ASolarers-Rodriguez opened a new pull request, #45387: URL: https://github.com/apache/superset/pull/45387
### SUMMARY Security bump of a transitive development dependency to a patched release: | Package | From | To | Advisories | |---|---|---|---| | `joserfc` | 1.7.2 | 1.7.3 | CVE-2026-75509 (GHSA-r74j-q665-7rpj): `JWTClaimsRegistry` claim-validation bypass via array-typed `iss`/`sub` claims | Changes: - `requirements/development.in`: adds a `joserfc>=1.7.3` security floor with a CVE comment, so a future re-compile can't resolve back to a vulnerable release (same pattern as the security floors in `requirements/base.in`). - `requirements/development.txt`: regenerated. Only the `joserfc` pin moves (1.7.2 → 1.7.3), and its `# via` block gains `-r requirements/development.in`. No other package moves, and the header command is unchanged. `joserfc` is not a direct dependency. It only appears in `development.txt`, pulled in through the `fastmcp` extra (`fastmcp-slim`), whose range already allows 1.7.3. `base.txt` is unaffected. 1.7.3 adds no new dependencies; it still requires only `cryptography>=45.0.1`. **Why 1.7.3:** it is the first fixed release and has no other known advisories. Left unpinned, the resolver would pick the latest (1.7.5). I pinned the minimum fix instead with `-P joserfc==1.7.3`, and a plain re-run of the script keeps it because the floor accepts the existing pin. This is independent of the python-multipart bump (#45386). Each floor applied on its own moves only its own package, so they are split into separate PRs. Both append to the end of `requirements/development.in`, so whichever merges second may need a trivial rebase. **Verification (what was actually run):** - `scripts/uv-pip-compile.sh` via its non-Docker branch (`RUNNING_IN_DOCKER=1`, Python 3.11, uv 0.12.3). On unmodified `master` it produced no diff, so there is no pre-existing drift. With the floor it changed only the lines above. A second plain run (no `-P`) produced an identical lockfile. - `pytest tests/unit_tests/mcp_service` in a Python 3.11 env built from the base deps plus the `fastmcp` extra, constrained to this branch's `development.txt` (joserfc 1.7.3): 10867 passed, 13 skipped. - `pre-commit` on the changed files passed. ### TESTING INSTRUCTIONS - CI (`check-python-deps`, backend unit tests) should pass unchanged. - Locally: `pip install -r requirements/development.txt` (or `pip install joserfc==1.7.3`), then run `pytest tests/unit_tests/mcp_service`. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
