Description

ddl-joyce-zhao

opened on Apr 1, 2024

Issue body actions

Is your feature request related to a problem? Please describe.

There is a security vulnerability PVE-2022-51668 in SQLAlchemy < 2.0.0.b1.
https://data.safetycli.com/v/51668/f17/

However feast pinned the SQLAlchemy version to be < 2. We are struggling to have solve this vulnerability in our feast dependent projects.
https://github.com/feast-dev/feast/blob/master/setup.py#L60

Describe the solution you'd like

Change the version specification to be >1 only

Describe alternatives you've considered
NA

Additional context
NA

Activity

1. ddl-joyce-zhao

   added

   kind/featureNew feature or requestNew feature or request

   on Apr 1, 2024
2. shuchu

   self-assigned this

   on Apr 2, 2024
3. shuchu commented on Apr 2, 2024

   

   shuchu

   on Apr 2, 2024

   Collaborator

   More actions

   ➜ feast git:(master) ✗ grep --include=*.py -rnw ./sdk/python -e "sqlalchemy"
   ./sdk/python/feast/infra/registry/sql.py:9:from sqlalchemy import ( # type: ignore
   ./sdk/python/feast/infra/registry/sql.py:22:from sqlalchemy.engine import Engine
   ./sdk/python/feast/infra/offline_stores/contrib/mssql_offline_store/tests/data_source.py:5:from sqlalchemy import create_engine
   ./sdk/python/feast/infra/offline_stores/contrib/mssql_offline_store/mssql.py:12:import sqlalchemy
   ./sdk/python/feast/infra/offline_stores/contrib/mssql_offline_store/mssql.py:14:from sqlalchemy import create_engine
   ./sdk/python/feast/infra/offline_stores/contrib/mssql_offline_store/mssql.py:15:from sqlalchemy.engine import Engine
   ./sdk/python/feast/infra/offline_stores/contrib/mssql_offline_store/mssql.py:16:from sqlalchemy.orm import sessionmaker
   ./sdk/python/feast/infra/offline_stores/contrib/mssql_offline_store/mssql.py:393: engine: sqlalchemy.engine.Engine,
   ./sdk/python/feast/infra/offline_stores/contrib/mssql_offline_store/mssqlserver_source.py:8:from sqlalchemy import create_engine
4. shuchu commented on Apr 2, 2024

   

   shuchu

   on Apr 2, 2024

   Collaborator

   More actions

   https://docs.sqlalchemy.org/en/20/changelog/migration_20.html
5. shuchu commented on Apr 2, 2024

   

   shuchu

   on Apr 2, 2024

   Collaborator

   More actions

   Major two Warnings:

   1, RemovedIn20Warning: The current statement is being autocommitted using implicit autocommit, which will be removed in SQLAlchemy 2.0. Use the .begin() method of Engine or Connection in order to use an explicit transaction for DML and DDL statements. (Background on SQLAlchemy 2.0 at: https://sqlalche.me/e/b8d9)
   2, RemovedIn20Warning: Using non-integer/slice indices on Row is deprecated and will be removed in version 2.0; please use row._mapping[], or the mappings() accessor on the Result object. (Background on SQLAlchemy 2.0 at: https://sqlalche.me/e/b8d9)

   Reacted by Tornike Gurgenidze
6. franciscojavierarceo

   closed this as completedin #4065on Apr 3, 2024
7. ddl-joyce-zhao commented on Apr 3, 2024

   

   ddl-joyce-zhao

   on Apr 3, 2024

   Author

   More actions

   Thank you guys very much for your quick action!

Issue actions