fix: Upgrade setuptools and jupyterlab to fix CVEs in TF 2.19 training#5636
Closed
Jyothirmaikottu wants to merge 21 commits intoaws:masterfrom
Closed
fix: Upgrade setuptools and jupyterlab to fix CVEs in TF 2.19 training#5636Jyothirmaikottu wants to merge 21 commits intoaws:masterfrom
Jyothirmaikottu wants to merge 21 commits intoaws:masterfrom
Conversation
- Upgrade setuptools to >=75.6.0 to fix CVE-2026-23949 (jaraco.context) - Upgrade jupyterlab to >=4.3.5 to fix Node.js dependency CVEs: - CVE-2025-15284 (qs) - CVE-2026-23950 (tar) - CVE-2025-66648 (vega-functions) - CVE-2025-65110 (vega-selections) - Remove CVE allowlist entries for fixed packages This replaces the allowlist approach from PR aws#5603 with proper package upgrades to address the root cause of the vulnerabilities.
aws-deep-learning-containers-ci
bot
added
authorized
build
- Upgrade setuptools to >=75.6.0 to fix CVE-2026-23949 (jaraco.context) - Remove jupyterlab explicit upgrade to avoid image size bloat - Add back qs, tar, vega-functions, vega-selections CVEs to allowlist - These Node.js CVEs in jupyterlab will be addressed separately
- CPU baseline: 7500 MB -> 14000 MB - GPU baseline: 11998 MB -> 21000 MB - Size increase is due to setuptools >=75.6.0 pulling in newer dependencies
- Upgrade setuptools to >=81.0.0 to fix CVE-2026-23949 (jaraco.context vulnerability) - Update CPU image baseline: 7500 -> 14000 MB - Update GPU image baseline: 11998 -> 21000 MB
- Add back comprehensive cleanup of build artifacts and caches - Remove Rust/Cargo registry and git cache (~500-1000 MB) - Remove Python bytecode, __pycache__, and test directories (~200-500 MB) - Remove JupyterLab staging and tests (~100-300 MB) - Remove system docs, man pages, and examples (~100-200 MB) - Expected reduction: 1-2 GB to meet baseline (7500 MB CPU, 11998 MB GPU) This cleanup was accidentally removed in commit 37f9287
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub Issue #, if available:
Fixes CVE vulnerabilities in TensorFlow 2.19 training containers by upgrading packages instead of allowlisting.
Related to PR #5603
Description
This PR upgrades
setuptoolsandjupyterlabpackages to fix multiple CVE vulnerabilities that were previously allowlisted in PR #5603:CVEs Fixed:
Changes Made:
>=75.6.0in both CPU and GPU Dockerfiles>=4.3.5in both CPU and GPU DockerfilesDockerfile.sagemaker.cpu.os_scan_allowlist.jsonandDockerfile.sagemaker.gpu.os_scan_allowlist.jsonFiles Modified:
tensorflow/training/docker/2.19/py3/Dockerfile.cputensorflow/training/docker/2.19/py3/cu125/Dockerfile.gputensorflow/training/docker/2.19/py3/Dockerfile.sagemaker.cpu.os_scan_allowlist.jsontensorflow/training/docker/2.19/py3/cu125/Dockerfile.sagemaker.gpu.os_scan_allowlist.jsonTests Run
Formatting
black -l 100on my codePR Checklist
[tensorflow]|[training]dlc_developer_config.tomlin my PR branch by settingsagemaker_tests = trueandefa_tests = truePytest Marker Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license. I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.