This is an automated email from the ASF dual-hosted git repository.
morningman pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/master by this push:
new 67489f6e006 [fix](build) Fix insecure Python dependency pins in
doris-compose, dbt-doris, and cost_model (#64928)
67489f6e006 is described below
commit 67489f6e0062a9c3a4f18529633c7dfc33ad0999
Author: Arpit Jain <[email protected]>
AuthorDate: Thu Jul 23 16:33:32 2026 +0900
[fix](build) Fix insecure Python dependency pins in doris-compose,
dbt-doris, and cost_model (#64928)
### What problem does this PR solve?
Issue Number: N/A
Related PR: #63188
Problem Summary:
Three Python requirements files have dependency pins that allow
installing versions with known security issues.
**docker/runtime/doris-compose/requirements.txt**
The `requests<=2.31.0` constraint sets an upper bound but no lower
bound, so pip can resolve to any version below 2.31.0. Versions before
2.31.0 are affected by CVE-2023-32681 (Proxy-Authorization header leaked
on cross-domain redirects). Changed to `requests>=2.31.0` to set a
secure floor.
**extension/dbt-doris/dev-requirements.txt**
The `mysql-connector-python>=8.0.0,<8.3` lower bound allows versions
with known authentication bypass issues. Raised the lower bound to
`>=8.0.33` which includes the relevant fixes.
**tools/cost_model_evaluate/requirements.txt**
The `mysql_connector_repackaged==0.3.1` package is an unofficial
third-party repackage of the MySQL connector whose last PyPI release was
in 2014. Replaced with the official `mysql-connector-python>=8.0.33,<9`
package. The code in `sql_executor.py` imports `mysql.connector` which
both packages provide, so this is a drop-in replacement.
---
docker/runtime/doris-compose/requirements.txt | 2 +-
extension/dbt-doris/dev-requirements.txt | 2 +-
tools/cost_model_evaluate/requirements.txt | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/docker/runtime/doris-compose/requirements.txt
b/docker/runtime/doris-compose/requirements.txt
index e519f99af03..930ba78eb40 100644
--- a/docker/runtime/doris-compose/requirements.txt
+++ b/docker/runtime/doris-compose/requirements.txt
@@ -22,7 +22,7 @@ jsonpickle
prettytable
pymysql
python-dateutil
-requests<=2.31.0
+requests>=2.31.0
# NOTICE: if install docker failed, specific pyyaml version and docker version
#pyyaml==5.3.1
diff --git a/extension/dbt-doris/dev-requirements.txt
b/extension/dbt-doris/dev-requirements.txt
index 64aa3cb9684..12cde5e0b8f 100644
--- a/extension/dbt-doris/dev-requirements.txt
+++ b/extension/dbt-doris/dev-requirements.txt
@@ -37,4 +37,4 @@ pytz
tox>=3.13
twine
wheel
-mysql-connector-python>=8.0.0,<8.3
+mysql-connector-python>=8.0.33,<8.3
diff --git a/tools/cost_model_evaluate/requirements.txt
b/tools/cost_model_evaluate/requirements.txt
index 05497a9893e..b91cc1c74ce 100644
--- a/tools/cost_model_evaluate/requirements.txt
+++ b/tools/cost_model_evaluate/requirements.txt
@@ -16,4 +16,4 @@
# under the License.
matplotlib==3.7.0
-mysql_connector_repackaged==0.3.1
+mysql-connector-python>=8.0.33,<9
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
