fix(customizer): address CVEs in unsloth and automodel

[soluwalana]

Summary by CodeRabbit

• Bug Fixes
  • Updated bundled dependencies and runtime packages to newer versions for improved compatibility and stability.
  • Improved container startup behavior by ensuring the virtual environment tools are used by default.
  • Cleaned up leftover package artifacts and stale files in images to reduce conflicts during runtime.
  • Adjusted license metadata to reflect newly included third-party packages.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Dependency constraints and image pins were updated for jupyter-server, wandb, msgpack, mlflow-skinny, pyarrow, and cryptography. The Dockerfiles add OS package refresh and cleanup steps, adjust the unsloth install path, and update third-party license metadata snapshots.

Changes

Container dependency and license metadata updates

Layer / File(s)	Summary
Core dependency contracts pyproject.toml, services/unsloth/pyproject.toml	The uv constraints raise jupyter-server, add msgpack, bump wandb, and move wandb and mlflow-skinny into core dependencies.
Training runtime and requirement pins docker/Dockerfile.nmp-automodel-training, docker/Dockerfile.nmp-unsloth-training, docker/automodel/no_override_requirements.txt, docker/unsloth/no_override_requirements.txt	PATH is prepended with ${VIRTUAL_ENV}/bin, the unsloth install path changes, and both no-override requirement files pin wandb to 0.28.0.
Automodel builder dependency refresh docker/Dockerfile.nmp-automodel-base	The builder-stage dependency block repins jupyter-server, switches wandb to a range, adds msgpack and cryptography pins, and removes PyAV/OpenCV artifacts from the venv.
Final-stage maintenance docker/Dockerfile.nmp-automodel-base, docker/Dockerfile.nmp-unsloth-training	Both Dockerfiles add apt-get update plus noninteractive openssl and libssl3t64 updates, and the final cleanup blocks remove jupyter_server and Nsight Systems CLI artifacts.
Third-party license manifest updates third_party/licenses.jsonl	New records are added for databricks-sdk, gitdb, gitpython, google-auth, mlflow-skinny, pyasn1, pyasn1-modules, smmap, and wandb, and sqlparse changes to NON-STANDARD with compatible: false.
OSV license snapshot updates third_party/osv-licenses.json	Matching package entries are added, several opentelemetry-* versions are updated, and license summary counts are adjusted.

Possibly related PRs

• NVIDIA-NeMo/nemo-platform#452: Also changes docker/Dockerfile.nmp-automodel-base dependency pins and FFmpeg-related cleanup.
• NVIDIA-NeMo/nemo-platform#463: Also updates W&B dependency handling and image artifact cleanup in the Docker build path.
• NVIDIA-NeMo/nemo-platform#464: Also changes wandb, mlflow-skinny, and jupyter_server-related dependency cleanup.

Suggested reviewers

• gabwow
• ironcommit

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: CVE fixes applied to the unsloth and automodel customizer images.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch solu/cves3

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

docker/Dockerfile.nmp-automodel-base (1)

108-113: 📐 Maintainability & Code Quality | 🟡 Minor

Drop the duplicate wandb spec. uv treats repeated package requirements as conflicting, so keep only one of wandb>=0.27.2,<1 or wandb==0.27.2 in docker/Dockerfile.nmp-automodel-base:108-113.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docker/Dockerfile.nmp-automodel-base` around lines 108 - 113, The dependency
list in the Dockerfile has a duplicate wandb requirement that uv treats as
conflicting. In the package install block, keep only one wandb specifier by
removing either the broad version range or the pinned wandb==0.27.2 entry, and
leave the other dependencies unchanged.

🧹 Nitpick comments (1)

docker/Dockerfile.nmp-automodel-base (1)

126-129: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Comment at Lines 123-125 now mismatches its target.

The rm -rf (not pip uninstall) note now sits above the new apt openssl RUN instead of the dist-packages rm -rf (Line 130). Move the apt RUN below the cleanup block, or relocate the comment, to avoid confusion.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docker/Dockerfile.nmp-automodel-base` around lines 126 - 129, The comment
placement is now misleading because the `rm -rf (not pip uninstall)` note no
longer matches the cleanup it refers to. In `Dockerfile.nmp-automodel-base`,
move the new `apt-get update` / `apt-get install` `RUN` block so it comes after
the dist-packages cleanup block, or relocate the comment to sit directly above
the cleanup it describes. Keep the existing `RUN` instructions grouped logically
so the comment and the referenced `rm -rf` remain aligned.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@docker/Dockerfile.nmp-automodel-base`:
- Around line 108-113: The dependency list in the Dockerfile has a duplicate
wandb requirement that uv treats as conflicting. In the package install block,
keep only one wandb specifier by removing either the broad version range or the
pinned wandb==0.27.2 entry, and leave the other dependencies unchanged.

---

Nitpick comments:
In `@docker/Dockerfile.nmp-automodel-base`:
- Around line 126-129: The comment placement is now misleading because the `rm
-rf (not pip uninstall)` note no longer matches the cleanup it refers to. In
`Dockerfile.nmp-automodel-base`, move the new `apt-get update` / `apt-get
install` `RUN` block so it comes after the dist-packages cleanup block, or
relocate the comment to sit directly above the cleanup it describes. Keep the
existing `RUN` instructions grouped logically so the comment and the referenced
`rm -rf` remain aligned.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 67132824-fb1b-4f17-86e8-6d3942165383

📥 Commits

Reviewing files that changed from the base of the PR and between 6bced94 and 12559c7.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• docker/Dockerfile.nmp-automodel-base
• docker/Dockerfile.nmp-automodel-training
• docker/Dockerfile.nmp-unsloth-training
• pyproject.toml

💤 Files with no reviewable changes (1)

• docker/Dockerfile.nmp-automodel-training

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	21322/27924	76.4%	61.4%
Integration Tests	12354/26693	46.3%	19.8%

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docker/Dockerfile.nmp-automodel-base`:
- Around line 136-142: The Dockerfile currently installs the VLM extra but then
removes av/cv2 packages, leaving a broken runtime for the supported VLM paths.
Update the image build in Dockerfile.nmp-automodel-base so the packages required
by the VLM flow remain available: either stop enabling the affected
extra/packages during install or replace the post-sync deletion with patched
PyAV/OpenCV wheels. Verify the build steps that install --extra vlm and the VLM
support paths stay consistent with the final site-packages contents.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c2ce1b23-f18b-48a8-9d3f-86471d2be5bc

📥 Commits

Reviewing files that changed from the base of the PR and between 78cc61d and 4a18c07.

📒 Files selected for processing (1)

• docker/Dockerfile.nmp-automodel-base

[ironcommit]

LGTM