FrancescoCastaldi commented on PR #45186: URL: https://github.com/apache/superset/pull/45186#issuecomment-6509199283
### Executive Summary & Review Feedback Resolution This PR branch has been rebased onto latest `upstream/master` (resolving merge conflicts in `UPDATING.md`), all review feedback from @sadpandajoe and @hainenber has been addressed, and the branch has been pushed with lease in commit `3fb6fc4617`. #### 1. Addressed Review Items - **Rebase on Upstream Master**: cleanly resolved merge conflicts in `UPDATING.md` against upstream changes. - **`UPDATING.md` Scope Accuracy**: rewritten to document specifically what changes: setting `pyarrow>=23.0.1` in `superset-core` (without an upper ceiling) to resolve CVE-2026-25087 for downstream extensions, and explicitly bounding `msgpack>=1.2.3,<1.3.0` in `requirements/base.in` for container and application builds. - **Granular Vulnerability Exploitability Analysis**: updated the risk matrix and suppression guidance in `docs/admin_docs/security/dependency-vulnerability-remediation.mdx` with advisory-specific reachability reasoning for each CVE (CVE-2026-69247 for PKCS#7 EnvelopedData, CVE-2026-69249 for untrusted certificate path-building, CVE-2026-69248 for the PolicyBuilder certificate verifier, and wheel-bundled OpenSSL). - **Suppression vs Upgrade Hygiene**: explicitly omitted `GHSA-j586-36cw-2gc2` from `.trivyignore` with an admonition instructing operators to remediate via `msgpack>=1.2.3` upgrade (Option A) rather than suppressing findings reachable in default configurations. - **Simplified Scope**: removed the redundant custom verification script (`scripts/check_security_dependencies.py`) and the unnecessary `load_pem_x509_certificate` fallback retry, keeping the PR clean and minimal. @sadpandajoe, @hainenber, all review items have been resolved and the branch is fully up to date with upstream master. The PR is ready for your re-review whenever convenient, thank you! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
