eladkal commented on code in PR #72946:
URL: https://github.com/apache/airflow/pull/72946#discussion_r3989851847
##########
RELEASE_NOTES.rst:
##########
@@ -24,6 +24,210 @@
.. towncrier release notes start
+Airflow 3.3.2 (2026-09-17)
+--------------------------
+
+Significant Changes
+^^^^^^^^^^^^^^^^^^^
+
+- Backfill endpoints no longer disclose which backfill ids exist across Dags
+
+ The four routes that name a backfill in their path -- ``GET
/backfills/{backfill_id}``
+ and the ``pause``, ``unpause`` and ``cancel`` routes -- resolved the Dag
they authorize
+ against from the ``dag_id`` supplied on the request whenever the path's id
matched no row.
+ An unknown id and a backfill on a Dag the caller cannot see therefore
answered differently,
+ which enumerates backfill ids across Dags.
+
+ The backfill named in the path is now the only thing those routes authorize
against.
+
+ **Behaviour changes:**
+
+ - A backfill whose Dag the caller may not read returns ``404`` with detail
+ ``Backfill not found``, the same answer an unknown id gets, where it
previously returned
+ ``403``. A caller who may read the Dag still gets ``403`` for a write they
are not allowed.
Review Comment:
I find this paragraph as a difficult read
##########
RELEASE_NOTES.rst:
##########
@@ -24,6 +24,210 @@
.. towncrier release notes start
+Airflow 3.3.2 (2026-09-17)
+--------------------------
+
+Significant Changes
+^^^^^^^^^^^^^^^^^^^
+
+- Backfill endpoints no longer disclose which backfill ids exist across Dags
+
+ The four routes that name a backfill in their path -- ``GET
/backfills/{backfill_id}``
+ and the ``pause``, ``unpause`` and ``cancel`` routes -- resolved the Dag
they authorize
+ against from the ``dag_id`` supplied on the request whenever the path's id
matched no row.
+ An unknown id and a backfill on a Dag the caller cannot see therefore
answered differently,
+ which enumerates backfill ids across Dags.
+
+ The backfill named in the path is now the only thing those routes authorize
against.
+
+ **Behaviour changes:**
+
+ - A backfill whose Dag the caller may not read returns ``404`` with detail
+ ``Backfill not found``, the same answer an unknown id gets, where it
previously returned
+ ``403``. A caller who may read the Dag still gets ``403`` for a write they
are not allowed.
+ - A ``backfill_id`` in the path is never authorized against a ``dag_id`` in
the request body
+ or query string. ``GET /backfills``, ``POST /backfills`` and ``POST
/backfills/dry_run``
+ name no backfill in their path and keep authorizing off the request.
+ - All four routes now answer an unknown id with the same detail, ``Backfill
not found``.
+ The ``pause``, ``unpause`` and ``cancel`` routes previously answered
+ ``Could not find backfill with id {backfill_id}``. Clients matching on
``detail``
+ must be updated. (#71113)
+- An explicit credential now takes precedence over the session cookie
+
+ ``get_user()`` codes the precedence bearer, then OAuth2, then the session
cookie, but
+ that block was unreachable whenever a cookie was present.
``JWTRefreshMiddleware`` runs
+ first, resolves a user from the ``_token`` cookie alone and stamps it on
+ ``request.state``, and ``get_user()`` returned that cached user before
looking at either
+ explicit credential. The effective order on every core-API route was cookie
over bearer.
+
+ A request carrying both a session cookie and an explicit credential
therefore executed,
+ and was recorded in the audit log, as the cookie's principal rather than the
identity the
+ client presented. The cached user is now honoured only when the request
carries no
+ explicit credential.
+
+ **Behaviour changes:**
+
+ - A request carrying **both** a ``_token`` cookie and an ``Authorization:
Bearer`` header
+ is now resolved as the bearer token's principal, where it was previously
resolved as the
+ cookie's. The same applies to a cookie combined with an OAuth2 token.
+ - An **invalid or expired** explicit credential is now rejected with
``401``/``403`` even
+ when a valid ``_token`` cookie accompanies it. Previously the cookie
silently took over
+ and the request succeeded as the cookie's principal; the failure is now
loud.
+ - Requests carrying a single credential are unaffected. Cookie-only browser
sessions keep
+ the token-refresh behaviour of ``JWTRefreshMiddleware`` unchanged.
+ - Clients that relied on the cookie winning -- for example a browser-based
tool that sent a
+ service account's bearer token while a user session cookie was present,
and expected the
+ user's identity to apply -- will now act as the bearer token's principal.
