Upgrade base image to release-colab-external-images_20261027-060057_RC00

Dockerfile.tmpl

@@ -1,7 +1,7 @@
 {{ if eq .Accelerator "gpu" }}
-FROM us-docker.pkg.dev/colab-images/public/runtime:release-colab-external-images_20260917-060051_RC00
+FROM us-docker.pkg.dev/colab-images/public/runtime:release-colab-external-images_20261027-060057_RC00
 {{ else }}
-FROM us-docker.pkg.dev/colab-images/public/cpu-runtime:release-colab-external-images_20260917-060051_RC00
+FROM us-docker.pkg.dev/colab-images/public/cpu-runtime:release-colab-external-images_20261027-060057_RC00
 {{ end}}
 
 ADD kaggle_requirements.txt /kaggle_requirements.txt
@@ -13,14 +13,6 @@ RUN pip freeze | grep -E 'tensorflow|keras|torch|jax' > /colab_requirements.txt
 RUN cat /colab_requirements.txt >> /requirements.txt
 RUN cat /kaggle_requirements.txt >> /requirements.txt
 
-# GHSA-hq85-5cpj-mr62: uv < 0.13.4 vendors a CA bundle that trusts emSign intermediates with compromised keys.
-# Upgrade it first so the patched uv performs all subsequent installs.
-# The base image's uv may not be the pip-managed one, so point every uv on PATH at the new binary.
-# TODO(b/576329498): Remove once base image ships with newer uv, pip and certifi packages.
-RUN uv pip install --system --no-cache "uv>=0.13.4" && \
-    NEW_UV="$(python -c 'import uv; print(uv.find_uv_bin())')" && \
-    for old in $(which -a uv); do [ "$old" -ef "$NEW_UV" ] || ln -sf "$NEW_UV" "$old"; done
-
 # Install Kaggle packages
 RUN uv pip install --system --no-cache -r /requirements.txt
 
@@ -33,11 +25,9 @@ RUN uv pip uninstall --system --no-cache google-cloud-bigquery-storage
 RUN uv pip install --no-build-isolation --no-cache --system "git+https://github.com/Kaggle/learntools"
 
 # b/404590350: Ray and torchtune have conflicting cli named `tune`. `ray` is not part of Colab's base image. Re-install `tune` to ensure the torchtune CLI is available by default.
-# b/468367647: Unpin protobuf, version greater than v5.29.5 causes issues with numerous packages
-# grpcio-tools must be installed here (not in kaggle_requirements.txt) to stay version-compatible with protobuf.
 # setuptools v82+ removed pkg_resources
 RUN uv pip install --system --force-reinstall --no-cache --no-deps torchtune
-RUN uv pip install --system --force-reinstall --no-cache "protobuf==5.29.5" "grpcio-tools>=1.60.0" "setuptools>=70.0,<82"
+RUN uv pip install --system --force-reinstall --no-cache "grpcio-tools>=1.60.0" "setuptools>=70.0,<82"
 
 # Adding non-package dependencies:
 ADD clean-layer.sh  /tmp/clean-layer.sh
@@ -56,9 +46,6 @@ RUN uv pip install --system --no-cache "pycuda"
 # as described by Lionel Chan at http://stackoverflow.com/a/37426929/5881346
 RUN sed -i "s/httpredir.debian.org/debian.uchicago.edu/" /etc/apt/sources.list && \
     apt-get update --allow-releaseinfo-change && \
-    # Debian's trixie-security ca-certificates 20250419+deb13u1 blocklists it in the system store.
-    # TODO(b/576329498): Remove upgrade to ca-certificates once the base image ships the newer version.
-    apt-get install --no-install-recommends -y --only-upgrade ca-certificates && \
     # Needed by lightGBM (GPU build)
     # https://lightgbm.readthedocs.io/en/latest/GPU-Tutorial.html#build-lightgbm
     apt-get install -y build-essential unzip cmake libboost-dev libboost-system-dev libboost-filesystem-dev p7zip-full && \

kaggle_requirements.txt

@@ -15,8 +15,6 @@ bayesian-optimization
 boto3
 catboost
 category-encoders
-# GHSA-6q48-6c7w-9gw2: older bundles trust emSign intermediates with compromised keys.
-certifi>=2026.10.19
 cesium
 comm
 cytoolz
@@ -110,8 +108,6 @@ pdf2image
 # The base image ships pillow 11.3; pin up to a newer release.
 # Remove once the base image ships >=12.2 itself.
 pillow>=12.2
-# pip < 26.2.2 always loads its vendored certifi, so it needs the GHSA-6q48-6c7w-9gw2 fix separately.
-pip>=26.2.2
 plotly-express
 pudb
 pyLDAvis