Skip to content

Use context to enhance recognition by default - #25856

Merged
pmbrull merged 12 commits into
mainfrom
imp/increase-recognizers-accuracy
Mar 16, 2026
Merged

Use context to enhance recognition by default#25856
pmbrull merged 12 commits into
mainfrom
imp/increase-recognizers-accuracy

Conversation

@edg956

@edg956 edg956 commented Feb 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Problem

Presidio's default context enhancement relies heavily on NLP (Named Entity Recognition) and often fails when analyzing individual column values rather than complete sentences or paragraphs. This results in:

  • Lower accuracy for PII detection in structured data (database columns, CSV fields, etc.)
  • Missed detections when column names provide clear context (e.g., "email" column containing email addresses)
  • Inconsistent results when processing single values vs. full text

Solution

This PR implements a custom context enhancement strategy that works better with individual values by:

  1. Custom Context Matching: Directly checks if context keywords match the provided context list, without relying on NLP parsing
  2. Score Boosting: When context keywords match, boosts the recognition score to maximum (1.0) for high confidence
  3. Minimum Threshold: Only enhances results with score ≥ 0.3 to avoid false positives
  4. Decorator Pattern: Applies enhancements uniformly across all recognizers while maintaining flexibility

Changes

Core Enhancement Logic (presidio_utils.py)

  • enhance_using_context: Custom enhancement that boosts scores when context keywords match

    • Checks context keywords against provided context list
    • Boosts score to MAX_SCORE (1.0) on match
    • Sets IS_SCORE_ENHANCED_BY_CONTEXT_KEY metadata flag
    • Skips already-enhanced results to prevent double-boosting

  • filter_enhanced_results_below_threshold: Filters results below confidence threshold after enhancement

    • Applied only when confidenceThreshold is configured
    • Works with enhanced scores to maintain accuracy

  • decorate_recognizer: Utility to compose multiple decorators in sequence

    • Clean application of enhancement pipeline
    • Maintains recognizer interface

  • eager_us_bank_recognizer: Improved US Bank recognizer with higher base scores (0.5 instead of default)

Integration (presidio_recognizer_factory.py)

  • Updated PresidioRecognizerFactory.create_recognizer() to apply decorators to all recognizers:
    1. enhance_using_context (always applied)
    2. filter_enhanced_results_below_threshold (applied when threshold is set)
  • Passes context parameter to PatternRecognizer during creation

Backend Migration Support

  • CollectionDAO.patchRecognizers(): New method to update tag recognizer configurations

    • Supports both MySQL and PostgreSQL
    • Updates JSON field with new recognizer configs

  • MigrationUtil.setRecognizersForSensitiveTags(): Migration logic to update existing PII tags

    • Loads recognizer configs from piiTagsWithRecognizers.json
    • Applies updates to all sensitive tags in database
    • Runs as post-DDL script in v1.1.22 migration

  • piiTagsWithRecognizers.json: Updated with context keywords for better classification

    • Phone recognizer: ["phone", "telephone", "mobile", "cell"]
    • Email recognizer: ["email", "mail", "address"]
    • Credit card, SSN, crypto, location, and other recognizers with relevant keywords

Testing

Unit Tests

  • test_presidio_utils.py: Comprehensive tests for enhancement logic

    • Context matching and score boosting
    • Minimum threshold enforcement
    • Already-enhanced result handling
    • Decorator composition

  • test_presidio_recognizer_factory.py: Integration tests

    • Decorator application to all recognizers
    • Confidence threshold filtering
    • Disabled recognizer handling

Type of change

  • Improvement

Checklist

  • I have read the CONTRIBUTING document.
  • I have commented on my code, particularly in hard-to-understand areas.
  • For JSON Schema changes: I updated the migration scripts or explained why it is not needed.
  • I have added tests around the new logic.
  • For connector/ingestion changes: I updated the documentation (N/A - internal improvement).

Migration Impact

Existing deployments will automatically benefit from improved PII detection accuracy after upgrading to v1.1.22. The migration:

  • Updates all PII tags with context-aware recognizer configurations
  • Is idempotent and safe to re-run
  • Supports both MySQL and PostgreSQL
  • Does not require manual reconfiguration

Summary by Gitar

  • Context enhancement for recognizers:
    • Added enhance_using_context decorator to boost PII detection scores when context keywords match, with MIN_SCORE_FOR_ENHANCEMENT threshold of 0.3
    • Implemented filter_enhanced_results_below_threshold to filter results below confidenceThreshold after context enhancement
    • Added decorate_recognizer utility to compose multiple decorators in sequence
  • Recognizer improvements:
    • Enhanced UsBankRecognizer with custom pattern scoring (0.5) for better accuracy
    • Updated 9 PII tags with context keywords (PhoneRecognizer, LocationRecognizer, CreditCardRecognizer, UsSsnRecognizer, CryptoRecognizer, SpacyRecognizer, etc.)
    • Added new CVV recognizer pattern for card security codes
  • Database migration:
    • Added patchRecognizers method to CollectionDAO for updating tag recognizer configurations
    • Implemented MigrationUtil.setRecognizersForSensitiveTags to populate recognizers for sensitive tags from seed data

This will update automatically on new commits.

