[PawelPeczek-Roboflow]

What does this PR do?

Resolve security issues with dependencies that could be easily bumped.

Type of Change

• Bug fix (non-breaking change that fixes an issue)

Testing

• CI
• I have tested this change locally
• I have added/updated tests for this change

Test details:

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code where necessary, particularly in hard-to-understand areas
• My changes generate no new warnings or errors
• I have updated the documentation accordingly (if applicable)

Additional Context

[github-actions]

👋 Thanks for the pull request! Here is how automated Claude review works here, so you spend credits (and reviewer time) wisely.

🚦 This PR is marked Ready for review, so automated Claude review will run — and every pass spends real credits.

Warning

💸 The Claude reviewer bills in credits, not vibes

Automated review spins up a real agent that reads real code and spends real credits on every pass. It is glad to help — but it is not a rubber duck, a linter you poke in a loop, or a substitute for reading the contributing guide. Treat it like an expensive senior reviewer whose time you booked, and show up prepared.

Draft when unsure, Ready when you mean it:

• 🌱 Not sure the PR is in good shape yet? Keep it (or set it back) as a draft — drafts pause review, so you can push and iterate without burning credits on a moving target.
• 💪 Feel strong about the contents? Mark it Ready for review and the reviewer will take a look.

However you get there, arrive prepared:

• 🧱 Bring a SOLID, thorough PR. Point your local agent at our skills/ to tune it to our guidelines first — or, if you are one of those fabled carbon-based contributors, read them yourself. A half-baked diff costs exactly the same to review as a finished one.
• ✅ Resolve every comment before you re-request review. Re-requesting with threads still open means paying twice for the same conversation.
• 🔁 Do not use CI review as an inner loop for a local agent. The reviewer is not a step-by-step debugger — do the unfolding locally and arrive with the answer, not the search.
• 🙋 If something looks off, ask a human. One question to a maintainer is cheaper and faster than three rounds of agent re-review chasing a misread.

Reviews are not free. A draft costs nothing to review; a Ready PR is a promise that it is worth reviewing.

• Prefer to skip automated review entirely? Add the skip-claude-review label.

[github-actions]

🤖 Claude review started at commit 74435304377d91d55ca610c64b1d58f7553acda8.

New commits are not auto-reviewed. Add the claude-review label to request a re-review — the label is consumed when the review starts, so just add it again next time.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​next@​16.3.8 ⏵ 16.4.3	+1	+75	+1
	pypi/​black@​26.3.1 ⏵ 26.10.1	+1	+16

View full report

[github-actions]

High: this conflicts with the setuptools~=83.0.0 pins still in the Dockerfiles, so Docker image builds will fail to resolve.

Most Dockerfiles install this file together with a hard setuptools~=83.0.0 (which means >=83.0.0,<83.1) in a single pip install. For example, docker/dockerfiles/Dockerfile.onnx.cpu:40-53:

-r _requirements.txt \      # now setuptools>=84.1.0
-r requirements.cpu.txt \   # inference-models==0.39.6 -> setuptools>=84.1.0
...
"setuptools~=83.0.0" \

pip can't satisfy both, so it fails with ResolutionImpossible. The same pin also appears in the wheel-install step (Dockerfile.onnx.cpu:62, dist/inference_core*.whl ... "setuptools~=83.0.0"), and inference_core's install_requires reads _requirements.txt.

Other files with the same ~=83.0.0 pin: Dockerfile.onnx.{cpu.dev,cpu.slim,cpu.parallel,gpu,gpu.dev,gpu.slim,gpu.3d,gpu.parallel,udp.gpu,trt,cu13.gpu} and Dockerfile.onnx.jetson.{5.1.1,6.2.0}. Unless they change, every CPU, GPU and Jetson server image breaks on the next build.

Fix: change these Dockerfile pins to setuptools~=84.2 (or >=84.1.0,<85) in this PR. Also check whether Dockerfile.wheels.jetson.7.2.0 (setuptools>=77,<82) installs inference-models in the same environment.

[github-actions]

Claude review summary

Status: blocked. One High finding needs fixing before this can merge.

Skills: review-packaging-ci, review-inference-models-pkg, review-topic-backward-compat-and-versioning, review-topic-test-hygiene

No dedicated surface skill covers inference_server/** or inference_model_manager/**, so those got the generic review plus topic skills only. The same applies to inference/landing/**; its generated out/ bundle and package-lock.json were not reviewed line by line.

Findings

• High: the Dockerfiles still pin setuptools~=83.0.0 in the same pip install as _requirements.txt and the inference-models==0.39.6 pins, which now require setuptools>=84.1.0. pip can't resolve both, so the CPU, GPU and Jetson server image builds break. Details are in the inline comment on requirements/_requirements.txt:23.

What checks out

• inference-models pins: all four inference-models pins (cpu/gpu/vino/jetson), plus gpu.cu13, moved together to 0.39.6. This matches inference_models/pyproject.toml and the version entry in inference_models/uv.lock.
• roboflow-workflows and streamvision: 0.2.14 / 0.1.4 match their pyproject.toml files, the editable entries in their own uv.lock files, and the requirements/requirements.{workflows,streamvision}.txt pins.
• CI wheel names: CI workflows find wheels with * globs, so no hardcoded wheel filenames needed updating.
• Changelogs: each changelog has its final version heading. No Execution Engine change: the bundled engine stays at 1.17.0.

Tests to add

• None at unit level. A Docker build smoke run of Dockerfile.onnx.cpu would have caught the setuptools conflict.

Commands that informed this review

gh pr diff 3274, gh pr view 3274, gh api (issue comments / review comments / reviews / commits, all paginated), grep -rn setuptools docker/dockerfiles requirements, grep for version strings across .github, requirements and the uv.lock files, sed -n 40,66p docker/dockerfiles/Dockerfile.onnx.cpu

Reviewed at HEAD: 7443530

[github-actions]

Release coordination (maintainers)

This PR needs release-time version changes for inference-models (0.39.6), roboflow-workflows (0.2.14) and streamvision (0.1.4). The Execution Engine does not change.

The version strings, pins and changelog headings are already in this PR. Publishing uses skip-existing, so make sure all three packages are actually published before the inference release picks up the == pins.

Reviewed at HEAD: 7443530