fix(security): upgrade pillow and remove from cache

[ironcommit]

Summary by CodeRabbit

• Bug Fixes
  • Improved runtime image consistency by pinning the Pillow dependency to a specific compatible version range.
  • Removed stale inherited Pillow-related files from the base image to prevent package conflicts and reduce potential security exposure.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 5993daab-1a85-42a3-849f-6e46c8049b93

📥 Commits

Reviewing files that changed from the base of the PR and between b154b39 and 3c3d628.

📒 Files selected for processing (1)

• docker/Dockerfile.nmp-customizer-tasks

🚧 Files skipped from review as they are similar to previous changes (1)

• docker/Dockerfile.nmp-customizer-tasks

---

📝 Walkthrough

Walkthrough

The Dockerfile pins Pillow to >=12.3.0,<13 in /opt/venv and removes inherited system-site Pillow files from the runtime image.

Changes

Pillow runtime alignment

Layer / File(s)	Summary
Pin and clean Pillow runtime docker/Dockerfile.nmp-customizer-tasks	Adds the Pillow version constraint to the runtime installation and removes system-site PIL, pillow.libs, and Pillow metadata during cleanup.

Possibly related PRs

• NVIDIA-NeMo/nemo-platform#817: Modifies the same Dockerfile with matching Pillow pinning and stale-artifact cleanup.

Suggested reviewers: anastasia-nesterenko, mckornfield

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: upgrading Pillow and removing cached/system copies for security.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch upgrade-pillow

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docker/Dockerfile.nmp-customizer-tasks`:
- Around line 113-114: Update the existing rm -rf package cleanup list in the
Dockerfile to include /usr/local/lib/python3.12/dist-packages/pillow.libs
alongside the PIL and pillow-*.dist-info paths, removing Pillow’s bundled native
libraries from the image.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f1d6be72-618a-4250-95cd-9776e35a911f

📥 Commits

Reviewing files that changed from the base of the PR and between 07f6290 and b154b39.

📒 Files selected for processing (1)

• docker/Dockerfile.nmp-customizer-tasks

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	27162/34869	77.9%	62.1%
Integration Tests	15969/33581	47.5%	20.0%

[mckornfield]

this is sorta a subset of what I had in https://github.com/NVIDIA-NeMo/nemo-platform/pull/817/changes