ASolarers-Rodriguez opened a new pull request, #45910: URL: https://github.com/apache/superset/pull/45910
### SUMMARY Bumps `dnspython` from 2.7.0 to 2.9.0 to fix [CVE-2026-114605](https://nvd.nist.gov/vuln/detail/CVE-2026-114605) / [GHSA-45c3-73f7-pv4m](https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m) (high). `dns.name.from_wire_parser()` followed DNS name compression pointer chains with no length limit, so a crafted DNS message could cause excessive CPU use (DoS). 2.9.0 limits the decompression chain to 16 ([fix commit](https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023)). 2.9.0 is the first fixed version. `dnspython` is a transitive dependency (`flask-appbuilder` → `email-validator` → `dnspython`). `email-validator` requires `dnspython>=2.0.0` with no upper bound. This PR adds a `dnspython>=2.9.0` floor to `requirements/base.in`, next to the other security floors, so the pin can't regress when the lockfiles are recompiled. The lockfiles were regenerated with `scripts/uv-pip-compile.sh` (Docker, Python 3.11). Only the `dnspython` entries changed in `base.txt` and `development.txt`; `translations.txt` and every other pin are unchanged. Running the script on unmodified `master` first produced no drift. Upstream changes between 2.7.0 and 2.9.0 that are relevant ([What's New](https://dnspython.readthedocs.io/en/stable/whatsnew.html), [v2.8.0](https://github.com/rthalley/dnspython/releases/tag/v2.8.0), [v2.9.0](https://github.com/rthalley/dnspython/releases/tag/v2.9.0)): - **Python floor:** 2.8.0 requires Python ≥ 3.10 and 2.9.0 requires Python ≥ 3.11. That matches Superset's `requires-python = ">=3.11"`. - **API changes:** the unused `ignore_errors` parameter of `dns.asyncquery.receive_tcp()` was removed. DNS-over-HTTPS uses `httpx2` instead of `httpx`. Custom `Rdata` subclasses must implement `to_styled_text()`. Parsing of zone files and SVCB/HTTPS/DNSSEC records is stricter. Superset doesn't import `dns` directly. The only consumer here is `email-validator`, which uses `dns.resolver` for MX/deliverability checks, and that API did not change. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A ### TESTING INSTRUCTIONS These ran locally on Python 3.11, in a venv built from the regenerated `requirements/development.txt`. `mysqlclient` and `python-ldap` were left out because their system headers weren't available. Installed: `dnspython==2.9.0`, `email-validator==2.2.0`. - `./scripts/uv-pip-compile.sh`: clean on `master` before the change. After the change, a second run with no extra args produced no further diff. - `pytest tests/unit_tests/security`: **741 passed**, 0 skipped, 0 failed. - `pytest tests/unit_tests/security tests/unit_tests/reports/schemas_test.py tests/unit_tests/views/test_user_schemas.py tests/unit_tests/dao/user_test.py tests/unit_tests/commands/security tests/unit_tests/views/test_current_user_api.py`: **844 passed**, 0 skipped, 0 failed. - Smoke test of the code path that actually uses dnspython: - `email_validator.validate_email(..., check_deliverability=False)` accepts a valid address and rejects a malformed one. - WTForms `Email()`, the validator behind Flask-AppBuilder's registration/user forms, accepts and rejects as expected. - `validate_email("[email protected]", check_deliverability=True)` did a live MX lookup through `dns.resolver` and returned the expected MX record. - `pre-commit run --files requirements/base.in requirements/base.txt requirements/development.txt`: passed (applicable hooks: large files, end-of-file, trailing whitespace). The full backend test suite was not run locally; CI covers it. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