@github-actions github-actions Bot added Ingestion safe to test Add this label to run secure Github workflows on PRs labels Feb 12, 2026
gitar-bot[bot]
gitar-bot Bot reviewed Feb 12, 2026
View reviewed changes
Comment thread ingestion/src/metadata/pii/algorithms/presidio_utils.py Outdated
gitar-bot[bot]
gitar-bot Bot reviewed Feb 12, 2026
View reviewed changes
Comment thread ingestion/tests/unit/pii/algorithms/test_presidio_utils.py
gitar-bot[bot]
gitar-bot Bot reviewed Feb 12, 2026
View reviewed changes
Comment thread ingestion/src/metadata/pii/algorithms/presidio_utils.py Outdated
@edg956
edg956 force-pushed the imp/increase-recognizers-accuracy branch from f525bae to 09c50a2 Compare February 16, 2026 20:48
@edg956
edg956 marked this pull request as ready for review February 16, 2026 21:13
@edg956
edg956 requested a review from a team as a code owner February 16, 2026 21:13
@edg956 edg956 self-assigned this Feb 16, 2026
@edg956 edg956 added the To release Will cherry-pick this PR into the release branch label Feb 16, 2026
@github-actions

github-actions Bot commented Feb 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🛡️ TRIVY SCAN RESULT 🛡️

Target: openmetadata-ingestion-base-slim:trivy (debian 12.13)

Vulnerabilities (257)

