Skip to content

[Snyk] Fix for 2 vulnerabilities #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
deargvp1 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Fix for 2 vulnerabilities #31

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions composer/airflow_1_samples/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,3 +5,5 @@ apache-airflow-backport-providers-google==2021.3.3
apache-airflow-backport-providers-cncf-kubernetes==2021.3.3
kubernetes==11.0.0
scipy==1.4.1; python_version > '3.0'
idna>=3.7 # not directly required, pinned by Snyk to avoid a vulnerability
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Jun 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Pinning idna>=3.7 introduces a dependency conflict with requests 2.23.0 (used by Apache Airflow 1.10.15), which requires idna<3,>=2.5. This will prevent successful installation of the requirements.

Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot Jun 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: New dependency minimums conflict with the sample’s pinned constraints, which can break dependency resolution for Airflow 1 installs.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At composer/airflow_1_samples/requirements.txt, line 8:

<comment>New dependency minimums conflict with the sample’s pinned constraints, which can break dependency resolution for Airflow 1 installs.</comment>

<file context>
@@ -5,3 +5,5 @@ apache-airflow-backport-providers-google==2021.3.3
 apache-airflow-backport-providers-cncf-kubernetes==2021.3.3
 kubernetes==11.0.0
 scipy==1.4.1; python_version > '3.0'
+idna>=3.7 # not directly required, pinned by Snyk to avoid a vulnerability
+marshmallow>=3.26.2 # not directly required, pinned by Snyk to avoid a vulnerability
</file context>

Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot Jun 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: Pinning idna>=3.7 creates an unresolvable dependency conflict. Apache Airflow 1.10.15 depends on requests in the range <2.24.0,>=2.20.0, and all versions of requests in that range (including 2.23.0) require idna<3,>=2.5. Since idna>=3.7 violates the <3 upper bound, pip install will fail with a dependency resolution error.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At composer/airflow_1_samples/requirements.txt, line 8:

<comment>Pinning `idna>=3.7` creates an unresolvable dependency conflict. Apache Airflow 1.10.15 depends on `requests` in the range `<2.24.0,>=2.20.0`, and all versions of `requests` in that range (including 2.23.0) require `idna<3,>=2.5`. Since `idna>=3.7` violates the `<3` upper bound, `pip install` will fail with a dependency resolution error.</comment>

<file context>
@@ -5,3 +5,5 @@ apache-airflow-backport-providers-google==2021.3.3
 apache-airflow-backport-providers-cncf-kubernetes==2021.3.3
 kubernetes==11.0.0
 scipy==1.4.1; python_version > '3.0'
+idna>=3.7 # not directly required, pinned by Snyk to avoid a vulnerability
+marshmallow>=3.26.2 # not directly required, pinned by Snyk to avoid a vulnerability
</file context>
Suggested change
idna>=3.7 # not directly required, pinned by Snyk to avoid a vulnerability
idna>=2.5,<3 # not directly required, pinned by Snyk to avoid a vulnerability

marshmallow>=3.26.2 # not directly required, pinned by Snyk to avoid a vulnerability
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Jun 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Pinning marshmallow>=3.26.2 introduces a dependency conflict with Flask-AppBuilder 2.3.4 (used by Apache Airflow 1.10.15), which requires marshmallow<3.0.0,>=2.18.0. This will cause installation failures.

Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot Jun 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P0: marshmallow>=3.26.2 conflicts with Flask-AppBuilder 2.3.4 (bundled with apache-airflow[gcp]==1.10.15), which requires marshmallow<3.0.0,>=2.18.0. This will cause pip dependency resolution to fail, and even if forced, Airflow 1.10.15's web UI (built on Flask-AppBuilder) will break due to marshmallow 3.x's breaking API changes (removed strict mode, changed load/dump return types, etc.). The Snyk-required marshmallow fix is incompatible with this Airflow version.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At composer/airflow_1_samples/requirements.txt, line 9:

<comment>marshmallow>=3.26.2 conflicts with Flask-AppBuilder 2.3.4 (bundled with apache-airflow[gcp]==1.10.15), which requires marshmallow<3.0.0,>=2.18.0. This will cause pip dependency resolution to fail, and even if forced, Airflow 1.10.15's web UI (built on Flask-AppBuilder) will break due to marshmallow 3.x's breaking API changes (removed strict mode, changed load/dump return types, etc.). The Snyk-required marshmallow fix is incompatible with this Airflow version.</comment>

<file context>
@@ -5,3 +5,5 @@ apache-airflow-backport-providers-google==2021.3.3
 kubernetes==11.0.0
 scipy==1.4.1; python_version > '3.0'
+idna>=3.7 # not directly required, pinned by Snyk to avoid a vulnerability
+marshmallow>=3.26.2 # not directly required, pinned by Snyk to avoid a vulnerability
</file context>