ASolarers-Rodriguez opened a new pull request, #45383: URL: https://github.com/apache/superset/pull/45383
### SUMMARY Security bump of a dev-only transitive dependency to the first patched release: | Package | From | To | Advisory | |---|---|---|---| | `fonttools` | 4.60.2 | 4.62.0 | Arbitrary code execution via `eval()` in `cffLib.parseBlendList()` from a crafted TTX file ([fonttools/fonttools#4039](https://github.com/fonttools/fonttools/issues/4039), fixed by [#4040](https://github.com/fonttools/fonttools/pull/4040); listed as **SECURITY** in the [4.62.0 changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst)) | `fonttools` only appears in `requirements/development.txt` (`matplotlib` → `prophet` pull it in). It is not in `base.txt`, so production installs are unaffected. Changes: - `requirements/development.in`: add a commented security floor, `fonttools>=4.62.0,<5.0.0`, following the CVE-floor pattern in `requirements/base.in`. A future re-compile then can't resolve back to a vulnerable release. - `requirements/development.txt`: regenerated. The pin moves from 4.60.2 to 4.62.0, and the `# via` block picks up `-r requirements/development.in` from the new floor. No other package moves. Why 4.62.0: it is the lowest release with the fix. 4.61.0 and 4.61.1 still call `eval()` in `parseBlendList()`; 4.62.0 switches to `safeEval()`. OSV and GitHub's advisory database list no other open advisories for 4.62.0. The two published fonttools advisories, GHSA-6673-4983-2vx5 and GHSA-768j-98cg-p3fv, are fixed in 4.43.0 and 4.60.2. `matplotlib==3.9.0` only requires `fonttools>=4.28.2`. **Verification** (only what actually ran): - Ran `scripts/uv-pip-compile.sh` through its non-Docker branch (`RUNNING_IN_DOCKER=1`, CPython 3.11.15, uv 0.12.3). On unmodified `master` it produced no diff, so there was no pre-existing drift. With the floor added, two consecutive runs gave byte-identical lockfiles, and only `fonttools` changed. - In a clean Python 3.11 venv with `fonttools==4.62.0`, `matplotlib==3.9.0`, and the repo's pinned `numpy`/`pandas`/`pillow`/`cmdstanpy`/`prophet`: - `uv pip check` reported no conflicts. - A plot rendered to PNG, PDF (which subsets fonts through fontTools) and SVG with the Agg backend. - `prophet.plot` imported. - Tested a `parseBlendList()` payload that tries to run a shell command. On 4.60.2 the command ran; on 4.62.0 `safeEval` raised `ValueError` and the command did not run. - `pre-commit run` passed on the changed files. - Superset's own code and tests don't import matplotlib or fontTools, so no repo test exercises this path directly. The full backend suite was not run locally; CI covers it. ### TESTING INSTRUCTIONS - CI (`check-python-deps`, backend unit/integration tests) should pass unchanged. - Locally: `pip install -r requirements/development.txt`, then `python -c "import fontTools, matplotlib; print(fontTools.version)"`. It should print `4.62.0`. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