Package Vulnerability ID Severity Installed Version Fixed Version
imagemagick CVE-2026-25897 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick CVE-2026-25898 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick CVE-2026-25968 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick CVE-2026-25983 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick CVE-2026-25986 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick CVE-2026-25987 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick CVE-2026-24481 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick CVE-2026-24485 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick CVE-2026-25795 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick CVE-2026-25796 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick CVE-2026-25798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick CVE-2026-25799 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick CVE-2026-25965 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick CVE-2026-25970 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick CVE-2026-25988 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick CVE-2026-25989 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick CVE-2026-26066 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick CVE-2026-26283 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick CVE-2026-27798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6-common CVE-2026-25897 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6-common CVE-2026-25898 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6-common CVE-2026-25968 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6-common CVE-2026-25983 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6-common CVE-2026-25986 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6-common CVE-2026-25987 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6-common CVE-2026-24481 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6-common CVE-2026-24485 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6-common CVE-2026-25795 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6-common CVE-2026-25796 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6-common CVE-2026-25798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6-common CVE-2026-25799 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6-common CVE-2026-25965 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6-common CVE-2026-25970 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6-common CVE-2026-25988 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6-common CVE-2026-25989 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6-common CVE-2026-26066 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6-common CVE-2026-26283 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6-common CVE-2026-27798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6.q16 CVE-2026-25897 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6.q16 CVE-2026-25898 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6.q16 CVE-2026-25968 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6.q16 CVE-2026-25983 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6.q16 CVE-2026-25986 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6.q16 CVE-2026-25987 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6.q16 CVE-2026-24481 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6.q16 CVE-2026-24485 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6.q16 CVE-2026-25795 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6.q16 CVE-2026-25796 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6.q16 CVE-2026-25798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6.q16 CVE-2026-25799 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6.q16 CVE-2026-25965 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6.q16 CVE-2026-25970 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6.q16 CVE-2026-25988 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6.q16 CVE-2026-25989 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6.q16 CVE-2026-26066 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6.q16 CVE-2026-26283 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
imagemagick-6.q16 CVE-2026-27798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-arch-config CVE-2026-25897 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-arch-config CVE-2026-25898 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-arch-config CVE-2026-25968 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-arch-config CVE-2026-25983 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-arch-config CVE-2026-25986 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-arch-config CVE-2026-25987 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-arch-config CVE-2026-24481 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-arch-config CVE-2026-24485 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-arch-config CVE-2026-25795 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-arch-config CVE-2026-25796 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-arch-config CVE-2026-25798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-arch-config CVE-2026-25799 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-arch-config CVE-2026-25965 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-arch-config CVE-2026-25970 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-arch-config CVE-2026-25988 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-arch-config CVE-2026-25989 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-arch-config CVE-2026-26066 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-arch-config CVE-2026-26283 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-arch-config CVE-2026-27798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-headers CVE-2026-25897 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-headers CVE-2026-25898 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-headers CVE-2026-25968 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-headers CVE-2026-25983 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-headers CVE-2026-25986 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-headers CVE-2026-25987 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-headers CVE-2026-24481 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-headers CVE-2026-24485 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-headers CVE-2026-25795 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-headers CVE-2026-25796 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-headers CVE-2026-25798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-headers CVE-2026-25799 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-headers CVE-2026-25965 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-headers CVE-2026-25970 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-headers CVE-2026-25988 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-headers CVE-2026-25989 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-headers CVE-2026-26066 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-headers CVE-2026-26283 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6-headers CVE-2026-27798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6 CVE-2026-25897 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6 CVE-2026-25898 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6 CVE-2026-25968 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6 CVE-2026-25983 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6 CVE-2026-25986 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6 CVE-2026-25987 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6 CVE-2026-24481 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6 CVE-2026-24485 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6 CVE-2026-25795 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6 CVE-2026-25796 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6 CVE-2026-25798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6 CVE-2026-25799 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6 CVE-2026-25965 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6 CVE-2026-25970 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6 CVE-2026-25988 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6 CVE-2026-25989 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6 CVE-2026-26066 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6 CVE-2026-26283 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6 CVE-2026-27798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6-extra CVE-2026-25897 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6-extra CVE-2026-25898 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6-extra CVE-2026-25968 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6-extra CVE-2026-25983 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6-extra CVE-2026-25986 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6-extra CVE-2026-25987 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6-extra CVE-2026-24481 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6-extra CVE-2026-24485 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6-extra CVE-2026-25795 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6-extra CVE-2026-25796 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6-extra CVE-2026-25798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6-extra CVE-2026-25799 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6-extra CVE-2026-25965 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6-extra CVE-2026-25970 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6-extra CVE-2026-25988 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6-extra CVE-2026-25989 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6-extra CVE-2026-26066 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6-extra CVE-2026-26283 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-6-extra CVE-2026-27798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-dev CVE-2026-25897 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-dev CVE-2026-25898 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-dev CVE-2026-25968 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-dev CVE-2026-25983 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-dev CVE-2026-25986 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-dev CVE-2026-25987 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-dev CVE-2026-24481 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-dev CVE-2026-24485 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-dev CVE-2026-25795 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-dev CVE-2026-25796 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-dev CVE-2026-25798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-dev CVE-2026-25799 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-dev CVE-2026-25965 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-dev CVE-2026-25970 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-dev CVE-2026-25988 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-dev CVE-2026-25989 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-dev CVE-2026-26066 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-dev CVE-2026-26283 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-6.q16-dev CVE-2026-27798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-dev CVE-2026-25897 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-dev CVE-2026-25898 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-dev CVE-2026-25968 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-dev CVE-2026-25983 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-dev CVE-2026-25986 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-dev CVE-2026-25987 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-dev CVE-2026-24481 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-dev CVE-2026-24485 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-dev CVE-2026-25795 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-dev CVE-2026-25796 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-dev CVE-2026-25798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-dev CVE-2026-25799 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-dev CVE-2026-25965 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-dev CVE-2026-25970 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-dev CVE-2026-25988 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-dev CVE-2026-25989 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-dev CVE-2026-26066 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-dev CVE-2026-26283 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickcore-dev CVE-2026-27798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6-headers CVE-2026-25897 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6-headers CVE-2026-25898 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6-headers CVE-2026-25968 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6-headers CVE-2026-25983 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6-headers CVE-2026-25986 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6-headers CVE-2026-25987 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6-headers CVE-2026-24481 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6-headers CVE-2026-24485 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6-headers CVE-2026-25795 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6-headers CVE-2026-25796 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6-headers CVE-2026-25798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6-headers CVE-2026-25799 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6-headers CVE-2026-25965 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6-headers CVE-2026-25970 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6-headers CVE-2026-25988 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6-headers CVE-2026-25989 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6-headers CVE-2026-26066 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6-headers CVE-2026-26283 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6-headers CVE-2026-27798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-6 CVE-2026-25897 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-6 CVE-2026-25898 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-6 CVE-2026-25968 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-6 CVE-2026-25983 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-6 CVE-2026-25986 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-6 CVE-2026-25987 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-6 CVE-2026-24481 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-6 CVE-2026-24485 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-6 CVE-2026-25795 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-6 CVE-2026-25796 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-6 CVE-2026-25798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-6 CVE-2026-25799 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-6 CVE-2026-25965 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-6 CVE-2026-25970 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-6 CVE-2026-25988 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-6 CVE-2026-25989 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-6 CVE-2026-26066 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-6 CVE-2026-26283 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-6 CVE-2026-27798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-dev CVE-2026-25897 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-dev CVE-2026-25898 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-dev CVE-2026-25968 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-dev CVE-2026-25983 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-dev CVE-2026-25986 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-dev CVE-2026-25987 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-dev CVE-2026-24481 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-dev CVE-2026-24485 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-dev CVE-2026-25795 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-dev CVE-2026-25796 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-dev CVE-2026-25798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-dev CVE-2026-25799 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-dev CVE-2026-25965 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-dev CVE-2026-25970 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-dev CVE-2026-25988 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-dev CVE-2026-25989 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-dev CVE-2026-26066 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-dev CVE-2026-26283 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-6.q16-dev CVE-2026-27798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-dev CVE-2026-25897 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-dev CVE-2026-25898 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-dev CVE-2026-25968 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-dev CVE-2026-25983 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-dev CVE-2026-25986 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-dev CVE-2026-25987 🔥 CRITICAL 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-dev CVE-2026-24481 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-dev CVE-2026-24485 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-dev CVE-2026-25795 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-dev CVE-2026-25796 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-dev CVE-2026-25798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-dev CVE-2026-25799 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-dev CVE-2026-25965 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-dev CVE-2026-25970 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-dev CVE-2026-25988 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-dev CVE-2026-25989 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-dev CVE-2026-26066 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-dev CVE-2026-26283 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
libmagickwand-dev CVE-2026-27798 🚨 HIGH 8:6.9.11.60+dfsg-1.6+deb12u6 8:6.9.11.60+dfsg-1.6+deb12u7
linux-libc-dev CVE-2025-37786 🚨 HIGH 6.1.162-1 6.1.164-1
linux-libc-dev CVE-2025-37822 🚨 HIGH 6.1.162-1 6.1.164-1
linux-libc-dev CVE-2025-38201 🚨 HIGH 6.1.162-1 6.1.164-1
linux-libc-dev CVE-2025-40082 🚨 HIGH 6.1.162-1 6.1.164-1
linux-libc-dev CVE-2025-71089 🚨 HIGH 6.1.162-1 6.1.164-1
linux-libc-dev CVE-2025-71238 🚨 HIGH 6.1.162-1 6.1.164-1
linux-libc-dev CVE-2026-23111 🚨 HIGH 6.1.162-1 6.1.164-1
linux-libc-dev CVE-2026-23112 🚨 HIGH 6.1.162-1 6.1.164-1
linux-libc-dev CVE-2026-23193 🚨 HIGH 6.1.162-1 6.1.164-1
linux-libc-dev CVE-2026-23209 🚨 HIGH 6.1.162-1 6.1.164-1

🛡️ TRIVY SCAN RESULT 🛡️

Target: Java

Vulnerabilities (37)

