Skip to content

docs(security): Option A (uninstall pyarrow) probed and rejected — record why #229

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
brownjuly2003-code merged 1 commit into from
Jul 20, 2026
Merged

docs(security): Option A (uninstall pyarrow) probed and rejected — record why #229

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -222,6 +222,13 @@ jobs:
# manifest (src/processing/flink_jobs), so the next apache-flink
# release opens a PR — re-check this ignore there. Remove when the
# resolved flink-runtime bucket installs pyarrow>=23.0.1.
# Do NOT retry "uninstall unused pyarrow from the image" — probed
# in the real image 2026-07-21 and rejected: without pyarrow,
# `import apache_beam` itself crashes (beam 2.61 io/__init__ does
# `from apache_beam.io.parquetio import *`, and parquetio's class
# bodies evaluate `pa.Table` annotations with pa=None ->
# AttributeError). The dependency is load-bearing at import time
# even though our jobs never use it.
#
# 88512 (langchain cross-ecosystem false positive) was ignored here
# until 2026-07-20; PyUp corrected the entry (verified: safety
Expand Down