potiuk opened a new pull request, #73059: URL: https://github.com/apache/airflow/pull/73059
The `Reject vulnerable dependency changes` jobs fail on `uv.lock ยป [email protected]` for [GHSA-8mgp-746c-j5xp](https://github.com/advisories/GHSA-8mgp-746c-j5xp) (CVE-2026-81726, high) โ a path traversal in nltk's model-artifact save/load APIs (`TransitionParser.train`/`parse`, `AveragedPerceptron.save`/`load`, `PerceptronTagger.save_to_json`, `save_maxent_params`), which call builtin `open()` on a caller-supplied path instead of nltk's pathsec helpers. It does not affect Airflow: * nltk is not an Airflow dependency. It arrives only through `llama-index-core` (`Requires-Dist: nltk>=3.9.3`), itself the `llamaindex` optional extra and dev group of `apache-airflow-providers-common-ai`. * It is absent from the released constraints โ `nltk` appears only in `constraints-source-providers-*.txt`, never in `constraints-*.txt` or `constraints-no-providers-*.txt`. * The affected APIs are never imported by `llama-index-core`, which uses only the Punkt tokenizer and the stopwords corpus (`llama_index/core/utils.py`, plus optional `rake_nltk` in `indices/keyword_table/utils.py`). Upstream merged the fix on nltk's `develop` branch (nltk/nltk#3757, nltk/nltk#3759, nltk/nltk#3813) *after* `v3.10.3` was tagged, so the advisory has no patched version and the check stays red until nltk 3.10.4 ships. Upstream tracker: nltk/nltk#3789. Drop the entries once it ships. Both gates get the entry: each triggers on its own SDK paths but then reviews the whole PR dependency diff, `uv.lock` included. That is also why a Python-side advisory currently fails the Java SDK gate โ worth scoping separately, but out of scope here. This is the same fixup already pushed to `changes-3.3.2rc1` to unblock #72946, landed on `main` so the next sync PR doesn't hit it again. ๐ค Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01G9A6Mofr5qErDuTh7vqWcX -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
