Merge pull request #22 from Azure-Samples/enchen/uv

Fix pip security vulnerability and uv installation

Author: Emma-ms

.devcontainer/devcontainer.json

@@ -17,7 +17,7 @@
             ]
         }
     },
-    "postCreateCommand": "cd server && pip install git+https://github.com/astral-sh/uv.git && uv sync",
+    "postCreateCommand": "pip install --upgrade pip && cd server && pip install uv && uv sync",
     "remoteUser": "vscode",
     "hostRequirements": {
         "memory": "4gb"

server/Dockerfile

@@ -27,6 +27,9 @@ ENV UV_LINK_MODE=copy \
 # Create virtual environment explicitly
 RUN python -m venv /app/.venv
 
+# Upgrade pip in the virtual environment to fix security vulnerability GHSA-4xh5-x5gv-qwph
+RUN /app/.venv/bin/pip install --upgrade pip
+
 # Copy dependency files
 COPY pyproject.toml uv.lock /app/