This is an automated email from the ASF dual-hosted git repository.
vatsrahul1001 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new bf973cb09ee Airflow 3.3.2 has been released (#73279)
bf973cb09ee is described below
commit bf973cb09eee8475389c349be1d97c8224d98761
Author: Rahul Vats <[email protected]>
AuthorDate: Thu Sep 17 18:40:39 2026 +0530
Airflow 3.3.2 has been released (#73279)
* Airflow 3.3.2 has been released
* Fix spellcheck: backtick locale/type identifiers, add wordlist entries
---
Dockerfile | 2 +-
README.md | 2 +-
RELEASE_NOTES.rst | 209 +++++++++++++++++++++
.../docs/installation/supported-versions.rst | 2 +-
dev/breeze/src/airflow_breeze/global_constants.py | 2 +-
docs/spelling_wordlist.txt | 2 +
reproducible_build.yaml | 4 +-
scripts/ci/prek/supported_versions.py | 2 +-
8 files changed, 218 insertions(+), 7 deletions(-)
diff --git a/Dockerfile b/Dockerfile
index b5c0ef261cf..28a90b39a13 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -48,7 +48,7 @@ ARG AIRFLOW_UID="50000"
ARG AIRFLOW_USER_HOME_DIR=/home/airflow
# latest released version here
-ARG AIRFLOW_VERSION="3.3.1"
+ARG AIRFLOW_VERSION="3.3.2"
ARG BASE_IMAGE="debian:bookworm-slim"
ARG AIRFLOW_PYTHON_VERSION="3.13.15"
diff --git a/README.md b/README.md
index 886a21be6d7..7e49de2a1ea 100644
--- a/README.md
+++ b/README.md
@@ -296,7 +296,7 @@ Apache Airflow version life cycle:
| Version | Current Patch/Minor | State | First Release | Limited
Maintenance | EOL/Terminated |
|-----------|-----------------------|-------------|-----------------|-----------------------|------------------|
-| 3 | 3.3.1 | Maintenance | Apr 22, 2025 | TBD
| TBD |
+| 3 | 3.3.2 | Maintenance | Apr 22, 2025 | TBD
| TBD |
| 2 | 2.11.2 | EOL | Dec 17, 2020 | Oct 22,
2025 | Apr 22, 2026 |
| 1.10 | 1.10.15 | EOL | Aug 27, 2018 | Dec 17,
2020 | June 17, 2021 |
| 1.9 | 1.9.0 | EOL | Jan 03, 2018 | Aug 27,
2018 | Aug 27, 2018 |
diff --git a/RELEASE_NOTES.rst b/RELEASE_NOTES.rst
index a02be76362a..90ffa8a8e62 100644
--- a/RELEASE_NOTES.rst
+++ b/RELEASE_NOTES.rst
@@ -24,6 +24,215 @@
.. towncrier release notes start
+Airflow 3.3.2 (2026-09-17)
+--------------------------
+
+Significant Changes
+^^^^^^^^^^^^^^^^^^^
+
+- Backfill endpoints no longer disclose which backfill ids exist across Dags
+
+ The four routes that name a backfill in their path -- ``GET
/backfills/{backfill_id}``
+ and the ``pause``, ``unpause`` and ``cancel`` routes -- resolved the Dag
they authorize
+ against from the ``dag_id`` supplied on the request whenever the path's id
matched no row.
+ An unknown id and a backfill on a Dag the caller cannot see therefore
answered differently,
+ which enumerates backfill ids across Dags.
+
+ The backfill named in the path is now the only thing those routes authorize
against.
+
+ **Behaviour changes:**
+
+ - Requesting a backfill on a Dag the caller cannot read now returns ``404``
+ (``Backfill not found``) -- the same response an unknown id gets --
instead of the
+ ``403`` returned before. A caller who can read the Dag still gets ``403``
for a write
+ they are not allowed to make.
+ - A ``backfill_id`` in the path is never authorized against a ``dag_id`` in
the request body
+ or query string. ``GET /backfills``, ``POST /backfills`` and ``POST
/backfills/dry_run``
+ name no backfill in their path and keep authorizing off the request.
+ - All four routes now answer an unknown id with the same detail, ``Backfill
not found``.
