[TRTLLM-6607] fix NSPECT issue

Signed-off-by: ZhanruiSunCh <184402041+ZhanruiSunCh@users.noreply.github.com>

Author: ZhanruiSunCh

constraints.txt

@@ -1,5 +1,2 @@
 # These vulnerabilities were inherited from the base image (pytorch:25.06-py3) and should be removed when the base image
 # is updated.
-
-# WAR against https://github.com/advisories/GHSA-8qvm-5x2c-j2w7
-protobuf>=4.25.8

docker/Dockerfile.multi

@@ -71,7 +71,7 @@ RUN GITHUB_MIRROR=${GITHUB_MIRROR} bash ./install.sh --mpi4py && rm install_mpi4
 ARG TORCH_INSTALL_TYPE="skip"
 RUN TORCH_INSTALL_TYPE=${TORCH_INSTALL_TYPE} bash ./install.sh --pytorch && rm install_pytorch.sh
 
-RUN bash ./install.sh --opencv && bash ./install.sh --protobuf && rm install.sh
+RUN bash ./install.sh --opencv && rm install.sh
 
 FROM ${TRITON_IMAGE}:${TRITON_BASE_TAG} AS triton
 

docker/common/install.sh

@@ -16,7 +16,6 @@ polygraphy=0
 mpi4py=0
 pytorch=0
 opencv=0
-protobuf=0
 
 while [[ $# -gt 0 ]]; do
     case $1 in
@@ -56,10 +55,6 @@ while [[ $# -gt 0 ]]; do
             opencv=1
             shift 1
             ;;
-        --protobuf)
-            protobuf=1
-            shift 1
-            ;;
         --all)
             base=1
             cmake=1
@@ -70,7 +65,6 @@ while [[ $# -gt 0 ]]; do
             mpi4py=1
             pytorch=1
             opencv=1
-            protobuf=1
             shift 1
             ;;
         *)
@@ -135,10 +129,3 @@ if [ $opencv -eq 1 ]; then
     rm -rf /usr/local/lib/python3*/dist-packages/cv2/
     pip3 install opencv-python-headless --force-reinstall --no-deps --no-cache-dir
 fi
-
-# WARs against security issues inherited from pytorch:25.06
-# * https://github.com/advisories/GHSA-8qvm-5x2c-j2w7
-if [ $protobuf -eq 1 ]; then
-    pip3 install --upgrade --no-cache-dir \
-    "protobuf>=4.25.8"
-fi

requirements.txt

@@ -33,7 +33,7 @@ prometheus_fastapi_instrumentator
 pydantic>=2.9.1
 pydantic-settings[yaml]
 omegaconf
-pillow==10.3.0
+pillow
 wheel<=0.45.1
 optimum
 # evaluate needs datasets>=2.0.0 which triggers datasets>3.1.0 which is not stable: https://github.com/huggingface/datasets/issues/7467