Skip to content

Conversation

@kukushking
Copy link
Contributor

@kukushking kukushking commented Oct 30, 2025

Feature or Bugfix

  • Feature

Detail

  • CVE-2025-61385
  • fix authors field in pyproject.toml for test infra
  • override pyarrow version

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@kukushking kukushking self-assigned this Oct 30, 2025
@kukushking kukushking changed the title chore: upgrade pg8000 due to a CVE chore: upgrade pg8000 due to a CVE-2025-61385 Oct 30, 2025
@jaidisido

This comment was marked as outdated.

@jaidisido

This comment was marked as outdated.

@jaidisido

This comment was marked as outdated.

@jaidisido

This comment was marked as outdated.

@jaidisido

This comment was marked as outdated.

@jaidisido

This comment was marked as outdated.

@jaidisido

This comment was marked as outdated.

@jaidisido

This comment was marked as outdated.

@jaidisido

This comment was marked as outdated.

@bbodensieck
Copy link

Sorry for jumping in, wouldn't this be an option in the pyproject.toml and then rebuild the uv.lock?

- postgres = ["pg8000>=1.29.0,<2"]
+ postgres = ["pg8000>=1.31.5,<2"]

@jaidisido

This comment was marked as outdated.

@jaidisido

This comment was marked as outdated.

@jaidisido

This comment was marked as outdated.

@jaidisido

This comment was marked as outdated.

@jaidisido

This comment was marked as outdated.

@kukushking
Copy link
Contributor Author

Sorry for jumping in, wouldn't this be an option in the pyproject.toml and then rebuild the uv.lock?

- postgres = ["pg8000>=1.29.0,<2"]
+ postgres = ["pg8000>=1.31.5,<2"]

Thanks for jumping in - toml just specifies the constraints, the dependency was updated in the lock file.

@jaidisido

This comment was marked as outdated.

@jaidisido
Copy link
Contributor

AWS CodeBuild CI Report

  • CodeBuild project: GitHubCodeBuild8756EF16-4rfo0GHQ0u9a
  • Commit ID: fb3ec38
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@kukushking kukushking merged commit f5980f2 into main Oct 30, 2025
24 checks passed
@kukushking kukushking deleted the fix/upgrade-pg8000 branch October 30, 2025 12:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants