Apache Airflow 3.2.2

📦 PyPI: https://pypi.org/project/apache-airflow/3.2.2/
📚 Docs: https://airflow.apache.org/docs/apache-airflow/3.2.2/
🛠 Release Notes: https://airflow.apache.org/docs/apache-airflow/3.2.2/release_notes.html
🐳 Docker Image: "docker pull apache/airflow:3.2.2"
🚏 Constraints: https://github.com/apache/airflow/tree/constraints-3.2.2

Significant Changes

• The SMTP STARTTLS upgrade performed by airflow.utils.email.send_email now validates the SMTP server's certificate against the system's trusted CA bundle by default. Previously the starttls() call was made without an SSL context, so any certificate was accepted.
  Deployments that intentionally point Airflow at an SMTP server with a self-signed or otherwise non-validating certificate and need to preserve the previous behaviour must set email.ssl_context = "none" in airflow.cfg. The "default" value (now also the default when the option is unset) uses :func:ssl.create_default_context. Previously this option applied only to the SMTP_SSL path; it now applies to the STARTTLS path as well. (#65346)

• In #64963, the Airflow UI switched from full-match *_pattern REST API query parameters to the new index-friendly *_prefix_pattern parameters on list endpoints. This is a behavioral change for search-as-you-type filters in the UI: matches are prefix-based (LIKE 'term%' via a range scan) instead of substring-based (ILIKE '%term%'), which means the database can use B-tree indexes and search stays fast on large deployments. The REST API itself keeps both forms: existing *_pattern parameters still behave exactly as before.
  In #66015, a per-search-bar "Match anywhere" toggle was added so users who relied on the previous substring behavior can opt back into it from the UI. Each search input and each text filter pill now has a small regex-icon toggle next to the value; flipping it on switches that input from *_prefix_pattern to *_pattern. (#66015)

• Fix triggerer race condition and deadlock that caused deferred tasks to stall indefinitely

  Triggers that call synchronous SDK methods (e.g. get_task_states used by
  safe_to_cancel in several Google provider operators) could crash the triggerer's
  internal subprocess. The triggerer would then continue to heartbeat normally —
  appearing healthy to the scheduler — while silently processing zero triggers, causing
  every deferred task to time out. This was first reported in issue #64620; a
  partial fix shipped in Airflow 3.2.1 (#64882) but introduced a new deadlock
  with the same visible symptom under load.

  Both issues are fixed by replacing the lock-based serialization with response
  multiplexing: each request now carries a unique ID and the response is routed back to
  the correct caller, so concurrent requests from trigger threads no longer contend or
  deadlock regardless of how many triggers are running or what SDK methods they call.

  New: triggerer subprocess watchdog

  Even with the race fixed, a trigger that blocks the event loop (e.g. by calling
  time.sleep() or performing blocking I/O directly in async def run()) would
  previously leave the triggerer appearing healthy indefinitely.

  A new [triggerer] runner_health_check_threshold config option (default: 30 seconds)
  adds a watchdog: if the triggerer subprocess goes silent for longer than the threshold,
  the parent process stops updating the heartbeat so the scheduler can detect the hang and
  reassign triggers rather than waiting for them to individually time out. Set the option
  to 0 to disable the watchdog. (#66412)

• Tighten [core] allowed_deserialization_classes_regexp to require full-string matches

  Patterns in [core] allowed_deserialization_classes_regexp are now matched
  against the entire classname using re.fullmatch() instead of re.match().
  Previously a pattern such as airflow\.models\.Variable admitted not only
  the intended class but also names that started with it
  (e.g. airflow.models.Variable_Malicious), because re.match only anchors
  at the start of the string.

  The default value of this option is empty, so out-of-the-box deployments are
  unaffected. Deployments that configured this option with patterns relying on
  prefix-match semantics — for example airflow\.models\. to mean "any class
  under airflow.models" — must add .* to the pattern
  (airflow\.models\..*) to retain the previous behaviour. (#66499)

• Custom deadline reference classes must now be registered via the new deadline_references attribute on AirflowPlugin, matching the existing pattern for custom timetables and custom partition mappers. To use a custom DeadlineReference subclass, register it in a plugin's deadline_references list. Custom references that are not registered will raise DeadlineReferenceNotRegistered at deserialization. (#66737)

Bug Fixes

• Fix Callback.handle_event triggerer crash when OpenTelemetry metrics receive dict typed tag values (#67527) (#67529)
• UI: Rewrite modulepreload hrefs to the api-server static path (#67548) (#67556)
• Correctly pre-allocate external_executor_id with multiple executors on PostgreSQL (#67388) (#67458)
• Return raw import-error stacktrace when a Dag file has no registered Dag (#67465) (#67478)
• UI: Fix Expand/Collapse All on XComs and Audit Log JSON cells (#67316) (#67361)
• UI: Load Monaco workers via a same-origin Blob shim (#67352) (#67469)
• UI: Show DAG name in browser tab title (#67169) (#67399)
• Require starlette>=1.0.1 for Host-header parsing fix and cadwyn>=6.1.1 for compatibility
  (#67326) (#67460)
• Revoke JWT on /auth/logout regardless of auth manager logout URL (#67289) (#67362)
• Fix deadlock in ti_update_state caused by FOR UPDATE locking dag_run (#67246) (#67264)
• UI: Stop polling getLatestRunInfo on paused Dags with no active runs (#67249) (#67256)
• Fail closed when supervisor IPC fails on a non-success terminal state (#66573) (#67183)
• Refuse secrets-backend fallback on Execution-API authorization deny (#66575) (#67173)
• Harden _collect_teams_to_check and requires_access_backfill against malformed request bodies (#66504) (#67182)
• Don't crash supervisor IPC loop on transient network errors (#66572) (#67177)
• Default-deny auth at the API and UI router level (#66505) (#67171)
• Apply per-Dag audit log permission to event log detail endpoint (#67112) (#67159)
• Fix ValueError when supervisor force-closes stuck sockets after timeout (#67115) (#67162)
• Redact rendered template fields while still structured to preserve nested-key masking on truncation (#65906) (#67117)
• Fix migration 0080 to migrate existing deadline rows on upgrade and downgrade (#66016) (#67129)
• Fix XCom PATCH/POST to store native values instead of json.dumps output (#64220) (#67116)
• Fix max_active_runs lost during Dag serialization when value equals schema default (#65310) (#67097)
• Fix N+1 query pattern in bulk pool delete endpoint (#66222) (#67108)
• Optimize DB performance of datetime range filters in API queries (#66696) (#67102)
• Fix serialize_template_field handling callable value in dict (#63871) (#67092)
• Fix scheduler to ignore stale executor success after defer reschedule (#66431) (#67089)
• Fix ArgNotSet repr to use stable string instead of memory address (#65222) (#66897)
• Fix scheduler MySQL task instance index hint (#66785) (#67087)
• UI: Preserve Grid limit and filters when redirecting after manual Dag trigger (#66717) (#66867)
• Apply reserved-key check to XCom update payload (#65915) (#66913)
• Fix log server path extraction to use removeprefix (#66749) (#66772)
• Fix macOS SIGSEGV in task execution by using fork + exec (#64874) (#66872)
• Fix Dag auto-pause ordering to use run_after (#65207) (#66863)
• Fix Dag version inflation caused by unmatched serialized result of task using re-serialized command (#61077) (#66861)
• Fix pod_override serialization in Dag details and executor path (#65407) (#66898)
• Fix async engine missing pool_recycle and pool_pre_ping configuration (#65276) (#66866)
• UI: Make Dag detail page scrollable on mobile viewports (#65899) (#66975)
• Fix DagVersion when clearing tasks with run on latest version (#65835) (#66901)
• Fix millisecond floating point duration bug (#66560) (#66915)
• UI: Fix "Mark state as..." buttons grayed out when task or DagRun already in target state (#66198) (#66919)
• Fix memory leak in LocalExecutor caused by unreleased file descriptor locks (#65121) (#66887)
• Fix external DB manager upgrades with existing tables (#66674) (#66882)
• UI: Improve DagCalendarTab background color retrieval and loading overlay handling (#64189) (#66860)
• UI: Handle Dags state filter overflow on mobile (#66812) (#66847)
• UI: Fix Edit Connection dialog missing lazyMount causing JSON editor infinite loading (#65969) (#66828)
• UI: Fix ConnectionForm crashing when connection has invalid extra JSON (#66593) (#66831)
• Handle PermissionError in init_log_folder for mounted filesystems (#63878) (#66733)
• Fix scheduler crash by catching StaleDataError in verify_integrity (#64503) (#66727)
• Fix triggerer file handle leak when remote log upload fails (#66675) (#66684)
• Fix /tmp file leak when API server streams large task logs (#66450) (#66667)
• Fix XCom prior-dates lookup for duplicate run_id across Dags (#65227) (#66646)
• Fix HITL (Human-In-The-Loop) /required_actions listing to show mapped task instances (#66433) (#66482)
• Fix scheduler callback bundle_version when versioning disabled (#66485) (#66518)
• UI: Hide Next Run timestamp for paused Dags (#66552) (#66568)
• Fix task run context crash when DagRun state is expired (#66339) (#66...

Apache Airflow Helm Chart 1.21.0

Significant Changes

Workers config options have been moved under workers.celery.* and workers.kubernetes.*

Please update your configuration accordingly:

• workers.safeToEvict is now deprecated in favor of workers.celery.safeToEvict/workers.kubernetes.safeToEvict (#61915).
• workers.hostAliases is now deprecated in favor of workers.celery.hostAliases/workers.kubernetes.hostAliases (#61960).
• workers.priorityClassName is now deprecated in favor of workers.celery.priorityClassName/workers.kubernetes.priorityClassName (#61961).
• workers.runtimeClassName is now deprecated in favor of workers.celery.runtimeClassName/workers.kubernetes.runtimeClassName (#61962).
• workers.schedulerName is now deprecated in favor of workers.celery.schedulerName/workers.kubernetes.schedulerName (#62030).
• workers.serviceAccount is now deprecated in favor of workers.celery.serviceAccount/workers.kubernetes.serviceAccount (#64730).
• workers.extraContainers is now deprecated in favor of workers.celery.extraContainers/workers.kubernetes.extraContainers (#64739).
• workers.extraInitContainers is now deprecated in favor of workers.celery.extraInitContainers/workers.kubernetes.extraInitContainers (#64741).
• workers.extraVolumes is now deprecated in favor of workers.celery.extraVolumes/workers.kubernetes.extraVolumes (#64746).
• workers.affinity is now deprecated in favor of workers.celery.affinity/workers.kubernetes.affinity (#64860).
• workers.tolerations is now deprecated in favor of workers.celery.tolerations/workers.kubernetes.tolerations (#64976).
• workers.topologySpreadConstraints is now deprecated in favor of workers.celery.topologySpreadConstraints/workers.kubernetes.topologySpreadConstraints (#64980).
• workers.podAnnotations is now deprecated in favor of workers.celery.podAnnotations/workers.kubernetes.podAnnotations (#65027).
• workers.labels is now deprecated in favor of workers.celery.labels/workers.kubernetes.labels (#65030).
• workers.env is now deprecated in favor of workers.celery.env/workers.kubernetes.env (#65056).
• workers.extraVolumeMounts is now deprecated in favor of workers.celery.extraVolumeMounts/workers.kubernetes.extraVolumeMounts (#65059).
• workers.extraPorts is now deprecated in favor of workers.celery.extraPorts (#61919).
• workers.volumeClaimTemplates is now deprecated in favor of workers.celery.volumeClaimTemplates (#62048).
• workers.waitForMigrations is now deprecated in favor of workers.celery.waitForMigrations (#62054).
• workers.hpa is now deprecated in favor of workers.celery.hpa (#64734).
• workers.annotations is now deprecated in favor of workers.celery.annotations (#64982).
• workers.logGroomerSidecar is now deprecated in favor of workers.celery.logGroomerSidecar (#65033).

The previous configuration options are still working but are deprecated and will be removed in a future version.

Default Airflow image is updated to 3.2.0 (#64841)
...

Apache Airflow 3.2.1

📦 PyPI: https://pypi.org/project/apache-airflow/3.2.1/
📚 Docs: https://airflow.apache.org/docs/apache-airflow/3.2.1/
🛠 Release Notes: https://airflow.apache.org/docs/apache-airflow/3.2.1/release_notes.html
🐳 Docker Image: "docker pull apache/airflow:3.2.1"
🚏 Constraints: https://github.com/apache/airflow/tree/constraints-3.2.1

Significant Changes

• Users who only have read access to DAGs will no longer be able to fetch data from the /dags endpoint, as it now requires additional permissions (DagAccessEntity.RUN, DagAccessEntity.HITL_DETAIL, and DagAccessEntity.TASK_INSTANCE). This change was made because the endpoint returns aggregated data from these multiple entities. Please update your custom user roles to include read access for DAG Runs, Task Instances, and HITL Details if those users should still have access to the /dags endpoint. (#64822)

Improvements

• Allow UI theme config with only CSS overrides, icon only, or empty {} to restore OSS defaults. The tokens field is now optional in the theme configuration. (#64552)

