From 19082cda63138184f202eac175e8bdfd8b529883 Mon Sep 17 00:00:00 2001 From: Fabian Gonzalez Date: Tue, 11 Aug 2026 14:24:20 -0400 Subject: [PATCH 1/2] bump uv version, py bump idna, remove unecessary (but flagged) docker files Signed-off-by: Fabian Gonzalez --- python/Dockerfile | 10 +++++++++- python/Dockerfile.full | 2 +- python/pyproject.toml | 1 + python/uv.lock | 20 ++++++++++++-------- 4 files changed, 23 insertions(+), 10 deletions(-) diff --git a/python/Dockerfile b/python/Dockerfile index 38a946b61..e57e56c9b 100644 --- a/python/Dockerfile +++ b/python/Dockerfile @@ -1,5 +1,5 @@ ### STAGE 1: uv binary -ARG UV_VERSION=0.11.15 +ARG UV_VERSION=0.12.3 FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv-bin ### STAGE 2: builder @@ -54,6 +54,14 @@ RUN --mount=type=cache,target=/.kagent/cache,rw \ && uv venv --python=python$TOOLS_PYTHON_VERSION \ && uv lock && uv sync --package kagent-adk --no-editable \ && uv cache prune \ + # The standalone CPython build bundles pip (with vendored msgpack / + # pkg_resources) in its own site-packages. The runtime only uses the venv, + # so drop it rather than shipping CVE-flagged packages that nothing imports. + && rm -rf /python/cpython-*/lib/python*/site-packages/pip \ + /python/cpython-*/lib/python*/site-packages/pip-*.dist-info \ + /python/cpython-*/lib/python*/site-packages/setuptools \ + /python/cpython-*/lib/python*/site-packages/setuptools-*.dist-info \ + /python/cpython-*/lib/python*/site-packages/pkg_resources \ && echo "Installation complete." # Pre-create the config dir owned by the runtime user. On Agent Substrate the config is diff --git a/python/Dockerfile.full b/python/Dockerfile.full index 5452dabfc..1f8fecc3d 100644 --- a/python/Dockerfile.full +++ b/python/Dockerfile.full @@ -6,7 +6,7 @@ # and for sandboxed BYO agents. ### STAGE 1: uv binary -ARG UV_VERSION=0.11.15 +ARG UV_VERSION=0.12.3 FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv-bin ### STAGE 2: base os + sandbox runtime diff --git a/python/pyproject.toml b/python/pyproject.toml index 790319bcf..84a44345b 100644 --- a/python/pyproject.toml +++ b/python/pyproject.toml @@ -14,6 +14,7 @@ constraint-dependencies = [ "aiohttp>=3.14.3", "cryptography>=50.0.0", "httplib2>=0.32.0", + "idna>=3.15", "jaraco-context>=6.1.0", "joserfc>=1.6.8", "mako>=1.3.12", diff --git a/python/uv.lock b/python/uv.lock index 92f1d38c0..2db5c81b0 100644 --- a/python/uv.lock +++ b/python/uv.lock @@ -28,6 +28,7 @@ constraints = [ { name = "aiohttp", specifier = ">=3.14.3" }, { name = "cryptography", specifier = ">=50.0.0" }, { name = "httplib2", specifier = ">=0.32.0" }, + { name = "idna", specifier = ">=3.15" }, { name = "jaraco-context", specifier = ">=6.1.0" }, { name = "joserfc", specifier = ">=1.6.8" }, { name = "mako", specifier = ">=1.3.12" }, @@ -248,9 +249,9 @@ name = "aiologic" version = "0.17.1" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "sniffio" }, - { name = "typing-extensions" }, - { name = "wrapt" }, + { name = "sniffio", marker = "python_full_version < '3.13'" }, + { name = "typing-extensions", marker = "python_full_version < '3.13'" }, + { name = "wrapt", marker = "python_full_version < '3.13'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/f1/7a/d51f2fde1e8ae8a83431f8e97b7a71e9358cdb1d4d2ce6be387fa44d68de/aiologic-0.17.1.tar.gz", hash = "sha256:2e1b93b9e88ced318c2a63ad7b382688f40cbfe40e3d42258d49dc9c5aea179d", size = 252354, upload-time = "2026-06-27T20:41:33.25Z" } wheels = [ @@ -870,8 +871,8 @@ name = "culsans" version = "0.11.0" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "aiologic" }, - { name = "typing-extensions" }, + { name = "aiologic", marker = "python_full_version < '3.13'" }, + { name = "typing-extensions", marker = "python_full_version < '3.13'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/d9/e3/49afa1bc180e0d28008ec6bcdf82a4072d1c7a41032b5b759b60814ca4b0/culsans-0.11.0.tar.gz", hash = "sha256:0b43d0d05dce6106293d114c86e3fb4bfc63088cfe8ff08ed3fe36891447fe33", size = 107546, upload-time = "2025-12-31T23:15:38.196Z" } wheels = [ @@ -1285,6 +1286,7 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/fc/2e/d4fcb2978f826358b673f779f78fa8a32ee37df11920dc2bb5589cbeecef/greenlet-3.2.3-cp311-cp311-macosx_11_0_universal2.whl", hash = "sha256:784ae58bba89fa1fa5733d170d42486580cab9decda3484779f4759345b29822", size = 270219, upload-time = "2025-06-05T16:10:10.414Z" }, { url = "https://files.pythonhosted.org/packages/16/24/929f853e0202130e4fe163bc1d05a671ce8dcd604f790e14896adac43a52/greenlet-3.2.3-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:0921ac4ea42a5315d3446120ad48f90c3a6b9bb93dd9b3cf4e4d84a66e42de83", size = 630383, upload-time = "2025-06-05T16:38:51.785Z" }, { url = "https://files.pythonhosted.org/packages/d1/b2/0320715eb61ae70c25ceca2f1d5ae620477d246692d9cc284c13242ec31c/greenlet-3.2.3-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:d2971d93bb99e05f8c2c0c2f4aa9484a18d98c4c3bd3c62b65b7e6ae33dfcfaf", size = 642422, upload-time = "2025-06-05T16:41:35.259Z" }, + { url = "https://files.pythonhosted.org/packages/bd/49/445fd1a210f4747fedf77615d941444349c6a3a4a1135bba9701337cd966/greenlet-3.2.3-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:c667c0bf9d406b77a15c924ef3285e1e05250948001220368e039b6aa5b5034b", size = 638375, upload-time = "2025-06-05T16:48:18.235Z" }, { url = "https://files.pythonhosted.org/packages/7e/c8/ca19760cf6eae75fa8dc32b487e963d863b3ee04a7637da77b616703bc37/greenlet-3.2.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:592c12fb1165be74592f5de0d70f82bc5ba552ac44800d632214b76089945147", size = 637627, upload-time = "2025-06-05T16:13:02.858Z" }, { url = "https://files.pythonhosted.org/packages/65/89/77acf9e3da38e9bcfca881e43b02ed467c1dedc387021fc4d9bd9928afb8/greenlet-3.2.3-cp311-cp311-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:29e184536ba333003540790ba29829ac14bb645514fbd7e32af331e8202a62a5", size = 585502, upload-time = "2025-06-05T16:12:49.642Z" }, { url = "https://files.pythonhosted.org/packages/97/c6/ae244d7c95b23b7130136e07a9cc5aadd60d59b5951180dc7dc7e8edaba7/greenlet-3.2.3-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:93c0bb79844a367782ec4f429d07589417052e621aa39a5ac1fb99c5aa308edc", size = 1114498, upload-time = "2025-06-05T16:36:46.598Z" }, @@ -1293,6 +1295,7 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/f3/94/ad0d435f7c48debe960c53b8f60fb41c2026b1d0fa4a99a1cb17c3461e09/greenlet-3.2.3-cp312-cp312-macosx_11_0_universal2.whl", hash = "sha256:25ad29caed5783d4bd7a85c9251c651696164622494c00802a139c00d639242d", size = 271992, upload-time = "2025-06-05T16:11:23.467Z" }, { url = "https://files.pythonhosted.org/packages/93/5d/7c27cf4d003d6e77749d299c7c8f5fd50b4f251647b5c2e97e1f20da0ab5/greenlet-3.2.