+ The ``pause``, ``unpause`` and ``cancel`` routes previously answered
+ ``Could not find backfill with id {backfill_id}``. Clients matching on
``detail``
+ must be updated. (#71113)
+
+- An explicit credential now takes precedence over the session cookie
+
+ ``get_user()`` is written to prefer an explicit bearer token, then OAuth2,
then the
+ session cookie, but that precedence was unreachable whenever a cookie was
present.
+ ``JWTRefreshMiddleware`` runs
+ first, resolves a user from the ``_token`` cookie alone and stamps it on
+ ``request.state``, and ``get_user()`` returned that cached user before
looking at either
+ explicit credential. The effective order on every core-API route was cookie
over bearer.
+
+ A request carrying both a session cookie and an explicit credential
therefore executed,
+ and was recorded in the audit log, as the cookie's principal rather than the
identity the
+ client presented. The cached user is now honoured only when the request
carries no
+ explicit credential.
+
+ **Behaviour changes:**
+
+ - A request carrying **both** a ``_token`` cookie and an ``Authorization:
Bearer`` header
+ is now resolved as the bearer token's principal, where it was previously
resolved as the
+ cookie's. The same applies to a cookie combined with an OAuth2 token.
+ - An **invalid or expired** explicit credential is now rejected with
``401``/``403`` even
+ when a valid ``_token`` cookie accompanies it. Previously the cookie
silently took over
+ and the request succeeded as the cookie's principal; the failure is now
loud.
+ - Requests carrying a single credential are unaffected. Cookie-only browser
sessions keep
+ the token-refresh behaviour of ``JWTRefreshMiddleware`` unchanged.
+ - Clients that relied on the cookie winning -- for example a browser-based
tool that sent a
+ service account's bearer token while a user session cookie was present,
and expected the
+ user's identity to apply -- will now act as the bearer token's principal.
Remove the
+ header, or the cookie, to select the intended identity explicitly. (#72225)
+
+
+Bug Fixes
+^^^^^^^^^
+
+- Optimize the previous-task-instance lookup by removing a redundant
``dag_run`` join (#72944)
+- Revoke every credential presented to the logout endpoint, not just the
session cookie (#72933)
+- API: Return HTTP 404 instead of 500 when a task starts against a missing Dag
run (#72900)
+- Fix ``airflow db clean`` never purging the ``callback`` table (#72899)
+- Fix the Dag version inflation check not warning about custom ``DAG``
subclasses or aliased-module imports (#72898)
+- Fix ``DeadlockImminentError`` when a connection is resolved inside an async
task (#72895)
+- Fix dag processor crash when an orphaned processor is killed (#72888)
+- Prevent corruption of ``XCom`` values that already parse as JSON during the
``bytea``-to-``JSONB`` migration (#72886)
+- Fix HTTP 500 for non-dict JSON bodies on the Variable and Connection API
endpoints (#72878)
+- Fix resolution of deprecated imports in ``airflow.utils.helpers`` (#72868)
+- Bound single-row lookups with ``LIMIT 1`` to avoid scanning large tables
(#72842)
+- UI: Fix clipping of the Last Run state badge (#72841)
+- UI: Fix Calendar view computing planned cron runs in UTC instead of the
Dag's timezone (#72839)
+- Fix ``airflow info --file-io`` uploading an empty report (#72832)
+- Preserve custom operator defaults in mapped tasks (#72828)
+- Gate the asset event ``partition_key`` behind the 2026-06-30 Execution API
version (#72827)
+- Improve deadline diagnostics for null ``DagRun`` fields (#72812)
+- Fix missing HTTP access logs when the api-server omits the core app (#72808)
+- Clarify when the auth manager ``is_authorized_hitl_task``
(Human-in-the-loop) hook runs (#72807)
+- Fix ``td_format`` rendering of negative durations (#72798)
+- UI: Make copied task log text match the on-screen format (#72771)
