FrancescoCastaldi commented on PR #45186:
URL: https://github.com/apache/superset/pull/45186#issuecomment-6163205894
**Follow-up updates (@sadpandajoe) - addressed in commit
15aae17857d83f31b9a977ff69e14bfabe1da252**
1. **`requirements/base.in` comments aligned (thread 4260005610)**:
Updated the security comments for msgpack and pyarrow:
- `msgpack`: documents GHSA-6v7p-g79w-8964 / CVE-2026-57585
(out-of-bounds read/crash on Unpacker reuse) and GHSA-j586-36cw-2gc2 (C
extension memory leak on map key validation failure).
- `pyarrow`: documents CVE-2026-25087 as use-after-free in IPC file
reader with pre-buffering (GHSA-rgxp-2hwp-jwgg).
2. **Dual CVE/GHSA aliases in `.trivyignore` (thread 4266306292)**:
Included both CVE and GHSA aliases in the Option B `.trivyignore`
template for each advisory (CVE-2026-34180 / GHSA-537c-gmf6-5ccf,
CVE-2026-57585 / GHSA-6v7p-g79w-8964, and CVE-2026-25087 /
GHSA-rgxp-2hwp-jwgg), with an explicit note in the preamble explaining that
Trivy requires rules to match the exact identifier reported by the scan engine.
@sadpandajoe, ready for re-review when convenient.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
