pytorch: remove old pip/setuptools/wheel pkgs

Author: jondea

ML-Frameworks/pytorch-aarch64/Dockerfile

@@ -65,8 +65,12 @@ RUN echo 'export PATH="$HOME/.local/bin:$PATH"' >>  /etc/bash.bashrc
 WORKDIR /home/$DOCKER_USER
 USER $DOCKER_USER
 
+# Update to newer pip/setuptools/wheel (setuptools>= 70.0.0 due to CVE-2024-6345 and CVE-2025-47273)
+# and delete old system version (we essentially use apt:python3-pip to bootstrap pip)
+RUN pip install --upgrade pip~=25.2 setuptools~=78.1.1 wheel~=0.45.1 \
+    && sudo rm -r /usr/lib/python3/dist-packages/
+
 # Base requirements for examples, excluding torch and torch*
-RUN pip install --upgrade pip
 COPY requirements.txt ./
 RUN pip install -r requirements.txt
 

ML-Frameworks/pytorch-aarch64/requirements.txt

@@ -28,7 +28,6 @@ PyYAML~=6.0.2
 regex==2024.9.11
 requests~=2.32.3
 safetensors~=0.4.5
-setuptools~=78.1.1    # >= 70.0.0 due to CVE-2024-6345 and CVE-2025-47273
 six~=1.16.0
 sympy~=1.13.1
 tiktoken~=0.9.0
@@ -38,5 +37,3 @@ transformers~=4.55.2  # >= 4.50.0 due to CVE-2025-2099
 typing_extensions~=4.12.2
 tzdata==2024.2
 urllib3~=2.2.3
-wheel~=0.38.0         # >= 0.38.0 due to CVE-2022-40898
-