chore: refresh dev apache-airflow lock to clear security alerts - #62
Merged
Conversation
apache-airflow (and its large transitive tree) is a dev-only dependency here — the published provider only depends on wherobots-python-dbapi and pydantic. The dev lock had drifted onto vulnerable transitive versions, producing dozens of Dependabot alerts for the CI test environment. Refresh the locked dev tree to the newest versions apache-airflow 2.x permits: aiohttp 3.12.15 -> 3.14.1, werkzeug 2.2.3 -> 3.1.8, cryptography 45 -> 49, pyjwt -> 2.13, urllib3 -> 2.7, requests -> 2.34, apache-airflow 2.11.0 -> 2.11.2, providers-http 5 -> 6, and others. This clears 65 of 86 alerts. The remaining alerts are apache-airflow CVEs patched only in 3.x (the provider caps <3) plus a few transitives airflow 2.x pins below their patched versions (flask, flask-appbuilder, pytest) — none of which ships in the provider wheel.
jiayuasu
requested review from
ClayMav,
james-willis,
peterfoldes and
zongsizhang
July 16, 2026 05:09
peterfoldes
approved these changes
Jul 16, 2026
6 tasks
zongsizhang
added a commit
that referenced
this pull request
Aug 18, 2026
Release bump for the v1.8.0 tag. Two changes have landed since v1.7.0: - #62 chore: refresh the dev apache-airflow lock to clear security alerts (dev dependency group only, no runtime surface change) - #64 feat: emit the X-Wherobots-Client attribution header (WBC-819) The attribution header is additive and reads the provider version from the installed distribution metadata, so this bump is what makes the provider report `client=airflow;ver=1.8.0` — minor, not patch, because #64 adds behavior. No runtime dependency floors change; wherobots-python-dbapi stays at >=0.28.0, and the published 0.28.1 already carries the `extra_headers` support the header relies on. Version lives in two places, both updated: `pyproject.toml` and the `airflow-providers-wherobots` entry in `uv.lock`. `uv lock --locked` passes, so no other lock churn was needed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Refreshes the dev dependency lock to clear security alerts in the
apache-airflowtest tree.Context
apache-airflowis a dev-only dependency ([dependency-groups] dev) — the published provider only depends onwherobots-python-dbapiandpydantic. So none of these alerts ship to users; they're the CI test environment. But the locked dev tree had drifted onto vulnerable transitive versions, producing 86 Dependabot alerts.Change
uv lockupgrade of the alert packages, staying within theapache-airflow>=2.7,<3constraint. Highlights:aiohttp3.12.15 -> 3.14.1 (was 29 alerts)werkzeug2.2.3 -> 3.1.8,flask2.2.5 -> 2.3.3cryptography45 -> 49,pyjwt-> 2.13,urllib3-> 2.7,requests-> 2.34,idna-> 3.18apache-airflow2.11.0 -> 2.11.2,providers-http5 -> 6,providers-smtp2 -> 3Clears 65 of 86 alerts.
Remaining (21, all dev-scope, structurally capped)
<3These can't be fixed without dropping airflow-2.x support, and none ship in the wheel. Tracking separately (dismiss as dev-scope, or fold into a future airflow-3 support decision).
Verification
Lock-only change to the dev/test environment; CI (pytest against airflow 2.11.2) validates the refreshed tree.