ASolarers-Rodriguez opened a new pull request, #45386: URL: https://github.com/apache/superset/pull/45386
### SUMMARY Security bump of a transitive development dependency to a patched release: | Package | From | To | Advisories | |---|---|---|---| | `python-multipart` | 0.0.29 | 0.0.31 | CVE-2026-53537, CVE-2026-53538, CVE-2026-53539 (fixed in 0.0.30); CVE-2026-53540 (fixed in 0.0.31) | Changes: - `requirements/development.in`: adds a `python-multipart>=0.0.31` security floor with a CVE comment, so a future re-compile can't resolve back to a vulnerable release (same pattern as the security floors in `requirements/base.in`). - `requirements/development.txt`: regenerated. Only the `python-multipart` pin moves (0.0.29 → 0.0.31), and its `# via` block gains `-r requirements/development.in`. No other package moves, and the header command is unchanged. `python-multipart` is not a direct dependency. It only appears in `development.txt`, pulled in through the `fastmcp` extra (`fastmcp-slim` and `mcp`), and both ranges already allow 0.0.31. `base.txt` is unaffected. **Why 0.0.31:** it is the lowest release with no open advisories. 0.0.30 still carries CVE-2026-53540, and 0.0.31 returns nothing from OSV. Left unpinned, the resolver would pick the latest (0.0.32). I pinned the minimum fix instead with `-P python-multipart==0.0.31`, and a plain re-run of the script keeps it because the floor accepts the existing pin. **Verification (what was actually run):** - `scripts/uv-pip-compile.sh` via its non-Docker branch (`RUNNING_IN_DOCKER=1`, Python 3.11, uv 0.12.3). On unmodified `master` it produced no diff, so there is no pre-existing drift. With the floor it changed only the lines above. A second plain run (no `-P`) produced an identical lockfile. - `pytest tests/unit_tests/mcp_service` in a Python 3.11 env built from the base deps plus the `fastmcp` extra, constrained to the new `development.txt` (python-multipart 0.0.31): 10866 passed, 13 skipped, 1 failed. The failure was an ImportError because the `trino` driver wasn't in that minimal env. After installing it, that test passed. - `pre-commit` on the changed files passed. ### TESTING INSTRUCTIONS - CI (`check-python-deps`, backend unit tests) should pass unchanged. - Locally: `pip install -r requirements/development.txt` (or `pip install python-multipart==0.0.31`), then run `pytest tests/unit_tests/mcp_service`. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
