apache / apache/arrow

Minimum required numpy version (1.16.6) has security vulnerability

Open
#35,846 2 comments 1 reaction 0 assignees View on GitHub
Component: Python Type: bug
Dominant language
C++
Stars
17.1k
Forks
4.3k
Avg merge
3d 13h
Merged PRs (30d)
88

Description

### Describe the bug, including details regarding any error messages, version, and platform.

We currently use version 11.0.0 of pyarrow. We run Snyk checks to find vulnerabilities in our third party dependencies

In the version we use, but also on main, the setup.py file states numpy >= 1.16.6 is required (https://github.com/apache/arrow/blob/main/python/setup.py#L451)

This Python version is affected by the following vulnerability: https://security.snyk.io/vuln/SNYK-PYTHON-NUMPY-2321964

To solve the issue, version 1.22.2 or higher should be required

### Component(s)

Python

Contributor guide

Open the contributing guide

Research direction

Read python/setup.py around line 451, where the minimum numpy version is declared. Confirm the current requirement and the linked Snyk vulnerability details, then update the minimum to 1.22.2 or higher. Done means the dependency declaration no longer permits numpy 1.16.6.

Written by the indexing model from the issue text.

Assessment

Tech stack
numpy, python
Domain
data-engineering
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.