chore: CVE updates and additional skill

[mckornfield]

Summary by CodeRabbit

• Security & Maintenance

  • Updated the Python and Go build environments with newer system and compiler versions, including security fixes.
  • Tightened the supported cryptography package version range to improve consistency and security across builds.

• Development Experience

  • Removed the notebook package from development dependencies, simplifying the development setup.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 389c10cf-7f04-44fa-9cd7-70fa2b8b05b1

📥 Commits

Reviewing files that changed from the base of the PR and between d299b43 and a5892d4.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• docker/Dockerfile.bake
• docker/base/Dockerfile.nmp-jobs-launcher
• pyproject.toml

🚧 Files skipped from review as they are similar to previous changes (3)

• docker/Dockerfile.bake
• docker/base/Dockerfile.nmp-jobs-launcher
• pyproject.toml

---

📝 Walkthrough

Walkthrough

The PR updates container base and system packages, removes the notebook development dependency, and constrains cryptography resolution to the 48.x release range.

Changes

Build and dependency remediation

Layer / File(s)	Summary
Build and dependency remediation pyproject.toml, docker/Dockerfile.bake, docker/base/Dockerfile.nmp-jobs-launcher	Removes the notebook development dependency, constrains cryptography to >=48.0.1,<49, upgrades system packages during the Python image build, and updates the Go builder image to 1.25.12.

Possibly related PRs

• NVIDIA-NeMo/nemo-platform#617: Updates Docker build steps with an apt-get upgrade for container CVE remediation.

Suggested reviewers: ironcommit

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: CVE-related dependency and base image updates.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cve-update-0715/mck

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

docker/Dockerfile.bake (1)

31-46: 🧹 Nitpick | 🔵 Trivial

apt-get upgrade -y trades build reproducibility for freshness.

Reasonable for CVE remediation, but unpinned upgrades mean rebuilding the same commit later can pull different package versions. Consider a dated/pinned snapshot repo if reproducible builds matter here.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docker/Dockerfile.bake` around lines 31 - 46, Remove the unpinned apt-get
upgrade step from the Docker image dependency installation command. Keep apt-get
update, the existing package list, cleanup, and apt lists removal unchanged; use
a pinned or dated repository only if reproducible upgrade behavior is explicitly
required.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.agents/skills/address-cves/scripts/summarize_findings.py:
- Around line 157-220: Update emit_markdown so Critical and High counts use
nvd_severity when the finding’s scanner severity is not Critical or High and NVD
advisory inclusion produced the finding. Keep the existing category grouping and
ensure the counts table totals every Critical/High finding displayed in the
Findings section.

---

Nitpick comments:
In `@docker/Dockerfile.bake`:
- Around line 31-46: Remove the unpinned apt-get upgrade step from the Docker
image dependency installation command. Keep apt-get update, the existing package
list, cleanup, and apt lists removal unchanged; use a pinned or dated repository
only if reproducible upgrade behavior is explicitly required.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2e2b4a6a-159a-4fa4-b1c5-38b8b437c720

📥 Commits

Reviewing files that changed from the base of the PR and between 4b2b0d7 and d299b43.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (7)

• .agents/skills/address-cves/SKILL.md
• .agents/skills/address-cves/agents/openai.yaml
• .agents/skills/address-cves/references/finding-sources.md
• .agents/skills/address-cves/scripts/summarize_findings.py
• docker/Dockerfile.bake
• docker/base/Dockerfile.nmp-jobs-launcher
• pyproject.toml

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	25521/32723	78.0%	62.6%
Integration Tests	14715/31372	46.9%	19.2%

[ironcommit]

Not sure of the usefulness of the skill, but the other patches LGTM