(superset) 01/01: fix(deps): cap paramiko <4.0 to keep SSH tunneling working

[di...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

geido pushed a commit to branch geido/paramiko-dsskey-ssh-error
in repository https://gitbox.apache.org/repos/asf/superset.git

commit d6862213bd61226ad9c91503ac6f636d45924e3d
Author: Diego Pucci <di...@gmail.com>
AuthorDate: Thu Jun 11 16:53:03 2026 +0300

    fix(deps): cap paramiko <4.0 to keep SSH tunneling working
    
    paramiko 4.0.0 removed the DSSKey class (DSA support was dropped). The
    sshtunnel library used for SSH database tunneling references
    paramiko.DSSKey unconditionally in get_keys(), which
    SSHTunnelForwarder.__init__ invokes on every open_tunnel(). Once
    paramiko >=4 is resolved into the environment, every SSH-tunneled
    database connection fails during tunnel setup with:
    
        AttributeError: module 'paramiko' has no attribute 'DSSKey'
    
    This is independent of the user's key type, because the crash happens
    while enumerating key classes during forwarder initialization, before
    the user's key is used.
    
    The constraint was "paramiko>=3.4.0" with no upper bound, so any
    environment that re-resolves dependencies pulls paramiko 4.x/5.x and
    breaks. Cap to <4.0 to keep paramiko on the 3.x line, which retains
    DSSKey. The pinned lockfiles already resolve to paramiko==3.5.1 (the
    latest 3.x), so no lockfile regeneration is required.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <no...@anthropic.com>
---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index f694b400393..48d2b09f019 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -80,7 +80,7 @@ dependencies = [
     "bottleneck", # recommended performance dependency for pandas, see https://pandas.pydata.org/docs/getting_started/install.html#performance-dependencies-recommended
     # --------------------------
     "parsedatetime",
-    "paramiko>=3.4.0",
+    "paramiko>=3.4.0, <4.0", # 4.0 removed DSSKey, still referenced by sshtunnel
     "pgsanity",
     "Pillow>=11.0.0, <13",
     "polyline>=2.0.0, <3.0",