Remove the
+ header, or the cookie, to select the intended identity explicitly. (#72225)
+
+
+Bug Fixes
+^^^^^^^^^
+
+- Optimize the previous-task-instance lookup by removing a redundant
``dag_run`` join (#72944)
+- Revoke every credential presented to the logout endpoint, not just the
session cookie (#72933)
+- API: Return HTTP 404 instead of 500 when a task starts against a missing Dag
run (#72900)
+- Fix ``airflow db clean`` never purging the ``callback`` table (#72899)
+- Fix the Dag version inflation check not warning about custom ``DAG``
subclasses or aliased-module imports (#72898)
+- Fix ``DeadlockImminentError`` when a connection is resolved inside an async
task (#72895)
+- Fix dag processor crash when an orphaned processor is killed (#72888)
+- Prevent corruption of ``XCom`` values that already parse as JSON during the
bytea-to-JSONB migration (#72886)
+- Fix HTTP 500 for non-dict JSON bodies on the Variable and Connection API
endpoints (#72878)
+- Fix resolution of deprecated imports in ``airflow.utils.helpers`` (#72868)
+- Bound single-row lookups with ``LIMIT 1`` to avoid scanning large tables
(#72842)
+- UI: Fix clipping of the Last Run state badge (#72841)
+- UI: Fix Calendar view computing planned cron runs in UTC instead of the
Dag's timezone (#72839)
+- Fix ``airflow info --file-io`` uploading an empty report (#72832)
+- Preserve custom operator defaults in mapped tasks (#72828)
+- Gate the asset event ``partition_key`` behind the 2026-06-30 Execution API
version (#72827)
+- Improve deadline diagnostics for null ``DagRun`` fields (#72812)
+- Fix missing HTTP access logs when the api-server omits the core app (#72808)
+- Clarify when the auth manager ``is_authorized_hitl_task``
(Human-in-the-loop) hook runs (#72807)
+- Fix ``td_format`` rendering of negative durations (#72798)
+- UI: Make copied task log text match the on-screen format (#72771)
+- UI: Fix connection test with a null host and port (#72747)
+- Allow ``airflow jobs check --allow-multiple`` with ``--limit 0`` (#72744)
+- UI: Keep task log selection stable while dragging (#72743)
+- UI: Restore counts on the Dag Run and Task Instance lists (#72739)
+- UI: Fix the Dags list Last Run / Next Run going stale after runs complete
(#72735)
+- UI: Fix the first startup request being sent to an unset API base URL
(#72733)
+- UI: Fix task instance links leading to 404s for tasks outside the run's date
range (#72732)
+- UI: Fix the Human-in-the-loop form crashing on null values (#72731)
+- UI: Fix copying task logs dropping rows that scrolled out of view (#72729)
+- UI: Label Dag active runs accurately (#72722)
+- Bound single-row ``XCom`` existence lookups with ``LIMIT 1`` to avoid full
scans (#72702)
+- UI: Fix Firefox multi-line drag selection in the task log view (#72700)
+- Fix Dag scheduling stall after switching to a coarser cron (#72679)
+- Fix memray profiling capturing interpreter startup instead of the
dag-processor job (#72661)
+- Prevent Dag-existence disclosure on the partitioned dag runs listing (#72660)
+- Fix mark-failed ``KeyError`` for removed-task task instances (#72620)
+- UI: Fix ``hierarchical_alphabetical`` sort order breaking the graph and grid
(#72618)
+- Clarify ``@task``-decorated callable errors when extra positional arguments
are passed (#72616)
+- Load the correct Dag version when a task starts from a trigger (#72614)
+- Fix db migrate failure to Airflow 2.9.2 under the PyMySQL driver (#72613)
Review Comment:
We may need better wording here. it's odd to see airflow 2.9.2 under airflow
3.3.2 change
##########
RELEASE_NOTES.rst:
##########
@@ -24,6 +24,210 @@
.. towncrier release notes start
+Airflow 3.3.2 (2026-09-17)
+--------------------------
+
+Significant Changes
+^^^^^^^^^^^^^^^^^^^
+
+- Backfill endpoints no longer disclose which backfill ids exist across Dags
+
+ The four routes that name a backfill in their path -- ``GET
/backfills/{backfill_id}``
+ and the ``pause``, ``unpause`` and ``cancel`` routes -- resolved the Dag
they authorize
+ against from the ``dag_id`` supplied on the request whenever the path's id
matched no row.
+ An unknown id and a backfill on a Dag the caller cannot see therefore
answered differently,
+ which enumerates backfill ids across Dags.
+
+ The backfill named in the path is now the only thing those routes authorize
against.
+
+ **Behaviour changes:**
+
+ - A backfill whose Dag the caller may not read returns ``404`` with detail
+ ``Backfill not found``, the same answer an unknown id gets, where it
previously returned
+ ``403``. A caller who may read the Dag still gets ``403`` for a write they
are not allowed.
