ASolarers-Rodriguez opened a new pull request, #43519: URL: https://github.com/apache/superset/pull/43519
### SUMMARY SCA scanners that match declared **minimum** versions rather than resolved/installed versions (Black Duck and similar tools) flag Pillow and PyJWT here at their old floors (`>=11.0.0`, `>=2.4.0`) even though `requirements/base.txt` has resolved `12.3.0` / `2.13.0` for a while. Every other floor in this dependency block — flask, gunicorn, cryptography, Mako, markdown — was already raised to match its resolved pin; these two were missed. This PR just raises the two floors to match what's already resolved. **No lockfile changes** — `scripts/uv-pip-compile.sh` produces a zero-diff on `requirements/base.txt`/`development.txt`/`translations.txt`, confirming the floors now equal the already-resolved versions. We hit this concretely: a customer's Black Duck scan of a build cut from master flagged Pillow/PyJWT at the old floor versions as a false positive, the same class of finding already fixed on a downstream release line we maintain. Since some of our release lines are cut directly from master snapshots (no maintained release branch), fixing it here closes the gap for all of them going forward. ### TESTING INSTRUCTIONS `./scripts/uv-pip-compile.sh` produces no changes to `requirements/*.txt` — floors now match what was already resolved, so behavior is unchanged. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
