rusackas commented on code in PR #45387: URL: https://github.com/apache/superset/pull/45387#discussion_r4385249201
########## requirements/development.in: ########## @@ -61,3 +61,7 @@ testcontainers[cockroachdb,cratedb,mongodb,mssql,mysql,oracle,postgres,trino]>=4 # raises `zope.interface.exceptions.InvalidInterface` outright on 3.13. # 7.2 is the first release with explicit handling for it. zope.interface>=7.2 + +# Security: CVE-2026-75509 - joserfc claim-validation bypass via array-typed +# iss/sub claims (pulled in transitively via fastmcp-slim) +joserfc>=1.7.3 Review Comment: Fair point, but I think this is a gap in how `fastmcp` (and every other optional extra) is packaged, not something this PR owes us. None of the ~50 extras in `pyproject.toml` carry their own security floor, so a bare `pip install apache-superset[fastmcp]` has never been protected by anything in this repo, floor or no floor. Might be worth a follow-up issue on whether extras should get their own floors, but not a blocker on a dev-lockfile bump that does exactly what it says on the tin. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
