dvc-data dependency python-diskcache has critical vulnerability

Sorry, this is not really a bug report or a feature request.

My team has built our data pipeline using DVC. I have been informed that python-diskcache, which is a dependency of dvc-data, has a critical vulnerability which causes its CVSS score to be > 9, which means it will be blocked by our company's InfoSec team, so that we can not download it, and therefore can not build our data pipeline.

This is the vulnerability that is causing diskcache to have a high CVSS score: https://nvd.nist.gov/vuln/detail/CVE-2025-69872

The python-diskcache PR (https://github.com/grantjenks/python-diskcache/pull/364), which appears to address the vulnerability, would introduce breaking changes (and has version 6.0.0). However, my team has tested it locally and our dvc repro commands work fine with it.

There is no recent activity in the python-diskcache repo and the maintainer has not been responding for a few months, so I don't know when this fix will be merged. The fix is also available in the following fork: https://github.com/mapped/python-diskcache

@skshetry

No file or test is named in the issue. Start by locating dvc-data's python-diskcache dependency declaration, then compare the upstream PR and mapped fork for breaking changes. The work is done when the vulnerable dependency is replaced or safely upgraded and existing dvc repro commands continue to work.