+ - A ``backfill_id`` in the path is never authorized against a ``dag_id`` in
the request body
+ or query string. ``GET /backfills``, ``POST /backfills`` and ``POST
/backfills/dry_run``
+ name no backfill in their path and keep authorizing off the request.
+ - All four routes now answer an unknown id with the same detail, ``Backfill
not found``.
+ The ``pause``, ``unpause`` and ``cancel`` routes previously answered
+ ``Could not find backfill with id {backfill_id}``. Clients matching on
``detail``
+ must be updated. (#71113)
+- An explicit credential now takes precedence over the session cookie
+
+ ``get_user()`` codes the precedence bearer, then OAuth2, then the session
cookie, but
+ that block was unreachable whenever a cookie was present.
``JWTRefreshMiddleware`` runs
+ first, resolves a user from the ``_token`` cookie alone and stamps it on
+ ``request.state``, and ``get_user()`` returned that cached user before
looking at either
+ explicit credential. The effective order on every core-API route was cookie
over bearer.
+
+ A request carrying both a session cookie and an explicit credential
therefore executed,
+ and was recorded in the audit log, as the cookie's principal rather than the
identity the
+ client presented. The cached user is now honoured only when the request
carries no
+ explicit credential.
+
+ **Behaviour changes:**
+
+ - A request carrying **both** a ``_token`` cookie and an ``Authorization:
Bearer`` header
+ is now resolved as the bearer token's principal, where it was previously
resolved as the
+ cookie's. The same applies to a cookie combined with an OAuth2 token.
+ - An **invalid or expired** explicit credential is now rejected with
``401``/``403`` even
+ when a valid ``_token`` cookie accompanies it. Previously the cookie
silently took over
+ and the request succeeded as the cookie's principal; the failure is now
loud.
+ - Requests carrying a single credential are unaffected. Cookie-only browser
sessions keep
+ the token-refresh behaviour of ``JWTRefreshMiddleware`` unchanged.
+ - Clients that relied on the cookie winning -- for example a browser-based
tool that sent a
+ service account's bearer token while a user session cookie was present,
and expected the
+ user's identity to apply -- will now act as the bearer token's principal.
Remove the
+ header, or the cookie, to select the intended identity explicitly. (#72225)
+
+
+Bug Fixes
+^^^^^^^^^
+
+- Optimize the previous-task-instance lookup by removing a redundant
``dag_run`` join (#72944)
+- Revoke every credential presented to the logout endpoint, not just the
session cookie (#72933)
+- API: Return HTTP 404 instead of 500 when a task starts against a missing Dag
run (#72900)
+- Fix ``airflow db clean`` never purging the ``callback`` table (#72899)
+- Fix the Dag version inflation check not warning about custom ``DAG``
subclasses or aliased-module imports (#72898)
+- Fix ``DeadlockImminentError`` when a connection is resolved inside an async
task (#72895)
+- Fix dag processor crash when an orphaned processor is killed (#72888)
+- Prevent corruption of ``XCom`` values that already parse as JSON during the
bytea-to-JSONB migration (#72886)
+- Fix HTTP 500 for non-dict JSON bodies on the Variable and Connection API
endpoints (#72878)
+- Fix resolution of deprecated imports in ``airflow.utils.helpers`` (#72868)
+- Bound single-row lookups with ``LIMIT 1`` to avoid scanning large tables
(#72842)
+- UI: Fix clipping of the Last Run state badge (#72841)
+- UI: Fix Calendar view computing planned cron runs in UTC instead of the
Dag's timezone (#72839)
+- Fix ``airflow info --file-io`` uploading an empty report (#72832)
+- Preserve custom operator defaults in mapped tasks (#72828)
+- Gate the asset event ``partition_key`` behind the 2026-06-30 Execution API
version (#72827)
+- Improve deadline diagnostics for null ``DagRun`` fields (#72812)
+- Fix missing HTTP access logs when the api-server omits the core app (#72808)
+- Clarify when the auth manager ``is_authorized_hitl_task``
(Human-in-the-loop) hook runs (#72807)
+- Fix ``td_format`` rendering of negative durations (#72798)
+- UI: Make copied task log text match the on-screen format (#72771)
+- UI: Fix connection test with a null host and port (#72747)
+- Allow ``airflow jobs check --allow-multiple`` with ``--limit 0`` (#72744)
+- UI: Keep task log selection stable while dragging (#72743)
+- UI: Restore counts on the Dag Run and Task Instance lists (#72739)
+- UI: Fix the Dags list Last Run / Next Run going stale after runs complete
(#72735)
+- UI: Fix the first startup request being sent to an unset API base URL
(#72733)
+- UI: Fix task instance links leading to 404s for tasks outside the run's date
range (#72732)
+- UI: Fix the Human-in-the-loop form crashing on null values (#72731)
+- UI: Fix copying task logs dropping rows that scrolled out of view (#72729)
