Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[upstream package] Relax lxml<6.0.0 constraint in splunk-appinspect to allow lxml>=6.1.0 (CVE-2026-41066 fix)

Aperta
  • Qualcosa non va?
#164 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Bug
Chiarezza
Da chiarire
Stato di attività
Tranquilla
Stack tecnologico
python
Ambito
devops, security

Direzione di ricerca

The issue points to PyPI metadata for splunk-appinspect and provides no source file or test in this Action repository. Start by confirming the lxml constraint and package ownership, then review the linked docs/DECISION_LOG.md for downstream context. Done would require an upstream release that permits lxml 6.1.0 or clear compatibility guidance.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Note on venue

This issue is about the underlying splunk-appinspect Python package (pinned by this Action), not the Action wrapper itself. The PyPI metadata for splunk-appinspect declares no public source or bug tracker, so I'm filing here because it's the only public Splunk-org GitHub repo touching AppInspect. If there's a better venue, please redirect.

Summary

splunk-appinspect==4.2.0 and the newly-released 4.2.1 (2026-05-21) both declare Requires-Dist: lxml<6.0.0,>=5.3.0. The upper bound prevents downstream projects from picking up lxml==6.1.0, which patches CVE-2026-41066 / GHSA-vfmq-68hx-4jfw (XXE via iterparse() and ETCompatXMLParser() when resolve_entities=True). The 4.2.1 release did not relax this constraint.

Dependabot flags this in any repo that consumes splunk-appinspect through a hashed lockfile (pip-audit, pip-compile, poetry). Downstream maintainers cannot resolve it without either (a) carving out the CVE with an ignore-rule (the path I took — see DECISION_LOG entry), or (b) abandoning splunk-appinspect, which is the only tool that runs Splunkbase certification checks.

Ask

Could the lxml<6.0.0 upper bound be relaxed in the next splunk-appinspect release, ideally to allow lxml>=6.1.0? If lxml 6.x introduces API surface incompatibilities that the constraint exists to guard against, an outline of what splunk-appinspect calls into would help downstream projects understand the upgrade path.

Reachability for our use case

In our repo, lxml is invoked exclusively by splunk-appinspect against our own .spl artifact built from this repo's source tree. The XXE pathway requires untrusted XML input; our trusted-input CI use case is below the CVSS general-population threat model. I've documented this as accepted residual risk in our DECISION_LOG and applied a pip-audit --ignore-vuln carve-out so CI stays green. Filing this so downstream projects with stricter postures (or auditors who don't dig into reachability) aren't blocked.

Versions
  • splunk-appinspect: 4.2.0 (and 4.2.1, released 2026-05-21 — same constraint)
  • Constraint: Requires-Dist: lxml<6.0.0,>=5.3.0
  • Fixed lxml version: 6.1.0
  • CVE: CVE-2026-41066 (CVSS 7.5 HIGH)
  • GHSA: GHSA-vfmq-68hx-4jfw
Lingua principale
Python
Stelle
17
Fork
9
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.