Remove unneeded dependencies (#682)

* remove wheel runtime dependency

It is only needed as a build dependency

* dont install pip into venv

* remove setuptools dependency after build

Dockerfile

@@ -10,8 +10,7 @@ ADD . /logprep
 WORKDIR /logprep
 RUN curl https://sh.rustup.rs -sSf | bash -s -- -y
 ENV PATH="/root/.cargo/bin:${PATH}"
-RUN python -m pip install --upgrade pip wheel setuptools>=72.2.0
-RUN python -m venv /opt/venv
+RUN python -m venv --without-pip /opt/venv
 # Make sure we use the virtualenv:
 ENV PATH="/opt/venv/bin:$PATH"
 
@@ -20,6 +19,10 @@ RUN if [ "$LOGPREP_VERSION" = "dev" ]; then pip install .;\
     else pip install "logprep==$LOGPREP_VERSION"; fi; \
     logprep --version
 
+# geoip2 4.8.0 lists a vulnerable setuptools version as a dependency. setuptools is unneeded at runtime, so it is uninstalled.
+# More recent (currently unreleased) versions of geoip2 removed setuptools from dependencies.
+RUN pip uninstall -y setuptools
+
 
 FROM bitnami/python:${PYTHON_VERSION} as prod
 ARG http_proxy

pyproject.toml

@@ -85,7 +85,6 @@ dependencies = [
   "urlextract",
   "urllib3>=1.26.17",         # CVE-2023-43804
   "uvicorn",
-  "wheel",
   "deepdiff",
   "msgspec",
   "boto3",