Repository navigation
Conversation
github-actions
Bot
changed the base branch from
main
to
ranjiGT/advisory-improvement-10411
October 17, 2026 09:24
ranjiGT
changed the title
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The focused metadata changes match the advisory and upstream documentation, with no unresolved issues.
No open issues 🎉
What changed in this PR
Adds missing package metadata to GHSA-p86c-663x-5pxq so dependency scanners can identify affected Airflow providers.
Changes:
- Marks SSH and SFTP PyPI provider versions before 7.0.0 as affected.
- Adds a summary, provider changelog references, and the upstream repository.
| File | Description |
|---|---|
| advisories/unreviewed/2026/10/GHSA-p86c-663x-5pxq/GHSA-p86c-663x-5pxq.json | Adds affected-package ranges and supporting advisory metadata. |
Review effort: Max
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates
Comments
This improvement adds missing affected-package metadata and the upstream source-code location for GHSA-p86c-663x-5pxq (CVE-2026-94134).
The vulnerability affects the Apache Airflow SSH and SFTP providers, distributed through PyPI as
apache-airflow-providers-sshandapache-airflow-providers-sftp.The official Apache Airflow provider changelogs document the host-key verification fix in version 7.0.0, released on October 13, 2026. The upstream fix is tracked in apache/airflow#73419.
The changes improve dependency vulnerability identification by associating the advisory with the relevant Python packages and their upstream source repository.
The existing CVSS 3.1 assessment and CWE classification are preserved.
Supporting references: