Skip to content

Fixes #31790: [1.13] upgrade collate-sqllineage and require Python 3.10 - #31896

Merged
pmbrull merged 5 commits into
1.13from
fix/sqlparse-cve-1.13
Aug 21, 2026
Merged

Fixes #31790: [1.13] upgrade collate-sqllineage and require Python 3.10#31896
pmbrull merged 5 commits into
1.13from
fix/sqlparse-cve-1.13

Conversation

@IceS2

@IceS2 IceS2 commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

Fixes #31790.\n\nBackports the sqlparse CVE remediation from #31885 to 1.13 by upgrading collate-sqllineage from 2.1.4 to 2.1.7 and removing the temporary Docker-level sqlparse override. The resolver now installs sqlparse 0.6.0 through the normal dependency graph.\n\nThis raises the ingestion package's supported Python floor from 3.9 to 3.10 because both collate-sqllineage 2.1.7 and sqlparse 0.6.0 require Python 3.10 or newer. It also aligns the LAG/LEAD lineage expectation with the behavior already accepted on newer branches.

mohittilala and others added 5 commits August 21, 2026 18:12
2.1.4 produces no column lineage for UPDATE and MERGE. Table lineage still
resolves, so the gap is quiet: the graph looks populated while every column
edge on those statements is missing. 2.1.7 also clears one of the
sqlparse>=0.6.0 ceilings tracked in the issue.

Update the lineage tests to assert the correct lineage instead of the empty
result that encoded the old limitation. Two shapes are still unresolved
upstream and stay marked xfail with the correct lineage asserted.
…r 4 CVEs (#31791)"

collate-sqllineage 2.1.7 carries sqlparse 0.6.0 in its own metadata, so the
resolver handles this without a --no-deps override and an import gate to keep
it honest.

Reverts 2e8f045.
…vention

Greptile flagged that whole-test xfails also cover the table-lineage and
parser checks, so an unrelated regression reports as XFAIL instead of
failing. Use the per-parser flags the rest of the file already uses.

merge_06 asserts the one edge all three parsers resolve, with a comment on
why the two window ORDER BY edges are missing. merge_10 goes back to an
empty expectation with SqlGlot and SqlParse disabled and their specific
errors named, plus skip_graph_check on the table assertion since SqlGlot
and SqlFluff build different internal shapes for the recursion.
@IceS2
IceS2 requested a review from a team as a code owner August 21, 2026 16:20
@github-actions

Copy link
Copy Markdown
Contributor

❌ PR checklist incomplete

This PR cannot be merged until the following are addressed on its linked issue:

  • No GitHub issue is linked. Link an issue in the Development section of the PR (or add Fixes #12345 to the description). For a same-org cross-repo issue, add Fixes open-metadata/<repo>#123 to the description.

The fields live on the linked issue in the Shipping project (open the issue → right sidebar → Projects). After you set them, re-run this check (or push a commit) — issue/project changes do not re-trigger it automatically.

Maintainers can bypass this check by adding the skip-pr-checks label.

@github-actions github-actions Bot added Ingestion safe to test Add this label to run secure Github workflows on PRs labels Aug 21, 2026
@gitar-bot

gitar-bot Bot commented Aug 21, 2026

Copy link
Copy Markdown
Code Review ✅ Approved

Backports the sqlparse CVE remediation by upgrading collate-sqllineage to 2.1.7, requiring Python 3.10+, and aligning window lineage expectations. No issues found.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact
gitar display:verbose         

Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source

@github-actions

Copy link
Copy Markdown
Contributor

The Python checkstyle failed.

Please run make py_format and py_format_check in the root of your repository and commit the changes to this PR.
You can also use pre-commit to automate the Python code formatting.

You can install the pre-commit hooks with make install_test precommit_install.

@pmbrull
pmbrull merged commit 616e1cd into 1.13 Aug 21, 2026
61 of 87 checks passed
@pmbrull
pmbrull deleted the fix/sqlparse-cve-1.13 branch August 21, 2026 16:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Ingestion safe to test Add this label to run secure Github workflows on PRs

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants