vatsrahul1001 commented on PR #72741: URL: https://github.com/apache/airflow/pull/72741#issuecomment-5590383134
Closing — not needed for 3.3.2. The new overrides here (postcss, tar, js-yaml) are build-time transitive deps that don't ship in the release (Airflow ships the compiled UI, not node_modules). The one runtime-bundled dep, dompurify, is already overridden on v3-3-test. So there's no user-facing security impact for the patch; #71253 stays on main / can be picked up in a future maintenance-branch dep sync. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
