docs(security): advisory-accurate reason for the pyarrow safety ignore - #228
Merged
Conversation
…isory External review (Grok deep-audit follow-up) flagged the old reason as both overclaiming and underusing the facts: it argued "only beam-internal IPC", but on the DataStream STRING/pickle path no Arrow IPC is exchanged at all, and the stronger official finding went unused. Per GHSA-rgxp-2hwp-jwgg (verified 2026-07-20): the vulnerable API is the C++ IPC *file* reader with pre-buffering enabled, not exposed in Python bindings — the pyarrow wheel cannot reach the bug. PyFlink's only pyarrow use is the lazy Table/pandas ArrowCoder whose decode is pa.ipc.open_stream (IPC stream reader), explicitly excluded by the advisory. No behavior change — comment only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
DORA Metrics
|
…files) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Comment-only. Rewrites the SFTY-20260217-93940 ignore reason in the safety step after an external deep-review flagged the old wording as weak: it claimed the Flink jobs "only exchange beam-internal Arrow IPC", which is likely false on the DataStream path (STRING/pickle coders, no Arrow IPC at all) — while missing the much stronger official argument.
Verified 2026-07-20 against GHSA-rgxp-2hwp-jwgg and pyflink
release-2.3.0sources:RecordBatchFileReader::PreBufferMetadata— C++ IPC file reader with pre-buffering enabled (off by default). The advisory states verbatim that the functionality "is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable".fn_execution/coders.py); their decode path ispa.ipc.open_stream— the IPC stream reader, explicitly excluded by the advisory. Our jobs never trigger those branches.Verification
yaml.safe_loadon security.yml OK;tests/unit/test_security_workflow.pypasses (contract untouched — trivy SBOM steps only).🤖 Generated with Claude Code