Package Vulnerability ID Severity Installed Version Fixed Version
com.fasterxml.jackson.core:jackson-core CVE-2025-52999 🚨 HIGH 2.12.7 2.15.0
com.fasterxml.jackson.core:jackson-core GHSA-72hv-8253-57qq 🚨 HIGH 2.12.7 2.18.6, 2.21.1, 3.1.0
com.fasterxml.jackson.core:jackson-core CVE-2025-52999 🚨 HIGH 2.13.4 2.15.0
com.fasterxml.jackson.core:jackson-core GHSA-72hv-8253-57qq 🚨 HIGH 2.13.4 2.18.6, 2.21.1, 3.1.0
com.fasterxml.jackson.core:jackson-core GHSA-72hv-8253-57qq 🚨 HIGH 2.15.2 2.18.6, 2.21.1, 3.1.0
com.fasterxml.jackson.core:jackson-databind CVE-2022-42003 🚨 HIGH 2.12.7 2.12.7.1, 2.13.4.2
com.fasterxml.jackson.core:jackson-databind CVE-2022-42004 🚨 HIGH 2.12.7 2.12.7.1, 2.13.4
com.google.code.gson:gson CVE-2022-25647 🚨 HIGH 2.2.4 2.8.9
com.google.protobuf:protobuf-java CVE-2021-22569 🚨 HIGH 3.3.0 3.16.1, 3.18.2, 3.19.2
com.google.protobuf:protobuf-java CVE-2022-3509 🚨 HIGH 3.3.0 3.16.3, 3.19.6, 3.20.3, 3.21.7
com.google.protobuf:protobuf-java CVE-2022-3510 🚨 HIGH 3.3.0 3.16.3, 3.19.6, 3.20.3, 3.21.7
com.google.protobuf:protobuf-java CVE-2024-7254 🚨 HIGH 3.3.0 3.25.5, 4.27.5, 4.28.2
com.google.protobuf:protobuf-java CVE-2021-22569 🚨 HIGH 3.7.1 3.16.1, 3.18.2, 3.19.2
com.google.protobuf:protobuf-java CVE-2022-3509 🚨 HIGH 3.7.1 3.16.3, 3.19.6, 3.20.3, 3.21.7
com.google.protobuf:protobuf-java CVE-2022-3510 🚨 HIGH 3.7.1 3.16.3, 3.19.6, 3.20.3, 3.21.7
com.google.protobuf:protobuf-java CVE-2024-7254 🚨 HIGH 3.7.1 3.25.5, 4.27.5, 4.28.2
com.nimbusds:nimbus-jose-jwt CVE-2023-52428 🚨 HIGH 9.8.1 9.37.2
com.squareup.okhttp3:okhttp CVE-2021-0341 🚨 HIGH 3.12.12 4.9.2
commons-beanutils:commons-beanutils CVE-2025-48734 🚨 HIGH 1.9.4 1.11.0
commons-io:commons-io CVE-2024-47554 🚨 HIGH 2.8.0 2.14.0
dnsjava:dnsjava CVE-2024-25638 🚨 HIGH 2.1.7 3.6.0
io.airlift:aircompressor CVE-2025-67721 🚨 HIGH 0.27 2.0.3
io.netty:netty-codec-http2 CVE-2025-55163 🚨 HIGH 4.1.96.Final 4.2.4.Final, 4.1.124.Final
io.netty:netty-codec-http2 GHSA-xpw8-rcwv-8f8p 🚨 HIGH 4.1.96.Final 4.1.100.Final
io.netty:netty-handler CVE-2025-24970 🚨 HIGH 4.1.96.Final 4.1.118.Final
net.minidev:json-smart CVE-2021-31684 🚨 HIGH 1.3.2 1.3.3, 2.4.4
net.minidev:json-smart CVE-2023-1370 🚨 HIGH 1.3.2 2.4.9
org.apache.avro:avro CVE-2024-47561 🔥 CRITICAL 1.7.7 1.11.4
org.apache.avro:avro CVE-2023-39410 🚨 HIGH 1.7.7 1.11.3
org.apache.derby:derby CVE-2022-46337 🔥 CRITICAL 10.14.2.0 10.14.3, 10.15.2.1, 10.16.1.2, 10.17.1.0
org.apache.ivy:ivy CVE-2022-46751 🚨 HIGH 2.5.1 2.5.2
org.apache.mesos:mesos CVE-2018-1330 🚨 HIGH 1.4.3 1.6.0
org.apache.thrift:libthrift CVE-2019-0205 🚨 HIGH 0.12.0 0.13.0
org.apache.thrift:libthrift CVE-2020-13949 🚨 HIGH 0.12.0 0.14.0
org.apache.zookeeper:zookeeper CVE-2023-44981 🔥 CRITICAL 3.6.3 3.7.2, 3.8.3, 3.9.1
org.eclipse.jetty:jetty-server CVE-2024-13009 🚨 HIGH 9.4.56.v20240826 9.4.57.v20241219
org.lz4:lz4-java CVE-2025-12183 🚨 HIGH 1.8.0 1.8.1

🛡️ TRIVY SCAN RESULT 🛡️

Target: Node.js

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: Python

Vulnerabilities (9)

Package Vulnerability ID Severity Installed Version Fixed Version
apache-airflow CVE-2025-68438 🚨 HIGH 3.1.5 3.1.6
apache-airflow CVE-2025-68675 🚨 HIGH 3.1.5 3.1.6, 2.11.1
cryptography CVE-2026-26007 🚨 HIGH 42.0.8 46.0.5
jaraco.context CVE-2026-23949 🚨 HIGH 6.0.1 6.1.0
starlette CVE-2025-62727 🚨 HIGH 0.48.0 0.49.1
urllib3 CVE-2025-66418 🚨 HIGH 1.26.20 2.6.0
urllib3 CVE-2025-66471 🚨 HIGH 1.26.20 2.6.0
urllib3 CVE-2026-21441 🚨 HIGH 1.26.20 2.6.3
wheel CVE-2026-24049 🚨 HIGH 0.45.1 0.46.2

