potiuk opened a new issue, #73049:
URL: https://github.com/apache/airflow/issues/73049

   ### What the workaround is
   
   `.github/workflows/java-sdk-dependency-security.yml` now passes 
`allow-ghsas: GHSA-8mgp-746c-j5xp`
   to `actions/dependency-review-action`, suppressing that one advisory.
   
   ### Why
   
   [GHSA-8mgp-746c-j5xp](https://github.com/advisories/GHSA-8mgp-746c-j5xp) / 
CVE-2026-81726 (high,
   CVSS 7.0) is a path-traversal in nltk's model-artifact APIs. **Every 
published nltk version is
   affected** — the advisory range is `<= 3.10.3` and 3.10.3 is the newest 
release on PyPI, with no
   patched version recorded. Upstream has fixes on `main` (nltk/nltk#3757, 
nltk/nltk#3759,
   nltk/nltk#3813) but has not cut a release carrying them, so there is nothing 
to upgrade to.
   
   nltk is not a dependency of Airflow. It arrives transitively through 
`llama-index-core`, which is
   an optional `llamaindex` extra and a dev dependency of 
`providers/common/ai`. None of the affected
   APIs (`TransitionParser.train` / `.parse`, `AveragedPerceptron.save` / 
`.load`,
   `PerceptronTagger.save_to_json`, `save_maxent_params`) is reachable from 
Airflow code.
   
   The job fires on any PR touching `java-sdk/**`, but 
`dependency-review-action` reviews the whole
   repository dependency graph, so it also sees `uv.lock`. That is how a Python 
transitive dependency
   ends up blocking the Java SDK check — most visibly on the 3.3.2rc1 sync PR 
(#72946), where
   `uv.lock` moves nltk 3.10.0 → 3.10.3 and both versions are inside the 
advisory range.
   
   ### Follow-up work
   
   - Watch for an nltk release above 3.10.3 that carries the fix.
   - Bump nltk in `uv.lock` (it will come along with the next 
`llama-index-core` resolution) and drop
     the `allow-ghsas` line plus the comment above it.
   - Consider separately whether `java-sdk-dependency-security.yml` should 
review only the Java SDK's
     dependency graph rather than the whole repository's — a Python lockfile 
change failing the Java
     SDK gate is surprising, but the action has no path scoping today.
   
   ### Acceptance criteria
   
   The `allow-ghsas` entry and its explanatory comment are removed from
   `.github/workflows/java-sdk-dependency-security.yml`, and the "Reject 
vulnerable dependency changes"
   job passes on a PR that touches both `java-sdk/**` and `uv.lock`.
   
   ---
   Drafted-by: Claude Opus 5 (1M context) (no human review before posting)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to