+- UI: Fix connection test with a null host and port (#72747)
+- Allow ``airflow jobs check --allow-multiple`` with ``--limit 0`` (#72744)
+- UI: Keep task log selection stable while dragging (#72743)
+- UI: Restore counts on the Dag Run and Task Instance lists (#72739)
+- UI: Fix the Dags list Last Run / Next Run going stale after runs complete
(#72735)
+- UI: Fix the first startup request being sent to an unset API base URL
(#72733)
+- UI: Fix task instance links leading to 404s for tasks outside the run's date
range (#72732)
+- UI: Fix the Human-in-the-loop form crashing on null values (#72731)
+- UI: Fix copying task logs dropping rows that scrolled out of view (#72729)
+- UI: Label Dag active runs accurately (#72722)
+- Bound single-row ``XCom`` existence lookups with ``LIMIT 1`` to avoid full
scans (#72702)
+- UI: Fix Firefox multi-line drag selection in the task log view (#72700)
+- Fix Dag scheduling stall after switching to a coarser cron (#72679)
+- Fix memray profiling capturing interpreter startup instead of the
dag-processor job (#72661)
+- Prevent Dag-existence disclosure on the partitioned dag runs listing (#72660)
+- Fix mark-failed ``KeyError`` for removed-task task instances (#72620)
+- UI: Fix ``hierarchical_alphabetical`` sort order breaking the graph and grid
(#72618)
+- Clarify ``@task``-decorated callable errors when extra positional arguments
are passed (#72616)
+- Load the correct Dag version when a task starts from a trigger (#72614)
+- Fix ``airflow db migrate`` failing under the PyMySQL driver when a schema
migration drops unique constraints (#72613)
+- Stop ``airflow providers get --full`` mutating cached provider metadata
(#72601)
+- Fix ``airflow connections test`` returning a success exit code on failure
(#72583)
+- Stop ``airflow standalone`` leaking components when one fails to start
(#72568)
+- Fix ``DAG.cli()`` crashing on ``dags pause`` and ``dags unpause`` (#72565)
+- Prevent Dag CLI subcommands from being silently dropped (#72365)
+- Respect the ``limit`` search param in the task overview duration chart
(#72357)
+- UI: Show duration chart tooltips in the selected timezone (#72339)
+- Export ``AIRFLOW_TEST_MODE`` from ``airflow tasks test`` without
``--env-vars`` (#72320)
+- Authenticate only once per task process to external secrets backends (#72237)
+- Remove the unreachable 404 response from the create Variable API endpoint
(#72190)
+- Speed up bulk updates of Variables and Pools by fixing an N+1 query (#72160)
+- UI: Fix a React plugin rendering a previously loaded plugin's component
(#72136)
+- Fix Variable write-conflict checks comparing against the wrong team (#72125)
+- UI: Surface connection test errors instead of failing silently (#71963)
+- Fix the runtime-varying-value checker skipping tasks defined after a nested
``with`` block (#71956)
+- Speed up marking a Dag run failed when it has many mapped task instances
(#71955)
+- UI: Include the JSON parse-error message in the Variable form warning
(#71953)
+- UI: Allow file downloads from plugin external-view iframes (#71952)
+- UI: Make the grid run bar tooltip time zone aware (#71951)
+- Reduce memory used when deleting queued asset events (#71937)
+- UI: Activate assets materialized from an AssetAlias so they appear in the
Assets tab (#71935)
+- Fix ``Variable.set`` rewriting the ``team_name`` of existing variables
(#71904)
+- Reduce memory used when deleting a Dag with a large history (#71889)
+- UI: Show an empty object for object params with no value (#71876)
+- Fix Dag callbacks silently dropped when the version inflation check blocks
parsing (#71865)
+- Return HTTP 404 from task state store endpoints for unknown task instances
(#71860)
+- Fix deadline never firing after a non-deadline Dag edit (#71859)
+- Honor the API server Dag cache TTL when no size limit is set (#71845)