🛡️ TRIVY SCAN RESULT 🛡️

Target: /etc/ssl/private/ssl-cert-snakeoil.key

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: /ingestion/pipelines/extended_sample_data.yaml

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: /ingestion/pipelines/lineage.yaml

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: /ingestion/pipelines/sample_data.json

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: /ingestion/pipelines/sample_data.yaml

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: /ingestion/pipelines/sample_data_aut.yaml

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: /ingestion/pipelines/sample_usage.json

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: /ingestion/pipelines/sample_usage.yaml

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: /ingestion/pipelines/sample_usage_aut.yaml

No Vulnerabilities Found

@github-actions

github-actions Bot commented Feb 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🛡️ TRIVY SCAN RESULT 🛡️

Target: openmetadata-ingestion:trivy (debian 12.12)

Vulnerabilities (4)

Package Vulnerability ID Severity Installed Version Fixed Version
libpam-modules CVE-2025-6020 🚨 HIGH 1.5.2-6+deb12u1 1.5.2-6+deb12u2
libpam-modules-bin CVE-2025-6020 🚨 HIGH 1.5.2-6+deb12u1 1.5.2-6+deb12u2
libpam-runtime CVE-2025-6020 🚨 HIGH 1.5.2-6+deb12u1 1.5.2-6+deb12u2
libpam0g CVE-2025-6020 🚨 HIGH 1.5.2-6+deb12u1 1.5.2-6+deb12u2

🛡️ TRIVY SCAN RESULT 🛡️

Target: Java

Vulnerabilities (38)

Package Vulnerability ID Severity Installed Version Fixed Version
com.fasterxml.jackson.core:jackson-core CVE-2025-52999 🚨 HIGH 2.12.7 2.15.0
com.fasterxml.jackson.core:jackson-core GHSA-72hv-8253-57qq 🚨 HIGH 2.12.7 2.18.6, 2.21.1, 3.1.0
com.fasterxml.jackson.core:jackson-core CVE-2025-52999 🚨 HIGH 2.13.4 2.15.0
com.fasterxml.jackson.core:jackson-core GHSA-72hv-8253-57qq 🚨 HIGH 2.13.4 2.18.6, 2.21.1, 3.1.0
com.fasterxml.jackson.core:jackson-core GHSA-72hv-8253-57qq 🚨 HIGH 2.15.2 2.18.6, 2.21.1, 3.1.0
com.fasterxml.jackson.core:jackson-core GHSA-72hv-8253-57qq 🚨 HIGH 2.16.1 2.18.6, 2.21.1, 3.1.0
com.fasterxml.jackson.core:jackson-databind CVE-2022-42003 🚨 HIGH 2.12.7 2.12.7.1, 2.13.4.2
com.fasterxml.jackson.core:jackson-databind CVE-2022-42004 🚨 HIGH 2.12.7 2.12.7.1, 2.13.4
com.google.code.gson:gson CVE-2022-25647 🚨 HIGH 2.2.4 2.8.9
com.google.protobuf:protobuf-java CVE-2021-22569 🚨 HIGH 3.3.0 3.16.1, 3.18.2, 3.19.2
com.google.protobuf:protobuf-java CVE-2022-3509 🚨 HIGH 3.3.0 3.16.3, 3.19.6, 3.20.3, 3.21.7
com.google.protobuf:protobuf-java CVE-2022-3510 🚨 HIGH 3.3.0 3.16.3, 3.19.6, 3.20.3, 3.21.7
com.google.protobuf:protobuf-java CVE-2024-7254 🚨 HIGH 3.3.0 3.25.5, 4.27.5, 4.28.2
com.google.protobuf:protobuf-java CVE-2021-22569 🚨 HIGH 3.7.1 3.16.1, 3.18.2, 3.19.2
com.google.protobuf:protobuf-java CVE-2022-3509 🚨 HIGH 3.7.1 3.16.3, 3.19.6, 3.20.3, 3.21.7
com.google.protobuf:protobuf-java CVE-2022-3510 🚨 HIGH 3.7.1 3.16.3, 3.19.6, 3.20.3, 3.21.7
com.google.protobuf:protobuf-java CVE-2024-7254 🚨 HIGH 3.7.1 3.25.5, 4.27.5, 4.28.2
com.nimbusds:nimbus-jose-jwt CVE-2023-52428 🚨 HIGH 9.8.1 9.37.2
com.squareup.okhttp3:okhttp CVE-2021-0341 🚨 HIGH 3.12.12 4.9.2
commons-beanutils:commons-beanutils CVE-2025-48734 🚨 HIGH 1.9.4 1.11.0
commons-io:commons-io CVE-2024-47554 🚨 HIGH 2.8.0 2.14.0
dnsjava:dnsjava CVE-2024-25638 🚨 HIGH 2.1.7 3.6.0
io.airlift:aircompressor CVE-2025-67721 🚨 HIGH 0.27 2.0.3
io.netty:netty-codec-http2 CVE-2025-55163 🚨 HIGH 4.1.96.Final 4.2.4.Final, 4.1.124.Final
io.netty:netty-codec-http2 GHSA-xpw8-rcwv-8f8p 🚨 HIGH 4.1.96.Final 4.1.100.Final
io.netty:netty-handler CVE-2025-24970 🚨 HIGH 4.1.96.Final 4.1.118.Final
net.minidev:json-smart CVE-2021-31684 🚨 HIGH 1.3.2 1.3.3, 2.4.4
net.minidev:json-smart CVE-2023-1370 🚨 HIGH 1.3.2 2.4.9
org.apache.avro:avro CVE-2024-47561 🔥 CRITICAL 1.7.7 1.11.4
org.apache.avro:avro CVE-2023-39410 🚨 HIGH 1.7.7 1.11.3
org.apache.derby:derby CVE-2022-46337 🔥 CRITICAL 10.14.2.0 10.14.3, 10.15.2.1, 10.16.1.2, 10.17.1.0
org.apache.ivy:ivy CVE-2022-46751 🚨 HIGH 2.5.1 2.5.2
org.apache.mesos:mesos CVE-2018-1330 🚨 HIGH 1.4.3 1.6.0
org.apache.thrift:libthrift CVE-2019-0205 🚨 HIGH 0.12.0 0.13.0
org.apache.thrift:libthrift CVE-2020-13949 🚨 HIGH 0.12.0 0.14.0
org.apache.zookeeper:zookeeper CVE-2023-44981 🔥 CRITICAL 3.6.3 3.7.2, 3.8.3, 3.9.1
org.eclipse.jetty:jetty-server CVE-2024-13009 🚨 HIGH 9.4.56.v20240826 9.4.57.v20241219
org.lz4:lz4-java CVE-2025-12183 🚨 HIGH 1.8.0 1.8.1

