)]}' { "log": [ { "commit": "6d4808b4e802aacf6cf3a08dbb2272fadbb45951", "tree": "09d4d7e61b27a9b7d90103a111b4ac34a790c3b4", "parents": [ "c77ec694d1a1cfa1c12baacc5184cfd03b734206" ], "author": { "name": "Jyun-An Chen", "email": "jun930436@gmail.com", "time": "Sat Sep 05 07:41:54 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 05 00:41:54 2026 +0100" }, "message": "Add require_approval preflight check to @task.llm_schema_compare (#71688)\n\n@task.llm, @task.llm_branch, and @task.llm_sql all reject a non-string\nSequence[UserContent] prompt combined with require_approval\u003dTrue before\nthe LLM runs, with an error naming the decorator the caller actually used.\n@task.llm_schema_compare was missing this decorator-level check, so the\nsame misuse instead fell through to the underlying operator\u0027s own guard --\nwhich names the internal _LLMSchemaCompareDecoratedOperator class rather\nthan the decorator, confusing anyone who only ever wrote\n@task.llm_schema_compare." }, { "commit": "c77ec694d1a1cfa1c12baacc5184cfd03b734206", "tree": "1d2e3c626a9105432a0f7a1e8c6d0f7b220ac61b", "parents": [ "f23c096635f09b3f610bd9a72fa7874d1a173bc7" ], "author": { "name": "Wei Lee", "email": "weilee@apache.org", "time": "Fri Sep 04 18:38:11 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 05 00:38:11 2026 +0100" }, "message": "Fix LlamaIndexHook docs to stop claiming Ollama/vLLM support (#72013)\n\nThe class docstring, the host field description, and the UI\nplaceholder said host\u003d could point LlamaIndexHook at Ollama or vLLM.\nget_llm() and get_embedding_model() return LlamaIndex\u0027s OpenAI /\nOpenAIEmbedding classes, which validate model\u003d client-side against\nLlamaIndex\u0027s OpenAI-only model-name allowlists before any request is\nsent, so an Ollama/vLLM model name is rejected regardless of host.\nDocument the real constraint and why it exists instead of the\nnon-existent Ollama/vLLM support." }, { "commit": "f23c096635f09b3f610bd9a72fa7874d1a173bc7", "tree": "d476f39693153e087da290c8259d4d46cce8b4e8", "parents": [ "90354f166e1d511483c7084d11d0678b34f11cc4" ], "author": { "name": "Andrew Chang", "email": "69671930+Andrushika@users.noreply.github.com", "time": "Sat Sep 05 02:18:44 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 05 02:18:44 2026 +0800" }, "message": "Stop airflowctl integration tests timing out right after a Dag run starts (#72523)\n\nThe compose stack used by the tests runs one api-server process that also\nserves the Execution API. With the default Celery concurrency of 16, one\ntrigger of example_bash_operator forks more than ten task processes at once\non the 4 vCPU runner, and the api-server gets no CPU for 20 to 35 seconds.\nairflowctl commands running in that window hit the 5 second read timeout\nthree times and exit 1, which is the flaky failure seen in\ntest_airflowctl_commands[tasks failed-deps0] and neighbouring commands.\n\nLimiting the worker to 2 concurrent tasks in the test environment removes\nthe burst. Under the same CPU pressure that produced a 19 second stall\nlocally, the health endpoint never took more than 2 seconds afterwards." }, { "commit": "90354f166e1d511483c7084d11d0678b34f11cc4", "tree": "54fd5eeb764c18100048f3cb335ad78e334188d6", "parents": [ "0f7f45f674cbd2575c365107f843d2872980760f" ], "author": { "name": "Priyadharshini Jaffar Ali", "email": "85486815+Priyaj11@users.noreply.github.com", "time": "Fri Sep 04 12:44:50 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 04 12:44:50 2026 -0400" }, "message": "Fix EmrContainerSensor reporting success for an unknown job state (#72500)\n\nEmrContainerSensor.poke() returned True for any state that was neither a\nfailure state nor an intermediate state, so an unknown state was treated\nas a successful job run. SUCCESS_STATES was declared but never used.\n\nEmrContainerHook.check_query_status returns None when it swallows a\ngeneric ClientError, and poll_query_status passes that None through once\nmax_polling_attempts is reached. A throttled or otherwise transiently\nfailing DescribeJobRun therefore marked the task successful while the job\nwas still running.