Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 18, 2025

Bumps apache-airflow from 2.10.5 to 3.1.3.

Release notes

Sourced from apache-airflow's releases.

Apache Airflow 3.1.3

📦 PyPI: https://pypi.org/project/apache-airflow/3.1.3/ 📚 Docs: https://airflow.apache.org/docs/apache-airflow/3.1.3/ 🛠 Release Notes: https://airflow.apache.org/docs/apache-airflow/3.1.3/release_notes.html 🐳 Docker Image: "docker pull apache/airflow:3.1.3" 🚏 Constraints: https://github.com/apache/airflow/tree/constraints-3.1.3

Significant Changes

Fix Connection & Variable access in API server contexts (plugins, log handlers)(#56583)

Previously, hooks used in API server contexts (plugins, middlewares, log handlers) would fail with an ImportError for SUPERVISOR_COMMS, because SUPERVISOR_COMMS only exists in task runner child processes.

This has been fixed by implementing automatic context detection with three separate secrets backend chains:

Context Detection:

  1. Client contexts (task runner in worker): Detected via SUPERVISOR_COMMS presence
  2. Server contexts (API server, scheduler): Explicitly marked with _AIRFLOW_PROCESS_CONTEXT=server environment variable
  3. Fallback contexts (supervisor, unknown contexts): Neither marker present, uses minimal safe chain

Backend Chains:

  • Client: EnvironmentVariablesBackendExecutionAPISecretsBackend (routes to Execution API via SUPERVISOR_COMMS)
  • Server: EnvironmentVariablesBackendMetastoreBackend (direct database access)
  • Fallback: EnvironmentVariablesBackend only (+ external backends from config like AWS Secrets Manager, Vault)

The fallback chain is crucial for supervisor processes (worker-side, before task runner starts) which need to access external secrets for remote logging setup but should not use MetastoreBackend (to maintain worker isolation).

Architecture Benefits:

  • Workers (supervisor + task runner) never use MetastoreBackend, maintaining strict isolation
  • External secrets backends (AWS Secrets Manager, Vault, etc.) work in all three contexts
  • Supervisor falls back to Execution API client for connections not found in external backends
  • API server and scheduler have direct database access for optimal performance

Impact:

  • Hooks like GCSHook, S3Hook now work correctly in log handlers and plugins
  • No code changes required for existing plugins or hooks
  • Workers remain isolated from direct database access (network-level DB blocking fully supported)
  • External secrets work everywhere (workers, supervisor, API server)
  • Robust handling of unknown contexts with safe minimal chain

See: [#56120](https://github.com/apache/airflow/issues/56120) <https://github.com/apache/airflow/issues/56120>, [#56583](https://github.com/apache/airflow/issues/56583) <https://github.com/apache/airflow/issues/56583>, [#51816](https://github.com/apache/airflow/issues/51816) <https://github.com/apache/airflow/issues/51816>__

Remove insecure dag reports API endpoint that executed user code in API server (#56609)

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [apache-airflow](https://github.com/apache/airflow) from 2.10.5 to 3.1.3.
- [Release notes](https://github.com/apache/airflow/releases)
- [Changelog](https://github.com/apache/airflow/blob/main/docker-stack-docs/changelog.rst)
- [Commits](apache/airflow@2.10.5...3.1.3)

---
updated-dependencies:
- dependency-name: apache-airflow
  dependency-version: 3.1.3
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Nov 18, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant