FrancescoCastaldi commented on PR #45186:
URL: https://github.com/apache/superset/pull/45186#issuecomment-6113263327
### Executive Summary & Re-Review Request
All review findings across recent reviews (including #5483808076 and
#5484637625) have been addressed and validated:
1. **Declarative Constraint Declarations & Lock Alignment**:
* `pyproject.toml` and `superset-core/pyproject.toml` enforce semantic
floors: `cryptography>=50.0.2, <51.0.0`, `msgpack>=1.2.3, <1.3.0`, and
`pyarrow>=25.0.1, <26`.
* Locked requirements in `requirements/base.in` and
`requirements/base.txt` compiled via `./scripts/uv-pip-compile.sh`.
2. **Pruning Non-Essential Code & Direct Master Diff**:
* Removed custom security audit scripts and redundant meta-tests in
commit `7c4c4a00e5` as requested by @hainenber.
* Pruned artificial `TypeError` fallback handling in `parse_ssl_cert`
(`superset/utils/core.py`) and removed mock tests in `test_core.py`,
maintaining zero-diff against `upstream/master` on core code.
3. **Accurate Advisory Reachability & Documentation**:
* Corrected `UPDATING.md` upgrade notes in commit `5759859ca0` to reflect
actual constraint updates.
* Updated `dependency-vulnerability-remediation.mdx` in commit
`b168ceacce` per @sadpandajoe's review: clarified that CVE-2026-25087
(GHSA-rgxp-2hwp-jwgg) is a use-after-free in the Arrow C++ IPC file reader with
pre-buffering, and documented that Superset invokes the Parquet reader for user
uploads and the IPC stream reader for SQL Lab asynchronous serialization (never
invoking the IPC file reader).
* Realigned `.trivyignore` guidance and reaffirmed `SECURITY.md` scope
compliance.
@sadpandajoe @hainenber, all points have been resolved and verified. The PR
is ready for your re-review when convenient, thank you!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