Bug Fixes

• Fix DEFAULT_LOGGING_CONFIG to use right kwargs (#65412) (#65424)
• Fix zip DAG import errors being cleared during bundle refresh (#63617) (#65296)
• Fix dispose_orm() not disposing async engine on shutdown (#65274) (#65284)
• Fix get_team_name_dep creating wasted async sessions when multi_team=False (#65275) (#65282)
• Fix asset graph view leaking DAGs outside the user's permissions (#65273) (#65280)
• Fix migration: add missing disable_sqlite_fkeys to migration 0108 (#65288) (#65290)
• Fix heartbeat: add fast-path UPDATE to avoid row lock in the common case (#65029) (#65137)
• UI: Fix deactivated state not shown for stale DAGs (#65214) (#65218)
• Fix N+1 queries during DAG serialization with bulk prefetch (#64929) (#65208)
• Fix serializer for empty string extra in connection (#65014) (#65215)
• UI: Fix menu positioning for dropdowns in connection forms (#65007) (#65085) (#65138)
• UI: Fix SearchBar value not syncing with defaultValue changes (#65054) (#65140)
• Fix SDK configuration to use $AIRFLOW_CONFIG env (#64936) (#65200)
• Fix Session staying opened between yields (#65179) (#65195)
• Fix Session leak from StreamingResponse API endpoints (#65162) (#65193)
• Fix redirect loop when stale root-path _token cookie exists from older Airflow instance (#64955) (#65177)
• Fix @task decorator to validate operator arg types at decoration time (#65041) (#65050)
• Fix CLI error handling and exit codes for failed commands (#65052) (#65097)
• Fix is_alive default to None in jobs list CLI (#65065) (#65091)
• Fix missing dag_id in get_task_instance (#64957) (#64968) (#65067)
• UI: Fix cancel debounce on clear to prevent stale search value (#64893) (#64907)
• Fix read out-of-order issue with send method in CommsDecoder (#64894) (#64946)
• Fix bulk connection delete banner (#64735) (#64961)
• Fix migrations: move UPDATEs inside disable_sqlite_fkeys in migration 0097 (#64876) (#64940)
• Fix heartbeat to return 410 Gone when cleared TI exists in TIH (#61631) (#64693)
• Fix scheduler: skip asset-triggered Dags without SerializedDagModel (#64322) (#64738)
• Fix N+1 query pattern in task instance states and count endpoints (#60352) (#64695)
• Fix TypeError in GET /dags/{dag_id}/tasks when order_by field has None values (#64384) (#64587)
• UI: Fix duplicate nav sidebar when iframe navigates away from auth pages (#63873) (#64854)
• UI: Fix Gantt view "Error invalid date" on running DagRun (#64752) (#64853)
• Fix connections import returning non-zero exit code on failure (#64416) (#64449)
• Fix structlog positional formatting for single-dict arguments (#62849) (#64773)
• UI: Fix external link target and add rel attributes (#64542) (#64772)
• UI: Fix DagVersionSelect options not filtered by selected DagRun (#64736) (#64771)
• Fix spurious blank lines in filtered task log download (#64235) (#64640)
• Fix OTel metrics lost in forked task processes (#64703) (#64720)
• Fix start_date in example DAGs to avoid timezone conversion overflow (#63882) (#64758)
• Fix AirflowPlugin not re-exported, causing mypy errors in plugins (#65132) (#65163)
• Fix apache-airflow-providers-fab minimum version to prevent connexion import error on Python 3.13 (#65523) (#65524)
• UI: Fix graph view not auto-refreshing task states during DAG run (#65518) (#65522)

Miscellaneous

• Lock TriggerCommsDecoder sync req-res cycle (#64882) (#65285)
• Add write_to_os support for writing task logs to OpenSearch (#64364) (#65201)
• Restore OpenSearch log integration in airflow_local_settings.py (#64764) (#65003)

Doc-only Changes

• Add missing Polish translations to reach 100% coverage (#65272)
• Add FAQ entry for API server memory growth with gunicorn worker recycling (#65036) (#65037)
• Remove outdated reference to Dag Dependencies view (#64787) (#64911)
• Add JWT authentication docs and strengthen security model (#64760) (#64849)
• Add missing Catalan translations to reach 100% coverage (#65078) (#65389)
• Add missing German translations to close translation gaps (#65332)

Apache Airflow 3.2.0

📦 PyPI: https://pypi.org/project/apache-airflow/3.2.0/
📚 Docs: https://airflow.apache.org/docs/apache-airflow/3.2.0/
🛠 Release Notes: https://airflow.apache.org/docs/apache-airflow/3.2.0/release_notes.html
🐳 Docker Image: "docker pull apache/airflow:3.2.0"
🚏 Constraints: https://github.com/apache/airflow/tree/constraints-3.2.0

Significant Changes

Asset Partitioning

The headline feature of Airflow 3.2.0 is asset partitioning — a major evolution of data-aware
scheduling. Instead of triggering Dags based on an entire asset, you can now schedule downstream
processing based on specific partitions of data. Only the relevant slice of data triggers downstream
work, making pipeline orchestration far more efficient and precise.

This matters when working with partitioned data lakes — date-partitioned S3 paths, Hive table
partitions, BigQuery table partitions, or any other partitioned data store. Previously, any update
to an asset triggered all downstream Dags regardless of which partition changed. Now only the right
work gets triggered at the right time.

For detailed usage instructions, see :doc:/authoring-and-scheduling/assets.

Multi-Team Deployments

Airflow 3.2 introduces multi-team support, allowing organizations to run multiple isolated teams within a single Airflow deployment.
Each team can have its own Dags, connections, variables, pools, and executors— enabling true resource and permission isolation without requiring separate Airflow instances per team.

This is particularly valuable for platform teams that serve multiple data engineering or data science teams from shared infrastructure, while maintaining strong boundaries between teams' resources and access.

For detailed usage instructions, see :doc:/core-concepts/multi-team.

.. warning::

Multi-Team Deployments are experimental in 3.2.0 and may change in future versions based on
user feedback.

Synchronous callback support for Deadline Alerts

Deadline Alerts now support synchronous callbacks via SyncCallback in addition to the existing
asynchronous AsyncCallback. Synchronous callbacks are executed by the executor (rather than
the triggerer), and can optionally target a specific executor via the executor parameter.

A Dag can also define multiple Deadline Alerts by passing a list to the deadline parameter,
and each alert can use either callback type.

.. warning::

Deadline Alerts are experimental in 3.2.0 and may change in future versions based on
user feedback. Synchronous deadline callbacks (SyncCallback) do not currently
support Connections stored in the Airflow metadata database.

For detailed usage instructions, see :doc:/howto/deadline-alerts.

UI Enhancements & Performance

• Grid View Virtualization:
  The Grid view now uses virtualization -- only visible rows are rendered to the DOM. This dramatically improves performance when viewing Dags with large numbers of task runs, reducing render time and memory usage for complex Dags. (#60241)

• XCom Management in the UI:
  You can now add, edit, and delete XCom values directly from the Airflow UI. This makes it much easier to debug and manage XCom state during development and day-to-day operations without needing CLI commands. (#58921)

• HITL Detail History:
  The Human-in-the-Loop approval interface now includes a full history view, letting operators and reviewers see the complete audit trail of approvals and rejections for any task. (#56760, #55952)

• Gantt Chart Improvements:

  • All task tries displayed: Gantt chart now shows every attempt, not just the latest
  • Task display names in Gantt: task_display_name shown for better readability (#61438)
  • ISO dates in Gantt: Cross-browser consistent date format (#61250)
  • Fixed null datetime crash: Gantt chart no longer crashes on tasks with null datetime fields

New --only-idle flag for the scheduler CLI

The airflow scheduler command has a new --only-idle flag that only counts runs when the
scheduler is idle. This helps users run the scheduler once and process all triggered Dags and
queued tasks. It requires and complements the --num-runs flag so one can set a small value
instead of guessing how many iterations the scheduler needs.

Replace per-run TI summary requests with a single NDJSON stream

The grid, graph, gantt, and task-detail views now fetch task-instance
summaries through a single streaming HTTP request
(GET /ui/grid/ti_summaries/{dag_id}?run_ids=...) instead of one request
per run. The server emits one JSON line per run as soon as that run's task
instances are ready, so columns appear progressively rather than all at once.

