Request: v1 release that allows urllib3 v1.26.5 #16527
Labels
Comments
|
Thanks for opening your first issue here! Be sure to follow the issue template! |
michalc
changed the title
|
Airflow 1.10 has just (yesterday) reached End-Of-Life (!). It won't receive any more even critical security fixes. Please upgrade to 2.1+ at earliest convenience. |
|
Airflow 2.2 will contain the latest urllib3 https://github.com/apache/airflow/blob/constraints-main/constraints-3.6.txt#L497 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
We're still on Airflow v1.10.15 (moving to v2, but it's taking a while). However, Airflow v1 depends on requests < 2.24, i.e. the latest version that can be installed is 2.23.0, but this in turn requires urllib3<1.26. However, there is a vulnerability in urrlib3 before 1.26.5 GHSA-q2q7-5pp4-w6pg
It's probably a bit cheeky to ask, but you never know: can there be another v1 release that allows enough of a bump of requests to allow urllib3 v1.26.5?
Use case / motivation
Avoid vulnerabilities in Airflow v1
Are you willing to submit a PR?
No (sorry...)
Related Issues
No
The text was updated successfully, but these errors were encountered: