From 3427f8329e7698d3235cf0cc138811ae8833c6ed Mon Sep 17 00:00:00 2001 From: JuliaEdom Date: Tue, 21 Jul 2026 00:22:39 +0300 Subject: [PATCH] docs(security): record the probed rejection of uninstalling pyarrow from the Flink image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Probed 2026-07-21 inside the real agentflow-flink-local image: after pip uninstall pyarrow, `import apache_beam` itself crashes — beam 2.61 io/__init__ star-imports parquetio, whose class bodies evaluate `pa.Table` annotations with pa=None (AttributeError). The transitive dependency is load-bearing at import time even though our DataStream jobs never use it, so "remove unused pyarrow" is not a viable way to drop the safety ignore. Comment only. Co-Authored-By: Claude Fable 5 --- .github/workflows/security.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 45283b4..34627c9 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -222,6 +222,13 @@ jobs: # manifest (src/processing/flink_jobs), so the next apache-flink # release opens a PR — re-check this ignore there. Remove when the # resolved flink-runtime bucket installs pyarrow>=23.0.1. + # Do NOT retry "uninstall unused pyarrow from the image" — probed + # in the real image 2026-07-21 and rejected: without pyarrow, + # `import apache_beam` itself crashes (beam 2.61 io/__init__ does + # `from apache_beam.io.parquetio import *`, and parquetio's class + # bodies evaluate `pa.Table` annotations with pa=None -> + # AttributeError). The dependency is load-bearing at import time + # even though our jobs never use it. # # 88512 (langchain cross-ecosystem false positive) was ignored here # until 2026-07-20; PyUp corrected the entry (verified: safety