🛡️ TRIVY SCAN RESULT 🛡️

Target: Node.js

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: Python

Vulnerabilities (24)

Package Vulnerability ID Severity Installed Version Fixed Version
Authlib CVE-2026-28802 🚨 HIGH 1.6.6 1.6.7
Werkzeug CVE-2024-34069 🚨 HIGH 2.2.3 3.0.3
aiohttp CVE-2025-69223 🚨 HIGH 3.12.12 3.13.3
aiohttp CVE-2025-69223 🚨 HIGH 3.13.2 3.13.3
apache-airflow CVE-2025-68438 🚨 HIGH 3.1.5 3.1.6
apache-airflow CVE-2025-68675 🚨 HIGH 3.1.5 3.1.6, 2.11.1
apache-airflow-providers-http CVE-2025-69219 🚨 HIGH 5.6.0 6.0.0
azure-core CVE-2026-21226 🚨 HIGH 1.37.0 1.38.0
cryptography CVE-2026-26007 🚨 HIGH 42.0.8 46.0.5
google-cloud-aiplatform CVE-2026-2472 🚨 HIGH 1.130.0 1.131.0
google-cloud-aiplatform CVE-2026-2473 🚨 HIGH 1.130.0 1.133.0
jaraco.context CVE-2026-23949 🚨 HIGH 5.3.0 6.1.0
jaraco.context CVE-2026-23949 🚨 HIGH 6.0.1 6.1.0
protobuf CVE-2026-0994 🚨 HIGH 4.25.8 6.33.5, 5.29.6
pyasn1 CVE-2026-23490 🚨 HIGH 0.6.1 0.6.2
python-multipart CVE-2026-24486 🚨 HIGH 0.0.20 0.0.22
ray CVE-2025-62593 🔥 CRITICAL 2.47.1 2.52.0
starlette CVE-2025-62727 🚨 HIGH 0.48.0 0.49.1
tornado CVE-2026-31958 🚨 HIGH 6.5.3 6.5.5
urllib3 CVE-2025-66418 🚨 HIGH 1.26.20 2.6.0
urllib3 CVE-2025-66471 🚨 HIGH 1.26.20 2.6.0
urllib3 CVE-2026-21441 🚨 HIGH 1.26.20 2.6.3
wheel CVE-2026-24049 🚨 HIGH 0.45.1 0.46.2
wheel CVE-2026-24049 🚨 HIGH 0.45.1 0.46.2

🛡️ TRIVY SCAN RESULT 🛡️

Target: usr/bin/docker

Vulnerabilities (3)

Package Vulnerability ID Severity Installed Version Fixed Version
stdlib CVE-2025-68121 🔥 CRITICAL v1.25.5 1.24.13, 1.25.7, 1.26.0-rc.3
stdlib CVE-2025-61726 🚨 HIGH v1.25.5 1.24.12, 1.25.6
stdlib CVE-2025-61728 🚨 HIGH v1.25.5 1.24.12, 1.25.6

🛡️ TRIVY SCAN RESULT 🛡️

Target: /etc/ssl/private/ssl-cert-snakeoil.key

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: /home/airflow/openmetadata-airflow-apis/openmetadata_managed_apis.egg-info/PKG-INFO

No Vulnerabilities Found

@edg956
edg956 force-pushed the imp/increase-recognizers-accuracy branch from 09c50a2 to 3c5fa42 Compare February 17, 2026 22:05
@edg956
edg956 requested a review from pmbrull March 12, 2026 15:12
@edg956 edg956 removed the To release Will cherry-pick this PR into the release branch label Mar 12, 2026
@github-actions

github-actions Bot commented Mar 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🟡 Playwright Results — all passed (20 flaky)

