Skip to content

Commit 0713e63

Browse files
MikaKermanclaude
andcommitted
security: remove dbt-fabricspark and dbt-vertica to fix Dependabot alerts
Remove dbt-fabricspark and dbt-vertica optional deps from lockfile resolution — both were already excluded from the "all" extra and their outdated upstream pins (dbt-core==1.8.5, azure-cli pre-release) caused vulnerable transitive dependency versions to be resolved (deepdiff, protobuf, pyopenssl, etc.). Without them, poetry resolves all 7 high/critical Dependabot alerts to patched versions naturally. Users who need these adapters can still install them directly (e.g. pip install dbt-fabricspark dbt-vertica). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent c24a73a commit 0713e63

1 file changed

Lines changed: 4 additions & 7 deletions

File tree

pyproject.toml

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -57,9 +57,7 @@ dbt-clickhouse = {version = ">=1.8,<2.0.0", optional = true}
5757
dbt-duckdb = {version = ">=1.8,<2.0.0", optional = true}
5858
dbt-dremio = {version = ">=1.8,<2.0.0", optional = true}
5959
dbt-fabric = {version = ">=1.8,<2.0.0", optional = true}
60-
dbt-fabricspark = {version = ">=1.8,<2.0.0", optional = true}
6160
dbt-sqlserver = {version = ">=1.8,<2.0.0", optional = true}
62-
dbt-vertica = {version = ">=1.8,<2.0.0", optional = true}
6361
[tool.poetry.extras]
6462
snowflake = ["dbt-snowflake"]
6563
bigquery = ["dbt-bigquery"]
@@ -73,12 +71,11 @@ trino = ["dbt-trino"]
7371
duckdb = ["dbt-duckdb"]
7472
dremio = ["dbt-dremio"]
7573
fabric = ["dbt-fabric"]
76-
fabricspark = ["dbt-fabricspark"]
7774
sqlserver = ["dbt-sqlserver"]
78-
vertica = ["dbt-vertica"]
79-
# dbt-fabricspark is excluded due to broken upstream dependencies (azure-cli pre-release pins).
80-
# dbt-vertica is excluded because it pins dbt-core==1.8.5, forcing the entire resolution to dbt 1.8.
81-
# Both are still available as individual extras (e.g. pip install elementary-data[vertica]).
75+
# dbt-fabricspark and dbt-vertica are removed from the lockfile resolution because they pin
76+
# outdated transitive dependencies (dbt-core==1.8.5, azure-cli pre-release) that block
77+
# security patches for deepdiff, protobuf, and pyopenssl. Users who need these adapters
78+
# can still install them directly (e.g. pip install dbt-fabricspark dbt-vertica).
8279
all = ["dbt-snowflake", "dbt-bigquery", "dbt-redshift", "dbt-postgres", "dbt-databricks", "dbt-spark", "dbt-athena-community", "dbt-trino", "dbt-clickhouse", "dbt-duckdb", "dbt-dremio", "dbt-fabric", "dbt-sqlserver"]
8380

8481
[build-system]

0 commit comments

Comments
 (0)