Skip to content

Upgrade email notifications to use SmtpNotifier - #57354

Merged
amoghrajesh merged 13 commits into
apache:mainfrom
amoghrajesh:rework-email-in-task-using-smtp
Nov 11, 2025
Merged

Upgrade email notifications to use SmtpNotifier#57354
amoghrajesh merged 13 commits into
apache:mainfrom
amoghrajesh:rework-email-in-task-using-smtp

Conversation

@amoghrajesh

@amoghrajesh amoghrajesh commented Oct 27, 2025

Copy link
Copy Markdown
Contributor

closes: #54712

What?

Replace legacy email_on_failure and email_on_retry attributes with SmtpNotifier from apache-airflow-providers-smtp. This change automatically converts the old email configuration to the new notifier-based system while maintaining backward compatibility.

The intention behind doing this is to maintain ONE way of doing things compared to having copies of doing the same thing in multiple ways across core, task sdk, providers.

Testing

Setup

Using docker image of mailpit to set up a SMTP server in same network as breeze

~ docker run -d \
  --network breeze_default \
  -p 8025:8025 \
  --name mailpit \
  axllent/mailpit

Setup a connection for SMTP
image

The UI can be accessed at localhost:8025 now

Route 1: Testing email functionality from tasks

DAG used:

from datetime import datetime
from airflow import DAG
from airflow.providers.standard.operators.bash import BashOperator
from airflow.providers.smtp.notifications.smtp import send_smtp_notification
from airflow.providers.standard.operators.python import PythonOperator

def retryable_func():
    1//0

with DAG(
    dag_id="smtp_notifier",
    schedule=None,
    start_date=datetime(2023, 1, 1),
    catchup=False,
):
    op1 = BashOperator(
        task_id="mytask",
        email="bash-task@example.com",
        email_on_failure=True,
        bash_command="exit 1",
    )

    op2 = PythonOperator(
        task_id="mytask2",
        email_on_retry=True,
        python_callable=retryable_func,
        email="python-task@example.com",
        retries=3,
    )

    [op1, op2]

One of the tasks has email_on_retry defined, the other has email_on_failure.

The bash task fails and python tasks retries.

Bash Task

image

Python Task

image

Emails

For retried task (observe try number)
image

For failed task

image

Route 2: SMTP provider not installed at all

Uninstall smtp provider on workers

root@f7bf900b8f64:/opt/airflow# pip freeze | grep smtp
aiosmtplib==4.0.2
# Editable install with no version control (apache-airflow-providers-smtp==2.3.0)
-e /opt/airflow/providers/smtp
root@f7bf900b8f64:/opt/airflow# uv pip uninstall apache-airflow-providers-smtp
Using Python 3.10.18 environment at: /usr/python
Uninstalled 1 package in 23ms
 - apache-airflow-providers-smtp==2.3.0 (from file:///opt/airflow/providers/smtp)
root@f7bf900b8f64:/opt/airflow# pip freeze | grep smtp
aiosmtplib==4.0.2

Bash Task
image

Python Task
image

Route 3: Testing callbacks with email because it uses the same interface

DAG:

from datetime import datetime
from airflow import DAG
from airflow.providers.smtp.notifications.smtp import send_smtp_notification
from airflow.providers.standard.operators.bash import BashOperator
from airflow.providers.standard.operators.python import PythonOperator

def retryable_func():
    1//0

with DAG(
    dag_id="smtp_notifier",
    schedule=None,
    start_date=datetime(2023, 1, 1),
    catchup=False,
):
    op1 = BashOperator(
        task_id="mytask",
        on_failure_callback=[
            send_smtp_notification(
                from_email="from@mail.com",
                to="to@mail.com",
                subject="[Error] The Task {{ ti.task_id }} failed",
                html_content="debug logs",
            )
        ],
        # email="bash-task@example.com",
        # email_on_failure=True,
        bash_command="exit 1",
    )

    op2 = PythonOperator(
        task_id="mytask2",
        # email_on_retry=True,
        python_callable=retryable_func,
        # email="python-task@example.com",
        on_retry_callback=[
            send_smtp_notification(
                from_email="from2@mail.com",
                to="to2@mail.com",
                subject="[Error] The Task Python {{ ti.task_id }} failed",
                html_content="debug logs",
            )
        ],
        retries=3,
    )

    [op1, op2]

One of the task has a retry call back and the other has failure callback.

Task failures
image

image

Failure callback:
image

Retry callback:

image

And one for each retry:

image

Route 4: Testing with custom subject and html content templates

Subject template:

Custom Subject: {{ti.task_id}} failed in DAG {{ti.dag_id}}

Content template:

<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <title>Custom Email Template</title>
</head>
<body>
    <h2>Task Failure Notification</h2>
    <p><strong>Task:</strong> {{ti.task_id}}</p>
    <p><strong>DAG:</strong> {{ti.dag_id}}</p>
    <p><strong>Run ID:</strong> {{ti.run_id}}</p>
    <p><strong>Try Number:</strong> {{try_number}} of {{max_tries + 1}}</p>
    <p><strong>Host:</strong> {{ti.hostname}}</p>
    
    <h3>Exception Details:</h3>
    <pre>{{exception_html}}</pre>
    
    <p>
        <a href="{{ti.log_url}}">View Logs</a> | 
        <a href="{{ti.mark_success_url}}">Mark Success</a>
    </p>
</body>
</html>

Defined these env vars:

export AIRFLOW__EMAIL__SUBJECT_TEMPLATE=/files/custom_email_subject.jinja2
export AIRFLOW__EMAIL__HTML_CONTENT_TEMPLATE=/files/custom_email_body.html

This is how it renders:

image

^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

@amoghrajesh

Copy link
Copy Markdown
Contributor Author

Needs much more testing + cleanup but roughly this is where I am heading with moving email notifications to use SmtpNotifier

@amoghrajesh
amoghrajesh force-pushed the rework-email-in-task-using-smtp branch from 9dd7e37 to b7dec29 Compare October 28, 2025 09:20
@amoghrajesh amoghrajesh self-assigned this Oct 28, 2025
@amoghrajesh
amoghrajesh marked this pull request as ready for review October 28, 2025 09:42
Comment thread task-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated
@amoghrajesh
amoghrajesh requested a review from uranusjr October 28, 2025 11:17
Comment thread airflow-core/src/airflow/dag_processing/processor.py
Comment thread task-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated
Comment thread task-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated
Comment thread task-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

@ashb ashb left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we use AIRFLOW__EMAIL__HTML_CONTENT_TEMPLATE anymore -- we probably should?

Comment thread task-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated
@amoghrajesh

Copy link
Copy Markdown
Contributor Author

@ashb @eladkal good call above thanks.

I tested with subject template as well as html body template and these are the results:

Subject template:

Custom Subject: {{ti.task_id}} failed in DAG {{ti.dag_id}}

Content template:

<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <title>Custom Email Template</title>
</head>
<body>
    <h2>Task Failure Notification</h2>
    <p><strong>Task:</strong> {{ti.task_id}}</p>
    <p><strong>DAG:</strong> {{ti.dag_id}}</p>
    <p><strong>Run ID:</strong> {{ti.run_id}}</p>
    <p><strong>Try Number:</strong> {{try_number}} of {{max_tries + 1}}</p>
    <p><strong>Host:</strong> {{ti.hostname}}</p>
    
    <h3>Exception Details:</h3>
    <pre>{{exception_html}}</pre>
    
    <p>
        <a href="{{ti.log_url}}">View Logs</a> | 
        <a href="{{ti.mark_success_url}}">Mark Success</a>
    </p>
</body>
</html>

Defined these env vars:

export AIRFLOW__EMAIL__SUBJECT_TEMPLATE=/files/custom_email_subject.jinja2
export AIRFLOW__EMAIL__HTML_CONTENT_TEMPLATE=/files/custom_email_body.html

This is how it renders:

image

@amoghrajesh amoghrajesh added this to the Airflow 3.2.0 milestone Nov 5, 2025
@amoghrajesh

Copy link
Copy Markdown
Contributor Author

Added it to 3.2

@amoghrajesh

Copy link
Copy Markdown
Contributor Author

@ashb @uranusjr @ephraimbuddy gentle bump for a review request on this one when you have time

@amoghrajesh
amoghrajesh merged commit bf38405 into apache:main Nov 11, 2025
84 checks passed
hwang-cadent added a commit to hwang-cadent/airflow that referenced this pull request Nov 22, 2025
…fully test (#1)

* Enable PT006 rule to 15 files in helm-tests (other,security) (#57844)

Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Airflow 3.1.2 has been released (#57887)

* Enable PT006 rule to airflow-core tests (utils) (#57885)

Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Use Iterable instead of list in API responses (#57878)

* Enable PT006 rule to task-sdk tests (#57841)

Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Enable PT006 rule to airflow-core tests (security, lineage, jobs, executors, datasets) (#57913)

Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Make set_xcom route in API server DRY by reusing logic of XComModel.set method (#55289)

Co-authored-by: Tzu-ping Chung <uranusjr@gmail.com>

* Enable PT006 rule to 17 files in providers (operatorsproviders/amazon/tests/unit/amazon/aws/operators/) (#57903)

Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Add number of queries guard for ui config (#57868)

* Enable PT006 rule to airflow-core tests (ti_deps, serialization) (#57911)

Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Unify collection.abc imports (#57914)

* Expanding task sdk integration tests to cover critical xcom operations (#57797)

* Enable PT006 rule to airflow-core tests(triggers, timetables) (#57888)

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: Xch1 <qchwan@gmail.com>

* Enable PT006 rule to airflow-core tests (utils) (#57886)

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: Xch1 <qchwan@gmail.com>

* Add required context messages to all DagRun state change notifications (#56272)

* Propogate dagrun timeout failure context

* add unit test

* pass started msg for notify dagrun start state change

* make msg required for notify_dagrun_state_changed

* fix type unit test failure

* Fixing callback tests due to wrong types (#57935)

* Bump prek, zizmor, go to fix the CI (#57930)

* Enable PT006 rule to openai Provider test (#57920)

* Fix MyPy errors in airflow-core/tests/unit/api_fastapi/core_api/routes/public (#57230)

* Fix scheduler using stale max_active_runs from SerializedDAG (#57619)

* Fix scheduler using stale max_active_runs from SerializedDAG

When max_active_runs is updated via versioned bundles, the scheduler
was checking the limit against stale SerializedDAG data instead of
the latest DagModel value. This caused queued DAG runs to be incorrectly
blocked even when the limit had been increased.

The scheduler now uses max_active_runs from DagModel (accessed via
dag_run association proxy) to ensure versioned bundle updates to
max_active_runs are respected immediately.

closes: #57604

* fixup! Fix scheduler using stale max_active_runs from SerializedDAG

* fixup! fixup! Fix scheduler using stale max_active_runs from SerializedDAG

* feat: use get async conn from common compact (#57894)

* Expanding task sdk integration tests to test connection operations (#57805)

* Enable PT006 rule to keycloak Provider test (#57923)

* Expanding task sdk integration tests to test variable get operation (#57802)

* Add secret masking for Jinja template rendering exceptions (#57467)

* feat(openlineage): Add parentRunFacet for DAG events (#57809)

* Decrease the batch inference size for example_bedrock_batch_inference (#57912)

The system tests just needs to run the minimum batch size to test
functionality. The shorter batch should decrease test runtime and
resource usage.

Also fix a bug that caused the prompts list to be an unreliable size,
there was a missing flush on the temp file.

* Add number of queries guard for ui dependencies (#57957)

* Add number of queries guard for ui dashboard (#57956)

* Migrate FAB DELETE /roles to FastAPI (#57780)

* fix: MyPy type errors in pool.py (#57810)

* Enable PT006 rule to google Provider test (hooks) (#57915)

* Enable PT006 rule to google Provider test

* ads

* /cloud/hooks

* fix ci test

* Update AWS auth manager documentation to fix login callback URL (#57974)

* Enable PT006 rule to jdbc Provider test (#57919)

* Enable PT006 rule to http Provider test (#57917)

* Enable PT006 rule to http Provider test

* fix ci error

* Enable PT006 rule to jenkins Provider test # (#57922)

* Enable PT006 rule to hashicorp Provider test (#57916)

* Add `LIST` permission to admin role in Keycloak auth manager (#57978)

* Enable PT006 rule to google Provider test (operators part1) (#57943)

* modify test_variables

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: rich7420 <rc910420@gmail.com>

* fix ci test

---------

Signed-off-by: rich7420 <rc910420@gmail.com>
Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* modify test_variables (#57945)

Signed-off-by: rich7420 <rc910420@gmail.com>
Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Enable PT006 rule to trino Provider test (#57931)

* Remove global from Fernet Crypto tooling (#57642)

* Remove global from Fernet Crypto tooling

* Add support for key rotation

* Fix pytests

* Fix pytests

* Fix pytests

* Update the version of postgres we test against (#57899)

v13 is reaching EOL in a few weeks (well before we will release 3.2,
certainly) and v18 is out now, so we should test against it

* Add `breeze ci upgrade` command to automate CI infrastructure upgrade (#57958)

We have some semi-complex set of tools that take care about upgrading
of all our CI infrastructure periodically. While dependabot has a lot of
use, a lot of cases is not handled yet in it - such as upgrading the
charts, important dependencies in our scripts, dockerfiles and so on.

While we already have a set of prek hooks and github Actions that
do a lot there, some of that has to be done periodically outside of
dependabot - this CI wraps a number of those upgrade tools into a
single `ci upgrade` command that can be run locally, generate and
open PR - and can be used in both - main and any of the v*test
branches.

Future improvement areas:

* docker container upgrades for Helm chart and docker compose
* slack notification after such upgrade PR is opened
* more .....

* Enable ruff PLW1509 rule (#57659)

* Enable ruff PLW1509 rule

* Fix pytests

* Update ORM for asset / dag partitioning (#57360)

We add string field partition_key to models DagRun and AssetEvent so these entities can be partition aware.

And we add new models AssetPartitionDagRun and PartitionedAssetKeyLog.

Think of AssetPartitionDagRun as a provisional dag run. This record is created when there's an asset event that contributes to the creation of a dag run for this dag_id / partition_key combo. It may need to wait for other events before it's ready to be created though, and the scheduler will make this determination.

The PartitionedAssetKeyLog entity is a mapping between AssetPartitionDagRun and its corresponding AssetEvent entities.

* KubernetesPodTriggerer reads pod logs instead of KubernetesPodOperator (#57531)

* Move container-related functions from PodManager to a separate file

* Moved unit tests

* Sync and async workflow use the same code to track Pod startup

* Reworked unit tests and pod startup logic

* Add api permission error detection for triggerer

* Fix pytest fixture

* Removed not requried code

* Move log file reading to triggerer

* Removed not required code

* Removed not requried unit test

* Fixed unit tests

* Clean up unit tests

* Adapt unit test

* Adapt return type

---------

Co-authored-by: AutomationDev85 <AutomationDev85>

* Further fixes for release preparation process for tarballs (#57996)

When preparing tarballs for airflow-ctl, airflow, even if we are
preparing tarballs for "final" version we need to prepare them from
a tag that has version suffix added. And we need to know the suffix.

The prepare-tarball command has now --version-suffix added as well
as the VERSION, VERSION_SUFFIX and VERSION_RC variables have been
synchronized to be the same for airflow, airflowctl, helm-chart -
previously we used VERSION to contain also RC and VERSION_WITHOUT_RC
to be final version - this is now synchronized across all release
instructions.

* Remove unnecessary `--tag` flag from git push (#57999)

* Use VERSION_SUFFIX in airflow-ctl when preparing PyPI packages. (#58001)

* build: upgrade ruff to 0.14.4 (#58017)

* Expanding task sdk integration tests to test few dagrun operations (#57955)

* Adjustments in release docs (#58008)

* Fix Connection test failures due to Fernet key caching (#58034)

* fix: Add .txt extension for log download function (#57991)

* Fix double redirection while authenticating in Fab auth manager (#57993)

* Migrate FAB GET /roles/{name} to FastAPI (#58009)

* Fix mypy type errors in test_taskinstance.py (#57942)

* fix mypy type errors in test_taskinstance.py

* Use tuple

* Fix logout in airflow-core (#57990)

* Enable PT006 rule to microsoft Provider test(hooks) (#57932)

* Enable PT006 rule to ssh Provider test (#57929)

* Enable PT006 rule to microsoft Provider test(log,sensors) (#57927)

* Enable PT006 rule to samba Provider test(transfers, hooks) (#57926)

* Enable PT006 rule to samba Provider test

* fix static check

* Enable PT006 rule to microsoft Provider test(transfers) (#57925)

* PT006 modify standard (operator) (#58020)

* Enable PT006 rule to standard Provider test(decorator, hook) 8 files (#58019)

* Enable PT006 rule to 6 files in providers (edge3,git) (#58018)

* modify all remaining files related to airflow-core (#58015)

* Enable PT006 rule to airflow-core tests (auth, common, always, integration) (#58014)

* modify route/public (#58012)

* Enable PT006 rule to airflow-core tests (route/ui, execution_api) (#58010)

* Enable PT006 rule to airflow-core tests (cli) (#58007)

* Enable PT006 rule to 23 files in providers (all remaining files related to amazon) (#58005)

* Enable PT006 rule to 23 files in providers (amazon -> hooks, links, log, queues) (#58003)

* Fix logout in Fab and Keycloak auth managers (#57992)

* Stubbing missing tests for task sdk integration testing for xcoms (#58031)

* Stubbing missing tests for task sdk integration testing for variables (#58030)

* Stubbing missing tests for task sdk integration testing for connection (#58029)

* Stubbing missing tests for task sdk integration testing for dagruns (#58036)

* Docs: Add note on running prek inside Breeze (#58039)

* Docs: Add note on running prek inside Breeze

* Update dev/breeze/doc/03_developer_tasks.rst

---------

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

* Update Arabic translation 2025-11-07 (#58042)

* Add number of queries guard for ui team (#57980)

* Add number of queries guard for ui grid (#57977)

* fix typos in comments within triggerer_job_runner.py (#58013)

* Update Hebrew translation 2025-11-07 (#58041)

* Add number of queries guard for ui calendar (#58044)

* Enable PT006 rule to 14 files in providers (databricks,dbt,docker) (#57994)

Signed-off-by: Anusha Kovi <parvathi.kovi@gmail.com>
Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Enable PT006 rule to sftp Provider test (#57924)

* Enable PT006 rule to microsoft Provider test(operators) (#57928)

* Enable PT006 rule to postgres Provider test (#57934)

* Enable PT006 rule to microsoft Provider test(azure,mssql,psrp) (#57936)

* Enable PT006 rule to mysql Provider test (#57937)

* Enable PT006 rule to celery Provider test (#57938)

* Enable PT006 rule to neo4j  Provider test (#57939)

* Enable PT006 rule to openlineage Provider test (#57940)

* Enable PT006 rule to oracle Provider test (#57941)

* Enable PT006 rule to google Provider test (operators part2)  (#57944)

* modify test_variables

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: rich7420 <rc910420@gmail.com>

* fix for the ci test

---------

Signed-off-by: rich7420 <rc910420@gmail.com>
Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Enable PT006 rule to google Provider test (log,openlineage,common,utils) (#57947)

Signed-off-by: rich7420 <rc910420@gmail.com>
Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Enable PT006 rule to airflow-core tests (core, dag_processing) (#57948)

Signed-off-by: Xch1 <qchwan@gmail.com>
Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Enable PT006 rule to airflow-core tests (models) (#57949)

* modify test_asset

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: Xch1 <qchwan@gmail.com>

* modify test_backfill

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: Xch1 <qchwan@gmail.com>

* modify test_callback

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: Xch1 <qchwan@gmail.com>

* modify test_cleartasks

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: Xch1 <qchwan@gmail.com>

* modify test_connection

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: Xch1 <qchwan@gmail.com>

* modify test_dag

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: Xch1 <qchwan@gmail.com>

* modify test_dagrun

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: Xch1 <qchwan@gmail.com>

* modify test_deadline

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: Xch1 <qchwan@gmail.com>

---------

Signed-off-by: Xch1 <qchwan@gmail.com>
Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Enable PT006 rule to google Provider test (triggers) (#57950)

Signed-off-by: rich7420 <rc910420@gmail.com>
Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Enable PT006 rule to airflow-core tests (models) (#57951)

Signed-off-by: Xch1 <qchwan@gmail.com>
Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Enable PT006 rule to google Provider test (triggers) (#57953)

Signed-off-by: rich7420 <rc910420@gmail.com>
Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Enable PT006 rule to slack Provider test (#57963)

Signed-off-by: Your Name <yuchenlai87@gmail.com>
Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Enable PT006 rule to 19 files in providers (airbyte, alibaba, atlassian, papermill, presto, redis, singularity, sqlite, tableau, vertica, weaviate, elasticsearch, exasol) (#57986)

Signed-off-by: Anusha Kovi <parvathi.kovi@gmail.com>
Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Enable PT006 rule to 19 files in providers (cncf,common) (#57995)

Signed-off-by: Anusha Kovi <parvathi.kovi@gmail.com>
Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Enable PT006 rule to 13 files in providers (apache) (#57998)

Signed-off-by: Anusha Kovi <parvathi.kovi@gmail.com>
Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Enable PT006 rule to standard Provider test(ssensor, trigge, util) 9 files (#58022)

Signed-off-by: Your Name <yuchenlai87@gmail.com>
Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Add number of queries guard for ui next_run_assets (#58052)

* fix MyPy type errors in datamodels/hitl.py (#57808)

* Remove global from serialization (#57703)

* Remove global from serialization

* Fix connection test and fernet instability

* Enable PT006 rule to airflow-core tests (route/public) (#58011)

Signed-off-by: Xch1 <qchwan@gmail.com>
Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Fix MyPy type errors in api_fastapi(security.py),airflow/models(dag_version.py,hitl.py),mark_tasks.py (#58054)

* Fix duplicated SQLAlchemy sessions caused transactions fail to close (#57815)

* feat: add resize function to dag run / TI notes (#57897)

* feat: add resize funtion to notes

* refactor: deduplicate markdown dialog storage key constant

* Fix broken canary, remove unneeded crypto key generation (#58074)

* Remove global from kerberos (#57702)

* Remove global from kerberos

* Review feedback to adjust pytest using a fixture

* Apply suggestion from @potiuk

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

---------

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

* Add test setup and example asset operation tests to task SDK integration tests (#58027)

* Add number of queries guard for ui structure (#58051)

* Expanding task sdk integration tests to test asset operations (#58028)

* update CODEOWNERS (#58075)

* Fix reproducibility check source tarball instructions (#58077)

* Remove global from settings part1 (#57705)

* add doc line for hot reloading ui in certain wsl environments (#57921)

* docs: add doc for hot reloading in certain wsl environments

* typo

* Update contributing-docs/15_node_environment_setup.rst

---------

Co-authored-by: Elad Kalif <45845474+eladkal@users.noreply.github.com>

* Add learnings from Airflow 3 migration (#57989)

* Remove unused NullFernet from Crypto (#57988)

* Fix release cleanup for providers (#58082)

* Fix release cleanup for providers

* Apply suggestion from @potiuk

* Fix ts-compile-lint-ui hook not finding any UI files (#58099)

* Update providers metadata 2025-11-08 (#58084)

* The e2e-tests workflows properly use workflow-name to pass name (#58100)

The workflows used `inputs.name` but the passed input was really
the `workflow-name` one.

* Revert "Fix duplicated SQLAlchemy sessions caused transactions fail to close (#57815)" (#58097)

This reverts commit e5cb168fafe40059233ed9ab5fa191f1958a89fd.

* Revert "Remove unused NullFernet from Crypto (#57988)" (#58107)

This reverts commit c47c0817d8e11f885f4eef91232c08e1469e8c95.

* Upgrade hungarian language package (#58104)

* Upgrade hungarian language package

* fix linting

* fix linting

* Add `executor.running_dags` gauge to expose count of running DAGs (#12368) (#52815)

* feature: introducing a counter for number of DAGs in running state

* wrap emit executor.running_dags gague as a function

* add test for _emit_running_dags_metric

* add executor.running_dags to metrics.rst

* use Sqlalchemy 2.0 style

* check for metrics configuration before emitting running dags metric

* Enable metrics configuration for running dags in DagFileProcessorManager test

* Add configuration for multi-team support in test_bundles_with_team

* add go-sdk/bin/.gitignore back

* Update .gitignore to include all files except itself

* Refactor running DAGs metric emission: move to SchedulerJobRunner and update tests

* Add running DAGs metric and remove unused metrics check

* Add dagrun_metrics_interval to config and update running DAGs metric to use 'scheduler' namespace

* Remove unused import of DagRunState in test_emit_running_dags_metric

* Fix Low dep tests:core

* Rename running DAGs metric to 'scheduler.dagruns.running' for consistency and update related test assertions

* Components of providers docs update (#57657)

* components of providers docs update

* comes installed

* static check reproducible

* added hooks, triggers and etc cmt

* rebase regen files

* reproducible static check

* AIP-67 - Multi-team: Per team executor config (#57910)

This adds support for reading team specific config sections from the
config file. This allows multiple teams to configure separate instances
of the same type of executor.

* Enable ruff PLW2101,PLW2901,PLW3301 rule (#57700)

* Enable ruff PLW2901 rule

* Fix follow-up mypy complaints after PLW2901 rule

* Fix tests for pools and infinite size

* Fix logic in bigquery

* Fix variable renaming

* Fix mypy alert

* Review feedback by Wei

* Fix mypy

* Revert accidentially deleted line

* Second pass review suggestions by Wei

* Add registry.secretNames and registry.connections options to Helm chart (#58094)

Co-authored-by: Your Name <you@example.com>

* Fix Python 3.13 RuntimeWarning in test_reading_from_pipes (#58132)

* fix: Rendered Templates not showing dictionary items in AF3 (#58071)

* Rendered Templates not showing dictionary items in AF3

* add a unit test

* fix test error

* Airflow documentation updates for Windows WSL2 installation (#57027)

* Update start.rst for Windows WSL2 installation

Airflow Installation documentation updates for Windows using WSL2

* Update start.rst

Fixed typo in WSL

* Update start.rst with formatting changes

Formatting changes for Airflows Windows WSL2 installation

* Update start.rst to add line after ..code-block:: bash

Update start.rst to add line after ..code-block:: bash

* Fix trailing whitespace in start.rst

* Update airflow-core/docs/start.rst

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

* Update airflow-core/docs/start.rst

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

* Update airflow-core/docs/start.rst

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

* Fix trailing whitespace, reshuffling content, adding uv in start.rst

* Incorporating review comments for performance benefits of uv over pip in start.rst

* Fix RST syntax errors: add :: to code-block and fix path separators

* Fix typos in link

---------

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

* fix: HITL params not validating (#57547)

* RFC: Close portuguese gap airflow 3.1 (#58119)

* close portuguese gap airflow 3.1

* fix lint

* close catalan gap (#58110)

Co-authored-by: Bugra Ozturk <bugraoz93@users.noreply.github.com>

* Add CLI hot-reload support via --dev flag (#57741)

* Add watchfiles dependency and hot-reload utility with --dev flag support

Co-authored-by: jason810496 <68415893+jason810496@users.noreply.github.com>

* Add tests for --dev flag and hot-reload functionality

Co-authored-by: jason810496 <68415893+jason810496@users.noreply.github.com>

* Fix watchfiles API usage with proper DefaultFilter

Co-authored-by: jason810496 <68415893+jason810496@users.noreply.github.com>

* Address code review feedback: fix help text, API usage, and improve error messages

Co-authored-by: jason810496 <68415893+jason810496@users.noreply.github.com>

* Final code review fixes: improve logging and test clarity

Co-authored-by: jason810496 <68415893+jason810496@users.noreply.github.com>

* Refactor hot_reload utils

* Refactor hot-reload: move to cli module, remove pyproject change, add dag-processor support

Co-authored-by: jason810496 <68415893+jason810496@users.noreply.github.com>

* Fix serve-log teardown issue using psutil to terminate process tree

Co-authored-by: jason810496 <68415893+jason810496@users.noreply.github.com>

* Refactor hot_reload: extract _terminate_process_tree helper function

Co-authored-by: jason810496 <68415893+jason810496@users.noreply.github.com>

* Add type annotations and process_name parameter to hot_reload

Co-authored-by: jason810496 <68415893+jason810496@users.noreply.github.com>

* Refactor final nits

- remove logger in triggerer command
- ensure type annotation in hot-reload module
- fix test hot-reload

* Fix mypy error

* Respect DEV_MODE env var

* Fix nits

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

* Fix Connection test failures due to Fernet key caching (#58137)

* Convert all airflow distributions to be compliant with ASF requirements (#58138)

According to https://www.apache.org/legal/src-headers.html#faq-binaries
all our released source packages and binaries should have both LICENCE
and NOTICE files - even if we do not have any 3rd-party software embedded.

This PR updates it accross the board and makes sure that all our
distributions contain both LICENCE and NOTICE file and that they
are added as "licence" information to all our distribution packages
when they are built.

This PR also modernizes all our pyproject.toml files with regards
to latest metadata for licenses:

* license-file is an array of glob patterns
* license is s license expression
* the deprecated Trove Classifier is removed

Inspired by #58131

* fix mypy errors in delete_dag.py (#58101)

* close spanish gap airflow 3.1 (#58117)

* close spanish gap airflow 3.1

* fix lint

* Update Release instruction to include Task SDK version update (#58134)

* Update Release instruction to include Task SDK version update

This PR updates the release branch to include task-sdk version update
when doing a new release. Also updates how we sync test branch for a
new release

* fixup! Update Release instruction to include Task SDK version update

* Update dev/README_RELEASE_AIRFLOW.md

* Updates the go-sdk/Justfile for the changed package layout (#58153)

* Remove deprecation warning in common test utils (#58152)

* Remove pytest deprecation warning in common test utils

> pytest.PytestRemovedIn9Warning: Marks applied to fixtures have no effect

* Remove mark-on-fixture in AWS test too

Every use of that fixture already had this mark, so we remove it

* fix mypy errors in scheduler_job_runner.py (#58167)

* CI: Upgrade important CI environment (#58164)

* Patch pools should have an optional description (#58066)

* Update UI to allow creation of DagRuns with partition key (#58004)

Allow triggering dag runs for a specific partition key.  When there's a partition key associated with a dag run, show it in the UI.

* Bump boto3 from 1.40.68 to 1.40.69 in /dev/breeze (#58160)

Bumps [boto3](https://github.com/boto/boto3) from 1.40.68 to 1.40.69.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.40.68...1.40.69)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.40.69
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Remove unnecessary list (#58141)

* RFC: Close italian gap airflow 3.1 (#58120)

* close italian gap airflow 3.1

* fix lint

* Indent todo comment for IDE highlighting compatibility (#58174)

* Fix CI upgrade script to not delete branch from origin remote (#58163)

* Upgrade email notifications to use SmtpNotifier (#57354)

* Group upgrades of python dependencies (#58162)

Rather than having multiple PRs - separately for each dependency
upgrade, we should group the dependency upgrades accross several
distributions into single PRs as much as possible.

* Fix Enum-str interpolation in callback metrics in Python 3.11+ (#58168)

Followup to https://github.com/apache/airflow/pull/57215#pullrequestreview-3426156849

Even though CallbackState is a string Enum and works fine with string
comparisons, the default __str__ method was changed in Python 3.11
causing test failures due to unexpected metric name:

airflow-core/tests/unit/models/test_callback.py:105: in test_get_metric_info
    assert metric_info["stat"] == "deadline_alerts.callback_success"
E   AssertionError: assert equals failed
E     'deadline_alerts.callback_CallbackState.SUCCESS'  'deadline_alerts.callback_success'

This overrides __str__ in CallbackState so it behaves consistently
across python versions.

* fix(migration): disable sqlite fkeys (#58130)

* fix(migration): ignore sqlite fk constraint

* fixup! fix(migration): ignore sqlite fk constraint

* fixup! fixup! fix(migration): ignore sqlite fk constraint

* fixup! fixup! fixup! fix(migration): ignore sqlite fk constraint

* Fix location of comment in dags_needing_dagruns (#58173)

The comment applies only when we hit AttributeError, so moving it there makes sense.

(cherry picked from commit 2a2c1b1c8517bed956e9b93c34ee3338b2449a5c)

* Create additional users in breeze for testing (#58126)

* feat: added --create-all-roles flag to breeze. creates test users with each role by default for SimpleAuthManager

* update command config

* ci: ran prek --all-files

* remove dev modecreate roles error

* remove --dev-mode requirement for breeze start-airflow --create-all-roles

* docs: remove documentation

* Add HTTP URL authentication support to GitHook (#58194)

GitHook now supports authentication tokens with HTTP URLs, matching
the existing HTTPS support. This enables authentication with internal
git repositories that use HTTP instead of HTTPS.

HTTP URLs without authentication tokens are preserved as-is.

* Add push_logs configuration option to Edge executor (#58125)

* Add push_logs configuration option to Edge executor

  Adds a new boolean configuration option AIRFLOW__EDGE__PUSH_LOGS
  to control whether edge workers push log files to the central site.
  The option is set to True by default to maintain existing behavior.

  When disabled, edge workers will keep logs locally without uploading
  them to the central Airflow site, which can be useful for:
  - Reducing network bandwidth usage
  - Keeping logs on edge sites for compliance/security reasons
  - Troubleshooting network connectivity issues

* Add version_added: 1.5.0 to push_logs configuration option

* Update release instructions for Airflow Ctl (#58206)

* Rename task sdk integration tests folder hierarchy correctly (#58193)

* Fix the `__init__.py` for tests (#58211)

The `__init__.py` for tests should have the legacy namespaces
defined in order for IDE imports to work properly. This works also
in IDEs where `tests` folders are added the path of ours (this
is done via `setup_idea.py` and `setup_vscode.py`).

There was a bug in our prek hook wher it did not have "expected"
and "namespace" __init__.py for those known test folders.

This PR fixes the prek hook and some of the recently added
folders that had wrong __init__.py added.

* Make sure regenerating provider dependencies happens only once (#58198)

This has to be done in global_constants module, because regeneration
can happen just during importing and if we try to do it in a separate
package circular dependencies might happen.

* Fix check_files.py script after source tar was renamed (#58216)

* Re-Enable Back-Compat tests for Edge3 (#58217)

* Add flatten_structure parameter to GCSToS3Operator (#56134) (#57713)

* Add flatten_structure parameter to GCSToS3Operator

* Enhance GCSToS3Operator docs clarity and refactor tests to use pytest.mark.parametrize for better maintainability

* Improve GCSToS3Operator documentation consistency and add concrete examples

  - Use consistent "takes precedence over" terminology in warning messages
  - Add specific file path transformation example in class docstring

* Fix GCSToS3Operator test log mocking for Airflow SDK compatibility

  - Replace mock.patch.object() with mock.patch() string path to handle
  - read-only log property in new Airflow SDK.

* Add stream method to RemoteIO (#54813)

* Add stream method to RemoteIO

* Import BaseOperator from version_compact

* Skip Airflow 2 compact test for RemoteIO

* Add a new Protocal for .stream method, check attr in runtime

* Remove NotImplementedError

* Clearify naming for log response types

* Fix comment for LogMessages

* Try to make mypy happy

* Remove redundant tests

* Check hasattr before getattr

* Fix nits for using getattr

* i18n(Ko): add missing translations(Nov 12) (#58222)

* Improve is_container annotation (#58224)

Using TypeGuard lets the function perform type-narrowing for us, so
usages after it would not need a custom cast. The downside is we now
need to specify a bound, but we don't actually use this function that
often anyway and can just list all the possibilities.

* Fix MSSQLToGCSOperator MSSQL BIT data type conversion to Parquet boolean (#57514)

* Fix MSSQLToGCSOperator MSSQL BIT data type conversion to Parquet boolean

Changes type_map from "BOOLEAN" to "BOOL" to match the expected
schema type in BaseSQLToGCSOperator._convert_parquet_schema().

This fixes issue #57461 where exporting MSSQL bit fields to Parquet
format would raise ArrowTypeError: Expected bytes, got a 'bool' object.

* Add a test case to verify that MSSQL BIT fields are mapped to boolean in the parquet schema

* Fix duplicated SQLAlchemy sessions caused transactions fail to close (#58196)

* Make `conf.validate` pluggable on config parser (#58188)

* Rewrite config parser get() with modular lookup sequence (#57970)

* Update pyproject.toml files with pytest>=9.0.0 TOML syntax (#58182)

* Enable PT006 rule to task-sdk tests (#57842)

* modify test_asset_decorators

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: Xch1 <qchwan@gmail.com>

* modify test_asset

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: Xch1 <qchwan@gmail.com>

* modify _internal/test_templater

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: Xch1 <qchwan@gmail.com>

* modify _internal/test_decorators

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: Xch1 <qchwan@gmail.com>

* modify test_sensor

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: Xch1 <qchwan@gmail.com>

* modify test_operator

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: Xch1 <qchwan@gmail.com>

* modify test_client

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: Xch1 <qchwan@gmail.com>

---------

Signed-off-by: Xch1 <qchwan@gmail.com>
Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Skip the team config test until new modular config supports it (#58233)

* Fix a few typos in release process for Airflow (#58219)

* Enable pt006 rule and fix new generate errors (#58238)

* modify remaining new generated PT006 errors

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: Xch1 <qchwan@gmail.com>

* delete PT006 ignore list

Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Signed-off-by: Xch1 <qchwan@gmail.com>

---------

Signed-off-by: Xch1 <qchwan@gmail.com>
Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Delete all unnecessary LICENSE Files (#58191)

When rebasing/working on #58138 I **thought** I deleted those
deeply nested LICENSE files in our providers that were installed
together with other files when packages were installed. But since
the files are now embedded as metadata in the packages and this is
the only requirement from the ASF point of view, we can safely
delete them now.

This is continuation of #58138

* Fix generated Go header in code (#58243)

* CI: Upgrade important CI environment (#58245)

* Add protoc pinning and include it in important versions upgrade (#58244)

* fix mypy errors in airflow-core/src/airflow/jobs/job.py (#58190)

* Add check for schedule parameter for system tests (#58254)

* Support for "reconnecting" Supervisor Comms from task process when `dag.test()` is used (#58147)

This is a follow up to #57212, which worked fine "at run time" but did not
work in many of our own unit tests, which rely on `dag.test` or `ti.run`.

The way this is implemented is that when we use the InProcessTestSupervisor we
pre-emptively create a socket pair. We have to create it even it its not being
used, as we can't know.

And since this is all in one process we create a thread to handle the socket
comms. Since this is only ever for tests performance or hitting the GIL
doesn't matter.

* providers/trino: set split_statements=True by default and add unit tests (#58158)

* providers/trino: set split_statements=True by default in TrinoHook.run()

* providers/trino: add unit tests for TrinoHook.run()

* providers/trino: fixed patches in split_statement tests

* providers/trino fix documentation

* providers/trino: Apply ruff auto-format fixes in TrinoHook

* providers/trino: Apply ruff-format fixes in TrinoHook

* providers/trino: re-run after rebase on upstream/main

---------

Co-authored-by: Nikita <kr3m0g3n@gmail.com>
Co-authored-by: Nikita.Kalganov <Nikita.Kalganov@x5.ru>

* Fix `KubernetesPodOperator` fails to delete pods with None value labels (#53477)

* Add a `schedule` parameter to the Asana example dag (#58267)

* fix: add required arguments when creating an external table (#58199)

* Fix main failing on cross-merged PR (#58270)

* Exclude sagemaker for Python 3.13 due to pydanamodb pinning old sqlean (#58262)

* Fix test_async_write_logs_should_execute_successfully test

- Add client mock patch to properly mock self.client.read_namespaced_pod_log
- Fix assertions to verify actual log output using caplog
- Fix get_logs=False assertion to check client.read_namespaced_pod_log instead of pod_manager.read_pod_logs
- Add await_pod_completion mock return value

Fixes #57515

* issue-58236: Adding gcp_conn_id to template_fields for BigQuery and Dataproc Operators (#58250)

* Make it easier and faster to iterate on task-sdk-integration-tests (#58231)

There were a few of things that made task-sdk-tests iteration
a bit unobvious and slower. With this PR, we should be able
to iterate over task-sdk-integration-tests WAY faster and get
more contributors involved in contributing to those.

* It was not clear that prerequisite of running the tests was building
  PROD image for Pyton 3.10. This is now clear in the documentation.

* PROD images can be built in two different modes - from sources
  with --installation-method equal to . or from packages with
  the --installatio-method equal to "apache-airflow". This was
  not clearly communicated during build and it is now printed at
  output

* It was not clear that when you build PROD images from sources,
  you should first compile ui assets, because otehrwise the
  assets are not added as part of the image. With this PR the
  `breeze prod-image build` command checks if the .vite manifest
  is present in the right `dist` folders and will error out,
  suggesting to run `breeze compile-ui-assets` before.

* If the PROD image has not been built before, breeze will propose
  to build it and even do it automatically if the answer is not
  provided within 20 seconds.

* when building PROD images from sources, it is faster to rebuild
  the images with `uv` than with `pip`. the --use-uv parameter now
  defaults to False when building from packages and to True when
  building from sources.

* There was an error in .dockerignore where generated dist files
  were not added to context when PROD image was built from sources.
  This resulted in "permission denied' when such PROD images were used
  to run tests.

* The test compose had fallback of Airflow 3.0.3 which would be
  misleading if it happened. Now, AIRFLOW_IMAGE_NAME is mandatory

* We are now mounting sources of Airflow to inside the image by default
  and skip it in CI. This mounting happens in local environment where PROD
  image is built usually from sources, and it is disabled in CI by using
  --skip-mounting-local-volumes flag. We also do not stop docker compose
  by default when runnig it locally in order to make fast iteration the
  default.

* We pass host operating system when starting the compose, and we only
  change ownership on Linux - this is a long running operation on MacOS
  because mounted filesystem is slow, but it's also not needed on MacOS
  because the file system also maps ownershipt and files created by
  Airflow are created with local user id.

* We pass local user id to containers to make sure that the files
  created on linux are created by the local user (logs and the like).

* We are now detecting whether docker-compose is running and when we run
  with locally mounted sources, we reuse those running containers. When
  we don't mount local sources, we shut-down the compose before running
  to make sure we do not have sources mounted - and we close the compose
  by default when we do not mount local sources.

* When sources are mounted we are only enabling DEV_MODE inside the containers
  so that components are hot-reloading (new feature added in #57741
  last weeks. This way you do not have to restart anything when sources
  are changed and you can re-run the tests when docker compose is running.

* The environment are passsed now via .env file so that you can easily
  reproduce docke compose command locally

* The docker compose files are not copied any more, they are moved directly
  to the top of 'task-sdk-integraiton-tests' and used from there.

* A `--down` flag is added to breeze testing task-sdk-integration-tests
  that tears down running docker compose.

* Additional diagnostics added to show what's going on.

* Handling verbose option from breeze by adding more debugging information

* Updated documentation about the tests to be more comprehensive about
  the options, updated file structure etc.

* Small QOL immprovement - if expected dags are not yet parsed by dag file
  processor, when test starts, getting their status will return 404 "Not
  Found". In such case our tests implemented a short retry scheme with tenacity

* Add working_directory parameter (#58210)

* Add working_directory parameter

* fix test

* restore import Connection

* ignore type check

* Fix atomicity issue in SerializedDagModel.write_dag preventing orphaned DagVersions (#58259)

* KubernetesExecutor: retry pod creation on Kubernetes API 500 errors (#57054)

Treat 500 InternalServerError responses from the Kubernetes API as transient when creating
worker pods and requeue the task according to `task_publish_max_retries` (or indefinitely when -1).
This avoids failing tasks due to transient kube-apiserver errors and logs retry attempts with details.

* Fix walking through wildcarded directory in FileTrigger (#57155)

Fix is similar to the one in #21729

* Identify duplicate kubernetes section airflow configuration and mark them as deprecated (#57028)

* Bump the edge-ui-package-updates group across 1 directory with 19 updates (#58235)

* Bump the edge-ui-package-updates group across 1 directory with 19 updates

Bumps the edge-ui-package-updates group with 19 updates in the /providers/edge3/src/airflow/providers/edge3/plugins/www directory:

| Package | From | To |
| --- | --- | --- |
| [@chakra-ui/react](https://github.com/chakra-ui/chakra-ui/tree/HEAD/packages/react) | `3.28.0` | `3.29.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.90.5` | `5.90.8` |
| [axios](https://github.com/axios/axios) | `1.12.2` | `1.13.2` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.9.4` | `7.9.5` |
| [@eslint/compat](https://github.com/eslint/rewrite/tree/HEAD/packages/compat) | `1.4.0` | `1.4.1` |
| [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.38.0` | `9.39.1` |
| [@trivago/prettier-plugin-sort-imports](https://github.com/trivago/prettier-plugin-sort-imports) | `5.2.2` | `6.0.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.9.1` | `24.10.1` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.2` | `19.2.4` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.2` | `19.2.3` |
| [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react-swc) | `4.2.0` | `4.2.2` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.0.3` | `4.0.8` |
| [eslint](https://github.com/eslint/eslint) | `9.38.0` | `9.39.1` |
| [globals](https://github.com/sindresorhus/globals) | `16.4.0` | `16.5.0` |
| [happy-dom](https://github.com/capricorn86/happy-dom) | `20.0.8` | `20.0.10` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.8.3` | `5.9.3` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.46.2` | `8.46.4` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.1.12` | `7.2.2` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.3` | `4.0.8` |



Updates `@chakra-ui/react` from 3.28.0 to 3.29.0
- [Release notes](https://github.com/chakra-ui/chakra-ui/releases)
- [Changelog](https://github.com/chakra-ui/chakra-ui/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/chakra-ui/chakra-ui/commits/@chakra-ui/react@3.29.0/packages/react)

Updates `@tanstack/react-query` from 5.90.5 to 5.90.8
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.90.8/packages/react-query)

Updates `axios` from 1.12.2 to 1.13.2
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.12.2...v1.13.2)

Updates `react-router-dom` from 7.9.4 to 7.9.5
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.9.5/packages/react-router-dom)

Updates `@eslint/compat` from 1.4.0 to 1.4.1
- [Release notes](https://github.com/eslint/rewrite/releases)
- [Changelog](https://github.com/eslint/rewrite/blob/main/packages/compat/CHANGELOG.md)
- [Commits](https://github.com/eslint/rewrite/commits/compat-v1.4.1/packages/compat)

Updates `@eslint/js` from 9.38.0 to 9.39.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/commits/v9.39.1/packages/js)

Updates `@trivago/prettier-plugin-sort-imports` from 5.2.2 to 6.0.0
- [Release notes](https://github.com/trivago/prettier-plugin-sort-imports/releases)
- [Changelog](https://github.com/trivago/prettier-plugin-sort-imports/blob/main/CHANGELOG.md)
- [Commits](https://github.com/trivago/prettier-plugin-sort-imports/compare/v5.2.2...v6.0.0)

Updates `@types/node` from 24.9.1 to 24.10.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react` from 19.2.2 to 19.2.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 19.2.2 to 19.2.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@vitejs/plugin-react-swc` from 4.2.0 to 4.2.2
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react-swc@4.2.2/packages/plugin-react-swc)

Updates `@vitest/coverage-v8` from 4.0.3 to 4.0.8
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.8/packages/coverage-v8)

Updates `eslint` from 9.38.0 to 9.39.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v9.38.0...v9.39.1)

Updates `globals` from 16.4.0 to 16.5.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v16.4.0...v16.5.0)

Updates `happy-dom` from 20.0.8 to 20.0.10
- [Release notes](https://github.com/capricorn86/happy-dom/releases)
- [Commits](https://github.com/capricorn86/happy-dom/compare/v20.0.8...v20.0.10)

Updates `typescript` from 5.8.3 to 5.9.3
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Changelog](https://github.com/microsoft/TypeScript/blob/main/azure-pipelines.release-publish.yml)
- [Commits](https://github.com/microsoft/TypeScript/compare/v5.8.3...v5.9.3)

Updates `typescript-eslint` from 8.46.2 to 8.46.4
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.46.4/packages/typescript-eslint)

Updates `vite` from 7.1.12 to 7.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.2.2/packages/vite)

Updates `vitest` from 4.0.3 to 4.0.8
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.8/packages/vitest)

---
updated-dependencies:
- dependency-name: "@chakra-ui/react"
  dependency-version: 3.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: edge-ui-package-updates
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.90.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: edge-ui-package-updates
- dependency-name: axios
  dependency-version: 1.13.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: edge-ui-package-updates
- dependency-name: react-router-dom
  dependency-version: 7.9.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: edge-ui-package-updates
- dependency-name: "@eslint/compat"
  dependency-version: 1.4.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: edge-ui-package-updates
- dependency-name: "@eslint/js"
  dependency-version: 9.39.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: edge-ui-package-updates
- dependency-name: "@trivago/prettier-plugin-sort-imports"
  dependency-version: 6.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: edge-ui-package-updates
- dependency-name: "@types/node"
  dependency-version: 24.10.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: edge-ui-package-updates
- dependency-name: "@types/react"
  dependency-version: 19.2.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: edge-ui-package-updates
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: edge-ui-package-updates
- dependency-name: "@vitejs/plugin-react-swc"
  dependency-version: 4.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: edge-ui-package-updates
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.0.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: edge-ui-package-updates
- dependency-name: eslint
  dependency-version: 9.39.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: edge-ui-package-updates
- dependency-name: globals
  dependency-version: 16.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: edge-ui-package-updates
- dependency-name: happy-dom
  dependency-version: 20.0.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: edge-ui-package-updates
- dependency-name: typescript
  dependency-version: 5.9.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: edge-ui-package-updates
- dependency-name: typescript-eslint
  dependency-version: 8.46.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: edge-ui-package-updates
- dependency-name: vite
  dependency-version: 7.2.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: edge-ui-package-updates
- dependency-name: vitest
  dependency-version: 4.0.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: edge-ui-package-updates
...

Signed-off-by: dependabot[bot] <support@github.com>

* Downgrade typescript which can not be upgraded

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jens Scheffler <j_scheffler@gmx.de>

* feat: async apprise notifier (#57541)

* Mask kwargs on illegal args (#58252)

* Remove @pytest.mark.xfail and fix incorrect assertion

- Remove @pytest.mark.xfail decorator as the test is now fixed
- Remove incorrect assertion checking mock_manager.read_pod_logs which
  is never called by _write_logs() (it calls client.read_namespaced_pod_log
  directly instead)

Both parameterized test cases now pass:
- test_async_write_logs_should_execute_successfully[True] ✅
- test_async_write_logs_should_execute_successfully[False] ✅

Addresses reviewer feedback to remove xfail flag as proof the test works.

* Add poll_interval attribute to HttpEventTrigger (#57583)

* Add poll_interval attribute to HttpEventTrigger

* Add info on poll_interval to HttpEventTrigger docs

* Add info on poll_interval to HttpEventTrigger docs

* Add poll_interval attribute to tests

* Update providers/http/docs/triggers.rst

Co-authored-by: Ryan Hatter <25823361+RNHTTR@users.noreply.github.com>

---------

Co-authored-by: Ryan Hatter <25823361+RNHTTR@users.noreply.github.com>

* Add missing test for amazon/aws/executors/ecs/test_utils.py (#58139)

* Create test_utils.py

* remove

* Update test_utils.py

* Update test_utils.py

---------

Co-authored-by: zk-zou <zk.zou@samsung.net>

* Apply ruff formatting fixes

- Remove unused imports: BytesIO and HTTPResponse
- Format function parameters on multiple lines for better readability

* Add Kerberos dependency to hive provider (#55773)

* CI: Upgrade ruff version in CI environment (#58287)

* Update documentation for providers 14 Nov 2025 (#58284)

* HookLevelLineage can now add arbitrary data with add_extra (#57620)

It's useful, but it's missing an option to attach non-asset related metadata collected from hooks
(f.e. query_id, or query_text), that can be also useful in context of lineage and desired by hook
lineage readers. For example, having the executed SQL query enables SQL parsing on the reader
side, retrieving input and output datasets, which can significantly improve lineage extraction
accuracy.

* Bump min version of openlineage libraries to 1.40.0 to fix compat issues (#58302)

* Add logging to test_example_dag_hashes_are_always_consistent (#58264)

Add logging to test_example_dag_hashes_are_always_consistent

* Allow virtualenv code to access connections/variables and send logs (#58148)

(This is the second attempt at this PR)

This change is quite simple, as it simply calls the function added in #57212
and #58147 if it's available. Up until the point that it is released this code
will not hit the getattr will return None and be a no-op.

I didn't use the walrus operator here as theoretically someone could be using
this to run in a Python that doesn't support it.

Fixes #51422, fixes #54706.

This doesn't have any unit tests, as a) it's relatively simple, and b) due to
how we run in the same process in the tests, there is no socket to reconnect
to, so we can't actually exercise this code

* Drop version handling during config write as its not a practical case (#58269)

* Making `conf.as_dict` extendable by plugging in config sources (#58268)

* Delete dag_doc.md from the git tree which is a wrongly committed file (#58309)

* Remove SDK reference for NOTSET in Airflow Core (#58258)

* Display static asset metadata (extra) in Asset details page (#57710)

* Display static asset metadata (extra) in Asset details page

* Add i18n translation for static Asset Metadata and minor UI cleanup

* Add i18n translation key 'ststic_asset_metadata' to all locale asset.jason files

* Rename Static Asset Metadata to Additional Data

* Properly highlight TaskGroup nodes when selected (#58118)

* Fix link on installing-from-sources page (#58323)

* fix static checks in main (#58325)

* Fix AwaitMessageSensor to accept timeout and soft_fail parameters (#57863) (#58070)

- Changed AwaitMessageSensor and AwaitMessageTriggerFunctionSensor to inherit from BaseSensorOperator instead of BaseOperator
- This enables both sensors to accept standard sensor parameters like timeout and soft_fail
- Added comprehensive test coverage for timeout and soft_fail parameters
- Updated documentation to reflect the new parameters

Fixes #57863

* Fix: TriggerDagRunOperator stuck in deferred state with reset_dag_run (#57756) (#57968)

When TriggerDagRunOperator is used with deferrable=True, wait_for_completion=True,
  reset_dag_run=True, and a fixed trigger_run_id, the operator becomes permanently
  stuck in deferred state after clearing and re-running.

  Root cause:
  When reset_dag_run=True is used with a fixed run_id, the database preserves the
  original logical_date from the first run. However, on subsequent runs after clearing,
  the operator calculates a NEW logical_date based on the current time. The DagStateTrigger
  was being created with this newly calculated logical_date, causing a mismatch when
  querying the database - the trigger looked for a DAG run with the new logical_date
  but the database contained the original logical_date, causing the query to return
  zero results indefinitely.

  Solution:
  - Modified _handle_trigger_dag_run() in task_runner.py to pass execution_dates=None
    to DagStateTrigger when run_ids is provided, since run_id alone is sufficient and
    globally unique
  - Added test test_handle_trigger_dag_run_deferred_with_reset_uses_run_id_only to
    verify the fix and prevent regression

  The fix ensures that both deferrable and non-deferrable modes use identical logic
  for determining DAG run completion - querying by run_id and state only, without
  filtering by logical_date which can become stale when resets are involved.

* Updates to release process of providers (#58316)

* Updates to release process of providers

There are several updates to the release process in preparation for
rotational release management process:

* documentation has been simplified and unnecessary steps and digressions
  are move out of the way
* some commands had been simplified, optional steps have been moved
  at the end of the doc
* commented out PRs in release notes are automatically removed
  from the Issue created for users
* better guideliens on how to iterate with the issue by removing
  unneeded PRs
* gh issue create used instead of manually hand-crafting the URL
  is used to trigger issue creation
* github token retrieval is simplified for prepare-issues command
* stale ".. Please review " comments were removed from the changelogs
* We are using now ${RELEASE_DATE} subfolder in SVN to store the providers -
  this will allow several parallel releases to be run.

* Update providers/amazon/docs/changelog.rst

Co-authored-by: Bugra Ozturk <bugraoz93@users.noreply.github.com>

---------

Co-authored-by: Bugra Ozturk <bugraoz93@users.noreply.github.com>

* Doc: update chart info about built-in secrets and environment variables (#58317)

* Fix group TI tab memory (#58288)

* fix: Prevent preserving tabs when navigating to Task Groups

* refactor: Centralize keyboard navigation logic to use

* test: update test,  Groups should not preserve tabs

* Breeze: Automatically set CHOKIDAR_USEPOLLING for WSL users in --dev-mode (#57846) (#58080)

* Docs: Add note for WSL users about CHOKIDAR_USEPOLLING for UI hot reloading (#57846)

* Breeze: Automatically set CHOKIDAR_USEPOLLING for WSL users in --dev-mode (#57846)

* Breeze: Automatically set CHOKIDAR_USEPOLLING for WSL users in --dev-mode (#57846)

* Update dev/breeze/src/airflow_breeze/commands/developer_commands.py

Co-authored-by: LIU ZHE YOU <68415893+jason810496@users.noreply.github.com>

---------

Co-authored-by: LIU ZHE YOU <68415893+jason810496@users.noreply.github.com>

* Update main as 3.1.3 has been released (#58341)

* Add JSON serialization for kubeconfig in AsyncKubernetesHook (#57169)

* Add JSON serialization for kubeconfig in AsyncKubernetesHook

* Add debug logging for kubeconfig serialization in AsyncKubernetesHook

* Ran perk

---------

Co-authored-by: Kalyan R <kalyan.ben10@live.com>

* Chart: Default airflow version to 3.1.3 (#58343)

* Simolify and modernize provider documentation preparation instructions (#58306)

The instructions were partially outdated and quite a bit too chatty, they
did not focus on actual tasks to do but also contained some digressions
and more detailed description of some provider principles.

This change makes it simpler to follow the process by the release manager,
moves the docuentation of details to PROVIDERS.rst and removes largely
duplicated PROVIDER_DISTRIBUTION_DETAILS.md

The "--incremental-update" flag is specifically added and mentioned
in the doc on what should be done when new commits are added after
initial release notes have been prepared, guiding the release
manager more explicitly what to do and providing instructions.

* Increase waiter delay for ecs run tasks in system tests (#58338)

The default is 6s which is quite aggressive and causes throttling issues
in the test harness. Tests don't need that kind of fidelity and can wait
much longer between attempts to fire the trigger.

---------

Signed-off-by: Xch1 <qchwan@gmail.com>
Signed-off-by: rich7420 <rc910420@gmail.com>
Signed-off-by: Anusha Kovi <parvathi.kovi@gmail.com>
Signed-off-by: Your Name <yuchenlai87@gmail.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Anusha Kovi <parvathi.kovi@gmail.com>
Co-authored-by: Kalyan R <kalyan.ben10@live.com>
Co-authored-by: Ephraim Anierobi <splendidzigy24@gmail.com>
Co-authored-by: Xch1 <qchwan@gmail.com>
Co-authored-by: Vincent <97131062+vincbeck@users.noreply.github.com>
Co-authored-by: David Blain <info@dabla.be>
Co-authored-by: Tzu-ping Chung <uranusjr@gmail.com>
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com>
Co-authored-by: Stefan Wang <1fannnw@gmail.com>
Co-authored-by: ChenChen Lai <72776271+0lai0@users.noreply.github.com>
Co-authored-by: Yun-Ting Chiu <chiuting6@gmail.com>
Co-authored-by: Sebastian Daum <daumse@mediamarktsaturn.com>
Co-authored-by: GUAN-HAO HUANG <101171023+rich7420@users.noreply.github.com>
Co-authored-by: Ankit Chaurasia <8670962+sunank200@users.noreply.github.com>
Co-authored-by: Kacper Muda <mudakacper@gmail.com>
Co-authored-by: Niko Oliveira <onikolas@amazon.com>
Co-authored-by: kyounghoonJang <matkimchi_@naver.com>
Co-authored-by: Henry Chen <108824346+henry3260@users.noreply.github.com>
Co-authored-by: Jens Scheffler <95105677+jscheffl@users.noreply.github.com>
Co-authored-by: Ash Berlin-Taylor <ash@apache.org>
Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
Co-authored-by: Daniel Standish <15932138+dstandish@users.noreply.github.com>
Co-authored-by: AutomationDev85 <96178949+AutomationDev85@users.noreply.github.com>
Co-authored-by: Wei Lee <weilee.rx@gmail.com>
Co-authored-by: Bugra Ozturk <bugraoz93@users.noreply.github.com>
Co-authored-by: LI,JHE-CHEN <103923510+RoyLee1224@users.noreply.github.com>
Co-authored-by: Yang Yule <yule.yang@samsung.com>
Co-authored-by: Gurram Sai Ganesh <saiganeshgurram66@gmail.com>
Co-authored-by: Shahar Epstein <60007259+shahar1@users.noreply.github.com>
Co-authored-by: Lê Nam Khánh <55955273+khanhkhanhlele@users.noreply.github.com>
Co-authored-by: Simon Meng <menghot@gmail.com>
Co-authored-by: Elad Kalif <45845474+eladkal@users.noreply.github.com>
Co-authored-by: Aaron Wolmutt <163314771+aaron-wolmutt@users.noreply.github.com>
Co-authored-by: Guan-Ming (Wesley) Chiu <105915352+guan404ming@users.noreply.github.com>
Co-authored-by: majorosdonat <donat.majoros@gmail.com>
Co-authored-by: Aaron Chen <nailo2c@gmail.com>
Co-authored-by: Steve Ahn <steveahnahn@g.ucla.edu>
Co-authored-by: Ramit Kataria <ramitkat@amazon.com>
Co-authored-by: Jorge Rocamora <33847633+aeroyorch@users.noreply.github.com>
Co-authored-by: Your Name <you@example.com>
Co-authored-by: Srabasti Banerjee <srabasti_b@ymail.com>
Co-authored-by: Aldo <aoelvp94@gmail.com>
Co-authored-by: ecodina <41503039+ecodina@users.noreply.github.com>
Co-authored-by: LIU ZHE YOU <68415893+jason810496@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Prafful Javare <javarep4199@gmail.com>
Co-authored-by: Aritra Basu <24430013+aritra24@users.noreply.github.com>
Co-authored-by: Shubham Raj <48172486+shubhamraj-git@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: ha2hi <56156892+ha2hi@users.noreply.github.com>
Co-authored-by: Dheeraj Turaga <dheerajturaga@gmail.com>
Co-authored-by: Hajun Yoo <58240677+HaJunYoo@users.noreply.github.com>
Co-authored-by: Yeonguk Choo <choo121600@gmail.com>
Co-authored-by: Juarez Rudsatz <juarezr@gmail.com>
Co-authored-by: VladaZakharova <uladaz@google.com>
Co-authored-by: Nikita Kalganov <43411544+kremogen@users.noreply.github.com>
Co-authored-by: Nikita <kr3m0g3n@gmail.com>
Co-authored-by: Nikita.Kalganov <Nikita.Kalganov@x5.ru>
Co-authored-by: Vasu Madaan <156197431+Vasu-Madaan@users.noreply.github.com>
Co-authored-by: Dev-iL <6509619+Dev-iL@users.noreply.github.com>
Co-authored-by: Nathan Hadfield <nathan.hadfield@king.com>
Co-authored-by: Jake Roach <116606359+jroachgolf84@users.noreply.github.com>
Co-authored-by: darkag <darkag@free.fr>
Co-authored-by: Arkadiusz Bach <55976380+arkadiuszbach@users.noreply.github.com>
Co-authored-by: Mikhail Ilchenko <mix.ilchenko@gmail.com>
Co-authored-by: Jens Scheffler <j_scheffler@gmx.de>
Co-authored-by: Karen Braganza <karenbraganza15@gmail.com>
Co-authored-by: Ryan Hatter <258…
Copilot AI pushed a commit to jason810496/airflow that referenced this pull request Dec 5, 2025
@amoghrajesh

Copy link
Copy Markdown
Contributor Author

cc: @atul-astronomer functional testing can be performed on this one by having a dag with email on failure (check PR desc)

potiuk added a commit to potiuk/airflow that referenced this pull request Jul 20, 2026
Since apache#57354, task email_on_failure / email_on_retry alerts were routed
unconditionally through SmtpNotifier, silently ignoring the
[email] email_backend configuration. Custom backends (SES, SendGrid,
org-internal) stopped delivering failure/retry emails even though the
deprecated email_on_* parameters still worked.

This restores the old behaviour using the existing [email] email_backend
option -- no new configuration is introduced:

- A non-default [email] email_backend is transparently wrapped in a new
  LegacyEmailBackendNotifier adapter in common.compat, so existing SES /
  SendGrid / custom backends keep delivering alerts unchanged. The backend
  is loaded lazily from config at notify time, so the Task SDK keeps no
  static dependency on airflow.utils.email.
- Otherwise the default SmtpNotifier is used, exactly as before.

Both failure-email entry points (the worker task-runner path and the
DAG-processor callback path) funnel through the same function, so the
selected backend is used consistently regardless of how the task failed.

The deprecated email_on_* parameters are not un-deprecated; this only keeps
their existing behaviour pluggable until removal in Airflow 4.
potiuk added a commit to potiuk/airflow that referenced this pull request Jul 20, 2026
Since apache#57354, task email_on_failure / email_on_retry alerts were routed
unconditionally through SmtpNotifier, silently ignoring the
[email] email_backend configuration. Custom backends (SES, SendGrid,
org-internal) stopped delivering failure/retry emails even though the
deprecated email_on_* parameters still worked.

This restores the old behaviour using the existing [email] email_backend
option -- no new configuration is introduced:

- A non-default [email] email_backend is transparently wrapped in a new
  LegacyEmailBackendNotifier adapter in common.compat, so existing SES /
  SendGrid / custom backends keep delivering alerts unchanged. The backend
  is loaded lazily from config at notify time, so the Task SDK keeps no
  static dependency on airflow.utils.email.
- Otherwise the default SmtpNotifier is used, exactly as before.

Both failure-email entry points (the worker task-runner path and the
DAG-processor callback path) funnel through the same function, so the
selected backend is used consistently regardless of how the task failed.

The deprecated email_on_* parameters are not un-deprecated; this only keeps
their existing behaviour pluggable until removal in Airflow 4.
potiuk added a commit to potiuk/airflow that referenced this pull request Jul 20, 2026
Since apache#57354, task email_on_failure / email_on_retry alerts were routed
unconditionally through SmtpNotifier, silently ignoring the
[email] email_backend configuration. Custom backends (SES, SendGrid,
org-internal) stopped delivering failure/retry emails even though the
deprecated email_on_* parameters still worked.

