Is Airflow impacted by Polyfill?

[snowsky]

When I search for the keyword polyfill, it gave me a related package, but not sure if this is impacted by the supply chain attack.

[potiuk]

Why do you think it would be impacted ? https://sansec.io/research/polyfill-supply-chain-attack explains the package impacted, what makes you think we use it ?

(I think it's not affected, but apparently you have an indication it is - hence my question)

[snowsky]

This is why I thought a discussion will help than an issue to not interrupt developers. I think you may not be technical on these stuff but triggered by a good reminder.

[snowsky]

What I'd like to confirm is that there is no hidden issue deep in the codes. It is fine that nobody can answer it now but this should be aware by the community, instead of talking about the basic rules.

[potiuk]

Well - you wrote yourself "I found pollyfil" by searching on the repo. That's not homework. That's noise. When you mention security issues it will drag attention of others. Maintainers are also very sensitive to that - when you mention security issue - you can be sure it will drag their attantion no matter if you do it as discussion or issue. If you care about security of a project do homework first and drag attention later when you are reasonably sure things are going wrong.

If you did your homework and look it up - Airflow publlishes SBOMS (software bill of materials) - which is the standard way which is both machine and human readable which you can check if a dependency (polyfill in this case) is there: https://airflow.apache.org/docs/apache-airflow/stable/security/sbom.html if you want to check if Airflow uses polyfill or any other dependency that has high security issue you go there and check. This is the homework and standard industry-accepted way of publishing this information.

And this is what I recommend you to do next time - hoping again that if any other person finds the discussion will do this as well.

[snowsky]

Hold on closing, are you 100% sure Airflow is not impacted? You haven't mentioned.

[snowsky]

Let me give you an example, https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-6rr7-c55j-m9j6. Much easier to get the answer!