What changed:

• GET /ui/grid/ti_summaries/{dag_id}?run_ids=... is now the sole endpoint
  for TI summaries, returning an application/x-ndjson stream where each
  line is a serialized GridTISummaries object for one run.
• The old single-run endpoint GET /ui/grid/ti_summaries/{dag_id}/{run_id}
  has been removed.
• The serialized Dag structure is loaded once and shared across all runs that
  share the same dag_version_id, avoiding redundant deserialization.
• All UI views (grid, graph, gantt, task instance, mapped task instance, group
  task instance) use the stream endpoint, passing one or more run_ids.

Structured JSON logging for all API server output

The new json_logs option under the [logging] section makes Airflow
produce all its output as newline-delimited JSON (structured logs) instead of
human-readable formatted logs. This covers the API server (gunicorn/uvicorn),
including access logs, warnings, and unhandled exceptions.

Not all components support this yet — notably airflow celery worker but
any non-JSON output when json_logs is enabled will be treated as a bug. (#63365)

Remove legacy OTel Trace metaclass and shared tracer wrappers

The interfaces and functions located in airflow.traces were
internal code that provided a standard way to manage spans in
internal Airflow code. They were not intended as user-facing code
and were never documented. They are no longer needed so we
remove them in 3.2. (#63452)

Move task-level exception imports into the Task SDK

Airflow now sources task-facing exceptions (AirflowSkipException, TaskDeferred, etc.) from
airflow.sdk.exceptions. airflow.exceptions still exposes the same exceptions, but they are
proxies that emit DeprecatedImportWarning so Dag authors can migrate before the shim is removed.

What changed:

• Runtime code now consistently raises the SDK versions of task-level exceptions.
• The Task SDK redefines these classes so workers no longer depend on airflow-core at runtime.
• airflow.providers.common.compat.sdk centralizes compatibility imports for providers.

Behaviour changes:

• Sensors and other helpers that validate user input now raise ValueError (instead of
  AirflowException) when poke_interval/ timeout arguments are invalid.
• Importing deprecated exception names from airflow.exceptions logs a warning directing users to
  the SDK import path.

Exceptions now provided by airflow.sdk.exceptions:

• AirflowException and AirflowNotFoundException
• AirflowRescheduleException and AirflowSensorTimeout
• AirflowSkipException, AirflowFailException, AirflowTaskTimeout, AirflowTaskTerminated
• TaskDeferred, TaskDeferralTimeout, TaskDeferralError
• DagRunTriggerException and DownstreamTasksSkipped
• AirflowDagCycleException and AirflowInactiveAssetInInletOrOutletException
• ParamValidationError, DuplicateTaskIdFound, TaskAlreadyInTaskGroup, TaskNotFound, XComNotFound
• AirflowOptionalProviderFeatureException

Backward compatibility:

• Existing Dags/operators that still import from airflow.exceptions continue to work, though
  they log warnings.
• Providers can rely on airflow.providers.common.compat.sdk to keep one import path that works
  across supported Airflow versions.

Migration:

• Update custom operators, sensors, and extensions to import exception classes from
  airflow.sdk.exceptions (or from the provider compat shim).
• Adjust custom validation code to expect ValueError for invalid sensor arguments if it
  previously caught AirflowException.

Support numeric multiplier values for retry_exponential_backoff parameter

The retry_exponential_backoff parameter now accepts numeric values to specify custom exponential backoff multipliers for task retries. Previously, this parameter only accepted boolean values (True or False), with True using a hardcoded multiplier of 2.0.

New behavior:

• Numeric values (e.g., 2.0, 3.5) directly specify the exponential backoff multiplier
• retry_exponential_backoff=2.0 doubles the delay between each retry attempt
• retry_exponential_backoff=0 or False disables exponential backoff (uses fixed retry_delay)

Backwards compatibility:

Existing Dags using boolean values continue to work:

• retry_exponential_backoff=True → converted to 2.0 (maintains original behavior)
• retry_exponential_backoff=False → converted to 0.0 (no exponential backoff)

API changes:

The REST API schema for retry_exponential_backoff has changed from type: boolean to type: number. API clients must use numeric values (boolean values will be rejected).

Migration:

While boolean values in Python Dags are automatically converted for backwards compatibility, we recommend updating to explicit numeric values for clarity:

• Change retry_exponential_backoff=True → retry_exponential_backoff=2.0
• Change ``retry_exponential_backoff=False...

Apache Airflow Helm Chart 1.20.0

Significant Changes

Support for old versions of Apache Airflow <2.11 has been dropped (#61018)

Minimum supported version of Apache Airflow is now 2.11.0. If you want to deploy an
old version of Apache Airflow, please use the last released version of the chart 1.19.0.

workers specific sections have been moved to workers.celery / workers.kubernetes sections

Please update your configuration accordingly:

• workers.command command is now deprecated in favor of workers.celery.command/workers.kubernetes.command (#60067).
• workers.securityContexts command is now deprecated in favor of workers.celery.securityContexts/workers.kubernetes.securityContexts (#60396).
• workers.containerLifecycleHooks command is now deprecated in favor of workers.celery.containerLifecycleHooks/workers.kubernetes.containerLifecycleHooks (#61369).
• workers.kerberosSidecar section is now deprecated in favor of workers.celery.kerberosSidecar/workers.kubernetes.kerberosSidecar (#61881).
• workers.kerberosInitContainer section is now deprecated in favor of workers.celery.kerberosInitContainer/workers.kubernetes.kerberosInitContainer (#60751).
• workers.terminationGracePeriodSeconds command is now deprecated in favor of workers.celery.terminationGracePeriodSeconds/workers.kubernetes.terminationGracePeriodSeconds (#61892).
• workers.nodeSelector command is now deprecated in favor of workers.celery.nodeSelector/workers.kubernetes.nodeSelector (#61957).
• workers.podDisruptionBudget section is now deprecated in favor of workers.celery.podDisruptionBudget. Please update your configuration accordingly. (#61414)
• workers.keda section is now deprecated in favor of workers.celery.keda. Please update your configuration accordingly. (#61820)
• workers.resources section is now deprecated in favor of workers.celery.resources and workers.kubernetes.resources. Please update your configuration accordingly. (#61890)

The previous configuration options are still working, but are deprecated and will be removed in a future version.

As Git-Sync is not service-type object, the readiness probe will be removed. (#62334)

To enable feature behaviour set dags.gitSync.recommendedProbeSetting to true. Section itself will be removed in future release as to not break setups during upgrades.

As Git-Sync has dedicated liveness service, the liveness probe behaviour will be changed. To enable feature behaviour set dags.gitSync.recommendedProbeSetting to true.

Please update your configuration accordingly.

Automatic env variables removed from container_extra_envs and custom_airflow_environment (#60750)

The automatic prefix addition for Kubernetes Executor environment variables and secrets has been removed from both the container_extra_envs and custom_airflow_environment helper functions.

