namanjain24-sudo commented on issue #73049: URL: https://github.com/apache/airflow/issues/73049#issuecomment-5652835802
Small update while this waits on nltk: - On main the entry now lives in `.github/workflows/dependency-review.yml` (the comment + `allow-ghsas` line, L74-82), added in #73061. `java-sdk-dependency-security.yml` only runs on push/schedule now, so there's nothing left to remove there. The new gate triggers on `uv.lock` directly, so the `java-sdk/**` part of the acceptance criteria isn't needed anymore. - nltk hasn't released yet. 3.10.3 is still the latest on PyPI and the 3.10.4 release PR (nltk/nltk#3826) is still a draft. On `develop`, none of the six functions listed in the advisory call a bare `open()` on the caller's path anymore, they all go through `nltk.pathsec` now. ekaf also said [here](https://github.com/nltk/nltk/pull/3753#issuecomment-5630323840) they could release once those six are fixed, so hopefully it's not far off. Once 3.10.4 is out (and past the 4 day `exclude-newer` window), I'll bump nltk in `uv.lock` and remove the entry in the same PR. dependency-review only flags dependencies a PR adds, so removing the line on its own would pass even with 3.10.3 still locked. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