\n\nCheck state against SUCCESS_STATES instead, and add tests for the None\nand unrecognised-state cases." }, { "commit": "0f7f45f674cbd2575c365107f843d2872980760f", "tree": "9869fc321138eb0b3223f51196abc8019e438842", "parents": [ "1c23f876f235c70ce60e2defc0d644eb65bf299b" ], "author": { "name": "Kunal", "email": "kunalsharma000780@gmail.com", "time": "Fri Sep 04 22:11:30 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 04 12:41:30 2026 -0400" }, "message": "Fix XComs e2e filter tests: scope the filter input by testid (#72438)\n\n* Fix XComs e2e filter tests: scope the filter input by testid\n\nxcoms.spec.ts\u0027s filter tests locate the active filter pill\u0027s input via\npage.locator(\"div\").filter({ hasText: `${filterName}:` }), which\nmatches any ancestor whose descendant text contains that string.\n#71554 restructured the filter bar\u0027s DOM so more than one ancestor now\nmatches, and .first() no longer reliably picks the actual pill -\ngetByRole(\"textbox\") on it resolves to every textbox inside whichever\ndiv wins, throwing \"resolved to 12 elements instead of 1\".\n\nGive the actively-editing pill\u0027s input a stable data-testid\n(filter-pill-input) instead of relying on ancestor text matching, and\nscope XComsPage.applyFilter() to it directly. Only one pill is ever in\nedit mode at a time, so the testid alone is enough - no per-filter key\nplumbing needed.\n\nAdded a FilterBar test that fails without the fix (verified locally by\nreverting the testid and confirming the new test - and only that\ntest - breaks).\n\nCo-Authored-By: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_015kAvbZ6SeKgp6jbGcvpXSh\n\n* Add newsfragment\n\nCo-Authored-By: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_015kAvbZ6SeKgp6jbGcvpXSh\n\n* Revert \"Add newsfragment\"\n\nThis reverts commit 06fd055afb8fa6f4f3c6b7ea31d5c0920ee850ed.\n\n---------\n\nCo-authored-by: Claude \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Kunal8954 \u003cyour-github-email@example.com\u003e" }, { "commit": "1c23f876f235c70ce60e2defc0d644eb65bf299b", "tree": "0449c9c29dd879c1801bda39a9ec785acf722049", "parents": [ "8cbbf7c62c5fac74525aeeed6394fe38e98f54a2" ], "author": { "name": "Ed Summers", "email": "ehs@pobox.com", "time": "Fri Sep 04 12:40:08 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 04 12:40:08 2026 -0400" }, "message": "UI: Set the API client base URL before the first startup request (#72374)\n\nWhen Airflow is served under a path prefix, the UI sent its first API request\nto the origin root instead of the prefix.\n\n`OpenAPI.BASE` was assigned as a module side effect in `queryClient.ts`, which\nimports `src/i18n/config`. That module requests the version at module scope to\nbuild a translation cache buster, and ES module evaluation runs a dependency to\ncompletion before the importing module\u0027s body, so the request always went out\nwhile `BASE` was still `\"\"`. The generated client builds its URL as\n`config.BASE + path`, so the request was sent to the origin root.\n\nThe consequences depend on what else is mounted at `/api/`. In our case\nthe request reaches a different service, which responded with a 401\nwhich the UI reads as an expired session, which redirects to login,\nwhich succeeds and reloads, producing an infinite login loop. The\nrequest also defeats the feature it exists for: the lookup fails,\n`resolveI18nVersion` falls back to `Date.now()`, and translations are\nfetched with a timestamp instead of the version.\n\nMove the base href resolution and the client configuration into `src/basePath`,\na module with no application dependencies, and have `i18n/config` take its base\npath from there. The ordering guarantee then comes from a real data dependency\nrather than from the import graph happening to line up.\n\n`utils/links.ts` still reads `\u003cbase href\u003e` separately, but it does so at call\ntime rather than module scope, so it is unaffected; consolidating it is left\nout to keep this change to the bug.\n\nAdds a regression test that fails on main with\n`expected [ \u0027/api/v2/version\u0027 ] to deeply equal []`.