What changed:

Previously, when you added environment variables to component-specific configurations (e.g., .Values.scheduler.env), the chart automatically created an additional environment variable (to specified in the env section) with the AIRFLOW__KUBERNETES_ENVIRONMENT_VARIABLES__ prefix for Kubernetes Executor worker pods. After this change, only the variable specified in env section will be created.
Furthermore, for values specified under .Values.secret section, the AIRFLOW__KUBERNETES_SECRETS__ prefix is no longer automatically added. Secrets are now passed as-is via secretKeyRef without the prefixed copy for worker pods.

Why this change:

• Prevent unintended exposure of sensitive data like client_secret information. Previously, due to prefix, it was recognized as internal Airflow configuration leading to unintended exposure in Airflow UI (under Admin -> Configuration), even when AIRFLOW__API__EXPOSE_CONFIG is set to non-sensitive-only.
• Avoid unintended environment propagation to workers: component-specific env configurations are intended strictly for specific components. Previous behaviour caused these variables to be passed to worker pods, which could result in configuration conflicts and unexpected side effects.

Migration Required:

If you need to pass environment variables specifically to Kubernetes Executor worker pods, use one of the following approaches:

Option 1: Use .Values.env

.. code-block:: yaml

env:
  - name: my_var
    value: "my_value"

Environment variables specified under .Values.env are now passed as-is without the automatic prefix (same behaviour as component-specific env).

Option 2: Use .Values.config.kubernetes_environment_variables

.. code-block:: yaml

config:
  kubernetes_environment_variables:
    my_var: "my_value"

Default Airflow image is updated to 3.1.8 (#63392)

The default Airflow image that is used with the Chart is now 3.1.8, previously it was 3.1.7.

Features

• Support Helm template expressions in podAnnotations and airflowPodAnnotations values (#63019)
• Add minute-level log retention to clean-logs script (#61855)
• Add LOG_MAX_SIZE environment variables to log groomer (#61559)

Improvements

• Remove automatic KUBERNETES_ENVIRONMENT_VARIABLES and KUBERNETES_SECRETS prefixes from chart helpers (#60750)
• Remove JWT secrets from triggerer, worker and dag-processor (#63204)
• Add workers.celery.nodeSelector & workers.kubernetes.nodeSelector (#61957)
• Add workers.celery.terminationGracePeriodSeconds & workers.kubernetes.terminationGracePeriodSeconds (#61892)
• Add workers.celery.resources & workers.kubernetes.resources (#61890)
• Add workers.celery.keda section (#61820)
• Add workers.celery.podDisruptionBudget (#61414)
• Add workers.celery.containerLifecycleHooks & workers.kubernetes.containerLifecycleHooks (#61369)
• Refactor Git-Sync livenessProbe & deprecate readinessProbe & add startupProbe (#62334)
• Warn on deprecated per-component securityContext values (#62729)
• Add ingress deprecation warnings for apiServer, statsd, and pgbouncer (#62490)
• Add missing support for: securityContexts and containerLifecycleHook (#60677)

Bug Fixes

• More restrictive chart rendering logic (#63464)
• Omit api-server spec.replicas when HPA is enabled (#63187)
• Add workers.celery.kerberosSidecar & workers.kubernetes.kerberosSidecar sections (#61881)
• Fix chart NOTES.txt showing deprecation warnings only without secret key (#62722)
• Fix tpl rendering for TLS hosts in ingress templates #62358 (#62548)
• Fix webserver.defaultUser.enabled=false not honored (#62143)

Doc only changes

• Cleanup Helm Chart documentation (#62544)
• Add missing deprecation warnings for workers section (#63659)

Misc

• Drop support for all Airflow versions below 2.11 in Helm Chart (#61018)
• Default airflow version to 3.1.8 (#63392)
• Add *.iml to .gitignore in all distributions (#63636)
• Upgrade important CI environment (#62792, #62610)
• Allow to use short SPDX license identifier for selected files (#62073)
• Fix all build-system/requires including transitive dependencies (#62570)

airflow-ctl/0.1.3

📦 PyPI: https://pypi.org/project/apache-airflow-ctl/0.1.3/
📚 Docs: https://airflow.apache.org/docs/apache-airflow-ctl/0.1.3/
🛠 Release Notes: https://airflow.apache.org/docs/apache-airflow-ctl/0.1.3/release_notes.html

Thanks to all the contributors who made this possible. Next time, Release notes will be available through public documentation.

Significant Changes

• Add airflowctl auth token command to print JWT access tokens (#62843)
• Add --action-on-existing-key to pools import and connections import (#62702)
• Add retry mechanism to airflowctl and remove flaky integration mark (#63016)
• airflowctl auth login: prompt for credentials interactively when none are provided (#62549)
• feat(airflowctl): support on headless environments (#62217)

Bug Fixes

• Fix airflowctl pools export ignoring --output table/yaml/plain (#62665)
• Fix airflowctl connections import failure when JSON omits extra field (#62662)
• Amend compatibility issues for airflowctl (#63388)

Improvements

• Send limit parameter in execute_list server requests (#63048)
• Run test coverage when airflowctl command has any change (#63216)
• airflow-ctl: add coverage tests for console formatting output (#62627)
• Clean up stale Python 3.9 workaround in airflow-ctl CLI config parser (#62206)
• Expose timetable_partitioned in UI API (#62777)

Apache Airflow 3.1.8

📦 PyPI: https://pypi.org/project/apache-airflow/3.1.8/
📚 Docs: https://airflow.apache.org/docs/apache-airflow/3.1.8/
🛠️ Release Notes: https://airflow.apache.org/docs/apache-airflow/3.1.8/release_notes.html
🐳 Docker Image: "docker pull apache/airflow:3.1.8"
🚏 Constraints: https://github.com/apache/airflow/tree/constraints-3.1.8

Significant Changes

Backfill permissions are now handled via DagAccessEntity.Run (#61456)

is_authorized_backfill of the BaseAuthManager interface has been removed. Core will no longer call this method and their
provider counterpart implementation will be marked as deprecated.
Permissions for backfill operations are now checked against the DagAccessEntity.Run permission using the existing
requires_access_dag decorator. In other words, if a user has permission to run a DAG, they can perform backfill operations on it.

Please update your security policies to ensure that users who need to perform backfill operations have the appropriate DagAccessEntity.Run permissions. (Users
having the Backfill permissions without having the DagRun ones will no longer be able to perform backfill operations without any update)

Elasticsearch is now fully compatible with remote logging along (#62940)

Elasticsearch is now fully compatible with remote logging along side with apache-airflow-providers-elasticsearch>=6.5.0. Please review elasticsearch provider release notes for more information https://airflow.apache.org/docs/apache-airflow-providers-elasticsearch/6.5.0/changelog.html (#62121) (#62940)