+- Require Dag edit permission to delete asset queued events (#71828)
+- Bound the scheduler's deserialized Dag cache to prevent unbounded memory
growth (#71821)
+- Stop variables export/import from silently corrupting values (#71791)
+- UI: Fix datetime pickers unusable on Firefox and Safari (#71788)
+- Scope ``/assets/events`` to the Dags the caller may read (#71785)
+- Serve logs from the scheduler if any executor is LocalExecutor (#71781)
+- Fix cleared tasks getting stuck when a Dag run has no version (#71773)
+- Stop the dag processor warning on every file path normalized for stats
(#71764)
+- UI: Fix the last section on the page not being clickable (#71755)
+- Fix deadline serialization, repr, and prune edge cases (#71726)
+- Dispatch the highest-priority tasks first in the executor (#71715)
+- Keep ZIP-archived Dags active when ``dag_discovery_safe_mode`` is False
(#71714)
+- Honor ``FORWARDED_ALLOW_IPS`` when the API server runs under gunicorn
(#71708)
+- Fix ``airflow config lint`` staying silent on conditional removal rules
(#71651)
+- Avoid exhausting the DB connection pool when rendering the grid structure
for large Dags (#71626)
+- Fix Task SDK IPC short reads crashing the subprocess or hanging the
supervisor (#71609)
+- Fix one bad callback request crashing the Dag processor and dropping the
rest (#71608)
+- Fix ``clearTaskInstances`` returning HTTP 500 instead of 422 on an invalid
body (#71559)
+- Mark only a run's most recent asset event as triggering it (#71547)
+- Fix Variables API handling of non-string JSON values (#71526)
+- Include server error detail in Task SDK API error tracebacks (#71491)
+- Show each Dag only once in ``airflow dags list`` (#71481)
+- Keep Dag run Execution API endpoints working for older Task SDK clients
(#71438)
+- UI: Fix Calendar view hanging for Dags with high-frequency cron schedules
(#71435)
+- Require existing-connection read access when testing an existing connection
(#71428)
+- UI: Fix Grid view failing to load large Dags on MySQL (#71370)
+- Catch general Exception when initializing a Dag bundle (#71363)
+- Fix deactivation of stale ZIP-packaged Dags (#71326)
+- Avoid scheduler crash when periodic maintenance actions fail (#71288)
+- Fix ``_team_name`` missing from ``DagRun`` passed to some listener calls
(#71262)
+
+Miscellaneous
+^^^^^^^^^^^^^
+
+- Add async asset store accessors for async tasks and watcher triggers (#72851)
+- UI: Add Consuming Tasks, Aliases, and Watchers to the assets pages (#72780)
+- Improve confirmation output when connections are added via the CLI (#72779)
+- UI: Sync the browser URL with navigation inside iframe views (#72776)
+- Reduce Dag-processor log noise by logging a bundle that is not due for
refresh at debug instead of info (#72749)
+- Allow deadline alert UUID references in the serialized Dag schema (#72738)
+- Add ``SerializedVariableInterval`` for deadline alerts (#72244)
+- Report Dag cache metrics under each component's own namespace (#71925)
+- Add a password field type to ``FlexibleForm`` (#71573)
+- Add ``BaseDeadlineReference`` and ``deadline_reference`` to the SDK public
interface (#71208)
+
+Doc Only Changes
+^^^^^^^^^^^^^^^^
+
+- Update Catalan (ca) UI translations (#73026)
+- Fix a missing newline in the overview docs that prevented an image from
rendering (#73013)
+- Document durable execution in the core concepts docs (#73012)
+- Clarify authentication and add an authorization example for plugin FastAPI
apps (#72942)
+- Document that plugin FastAPI apps are not authenticated by Airflow (#72932)
+- Close German UI translation gaps (#72843)
+- Fix the Postgres tutorial for psycopg3 (#72837)
+- Document scope boundaries the security model leaves implicit (#72829)
+- Make the first tutorial example more explicit about Airflow syntax (#72805)
+- Add a ``create_async_metadata_engine`` example to the docs (#72804)