This restores the old behaviour using the existing [email] email_backend
option -- no new configuration is introduced:

- A non-default [email] email_backend is transparently wrapped in a new
  LegacyEmailBackendNotifier, so existing SES / SendGrid / custom backends
  keep delivering alerts unchanged. The backend is resolved from config at
  notify time, so the Task SDK keeps no static dependency on
  airflow.utils.email.
- Otherwise the default SmtpNotifier is used, exactly as before.

The notifier lives in the Task SDK (airflow.sdk.execution_time.email_backend)
next to its only caller, so no extra provider needs to be installed for a
custom email backend to keep working.

Both failure-email entry points (the worker task-runner path and the
DAG-processor callback path) funnel through the same function, so the
selected backend is used consistently regardless of how the task failed.

The deprecated email_on_* parameters are not un-deprecated; this only keeps
their existing behaviour pluggable until removal in Airflow 4.
potiuk added a commit to potiuk/airflow that referenced this pull request Jul 20, 2026
Since apache#57354, task email_on_failure / email_on_retry alerts were routed
unconditionally through SmtpNotifier, silently ignoring the
[email] email_backend configuration. Custom backends (SES, SendGrid,
org-internal) stopped delivering failure/retry emails even though the
deprecated email_on_* parameters still worked.

This restores the old behaviour using the existing [email] email_backend
option -- no new configuration is introduced:

- A non-default [email] email_backend is transparently wrapped in a new
  LegacyEmailBackendNotifier, so existing SES / SendGrid / custom backends
  keep delivering alerts unchanged. The backend is resolved from config at
  notify time, so the Task SDK keeps no static dependency on
  airflow.utils.email.
- Otherwise the default SmtpNotifier is used, exactly as before.

The notifier lives in the Task SDK (airflow.sdk.execution_time.email_backend)
next to its only caller, so no extra provider needs to be installed for a
custom email backend to keep working.

Both failure-email entry points (the worker task-runner path and the
DAG-processor callback path) funnel through the same function, so the
selected backend is used consistently regardless of how the task failed.

The deprecated email_on_* parameters are not un-deprecated; this only keeps
their existing behaviour pluggable until removal in Airflow 4.
potiuk added a commit to potiuk/airflow that referenced this pull request Jul 20, 2026
Since apache#57354, task email_on_failure / email_on_retry alerts were routed
unconditionally through SmtpNotifier, silently ignoring the
[email] email_backend configuration. Custom backends (SES, SendGrid,
org-internal) stopped delivering failure/retry emails even though the
deprecated email_on_* parameters still worked.

This restores the old behaviour using the existing [email] email_backend
option -- no new configuration is introduced:

- A non-default [email] email_backend is transparently wrapped in a new
  LegacyEmailBackendNotifier, so existing SES / SendGrid / custom backends
  keep delivering alerts unchanged. The backend is resolved from config at
  notify time, so the Task SDK keeps no static dependency on
  airflow.utils.email.
- Otherwise the default SmtpNotifier is used, exactly as before.

The notifier lives in the Task SDK (airflow.sdk.execution_time.email_backend)
next to its only caller, so no extra provider needs to be installed for a
custom email backend to keep working.

Both failure-email entry points (the worker task-runner path and the
DAG-processor callback path) funnel through the same function, so the
selected backend is used consistently regardless of how the task failed.

The deprecated email_on_* parameters are not un-deprecated; this only keeps
their existing behaviour pluggable until removal in Airflow 4.
potiuk added a commit to potiuk/airflow that referenced this pull request Jul 20, 2026
Since apache#57354, task email_on_failure / email_on_retry alerts were routed
unconditionally through SmtpNotifier, silently ignoring the
[email] email_backend configuration. Custom backends (SES, SendGrid,
org-internal) stopped delivering failure/retry emails even though the
deprecated email_on_* parameters still worked.

This restores the old behaviour using the existing [email] email_backend
option -- no new configuration is introduced:

- A non-default [email] email_backend is transparently wrapped in a new
  LegacyEmailBackendNotifier, so existing SES / SendGrid / custom backends
  keep delivering alerts unchanged. The backend is resolved from config at
  notify time, so the Task SDK keeps no static dependency on
  airflow.utils.email.
- Otherwise the default SmtpNotifier is used, exactly as before.

The notifier lives in the Task SDK (airflow.sdk.execution_time.email_backend)
next to its only caller, so no extra provider needs to be installed for a
custom email backend to keep working.

Both failure-email entry points (the worker task-runner path and the
DAG-processor callback path) funnel through the same function, so the
selected backend is used consistently regardless of how the task failed.

The deprecated email_on_* parameters are not un-deprecated; this only keeps
their existing behaviour pluggable until removal in Airflow 4.
potiuk added a commit to potiuk/airflow that referenced this pull request Jul 20, 2026
Since apache#57354, task email_on_failure / email_on_retry alerts were routed
unconditionally through SmtpNotifier, silently ignoring the
[email] email_backend configuration. Custom backends (SES, SendGrid,
org-internal) stopped delivering failure/retry emails even though the
deprecated email_on_* parameters still worked.

This restores the old behaviour using the existing [email] email_backend
option -- no new configuration is introduced:

- A non-default [email] email_backend is transparently wrapped in a new
  LegacyEmailBackendNotifier, so existing SES / SendGrid / custom backends
  keep delivering alerts unchanged. The backend is resolved from config at
  notify time, so the Task SDK keeps no static dependency on
  airflow.utils.email.
- Otherwise the default SmtpNotifier is used, exactly as before.

The notifier lives in the Task SDK (airflow.sdk.execution_time.email_backend)
next to its only caller, so no extra provider needs to be installed for a
custom email backend to keep working.

Both failure-email entry points (the worker task-runner path and the
DAG-processor callback path) funnel through the same function, so the
selected backend is used consistently regardless of how the task failed.

The deprecated email_on_* parameters are not un-deprecated; this only keeps
their existing behaviour pluggable until removal in Airflow 4.
potiuk added a commit that referenced this pull request Jul 20, 2026
…9877)

Since #57354, task email_on_failure / email_on_retry alerts were routed
unconditionally through SmtpNotifier, silently ignoring the
[email] email_backend configuration. Custom backends (SES, SendGrid,
org-internal) stopped delivering failure/retry emails even though the
deprecated email_on_* parameters still worked.

This restores the old behaviour using the existing [email] email_backend
option -- no new configuration is introduced:

- A non-default [email] email_backend is transparently wrapped in a new
  LegacyEmailBackendNotifier, so existing SES / SendGrid / custom backends
  keep delivering alerts unchanged. The backend is resolved from config at
  notify time, so the Task SDK keeps no static dependency on
  airflow.utils.email.
- Otherwise the default SmtpNotifier is used, exactly as before.

The notifier lives in the Task SDK (airflow.sdk.execution_time.email_backend)
next to its only caller, so no extra provider needs to be installed for a
custom email backend to keep working.

Both failure-email entry points (the worker task-runner path and the
DAG-processor callback path) funnel through the same function, so the
selected backend is used consistently regardless of how the task failed.

The deprecated email_on_* parameters are not un-deprecated; this only keeps
their existing behaviour pluggable until removal in Airflow 4.
github-actions Bot pushed a commit to aws-mwaa/upstream-to-airflow that referenced this pull request Jul 20, 2026
…y alerts (apache#69877)

Since apache#57354, task email_on_failure / email_on_retry alerts were routed
unconditionally through SmtpNotifier, silently ignoring the
[email] email_backend configuration. Custom backends (SES, SendGrid,
org-internal) stopped delivering failure/retry emails even though the
deprecated email_on_* parameters still worked.

This restores the old behaviour using the existing [email] email_backend
option -- no new configuration is introduced:

- A non-default [email] email_backend is transparently wrapped in a new
  LegacyEmailBackendNotifier, so existing SES / SendGrid / custom backends
  keep delivering alerts unchanged. The backend is resolved from config at
  notify time, so the Task SDK keeps no static dependency on
  airflow.utils.email.
- Otherwise the default SmtpNotifier is used, exactly as before.

The notifier lives in the Task SDK (airflow.sdk.execution_time.email_backend)
next to its only caller, so no extra provider needs to be installed for a
custom email backend to keep working.

Both failure-email entry points (the worker task-runner path and the
DAG-processor callback path) funnel through the same function, so the
selected backend is used consistently regardless of how the task failed.

The deprecated email_on_* parameters are not un-deprecated; this only keeps
their existing behaviour pluggable until removal in Airflow 4.
(cherry picked from commit f7dec02)

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
aws-airflow-bot pushed a commit to aws-mwaa/upstream-to-airflow that referenced this pull request Jul 20, 2026
…y alerts (apache#69877)

Since apache#57354, task email_on_failure / email_on_retry alerts were routed
unconditionally through SmtpNotifier, silently ignoring the
[email] email_backend configuration. Custom backends (SES, SendGrid,
org-internal) stopped delivering failure/retry emails even though the
deprecated email_on_* parameters still worked.

This restores the old behaviour using the existing [email] email_backend
option -- no new configuration is introduced:

- A non-default [email] email_backend is transparently wrapped in a new
  LegacyEmailBackendNotifier, so existing SES / SendGrid / custom backends
  keep delivering alerts unchanged. The backend is resolved from config at
  notify time, so the Task SDK keeps no static dependency on
  airflow.utils.email.
- Otherwise the default SmtpNotifier is used, exactly as before.

The notifier lives in the Task SDK (airflow.sdk.execution_time.email_backend)
next to its only caller, so no extra provider needs to be installed for a
custom email backend to keep working.

Both failure-email entry points (the worker task-runner path and the
DAG-processor callback path) funnel through the same function, so the
selected backend is used consistently regardless of how the task failed.

The deprecated email_on_* parameters are not un-deprecated; this only keeps
their existing behaviour pluggable until removal in Airflow 4.
(cherry picked from commit f7dec02)

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
dabla pushed a commit to dabla/airflow that referenced this pull request Jul 21, 2026
…ache#69877)

Since apache#57354, task email_on_failure / email_on_retry alerts were routed
unconditionally through SmtpNotifier, silently ignoring the
[email] email_backend configuration. Custom backends (SES, SendGrid,
org-internal) stopped delivering failure/retry emails even though the
deprecated email_on_* parameters still worked.

This restores the old behaviour using the existing [email] email_backend
option -- no new configuration is introduced:

- A non-default [email] email_backend is transparently wrapped in a new
  LegacyEmailBackendNotifier, so existing SES / SendGrid / custom backends
  keep delivering alerts unchanged. The backend is resolved from config at
  notify time, so the Task SDK keeps no static dependency on
  airflow.utils.email.
- Otherwise the default SmtpNotifier is used, exactly as before.

The notifier lives in the Task SDK (airflow.sdk.execution_time.email_backend)
next to its only caller, so no extra provider needs to be installed for a
custom email backend to keep working.

Both failure-email entry points (the worker task-runner path and the
DAG-processor callback path) funnel through the same function, so the
selected backend is used consistently regardless of how the task failed.

The deprecated email_on_* parameters are not un-deprecated; this only keeps
their existing behaviour pluggable until removal in Airflow 4.
potiuk added a commit that referenced this pull request Jul 21, 2026
…y alerts (#69877) (#70129)

Since #57354, task email_on_failure / email_on_retry alerts were routed
unconditionally through SmtpNotifier, silently ignoring the
[email] email_backend configuration. Custom backends (SES, SendGrid,
org-internal) stopped delivering failure/retry emails even though the
deprecated email_on_* parameters still worked.

This restores the old behaviour using the existing [email] email_backend
option -- no new configuration is introduced:

- A non-default [email] email_backend is transparently wrapped in a new
  LegacyEmailBackendNotifier, so existing SES / SendGrid / custom backends
  keep delivering alerts unchanged. The backend is resolved from config at
  notify time, so the Task SDK keeps no static dependency on
  airflow.utils.email.
- Otherwise the default SmtpNotifier is used, exactly as before.

The notifier lives in the Task SDK (airflow.sdk.execution_time.email_backend)
next to its only caller, so no extra provider needs to be installed for a
custom email backend to keep working.

Both failure-email entry points (the worker task-runner path and the
DAG-processor callback path) funnel through the same function, so the
selected backend is used consistently regardless of how the task failed.

The deprecated email_on_* parameters are not un-deprecated; this only keeps
their existing behaviour pluggable until removal in Airflow 4.
(cherry picked from commit f7dec02)

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
eladkal pushed a commit that referenced this pull request Jul 22, 2026
…#70007)

* Flag missing conn-fields when hook-only files change in static checks

* Add missing Dutch translations (#68742)

* Add missing  Dutch translations

* Fix common.ai durable execution skipping Toolset-capability tools (#69881)

When durable=True, tools supplied via a pydantic-ai Toolset capability
(capabilities=[Toolset(ts)]) bypassed the CachingToolset applied to
toolsets=, so their results re-executed on every retry instead of
replaying. Wrap the inner toolset of concrete Toolset capabilities with
the same CachingToolset. A Toolset capability backed by a callable
factory can't be wrapped (it resolves per run) and now logs a warning.

Also fixes two latent durable-execution bugs found in review:

- cleanup() ran before the message-history XCom push and output
  serialization. A failure in either wiped the cache, so the retry
  re-ran every already-completed step. Move cleanup to after them.

- the pre-3.3 ObjectStorage cache filename joined dag/task/run with "_",
  aliasing distinct tasks (dag "etl"/task "load_data" and dag
  "etl_load"/task "data" both mapped to one file, so one task could
  read, overwrite, or delete another's cache). Hash the identity
  components instead.

* Don't deactivate DAG bundles owned by other dag-processors (#69964)

`DagBundlesManager.sync_bundles_to_db()` marks every stored bundle that is
not in the calling process's config as inactive. This assumes the caller
sees the complete bundle configuration.

When multiple dag-processors are each configured with a partial config (one
bundle per processor, a natural way to shard parsing), each processor treats
the other processors' bundles as "no longer found in config" and disables
them. Processor A disables B's bundle, B disables A's, and they flip
`dag_bundle.active` on every parse cycle -- the deployment never converges
and continuously logs "DAG bundle ... is no longer found in config and has
been disabled" for bundles that are actively configured elsewhere.

Add a `deactivate_missing` flag (default `True`, preserving existing
single-processor behavior) and have `DagFileProcessorManager.sync_bundles()`
pass `deactivate_missing=False` when the processor was started with a bundle
filter (`--bundle-name` / `bundle_names_to_parse`), i.e. when it only owns a
subset of the bundles.

closes: #69963
related: #69698

Generated-by: Claude Code following the guidelines

* Authorize Dag reparse against the file's Dags, not the query-string dag_id (#69471)

* Authorize Dag reparse against the file's Dags, not the query-string dag_id

The PUT /parseDagFile/{file_token} endpoint authorized the caller through a route dependency that, with no dag_id path parameter, resolves the target from the query string, which is decoupled from the Dag file the signed file_token actually resolves to.

Add a requires_access_dag_from_file_token dependency that decodes the token, resolves the Dags defined in that file, and authorizes the caller against exactly those Dags, so authorization always matches the Dag being reparsed regardless of any request parameter.

* Update airflow-core/src/airflow/api_fastapi/core_api/security.py

Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com>

* Fix CI

---------

Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com>

* Restore graph task and group coloring via Chakra palette tokens (#68760)

* Restore graph task and group coloring via Chakra palette tokens

Custom operator and TaskGroup colors disappeared in Airflow 3: the
ui_color/ui_fgcolor attributes were kept but the new UI ignored them, so
teams that relied on color to parse large graphs at a glance lost that
signal (see the demand on the linked issue).

Bring the coloring back in a way that fits the new opinionated theming:
the value must be a Chakra palette token (e.g. blue.500), which resolves
through a theme-controlled CSS variable and therefore stays legible in
both light and dark mode and under custom themes -- the dark-mode and
accessibility concerns that drove the original removal. The graph paints
the node fill from ui_color and the operator label from ui_fgcolor, as in
Airflow 2.x, while the border keeps showing run state. Legacy hex/named
values can no longer adapt to the theme, so they are ignored by the graph
and emit a warning for user-authored operators and task groups.

* Color task groups in the graph view, including when expanded

ui_color and ui_fgcolor are documented as the fill and label colors of a
TaskGroup node, and Airflow 2.x painted them, but the graph excluded groups
from the custom fill and dropped the colors entirely once a group was
expanded. Treat groups like leaf tasks so a token-valued group color renders
its fill and label in both the collapsed and expanded states.

* Accept raw hex colors and Chakra tokens for graph node coloring

Review feedback asked to keep the Airflow 2 behavior where ui_color and ui_fgcolor accept a raw color (a hex code or CSS name) in addition to Chakra palette tokens, so existing Dags keep their graph colors without any change. Dark-mode color variants are deferred to a follow-up.

* Adjustments

* Fix unreadable graph task text on light custom colors in dark mode

The task icon and label fell back to the theme's default foreground for Chakra token fills, so a light token such as yellow.200 rendered light text on a light fill in dark mode. Deriving the text color from the resolved fill measures tokens too, so contrast holds for hex, CSS names, and tokens alike.

* Update task group graph test fixture for restored node colors

The graph serializer now emits each node's ui_color/ui_fgcolor for task
and group nodes, so the expected graph fixture must include them; join
nodes stay uncolored. The fixture was stale and omitted these fields,
failing test_task_group_to_dict_serialized_dag and
test_task_group_to_dict_alternative_syntax.

* Document semantic theme tokens for ui_color and ui_fgcolor

The graph node color attributes accept theme-aware semantic tokens (e.g.
brand.solid) that adapt to light and dark mode, in addition to palette tokens
and raw colors — but the docs only mentioned palette tokens, so users had no
pointer to the semantic tokens available in the UI theme.

* Skip Go SDK CI jobs for doc-only changes under go-sdk/ (#70021)

go-sdk/*.md edits (README, ADRs) currently match the Go SDK file groups
and trigger the Go unit + e2e suites plus a prod image build, none of
which a documentation change can affect. Excluding .md also lets
non-.go build files (go.mod, go.sum, build config) trigger the unit
tests, which the previous .go-only pattern missed.

* Enhance/standardize documentation for `AssetOrTimeSchedule` (#69831)

* UI: Lazy-mount the pause confirmation dialog on Dag cards and rows (#70016)

* Skip ts-sdk supervisor schema check for doc-only changes (#70022)

ts-sdk/*.md edits (e.g. README) currently match TS_SDK_FILES and keep
the check-ts-sdk-supervisor-schema prek hook from being skipped, so a
documentation-only change needlessly regenerates and diffs the
generated supervisor schema. Documentation does not affect it.

* Use atomic upsert for asset run queue on MySQL to avoid deadlocks (#69977)

Under concurrent asset-event fan-out, the per-row SAVEPOINT loop used for
non-PostgreSQL backends deadlocks on MySQL/InnoDB and surfaces confusing
"SAVEPOINT ... does not exist" errors, and the deadlock is not retried.
Route MySQL to a single-statement INSERT ... ON DUPLICATE KEY UPDATE,
mirroring the existing PostgreSQL path, so the enqueue is atomic and holds
locks far more briefly.

closes: #69938

* Pin task bundle manifest to the dagrun's version (#69941)

A mid-run DAG re-parse possibly creates a new DagVersion and bumps
not-yet-started task instances' dag_version_id, while the DagRun
stays pinned to its original bundle_version. ExecuteTask.make()
sourced the bundle version from the run's pin (dag_run.bundle_version)
but bundle version_data from the task's now-bumped dag_version,
so the workload shipped a hash and a manifest that describe
different versions. This double source was noticed for the callback
path in a previous PR, but the task path was missed.

Source version_data from the run's pinned created_dag_version so it always
matches the bundle version, mirroring ExecuteCallback.make() and the way Git
bundles resolve everything from the run's pinned commit.

* Allow configuring XCom sidecar container security context (#69613)

* Allow configuring XCom sidecar container security context

* fix CI error

* fix CI error #2

* Update providers/cncf/kubernetes/src/airflow/providers/cncf/kubernetes/operators/pod.py

Co-authored-by: Przemysław Mirowski <17602603+Miretpl@users.noreply.github.com>

* fix CI error

---------

Co-authored-by: Przemysław Mirowski <17602603+Miretpl@users.noreply.github.com>

* Add missing newsfragment to Helm Chart (#70043)

* Remove duplicated newsfragments

* Add missing newsfragments

* Consolidate Airflow version newsfragment

* Update doc (#70047)

* Fix `@task.llm_branch` import failure on Task SDK-only workers (#70068)

* Reject unsupported require_approval in LLM branch and schema compare operators (#70069)

* Fix stale docs.sqlalchemy.org/en/14 pooling link in config.yml (#69751)

* Java SDK: Throw MissingXComException instead of NPE for absent XComs (#69257)

Signed-off-by: PoAn Yang <payang@apache.org>

* Rename Kafka Listener to Kafka Event Producer and update the documentation (#70014)

* Set stream=False for Snowflake Cortex Agent requests. (#69731)

* Send Airflow CLI logs to stderr for -o commands so structured output stays parseable (#68598)

* Document task subprocess lifecycle and pre-connect log buffer (#70076)

* Enhancing docs for `HttpEventTrigger` (#70073)

* docs/http-event-trigger: Enhancing docs for HttpEventTrigger

* Apply suggestions from code review

Co-authored-by: Tzu-ping Chung <uranusjr@gmail.com>

---------

Co-authored-by: Tzu-ping Chung <uranusjr@gmail.com>

* Add Amazon ECR repository operators (#69886)

* Prevent negative trigger queue delay metrics (#69971)

* Bump the uv-dependency-updates group in /dev/breeze with 2 updates (#70033)

Bumps the uv-dependency-updates group in /dev/breeze with 2 updates: [gitpython](https://github.com/gitpython-developers/GitPython) and [prek](https://github.com/j178/prek).