Bug Fixes

• Fix SQLite migration disable disable_sqlite_fkeys in revision 509b94a1042d (#63256) (#63272)
• Fix: 404 queued asset events from API server logs (#62934) (#62976)
• Fix: Always include kid in JWT header for symmetric key tokens (#62883) (#62943)
• Fix: Scope session token in cookie to base_url (#62771) (#62851)
• Fix: UI of Scope session token in cookie to base_url (#62771) (#62859)
• Fix: UI tasks log missing in UP_FOR_RETRY and UP_FOR_RESCHEDULE states (#54547) (#62862)
• Fix: Backfill permissions (#62856) (#62873)
• Fix: Use useAssetServiceGetDagAssetQueuedEvents to get the correct number of ADRQs (#62868) (#62902)
• Fix: Adds task instance validation for HITL (#62886) (#62909)
• Fix: Restore task_instance_history sequence on downgrade (#62759)
• Fix broken dag_processing.total_parse_time metric (#62128) (#62764)
• Fix Trigger UI form rendering for null enum values (#62060) (#62767)
• Fix timer.duration unit labels in logs (#61824) (#62757)
• Fix XCom migration failing for NaN/Infinity float values (#62686) (#62760)
• Fix SQL not rendered in Rendered Templates view (#60739) (#62348)
• Fix missing DAG read permission checks on dependencies endpoint (#62046) (#62586)
• Changed dag_bundle.signed_url_template from varchar(200) to text (#61041) (#62568)
• Fix WASB remote logging base path handling (#58946) (#61013) (#62456)
• Handle non-dictionary json payload during logging to avoid internal server error. (#62355) (#62367)
• Fix grid view crash when task converted to TaskGroup (#61208) (#61279) (#62181)
• Fix running task duration showing as null in UI (#61898) (#62136)
• Fix deferrable sensors not respecting soft_fail on timeout (#61132) (#61421)
• Fix task failure details being obscured by finalization errors (#62070) (#62113)
• Add missing ti.start and ti.finish metrics in Airflow 3 (#62019) (#62110)
• Fix DepContext mutation leak and restore reschedule-mode guard (#62089)
• Fix scheduler heartbeat misses caused by slow reschedule dependency check (#61983) (#62068)
• Flush in-memory OTEL metrics at process shutdown (#61808) (#61869)
• Fix executor slots showing negative infinity (#61140) (#61768)
• Fix recursion depth error in _redact_exception_with_context (#61776) (#61795)
• Fix API server segfault when PYTHONASYNCIODEBUG=1 is set (#61281) (#61933)
• Fix scheduler crash when queuing TI with null dag_version_id (#61813) (#61846)
• Fix secrets masking in Rendered Templates for complex objects (#61394) (#61763)
• Fix list dag versions permissions (#61675) (#61733)
• Fix Triggerer crashing if Trigger uses builtin print function (#60258) (#61703)
• Fix GZipMiddleware with correct comment placement (#61538) (#61566)
• Fix middleware order to prevent chunked FastAPI responses (#61043) (#61539)
• Fix XCom serialization for pendulum.date.Date values (#61176) (#61717)
• Fix access_key and connection_string not being masked in logs (#61580) (#61582)
• Fix minimatch ReDoS vulnerabilities via pnpm overrides (#62805)
• Fix language selector state not updating on change (#61060) (#61263)
• Make conn_type optional in task SDK Connection data model (#61728) (#61835)
• UI: optimize grid view refresh pressure on the API (#62085) (#62135)
• UI: Fix main content margin to align with navigation sidebar width (#61614) (#61622)
• UI: Fix Preserve variable value formatting in edit dialog (#58757) (#62339)
• UI: Fix missing translation keys for blocking dependencies in UI (#61314) (#61366) (#61638)
• UI: Add error handling for pause/unpause toggle permission errors (#61389) (#61533)
• UI: Flatten grid structure endpoint memory consumption (#61273) (#61393)
• UI: Reduce memory usage in grid view by optimizing node data storage (#61656) (#61789)
• UI: Fix variable table word-break when values are expanded (#62416) (#62781)
• UI: Fix use ISO dates in Gantt chart for cross-browser consistency (#61250) (#62784)
• UI: Fix DataTable overflow on narrow screens (#62603)
• UI: Fix unique keys for pagination ellipses (#62352) (#62366)
• UI: Fix elk.portConstraints for LR orientation in graph view (#62144) (#62187)
• UI: Fix show active backfill in banner instead of first one (#61851) (#62137)
• UI: Fix star icon visibility in Favorite filter buttons when selected (#61862)
• UI: Fix grid view tooltip z-index issue (#61275) (#61403)
• UI: Fix mini-map on DAG graph view not showing DAG nodes (#61511) (#61530)
• UI: Fix pale appearance of filter buttons when selected (#60346 backport fix) (#61457)

Miscellaneous

• Add logging to detect try number race (#62703) (#62821)
• Override tar dependency in Simple auth manager (#62787)
• Remove mp_start_method remnants (#61150) (#62762)
• Expose literal and ParamsDict at SDK top level (#59782) (#62756)
• Add on_task_instance_skipped listener hookspec (#59467) (#61863)
• Persist table columns visibility in local storage (#61858) (#61868)
• Add run_after alias to XComResponse for backward compatibility (#61443) (#61672)
• UI: Add task_display_name to LightGridTaskInstanceSummary model (#61440) (#61505)
• UI: Add multi-line text display option on Variables page (#61679) (#62779)
• UI: Add bulk actions for connections and variables (#61570) (#62076)
• UI: Allow selecting file path using cursor in log viewer (#61011) (#61506)

Doc Only Changes

• Fix Liveness / Readiness / Startup probe path for Airflow 3.x (#58734) (#61411)
• Update health check command syntax for celery worker (#58861) (#61412)
• Translation fixes: Polish (#62031) (#62761), Catalan (#62477), Taiwanese Mandarin (#62397),
  German (#61478), Polish (#61423)
• Remove docs mentioning old, unsupported hybrid executors (#62093) (#62096)
• Clarify security model of Airflow (#61754) (#61770)
• Clarify ExternalTaskSensor path in dags.rst (#61555) (#61617)
• Clarify policy for exposing sensitive data (#59864) (#61392)
• Clarify template context for asset-triggered DAGs in airflow-core docs (#61258) (#61282)
• Add Keycloak token documentation to Security/API (#61228) (#61248)

Apache Airflow Ctl (airflowctl) 0.1.2

📦 PyPI: https://pypi.org/project/apache-airflow-ctl/0.1.2/
📚 Docs: https://airflow.apache.org/docs/apache-airflow-ctl/0.1.2/
🛠 Release Notes: https://airflow.apache.org/docs/apache-airflow-ctl/0.1.2/release_notes.html

Thanks to all the contributors who made this possible. Next time, Release notes will be available through public documentation.

