FrancescoCastaldi commented on code in PR #45186: URL: https://github.com/apache/superset/pull/45186#discussion_r4241969972
########## scripts/check_security_dependencies.py: ########## @@ -0,0 +1,230 @@ +#!/usr/bin/env python3 Review Comment: Fair question! The issue reported in #45087 was specifically that downstream operators trying to patch Trivy container findings ran into pip dependency resolution conflicts because pyproject.toml and superset-core had tight upper bounds or mismatched floors compared to requirements/base.in. Trivy and Dependabot flag vulnerable installed artifacts in Docker images or open PRs, but they do not validate that our declared packaging specifiers in pyproject.toml and base.in actually accept the security patch releases without conflicting with each other. The script and unit test simply check that our packaging specifiers reject the known vulnerable versions and allow the patched ones locally, catching any conflicting floor or ceiling before a full Docker build or release. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