Updates `gitpython` from 3.1.50 to 3.1.51
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](https://github.com/gitpython-developers/GitPython/compare/3.1.50...3.1.51)

Updates `prek` from 0.4.8 to 0.4.9
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](https://github.com/j178/prek/compare/v0.4.8...v0.4.9)

---
updated-dependencies:
- dependency-name: gitpython
  dependency-version: 3.1.51
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-dependency-updates
- dependency-name: prek
  dependency-version: 0.4.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-dependency-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump the github-actions-updates group across 1 directory with 9 updates (#70040)

Bumps the github-actions-updates group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/setup-java](https://github.com/actions/setup-java) | `5.4.0` | `5.5.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.0.0` |
| [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) | `3.0.3` | `3.0.5` |
| [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.2.1` | `6.2.2` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.2` | `4.37.0` |
| [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.36.2` | `4.37.0` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.2` | `4.37.0` |
| [actions/stale](https://github.com/actions/stale) | `10.3.0` | `10.4.0` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `8.2.0` | `8.3.2` |



Updates `actions/setup-java` from 5.4.0 to 5.5.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](https://github.com/actions/setup-java/compare/1bcf9fb12cf4aa7d266a90ae39939e61372fe520...0f481fcb613427c0f801b606911222b5b6f3083a)

Updates `actions/setup-node` from 6.4.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020)

Updates `slackapi/slack-github-action` from 3.0.3 to 3.0.5
- [Release notes](https://github.com/slackapi/slack-github-action/releases)
- [Changelog](https://github.com/slackapi/slack-github-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/slackapi/slack-github-action/compare/45a88b9581bfab2566dc881e2cd66d334e621e2c...0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc)

Updates `aws-actions/configure-aws-credentials` from 6.2.1 to 6.2.2
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](https://github.com/aws-actions/configure-aws-credentials/compare/254c19bd240aabef8777f48595e9d2d7b972184b...517a711dbcd0e402f90c77e7e2f81e849156e31d)

Updates `github/codeql-action/init` from 4.36.2 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

Updates `github/codeql-action/autobuild` from 4.36.2 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

Updates `github/codeql-action/analyze` from 4.36.2 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

Updates `actions/stale` from 10.3.0 to 10.4.0
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/stale/compare/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899...1e223db275d687790206a7acac4d1a11bd6fe629)

Updates `astral-sh/setup-uv` from 8.2.0 to 8.3.2
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](https://github.com/astral-sh/setup-uv/compare/fac544c07dec837d0ccb6301d7b5580bf5edae39...11f9893b081a58869d3b5fccaea48c9e9e46f990)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-updates
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-updates
- dependency-name: slackapi/slack-github-action
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-updates
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: 6.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-updates
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-updates
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-updates
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-updates
- dependency-name: actions/stale
  dependency-version: 10.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-updates
- dependency-name: astral-sh/setup-uv
  dependency-version: 8.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Fix CI integration tests gated by the wrong platform (#70015)

Signed-off-by: PoAn Yang <payang@apache.org>

* Fix mypy prek hooks skipping all files in dot-directory (#70064)

Signed-off-by: PoAn Yang <payang@apache.org>

* Document 3.3.0 image databricks constraint fix in Dockerfile changelog (#70083)

Record in the 'Changes after publishing the images' table that the 3.3.0 Python 3.11/3.12 images had their downgraded databricks stack corrected (provider 6.13.0 -> 7.16.1, connector 2.0.2 -> 4.2.5, thrift 0.23.0 -> 0.16.0).

related: #69603

* Fix DocumentLoaderOperator ignoring unknown parser on byte input (#70071)

* Fix DocumentLoaderOperator ignoring unknown parser on byte input

* Validate explicit parser in _resolve_backend

* Send TS SDK logs to stderr on socket disconnect (#69302)

* Send TypeScript SDK logs to stderr when the log socket disconnects

Co-authored-by: Jason(Zhe-You) Liu <68415893+jason810496@users.noreply.github.com>

* Harden TS SDK log channel shutdown

* Unref log channel close flush timer so it cannot delay process exit

---------

Co-authored-by: Jason(Zhe-You) Liu <68415893+jason810496@users.noreply.github.com>

* Build Go SDK e2e example bundle natively in CI (#69909)

* Build Go SDK e2e example bundle natively in CI

* Capture build output and remove path duplication in Go SDK e2e bundle build

The native/containerized build branch was inlined with no output capture, so a
failed CI build surfaced only a bare traceback, unlike the Java SDK's helper
which prints the build log on failure. The containerized path also hardcoded
/repo/go-sdk/bin instead of deriving it from the already-imported
GO_SDK_ROOT_PATH/GO_SDK_BIN_PATH constants, and the Go build cache key ignored
go.mod so a toolchain bump alone wouldn't invalidate it.

* i18n(ko): translate Dag list run-state filter labels (#69781)

* Preserve output_type through human approval in LLM operators (#70075)

* Preserve output_type through human approval in LLM operators

* Cover BaseModel in output_type restore test

* Clarify the dags reserialize command scope (#69810)

* Add Task SDK, Go and Java SDK execution architecture diagrams (#69750)

* Add Task SDK, Go and Java SDK execution architecture diagrams

Add graphviz-generated diagrams to the architecture overview showing how a
task actually runs across the different SDKs, and embed them in
core-concepts/overview.rst:

- Python Task SDK: supervised (two native OS processes over a msgpack socket)
  vs native/in-process paths, plus a numbered message-flow sequence.
- Go SDK: standalone edge worker pulling from the Edge API, task talks to the
  Execution API directly.
- Java (JVM) SDK: Coordinator layer reusing the Python Supervisor, driving a
  JVM subprocess over loopback TCP, with an architecture diagram and a numbered
  execution-workflow sequence.

* Draw Task and Java SDK execution flows as true sequence diagrams

The message-flow diagrams added earlier in this PR drew every step on a single
vertical spine, so the request/response round-trips between the task runtime and
the Supervisor were hard to follow. Responding to review feedback, redraw them
as true sequence diagrams — one lifeline per participant with the Supervisor in
the middle — so each round-trip reads as arrows going back and forth between
neighboring lifelines, with straight message arrows and margined labels.

* Discount CI image-build time from duration-trend alerts (#69789)

* Discount CI image-build time from duration-trend alerts

The CI duration monitor folded the "Prepare breeze & CI image" step into
each job's total. That step occasionally balloons on a one-off cache miss
(a full image rebuild instead of a cached pull), which repeatedly flagged
unrelated jobs as regressed — e.g. a Non-DB core job reported +190% driven
almost entirely by an 18m image build, while its actual test time was flat.

Image-build time is now excluded from the run and per-job durations used
for the trend, and the image build is watched on its own: it is only
reported when it has stayed slow for more than two days, so a transient
rebuild spike no longer produces a false alert.

* Apply naming nits: prefix duration helpers with calculate_

Rename work_duration -> calculate_work_duration,
run_image_build_seconds -> calculate_image_build_seconds,
adjusted_run_duration -> calculate_adjusted_run_duration for a
consistent calculate_ prefix on the duration-computing helpers.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* Clarify AssetPartitionDagRun provisional-run docstring (#69982)

The previous wording ("we should not allow more than one like this") did not
state the actual invariant. Make explicit that rows are never deleted — so
multiple records per target_dag_id/partition_key are expected — and that the
constraint is specifically at most one row with a null created_dag_run_id,
which the _lock_asset_model mutex enforces.

* fix/issue-70020: Adding cap to cloudpickle (#70086)

* Bring back edge worker metric compatibility with Airflow 3.2 (#67328)

* Bring back edge worker DualStatusManager compability

* Reworked statsd taging for pre airflow 3.3 versions

* Fix mypy

* document metrics compability issues

* fix doc

* Fix docu and added unit test

* Fix imports

* Fix unit test

* Fix flaky unit tests by reset after test execution

---------

Co-authored-by: AutomationDev85 <AutomationDev85>

* Replace vars(response) with attribute access in Azure Data Factory and Synapse operators for SDK v10 compatibility (#69689)

* fix(providers/azure): use attribute access instead of vars() for SDK v10 hybrid model compat

* added regression tests for azure data factory and azure synapse operators

* Fix ruff formatting in test_synapse.py

---------

Co-authored-by: Malte Niederstadt <M.Niederstadt@deutsche-glasfaser.de>

* Bump eslint (#70032)

Bumps the eslint group with 1 update in the /airflow-core/src/airflow/ui directory: [eslint](https://github.com/eslint/eslint).


Updates `eslint` from 10.6.0 to 10.7.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.6.0...v10.7.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 10.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: eslint
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* cncf-kubernetes: fix potential race condition in trigger_reentry flow caused by `is_istio_enabled` (#69269)

* Gracefully return istio check if pod is removed

This is meant to catch a potential race condition in the
`trigger_reentry` flow. There is already a check that the pod still
exists in the event of a success, but it is still possible for the pod
to be removed during the first and second API read. Should this happen,
we should return the same way as if no pod was provided to the function.

* Add log for missing pod in istio check

---------

Co-authored-by: Przemysław Mirowski <17602603+Miretpl@users.noreply.github.com>

* Upgrade http to https in PR template (#70063)

* Update SQLAlchemy documentation link from 1.4 to 2.0

* fix: upgrade http:// to https:// in .github/PULL_REQUEST_TEMPLATE.md

---------

Co-authored-by: hanu-14 <mohdhanan23@outlook.com>

* Make schema_fields templated in GCSToBigQueryOperator (#69108)

schema_fields was not a template field, so a templated value (a Variable
or XComArg resolving to a schema) passed to GCSToBigQueryOperator was never
rendered and reached BigQuery unresolved. Mark it templated, matching how
BigQueryUpdateTableSchemaOperator already templates schema_fields_updates.

* docs: fix stale Airflow 2.0 references in dev/README.md (#69961)

* docs: fix stale Airflow 2.0 references in dev/README.md

* docs: fix official_source typo and missing space in dev/README.md

Two small typos flagged in #69902 that were missed in the initial commit:
- Line 92: "official_source releases" -> "official source releases"
- Line 99: '"apache-airflow-providers"separately' -> '"apache-airflow-providers" separately'

* Refactor get_statsd_logger to use keyword arguments for clarity and add a test for ipv6 support in StatsD logger (#69632)

* Let area:e2e-tests label force the airflow-e2e-tests suite (#69993)

* Let area:e2e-test label force Airflow E2E tests

Contributors validating changes whose impact selective-checks' file heuristics miss otherwise have to request the full test matrix. A focused area label lets them run the standard Airflow E2E suite without unrelated test jobs.

* Use the plural E2E tests area label

* Automate keeping documented "tested with" versions in sync with the test matrix (#69124)

The Python, database and Kubernetes versions Airflow is tested with live in
global_constants.py, but are also listed by hand in the installation
prerequisites doc and the README. Those lists drifted: PostgreSQL 18 (and
MySQL 8.4) were added to the test matrix and the README, but the prerequisites
doc was forgotten, so it still advertised PostgreSQL up to 17.

Add a prek hook that regenerates the tested-versions block in prerequisites.rst
and the "Main version (dev)" column of the README from global_constants.py, so
this drift becomes an auto-fixable check failure instead of a silent doc bug.
Also correct the stale PostgreSQL and MySQL versions in prerequisites.rst.

Generated-by: Claude Code (Opus 4.8) following the guidelines

* Fix Breeze OpenLineage integration gate stuck on stale Postgres versions (#69264)

* Fix Breeze OpenLineage integration gate stuck on stale Postgres versions

The gate in enter_shell() hardcoded PostgreSQL 12/13/14 as the only
versions allowed with --integration openlineage, but Breeze's actual
matrix has moved to 14-18 (12 isn't even a valid choice anymore).
Derive the allowed set from CURRENT_POSTGRES_VERSIONS in
global_constants.py instead, so the gate can't drift out of sync with
the matrix again.

closes: #69233

* Cover --integration all in OpenLineage Postgres gate tests

Reviewer feedback on apache/airflow#69264: the gate also triggers on
"all" (not just "openlineage"), so the tests should exercise that path
too.

* Bump @visx/shape from 3.12.0 to 4.0.0 in /airflow-core/src/airflow/ui (#69722)

Bumps [@visx/shape](https://github.com/airbnb/visx) from 3.12.0 to 4.0.0.
- [Release notes](https://github.com/airbnb/visx/releases)
- [Changelog](https://github.com/airbnb/visx/blob/master/CHANGELOG.md)
- [Commits](https://github.com/airbnb/visx/compare/v3.12.0...v4.0.0)

---
updated-dependencies:
- dependency-name: "@visx/shape"
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Rename Task and Asset store to Task and Asset state store (#70097)

* i18n(ko): add missing translation for triggerDag.partitionKeyHelp (#70005)

* Add integration tests for coordinator-mode TypeScript tasks (#69328)

* Add integration tests for coordinator-mode TypeScript tasks

* Register ts_sdk e2e test mode in breeze CLI

* Exercise real airflow-ts-pack packing in TypeScript SDK e2e tests

The reviewer asked the e2e tests to wait for airflow-ts-pack and use its
real packing path. The example build now runs airflow-ts-pack, which embeds
the airflow metadata in bundle.mjs, so the hand-written
airflow-metadata.yaml sidecar would bypass the path users actually take.

* Trim ts_sdk e2e docstrings and comments to essentials

* Build TS SDK e2e example natively in CI and skip doc-only changes

* Suppress noisy Alembic plugin setup logs (#69916)

Alembic emits autogenerate plugin registration messages at INFO during CLI startup. Those unrelated lines contaminate machine-readable command output, while warnings and errors still need to remain visible.

* Fix ClickHouse test_connection unit test failing with newer clickhouse-connect (#70114)

* Fix ClickHouse test_connection unit test failing with newer clickhouse-connect

The assertion pinned the exact call signature that clickhouse_connect's
DB-API cursor uses internally, which changed in 1.4.x. Only the SQL sent
is relevant to what the test verifies, so the provider keeps working
across the whole supported clickhouse-connect range.

* Assert bound parameters too, not just the statement

Reviewer feedback: the statement and its parameters are Airflow's own
contract, so both belong in the assertion; only what the driver appends
on top of them is out of scope.

* Add running_pod_log_lines config option to KubernetesExecutor (#69301)

* Resolve conflict in KubernetesExecutor.__init__ and drop redundant comment

The running_pod_log_lines config addition conflicted with the
pod-launch-failure requeue state added to __init__ after this branch
diverged; keep both initializations. Also drops a comment that only
restated the line below it, per review feedback.

* Clarify fallback reference in KubernetesExecutor running_pod_log_lines

self.RUNNING_POD_LOG_LINES looked like a self-referential fallback since
it isn't set on the instance until this assignment completes; referencing
the class attribute directly makes clear it falls back to the class default.

* Bump the core-ui-package-updates group across 1 directory with 4 updates (#70037)

Bumps the core-ui-package-updates group with 4 updates in the /airflow-core/src/airflow/ui directory: [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual), [msw](https://github.com/mswjs/msw), [prettier](https://github.com/prettier/prettier) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `@tanstack/react-virtual` from 3.14.5 to 3.14.6
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.6/packages/react-virtual)

Updates `msw` from 2.14.6 to 2.15.0
- [Release notes](https://github.com/mswjs/msw/releases)
- [Changelog](https://github.com/mswjs/msw/blob/main/CHANGELOG.md)
- [Commits](https://github.com/mswjs/msw/compare/v2.14.6...v2.15.0)

Updates `prettier` from 3.9.4 to 3.9.5
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.9.4...3.9.5)

Updates `vite` from 8.1.3 to 8.1.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.1.4/packages/vite)

---
updated-dependencies:
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: core-ui-package-updates
- dependency-name: msw
  dependency-version: 2.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: core-ui-package-updates
- dependency-name: prettier
  dependency-version: 3.9.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: core-ui-package-updates
- dependency-name: vite
  dependency-version: 8.1.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: core-ui-package-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* UI: Complete Hindi (hi) translation coverage (#70111)

Adds the missing Hindi translations so the locale reaches full coverage
against the current English source, well above the 90% completeness
threshold defined in airflow-core/src/airflow/ui/public/i18n/README.md.

Covers:
- common.json: preset filters, keyboard-shortcut help dialog, note
  edit/preview/write, dagRun.partitionDate.
- admin.json: variables import parsing status.
- components.json: triggerDag partitionKeyHelp.
- dags.json: any/last run-state filters and the run-state count block.
- dashboard.json: alert see more/less toggles and pluralized count.
- hitl.json: review drawer and required-action list strings.

Also removes stale Hindi keys that were renamed or dropped on the English
side (asset_other, dagWarnings.error_other, and four keyboard-shortcut
copies in dag.json) so the locale no longer carries unused entries.

* Document GlueJobOperator support for OpenLineage Spark injection (#69652)

Signed-off-by: Maciej Obuchowski <maciej.obuchowski@datadoghq.com>

* Add API endpoint for backfill dag run entries (#67381)

* Add GET /backfills/{backfill_id}/dag_runs endpoint

Adds a new public API endpoint that returns the BackfillDagRun entries
for a given backfill with joined DagRun state. Users can see what
happened in a backfill: which dates ran, their states (queued, running,
success, failed), and which slots were skipped (with reason).

- BackfillDagRunResponse / BackfillDagRunCollectionResponse models
- LEFT OUTER JOIN via joinedload includes skipped slots (null dag_run_id)
- Pagination via limit/offset, default ordering by sort_ordinal
- 404 when backfill doesn't exist
- 8 unit tests covering happy path, skipped slots, 404, pagination,
  empty backfill, and ordering contract

closes: #46250

* Align backfill dag run response identifiers

* Update Weaviate examples for client 4.16 API (#67343)

* Restore pluggable email backend for task failure and retry alerts (#69877)

Since #57354, task email_on_failure / email_on_retry alerts were routed
unconditionally through SmtpNotifier, silently ignoring the
[email] email_backend configuration. Custom backends (SES, SendGrid,
org-internal) stopped delivering failure/retry emails even though the
deprecated email_on_* parameters still worked.

This restores the old behaviour using the existing [email] email_backend
option -- no new configuration is introduced:

- A non-default [email] email_backend is transparently wrapped in a new
  LegacyEmailBackendNotifier, so existing SES / SendGrid / custom backends
  keep delivering alerts unchanged. The backend is resolved from config at
  notify time, so the Task SDK keeps no static dependency on
  airflow.utils.email.
- Otherwise the default SmtpNotifier is used, exactly as before.

The notifier lives in the Task SDK (airflow.sdk.execution_time.email_backend)
next to its only caller, so no extra provider needs to be installed for a
custom email backend to keep working.

Both failure-email entry points (the worker task-runner path and the
DAG-processor callback path) funnel through the same function, so the
selected backend is used consistently regardless of how the task failed.

The deprecated email_on_* parameters are not un-deprecated; this only keeps
their existing behaviour pluggable until removal in Airflow 4.

* Add partition_key and partition_key_regexp_pattern filters for asset events (#64610)

* Add partition_key and partition_key_pattern filters for asset events

Add two new query parameters to the asset events API endpoints:

- partition_key: exact-match filter leveraging the new composite
  B-tree index on (asset_id, partition_key)
- partition_key_pattern: regex-based filter using database-native
  regexp_match for flexible pattern matching

Includes Core API, Execution API, Task SDK (InletEventsAccessor),
client, documentation, migration for the composite index, and tests.

Made-with: Cursor

* Regenerate supervisor schema snapshot for partition_key filters

* Add ReDoS safeguards for partition_key_pattern regex filter

The pattern is evaluated by the database's regex engine, so a pathological
pattern could consume DB CPU (ReDoS). Mitigations:

- Cap the pattern length (MAX_REGEX_PATTERN_LENGTH) in both the Core and
  Execution API validators, returning 400 for over-long patterns.
- Bound the regex query with a transaction-local statement_timeout on
  PostgreSQL (apply_regex_query_timeout); no-op elsewhere. MySQL bounds
  regex evaluation via its built-in regexp_time_limit; SQLite has no
  server-side regex and MariaDB is unsupported.
- Document the safeguards in assets.rst.

* Gate regex query filters behind a config flag with configurable timeout

Add two [api] configs (Airflow 3.4.0):

- enable_regexp_query_filters (bool, default False): the partition_key_pattern
  filter passes a user-supplied regex to the database engine, which is a ReDoS
  vector, so it is disabled by default and must be explicitly enabled. Exact-match
  partition_key filtering is unaffected.
- regexp_query_timeout (int seconds, default 30): the primary runtime mitigation,
  enforced as a PostgreSQL transaction-local statement_timeout; 0 disables it.

When the flag is off, partition_key_pattern requests return HTTP 400 on both the
Core and Execution APIs. Config descriptions document the security rationale.
Adds tests for the disabled path and the timeout helper.

* Revert pattern length cap for regex filters

Drop MAX_REGEX_PATTERN_LENGTH; the opt-in flag and the PostgreSQL
statement_timeout are the meaningful ReDoS safeguards, and a length cap
does not stop short catastrophic patterns while risking false rejections
of legitimate ones.

* Fix CI: enable regex flag for by-alias tests, regenerate TS SDK schema

- Add the enable_regexp_query_filters conf_vars fixture to
  TestGetAssetEventByAssetAliasPartitionKey (was missed), fixing the 4
  by-alias regex tests that now hit the default-off flag; add a
  disabled->400 test for the alias endpoint too.
- Regenerate ts-sdk/src/generated/supervisor.ts for the partition_key /
  partition_key_pattern comms fields (check-ts-sdk-supervisor-schema).

* Address review feedback on partition key regexp filter

- Rename the public/SDK parameter partition_key_pattern ->
  partition_key_regexp_pattern to distinguish regexp filtering from the
  substring "*_pattern" filters on other APIs.
- Move the enable_regexp_query_filters gate into _RegexParam construction
  and the regex compile check into depends_regex, so a regexp filter can
  never be instantiated without the setting being enabled.
- Drop the mutually-exclusive 400 between partition_key and
  partition_key_regexp_pattern (both now combine with AND) on the Core and
  Execution APIs and in the Task SDK client/accessor.
- Reuse the shared QueryAssetEventPartitionKeyFilter/Regex params in the
  Execution API asset-event routes instead of duplicating the query params
  and validation.
- Keep backend implementation details out of the public parameter
  description; simplify the config docs; revert an unrelated limit check.
- Regenerate OpenAPI specs, UI TS clients, and the supervisor schema
  snapshots.

* Collapse regexp config into one setting and scope the query timeout

Address further review feedback:

- Replace the enable_regexp_query_filters + regexp_query_timeout pair with a
  single [api] regexp_query_timeout: 0 (default) disables regexp filtering
  entirely, any positive value enables it and bounds the query runtime. This
  removes the "enabled but unbounded" combination.
- Make apply_regex_query_timeout a context manager that sets a transaction-local
  statement_timeout on enter and resets it on exit, so the bound is scoped to
  the regexp query and does not leak to other statements in the request's
  transaction. Both asset-event routes apply it automatically around query
  execution instead of relying on a manual call in the view.

