fix(customizer): unsloth image CVE resolution

[soluwalana]

Summary by CodeRabbit

• New Features

  • Updated the container base and training images to newer NVIDIA/PyTorch/CUDA builds for improved compatibility.
  • Added/strengthened pinned Python dependencies in the build environment, including mlflow-skinny and grpcio.

• Bug Fixes

  • Reduced runtime dependency conflicts by cleaning up stale preinstalled Python packages in the final images.
  • Improved installation alignment for CUDA 13.2 (including related wheel paths) and updated bitsandbytes to 0.49.2.

• Documentation

  • Refreshed CUDA compatibility notes for the updated training image.

[ironcommit]

LGTM

[coderabbitai]

📝 Walkthrough

Walkthrough

Updated Docker base tags and CUDA 13.2 image inputs, added runtime cleanup of stale system packages, and pinned mlflow-skinny in pyproject.toml.

Changes

Container dependency alignment

Layer / File(s)	Summary
Automodel base tag docker-bake.hcl	The pinned default tag for BASE_TAG_AUTOMODEL was changed.
Automodel base pins and cleanup docker/Dockerfile.nmp-automodel-base	Builder-stage installs add pinned mlflow-skinny and grpcio; the runtime stage removes stale system distributions from /usr/local/lib/python3.12/dist-packages.
Training image CUDA and wheel alignment docker/Dockerfile.nmp-unsloth-training	The training image moves to nvcr.io/nvidia/pytorch:26.05-py3, bumps bitsandbytes, switches wheel paths to CUDA 13.2, and adds venv pinning plus system package cleanup.
Project dependency pinning and formatting pyproject.toml	mlflow-skinny is pinned in the dev group, and the tool.uv dependency sections are reformatted without specifier changes.

Possibly related PRs

• NVIDIA-NeMo/nemo-platform#445: Updates Docker base tags and the pinned default used by docker-bake.hcl.
• NVIDIA-NeMo/nemo-platform#452: Changes docker/Dockerfile.nmp-automodel-base dependency setup and version pins.

Suggested reviewers

• anubhutivyas
• gabwow

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: updating the Unsloth image and related dependencies to address CVEs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch solu/cves2

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docker/Dockerfile.nmp-automodel-base`:
- Around line 136-137: The cleanup in the Dockerfile still targets the grpcio
package metadata instead of the actual runtime package. Update the dist-packages
removal list to delete the top-level grpc directory rather than grpcio, and keep
the existing grpcio-*.dist-info cleanup so the installed code is fully removed.

In `@docker/Dockerfile.nmp-unsloth-training`:
- Line 176: The Docker dependency pin for aiohttp is still lower than the
project requirement, so update the aiohttp constraint in
docker/Dockerfile.nmp-unsloth-training to match the floor used in
pyproject.toml. Locate the aiohttp package entry in the Dockerfile and raise the
minimum version from 3.13.3 to 3.13.4 so the container build matches the
declared dependency policy.

In `@pyproject.toml`:
- Line 88: The mlflow-skinny dependency floor in pyproject.toml is still lower
than the training image constraint; update the dependency entry for
mlflow-skinny so its minimum version matches the Dockerfiles’ 3.11.1 floor while
keeping the existing upper bound and intent of the optional fine-tuning
dependency.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0cdb9ff9-2bfe-48a0-9ebf-2c47c1825f6a

📥 Commits

Reviewing files that changed from the base of the PR and between f542481 and 458d5f9.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• docker/Dockerfile.nmp-automodel-base
• docker/Dockerfile.nmp-unsloth-training
• pyproject.toml

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	20911/27483	76.1%	61.2%
Integration Tests	12109/26252	46.1%	19.5%

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docker-bake.hcl`:
- Line 78: The automodel docs and eval comments still describe the default base
reference as local or $BAKE_TAG, but the pinned prebuilt base tag is now the
source of truth. Update the documentation and any related comments in the
automodel README and the image-env script so they describe BASE_TAG_AUTOMODEL as
only relevant when USE_PREBUILT_BASES is enabled, and make sure the wording
matches the pinned tag used by the bake configuration.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 85865e84-5eae-4b5f-8448-21bca08c84e6

📥 Commits

Reviewing files that changed from the base of the PR and between 458d5f9 and 2322544.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• docker-bake.hcl
• docker/Dockerfile.nmp-automodel-base
• docker/Dockerfile.nmp-unsloth-training
• pyproject.toml

🚧 Files skipped from review as they are similar to previous changes (3)

• pyproject.toml
• docker/Dockerfile.nmp-automodel-base
• docker/Dockerfile.nmp-unsloth-training