Update dependency pyspark to v3.5.8 [SECURITY]

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
pyspark (source)	==3.5.5 → ==3.5.8

---

Apache Spark History Server allows stored cross-site scripting through unescaped application names

CVE-2026-32773 / GHSA-9437-39hj-3c93

More information

Details

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.

This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.

Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-32773
• https://lists.apache.org/thread/k36prh3oxl1z6ov7w8rpmfnt07hmzw3v
• http://www.openwall.com/lists/oss-security/2026/09/01/4
• https://github.com/apache/spark/pull/52851
• https://github.com/apache/spark/commit/3c83c2c6a22fe384280b99bb753b14800b7e27e1
• https://github.com/apache/spark/commit/e739b7d349dbd41b78d49bc8086cab63db057e14
• https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2026-3966.yaml
• https://issues.apache.org/jira/browse/SPARK-53747
• https://github.com/advisories/GHSA-9437-39hj-3c93

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

apache/spark (pyspark)

v3.5.8

Compare Source

v3.5.7

Compare Source

v3.5.6

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[gemini-code-assist]

Code Review

This pull request updates the pyspark[sql] dependency version from 3.5.5 to 3.5.8 in requirements.txt. There are no review comments, and I have no feedback to provide.