potiuk opened a new pull request, #74224:
URL: https://github.com/apache/airflow/pull/74224
moto releases before 5.2.2 load their bundled EC2 data through
`../resources/…` paths with
`pkgutil.get_data()`. Python builds that carry the CVE-2026-3479 patch for
`pkgutil.get_data` reject `..`
in resource paths. Docker Hardened Images are one such build. On those
builds every EC2-backed test fails
in the lowest-dependency `Providers[amazon]` run. moto 5.2.2 loads the files
with
`load_resource("ec2/resources/…")` instead, so this raises the test floor to
5.2.2.
Found while moving the CI/PROD images to hardened Python base images
(#73038).
related: #73038
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Opus 5)
Generated-by: Claude Code (Opus 5) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
