chore(ci): refresh Spark py3.14 pins for security advisories

Aperta
  • Qualcosa non va?
#2,014 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
66/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Tranquilla
Stack tecnologico
python
Ambito
ci-cd, devops

Direzione di ricerca

Start with requirements/spark-py3.14.in and the lockfile generator, ./bin/generate-lockfiles.sh; confirm the four patched dependency versions work with Spark and Python 3.14. Regenerate the hashed lock using PROFILES=spark VERSIONS=3.14 ./bin/generate-lockfiles.sh, then run the focused Spark lane and lockfile checks. Done means the checks pass and Dependabot alerts 2–5 close, or any remaining alert is documented or dismissed as a proven false positive.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Release-readiness finding

GitHub reports four open Dependabot alerts against requirements/spark-py3.14.in:

  • pyarrow==22.0.0: GHSA-rgxp-2hwp-jwgg / CVE-2026-25087, patched in 23.0.1. The advisory explicitly says the affected pre-buffering API is not exposed in Python bindings, so this is not a pygraphistry runtime exploit, but the lock still triggers a high alert.
  • setuptools==80.9.0: GHSA-h35f-9h28-mq5c / CVE-2026-59890, patched in 83.0.0. This is a macOS sdist exclusion-normalization issue.
  • pytest==9.0.1: GHSA-6w46-j5rx-g56g / CVE-2025-71176, patched in 9.0.3. This is test-runner-only local temporary-directory handling.
  • requests==2.32.5: GHSA-gc5v-m9x4-r6x2 / CVE-2026-25645, patched in 2.33.0. Standard Requests usage is not affected; the vulnerable utility is extract_zipped_paths().

0.59.0 assessment

This does not block the 0.59.0 package release:

  • the manifest is the direct-input lock for the focused Spark CI lane, not a package lock shipped to users;
  • setup.py does not cap these runtime dependencies below their patched versions, so fresh package installs can resolve patched releases;
  • the publish workflow builds in an isolated environment rather than from this Spark lock;
  • the sole high advisory excludes Python bindings.

The stale pins should still be removed so CI exercises supported patched versions and the repository returns to a clean Dependabot state.

Acceptance criteria

  • Confirm Spark/Python 3.14 compatibility for pyarrow >=23.0.1, setuptools >=83.0.0, pytest >=9.0.3, and requests >=2.33.0.
  • Update requirements/spark-py3.14.in and regenerate the hashed lock with PROFILES=spark VERSIONS=3.14 ./bin/generate-lockfiles.sh.
  • Run the focused Spark lane and lockfile checks.
  • Verify Dependabot alerts 2–5 close, or document/dismiss any alert that remains a proven ecosystem false positive.
Lingua principale
Python
Stelle
2.6k
Fork
229
Merge medio
1g 5h
PR unite (30g)
99

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di graphistry/pygraphistry

Tutte le issue di graphistry/pygraphistry

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.