chore: Update Python and pyarrow to address CVEs (#15877) (#15885)

* Bump to Python 3.13.14



* Update pyarrow to 23.0.1



* Update uv lock file



* Remove --no-check-cerificate in scripts



---------

Signed-off-by: Charlie Truong <chtruong@nvidia.com>
Signed-off-by: NeMo Bot <nemo-bot@nvidia.com>
Co-authored-by: Charlie Truong <chtruong@nvidia.com>

Author: svcnvidia-nemo-ci

docker/Dockerfile

@@ -42,7 +42,7 @@
 ARG BASE_IMAGE=nvcr.io/nvidia/cuda-dl-base:26.04-cuda13.2-devel-ubuntu24.04
 FROM ${BASE_IMAGE} AS base-image
 ARG BASE_IMAGE
-ARG UV_VERSION=0.11.14
+ARG UV_VERSION=0.11.27
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV TRANSFORMERS_OFFLINE=0

pyproject.toml

@@ -446,7 +446,8 @@ override-dependencies = [
     "opencv-python-headless; sys_platform == 'never'",
     "lxml>=6.1.0",
     "gitpython>=3.1.50",
-    "mako>=1.3.12"
+    "mako>=1.3.12",
+    "pyarrow>=23.0.1"
 ]
 no-binary-package = [
     "causal-conv1d",

scripts/asr_language_modeling/ngram_lm/install_beamsearch_decoders.sh

@@ -41,7 +41,7 @@ fi
 aptupdate && apt-get upgrade -y && apt-get install -y swig liblzma-dev && rm -rf /var/lib/apt/lists/* # liblzma needed for flashlight decoder
 
 # install Boost package for KenLM
-wget https://archives.boost.io/release/1.80.0/source/boost_1_80_0.tar.bz2 --no-check-certificate && tar --bzip2 -xf $NEMO_PATH/boost_1_80_0.tar.bz2 && cd boost_1_80_0 && ./bootstrap.sh && b2install --layout=tagged link=static,shared threading=multi,single install -j4 && cd .. || echo FAILURE
+wget https://archives.boost.io/release/1.80.0/source/boost_1_80_0.tar.bz2 && tar --bzip2 -xf $NEMO_PATH/boost_1_80_0.tar.bz2 && cd boost_1_80_0 && ./bootstrap.sh && b2install --layout=tagged link=static,shared threading=multi,single install -j4 && cd .. || echo FAILURE
 export BOOST_ROOT=$NEMO_PATH/boost_1_80_0
 
 git clone https://github.com/NVIDIA/OpenSeq2Seq

scripts/installers/install_opengrm.sh

@@ -26,7 +26,7 @@ fi
 cd $DECODERS_PATH
 
 # Install OpenGrm OpenFST
-wget https://www.openfst.org/twiki/pub/FST/FstDownload/openfst-1.8.2.tar.gz --no-check-certificate && tar xvzf openfst-1.8.2.tar.gz && cd openfst-1.8.2 && ./configure --enable-grm && make -j4 && make -j4 install && cd ..
+wget https://www.openfst.org/twiki/pub/FST/FstDownload/openfst-1.8.2.tar.gz && tar xvzf openfst-1.8.2.tar.gz && cd openfst-1.8.2 && ./configure --enable-grm && make -j4 && make -j4 install && cd ..
 
 # Install OpenGrm Ngram
-OPENFSTPREFIX=$DECODERS_PATH/openfst-1.8.2/src &&  wget https://www.opengrm.org/twiki/pub/GRM/NGramDownload/ngram-1.3.14.tar.gz --no-check-certificate && tar xvzf ngram-1.3.14.tar.gz && cd ngram-1.3.14 && LDFLAGS="-L${OPENFSTPREFIX}/lib" CXXFLAGS="-I${OPENFSTPREFIX}/include" ./configure --prefix ${OPENFSTPREFIX} && make -j4 && make -j4 install && cd ..
+OPENFSTPREFIX=$DECODERS_PATH/openfst-1.8.2/src &&  wget https://www.opengrm.org/twiki/pub/GRM/NGramDownload/ngram-1.3.14.tar.gz && tar xvzf ngram-1.3.14.tar.gz && cd ngram-1.3.14 && LDFLAGS="-L${OPENFSTPREFIX}/lib" CXXFLAGS="-I${OPENFSTPREFIX}/include" ./configure --prefix ${OPENFSTPREFIX} && make -j4 && make -j4 install && cd ..