✅ 3324 passed · ❌ 0 failed · 🟡 20 flaky · ⏭️ 183 skipped

Shard Passed Failed Flaky Skipped
✅ Shard 1 455 0 0 2
✅ Shard 2 305 0 0 1
🟡 Shard 3 651 0 7 33
🟡 Shard 4 720 0 10 47
✅ Shard 5 591 0 0 67
🟡 Shard 6 602 0 3 33
🟡 20 flaky test(s) (passed on retry)
  • Features/DataQuality/TestCaseImportExportE2eFlow.spec.ts › Admin: Complete export-import-validate flow (shard 3, 1 retry)
  • Features/DataQuality/TestCaseImportExportE2eFlow.spec.ts › EditAll User: Complete export-import-validate flow (shard 3, 1 retry)
  • Features/DataQuality/TestCaseIncidentPermissions.spec.ts › User with TEST_CASE.EDIT_ALL can see edit icon on incidents (shard 3, 1 retry)
  • Features/DataQuality/TestCaseIncidentPermissions.spec.ts › User with only VIEW cannot PATCH incidents (shard 3, 1 retry)
  • Features/DataQuality/TestCaseResultPermissions.spec.ts › User with TEST_CASE.EDIT_ALL can see edit action on test case (shard 3, 1 retry)
  • Features/Permissions/GlossaryPermissions.spec.ts › Team-based permissions work correctly (shard 3, 1 retry)
  • Features/TableSorting.spec.ts › Data Observability services page should have sorting on name column (shard 3, 1 retry)
  • Features/UserProfileOnlineStatus.spec.ts › Should update online status in real-time when user becomes active (shard 4, 1 retry)
  • Flow/NestedChildrenUpdates.spec.ts › should update nested column description immediately without page refresh (shard 4, 1 retry)
  • Flow/ObservabilityAlerts.spec.ts › Test Suite alert (shard 4, 1 retry)
  • Pages/Customproperties-part2.spec.ts › Time (shard 4, 1 retry)
  • Pages/Customproperties-part2.spec.ts › entityReferenceList shows item count, scrollable list, no expand toggle (shard 4, 1 retry)
  • Pages/DataContractsSemanticRules.spec.ts › Validate Description Rule Is_Not_Set (shard 4, 1 retry)
  • Pages/DataProductAndSubdomains.spec.ts › Search data products by name (shard 4, 1 retry)
  • Pages/Domains.spec.ts › Verify data product tags and glossary terms (shard 4, 1 retry)
  • Pages/Entity.spec.ts › Glossary Term Add, Update and Remove (shard 4, 1 retry)
  • Pages/Entity.spec.ts › Set & Update table-cp, hyperlink-cp, string, integer, markdown, number, duration, email, enum, sqlQuery, timestamp, entityReference, entityReferenceList, timeInterval, time-cp, date-cp, dateTime-cp Custom Property (shard 4, 1 retry)
  • Pages/HyperlinkCustomProperty.spec.ts › should show No Data placeholder when hyperlink has no value (shard 6, 1 retry)
  • Pages/ODCSImportExport.spec.ts › Multi-object ODCS contract - object selector shows all schema objects (shard 6, 1 retry)
  • Pages/Users.spec.ts › Permissions for table details page for Data Consumer (shard 6, 1 retry)

📦 Download artifacts

How to debug locally 
# Download playwright-test-results-<shard> artifact and unzip
npx playwright show-trace path/to/trace.zip    # view trace

@gitar-bot

gitar-bot Bot commented Mar 14, 2026

Copy link
Copy Markdown
Code Review 👍 Approved with suggestions 5 resolved / 6 findings

Enhances entity recognition by leveraging context information to improve accuracy by default. Five issues were resolved including parameter mismatches, uninitialized fields, and type mismatches; consider refining the substring context matching at line 367 to avoid false positive boosts.

💡 Edge Case: Substring context matching may cause false positive boosts

📄 ingestion/src/metadata/pii/algorithms/presidio_utils.py:358-367 📄 ingestion/src/metadata/pii/algorithms/presidio_utils.py:375 📄 ingestion/src/metadata/pii/algorithms/presidio_utils.py:388

The context matching at line 367 uses substring matching on a joined string (ctx_word.lower() in context_lower where context_lower = " ".join(context).lower()). This can produce false positive matches when a recognizer's context keyword happens to be a substring of an unrelated runtime context word.

For example:

  • rec.context = ["id"], runtime context = ["invalid"] → "id" in "invalid" → True (false positive)
  • rec.context = ["mail"], runtime context = ["blackmail"] → "mail" in "blackmail" → True (false positive)
  • rec.context = ["age"], runtime context = ["storage_bucket"] → "age" in "storage_bucket" → True (false positive)

Impact: Low in practice since typical PII context keywords (email, phone, ssn, credit_card) are multi-character and unlikely to be substrings of unrelated column names, but it could cause unexpected score boosts in edge cases.

Suggestion: Consider matching against individual context words instead of a joined string, similar to the set-based approach used elsewhere in this file (_is_timestamp_context uses set intersection):

context_lower = {word.lower() for word in context}
# ...
if any(ctx_word.lower() in context_lower for ctx_word in rec.context):

This changes to exact word matching instead of substring matching. If substring matching is intentional (e.g., to match "email" within "email_address"), consider using word boundaries or splitting on underscores.

Suggested fix 
context_lower = {word.lower() for word in context}

for result in results:
    # if previously enhanced, then ignore
    if result.recognition_metadata.get(
        RecognizerResult.IS_SCORE_ENHANCED_BY_CONTEXT_KEY
    ):
        continue

    if any(ctx_word.lower() in context_lower for ctx_word in rec.context):
✅ 5 resolved
✅ Bug: Migration won't compile: parameter order mismatch + missing arg

📄 openmetadata-service/src/main/java/org/openmetadata/service/migration/utils/v1122/MigrationUtil.java:284 📄 openmetadata-service/src/main/java/org/openmetadata/service/migration/utils/v1122/MigrationUtil.java:310 📄 openmetadata-service/src/main/java/org/openmetadata/service/migration/mysql/v1122/Migration.java:35 📄 openmetadata-service/src/main/java/org/openmetadata/service/migration/postgres/v1122/Migration.java:35
Two related compilation errors in MigrationUtil:

  1. Parameter order mismatch — Both MySQL and Postgres Migration.runPostDDLScripts call setRecognizersForSensitiveTags(handle, migrationDAO, migrationFile.version, isForceMigration), passing MigrationDAO as the 2nd arg and String as the 3rd. But the method signature declares (Handle handle, String version, MigrationDAO migrationDAO, boolean isForceMigration), expecting the reverse order. This is a type mismatch → compile error.

