You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "dpgaspar (via GitHub)" <gi...@apache.org> on 2025/12/11 11:06:24 UTC
[PR] chore: bump urllib3 to 2.6.0 [superset]
dpgaspar opened a new pull request, #36526:
URL: https://github.com/apache/superset/pull/36526
### SUMMARY
Bump urllib3 to 2.6.0 to address the following vulnerability: [CVE-2025-66471](https://nvd.nist.gov/vuln/detail/CVE-2025-66471)
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
<!--- Skip this if not applicable -->
### TESTING INSTRUCTIONS
<!--- Required! What steps can be taken to manually verify the changes? -->
### ADDITIONAL INFORMATION
<!--- Check any relevant boxes with "x" -->
<!--- HINT: Include "Fixes #nnn" if you are fixing an existing issue -->
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore: bump urllib3 to 2.6.0 [superset]
Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on PR #36526:
URL: https://github.com/apache/superset/pull/36526#issuecomment-3641402684
CodeAnt AI is reviewing your PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore: bump urllib3 to 2.6.0 [superset]
Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on code in PR #36526:
URL: https://github.com/apache/superset/pull/36526#discussion_r2610168805
##########
requirements/base.in:
##########
@@ -16,7 +16,7 @@
# specific language governing permissions and limitations
# under the License.
#
-urllib3==2.5.0
+urllib3==2.6.0
Review Comment:
**Suggestion:** Strict equality pin `urllib3==2.6.0` can cause dependency resolution failures when another package requires a different urllib3 version; use a compatible range so the resolver can find a mutually compatible set of packages. [possible bug]
**Severity Level:** Critical 🚨
```suggestion
urllib3>=2.6.0,<3.0.0
```
<details>
<summary><b>Why it matters? ⭐ </b></summary>
The PR added an exact pin. Exact pins can cause dependency resolution failures when other packages require a different urllib3 version.
Switching to a compatible range (e.g. >=2.6.0,<3.0.0) gives the resolver flexibility and aligns with how most other deps in this file are specified.
This is a real, actionable change that can prevent install-time conflicts.
</details>
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** requirements/base.in
**Line:** 19:19
**Comment:**
*Possible Bug: Strict equality pin `urllib3==2.6.0` can cause dependency resolution failures when another package requires a different urllib3 version; use a compatible range so the resolver can find a mutually compatible set of packages.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
```
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore: bump urllib3 to 2.6.0 [superset]
Posted by "dpgaspar (via GitHub)" <gi...@apache.org>.
dpgaspar merged PR #36526:
URL: https://github.com/apache/superset/pull/36526
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore: bump urllib3 to 2.6.0 [superset]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #36526:
URL: https://github.com/apache/superset/pull/36526#issuecomment-3641432957
## [Codecov](https://app.codecov.io/gh/apache/superset/pull/36526?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 47.88%. Comparing base ([`1bde06b`](https://app.codecov.io/gh/apache/superset/commit/1bde06b3661637c1a1d467513f27b97d1f764b71?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`2197a4b`](https://app.codecov.io/gh/apache/superset/commit/2197a4bee7b942461d92b39c5e9be043f5b15338?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #36526 +/- ##
===========================================
+ Coverage 0 47.88% +47.88%
===========================================
Files 0 637 +637
Lines 0 47101 +47101
Branches 0 5131 +5131
===========================================
+ Hits 0 22553 +22553
- Misses 0 23893 +23893
- Partials 0 655 +655
```
| [Flag](https://app.codecov.io/gh/apache/superset/pull/36526/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [hive](https://app.codecov.io/gh/apache/superset/pull/36526/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `43.50% <ø> (?)` | |
| [presto](https://app.codecov.io/gh/apache/superset/pull/36526/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `47.14% <ø> (?)` | |
| [python](https://app.codecov.io/gh/apache/superset/pull/36526/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `47.87% <ø> (?)` | |
| [unit](https://app.codecov.io/gh/apache/superset/pull/36526/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `100.00% <ø> (?)` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/superset/pull/36526?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore: bump urllib3 to 2.6.0 [superset]
Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on PR #36526:
URL: https://github.com/apache/superset/pull/36526#issuecomment-3641411503
CodeAnt AI finished reviewing your PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore: bump urllib3 to 2.6.0 [superset]
Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on PR #36526:
URL: https://github.com/apache/superset/pull/36526#issuecomment-3641410305
## Nitpicks 🔍
<table>
<tr><td>🔒 <strong>No security issues identified</strong></td></tr>
<tr><td>⚡ <strong>Recommended areas for review</strong><br><br>
- [ ] <a href='https://github.com/apache/superset/pull/36526/files#diff-ffb9a8aa35f8e58dd818a724713720da25a2847e19d36b4bbf5da7d5744415e0R19-R19'><strong>Compatibility risk</strong></a><br>Bumping `urllib3` can cause runtime compatibility regressions with other libraries that depend on a specific `urllib3` behaviour or API (e.g., `requests`, `botocore`, or vendored copies). Validate that no transitive dependencies rely on behaviour changed in 2.6.0.<br>
- [ ] <a href='https://github.com/apache/superset/pull/36526/files#diff-ffb9a8aa35f8e58dd818a724713720da25a2847e19d36b4bbf5da7d5744415e0R19-R19'><strong>Lockfile / CI drift</strong></a><br>The high-level requirements file was changed but compiled/locked requirement files (pip-compiled .txt or constraint files used in CI and Docker images) may be out of sync. Ensure lockfiles and CI images are regenerated so deployments actually use 2.6.0.<br>
- [ ] <a href='https://github.com/apache/superset/pull/36526/files#diff-ffb9a8aa35f8e58dd818a724713720da25a2847e19d36b4bbf5da7d5744415e0R19-R19'><strong>Test coverage gap</strong></a><br>The upgrade needs verification across supported Python versions and integration tests (HTTP clients, auth, retries, connection pooling). Run full unit + integration matrix to detect regressions introduced by the bump.<br>
</td></tr>
</table>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org