Re: [D] Superset 6.1: is flask-caching still structurally required when runtime uses NullCache and SupersetMetastoreCache? [superset]

["bsethi24 (via GitHub)" <gi...@apache.org>]

GitHub user bsethi24 added a comment to the discussion: Superset 6.1: is flask-caching still structurally required when runtime uses NullCache and SupersetMetastoreCache?

Hi @dfbustosus / Team...... Thanks for the response.

Our main concern is the current Flask-Caching package version in our build: 2.3.1 (and the broader 2.x line, including 2.5.1), which is flagged by our security scan as a Critical issue (CVE-2021-33026, score 9.8).

- We would like to understand the supported remediation path for Superset 6.1 users who are blocked by mirror or policy constraints

1. Is there a recommended upgrade path to a non-vulnerable version?

2. Is there any supported way to avoid the dependency when only NullCache or melastore-backed cache modes are used?

3. If no supported removal path exists, what is the recommended remediation plan for a production build that cannot consume the vulnerable version?

4. Is this CVE expected to be fixed in a newer supported release?

Please advise on the recommended approach and any guidance available from the maintainers.

GitHub link: https://github.com/apache/superset/discussions/44823#discussioncomment-18758365

----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org