You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "potiuk (via GitHub)" <gi...@apache.org> on 2026/09/13 07:42:03 UTC

[PR] Allow GHSA-8mgp-746c-j5xp (nltk) in the dependency review gates [airflow]

potiuk opened a new pull request, #73059:
URL: https://github.com/apache/airflow/pull/73059

   The `Reject vulnerable dependency changes` jobs fail on `uv.lock ยป nltk@3.10.3` for [GHSA-8mgp-746c-j5xp](https://github.com/advisories/GHSA-8mgp-746c-j5xp) (CVE-2026-81726, high) โ€” a path traversal in nltk's model-artifact save/load APIs (`TransitionParser.train`/`parse`, `AveragedPerceptron.save`/`load`, `PerceptronTagger.save_to_json`, `save_maxent_params`), which call builtin `open()` on a caller-supplied path instead of nltk's pathsec helpers.
   
   It does not affect Airflow:
   
   * nltk is not an Airflow dependency. It arrives only through `llama-index-core` (`Requires-Dist: nltk>=3.9.3`), itself the `llamaindex` optional extra and dev group of `apache-airflow-providers-common-ai`.
   * It is absent from the released constraints โ€” `nltk` appears only in `constraints-source-providers-*.txt`, never in `constraints-*.txt` or `constraints-no-providers-*.txt`.
   * The affected APIs are never imported by `llama-index-core`, which uses only the Punkt tokenizer and the stopwords corpus (`llama_index/core/utils.py`, plus optional `rake_nltk` in `indices/keyword_table/utils.py`).
   
   Upstream merged the fix on nltk's `develop` branch (nltk/nltk#3757, nltk/nltk#3759, nltk/nltk#3813) *after* `v3.10.3` was tagged, so the advisory has no patched version and the check stays red until nltk 3.10.4 ships. Upstream tracker: nltk/nltk#3789. Drop the entries once it ships.
   
   Both gates get the entry: each triggers on its own SDK paths but then reviews the whole PR dependency diff, `uv.lock` included. That is also why a Python-side advisory currently fails the Java SDK gate โ€” worth scoping separately, but out of scope here.
   
   This is the same fixup already pushed to `changes-3.3.2rc1` to unblock #72946, landed on `main` so the next sync PR doesn't hit it again.
   
   ๐Ÿค– Generated with [Claude Code](https://claude.com/claude-code)
   
   https://claude.ai/code/session_01G9A6Mofr5qErDuTh7vqWcX
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Allow GHSA-8mgp-746c-j5xp (nltk) in the dependency review gates [airflow]

Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #73059:
URL: https://github.com/apache/airflow/pull/73059#issuecomment-5652176798

   Already merged 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Allow GHSA-8mgp-746c-j5xp (nltk) in the dependency review gates [airflow]

Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk closed pull request #73059: Allow GHSA-8mgp-746c-j5xp (nltk) in the dependency review gates
URL: https://github.com/apache/airflow/pull/73059


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org