fix(security): bump mlflow-skinny to clear Snyk critical/high findings#30046
Merged
Conversation
The Snyk ingestion dependency scan flags mlflow-skinny 3.12.0: - CVE-2026-2635 (critical) — Use of Default Credentials - CVE-2026-8147 (high) — Missing Authorization Both are fixed in the stable 3.13.0 release. Lift the window from >=3.11.1,<3.13 to >=3.13.0,<3.15 (resolves to 3.14.0), matching the established pattern of bumping this connector-extra pin for Snyk findings.
Contributor
✅ PR checks passedThe linked issue has a description and all required Shipping project fields set. Thanks! |
Contributor
|
Hi there 👋 Thanks for your contribution! The OpenMetadata team will review the PR shortly! Once it has been labeled as Let us know if you need any help! |
Khairajani
added
the
safe to test
Contributor
|
The Python checkstyle failed. Please run You can install the pre-commit hooks with |
Contributor
🔴 Playwright Results — 2 failure(s), 27 flaky✅ 4538 passed · ❌ 2 failed · 🟡 27 flaky · ⏭️ 96 skipped
Genuine Failures (failed on all attempts)❌
|
ruff format wrapped the inline comment past line-length; move the CVE rationale above the pin so the line stays short, and update the stale `>=3.11.1` note to reflect the new `>=3.13.0` floor.
|
mohittilala
added
To release
mohittilala
approved these changes
Jul 17, 2026
Contributor
|
Failed to cherry-pick changes to the 1.13 branch. |
Code Review ✅ ApprovedBumps the mlflow-skinny dependency version to 3.14.0 to remediate critical and high CVEs identified by Snyk. No issues were found. OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
mohittilala
pushed a commit
that referenced
this pull request
Jul 17, 2026
#30046) * fix(security): bump mlflow-skinny to clear Snyk critical/high findings The Snyk ingestion dependency scan flags mlflow-skinny 3.12.0: - CVE-2026-2635 (critical) — Use of Default Credentials - CVE-2026-8147 (high) — Missing Authorization Both are fixed in the stable 3.13.0 release. Lift the window from >=3.11.1,<3.13 to >=3.13.0,<3.15 (resolves to 3.14.0), matching the established pattern of bumping this connector-extra pin for Snyk findings. * style(ingestion): run make py_format; refresh mlflow pin comment ruff format wrapped the inline comment past line-length; move the CVE rationale above the pin so the line stays short, and update the stale `>=3.11.1` note to reflect the new `>=3.13.0` floor.
Contributor
|
Manually cherry-picked to 1.12.14 36928d1 |
mohittilala
pushed a commit
that referenced
this pull request
Jul 17, 2026
#30046) * fix(security): bump mlflow-skinny to clear Snyk critical/high findings The Snyk ingestion dependency scan flags mlflow-skinny 3.12.0: - CVE-2026-2635 (critical) — Use of Default Credentials - CVE-2026-8147 (high) — Missing Authorization Both are fixed in the stable 3.13.0 release. Lift the window from >=3.11.1,<3.13 to >=3.13.0,<3.15 (resolves to 3.14.0), matching the established pattern of bumping this connector-extra pin for Snyk findings. * style(ingestion): run make py_format; refresh mlflow pin comment ruff format wrapped the inline comment past line-length; move the CVE rationale above the pin so the line stays short, and update the stale `>=3.11.1` note to reflect the new `>=3.13.0` floor.
Contributor
|
Manually cherry-picked to 1.13 for 1.13.2 8ea4693 |
This was referenced Jul 17, 2026
Mlflow connector: 3.13+ bump breaks AutoPilot E2E and models are dropped after registry edits
#30189
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix #30100
What
The Snyk
ingestion-dep-scan(security-scan workflow) flags mlflow-skinny 3.12.0 — the only Python-dependency finding in the ingestion scan:Lifts the connector-extra window
mlflow-skinny>=3.11.1,<3.13→>=3.13.0,<3.15(resolves to stable 3.14.0; no release-candidate). This mirrors the prior Snyk-driven bump in #28501.Collate inherits this via the OSS
mlflowextra — no separate Collate change needed.Verification
pip install --dry-run "mlflow-skinny>=3.13.0,<3.15"resolves cleanly to 3.14.0 (exit 0, no conflicts).Scope note
This clears the Python-dependency portion of the ingestion security-scan. The remaining ingestion scan findings are Debian base-image OS CVEs (
zlib,openexr,cups,expat,libarchive,tiff, …) inapache/airflow:3.2.1-python3.10— 38 of 41 have no upstream fix available, so they are out of scope here and require a base-image refresh (or a Snyk ignore policy) rather than a dependency bump.Greptile Summary
This PR updates the MLflow ingestion extra to use a fixed
mlflow-skinnyrange.mlflow-skinnyfrom>=3.11.1,<3.13to>=3.13.0,<3.15.Confidence Score: 5/5
This looks safe to merge.
Important Files Changed
Reviews (5): Last reviewed commit: "Merge branch 'main' into security/bump-m..." | Re-trigger Greptile
Context used (3)