codeant-ai-for-open-source[bot] commented on code in PR #45186:
URL: https://github.com/apache/superset/pull/45186#discussion_r4241278811
##########
pyproject.toml:
##########
@@ -50,7 +50,7 @@ dependencies = [
"flask-cors>=6.0.5, <7.0",
"croniter>=6.2.4",
"cron-descriptor",
- "cryptography>=50.0.2, <51.0.0",
+ "cryptography>=48.0.1, <51.0.0",
Review Comment:
Yes—the package metadata should use **`cryptography>=50.0.2,<51.0.0`**.
`>=50.0.0` would address the cited CVE only if 50.0.0 is its first fixed
release, but it would still admit versions below the floor already specified
for CVE-2026-34073 in `requirements/base.in`.
The broader `pyproject.toml` range is used by fresh package installs;
`base.in` does not constrain those installs. I’d align the metadata floor with
`base.in` and update the checker/tests so they no longer treat 48.0.1 or 49.0.0
as acceptable. That preserves the stated security floor, though it may require
revisiting the PR’s resolver-compatibility rationale.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
