Request to backport security fix GHSA-c336-7962-wfj2 to 2025.3.0

[oshadura]

The HEP community is using distributed 2025.03.0 due to version requirement coming from dask-awkward

[cms-jovyan@jupyter-oksana-2eshadura-40cern-2ech ~]$ pip list | grep distributed
distributed                        2025.3.0

Would it be possible to backport GHSA-c336-7962-wfj2 to 2025.3.0? thank you in advance!

cc @martindurant

[jacobtomlinson]

I have backported the fix. Please update your pins in dask-awkward to point to 2025.3.1. Let me know if you have any problems!

[martindurant]

That was fast, @jacobtomlinson - thank you very much!
Will this propagate to conda-forge?

[oshadura]

Many thanks!!!

[jacobtomlinson]

@martindurant I pushed to Conda Forge too so they should be there :)