#3420 Move marshmallow-jsonschema to optional dependency to fix CVE-2024-6345 Pull request opened by dwo Tracking issue https://www.cve.org/CVERecord?id=CVE-2024-6345 Why are the changes needed?

setuptools

was pinned

<70

in #3388 as a runtime dependency solely because

marshmallow-jsonschema

imports

pkg_resources

at runtime. This forces all flytekit users onto a setuptools version affected by CVE-2024-6345. The

marshmallow-jsonschema

code path is only a fallback —

mashumaro

is the primary JSON Schema generator, and the marshmallow path only triggers when mashumaro fails for

DataClassJsonMixin

classes. The imports are already guarded by try/except, so nothing breaks when the package is absent.

marshmallow-jsonschema

itself appears unmaintained (last commit Oct 2023, multiple open PRs to remove

pkg_resources

unmerged). An alternative would be to drop

marshmallow-jsonschema

support entirely, since

mashumaro

already covers the primary path. What changes were proposed in this pull request? • Remove

marshmallow-jsonschema

,

marshmallow-enum

, and

setuptools

from core dependencies • Add a new

marshmallow-jsonschema

optional extra with those packages (

setuptools>=70,<82

) • Bump build-system setuptools to

>=70

• Update

<http://dev-requirements.in|dev-requirements.in>

to install the extra for tests • Update docstring to reflect mashumaro as the primary JSON Schema generator How was this patch tested? Ran

test_type_engine.py

and

test_generice_idl_type_engine.py

— 416 passed, 2 skipped. Check all the applicable boxes • I updated the documentation accordingly. • All new and existing tests passed. • All commits are signed-off. Related PRs #3388 flyteorg/flytekit