Repository navigation
chore(deps): bump airbyte-cdk to >=7.28.3 to pick up nltk 3.9.4 - #1133
Conversation
Co-Authored-By: AJ Steers <aj@airbyte.io>
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
👋 Greetings, Airbyte Team Member!Here are some helpful tips and reminders for your convenience. 💡 Show Tips and TricksTesting This PyAirbyte VersionYou can test this version of PyAirbyte using the following: # Run PyAirbyte CLI from this branch:
uvx --from 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1787943621-bump-cdk-nltk' pyairbyte --help
# Install PyAirbyte from this branch for development:
pip install 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1787943621-bump-cdk-nltk'PR Slash CommandsAirbyte Maintainers can execute the following slash commands on your PR:
📚 Show Repo GuidanceHelpful ResourcesCommunity SupportQuestions? Join the #pyairbyte channel in our Slack workspace. |
There was a problem hiding this comment.
Pull request overview
This PR updates PyAirbyte’s dependency floor for airbyte-cdk to ensure transitive resolution of nltk>=3.9.4, addressing reported security/CVE concerns tied to the older nltk==3.9.1 pin in earlier CDK releases.
Changes:
- Bump
airbyte-cdkminimum version from7.21.1to7.28.3inpyproject.toml. - Regenerate
uv.lockto reflect the new CDK version and updated resolved transitive dependencies (includingnltk 3.9.4andijson).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| pyproject.toml | Raises the airbyte-cdk lower bound to >=7.28.3 to allow newer transitive nltk resolution. |
| uv.lock | Updates the locked dependency graph for the new airbyte-cdk version, including nltk==3.9.4 and new transitive packages like ijson. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review. 📝 WalkthroughWalkthroughThe project now requires ChangesCDK Version Update
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This change raises the Airbyte CDK dependency floor and updates the lockfile to obtain the intended nltk security fixes; no actionable merge-blocking risk remains beyond normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) Full details: Title checkExplanation The title clearly identifies the dependency update and its purpose: raising the minimum ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Code Coverage OverviewLanguages: Python Python / code-coverage/pytest-fastThe overall line coverage in commit 5465c35 in the Show a line coverage summary of the most impacted files.
Python / code-coverage/pytest-no-credsThe overall line coverage in commit 5465c35 in the Show a line coverage summary of the most impacted files.
Python / code-coverage/pytestThe overall line coverage in commit 5465c35 in the Show a line coverage summary of the most impacted files.
Updated |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
Aaron ("AJ") Steers (aaronsteers)
changed the title
airbyte-cdk to >=7.28.3 to pick up nltk 3.9.4
Summary
Resolves #1022
Raises the CDK floor so
nltkcan resolve past3.9.1, closing the remaining half of #1022.nltkisn't declared here — it arrives transitively via the CDK'sunstructuredextra, and the CDK pinned it exactly at3.9.1until airbytehq/airbyte-python-cdk#968 landed in CDK v7.28.3. With that floor,uv lockresolvesnltk 3.9.4, which carries the ZIP path-traversal fixes (GHSA-rf74-v2fm-23pw and friends). Thecryptographyhalf of #1022 was already resolved onmain.Lockfile deltas beyond the CDK itself:
nltk 3.9.1 → 3.9.4, plusijsonandmsgspecnewly pulled in by the newer CDK.Verified:
uv sync --all-extras, thenuv run pytest tests/unit_tests— 608 passed, 1 skipped (pre-existing pokeAPI skip).Link to Devin session: https://app.devin.ai/sessions/5698b6c67afc453b9ff72ab0fbb30e29
Open in Devin Desktop: https://app.devin.ai/desktop/session/5698b6c67afc453b9ff72ab0fbb30e29?variant=devin
Requested by: Aaron ("AJ") Steers (@aaronsteers)
Summary by CodeRabbit
Important
Auto-merge enabled.
This PR is set to merge automatically when all requirements are met.