  2. Missing version argument — updateTagRecognizers is declared with 7 parameters (last being String version), but is called on line 310-311 with only 6 arguments — version is never passed through. This is also a compile error.

Together these prevent the migration from building at all.

✅ Bug: Uninitialized final field migrationFile in MigrationUtil

📄 openmetadata-service/src/main/java/org/openmetadata/service/migration/utils/v1122/MigrationUtil.java:54
Line 54 adds private final MigrationFile migrationFile; to MigrationUtil, but the class has no constructor to initialize it. A final instance field without initialization is a compile error in Java.

Since all methods in MigrationUtil are static and no instance is ever created, this field appears to be accidentally added and should be removed.

✅ Bug: Potential NPE on nullable Boolean auto-unboxing

📄 openmetadata-service/src/main/java/org/openmetadata/service/migration/utils/v1122/MigrationUtil.java:298
createTag.getAutoClassificationEnabled() returns a Boolean (boxed, nullable). When autoClassificationEnabled is absent from the JSON data, getAutoClassificationEnabled() returns null, and the if (createTag.getAutoClassificationEnabled()) auto-unboxing will throw a NullPointerException. This runs during a database migration, so the crash would halt the upgrade process.

This is a known pattern in the codebase — e.g., v1120/MigrationUtil.java uses Boolean.TRUE.equals(...) for the same field.

✅ Quality: Boolean vs boolean type mismatch in updateTagRecognizers

📄 openmetadata-service/src/main/java/org/openmetadata/service/migration/utils/v1122/MigrationUtil.java:323
setRecognizersForSensitiveTags declares isForceMigration as primitive boolean, but the private helper updateTagRecognizers declares it as boxed Boolean. While auto-boxing is safe today (the only caller passes a primitive), the mismatch is misleading and introduces a latent NPE risk if the method is ever called with null.

✅ Bug: Missing pyright ignore causes CI type-check failure on __get__

📄 ingestion/src/metadata/pii/algorithms/presidio_utils.py:383
Line 383 uses wrapped.__get__(recognizer, type(recognizer)) to bind the wrapped method. Because wrapped is decorated with @wraps(old_enhancing_function), the type checker (basedpyright) infers its type as _Wrapped[...] which doesn't expose __get__, causing a reportAttributeAccessIssue error that blocks Python CI jobs.

The existing apply_confidence_threshold function at line 327 uses the same __get__ pattern without @wraps, which is why it doesn't trigger this error.

Fix options (pick one):

  1. Add a pyright ignore comment (consistent with the rest of the file)
  2. Remove @wraps since the function is used via descriptor binding, not as a standard wrapper (and apply_confidence_threshold at line 318 doesn't use @wraps either)
🤖 Prompt for agents 
Code Review: Enhances entity recognition by leveraging context information to improve accuracy by default. Five issues were resolved including parameter mismatches, uninitialized fields, and type mismatches; consider refining the substring context matching at line 367 to avoid false positive boosts.

1. 💡 Edge Case: Substring context matching may cause false positive boosts
   Files: ingestion/src/metadata/pii/algorithms/presidio_utils.py:358-367, ingestion/src/metadata/pii/algorithms/presidio_utils.py:375, ingestion/src/metadata/pii/algorithms/presidio_utils.py:388

   The context matching at line 367 uses substring matching on a joined string (`ctx_word.lower() in context_lower` where `context_lower = " ".join(context).lower()`). This can produce false positive matches when a recognizer's context keyword happens to be a substring of an unrelated runtime context word.
   
   For example:
   - `rec.context = ["id"]`, runtime context = `["invalid"]` → `"id" in "invalid"` → True (false positive)
   - `rec.context = ["mail"]`, runtime context = `["blackmail"]` → `"mail" in "blackmail"` → True (false positive)
   - `rec.context = ["age"]`, runtime context = `["storage_bucket"]` → `"age" in "storage_bucket"` → True (false positive)
   
   **Impact**: Low in practice since typical PII context keywords (email, phone, ssn, credit_card) are multi-character and unlikely to be substrings of unrelated column names, but it could cause unexpected score boosts in edge cases.
   
   **Suggestion**: Consider matching against individual context words instead of a joined string, similar to the set-based approach used elsewhere in this file (`_is_timestamp_context` uses set intersection):
   ```python
   context_lower = {word.lower() for word in context}
   # ...
   if any(ctx_word.lower() in context_lower for ctx_word in rec.context):
   ```
   This changes to exact word matching instead of substring matching. If substring matching is intentional (e.g., to match "email" within "email_address"), consider using word boundaries or splitting on underscores.

   Suggested fix:
   context_lower = {word.lower() for word in context}
   
   for result in results:
       # if previously enhanced, then ignore
       if result.recognition_metadata.get(
           RecognizerResult.IS_SCORE_ENHANCED_BY_CONTEXT_KEY
       ):
           continue
   
       if any(ctx_word.lower() in context_lower for ctx_word in rec.context):
Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

Auto-apply Compact 
gitar auto-apply:on         

gitar display:verbose

Was this helpful? React with 👍 / 👎 | Gitar

@sonarqubecloud

sonarqubecloud Bot commented Mar 14, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed for 'open-metadata-ingestion'

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
92.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gitar-bot gitar-bot[bot] gitar-bot[bot] left review comments
@pmbrull pmbrull pmbrull approved these changes
@harshach harshach harshach left review comments

Assignees

@edg956 edg956

Labels

Ingestion safe to test Add this label to run secure Github workflows on PRs

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@edg956 @harshach @pmbrull