potiuk opened a new pull request, #73059:
URL: https://github.com/apache/airflow/pull/73059

   The `Reject vulnerable dependency changes` jobs fail on `uv.lock ยป 
[email protected]` for 
[GHSA-8mgp-746c-j5xp](https://github.com/advisories/GHSA-8mgp-746c-j5xp) 
(CVE-2026-81726, high) โ€” a path traversal in nltk's model-artifact save/load 
APIs (`TransitionParser.train`/`parse`, `AveragedPerceptron.save`/`load`, 
`PerceptronTagger.save_to_json`, `save_maxent_params`), which call builtin 
`open()` on a caller-supplied path instead of nltk's pathsec helpers.
   
   It does not affect Airflow:
   
   * nltk is not an Airflow dependency. It arrives only through 
`llama-index-core` (`Requires-Dist: nltk>=3.9.3`), itself the `llamaindex` 
optional extra and dev group of `apache-airflow-providers-common-ai`.
   * It is absent from the released constraints โ€” `nltk` appears only in 
`constraints-source-providers-*.txt`, never in `constraints-*.txt` or 
`constraints-no-providers-*.txt`.
   * The affected APIs are never imported by `llama-index-core`, which uses 
only the Punkt tokenizer and the stopwords corpus (`llama_index/core/utils.py`, 
plus optional `rake_nltk` in `indices/keyword_table/utils.py`).
   
   Upstream merged the fix on nltk's `develop` branch (nltk/nltk#3757, 
nltk/nltk#3759, nltk/nltk#3813) *after* `v3.10.3` was tagged, so the advisory 
has no patched version and the check stays red until nltk 3.10.4 ships. 
Upstream tracker: nltk/nltk#3789. Drop the entries once it ships.
   
   Both gates get the entry: each triggers on its own SDK paths but then 
reviews the whole PR dependency diff, `uv.lock` included. That is also why a 
Python-side advisory currently fails the Java SDK gate โ€” worth scoping 
separately, but out of scope here.
   
   This is the same fixup already pushed to `changes-3.3.2rc1` to unblock 
#72946, landed on `main` so the next sync PR doesn't hit it again.
   
   ๐Ÿค– Generated with [Claude Code](https://claude.com/claude-code)
   
   https://claude.ai/code/session_01G9A6Mofr5qErDuTh7vqWcX
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to