airbytehq / airbytehq/airbyte-python-cdk

Update setuptools to address CVE-2026-59890

Aperta Adatta ai principianti
#1,118 2 commenti 0 reazioni 0 assegnatari Vedi su GitHub
community
Lingua principale
Python
Stelle
26
Fork
53
Merge medio
2g 6h
PR unite (30g)
10

Descrizione

The latest released `airbyte-cdk` (7.25.1) and current `main` constrain `setuptools` to `^80.9.0`, while CVE-2026-59890 is fixed in 83.0.0. Downstream connectors cannot override this because Poetry reports an unsatisfiable constraint.

Please widen/update the CDK constraint to include `setuptools >=83.0.0` and publish a release so downstream lockfiles can remediate the vulnerability.

Trivy 0.74.0 reports this as MEDIUM with fixed version 83.0.0.

---
**Internal Tracking:** https://github.com/airbytehq/oncall/issues/13315

Guida per i contributori

Apri la guida per i contributori

Direzione di ricerca

Locate the Poetry dependency declaration that constrains setuptools in the CDK, then inspect how the current main branch and release configuration represent that constraint. Update it to include version 83.0.0 or newer, verify downstream lockfiles can resolve the fixed version, and publish a release as requested.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
python
Ambito
build-system, release, security
Tipo di issue
Bug
Difficoltà
2/5
Tempo stimato
1-3 ore
Stato di attività
Attiva
Chiarezza
Specificata chiaramente
Idoneità per principianti
75/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.