Significant Changes

• Add XCom CLI commands to airflowctl (#61021)
• Add auth list-envs command to list CLI environments and their auth status (#61426)
• Add allowed_run_types to whitelist specific dag run types (#61833)
• Default logical_date to now in airflowctl dagrun trigger to match UI behavior (#61047)

Bug Fixes

• Allow listing dag runs without specifying dag_id (#61525)
• Fix infinite password retry loop in airflowctl EncryptedKeyring initialization (#61329)
• Fix airflowctl auth login reporting success when keyring backend is unavailable (#61296)
• Fix airflowctl crash when incorrect keyring password is entered (#61042)
• Strip api-url for airflowctl auth login which fails with trailing slash (#61245)
• Fix airflow-ctl-tests files not triggering pre-commit integration tests (#61023)

Improvements

• Print debug mode warning to stderr to avoid polluting stdout JSON output (#61302)
• Refactor datamodel defaulting logic into dedicated method (#61236)
• Alias run_after for XComResponse (#61443)
• Add test for sensitive config masking in airflowctl (#60361)

Apache Airflow Helm Chart 1.19.0

Significant Changes

StatsD metrics aggregation now supports configurable TTL-enabled LRU cache to prevent memory growth in long-running daemons (#60933)

The Helm Chart now includes new configuration options for StatsD aggregation management:

• statsd.cache.type - Enable TTL-enabled lru cache or random cache for metrics aggregation (default: lru)
• statsd.cache.size - Maximum number of metrics to cache (default: 1000)
• statsd.cache.ttl - Time-to-live for cached metrics in seconds (0s is TTL disabled) (default: 0s)

This feature addresses uncontrolled memory growth in StatsD daemons by automatically cleaning up stale or unused metric entries. When enabled, the cache uses both LRU (Least Recently Used) eviction and TTL (Time To Live) expiration to manage memory usage effectively.

To maintain backward compatibility, the default behaviour remains unchanged. Users experiencing memory growth issues with StatsD can enable this feature by setting statsd.cache.ttl to value higher than 0 in their Helm values.

Support for Multiple Celery Worker Sets in the Helm Chart (#58547)

This change introduces support for advanced Celery Workers topologies to Apache Airflow Helm Chart, enabling more flexible resource allocation and precise autoscaling configurations.

Flexible Worker Topologies: The new workers.celery.enableDefault flag allows users to configure a deployment consisting only of specialized worker sets defined in workers.celery.sets section.

Multi-Queue Autoscaling Support: Updates the KEDA ScaledObject generation to support comma-separated queue lists. By using the SQL IN (...) clause, we ensure that KEDA scales worker sets based on the precise aggregate workload of all their assigned queues.

Granular Configuration Overrides: This change allows for overwrite of any currently available workers configuration per worker set. For example, a user can enable KEDA globally, but explicitly disable it for a specific worker set that requires a static number of replicas.

Options to create a default user have been moved under the createUserJob section

Please update your configuration accordingly:

• webserver.defaultUser section is now deprecated in favor of createUserJob (#59767)

The previous configuration options are still working but are deprecated and will be removed in a future version.

Note that the previous documentation described also the option apiServer.defaultUser, which was never implemented in the chart. The only supported option is now createUserJob. Using apiServer.defaultUser will raise an error.

Celery specific config options have been moved under the celery section in workers

Please update your configuration accordingly:

• workers.replicas command is now deprecated in favor of workers.celery.replicas (#59730)
• workers.revisionHistoryLimit command is now deprecated in favor of workers.celery.revisionHistoryLimit (#60056)
• workers.args command is now deprecated in favor of workers.celery.args (#60163)
• workers.livenessProbe section is now deprecated in favor of workers.celery.livenessProbe (#60186)
• workers.updateStrategy section is now deprecated in favor of workers.celery.updateStrategy (#60351)
• workers.strategy section is now deprecated in favor of workers.celery.strategy (#60354)
• workers.podManagementPolicy section is now deprecated in favor of workers.celery.podManagementPolicy (#60359)
• workers.persistence section is now deprecated in favor of workers.celery.persistence (#60238)

The previous configuration options are still working but are deprecated and will be removed in a future version.

Manual Service Account Token Volume configuration for pod-launching executors (#59156)

Added support for manual Service Account Token Volume configuration when using pod-launching executors
(CeleryExecutor, CeleryKubernetesExecutor, KubernetesExecutor, LocalKubernetesExecutor).
This implements defense-in-depth security with both ServiceAccount and Pod-level controls, providing
compatibility with security policies like Kyverno and enabling container-specific privilege assignment
following the Principle of Least Privilege.

Add imagePullSecrets option (#58094)

Add .Values.imagePullSecrets as the new mechanism for configuring registry credentials,
deprecating both .Values.registry.secretName and the automatic creation of the <RELEASE_NAME>-registry secret from .Values.registry.connection.

Default Airflow image is updated to 3.1.7 (#61447)

The default Airflow image that is used with the Chart is now 3.1.7, previously it was 3.0.2.

Default git-sync image is updated to 4.4.2 (#54085)

The default git-sync image that is used with the Chart is now 4.4.2, previously it was 4.3.0.

New Features

• Add PodDisruptionBudget for Dag Processor (#60294)
• Add PodDisruptionBudget for Triggerer and Workers (#59068)
• Add HorizontalPodAutoscaler (HPA) for API Server (#52392)
• Add support for launching jobs with KubernetesJobOperator (#52024)
• Add CronJob to clean old records in the database (#58155)

Improvements

• Improve dag_bundle_config_list Configuration (#60645)
• Add workers.celery.kerberosInitContainer & workers.kubernetes.kerberosInitContainer (#60751, #60427)
• Add workers.celery.securityContexts & workers.kubernetes.securityContexts (#60396)
• Add workers.celery.podManagementPolicy field (#60359)
• Add workers.celery.strategy field (#60354)
• Add workers.celery.updateStrategy field (#60351)
• Add workers.celery.persistence section (#60238)
• Add workers.celery.livenessProbe section (#60186)
• Add workers.celery.args field (#60163)
• Add workers.celery.command & workers.kubernetes.command (#60067)
• Allow custom volumeClaimTemplates when logs.persistence.enabled is true (#60118)
• Add checksum for JWT secret in API server and scheduler deployments (#60111)
• Add workers.celery.revisionHistoryLimit field (#60056)
• Add Redis StatefulSet persistentVolumeClaimRetentionPolicy support (#59955)
• Add workers.celery.replicas field (#59730)
• Add custom envs to database cleanup (#59804)
• Extend airflow_ti_running metrics by scheduled, queued and deferred (#58819)
• Create an explicit control for createUserJob (#56057)
• Make cleanup cronjob conditional on kubernetes executor (#58695)
• Add database cleanup options and remove deprecated securityContext field (#58663)
• Add ability to disable API Server (#56493)
• Add registry.secretNames and registry.connections options (#58094)
• Allow custom labels in StatsD, redis and Dag Processor (#55832)
• Allow setting restartPolicy for batch jobs in chart (#54354)
• Add readiness and liveliness support for git sync relay sidecars (#50218)
• Allow overriding schedulerName on worker/tasks pods (#53983)
• Allow additional PodDisruptionBudget config properties (#58864)
• Add EdgeExecutor to KEDA query (#55560)
• Allow revisionHistoryLimit to be set to 0 (#60340)
• Allow optional subPath for logs volume mount (#52350)
• Move triggerer from pod-log-reader-role to pod-launcher-role (#56872)