+- Add a systemd unit file for the Airflow Dag processor (#72797)
+- UI: Complete ``zh-CN`` Simplified Chinese translations (#72789)
+- Drop the extraneous "common" tag in i18n (#72781)
+- Add missing Russian UI translations (#72755)
+- Complete German UI translations (#72736)
+- UI: Complete Polish UI translations (#72624)
+- Record recurring non-issue shapes in the security model (#72617)
+- Complete Taiwanese Mandarin (``zh-TW``) UI translations (#72615)
+- UI: Translate durations and relative times in the selected language (#72334)
+- Remove the TaskFlow recommendation from the tutorial docs (#72118)
+- Split the task execution architecture docs into an overview and a dev guide
(#71858)
+- Document service.name and service.instance.id for OpenTelemetry metrics
(#71854)
+- UI: Improve French translation wording (#71846)
+- Complete French UI translations (#71790)
+- Improve Arabic UI translations (#71789)
+- Document HTTP statuses that API routes raise but never declared (#71622)
+- Recommend ``dag.test()`` for testing custom operators in the docs (#71587)
+
+
Airflow 3.3.1 (2026-08-12)
--------------------------
diff --git a/airflow-core/docs/installation/supported-versions.rst
b/airflow-core/docs/installation/supported-versions.rst
index 2c43585ac84..837de6809de 100644
--- a/airflow-core/docs/installation/supported-versions.rst
+++ b/airflow-core/docs/installation/supported-versions.rst
@@ -29,7 +29,7 @@ Apache Airflow® version life cycle:
========= ===================== =========== ===============
===================== ================
Version Current Patch/Minor State First Release Limited
Maintenance EOL/Terminated
========= ===================== =========== ===============
===================== ================
-3 3.3.1 Maintenance Apr 22, 2025 TBD
TBD
+3 3.3.2 Maintenance Apr 22, 2025 TBD
TBD
2 2.11.2 EOL Dec 17, 2020 Oct 22, 2025
Apr 22, 2026
1.10 1.10.15 EOL Aug 27, 2018 Dec 17, 2020
June 17, 2021
1.9 1.9.0 EOL Jan 03, 2018 Aug 27, 2018
Aug 27, 2018
diff --git a/dev/breeze/src/airflow_breeze/global_constants.py
b/dev/breeze/src/airflow_breeze/global_constants.py
index 463174c77e4..51a7d020351 100644
--- a/dev/breeze/src/airflow_breeze/global_constants.py
+++ b/dev/breeze/src/airflow_breeze/global_constants.py
@@ -894,7 +894,7 @@ PROVIDERS_COMPATIBILITY_TESTS_MATRIX: list[dict[str, str |
list[str]]] = [
},
{
"python-version": "3.10",
- "airflow-version": "3.3.1",
+ "airflow-version": "3.3.2",
"remove-providers": "",
"run-unit-tests": "true",
},
diff --git a/docs/spelling_wordlist.txt b/docs/spelling_wordlist.txt
index bfc7fc8a43b..ad18f656ec2 100644
--- a/docs/spelling_wordlist.txt
+++ b/docs/spelling_wordlist.txt
@@ -3,6 +3,7 @@ abc
AbstractFileSystem
AbstractToolset
accessor
+accessors
AccessSecretVersionResponse
aci
Ack
@@ -798,6 +799,7 @@ hiveserver
hmsclient
hoc
homebrew
+honoured
hookimpl
hookspec
HostAliases
diff --git a/reproducible_build.yaml b/reproducible_build.yaml
index 899ae26633d..4164646e34f 100644
--- a/reproducible_build.yaml
+++ b/reproducible_build.yaml
@@ -1,2 +1,2 @@
-release-notes-hash: 450e43a9dd38329434e5f90e2762ff8c
-source-date-epoch: 1788437511
+release-notes-hash: 9c64e2f3d23b4234ae54f5b5db13a331
+source-date-epoch: 1789644375
diff --git a/scripts/ci/prek/supported_versions.py
b/scripts/ci/prek/supported_versions.py
index c438e11d1b4..2e218381c1f 100755
--- a/scripts/ci/prek/supported_versions.py
+++ b/scripts/ci/prek/supported_versions.py
@@ -39,7 +39,7 @@ HEADERS = (
)
SUPPORTED_VERSIONS = (
- ("3", "3.3.1", "Maintenance", "Apr 22, 2025", "TBD", "TBD"),
+ ("3", "3.3.2", "Maintenance", "Apr 22, 2025", "TBD", "TBD"),
("2", "2.11.2", "EOL", "Dec 17, 2020", "Oct 22, 2025", "Apr 22, 2026"),
("1.10", "1.10.15", "EOL", "Aug 27, 2018", "Dec 17, 2020", "June 17,
2021"),
("1.9", "1.9.0", "EOL", "Jan 03, 2018", "Aug 27, 2018", "Aug 27, 2018"),