* Regenerate UI query client for partition_key_regexp_pattern rename

The hand-applied rename missed the type-block declarations and JSDoc in the
generated query hooks (they were not on lines matching the AssetEvents hook
name). Regenerate with `pnpm codegen` so the UI client matches the OpenAPI
spec, fixing the "Compile / format / lint UI" static check.

* Fix provide_session positional static check in partition-key tests

The check-no-new-provide-session-positional hook flagged the partition-key
regexp tests. The nine test methods never used the injected session, so drop
their @provide_session decorator and unused session parameter; make session
keyword-only in the _create_partition_key_test_data helper that does use it.

* Address review: MySQL query timeout, float config, doc link, test tidy-up

- Enforce regexp_query_timeout on MySQL too (session max_execution_time),
  not just PostgreSQL statement_timeout; apply_regex_query_timeout now
  branches by dialect and is a no-op on SQLite.
- Make [api] regexp_query_timeout a float so fractional seconds (e.g. 0.5)
  are allowed; read it via conf.getfloat.
- Link the config option in assets.rst via :ref: and note the MySQL bound.
- Tests: create partition-key rows via an autouse fixture instead of a
  per-test helper call, fold the exact-match cases into parametrized tests
  (core + execution API), and cover the MySQL/float timeout paths.

* Restore previous db timeout instead of clearing it

Address review nit: apply_regex_query_timeout now captures the current
statement_timeout (PostgreSQL) / max_execution_time (MySQL) before overriding
it and restores that value on exit, instead of resetting to 0. This preserves
a server- or role-level global timeout rather than clobbering it.

* Apply regexp query timeout automatically via the filter dependency

Address review feedback: instead of relying on each view to wrap its query in
apply_regex_query_timeout (easy to forget -> ReDoS), the regexp filter's
dependency (regex_param_factory) now applies the timeout to the request's
session itself. Any endpoint using QueryAssetEventPartitionKeyRegex is bounded
automatically. The dependency is function-scoped so it can depend on the
session it bounds; the previous timeout value is restored on teardown. Removes
the manual wrappers from the core and execution asset-event routes and adds
tests for the dependency behavior.

* Optionally emit Dag tags as metric tags (#68568)

* Emit Dag tags as metric tags

Add a [metrics] dag_tags_in_metrics option (default False). When enabled, each
Dag tag becomes a metric tag on Dag-run and task-instance metrics: tags with a
colon (e.g. env:prod) split into a key/value pair; plain tags (e.g. production)
become standalone DogStatsd tags, or tag=true in InfluxDB line protocol. Built-in
keys (dag_id, run_type, task_id, team_name) win on collision.

Tags come from the DagRun's dag_model.tags. The scheduler hot loop
(get_running_dag_runs_to_examine) and the executor-event failure path eager-load
them (gated on the flag) to avoid per-DagRun queries; other in-session emission
paths fall back to a lazy load, so the tags reach all Dag-run and task-instance
metrics. DagRun.dag_tags_for_stats swallows SQLAlchemyError so a detached/expired
instance degrades to no tags rather than breaking the caller.

TaskInstance.stats_tags reuses DagRun.dag_tags_for_stats and adds task_id and
run_type; the Task SDK worker reads the in-memory Dag and also adds run_type, so
ti.* metrics carry a consistent tag set across the worker and scheduler emitters.

The build_dag_metric_tags helper lives in the shared observability stats module.

* Address review feedback on Dag tags metric emission

Keep the scheduler hot path free of per-task conf reads. Warm the dag tags via the existing
TaskInstance -> DagModel join rather than an extra dag_run hop, since the
DagModel is shared in the identity map. Fold the repeated dogstatsd tag-list
guard into a single helper, and consolidate the tag-formatting tests.

* Address further review nits on Dag tags metric emission

Make session a keyword-only argument on get_running_dag_runs_to_examine, in
line with the convention for session parameters. Reduce TaskInstance.stats_tags
to the dag run's tags plus the task-level ones, keeping the TI's transiently
resolved team_name when present.

* Source task instance team_name metric tag from the dag run

TaskInstance.stats_tags already reuses the dag run's stats tags, so take
team_name from there too rather than from a separate per-task transient
attribute, keeping a single source of truth for the tag.

The scheduling loop now stashes the resolved team on the dag run so
task-instance metrics still carry it. The heartbeat-purge path already tags
team inline, so its now-redundant per-task assignment is dropped.

* Add ADR-0006: no Lang-SDK source display for mixed-language (@task.stub) Dag (#70059)

* Add ADR-0006: no Lang-SDK source display for stub DAGs

* Drop the per-Dag source slicing argument from ADR-0006

That point argued against per-Dag filtering of the source view, but that
shape is essentially the upcoming per-file get_source_code on the AIP-85
DagImporter interface, so it is not a reason for this decision and would
read as pre-judging that work.

* [main] Upgrade important CI environment (#69999)

* [main] CI: Upgrade important CI environment

* Fix plugin validation type check for mypy 2.3.0

mypy 2.3.0 narrows the `inspect.isclass()` guard to `type[object]`, which does
not carry `validate`, so the four shared distributions that symlink
plugins_manager.py failed static checks. The MRO check immediately above
already establishes the class is an AirflowPlugin by name -- it cannot use
issubclass() because the shared library is reachable under two module paths --
so make that knowledge explicit to the type checker.

* Fix breeze tag listing type check for GitPython 3.1.52

GitPython 3.1.52 types `git.ls_remote` as the full union of git-command
return shapes, so mypy no longer accepts calling `splitlines()` on it and the
four static-check hooks that type-check dev/breeze failed. With plain
arguments the call always returns the command output, so say so.

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

* Bump the auth-ui-package-updates group across 1 directory with 9 updates (#70105)

* Bump the auth-ui-package-updates group across 1 directory with 9 updates

Bumps the auth-ui-package-updates group with 9 updates in the /airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui directory:

| Package | From | To |
| --- | --- | --- |
| [@7nohe/openapi-react-query-codegen](https://github.com/7nohe/openapi-react-query-codegen) | `2.1.0` | `2.2.0` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.62.1` | `8.64.0` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.62.1` | `8.64.0` |
| [@typescript-eslint/utils](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/utils) | `8.62.1` | `8.64.0` |
| [eslint](https://github.com/eslint/eslint) | `10.6.0` | `10.7.0` |
| [eslint-plugin-perfectionist](https://github.com/azat-io/eslint-plugin-perfectionist) | `5.9.1` | `5.10.0` |
| [prettier](https://github.com/prettier/prettier) | `3.9.4` | `3.9.5` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.62.1` | `8.64.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.3` | `8.1.4` |



Updates `@7nohe/openapi-react-query-codegen` from 2.1.0 to 2.2.0
- [Release notes](https://github.com/7nohe/openapi-react-query-codegen/releases)
- [Commits](https://github.com/7nohe/openapi-react-query-codegen/compare/v2.1.0...v2.2.0)

Updates `@typescript-eslint/eslint-plugin` from 8.62.1 to 8.64.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.64.0/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.62.1 to 8.64.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.64.0/packages/parser)

Updates `@typescript-eslint/utils` from 8.62.1 to 8.64.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/utils/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.64.0/packages/utils)

Updates `eslint` from 10.6.0 to 10.7.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.6.0...v10.7.0)

Updates `eslint-plugin-perfectionist` from 5.9.1 to 5.10.0
- [Release notes](https://github.com/azat-io/eslint-plugin-perfectionist/releases)
- [Changelog](https://github.com/azat-io/eslint-plugin-perfectionist/blob/main/changelog.md)
- [Commits](https://github.com/azat-io/eslint-plugin-perfectionist/compare/v5.9.1...v5.10.0)

Updates `prettier` from 3.9.4 to 3.9.5
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.9.4...3.9.5)

Updates `typescript-eslint` from 8.62.1 to 8.64.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.64.0/packages/typescript-eslint)

Updates `vite` from 8.1.3 to 8.1.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.1.4/packages/vite)

---
updated-dependencies:
- dependency-name: "@7nohe/openapi-react-query-codegen"
  dependency-version: 2.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: auth-ui-package-updates
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.64.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: auth-ui-package-updates
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.64.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: auth-ui-package-updates
- dependency-name: "@typescript-eslint/utils"
  dependency-version: 8.64.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: auth-ui-package-updates
- dependency-name: eslint
  dependency-version: 10.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: auth-ui-package-updates
- dependency-name: eslint-plugin-perfectionist
  dependency-version: 5.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: auth-ui-package-updates
- dependency-name: prettier
  dependency-version: 3.9.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: auth-ui-package-updates
- dependency-name: typescript-eslint
  dependency-version: 8.64.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: auth-ui-package-updates
- dependency-name: vite
  dependency-version: 8.1.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: auth-ui-package-updates
...

Signed-off-by: dependabot[bot] <support@github.com>

* Update generated files

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: vincbeck <vincbeck@amazon.com>

* Add Asset Tab plugin (#69986)

* Add Asset Tab plugin

* Delete test_plugins.py

* [AIP-94] Add filters and pagination to airflowctl jobs list (#68616)

* Support legacy list-jobs filters in airflowctl jobs list

* Always default jobs list ordering to most recent start date

Previously the default order_by switched between the API default and
-start_date depending on whether --limit was given, making the output
ordering hard to predict. The legacy airflow dags list-jobs command
always ordered by start_date descending, so apply that default
unconditionally.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* Add AWS services toolset for agents to access 1000+ APIs (#70087)

* Add AWS services toolset for agents to access 1000+ APIs

* Fix basic tests

* Fix basic tests

* Move to helpers

* resolve comments

* Add more tests

* Update description

* parametrize tests

* Fix task instance mark success downstream default (#67763)

* Add worker-name filter to `airflow edge list-workers` (#70095)

* get the name pattern for the list-workers

* Rename list-workers name filter flag to --worker-name-pattern

Match the existing worker_name_pattern naming already used by the edge
REST/UI routes for consistency.

* Fix dag.test() dropping defer-time kwargs when trigger yields an event (#69942)

When DAG.test() runs a deferred task's trigger inline and the trigger
yields an event, the kwargs passed at defer() time were discarded and
replaced with only {"event": ...}. The resume method then ran with its
default argument values.

This broke example_neptune_analytics on the deferrable path:
NeptuneCreatePrivateGraphEndpointOperator defers with
kwargs={"vpc_id": self.vpc_id} and resumes into
execute_complete(..., vpc_id=""). The lost vpc_id fell back to "" and
was pushed to XCom; the downstream delete_endpoint task built a malformed
request URI (/graphs/<id>/endpoints/) and the service rejected it with
AccessDeniedException: Unable to determine service/operation name to be
authorized.

Merge the event into the deferral's next_kwargs instead of replacing
them, mirroring the production resume path in airflow.models.trigger.
Add a regression test.

* TriggerRunner: Add batch trigger creation duration metric (#68521)

Add a timing metric that records the time spent creating all pending triggers during a single create_triggers() invocation. Also, add a unit test verifying that the metric is emitted with the expected tags when triggers are successfully created.

* Bump axios in /providers/edge3/src/airflow/providers/edge3/plugins/www (#70145)

Bumps [axios](https://github.com/axios/axios) from 1.17.0 to 1.18.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.17.0...v1.18.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.18.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Remove airflow.utils dependency from Docker provider (#69900)

* Document that Code view shows only Python source for stub tasks (#70155)

* Remove deprecated dataset aliases (#70154)

Co-authored-by: SHIVANSH-ux-ys <singaser78@gmail.com>
Signed-off-by: viiccwen <vicwen@apache.org>

* Use canonical serde imports in tests (#70162)

Signed-off-by: viiccwen <vicwen@apache.org>

* Fix flaky static checks caused by migration-reference hook race (#70170)

The update-migration-references, -fab, and -edge3 hooks live in three
different prek workspaces that run in parallel, yet each invocation
processed all three apps and rewrote every migration file and
migrations-ref.rst even when nothing changed. Concurrent containers
racing on the same files intermittently failed CI static checks with
'revision = not found' when a reader caught a file mid-write.

Scope each hook to its own app and write files only when the content
actually changed, so no two hooks touch the same files.

* Add toolset as a provider module category (#70122)

* Fix toolsets python-modules check for common.ai provider (#70181)

* Harden common.ai SQLToolset allowed_tables against function/COPY bypass (#70134)

SQLToolset(allowed_tables=[...]) restricts which tables an LLM agent's SQL
can reach, but the check only inspected table references. A SQL function
whose argument is a file path or a SQL string carries no table node, so
pg_read_file('/etc/passwd'), query_to_xml('SELECT ... FROM other_table'),
and COPY ... FROM PROGRAM (under allow_writes) slipped past the guardrail.

collect_table_references now rejects COPY and -- fail-closed -- every
function sqlglot cannot type (exp.Anonymous), the channel those functions
use. Ordinary builtins (count, lower) are recognised and pass; a legitimate
unrecognised function (json_build_object) or a project UDF is permitted via
the new allowed_functions parameter. This avoids maintaining an unbounded
denylist of dangerous names and matches the module's allowlist philosophy:
an incomplete allow-list refuses a query, it never leaks.

The guardrail stays best-effort: a least-privilege database role remains the
hard boundary, and the docs, docstrings, and SQL example DAG lead with that
guidance.

---------

Signed-off-by: PoAn Yang <payang@apache.org>
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Maciej Obuchowski <maciej.obuchowski@datadoghq.com>
Signed-off-by: viiccwen <vicwen@apache.org>
Co-authored-by: Vincent Kling <vkling@vinniict.nl>
Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com>
Co-authored-by: Sebastián Ortega <sebastian.ortegatorres@datadoghq.com>
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com>
Co-authored-by: Andrew Chang <69671930+Andrushika@users.noreply.github.com>
Co-authored-by: Jake McGrath <116606359+jroachgolf84@users.noreply.github.com>
Co-authored-by: Yuseok Jo <yuseok89@gmail.com>
Co-authored-by: Daniel Standish <15932138+dstandish@users.noreply.github.com>
Co-authored-by: Niko Oliveira <onikolas@amazon.com>
Co-authored-by: Aaron Chen <nailo2c@gmail.com>
Co-authored-by: Przemysław Mirowski <17602603+Miretpl@users.noreply.github.com>
Co-authored-by: Guan-Ming Chiu <105915352+guan404ming@users.noreply.github.com>
Co-authored-by: Amitesh Gupta <143833521+singlaamitesh@users.noreply.github.com>
Co-authored-by: PoAn Yang <payang@apache.org>
Co-authored-by: Christos Bisias <christosbis@gmail.com>
Co-authored-by: SameerMesiah97 <75502260+SameerMesiah97@users.noreply.github.com>
Co-authored-by: Dheeraj Turaga <dheerajturaga@gmail.com>
Co-authored-by: Jason(Zhe-You) Liu <68415893+jason810496@users.noreply.github.com>
Co-authored-by: Tzu-ping Chung <uranusjr@gmail.com>
Co-authored-by: Morgan <62363051+AlejandroMorgante@users.noreply.github.com>
Co-authored-by: Vic Wen <vicwen@apache.org>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
Co-authored-by: Hojeong Park <parkhj062@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: AutomationDev85 <96178949+AutomationDev85@users.noreply.github.com>
Co-authored-by: Malte Niederstadt <116146665+MalteNiederstadt@users.noreply.github.com>
Co-authored-by: Malte Niederstadt <M.Niederstadt@deutsche-glasfaser.de>
Co-authored-by: Noah Gil <98035801+noah-gil@users.noreply.github.com>
Co-authored-by: MOHAMMED HANAN M T P <91409429+hanu-14@users.noreply.github.com>
Co-authored-by: hanu-14 <mohdhanan23@outlook.com>
Co-authored-by: Nikolaus Schuetz <nikolauspschuetz@gmail.com>
Co-authored-by: nagasrisai <59650078+nagasrisai@users.noreply.github.com>
Co-authored-by: ykuc <140019825+ykuc@users.noreply.github.com>
Co-authored-by: Aaryan Mahajan <aaryanmhjn@gmail.com>
Co-authored-by: 조현준 <101855229+aaiss0927@users.noreply.github.com>
Co-authored-by: Ephraim Anierobi <splendidzigy24@gmail.com>
Co-authored-by: Henry Chen <henrychen@apache.org>
Co-authored-by: Deepak kumar <deepakkumar@meta.com>
Co-authored-by: Maciej Obuchowski <obuchowski.maciej@gmail.com>
Co-authored-by: Shivam Rastogi <6463385+shivaam@users.noreply.github.com>
Co-authored-by: Hussein Awala <hussein@awala.fr>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: vincbeck <vincbeck@amazon.com>
Co-authored-by: Brent Bovenzi <brent@astronomer.io>
Co-authored-by: GPK <gopidesupavan@gmail.com>
Co-authored-by: Aditya Patel <125534950+Codingaditya17@users.noreply.github.com>
Co-authored-by: Shubham Raj <48172486+shubhamraj-git@users.noreply.github.com>
Co-authored-by: Sean Ghaeli <58916776+seanghaeli@users.noreply.github.com>
Co-authored-by: Shae Alhusayni <shae.alh@gmail.com>
Co-authored-by: SHIVANSH-ux-ys <singaser78@gmail.com>
Co-authored-by: Wei Lee <weilee.rx@gmail.com>
potiuk added a commit that referenced this pull request Jul 30, 2026
…tatic checks (#70007)

* Flag missing conn-fields when hook-only files change in static checks

* Add missing Dutch translations (#68742)

* Add missing  Dutch translations

* Fix common.ai durable execution skipping Toolset-capability tools (#69881)

When durable=True, tools supplied via a pydantic-ai Toolset capability
(capabilities=[Toolset(ts)]) bypassed the CachingToolset applied to
toolsets=, so their results re-executed on every retry instead of
replaying. Wrap the inner toolset of concrete Toolset capabilities with
the same CachingToolset. A Toolset capability backed by a callable
factory can't be wrapped (it resolves per run) and now logs a warning.

Also fixes two latent durable-execution bugs found in review:

- cleanup() ran before the message-history XCom push and output
  serialization. A failure in either wiped the cache, so the retry
  re-ran every already-completed step. Move cleanup to after them.

- the pre-3.3 ObjectStorage cache filename joined dag/task/run with "_",
  aliasing distinct tasks (dag "etl"/task "load_data" and dag
  "etl_load"/task "data" both mapped to one file, so one task could
  read, overwrite, or delete another's cache). Hash the identity
  components instead.

* Don't deactivate DAG bundles owned by other dag-processors (#69964)

`DagBundlesManager.sync_bundles_to_db()` marks every stored bundle that is
not in the calling process's config as inactive. This assumes the caller
sees the complete bundle configuration.

When multiple dag-processors are each configured with a partial config (one
bundle per processor, a natural way to shard parsing), each processor treats
the other processors' bundles as "no longer found in config" and disables
them. Processor A disables B's bundle, B disables A's, and they flip
`dag_bundle.active` on every parse cycle -- the deployment never converges
and continuously logs "DAG bundle ... is no longer found in config and has
been disabled" for bundles that are actively configured elsewhere.

Add a `deactivate_missing` flag (default `True`, preserving existing
single-processor behavior) and have `DagFileProcessorManager.sync_bundles()`
pass `deactivate_missing=False` when the processor was started with a bundle
filter (`--bundle-name` / `bundle_names_to_parse`), i.e. when it only owns a
subset of the bundles.

closes: #69963
related: #69698

Generated-by: Claude Code following the guidelines

* Authorize Dag reparse against the file's Dags, not the query-string dag_id (#69471)

* Authorize Dag reparse against the file's Dags, not the query-string dag_id

The PUT /parseDagFile/{file_token} endpoint authorized the caller through a route dependency that, with no dag_id path parameter, resolves the target from the query string, which is decoupled from the Dag file the signed file_token actually resolves to.

Add a requires_access_dag_from_file_token dependency that decodes the token, resolves the Dags defined in that file, and authorizes the caller against exactly those Dags, so authorization always matches the Dag being reparsed regardless of any request parameter.

* Update airflow-core/src/airflow/api_fastapi/core_api/security.py

Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com>

* Fix CI

---------

Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com>

* Restore graph task and group coloring via Chakra palette tokens (#68760)

* Restore graph task and group coloring via Chakra palette tokens

Custom operator and TaskGroup colors disappeared in Airflow 3: the
ui_color/ui_fgcolor attributes were kept but the new UI ignored them, so
teams that relied on color to parse large graphs at a glance lost that
signal (see the demand on the linked issue).

Bring the coloring back in a way that fits the new opinionated theming:
the value must be a Chakra palette token (e.g. blue.500), which resolves
through a theme-controlled CSS variable and therefore stays legible in
both light and dark mode and under custom themes -- the dark-mode and
accessibility concerns that drove the original removal. The graph paints
the node fill from ui_color and the operator label from ui_fgcolor, as in
Airflow 2.x, while the border keeps showing run state. Legacy hex/named
values can no longer adapt to the theme, so they are ignored by the graph
and emit a warning for user-authored operators and task groups.

* Color task groups in the graph view, including when expanded

ui_color and ui_fgcolor are documented as the fill and label colors of a
TaskGroup node, and Airflow 2.x painted them, but the graph excluded groups
from the custom fill and dropped the colors entirely once a group was
expanded. Treat groups like leaf tasks so a token-valued group color renders
its fill and label in both the collapsed and expanded states.

* Accept raw hex colors and Chakra tokens for graph node coloring

Review feedback asked to keep the Airflow 2 behavior where ui_color and ui_fgcolor accept a raw color (a hex code or CSS name) in addition to Chakra palette tokens, so existing Dags keep their graph colors without any change. Dark-mode color variants are deferred to a follow-up.

* Adjustments

* Fix unreadable graph task text on light custom colors in dark mode

The task icon and label fell back to the theme's default foreground for Chakra token fills, so a light token such as yellow.200 rendered light text on a light fill in dark mode. Deriving the text color from the resolved fill measures tokens too, so contrast holds for hex, CSS names, and tokens alike.

* Update task group graph test fixture for restored node colors

The graph serializer now emits each node's ui_color/ui_fgcolor for task
and group nodes, so the expected graph fixture must include them; join
nodes stay uncolored. The fixture was stale and omitted these fields,
failing test_task_group_to_dict_serialized_dag and
test_task_group_to_dict_alternative_syntax.

