rusackas commented on PR #39721: URL: https://github.com/apache/superset/pull/39721#issuecomment-6150870171
Thanks for this, @ASolarers-Rodriguez! Looks like `master` has since moved past all three CVEs here on its own: Pillow's at `12.3.0` now (ahead of the `12.2.0` floor here, and the comment on that bump specifically calls out closing the same CVE class), and `python-multipart`/`authlib`/`joserfc` are all newer too, since `fastmcp` itself got bumped way up to `>=3.4.7,<5.0` (#43876, #44200) and pulls in patched versions transitively. Closing this as superseded since there's nothing left for it to add. Appreciate you catching these! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
