airflow-3/3.0.2-r5: cve remediation

[octo-sts]

airflow-3/3.0.2-r5: fix GHSA-j288-q9x7-2f5v

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/airflow-3.advisories.yaml

---

"Breadcrumbs" for this automated service

• Source Code: https://go/cve-remedy-automation-source
• Logs: https://go/cve-remedy-automation-logs
• Docs: (not provided yet)

[octo-sts]

⚙️ Build Failed: Configuration

Error: failed to parse the pom file: open pom.xml: no such file or directory

Build Details

Category	Details
Build System	Maven (attempted with pombump)
Failure Point	pombump pom.xml

Root Cause Analysis 🔍

The build process expected a Maven pom.xml file in the project root directory, but the file doesn't exist. The build was attempting to use pombump to modify the pom.xml file, but it couldn't find the file. This indicates a configuration issue with the build pipeline, as it's trying to build Apache Airflow using Maven tools, but Apache Airflow doesn't use Maven as its primary build system.

---

🔍 Build failure fix suggestions

Found similar build failures that have been fixed in the past and analyzed them to suggest a fix:

Similar PRs with fixes

• cassandra-5.0/5.0.3-r0: cve remediation #42330
• selenium/4.28.0-r0: cve remediation #42311

Suggested Changes

File: airflow-3.yaml

• remove at line 95 (pipeline section)
  Original:

  - uses: maven/pombump

Click to expand fix analysis

Analysis

Looking at the similar fixed build failures, there's a clear pattern: both failures involved trying to use the maven/pombump step on projects that don't use Maven as their build system. In both cases (Cassandra and Selenium), the fix involved either:

1. Specifying a specific pom file path when using maven/pombump (as in the Cassandra fix)
2. Or removing the maven/pombump step entirely if it's not needed (implicitly shown in the Selenium fix)

The current failure with Apache Airflow shows the same error pattern: "failed to parse the pom file: open pom.xml: no such file or directory". This indicates that the build is trying to use Maven's pom.xml file, but Airflow doesn't use Maven as its build system - it uses Python's packaging tools.

Click to expand fix explanation

Explanation

The build is failing because the Melange YAML file includes a maven/pombump step, but Apache Airflow is a Python project that doesn't use Maven or have a pom.xml file.

By removing the maven/pombump step from the pipeline, we eliminate the error since the build will no longer try to find and parse a pom.xml file that doesn't exist.

This is consistent with how similar issues were fixed in other packages like Selenium, where the root cause was also trying to use Maven tools on non-Maven projects. Apache Airflow uses Python's packaging system with pyproject.toml and setup.py files, not Maven's pom.xml.

The rest of the build pipeline appears correct - it properly builds and installs the Python packages using Python-specific tools like uv and pip, which are the appropriate tools for a Python project like Airflow.

Click to expand alternative approaches

Alternative Approaches

• Instead of removing the maven/pombump step entirely, we could add a custom empty pom.xml file and specify its path with the 'pom' parameter as was done in the Cassandra fix. However, this approach is less clean and adds unnecessary complexity since Airflow doesn't use Maven at all.
• If there's a specific reason the pombump step was included (perhaps to upgrade Java dependencies in some Python packages that have Java interoperability), we could create a minimal pom.xml file that contains only the dependencies that need to be upgraded. However, looking at the Airflow YAML, there's no evidence that any Java dependencies need upgrading.

---

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.

[octo-sts]

This vulnerability remediation is stale and no longer needed. 👋

Advisory CGA-2p25-23hq-8932 has the latest event type of "pending-upstream-fix": https://github.com/wolfi-dev/advisories/blob/main/airflow-3.advisories.yaml

ID:      CGA-2p25-23hq-8932
Package: airflow-3
Aliases: CVE-2025-48924 GHSA-j288-q9x7-2f5v
Events:
  - "scan/v1" at 2025-07-12 07:14:55 UTC
  - "pending-upstream-fix" at 2025-07-14 06:26:17 UTC