* Document semantic theme tokens for ui_color and ui_fgcolor

The graph node color attributes accept theme-aware semantic tokens (e.g.
brand.solid) that adapt to light and dark mode, in addition to palette tokens
and raw colors — but the docs only mentioned palette tokens, so users had no
pointer to the semantic tokens available in the UI theme.

* Skip Go SDK CI jobs for doc-only changes under go-sdk/ (#70021)

go-sdk/*.md edits (README, ADRs) currently match the Go SDK file groups
and trigger the Go unit + e2e suites plus a prod image build, none of
which a documentation change can affect. Excluding .md also lets
non-.go build files (go.mod, go.sum, build config) trigger the unit
tests, which the previous .go-only pattern missed.

* Enhance/standardize documentation for `AssetOrTimeSchedule` (#69831)

* UI: Lazy-mount the pause confirmation dialog on Dag cards and rows (#70016)

* Skip ts-sdk supervisor schema check for doc-only changes (#70022)

ts-sdk/*.md edits (e.g. README) currently match TS_SDK_FILES and keep
the check-ts-sdk-supervisor-schema prek hook from being skipped, so a
documentation-only change needlessly regenerates and diffs the
generated supervisor schema. Documentation does not affect it.

* Use atomic upsert for asset run queue on MySQL to avoid deadlocks (#69977)

Under concurrent asset-event fan-out, the per-row SAVEPOINT loop used for
non-PostgreSQL backends deadlocks on MySQL/InnoDB and surfaces confusing
"SAVEPOINT ... does not exist" errors, and the deadlock is not retried.
Route MySQL to a single-statement INSERT ... ON DUPLICATE KEY UPDATE,
mirroring the existing PostgreSQL path, so the enqueue is atomic and holds
locks far more briefly.

closes: #69938

* Pin task bundle manifest to the dagrun's version (#69941)

A mid-run DAG re-parse possibly creates a new DagVersion and bumps
not-yet-started task instances' dag_version_id, while the DagRun
stays pinned to its original bundle_version. ExecuteTask.make()
sourced the bundle version from the run's pin (dag_run.bundle_version)
but bundle version_data from the task's now-bumped dag_version,
so the workload shipped a hash and a manifest that describe
different versions. This double source was noticed for the callback
path in a previous PR, but the task path was missed.

Source version_data from the run's pinned created_dag_version so it always
matches the bundle version, mirroring ExecuteCallback.make() and the way Git
bundles resolve everything from the run's pinned commit.

* Allow configuring XCom sidecar container security context (#69613)

* Allow configuring XCom sidecar container security context

* fix CI error

* fix CI error #2

* Update providers/cncf/kubernetes/src/airflow/providers/cncf/kubernetes/operators/pod.py

Co-authored-by: Przemysław Mirowski <17602603+Miretpl@users.noreply.github.com>

* fix CI error

---------

Co-authored-by: Przemysław Mirowski <17602603+Miretpl@users.noreply.github.com>

* Add missing newsfragment to Helm Chart (#70043)

* Remove duplicated newsfragments

* Add missing newsfragments

* Consolidate Airflow version newsfragment

* Update doc (#70047)

* Fix `@task.llm_branch` import failure on Task SDK-only workers (#70068)

* Reject unsupported require_approval in LLM branch and schema compare operators (#70069)

* Fix stale docs.sqlalchemy.org/en/14 pooling link in config.yml (#69751)

* Java SDK: Throw MissingXComException instead of NPE for absent XComs (#69257)

Signed-off-by: PoAn Yang <payang@apache.org>

* Rename Kafka Listener to Kafka Event Producer and update the documentation (#70014)

* Set stream=False for Snowflake Cortex Agent requests. (#69731)

* Send Airflow CLI logs to stderr for -o commands so structured output stays parseable (#68598)

* Document task subprocess lifecycle and pre-connect log buffer (#70076)

* Enhancing docs for `HttpEventTrigger` (#70073)

* docs/http-event-trigger: Enhancing docs for HttpEventTrigger

* Apply suggestions from code review

Co-authored-by: Tzu-ping Chung <uranusjr@gmail.com>

---------

Co-authored-by: Tzu-ping Chung <uranusjr@gmail.com>

* Add Amazon ECR repository operators (#69886)

* Prevent negative trigger queue delay metrics (#69971)

* Bump the uv-dependency-updates group in /dev/breeze with 2 updates (#70033)

Bumps the uv-dependency-updates group in /dev/breeze with 2 updates: [gitpython](https://github.com/gitpython-developers/GitPython) and [prek](https://github.com/j178/prek).

Updates `gitpython` from 3.1.50 to 3.1.51
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](https://github.com/gitpython-developers/GitPython/compare/3.1.50...3.1.51)

Updates `prek` from 0.4.8 to 0.4.9
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](https://github.com/j178/prek/compare/v0.4.8...v0.4.9)
(cherry picked from commit ffe49c77d25d32284eb01fc9eb3187ec87b5b39f)

Co-authored-by: David Blain <info@dabla.be>

---
updated-dependencies:
- dependency-name: gitpython
  dependency-version: 3.1.51
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-dependency-updates
- dependency-name: prek
  dependency-version: 0.4.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-dependency-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump the github-actions-updates group across 1 directory with 9 updates (#70040)

Bumps the github-actions-updates group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/setup-java](https://github.com/actions/setup-java) | `5.4.0` | `5.5.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.0.0` |
| [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) | `3.0.3` | `3.0.5` |
| [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.2.1` | `6.2.2` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.2` | `4.37.0` |
| [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.36.2` | `4.37.0` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.2` | `4.37.0` |
| [actions/stale](https://github.com/actions/stale) | `10.3.0` | `10.4.0` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `8.2.0` | `8.3.2` |

Updates `actions/setup-java` from 5.4.0 to 5.5.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](https://github.com/actions/setup-java/compare/1bcf9fb12cf4aa7d266a90ae39939e61372fe520...0f481fcb613427c0f801b606911222b5b6f3083a)

Updates `actions/setup-node` from 6.4.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020)

Updates `slackapi/slack-github-action` from 3.0.3 to 3.0.5
- [Release notes](https://github.com/slackapi/slack-github-action/releases)
- [Changelog](https://github.com/slackapi/slack-github-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/slackapi/slack-github-action/compare/45a88b9581bfab2566dc881e2cd66d334e621e2c...0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc)

Updates `aws-actions/configure-aws-credentials` from 6.2.1 to 6.2.2
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](https://github.com/aws-actions/configure-aws-credentials/compare/254c19bd240aabef8777f48595e9d2d7b972184b...517a711dbcd0e402f90c77e7e2f81e849156e31d)

Updates `github/codeql-action/init` from 4.36.2 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

Updates `github/codeql-action/autobuild` from 4.36.2 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

Updates `github/codeql-action/analyze` from 4.36.2 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9)

Updates `actions/stale` from 10.3.0 to 10.4.0
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/stale/compare/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899...1e223db275d687790206a7acac4d1a11bd6fe629)

Updates `astral-sh/setup-uv` from 8.2.0 to 8.3.2
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](https://github.com/astral-sh/setup-uv/compare/fac544c07dec837d0ccb6301d7b5580bf5edae39...11f9893b081a58869d3b5fccaea48c9e9e46f990)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-updates
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-updates
- dependency-name: slackapi/slack-github-action
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-updates
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: 6.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-updates
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-updates
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-updates
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-updates
- dependency-name: actions/stale
  dependency-version: 10.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-updates
- dependency-name: astral-sh/setup-uv
  dependency-version: 8.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Fix CI integration tests gated by the wrong platform (#70015)

Signed-off-by: PoAn Yang <payang@apache.org>

* Fix mypy prek hooks skipping all files in dot-directory (#70064)

Signed-off-by: PoAn Yang <payang@apache.org>

* Document 3.3.0 image databricks constraint fix in Dockerfile changelog (#70083)

Record in the 'Changes after publishing the images' table that the 3.3.0 Python 3.11/3.12 images had their downgraded databricks stack corrected (provider 6.13.0 -> 7.16.1, connector 2.0.2 -> 4.2.5, thrift 0.23.0 -> 0.16.0).

related: #69603

* Fix DocumentLoaderOperator ignoring unknown parser on byte input (#70071)

* Fix DocumentLoaderOperator ignoring unknown parser on byte input

* Validate explicit parser in _resolve_backend

* Send TS SDK logs to stderr on socket disconnect (#69302)

* Send TypeScript SDK logs to stderr when the log socket disconnects

Co-authored-by: Jason(Zhe-You) Liu <68415893+jason810496@users.noreply.github.com>

* Harden TS SDK log channel shutdown

* Unref log channel close flush timer so it cannot delay process exit

---------

Co-authored-by: Jason(Zhe-You) Liu <68415893+jason810496@users.noreply.github.com>

* Build Go SDK e2e example bundle natively in CI (#69909)

* Build Go SDK e2e example bundle natively in CI

* Capture build output and remove path duplication in Go SDK e2e bundle build

The native/containerized build branch was inlined with no output capture, so a
failed CI build surfaced only a bare traceback, unlike the Java SDK's helper
which prints the build log on failure. The containerized path also hardcoded
/repo/go-sdk/bin instead of deriving it from the already-imported
GO_SDK_ROOT_PATH/GO_SDK_BIN_PATH constants, and the Go build cache key ignored
go.mod so a toolchain bump alone wouldn't invalidate it.

* i18n(ko): translate Dag list run-state filter labels (#69781)

* Preserve output_type through human approval in LLM operators (#70075)

* Preserve output_type through human approval in LLM operators

* Cover BaseModel in output_type restore test

* Clarify the dags reserialize command scope (#69810)

* Add Task SDK, Go and Java SDK execution architecture diagrams (#69750)

* Add Task SDK, Go and Java SDK execution architecture diagrams

Add graphviz-generated diagrams to the architecture overview showing how a
task actually runs across the different SDKs, and embed them in
core-concepts/overview.rst:

- Python Task SDK: supervised (two native OS processes over a msgpack socket)
  vs native/in-process paths, plus a numbered message-flow sequence.
- Go SDK: standalone edge worker pulling from the Edge API, task talks to the
  Execution API directly.
- Java (JVM) SDK: Coordinator layer reusing the Python Supervisor, driving a
  JVM subprocess over loopback TCP, with an architecture diagram and a numbered
  execution-workflow sequence.

* Draw Task and Java SDK execution flows as true sequence diagrams

The message-flow diagrams added earlier in this PR drew every step on a single
vertical spine, so the request/response round-trips between the task runtime and
the Supervisor were hard to follow. Responding to review feedback, redraw them
as true sequence diagrams — one lifeline per participant with the Supervisor in
the middle — so each round-trip reads as arrows going back and forth between
neighboring lifelines, with straight message arrows and margined labels.

* Discount CI image-build time from duration-trend alerts (#69789)

* Discount CI image-build time from duration-trend alerts

The CI duration monitor folded the "Prepare breeze & CI image" step into
each job's total. That step occasionally balloons on a one-off cache miss
(a full image rebuild instead of a cached pull), which repeatedly flagged
unrelated jobs as regressed — e.g. a Non-DB core job reported +190% driven
almost entirely by an 18m image build, while its actual test time was flat.

Image-build time is now excluded from the run and per-job durations used
for the trend, and the image build is watched on its own: it is only
reported when it has stayed slow for more than two days, so a transient
rebuild spike no longer produces a false alert.

* Apply naming nits: prefix duration helpers with calculate_

Rename work_duration -> calculate_work_duration,
run_image_build_seconds -> calculate_image_build_seconds,
adjusted_run_duration -> calculate_adjusted_run_duration for a
consistent calculate_ prefix on the duration-computing helpers.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* Clarify AssetPartitionDagRun provisional-run docstring (#69982)

The previous wording ("we should not allow more than one like this") did not
state the actual invariant. Make explicit that rows are never deleted — so
multiple records per target_dag_id/partition_key are expected — and that the
constraint is specifically at most one row with a null created_dag_run_id,
which the _lock_asset_model mutex enforces.

* fix/issue-70020: Adding cap to cloudpickle (#70086)

* Bring back edge worker metric compatibility with Airflow 3.2 (#67328)

* Bring back edge worker DualStatusManager compability

* Reworked statsd taging for pre airflow 3.3 versions

* Fix mypy

* document metrics compability issues

* fix doc

* Fix docu and added unit test

* Fix imports

* Fix unit test

* Fix flaky unit tests by reset after test execution

---------

Co-authored-by: AutomationDev85 <AutomationDev85>

* Replace vars(response) with attribute access in Azure Data Factory and Synapse operators for SDK v10 compatibility (#69689)

* fix(providers/azure): use attribute access instead of vars() for SDK v10 hybrid model compat

* added regression tests for azure data factory and azure synapse operators

* Fix ruff formatting in test_synapse.py

---------

Co-authored-by: Malte Niederstadt <M.Niederstadt@deutsche-glasfaser.de>

* Bump eslint (#70032)

Bumps the eslint group with 1 update in the /airflow-core/src/airflow/ui directory: [eslint](https://github.com/eslint/eslint).

Updates `eslint` from 10.6.0 to 10.7.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.6.0...v10.7.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 10.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: eslint
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* cncf-kubernetes: fix potential race condition in trigger_reentry flow caused by `is_istio_enabled` (#69269)

* Gracefully return istio check if pod is removed

This is meant to catch a potential race condition in the
`trigger_reentry` flow. There is already a check that the pod still
exists in the event of a success, but it is still possible for the pod
to be removed during the first and second API read. Should this happen,
we should return the same way as if no pod was provided to the function.

* Add log for missing pod in istio check

---------

Co-authored-by: Przemysław Mirowski <17602603+Miretpl@users.noreply.github.com>

* Upgrade http to https in PR template (#70063)

* Update SQLAlchemy documentation link from 1.4 to 2.0

* fix: upgrade http:// to https:// in .github/PULL_REQUEST_TEMPLATE.md

---------

Co-authored-by: hanu-14 <mohdhanan23@outlook.com>

* Make schema_fields templated in GCSToBigQueryOperator (#69108)

schema_fields was not a template field, so a templated value (a Variable
or XComArg resolving to a schema) passed to GCSToBigQueryOperator was never
rendered and reached BigQuery unresolved. Mark it templated, matching how
BigQueryUpdateTableSchemaOperator already templates schema_fields_updates.

* docs: fix stale Airflow 2.0 references in dev/README.md (#69961)

* docs: fix stale Airflow 2.0 references in dev/README.md

* docs: fix official_source typo and missing space in dev/README.md

Two small typos flagged in #69902 that were missed in the initial commit:
- Line 92: "official_source releases" -> "official source releases"
- Line 99: '"apache-airflow-providers"separately' -> '"apache-airflow-providers" separately'

* Refactor get_statsd_logger to use keyword arguments for clarity and add a test for ipv6 support in StatsD logger (#69632)

* Let area:e2e-tests label force the airflow-e2e-tests suite (#69993)

* Let area:e2e-test label force Airflow E2E tests

Contributors validating changes whose impact selective-checks' file heuristics miss otherwise have to request the full test matrix. A focused area label lets them run the standard Airflow E2E suite without unrelated test jobs.

* Use the plural E2E tests area label

* Automate keeping documented "tested with" versions in sync with the test matrix (#69124)

The Python, database and Kubernetes versions Airflow is tested with live in
global_constants.py, but are also listed by hand in the installation
prerequisites doc and the README. Those lists drifted: PostgreSQL 18 (and
MySQL 8.4) were added to the test matrix and the README, but the prerequisites
doc was forgotten, so it still advertised PostgreSQL up to 17.

Add a prek hook that regenerates the tested-versions block in prerequisites.rst
and the "Main version (dev)" column of the README from global_constants.py, so
this drift becomes an auto-fixable check failure instead of a silent doc bug.
Also correct the stale PostgreSQL and MySQL versions in prerequisites.rst.

Generated-by: Claude Code (Opus 4.8) following the guidelines

* Fix Breeze OpenLineage integration gate stuck on stale Postgres versions (#69264)

* Fix Breeze OpenLineage integration gate stuck on stale Postgres versions

The gate in enter_shell() hardcoded PostgreSQL 12/13/14 as the only
versions allowed with --integration openlineage, but Breeze's actual
matrix has moved to 14-18 (12 isn't even a valid choice anymore).
Derive the allowed set from CURRENT_POSTGRES_VERSIONS in
global_constants.py instead, so the gate can't drift out of sync with
the matrix again.

closes: #69233

* Cover --integration all in OpenLineage Postgres gate tests

Reviewer feedback on apache/airflow#69264: the gate also triggers on
"all" (not just "openlineage"), so the tests should exercise that path
too.

* Bump @visx/shape from 3.12.0 to 4.0.0 in /airflow-core/src/airflow/ui (#69722)

Bumps [@visx/shape](https://github.com/airbnb/visx) from 3.12.0 to 4.0.0.
- [Release notes](https://github.com/airbnb/visx/releases)
- [Changelog](https://github.com/airbnb/visx/blob/master/CHANGELOG.md)
- [Commits](https://github.com/airbnb/visx/compare/v3.12.0...v4.0.0)

---
updated-dependencies:
- dependency-name: "@visx/shape"
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Rename Task and Asset store to Task and Asset state store (#70097)

* i18n(ko): add missing translation for triggerDag.partitionKeyHelp (#70005)

* Add integration tests for coordinator-mode TypeScript tasks (#69328)

* Add integration tests for coordinator-mode TypeScript tasks

* Register ts_sdk e2e test mode in breeze CLI

* Exercise real airflow-ts-pack packing in TypeScript SDK e2e tests

The reviewer asked the e2e tests to wait for airflow-ts-pack and use its
real packing path. The example build now runs airflow-ts-pack, which embeds
the airflow metadata in bundle.mjs, so the hand-written
airflow-metadata.yaml sidecar would bypass the path users actually take.

* Trim ts_sdk e2e docstrings and comments to essentials

* Build TS SDK e2e example natively in CI and skip doc-only changes

* Suppress noisy Alembic plugin setup logs (#69916)

Alembic emits autogenerate plugin registration messages at INFO during CLI startup. Those unrelated lines contaminate machine-readable command output, while warnings and errors still need to remain visible.

* Fix ClickHouse test_connection unit test failing with newer clickhouse-connect (#70114)

* Fix ClickHouse test_connection unit test failing with newer clickhouse-connect

The assertion pinned the exact call signature that clickhouse_connect's
DB-API cursor uses internally, which changed in 1.4.x. Only the SQL sent
is relevant to what the test verifies, so the provider keeps working
across the whole supported clickhouse-connect range.

* Assert bound parameters too, not just the statement

Reviewer feedback: the statement and its parameters are Airflow's own
contract, so both belong in the assertion; only what the driver appends
on top of them is out of scope.

* Add running_pod_log_lines config option to KubernetesExecutor (#69301)

* Resolve conflict in KubernetesExecutor.__init__ and drop redundant comment

The running_pod_log_lines config addition conflicted with the
pod-launch-failure requeue state added to __init__ after this branch
diverged; keep both initializations. Also drops a comment that only
restated the line below it, per review feedback.

* Clarify fallback reference in KubernetesExecutor running_pod_log_lines

self.RUNNING_POD_LOG_LINES looked like a self-referential fallback since
it isn't set on the instance until this assignment completes; referencing
the class attribute directly makes clear it falls back to the class default.

* Bump the core-ui-package-updates group across 1 directory with 4 updates (#70037)

Bumps the core-ui-package-updates group with 4 updates in the /airflow-core/src/airflow/ui directory: [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual), [msw](https://github.com/mswjs/msw), [prettier](https://github.com/prettier/prettier) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).

Updates `@tanstack/react-virtual` from 3.14.5 to 3.14.6
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.6/packages/react-virtual)

Updates `msw` from 2.14.6 to 2.15.0
- [Release notes](https://github.com/mswjs/msw/releases)
- [Changelog](https://github.com/mswjs/msw/blob/main/CHANGELOG.md)
- [Commits](https://github.com/mswjs/msw/compare/v2.14.6...v2.15.0)

Updates `prettier` from 3.9.4 to 3.9.5
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.9.4...3.9.5)

Updates `vite` from 8.1.3 to 8.1.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.1.4/packages/vite)

---
updated-dependencies:
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: core-ui-package-updates
- dependency-name: msw
  dependency-version: 2.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: core-ui-package-updates
- dependency-name: prettier
  dependency-version: 3.9.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: core-ui-package-updates
- dependency-name: vite
  dependency-version: 8.1.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: core-ui-package-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* UI: Complete Hindi (hi) translation coverage (#70111)

Adds the missing Hindi translations so the locale reaches full coverage
against the current English source, well above the 90% completeness
threshold defined in airflow-core/src/airflow/ui/public/i18n/README.md.

Covers:
- common.json: preset filters, keyboard-shortcut help dialog, note
  edit/preview/write, dagRun.partitionDate.
- admin.json: variables import parsing status.
- components.json: triggerDag partitionKeyHelp.
- dags.json: any/last run-state filters and the run-state count block.
- dashboard.json: alert see more/less toggles and pluralized count.
- hitl.json: review drawer and required-action list strings.

Also removes stale Hindi keys that were renamed or dropped on the English
side (asset_other, dagWarnings.error_other, and four keyboard-shortcut
copies in dag.json) so the locale no longer carries unused entries.

* Document GlueJobOperator support for OpenLineage Spark injection (#69652)

Signed-off-by: Maciej Obuchowski <maciej.obuchowski@datadoghq.com>

* Add API endpoint for backfill dag run entries (#67381)

* Add GET /backfills/{backfill_id}/dag_runs endpoint

Adds a new public API endpoint that returns the BackfillDagRun entries
for a given backfill with joined DagRun state. Users can see what
happened in a backfill: which dates ran, their states (queued, running,
success, failed), and which slots were skipped (with reason).

- BackfillDagRunResponse / BackfillDagRunCollectionResponse models
- LEFT OUTER JOIN via joinedload includes skipped slots (null dag_run_id)
- Pagination via limit/offset, default ordering by sort_ordinal
- 404 when backfill doesn't exist
- 8 unit tests covering happy path, skipped slots, 404, pagination,
  empty backfill, and ordering contract

closes: #46250

* Align backfill dag run response identifiers

* Update Weaviate examples for client 4.16 API (#67343)

* Restore pluggable email backend for task failure and retry alerts (#69877)

Since #57354, task email_on_failure / email_on_retry alerts were routed
unconditionally through SmtpNotifier, silently ignoring the
[email] email_backend configuration. Custom backends (SES, SendGrid,
org-internal) stopped delivering failure/retry emails even though the
deprecated email_on_* parameters still worked.

