You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "bbovenzi (via GitHub)" <gi...@apache.org> on 2025/12/04 22:18:34 UTC
[PR] Manually bump packages [airflow]
bbovenzi opened a new pull request, #59073:
URL: https://github.com/apache/airflow/pull/59073
Dependabot had a lot of updates. I manually went through them.
Will do eslint and typescript in a separate PR because it broke our CI
---
**^ Add meaningful description above**
Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information.
In case of fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
In case of a new dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
In case of backwards incompatible changes please leave a note in a newsfragment file, named `{pr_number}.significant.rst` or `{issue_number}.significant.rst`, in [airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Manually bump packages [airflow]
Posted by "tschroeder-zendesk (via GitHub)" <gi...@apache.org>.
tschroeder-zendesk commented on PR #59073:
URL: https://github.com/apache/airflow/pull/59073#issuecomment-3628495518
Will this PR address https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Manually bump packages [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #59073:
URL: https://github.com/apache/airflow/pull/59073#issuecomment-3634888187
> No need to be rude. I just asked if this addressed that as it seemed like it would since that CVE mentioned needing to bump react to 19.2.1 and react-dom 19.2.1 that seemed to be addressed here and after looking at the code it wasn't clear to me if this security issue was a problem. The version is definitely one of the affected so I don't think it was an unreasonable question.
React != react-server-components. In all articles about the issue it's very clearly specifed which components are updated. And it's a great opportunity to remind people that there are ways to check it. You are not the first one who did not look in detail but saw "react" and did not check that it was really "react-server-components", there were few others with difference channels who did not check we are not using it. If everyone - like you and them - would do the same, we would have to spend the whole day just answering.
You have to be really careful when you mention a security issue in publick - it might not only be "irresponsive disclosure". This immediately triggers maintainers alert - and might drag attention of malicious actors who might want to use it against the project, So by publicly commenting on it you are putting the project in danger, if in-fact we would be affected. Our project have very clear policies, describing what you should do when you suspect security issue. Commenting on public PRs and issues is NOT the way it should be done. I recommend you check it (Security tab in GitHub project - easy to find).
Also - to be perfectly honest - the harsh tone is deliberate. Since those issues are public - I treat it as a teaching and unfortunately this time it was your turn - I hope this will serve as an example to others who will likely find the issue and learn about SBOMS and ways they should check things. If we receive 1000 questions like yours and 1 on of them will be important - we migh miss it, so I prefer to be slightly rude and through that have less of such questions - no more.
This is really a sign we are treating security seriously - and we simply ask our users to do the same. Just that.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Manually bump packages [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #59073:
URL: https://github.com/apache/airflow/pull/59073#issuecomment-3661734631
### Backport failed to create: v3-1-test. View the failure log <a href='https://github.com/apache/airflow/actions/runs/20277581706'> Run details </a>
<table>
<tr>
<th>Status</th>
<th>Branch</th>
<th>Result</th>
</tr>
<tr>
<td>❌</td>
<td>v3-1-test</td>
<td><a href="https://github.com/apache/airflow/commit/55c42fa7fd6bb5d0b5bb6649469f9141c925c150"><img src='https://img.shields.io/badge/Commit-55c42fa-red' alt='Commit Link'></a></td>
</tr>
</table>
You can attempt to backport this manually by running:
```bash
cherry_picker 55c42fa v3-1-test
```
This should apply the commit to the v3-1-test branch and leave the commit in conflict state marking
the files that need manual conflict resolution.
After you have resolved the conflicts, you can continue the backport process by running:
```bash
cherry_picker --continue
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Manually bump packages [airflow]
Posted by "bbovenzi (via GitHub)" <gi...@apache.org>.
bbovenzi commented on PR #59073:
URL: https://github.com/apache/airflow/pull/59073#issuecomment-3661729941
Merging. Test failures unrelated
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Manually bump packages [airflow]
Posted by "bbovenzi (via GitHub)" <gi...@apache.org>.
bbovenzi commented on PR #59073:
URL: https://github.com/apache/airflow/pull/59073#issuecomment-3643949108
Fortunately, we're not worried about the specific server components vulnerability. But I figured its not a bad idea to update react anyways.
Just pushed up changes that should fix all the eslint and typescript errors
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Manually bump packages [airflow]
Posted by "pierrejeambrun (via GitHub)" <gi...@apache.org>.
pierrejeambrun commented on PR #59073:
URL: https://github.com/apache/airflow/pull/59073#issuecomment-3633222911
@tschroeder-zendesk Airflow is not exposed to this vulnerability.
If you think otherwise, I suggest you contact our security team at `security@airflow.apache.org` with more details.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Manually bump packages [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #59073:
URL: https://github.com/apache/airflow/pull/59073#issuecomment-3633705823
I think rebase is needed @bbovenzi :) ..
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Manually bump packages [airflow]
Posted by "tschroeder-zendesk (via GitHub)" <gi...@apache.org>.
tschroeder-zendesk commented on PR #59073:
URL: https://github.com/apache/airflow/pull/59073#issuecomment-3634772421
> > If you think otherwise, I suggest you contact our security team at [security@airflow.apache.org](mailto:security@airflow.apache.org) with a report.
>
> Including POC @tschroeder-zendesk
>
> Also @tschroeder-zendesk -> if you look at Security tab of our documentation, you will find SBOM - which is machine-readable, industry standard way how you can check which 3rd-party dependencies Airflow uses. Please use it next time when you want to see if particular component that you know is vulnerable. That will save a lot of time of maintainers that have to individually answer ssuch questions rather than users reading informatoin that is provided by maintainers so that they can use it.
>
> When you are getting software for free, I think good idea is not to demand more time from maintainers than needed - especially if they provide you all information you need (for free mind you)
No need to be rude. I just asked if this addressed that as it seemed like it would since that CVE mentioned needing to bump react to 19.2.1 and react-dom 19.2.1 that seemed to be addressed here and after looking at the code it wasn't clear to me if this security issue was a problem. The version is definitely one of the affected so I don't think it was an unreasonable question.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Manually bump packages [airflow]
Posted by "bbovenzi (via GitHub)" <gi...@apache.org>.
bbovenzi merged PR #59073:
URL: https://github.com/apache/airflow/pull/59073
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Manually bump packages [airflow]
Posted by "pierrejeambrun (via GitHub)" <gi...@apache.org>.
pierrejeambrun commented on PR #59073:
URL: https://github.com/apache/airflow/pull/59073#issuecomment-3665685072
Manual backport is needed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Manually bump packages [airflow]
Posted by "bbovenzi (via GitHub)" <gi...@apache.org>.
bbovenzi commented on PR #59073:
URL: https://github.com/apache/airflow/pull/59073#issuecomment-3627376095
Working on it, looks like the react upgrade changed some typescript checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Manually bump packages [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #59073:
URL: https://github.com/apache/airflow/pull/59073#issuecomment-3633701405
> If you think otherwise, I suggest you contact our security team at security@airflow.apache.org with a report.
Including POC @tschroeder-zendesk
Also @tschroeder-zendesk -> if you look at Security tab of our documentation, you will find SBOM - which is machine-readable, industry standard way how you can check which 3rd-party dependencies Airflow uses. Please use it next time when you want to see if particular component that you know is vulnerable. That will save a lot of time of maintainers that have to individually answer ssuch questions rather than users reading informatoin that is provided by maintainers so that they can use it.
When you are getting software for free, I think good idea is not to demand more time from maintainers than needed - especially if they provide you all information you need (for free mind you)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org