FrancescoCastaldi opened a new pull request, #45186:
URL: https://github.com/apache/superset/pull/45186
### Summary
This PR addresses and resolves #45087 by updating the security floors and
supported version ranges for `cryptography`, `msgpack`, and `pyarrow`. This
resolves container security scanner (Trivy) HIGH/MEDIUM vulnerability findings
without causing pip dependency resolver conflicts in Apache Superset.
### Key Changes
- **`cryptography`**:
- Widened the supported version constraint range to `>=48.0.1, <51.0.0`
(previously `<47.0.0`), allowing fixed releases (48.0.1+, 49.0.0, 50.0.0,
50.0.2) to remediate CVE-2026-69247, CVE-2026-69249, GHSA-537c-gmf6-5ccf, and
CVE-2026-69248.
- Verified modern cryptography hazmat compatibility and keypair private
key PKCS8 DER encoding in `superset/db_engine_specs/snowflake.py`.
- **`msgpack`**:
- Widened constraint range to `>=1.2.1, <1.3` (previously `<1.1`),
allowing 1.2.1+ and 1.2.3 to remediate GHSA-6v7p-g79w-8964.
- Validated SQL Lab query result caching serialization.
- **`pyarrow`**:
- Bumped minimum security floor to `>=25.0.1, <26` across `pyproject.toml`
and `superset-core/pyproject.toml` to remediate CVE-2026-25087.
- Added roundtrip IPC stream serialization unit tests.
- **Tooling & Documentation**:
- Added automated security dependency constraint checker script:
`scripts/check_security_dependencies.py`.
- Added comprehensive test suites:
`tests/unit_tests/security/test_dependency_security_constraints.py` and
`tests/unit_tests/security/test_dependency_conflicts_reproduction.py`.
- Added vulnerability remediation and container scanning guide in
`docs/admin_docs/security/dependency-vulnerability-remediation.mdx` and
recorded dependency floor changes in `UPDATING.md`.
### Issue Reference
Closes #45087
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
