adk-swisstopo opened a new issue, #75858: URL: https://github.com/apache/airflow/issues/75858
### Under which category would you file this issue? Airflow Core ### Apache Airflow version at least main, v3-4-stable ### What happened and how to reproduce it? A security issue affecting virtualenv (through its dependencies on uv and certifi) has been resolved in version 21.14.12. Airflow still depends on versions older than that. ``` $ git checkout v3-4-stable Switched to branch 'v3-4-stable' Your branch is up to date with 'origin/v3-4-stable'. $ egrep -A1 '^name = "virtualenv"' uv.lock name = "virtualenv" version = "21.14.10" ``` Could you please update your dependency on virtualenv to keep up with this security issue? See also: https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576 https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2 https://github.com/astral-sh/uv/security/advisories/GHSA-hq85-5cpj-mr62 ### What you think should happen instead? _No response_ ### Operating System _No response_ ### Deployment None ### Apache Airflow Provider(s) _No response_ ### Versions of Apache Airflow Providers _No response_ ### Official Helm Chart version Not Applicable ### Kubernetes Version _No response_ ### Helm Chart configuration _No response_ ### Docker Image customizations _No response_ ### Anything else? _No response_ ### Are you willing to submit PR? - [ ] Yes I am willing to submit a PR! ### Code of Conduct - [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
