GitHub user bsethi24 added a comment to the discussion: Superset 6.1: is flask-caching still structurally required when runtime uses NullCache and SupersetMetastoreCache?
Hi @dfbustosus / Team...... Thanks for the response. Our main concern is the current Flask-Caching package version in our build: 2.3.1 (and the broader 2.x line, including 2.5.1), which is flagged by our security scan as a Critical issue (CVE-2021-33026, score 9.8). - We would like to understand the supported remediation path for Superset 6.1 users who are blocked by mirror or policy constraints 1. Is there a recommended upgrade path to a non-vulnerable version? 2. Is there any supported way to avoid the dependency when only NullCache or melastore-backed cache modes are used? 3. If no supported removal path exists, what is the recommended remediation plan for a production build that cannot consume the vulnerable version? 4. Is this CVE expected to be fixed in a newer supported release? Please advise on the recommended approach and any guidance available from the maintainers. GitHub link: https://github.com/apache/superset/discussions/44823#discussioncomment-18758365 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
