eladkal commented on code in PR #75922: URL: https://github.com/apache/airflow/pull/75922#discussion_r4411364251
########## pyproject.toml: ########## @@ -1484,7 +1484,11 @@ override-dependencies = ["openai>=2.47.0,<3"] # in the image build catches it. Cap each such package here at its last openai 2.x release, which # is what the resolver would pick without the override. azure-ai-projects 2.5.0 moved to # openai>=3.0.0; the Azure provider needs >=2.2.0. -constraint-dependencies = ["azure-ai-projects<2.5"] +constraint-dependencies = [ + "azure-ai-projects<2.5", + # Mitigate emSign/eMudhra CA certificate invalidation security issue (GHSA-6q48-6c7w-9gw2, fixes #75858) + "virtualenv>=21.14.12", Review Comment: I don't understand why this is needed. Nothing prevents using newer versions of virtualenv. Please explain why must we force all users to use these versions. the fact that a specific library has a risk is not good enough reason. If that was the case all airflow dependencies were always bumped to newest versions all the time. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