This restores the old behaviour using the existing [email] email_backend
option -- no new configuration is introduced:

- A non-default [email] email_backend is transparently wrapped in a new
  LegacyEmailBackendNotifier, so existing SES / SendGrid / custom backends
  keep delivering alerts unchanged. The backend is resolved from config at
  notify time, so the Task SDK keeps no static dependency on
  airflow.utils.email.
- Otherwise the default SmtpNotifier is used, exactly as before.

The notifier lives in the Task SDK (airflow.sdk.execution_time.email_backend)
next to its only caller, so no extra provider needs to be installed for a
custom email backend to keep working.

Both failure-email entry points (the worker task-runner path and the
DAG-processor callback path) funnel through the same function, so the
selected backend is used consistently regardless of how the task failed.

The deprecated email_on_* parameters are not un-deprecated; this only keeps
their existing behaviour pluggable until removal in Airflow 4.

* Add partition_key and partition_key_regexp_pattern filters for asset events (#64610)

* Add partition_key and partition_key_pattern filters for asset events

Add two new query parameters to the asset events API endpoints:

- partition_key: exact-match filter leveraging the new composite
  B-tree index on (asset_id, partition_key)
- partition_key_pattern: regex-based filter using database-native
  regexp_match for flexible pattern matching

Includes Core API, Execution API, Task SDK (InletEventsAccessor),
client, documentation, migration for the composite index, and tests.

Made-with: Cursor

* Regenerate supervisor schema snapshot for partition_key filters

* Add ReDoS safeguards for partition_key_pattern regex filter

The pattern is evaluated by the database's regex engine, so a pathological
pattern could consume DB CPU (ReDoS). Mitigations:

- Cap the pattern length (MAX_REGEX_PATTERN_LENGTH) in both the Core and
  Execution API validators, returning 400 for over-long patterns.
- Bound the regex query with a transaction-local statement_timeout on
  PostgreSQL (apply_regex_query_timeout); no-op elsewhere. MySQL bounds
  regex evaluation via its built-in regexp_time_limit; SQLite has no
  server-side regex and MariaDB is unsupported.
- Document the safeguards in assets.rst.

* Gate regex query filters behind a config flag with configurable timeout

Add two [api] configs (Airflow 3.4.0):

- enable_regexp_query_filters (bool, default False): the partition_key_pattern
  filter passes a user-supplied regex to the database engine, which is a ReDoS
  vector, so it is disabled by default and must be explicitly enabled. Exact-match
  partition_key filtering is unaffected.
- regexp_query_timeout (int seconds, default 30): the primary runtime mitigation,
  enforced as a PostgreSQL transaction-local statement_timeout; 0 disables it.

When the flag is off, partition_key_pattern requests return HTTP 400 on both the
Core and Execution APIs. Config descriptions document the security rationale.
Adds tests for the disabled path and the timeout helper.

* Revert pattern length cap for regex filters

Drop MAX_REGEX_PATTERN_LENGTH; the opt-in flag and the PostgreSQL
statement_timeout are the meaningful ReDoS safeguards, and a length cap
does not stop short catastrophic patterns while risking false rejections
of legitimate ones.

* Fix CI: enable regex flag for by-alias tests, regenerate TS SDK schema

- Add the enable_regexp_query_filters conf_vars fixture to
  TestGetAssetEventByAssetAliasPartitionKey (was missed), fixing the 4
  by-alias regex tests that now hit the default-off flag; add a
  disabled->400 test for the alias endpoint too.
- Regenerate ts-sdk/src/generated/supervisor.ts for the partition_key /
  partition_key_pattern comms fields (check-ts-sdk-supervisor-schema).

* Address review feedback on partition key regexp filter

- Rename the public/SDK parameter partition_key_pattern ->
  partition_key_regexp_pattern to distinguish regexp filtering from the
  substring "*_pattern" filters on other APIs.
- Move the enable_regexp_query_filters gate into _RegexParam construction
  and the regex compile check into depends_regex, so a regexp filter can
  never be instantiated without the setting being enabled.
- Drop the mutually-exclusive 400 between partition_key and
  partition_key_regexp_pattern (both now combine with AND) on the Core and
  Execution APIs and in the Task SDK client/accessor.
- Reuse the shared QueryAssetEventPartitionKeyFilter/Regex params in the
  Execution API asset-event routes instead of duplicating the query params
  and validation.
- Keep backend implementation details out of the public parameter
  description; simplify the config docs; revert an unrelated limit check.
- Regenerate OpenAPI specs, UI TS clients, and the supervisor schema
  snapshots.

* Collapse regexp config into one setting and scope the query timeout

Address further review feedback:

- Replace the enable_regexp_query_filters + regexp_query_timeout pair with a
  single [api] regexp_query_timeout: 0 (default) disables regexp filtering
  entirely, any positive value enables it and bounds the query runtime. This
  removes the "enabled but unbounded" combination.
- Make apply_regex_query_timeout a context manager that sets a transaction-local
  statement_timeout on enter and resets it on exit, so the bound is scoped to
  the regexp query and does not leak to other statements in the request's
  transaction. Both asset-event routes apply it automatically around query
  execution instead of relying on a manual call in the view.

* Regenerate UI query client for partition_key_regexp_pattern rename

The hand-applied rename missed the type-block declarations and JSDoc in the
generated query hooks (they were not on lines matching the AssetEvents hook
name). Regenerate with `pnpm codegen` so the UI client matches the OpenAPI
spec, fixing the "Compile / format / lint UI" static check.

* Fix provide_session positional static check in partition-key tests

The check-no-new-provide-session-positional hook flagged the partition-key
regexp tests. The nine test methods never used the injected session, so drop
their @provide_session decorator and unused session parameter; make session
keyword-only in the _create_partition_key_test_data helper that does use it.

* Address review: MySQL query timeout, float config, doc link, test tidy-up

- Enforce regexp_query_timeout on MySQL too (session max_execution_time),
  not just PostgreSQL statement_timeout; apply_regex_query_timeout now
  branches by dialect and is a no-op on SQLite.
- Make [api] regexp_query_timeout a float so fractional seconds (e.g. 0.5)
  are allowed; read it via conf.getfloat.
- Link the config option in assets.rst via :ref: and note the MySQL bound.
- Tests: create partition-key rows via an autouse fixture instead of a
  per-test helper call, fold the exact-match cases into parametrized tests
  (core + execution API), and cover the MySQL/float timeout paths.

* Restore previous db timeout instead of clearing it

Address review nit: apply_regex_query_timeout now captures the current
statement_timeout (PostgreSQL) / max_execution_time (MySQL) before overriding
it and restores that value on exit, instead of resetting to 0. This preserves
a server- or role-level global timeout rather than clobbering it.

* Apply regexp query timeout automatically via the filter dependency

Address review feedback: instead of relying on each view to wrap its query in
apply_regex_query_timeout (easy to forget -> ReDoS), the regexp filter's
dependency (regex_param_factory) now applies the timeout to the request's
session itself. Any endpoint using QueryAssetEventPartitionKeyRegex is bounded
automatically. The dependency is function-scoped so it can depend on the
session it bounds; the previous timeout value is restored on teardown. Removes
the manual wrappers from the core and execution asset-event routes and adds
tests for the dependency behavior.

* Optionally emit Dag tags as metric tags (#68568)

* Emit Dag tags as metric tags

Add a [metrics] dag_tags_in_metrics option (default False). When enabled, each
Dag tag becomes a metric tag on Dag-run and task-instance metrics: tags with a
colon (e.g. env:prod) split into a key/value pair; plain tags (e.g. production)
become standalone DogStatsd tags, or tag=true in InfluxDB line protocol. Built-in
keys (dag_id, run_type, task_id, team_name) win on collision.

Tags come from the DagRun's dag_model.tags. The scheduler hot loop
(get_running_dag_runs_to_examine) and the executor-event failure path eager-load
them (gated on the flag) to avoid per-DagRun queries; other in-session emission
paths fall back to a lazy load, so the tags reach all Dag-run and task-instance
metrics. DagRun.dag_tags_for_stats swallows SQLAlchemyError so a detached/expired
instance degrades to no tags rather than breaking the caller.

TaskInstance.stats_tags reuses DagRun.dag_tags_for_stats and adds task_id and
run_type; the Task SDK worker reads the in-memory Dag and also adds run_type, so
ti.* metrics carry a consistent tag set across the worker and scheduler emitters.

The build_dag_metric_tags helper lives in the shared observability stats module.

* Address review feedback on Dag tags metric emission

Keep the scheduler hot path free of per-task conf reads. Warm the dag tags via the existing
TaskInstance -> DagModel join rather than an extra dag_run hop, since the
DagModel is shared in the identity map. Fold the repeated dogstatsd tag-list
guard into a single helper, and consolidate the tag-formatting tests.

* Address further review nits on Dag tags metric emission

Make session a keyword-only argument on get_running_dag_runs_to_examine, in
line with the convention for session parameters. Reduce TaskInstance.stats_tags
to the dag run's tags plus the task-level ones, keeping the TI's transiently
resolved team_name when present.

* Source task instance team_name metric tag from the dag run

TaskInstance.stats_tags already reuses the dag run's stats tags, so take
team_name from there too rather than from a separate per-task transient
attribute, keeping a single source of truth for the tag.

The scheduling loop now stashes the resolved team on the dag run so
task-instance metrics still carry it. The heartbeat-purge path already tags
team inline, so its now-redundant per-task assignment is dropped.

* Add ADR-0006: no Lang-SDK source display for mixed-language (@task.stub) Dag (#70059)

* Add ADR-0006: no Lang-SDK source display for stub DAGs

* Drop the per-Dag source slicing argument from ADR-0006

That point argued against per-Dag filtering of the source view, but that
shape is essentially the upcoming per-file get_source_code on the AIP-85
DagImporter interface, so it is not a reason for this decision and would
read as pre-judging that work.

* [main] Upgrade important CI environment (#69999)

* [main] CI: Upgrade important CI environment

* Fix plugin validation type check for mypy 2.3.0

mypy 2.3.0 narrows the `inspect.isclass()` guard to `type[object]`, which does
not carry `validate`, so the four shared distributions that symlink
plugins_manager.py failed static checks. The MRO check immediately above
already establishes the class is an AirflowPlugin by name -- it cannot use
issubclass() because the shared library is reachable under two module paths --
so make that knowledge explicit to the type checker.

* Fix breeze tag listing type check for GitPython 3.1.52

GitPython 3.1.52 types `git.ls_remote` as the full union of git-command
return shapes, so mypy no longer accepts calling `splitlines()` on it and the
four static-check hooks that type-check dev/breeze failed. With plain
arguments the call always returns the command output, so say so.

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

* Bump the auth-ui-package-updates group across 1 directory with 9 updates (#70105)

* Bump the auth-ui-package-updates group across 1 directory with 9 updates

Bumps the auth-ui-package-updates group with 9 updates in the /airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui directory:

| Package | From | To |
| --- | --- | --- |
| [@7nohe/openapi-react-query-codegen](https://github.com/7nohe/openapi-react-query-codegen) | `2.1.0` | `2.2.0` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.62.1` | `8.64.0` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.62.1` | `8.64.0` |
| [@typescript-eslint/utils](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/utils) | `8.62.1` | `8.64.0` |
| [eslint](https://github.com/eslint/eslint) | `10.6.0` | `10.7.0` |
| [eslint-plugin-perfectionist](https://github.com/azat-io/eslint-plugin-perfectionist) | `5.9.1` | `5.10.0` |
| [prettier](https://github.com/prettier/prettier) | `3.9.4` | `3.9.5` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.62.1` | `8.64.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.3` | `8.1.4` |

Updates `@7nohe/openapi-react-query-codegen` from 2.1.0 to 2.2.0
- [Release notes](https://github.com/7nohe/openapi-react-query-codegen/releases)
- [Commits](https://github.com/7nohe/openapi-react-query-codegen/compare/v2.1.0...v2.2.0)

Updates `@typescript-eslint/eslint-plugin` from 8.62.1 to 8.64.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.64.0/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.62.1 to 8.64.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.64.0/packages/parser)

Updates `@typescript-eslint/utils` from 8.62.1 to 8.64.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/utils/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.64.0/packages/utils)

Updates `eslint` from 10.6.0 to 10.7.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.6.0...v10.7.0)

Updates `eslint-plugin-perfectionist` from 5.9.1 to 5.10.0
- [Release notes](https://github.com/azat-io/eslint-plugin-perfectionist/releases)
- [Changelog](https://github.com/azat-io/eslint-plugin-perfectionist/blob/main/changelog.md)
- [Commits](https://github.com/azat-io/eslint-plugin-perfectionist/compare/v5.9.1...v5.10.0)

Updates `prettier` from 3.9.4 to 3.9.5
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.9.4...3.9.5)

Updates `typescript-eslint` from 8.62.1 to 8.64.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.64.0/packages/typescript-eslint)

Updates `vite` from 8.1.3 to 8.1.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.1.4/packages/vite)

---
updated-dependencies:
- dependency-name: "@7nohe/openapi-react-query-codegen"
  dependency-version: 2.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: auth-ui-package-updates
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.64.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: auth-ui-package-updates
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.64.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: auth-ui-package-updates
- dependency-name: "@typescript-eslint/utils"
  dependency-version: 8.64.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: auth-ui-package-updates
- dependency-name: eslint
  dependency-version: 10.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: auth-ui-package-updates
- dependency-name: eslint-plugin-perfectionist
  dependency-version: 5.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: auth-ui-package-updates
- dependency-name: prettier
  dependency-version: 3.9.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: auth-ui-package-updates
- dependency-name: typescript-eslint
  dependency-version: 8.64.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: auth-ui-package-updates
- dependency-name: vite
  dependency-version: 8.1.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: auth-ui-package-updates
...

Signed-off-by: dependabot[bot] <support@github.com>

* Update generated files

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: vincbeck <vincbeck@amazon.com>

* Add Asset Tab plugin (#69986)

* Add Asset Tab plugin

* Delete test_plugins.py

* [AIP-94] Add filters and pagination to airflowctl jobs list (#68616)

* Support legacy list-jobs filters in airflowctl jobs list

* Always default jobs list ordering to most recent start date

Previously the default order_by switched between the API default and
-start_date depending on whether --limit was given, making the output
ordering hard to predict. The legacy airflow dags list-jobs command
always ordered by start_date descending, so apply that default
unconditionally.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* Add AWS services toolset for agents to access 1000+ APIs (#70087)

* Add AWS services toolset for agents to access 1000+ APIs

* Fix basic tests

* Fix basic tests

* Move to helpers

* resolve comments

* Add more tests

* Update description

* parametrize tests

* Fix task instance mark success downstream default (#67763)

* Add worker-name filter to `airflow edge list-workers` (#70095)

* get the name pattern for the list-workers

* Rename list-workers name filter flag to --worker-name-pattern

Match the existing worker_name_pattern naming already used by the edge
REST/UI routes for consistency.

* Fix dag.test() dropping defer-time kwargs when trigger yields an event (#69942)

When DAG.test() runs a deferred task's trigger inline and the trigger
yields an event, the kwargs passed at defer() time were discarded and
replaced with only {"event": ...}. The resume method then ran with its
default argument values.

This broke example_neptune_analytics on the deferrable path:
NeptuneCreatePrivateGraphEndpointOperator defers with
kwargs={"vpc_id": self.vpc_id} and resumes into
execute_complete(..., vpc_id=""). The lost vpc_id fell back to "" and
was pushed to XCom; the downstream delete_endpoint task built a malformed
request URI (/graphs/<id>/endpoints/) and the service rejected it with
AccessDeniedException: Unable to determine service/operation name to be
authorized.

Merge the event into the deferral's next_kwargs instead of replacing
them, mirroring the production resume path in airflow.models.trigger.
Add a regression test.

* TriggerRunner: Add batch trigger creation duration metric (#68521)

Add a timing metric that records the time spent creating all pending triggers during a single create_triggers() invocation. Also, add a unit test verifying that the metric is emitted with the expected tags when triggers are successfully created.

* Bump axios in /providers/edge3/src/airflow/providers/edge3/plugins/www (#70145)

Bumps [axios](https://github.com/axios/axios) from 1.17.0 to 1.18.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.17.0...v1.18.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.18.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Remove airflow.utils dependency from Docker provider (#69900)

* Document that Code view shows only Python source for stub tasks (#70155)

* Remove deprecated dataset aliases (#70154)

Co-authored-by: SHIVANSH-ux-ys <singaser78@gmail.com>
Signed-off-by: viiccwen <vicwen@apache.org>

* Use canonical serde imports in tests (#70162)

Signed-off-by: viiccwen <vicwen@apache.org>

* Fix flaky static checks caused by migration-reference hook race (#70170)

The update-migration-references, -fab, and -edge3 hooks live in three
different prek workspaces that run in parallel, yet each invocation
processed all three apps and rewrote every migration file and
migrations-ref.rst even when nothing changed. Concurrent containers
racing on the same files intermittently failed CI static checks with
'revision = not found' when a reader caught a file mid-write.

Scope each hook to its own app and write files only when the content
actually changed, so no two hooks touch the same files.

* Add toolset as a provider module category (#70122)

* Fix toolsets python-modules check for common.ai provider (#70181)

* Harden common.ai SQLToolset allowed_tables against function/COPY bypass (#70134)

SQLToolset(allowed_tables=[...]) restricts which tables an LLM agent's SQL
can reach, but the check only inspected table references. A SQL function
whose argument is a file path or a SQL string carries no table node, so
pg_read_file('/etc/passwd'), query_to_xml('SELECT ... FROM other_table'),
and COPY ... FROM PROGRAM (under allow_writes) slipped past the guardrail.

collect_table_references now rejects COPY and -- fail-closed -- every
function sqlglot cannot type (exp.Anonymous), the channel those functions
use. Ordinary builtins (count, lower) are recognised and pass; a legitimate
unrecognised function (json_build_object) or a project UDF is permitted via
the new allowed_functions parameter. This avoids maintaining an unbounded
denylist of dangerous names and matches the module's allowlist philosophy:
an incomplete allow-list refuses a query, it never leaks.

The guardrail stays best-effort: a least-privilege database role remains the
hard boundary, and the docs, docstrings, and SQL example DAG lead with that
guidance.

---------

Signed-off-by: PoAn Yang <payang@apache.org>
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Maciej Obuchowski <maciej.obuchowski@datadoghq.com>
Signed-off-by: viiccwen <vicwen@apache.org>
Co-authored-by: Vincent Kling <vkling@vinniict.nl>
Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com>
Co-authored-by: Sebastián Ortega <sebastian.ortegatorres@datadoghq.com>
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com>
Co-authored-by: Andrew Chang <69671930+Andrushika@users.noreply.github.com>
Co-authored-by: Jake McGrath <116606359+jroachgolf84@users.noreply.github.com>
Co-authored-by: Yuseok Jo <yuseok89@gmail.com>
Co-authored-by: Daniel Standish <15932138+dstandish@users.noreply.github.com>
Co-authored-by: Niko Oliveira <onikolas@amazon.com>
Co-authored-by: Aaron Chen <nailo2c@gmail.com>
Co-authored-by: Przemysław Mirowski <17602603+Miretpl@users.noreply.github.com>
Co-authored-by: Guan-Ming Chiu <105915352+guan404ming@users.noreply.github.com>
Co-authored-by: Amitesh Gupta <143833521+singlaamitesh@users.noreply.github.com>
Co-authored-by: PoAn Yang <payang@apache.org>
Co-authored-by: Christos Bisias <christosbis@gmail.com>
Co-authored-by: SameerMesiah97 <75502260+SameerMesiah97@users.noreply.github.com>
Co-authored-by: Dheeraj Turaga <dheerajturaga@gmail.com>
Co-authored-by: Jason(Zhe-You) Liu <68415893+jason810496@users.noreply.github.com>
Co-authored-by: Tzu-ping Chung <uranusjr@gmail.com>
Co-authored-by: Morgan <62363051+AlejandroMorgante@users.noreply.github.com>
Co-authored-by: Vic Wen <vicwen@apache.org>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
Co-authored-by: Hojeong Park <parkhj062@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: AutomationDev85 <96178949+AutomationDev85@users.noreply.github.com>
Co-authored-by: Malte Niederstadt <116146665+MalteNiederstadt@users.noreply.github.com>
Co-authored-by: Malte Niederstadt <M.Niederstadt@deutsche-glasfaser.de>
Co-authored-by: Noah Gil <98035801+noah-gil@users.noreply.github.com>
Co-authored-by: MOHAMMED HANAN M T P <91409429+hanu-14@users.noreply.github.com>
Co-authored-by: hanu-14 <mohdhanan23@outlook.com>
Co-authored-by: Nikolaus Schuetz <nikolauspschuetz@gmail.com>
Co-authored-by: nagasrisai <59650078+nagasrisai@users.noreply.github.com>
Co-authored-by: ykuc <140019825+ykuc@users.noreply.github.com>
Co-authored-by: Aaryan Mahajan <aaryanmhjn@gmail.com>
Co-authored-by: 조현준 <101855229+aaiss0927@users.noreply.github.com>
Co-authored-by: Ephraim Anierobi <splendidzigy24@gmail.com>
Co-authored-by: Henry Chen <henrychen@apache.org>
Co-authored-by: Deepak kumar <deepakkumar@meta.com>
Co-authored-by: Maciej Obuchowski <obuchowski.maciej@gmail.com>
Co-authored-by: Shivam Rastogi <6463385+shivaam@users.noreply.github.com>
Co-authored-by: Hussein Awala <hussein@awala.fr>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: vincbeck <vincbeck@amazon.com>
Co-authored-by: Brent Bovenzi <brent@astronomer.io>
Co-authored-by: GPK <gopidesupavan@gmail.com>
Co-authored-by: Aditya Patel <125534950+Codingaditya17@users.noreply.github.com>
Co-authored-by: Shubham Raj <48172486+shubhamraj-git@users.noreply.github.com>
Co-authored-by: Sean Ghaeli <58916776+seanghaeli@users.noreply.github.com>
Co-authored-by: Shae Alhusayni <shae.alh@gmail.com>
Co-authored-by: SHIVANSH-ux-ys <singaser78@gmail.com>
Co-authored-by: Wei Lee <weilee.rx@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Remove airflow.utils.email references in task-sdk

5 participants