FrancescoCastaldi commented on PR #45186: URL: https://github.com/apache/superset/pull/45186#issuecomment-6148206757
**Review 5505208520 (@sadpandajoe) - addressed in commit 984e8aaa55632724add765f7be6d8d7c02e68bd7** Two threads have been resolved: **Thread 1 - msgpack advisory ID/fixed-version mismatch (comment 4260005610)** The single msgpack row has been split into two rows, one per advisory: | Finding ID | Upstream Fixed | Description | |---|---|---| | GHSA-6v7p-g79w-8964 (CVE-2026-57585) | 1.2.1 | Out-of-bounds read/crash on Unpacker reuse after a caught error. Superset does not reuse Unpacker instances across error boundaries. | | GHSA-j586-36cw-2gc2 | 1.2.3 | Memory leak in C extension when map key validators or container hooks raise. Superset does not configure either; the path is never entered. | Section 2 now names both advisory IDs with their respective upstream fixed versions. **Thread 2 - trivyignore suppression criterion (comment 4260005630)** The Option B preamble now specifies the suppression criterion as advisory-specific non-reachability for the shipped configuration, not authentication reachability. The msgpack trivyignore comments have been rewritten with code-path rationale for each advisory independently, consistent with the Superset SECURITY.md threat model. @sadpandajoe, ready for re-review when convenient. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
