chore(deps): [database-archival] Update dependency apache-airflow-providers-fab to v1.5.2 [SECURITY]

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
apache-airflow-providers-fab (changelog)	==1.3.0 -> ==1.5.2

GitHub Vulnerability Alerts

CVE-2024-45033

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider.

This issue affects Apache Airflow Fab Provider: before 1.5.2.

When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from CVE-2023-40273 which was addressed in Apache-Airflow 2.7.0

Users are recommended to upgrade to version 1.5.2, which fixes the issue.

---

Release Notes

apache/airflow (apache-airflow-providers-fab)

v1.5.2

Compare Source

This is probably missing some important items, but most of it should be captured

• Initial setup on Travis CI provides continuous Integration, automated testing, no Hadoop unit tests just yet, but that is coming up
• Unit tests coverage reports with coverals
• Better py3 compatibility, unit tests run against both 2.7 ad 3.4 and we're now using the from __future__ imports to prevent regression
• A MesosExecutor to run your tasks on Mesos
• Some Kerberos integration for Hive / Hadoop
• DAG's graph view legend for states are now toggles to highlight tasks in specific states
• Automated zombie task instance killing as part of the scheduler's routine. The process looks for running tasks that don't have a heartbeat and kills them
• MySqlHook bulk load option
• More options in the UI's Mark Success form
• MySQL uses mysqlclient lib instead of mysql-python
• Using gunicorn instead of tornado as the wsgi web server
• OracleHook
• FTPHook
• Much more! tons of bug fixes and usability improvements.

v1.5.1

Compare Source

Bugfix around XCom table creation timestamp issue

v1.5.0

Compare Source

v1.5.0 is a huge release. Tons of important features.

Make sure to run airflow upgradedb after you upgrade

Improvements:

• @​jlowin landed a feature to communicate information across tasks called XCom, more information here
• @​neovintage integrated Airflow with Alembic, making database migration easy, run airflow upgradedb to get your database up to date as you upgrade Airflow
• The dependency engine is now more flexible, allowing for trigger rules, before this update, tasks would only be triggered when all dependencies were successful (still the default), now you can set tasks to trigger when a single parent succeeds, when one fails, when they all fail, or to fire regardless of their dependencies:
• @​neovintage added support for connection to be defined in environment variables, allowing to bypass or override the metadata database
• @​jlowin improved the tree view to render a non expendable when trees go above 5k nodes
• The Druid hook and HiveToDruidTransfer are maturing and becoming production grade
• @​kapil-malik added a UI feature where some users can only see their own DAGs while superusers can still see all, this feature is turned off by default
• Allowing all operators and some preoperators to receive list of sql statements to be execute as a chain
• Improved the task_instance table to log the operator name and queued timestamp
• Passwords in the metadata can now be encrypted
• Improvements to the unit tests (speed + coverage)
• Bugfixes + more

v1.4.1

Compare Source

v1.4.0

Compare Source

• Python3 compatibility improvements
• + TimeDeltaSensor
• + Slack related hooks and operators
• Fancy widget for pausing DAGs from the main dash
• Bugfixes and polish!

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[code-review-assist]

Hi team,

I'm currently reviewing this pull request and will provide my feedback in a few minutes. In the meantime, I'm providing this summary of the pull request's content for you and other reviewers to quickly get up to speed on the changes and intent.

This pull request, submitted by Renovate Bot, updates the apache-airflow-providers-fab dependency in the database-archival project from version 1.3.0 to 1.5.2. This is a security update addressing the CVE-2024-45033 vulnerability, which involves insufficient session expiration. The vulnerability allowed users to remain logged in even after a password change via the admin CLI.

Here's a summary of the changes:

• Intent: Address a security vulnerability (CVE-2024-45033) in the apache-airflow-providers-fab library.
• Changes: The requirements.txt file in the projects/database-archival directory has been modified to update the apache-airflow-providers-fab dependency version from 1.3.0 to 1.5.2. The SHA256 hashes for the new version have also been updated.
• Activity: The pull request was automatically generated by Renovate Bot. It's currently awaiting manual merge.

The pull request includes release notes detailing numerous improvements and bug fixes in versions 1.4.0, 1.4.1, 1.5.0, 1.5.1, and 1.5.2 of apache-airflow-providers-fab. These notes are available in the pull request description.

I'll provide a more detailed review shortly.

---

A little poem for your coding pleasure:

Security updates, a vital quest,
To keep our systems, truly blessed.
With fixes applied, and worries gone,
Our code runs smoothly, till the dawn.

Thanks!

[code-review-assist]

This pull request updates the apache-airflow-providers-fab dependency to version 1.5.2 to address a security vulnerability (CVE-2024-45033). The update is necessary and well-justified. The changelog and release notes provide context, although the release notes for v1.5.2 seem to be for a much older version. Overall, the PR is good to merge.