Minimum required numpy version (1.16.6) has security vulnerability
- Dominant language
- C++
- Stars
- 17.1k
- Forks
- 4.3k
- Avg merge
- 3d 13h
- Merged PRs (30d)
- 88
Description
### Describe the bug, including details regarding any error messages, version, and platform.
We currently use version 11.0.0 of pyarrow. We run Snyk checks to find vulnerabilities in our third party dependencies
In the version we use, but also on main, the setup.py file states numpy >= 1.16.6 is required (https://github.com/apache/arrow/blob/main/python/setup.py#L451)
This Python version is affected by the following vulnerability: https://security.snyk.io/vuln/SNYK-PYTHON-NUMPY-2321964
To solve the issue, version 1.22.2 or higher should be required
### Component(s)
Python
Contributor guide
Research direction
Read python/setup.py around line 451, where the minimum numpy version is declared. Confirm the current requirement and the linked Snyk vulnerability details, then update the minimum to 1.22.2 or higher. Done means the dependency declaration no longer permits numpy 1.16.6.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- numpy, python
- Domain
- data-engineering
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 50/100