Skip to content

fix: resolve CVE-2026-6321/6322 and register Airflow Job types in source-gen JSON - #105

Merged
Ebram Tawfik (EbramTawfik) merged 3 commits into
mainfrom
fix/fast-uri-security-vulnerability
May 18, 2026
Merged

fix: resolve CVE-2026-6321/6322 and register Airflow Job types in source-gen JSON#105
Ebram Tawfik (EbramTawfik) merged 3 commits into
mainfrom
fix/fast-uri-security-vulnerability

Conversation

@Ebram-Tawfik

@Ebram-Tawfik Ebram-Tawfik commented May 18, 2026

Copy link
Copy Markdown
Contributor

Summary

Fixes two high-severity security alerts and resolves Airflow Job serialization failures introduced by the source-gen JSON merge.

Security Fix

Updates transitive dependency fast-uri from 3.1.0 to 3.1.2 to resolve:

Airflow Job Source-Gen JSON Fix

Registers all Airflow Job types in DataFactoryJsonContext for AOT-compatible serialization:

  • AirflowJob, CreateAirflowJobRequest, UpdateAirflowJobRequest, ListAirflowJobsResponse
  • AirflowJobDefinition, AirflowJobDefinitionPart, GetAirflowJobDefinitionResponse, UpdateAirflowJobDefinitionRequest
  • Replaces anonymous new { } with EmptyRequest in GetAirflowJobDefinitionAsync

Changes

  • DataFactory.MCP.Core/Resources/McpApps/package-lock.json: bumped fast-uri 3.1.0 -> 3.1.2
  • DataFactory.MCP.Core/Configuration/DataFactoryJsonContext.cs: registered Airflow Job types
  • DataFactory.MCP.Core/Services/FabricAirflowJobService.cs: use EmptyRequest instead of anonymous type

Testing

  • npm audit reports 0 vulnerabilities
  • Fixes 3 failing integration tests (CreateAirflowJob, GetAirflowJobDefinition, FullLifecycle)

@github-actions

github-actions Bot commented May 18, 2026

Copy link
Copy Markdown

✅ Integration Tests PASSED

Workflow: PR Validation
Commit: 11d236fe9294883d944f3585e72f4f6a92b2cf4f
Result: PASSED

🎉 All integration tests passed! This PR is ready for review.

View full results

Ebram Tawfik and others added 2 commits May 18, 2026 11:31


Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…gen JSON

Add CreateAirflowJobRequest, UpdateAirflowJobRequest, AirflowJob,
ListAirflowJobsResponse, and definition types to the source-generated
JSON context. Replace anonymous type with EmptyRequest for getDefinition.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Ebram-Tawfik
Ebram-Tawfik force-pushed the fix/fast-uri-security-vulnerability branch from cac2bb6 to 383da85 Compare May 18, 2026 18:32
@Ebram-Tawfik Ebram-Tawfik changed the title fix: update fast-uri to 3.1.2 to resolve CVE-2026-6321 and CVE-2026-6322 fix: resolve CVE-2026-6321/6322 and register Airflow Job types in source-gen JSON May 18, 2026
The FullLifecycle test now gracefully skips when the create API returns
an error (e.g., EntityNotFound), instead of failing with a confusing
assertion error about missing airflowJobId.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@EbramTawfik
Ebram Tawfik (EbramTawfik) merged commit 7257e20 into main May 18, 2026
8 checks passed
@Ebram-Tawfik
Ebram-Tawfik deleted the fix/fast-uri-security-vulnerability branch July 8, 2026 18:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants