tvalentyn commented on PR #66952: URL: https://github.com/apache/airflow/pull/66952#issuecomment-4916744391
> 2. My [PR](https://github.com/apache/beam/pull/39213) in Apache beam has been merged, so we should be able to unsuspend it in version > 2.75. > Let's keep watching until it is shipped, and then we'll be able to unsuspend it. @shahar1 thanks for doing that. Regarding betterproto dependency: * the functionality where envoy-data-plane is used is an opt-in functionality of Beam that doesn't have significant usage atm * While Betterproto doesn't have any recent releases: https://pypi.org/project/betterproto/#history, is there any concern as to this dependency having a vulnerability? It seems like we flagged it primarily due to beta in the naming, and then noticed that the codebase is old. Even if a project has recent releases, it can have codepaths that haven't been touched for years. Do we have any reason to be concerned beside the name ? * As mentioned, Beam will drop the dependency on the envoy-data-plane in the next release, but using older version of Beam does more harm in this case to airflow users. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