+- UI: Label Dag active runs accurately (#72722)
+- Bound single-row ``XCom`` existence lookups with ``LIMIT 1`` to avoid full
scans (#72702)
+- UI: Fix Firefox multi-line drag selection in the task log view (#72700)
+- Fix Dag scheduling stall after switching to a coarser cron (#72679)
+- Fix memray profiling capturing interpreter startup instead of the
dag-processor job (#72661)
+- Prevent Dag-existence disclosure on the partitioned dag runs listing (#72660)
+- Fix mark-failed ``KeyError`` for removed-task task instances (#72620)
+- UI: Fix ``hierarchical_alphabetical`` sort order breaking the graph and grid
(#72618)
+- Clarify ``@task``-decorated callable errors when extra positional arguments
are passed (#72616)
+- Load the correct Dag version when a task starts from a trigger (#72614)
+- Fix db migrate failure to Airflow 2.9.2 under the PyMySQL driver (#72613)
+- Stop ``airflow providers get --full`` mutating cached provider metadata
(#72601)
+- Fix ``airflow connections test`` returning a success exit code on failure
(#72583)
+- Stop ``airflow standalone`` leaking components when one fails to start
(#72568)
+- Fix ``DAG.cli()`` crashing on ``dags pause`` and ``dags unpause`` (#72565)
+- Prevent Dag CLI subcommands from being silently dropped (#72365)
+- Respect the ``limit`` search param in the task overview duration chart
(#72357)
+- UI: Show duration chart tooltips in the selected timezone (#72339)
+- Export ``AIRFLOW_TEST_MODE`` from ``airflow tasks test`` without
``--env-vars`` (#72320)
+- Authenticate only once per task process to external secrets backends (#72237)
+- Remove the impossible 404 response from the create Variable API endpoint
(#72190)
Review Comment:
impossible?
##########
RELEASE_NOTES.rst:
##########
@@ -6441,6 +6645,17 @@ You can achieve it also by installing airflow with
``[celery]``, ``[cncf.kuberne
Users who base their images on the ``apache/airflow`` reference image (not
slim) should be unaffected - the base
reference image comes with all the three providers installed.
+``DAG.test()`` now returns a ``DagRun`` and no longer stops at the first task
failure (#32820)
+""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+This was an undocumented side effect of adding support for setup/teardown
tasks in mapped task
+groups. Previously, ``DAG.test()`` returned ``None``, and if any task raised
an exception, the
+whole test run stopped immediately without running the DAG's other schedulable
tasks. Now,
+``DAG.test()`` returns the ``DagRun`` it executed, and a failing task no
longer aborts the run:
+the remaining tasks keep running according to their trigger rules, just like
in a real scheduled
+run. This makes it possible to use ``DAG.test()`` to test DAGs where a task is
expected to fail
+but downstream tasks with a different trigger rule (or a parallel mapped task
group) should still
+run, without having to fall back to the ``DebugExecutor``.
+
Review Comment:
How did this get here? It's 2.7 change
##########
RELEASE_NOTES.rst:
##########
@@ -24,6 +24,210 @@
.. towncrier release notes start
+Airflow 3.3.2 (2026-09-17)
+--------------------------
+
+Significant Changes
+^^^^^^^^^^^^^^^^^^^
+
+- Backfill endpoints no longer disclose which backfill ids exist across Dags
+
+ The four routes that name a backfill in their path -- ``GET
/backfills/{backfill_id}``
+ and the ``pause``, ``unpause`` and ``cancel`` routes -- resolved the Dag
they authorize
+ against from the ``dag_id`` supplied on the request whenever the path's id
matched no row.
+ An unknown id and a backfill on a Dag the caller cannot see therefore
answered differently,
+ which enumerates backfill ids across Dags.
+
+ The backfill named in the path is now the only thing those routes authorize
against.
+
+ **Behaviour changes:**
+
+ - A backfill whose Dag the caller may not read returns ``404`` with detail
+ ``Backfill not found``, the same answer an unknown id gets, where it
previously returned
+ ``403``. A caller who may read the Dag still gets ``403`` for a write they
are not allowed.
+ - A ``backfill_id`` in the path is never authorized against a ``dag_id`` in
the request body
+ or query string. ``GET /backfills``, ``POST /backfills`` and ``POST
/backfills/dry_run``
+ name no backfill in their path and keep authorizing off the request.
+ - All four routes now answer an unknown id with the same detail, ``Backfill
not found``.
+ The ``pause``, ``unpause`` and ``cancel`` routes previously answered
+ ``Could not find backfill with id {backfill_id}``. Clients matching on
``detail``
+ must be updated. (#71113)
+- An explicit credential now takes precedence over the session cookie
+
Review Comment:
```suggestion
- An explicit credential now takes precedence over the session cookie
```
Space from unrelated pagraph above
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