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:88cd97bf37fe24a6710ec6a3a7799f3f81d9cd33317dcf565ff9950c83f55e0b", size = 638820, upload-time = "2025-06-05T16:38:52.882Z" }, { url = "https://files.pythonhosted.org/packages/c6/7e/807e1e9be07a125bb4c169144937910bf59b9d2f6d931578e57f0bce0ae2/greenlet-3.2.3-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:baeedccca94880d2f5666b4fa16fc20ef50ba1ee353ee2d7092b383a243b0b0d", size = 653046, upload-time = "2025-06-05T16:41:36.343Z" }, + { url = "https://files.pythonhosted.org/packages/9d/ab/158c1a4ea1068bdbc78dba5a3de57e4c7aeb4e7fa034320ea94c688bfb61/greenlet-3.2.3-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:be52af4b6292baecfa0f397f3edb3c6092ce071b499dd6fe292c9ac9f2c8f264", size = 647701, upload-time = "2025-06-05T16:48:19.604Z" }, { url = "https://files.pythonhosted.org/packages/cc/0d/93729068259b550d6a0288da4ff72b86ed05626eaf1eb7c0d3466a2571de/greenlet-3.2.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:0cc73378150b8b78b0c9fe2ce56e166695e67478550769536a6742dca3651688", size = 649747, upload-time = "2025-06-05T16:13:04.628Z" }, { url = "https://files.pythonhosted.org/packages/f6/f6/c82ac1851c60851302d8581680573245c8fc300253fc1ff741ae74a6c24d/greenlet-3.2.3-cp312-cp312-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:706d016a03e78df129f68c4c9b4c4f963f7d73534e48a24f5f5a7101ed13dbbb", size = 605461, upload-time = "2025-06-05T16:12:50.792Z" }, { url = "https://files.pythonhosted.org/packages/98/82/d022cf25ca39cf1200650fc58c52af32c90f80479c25d1cbf57980ec3065/greenlet-3.2.3-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:419e60f80709510c343c57b4bb5a339d8767bf9aef9b8ce43f4f143240f88b7c", size = 1121190, upload-time = "2025-06-05T16:36:48.59Z" }, @@ -1301,6 +1304,7 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/b1/cf/f5c0b23309070ae93de75c90d29300751a5aacefc0a3ed1b1d8edb28f08b/greenlet-3.2.3-cp313-cp313-macosx_11_0_universal2.whl", hash = "sha256:500b8689aa9dd1ab26872a34084503aeddefcb438e2e7317b89b11eaea1901ad", size = 270732, upload-time = "2025-06-05T16:10:08.26Z" }, { url = "https://files.pythonhosted.org/packages/48/ae/91a957ba60482d3fecf9be49bc3948f341d706b52ddb9d83a70d42abd498/greenlet-3.2.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:a07d3472c2a93117af3b0136f246b2833fdc0b542d4a9799ae5f41c28323faef", size = 639033, upload-time = "2025-06-05T16:38:53.983Z" }, { url = "https://files.pythonhosted.org/packages/6f/df/20ffa66dd5a7a7beffa6451bdb7400d66251374ab40b99981478c69a67a8/greenlet-3.2.3-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:8704b3768d2f51150626962f4b9a9e4a17d2e37c8a8d9867bbd9fa4eb938d3b3", size = 652999, upload-time = "2025-06-05T16:41:37.89Z" }, + { url = "https://files.pythonhosted.org/packages/51/b4/ebb2c8cb41e521f1d72bf0465f2f9a2fd803f674a88db228887e6847077e/greenlet-3.2.3-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:5035d77a27b7c62db6cf41cf786cfe2242644a7a337a0e155c80960598baab95", size = 647368, upload-time = "2025-06-05T16:48:21.467Z" }, { url = "https://files.pythonhosted.org/packages/8e/6a/1e1b5aa10dced4ae876a322155705257748108b7fd2e4fae3f2a091fe81a/greenlet-3.2.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:2d8aa5423cd4a396792f6d4580f88bdc6efcb9205891c9d40d20f6e670992efb", size = 650037, upload-time = "2025-06-05T16:13:06.402Z" }, { url = "https://files.pythonhosted.org/packages/26/f2/ad51331a157c7015c675702e2d5230c243695c788f8f75feba1af32b3617/greenlet-3.2.3-cp313-cp313-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:2c724620a101f8170065d7dded3f962a2aea7a7dae133a009cada42847e04a7b", size = 608402, upload-time = "2025-06-05T16:12:51.91Z" }, { url = "https://files.pythonhosted.org/packages/26/bc/862bd2083e6b3aff23300900a956f4ea9a4059de337f5c8734346b9b34fc/greenlet-3.2.3-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:873abe55f134c48e1f2a6f53f7d1419192a3d1a4e873bace00499a4e45ea6af0", size = 1119577, upload-time = "2025-06-05T16:36:49.787Z" }, @@ -1553,11 +1557,11 @@ wheels = [ [[package]] name = "idna" -version = "3.10" +version = "3.18" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/f1/70/7703c29685631f5a7590aa73f1f1d3fa9a380e654b86af429e0934a32f7d/idna-3.10.tar.gz", hash = "sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9", size = 190490, upload-time = "2024-09-15T18:07:39.745Z" } +sdist = { url = "https://files.pythonhosted.org/packages/cd/63/9496c57188a2ee585e0f1db071d75089a11e98aa86eb99d9d7618fc1edce/idna-3.18.tar.gz", hash = "sha256:ffb385a7e039654cef1ab9ef32c6fafe283c0c0467bba1d9029738ce4a14a848", size = 196711, upload-time = "2026-06-02T14:34:07.794Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/76/c6/c88e154df9c4e1a2a66ccf0005a88dfb2650c1dffb6f5ce603dfbd452ce3/idna-3.10-py3-none-any.whl", hash = "sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3", size = 70442, upload-time = "2024-09-15T18:07:37.964Z" }, + { url = "https://files.pythonhosted.org/packages/1e/5e/d4e9f1a599fb8e573b7b87160658329fbf28d19eac2718f51fc3def3aa5a/idna-3.18-py3-none-any.whl", hash = "sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2", size = 65455, upload-time = "2026-06-02T14:34:06.319Z" }, ] [[package]] From 5eec69c220f43baa750c71f738ad2daa6db6277d Mon Sep 17 00:00:00 2001 From: Fabian Gonzalez Date: Wed, 12 Aug 2026 11:35:24 -0400 Subject: [PATCH 2/2] freeze uv sync + add uv check in workflow Signed-off-by: Fabian Gonzalez --- .github/workflows/ci.yaml | 4 ++++ python/Dockerfile | 5 ++++- python/Dockerfile.full | 2 +- 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index ac16d57f1..8db5b6833 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -461,6 +461,10 @@ jobs: - name: Install python run: uv python install 3.11 + - name: Verify uv.lock matches pyproject.toml + working-directory: ./python + run: uv lock --check + - name: Sync dependencies working-directory: ./python run: uv sync --all-extras diff --git a/python/Dockerfile b/python/Dockerfile index e57e56c9b..b562f88de 100644 --- a/python/Dockerfile +++ b/python/Dockerfile @@ -52,7 +52,7 @@ ARG VERSION RUN --mount=type=cache,target=/.kagent/cache,rw \ echo "Creating virtual environment and installing dependencies..." \ && uv venv --python=python$TOOLS_PYTHON_VERSION \ - && uv lock && uv sync --package kagent-adk --no-editable \ + && uv sync --frozen --package kagent-adk --no-editable \ && uv cache prune \ # The standalone CPython build bundles pip (with vendored msgpack / # pkg_resources) in its own site-packages. The runtime only uses the venv, @@ -62,6 +62,9 @@ RUN --mount=type=cache,target=/.kagent/cache,rw \ /python/cpython-*/lib/python*/site-packages/setuptools \ /python/cpython-*/lib/python*/site-packages/setuptools-*.dist-info \ /python/cpython-*/lib/python*/site-packages/pkg_resources \ + # Fail the build if pip survived (rm -rf on a non-matching glob exits 0, + # e.g. after a Python minor bump moves site-packages). + && ! "$(uv python find)" -c "import pip" 2>/dev/null \ && echo "Installation complete." # Pre-create the config dir owned by the runtime user. On Agent Substrate the config is diff --git a/python/Dockerfile.full b/python/Dockerfile.full index 1f8fecc3d..88326d580 100644 --- a/python/Dockerfile.full +++ b/python/Dockerfile.full @@ -97,7 +97,7 @@ ARG VERSION RUN --mount=type=cache,target=/.kagent/cache,uid=1001,gid=1001 \ echo "Creating virtual environment and installing dependencies..." \ && uv venv --python=python$TOOLS_PYTHON_VERSION \ - && uv lock && uv sync --package kagent-adk \ + && uv sync --frozen --package kagent-adk \ && uv cache prune \ && echo "Installation complete."