Bug Fixes

• Remove kedaNetworkPolicySelector from helpers (#61564)
• Use the bitnamilegacy/postgresql image (#61156)
• Fix Compatibility of Celery Worker Sets with Workers Separation (#60420)
• Fix database cleanup cronjob ImagePullSecrets (#58626)
• Remove workers.celery breaking change (#61049)
• Fix missing templating in API Server extraInitContainers (#60812)
• Fix securityContext.containers/ingress.apiServer in values.schema.json (#60575)
• Remove unused containerLifecycleHooks field (#60239)
• Remove unneeded logic in api-server (#60147)
• Remove defaultUser from API Server in values.schema.json (#59762)
• Isolate defaultUser handling in createUserJob (#59767)
• Fix rendering condition of git_sync_ssh_key_volume (#59418)
• Add watch for events to the Pod launcher role (#59080)
• Ensure that git-sync actually runs when dags.gitSync.enabled=true and dags.persistence.enabled=true (#59123)
• Don't add labels to non-existent configuration options (#59213)
• Add log volume to init container for scheduler, triggerer and worker (#56418)
• Correctly derive celery sync_parallelism from scheduler CPU limits (#58733)
• Fix ingress notes (#59122)
• Fix Liveness / Readiness / Startup probe path for Airflow 3.x (#58734)
• Fix flower network policy condition when multiple executors (#58635)
• Missing SCC Role bindings for redis and api-server (#57985)
• Ensure graceful Redis shutdown(#58432)
• Start Redis directly, not via shell (#58790)
• Add missing airflow.fullname on kubernetes objects (#52953)
• StatsD deployment volume mount without subpath for live reloading (#54986)
• Fix KEDA query for Kubernetes Executor (#55559)
• Add API Server config in k8s pod template (#53533)
• Fix helm schema validation for executor value (#54682)
• Correct watch verb quoting in Airflow Job Launcher Role (#53822)
• Trim non-alphanumeric characters from the executor label (#53534)
• Fix KEDA Query to Use executor Field Instead of queue for Multiple Executors (#52840)

Doc only changes

• Document how to run the API server behind a reverse proxy (#61095)
• Clarify ingress settings for Airflow 2 vs 3 in values.yaml (#60434)
• Add database cleanup docs to Helm productions docs (#58707)
• KEDA best practices + better documentation (#58246)
• Update chart info about built-in secrets and environment variables (#58317)
• Fix typo in PgBouncer section of the Production Guide (#56754)
• Update webserver secr...

Apache Airflow 3.1.7

📦 PyPI: https://pypi.org/project/apache-airflow/3.1.7/
📚 Docs: https://airflow.apache.org/docs/apache-airflow/3.1.7/
🛠 Release Notes: https://airflow.apache.org/docs/apache-airflow/3.1.7/release_notes.html
🐳 Docker Image: "docker pull apache/airflow:3.1.7"
🚏 Constraints: https://github.com/apache/airflow/tree/constraints-3.1.7

Significant Changes

No significant changes.

Bug Fixes

• Fix JWT token generation with unset issuer/audience config (#61331)
• Fix callback files losing priority during queue resort (#61232) (#61243)
• Fix Dag callback for versioned bundles in the processor (#60734) (#61230)
• Add 404 handling for non-existent Dag (#61131) (#61225)
• Add guardrail to handle Dag deserialization errors in scheduler (#61162) (#61210)
• Fix asset scheduling for stale Dags (#59337) (#60022) (#61106)
• Fix unnecessary Dag version churn when Dag file paths change (#60799)
• Fix missing warning when Bundle path may not be accessible to impersonated user (#60278)
• Fix TriggerDagRunOperator deferring when wait_for_completion=False (#60052)
• Fix NoneType error when updating serialized Dag (#56422)
• Fix Pool API slots validation (#61071) (#61114)
• Fix DagBag parsing by adding bundle_path temporarily to sys.path (#55894) (#61053)
• Fix API to respect maximum page limit (#60989) (#61073)
• Prevent Triggerer from crashing when a trigger event isn't serializable (#60152) (#60981)
• Fix permissions on get_event_logs endpoint (#60936) (#60958)
• Fix Dag access control for dag_id in query param (#60935) (#60959)
• Fix root logger to use log_level instead of hardcoded INFO level (#60784) (#60970)
• Fix Dag processor OOM by Avoid loading all TaskInstances when checking DagVersion in write_dag (#60937) (#60962)
• Fix worker startup Dag load failures by rescheduling tasks instead of exiting (#59604) (#60926)
• Fix permissions check in import error APIs (#60801) (#60884)
• Fix refresh-token invalidation by logging out the user (#60781) (#60881)
• Fix connection test API to restore masked password/extra from existing connections (#59643) (#60873)
• Fix Dag processor overhead by applying gc.freeze (#60505) (#60845)
• Fix Dag processor crashing due to MySQL deadlock errors (#60166) (#60418)
• Ensure unique run_id across manually triggered Dags with schedules (#59477) (#60468)
• UI: Avoid gantt annotation error during resize (#60877)
• UI: Fix react apps plugins router (#61206)
• UI: Reset pagination on search in all pages (#61169)
• UI: Explicitly set UI table ordering (#60609) (#61216)
• UI: Plugins pagination fix #61055 (#61059) (#61129)
• UI: Fix ui get dags permission endpoint for user without Dag run permissions (#60979) (#60988)
• UI: Convert Tasks Table from card to table mode (#60830) (#60874)
• UI: Fix slow log scrolling for large task logs (#60806) (#60875)
• UI: Grey out trigger button on API 403 (#60648) (#60777)
• UI: Remove API error from disabling submit (#60473) (#60658)
• UI: Added toasters for permission denied (#57966) (#58016) (#60646)
• UI: Move row count and display toggle into DataTable (#57680) (#60639)
• UI: Fix/backfill permission error handling (#60582) (#60587)
• UI: Improve Dags Filter UI (#60346) (#60547)
• UI: Update PoolBar to separate Scheduled and Deferred slots (#59270) (#60538)
• UI: Correct the access for the externalLogUrl (#60412) (#60479)
• UI: Fix gantt chart styling (#60347) (#60457)
• UI: Reset pagination on DagList search (#60326) (#60336)
• UI: Move dags list filters to buttongroups (#60298) (#60337)
• UI: Fix table filters resetting when deleting a Dag (#60279) (#60287)
• UI: Fix sidebar visibility issue when main content exceeds viewport height (#59660) (#60286)
• UI: Add virtualization to grid view (#60241) (#60285)

Miscellaneous

• UI: Upgrade react-dom-router in Airflow UI (#60316) (#60456)
• Use bulk DELETE for XComModel.clear() instead of loading records (#60955)
• Refactor Dag file queuing and fix redundant processing (#60124)
• Optimized Dag processing queue order on bundle refresh (#60003)
• Remove unused method is_default_pool in Pool model (#61084) (#61128)
• Translation fixes: Taiwaness Mandarin (#61126), Catalan (#61093), German (#61097), Polish (#61099),
  Arabic (#60635 #60782, (#60635) (#60782)), Spanish (#60775 #60785, (#60775) (#60785)),
  Hebrew (#60633 #60686, (#60633) (#60686))

Doc Only Changes

• Fix minor display issue with migration to airflow 3 docs (#60749)
• Fix airflow.utils.context.Context import path in Airflow 3 migration doc (#59937)
• Add missing links to airflow.sdk classes and functions in public interface docs (#61005) (#61012)
• Clarify BaseSensorOperator parameters in Sensors guide (#60275)
• Fix docstring for RuntimeTaskInstance.xcom_pull (#60220) (#60252)
• Fix broken syntax highlighting in AIR rules note section (#59188)