github-actions[bot] commented on code in PR #64928: URL: https://github.com/apache/doris/pull/64928#discussion_r3636060641
########## docker/runtime/doris-compose/requirements.txt: ########## @@ -22,7 +22,7 @@ jsonpickle prettytable pymysql python-dateutil -requests<=2.31.0 +requests>=2.31.0 Review Comment: **Raise Requests and the Docker SDK together** `>=2.31.0` still allows affected Requests 2.31.0 ([GHSA-9hjg-9r4m-mvj7](https://github.com/advisories/GHSA-9hjg-9r4m-mvj7)), but raising only this floor also breaks the README's documented `docker==6.1.3` fallback. [docker-py #3256](https://github.com/docker/docker-py/issues/3256) shows that SDK line failing in `docker.from_env()` with `Not supported URL scheme http+docker` on Requests 2.32; the fix shipped in Docker SDK 7.1.0. Simply raising Docker is insufficient too, because the `docker-compose` v1 package installed above calls SDK APIs removed in 7.x. Please move the whole set coherently—for example `requests>=2.32.4,<3` plus `docker>=7.1.0`, remove the legacy `docker-compose`/6.1.3 fallback in favor of the already-preferred Compose v2 client, and smoke-test both Docker-client and compose commands. ########## tools/cost_model_evaluate/requirements.txt: ########## @@ -16,4 +16,4 @@ # under the License. matplotlib==3.7.0 -mysql_connector_repackaged==0.3.1 +mysql-connector-python>=8.0.33,<9 Review Comment: **Do not cap the replacement below the current secure floor** This `<9` ceiling forces every selectable release into known affected ranges: [GHSA-hgjp-83m4-h4fj](https://github.com/advisories/GHSA-hgjp-83m4-h4fj) covers `<9.1.0`, and Oracle's [April 2025 CPU](https://www.oracle.com/security-alerts/cpuapr2025.html) also covers Connector/Python 9.0.0-9.2.0. Consequently the new manifest cannot meet the stated security goal. Please use a tested range beginning at 9.3.0 (for example `>=9.3.0,<10`) and smoke-test the Doris connection/query path with that major version. ########## extension/dbt-doris/dev-requirements.txt: ########## @@ -37,4 +37,4 @@ pytz tox>=3.13 twine wheel -mysql-connector-python>=8.0.0,<8.3 +mysql-connector-python>=8.0.33,<8.3 Review Comment: **Use the current secure Connector/Python floor in both manifests** This range contains no release beyond the known affected ranges: [GHSA-hgjp-83m4-h4fj](https://github.com/advisories/GHSA-hgjp-83m4-h4fj) covers `<9.1.0`, and Oracle's [April 2025 CPU](https://www.oracle.com/security-alerts/cpuapr2025.html) also covers Connector/Python 9.0.0-9.2.0. The current dependency-review job already fails on this exact line. This file is also development-only; the documented `pip install .` path resolves `setup.py`, which still allows `mysql-connector-python>=8.0.0`. Please use and test a floor of at least 9.3.0 in both manifests (for example `>=9.3.0,<10`) so CI, development, and real installs share the same secure range. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
