fix: nmp-rl, launcher and python CVEs

[mckornfield]

Summary by CodeRabbit

• Security
  • Hardened the base container image by upgrading targeted security-sensitive system packages.
  • Reduced vulnerability scan noise by removing unused profiling tooling from the base image.
• Maintenance
  • Updated Python dependency minimum versions for GitPython and pyasn1 (including related remediation pins).
  • Refreshed Go dependencies, including a gRPC update and cleanup/reshuffling of indirectly pulled telemetry components.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 3af3116d-f82f-414e-a771-2e583ec44b30

📥 Commits

Reviewing files that changed from the base of the PR and between 1c38779 and 717d5e6.

⛔ Files ignored due to path filters (2)

• services/core/jobs/jobs-launcher/go.sum is excluded by !**/*.sum
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• docker/Dockerfile.auditor-tasks
• docker/Dockerfile.nmp-rl-base
• pyproject.toml
• services/core/jobs/jobs-launcher/go.mod

🚧 Files skipped from review as they are similar to previous changes (3)

• docker/Dockerfile.nmp-rl-base
• pyproject.toml
• services/core/jobs/jobs-launcher/go.mod

---

📝 Walkthrough

Walkthrough

The changes harden container images against CVEs, raise Python dependency minimums, remove unused Go telemetry dependencies, and update gRPC.

Changes

Container image hardening

Layer / File(s)	Summary
CVE remediation and profiler cleanup docker/Dockerfile.nmp-rl-base, docker/Dockerfile.auditor-tasks	Upgrades targeted Ubuntu packages, removes apt metadata and Nsight Systems artifacts, and raises the pyasn1 installation constraint.

Dependency updates

Layer / File(s)	Summary
Python dependency constraints pyproject.toml	Raises minimum versions for GitPython and pyasn1 in uv constraints and overrides.
Go dependency graph services/core/jobs/jobs-launcher/go.mod	Removes indirect telemetry and Prometheus dependencies and updates gRPC to v1.82.1.

Possibly related PRs

• NVIDIA-NeMo/nemo-platform#617: Updates the auditor task CVE-remediation dependency installation.
• NVIDIA-NeMo/nemo-platform#762: Applies similar Docker image CVE hardening.
• NVIDIA-NeMo/nemo-platform#817: Updates the same Ubuntu package remediation in Dockerfile.nmp-rl-base.

Suggested reviewers: parkanzky

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the PR’s main change: fixing CVEs across nmp-rl, the launcher, and Python dependencies.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cve-0723/mck

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pyproject.toml`:
- Line 289: Update the explicit pyasn1 requirement in Dockerfile.auditor-tasks
from >=0.6.3 to >=0.6.4, matching the project constraint and ensuring the
auditor image cannot resolve the lower version.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 61e2ddbe-1745-4870-a11b-a528dc888519

📥 Commits

Reviewing files that changed from the base of the PR and between 53947a1 and 1c38779.

⛔ Files ignored due to path filters (2)

• services/core/jobs/jobs-launcher/go.sum is excluded by !**/*.sum
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• docker/Dockerfile.nmp-rl-base
• pyproject.toml
• services/core/jobs/jobs-launcher/go.mod

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	27120/34832	77.9%	62.1%
Integration Tests	15917/33544	47.4%	19.8%