Skip to content

Apache Airflow

Developer Productivity

Platform to programmatically author, schedule, and monitor workflows.

Python Latest 3.3.0 · 20d ago Security brief →

Recent releases

View all 15 releases →
Review required
3.3.0 Breaking risk
Breaking upgrade Auth

Routine maintenance and dependency updates.

Review required
helm-chart/1.22.0 Breaking risk
Auth RBAC Breaking upgrade

Helm 3.19, Airflow 3.2.2, OTel support

No immediate action
airflow-ctl/0.1.5 New feature

dags exec cmd + bulk delete + AIP-103

Review required
3.2.2 Breaking risk
Auth RCE / SSRF

SMTP TLS validation + UI prefix search + triggerer watchdog

helm-chart/1.21.0 Breaking risk
⚠ Upgrade required
  • Update Helm chart values: migrate any existing workers.* settings to the new workers.celery.* or workers.kubernetes.* locations before the deprecated keys are removed.
  • Be aware of the default Airflow image change to version 3.2.0; review any custom image overrides.
Breaking changes
  • Deprecation of all top-level workers.* configuration keys (e.g., workers.safeToEvict, workers.hostAliases, etc.) in favor of workers.celery.* and workers.kubernetes.*; these will be removed in a future version.
  • Default Airflow image updated from 3.1.8 to 3.2.0.
Notable features
  • Added ttlSecondsAfterFinished field for the database cleanup job.
  • Enabled tpl rendering in ServiceAccount annotations, metadataConnection, and config ConfigMap names.
Full changelog

Significant Changes

Workers config options have been moved under workers.celery.* and workers.kubernetes.*

Please update your configuration accordingly:

  • workers.safeToEvict is now deprecated in favor of workers.celery.safeToEvict/workers.kubernetes.safeToEvict (#61915).
  • workers.hostAliases is now deprecated in favor of workers.celery.hostAliases/workers.kubernetes.hostAliases (#61960).
  • workers.priorityClassName is now deprecated in favor of workers.celery.priorityClassName/workers.kubernetes.priorityClassName (#61961).
  • workers.runtimeClassName is now deprecated in favor of workers.celery.runtimeClassName/workers.kubernetes.runtimeClassName (#61962).
  • workers.schedulerName is now deprecated in favor of workers.celery.schedulerName/workers.kubernetes.schedulerName (#62030).
  • workers.serviceAccount is now deprecated in favor of workers.celery.serviceAccount/workers.kubernetes.serviceAccount (#64730).
  • workers.extraContainers is now deprecated in favor of workers.celery.extraContainers/workers.kubernetes.extraContainers (#64739).
  • workers.extraInitContainers is now deprecated in favor of workers.celery.extraInitContainers/workers.kubernetes.extraInitContainers (#64741).
  • workers.extraVolumes is now deprecated in favor of workers.celery.extraVolumes/workers.kubernetes.extraVolumes (#64746).
  • workers.affinity is now deprecated in favor of workers.celery.affinity/workers.kubernetes.affinity (#64860).
  • workers.tolerations is now deprecated in favor of workers.celery.tolerations/workers.kubernetes.tolerations (#64976).
  • workers.topologySpreadConstraints is now deprecated in favor of workers.celery.topologySpreadConstraints/workers.kubernetes.topologySpreadConstraints (#64980).
  • workers.podAnnotations is now deprecated in favor of workers.celery.podAnnotations/workers.kubernetes.podAnnotations (#65027).
  • workers.labels is now deprecated in favor of workers.celery.labels/workers.kubernetes.labels (#65030).
  • workers.env is now deprecated in favor of workers.celery.env/workers.kubernetes.env (#65056).
  • workers.extraVolumeMounts is now deprecated in favor of workers.celery.extraVolumeMounts/workers.kubernetes.extraVolumeMounts (#65059).
  • workers.extraPorts is now deprecated in favor of workers.celery.extraPorts (#61919).
  • workers.volumeClaimTemplates is now deprecated in favor of workers.celery.volumeClaimTemplates (#62048).
  • workers.waitForMigrations is now deprecated in favor of workers.celery.waitForMigrations (#62054).
  • workers.hpa is now deprecated in favor of workers.celery.hpa (#64734).
  • workers.annotations is now deprecated in favor of workers.celery.annotations (#64982).
  • workers.logGroomerSidecar is now deprecated in favor of workers.celery.logGroomerSidecar (#65033).

The previous configuration options are still working but are deprecated and will be removed in a future version.

Default Airflow image is updated to 3.2.0 (#64841)

The default Airflow image that is used with the Chart is now 3.2.0, previously it was 3.1.8.

New Features

  • Add ttlSecondsAfterFinished to database cleanup job (#64164)
  • Support tpl rendering in ServiceAccount annotations, metadataConnection, and config ConfigMap names (#64763)

Improvements

  • Generate JWT Secret of recommended length (#65082)

Bug Fixes

  • Fix wrong broker URL secret ref (#65006)
  • Fix Helm chart image volume schema validation (#65409)
  • Remove duplicate fallback branch in airflowPodSecurityContextsIds helper (#65558)
  • Render cleanup RBAC only for KubernetesExecutor (#65539)
  • Fix default args/command for database cleanup (#63821)
  • Fix invalid deprecation warning in NOTES.txt (#64296)
  • Add missing fields in schema file (#64339)

Doc only changes

  • Document secret key names for Helm chart secretName options (#64136)
  • Update customizing-labels documentation (#64170)
  • Fix documentation link (#64355)

Misc

  • Simplify Helm Chart Logic & Misc (#63957)
  • Improve consistency of values.yaml & misc (#64559)
  • Align log_id_template with current default in Elasticsearch provider (#64332)
  • Update alpine version in pgbouncer and pgbouncer-exporter (#65413)
  • Add default GO_VERSION for pgbouncer-exporter Dockerfile (#65446)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

About

Stars
46,168
Forks
17,399
Languages
Python TypeScript Go

Community & Support

Beta — feedback welcome: [email protected]