\n\nCloses: #72344" }, { "commit": "8cbbf7c62c5fac74525aeeed6394fe38e98f54a2", "tree": "e6a3fce43ea8f54363fbd3edeca1ceeb5ae00e81", "parents": [ "6815d040ed1b170477904f3f1c31316d00b855b4" ], "author": { "name": "Brent Bovenzi", "email": "brent@astronomer.io", "time": "Fri Sep 04 12:17:23 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 04 18:17:23 2026 +0200" }, "message": "Fix HITL form crashing on null values (#72375)" }, { "commit": "6815d040ed1b170477904f3f1c31316d00b855b4", "tree": "301741b1aca0dde5f6324893751bce51036194c7", "parents": [ "dc529a12f1bd54650523beecfa931bf31fc3f03d" ], "author": { "name": "SameerMesiah97", "email": "75502260+SameerMesiah97@users.noreply.github.com", "time": "Fri Sep 04 13:47:41 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 04 07:47:41 2026 -0500" }, "message": "Add dedicated exceptions for terminal waiter failures and max-attempt exhaustion, and allow AWS triggers to customize exception-to-event translation without reimplementing the shared waiter lifecycle. (#72455)" }, { "commit": "dc529a12f1bd54650523beecfa931bf31fc3f03d", "tree": "300d3ad21e736db70703d138bebf3341032817f7", "parents": [ "760ee9a2d399374114f06080b5dd6be4c07e7b2d" ], "author": { "name": "Ed Summers", "email": "ehs@pobox.com", "time": "Fri Sep 04 08:39:11 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 04 07:39:11 2026 -0500" }, "message": "Keycloak auth manager: keep API tokens usable with the Authorization (#72381)\n\nOn Airflow 3.3+, a token from `POST /auth/token` no longer authorized anything.\n`serialize_user()` omits the Keycloak JWTs from the claims, and the only code\nthat supplies them again, `KeycloakJWTMiddleware`, reads them from cookies. A\nclient authenticating with the `Authorization` header sends no cookies, so\n`get_user_from_token()` fell through to `return None` and the request failed --\nin practice with a 500, because the `None` reaches the authorization layer and\nraises `AttributeError: \u0027NoneType\u0027 object has no attribute \u0027get_id\u0027`.\n\nThe tokens were moved into cookies to keep the browser session cookie under the\n4096 byte limit. That constraint does not apply to a token handed to an API\nclient, which is never stored in a cookie, so the two paths can differ:\n\n- `generate_api_jwt()` mints tokens that keep the Keycloak JWTs in their claims,\n and `POST /auth/token` uses it for both the password and client-credentials\n grants. It builds on `serialize_user()` so an API token cannot silently miss a\n claim the browser flow gains later.\n- The browser paths, `routes/login.py` and the middleware, are unchanged and\n still mint claim-free tokens backed by the cookies.\n- `get_user_from_token()` falls back to the claims when no cookie-supplied\n tokens are present.\n\nThe fallback does not weaken the subject binding added for the cookie flow.\nThat check exists because cookies are not covered by the Airflow JWT signature,\nso a caller could pair their own session with somebody else\u0027s Keycloak token.\nIn the claims both values come from the same signed payload, and both minting\nsites derive them from one Keycloak response, so a mismatched pair cannot be\nconstructed.\n\nA browser token still resolves to `None` without its cookies: it carries no\nclaims to fall back on. Tested alongside the fix so the two paths stay distinct.\n\nFixes #72352" }, { "commit": "760ee9a2d399374114f06080b5dd6be4c07e7b2d", "tree": "d54a75a29a594caf7a7701e2fb0d97a7f001e96d", "parents": [ "e15f0d3bf129d73fc108d9b8869d6d0957a4731f" ], "author": { "name": "Alice", "email": "78815181+weiyu1029@users.noreply.github.com", "time": "Fri Sep 04 07:30:24 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 04 07:30:24 2026 -0500" }, "message": "Fix SageMaker Unified Studio trigger hook config (#72453)" }, { "commit": "e15f0d3bf129d73fc108d9b8869d6d0957a4731f", "tree": "b9307143e7446cb82debadafb5edf20b250e4d90", "parents": [ "b3b62fa8cf3c32cb45bb2815385a2af498300754" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 04 07:29:29 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 04 07:29:29 2026 -0500" }, "message": "Bump webpack (#72490)\n\nBumps the fab-ui-package-updates group with 1 update in the /providers/fab/src/airflow/providers/fab/www directory: [webpack](https://github.com/webpack/webpack).\n\n\nUpdates `webpack` from 5.110.1 to 5.110.2\n- [Release notes](https://github.com/webpack/webpack/releases)\n- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/webpack/webpack/compare/v5.110.1...v5.110.2)\n\n---\nupdated-dependencies:\n- dependency-name: webpack\n dependency-version: 5.110.2\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: fab-ui-package-updates\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "b3b62fa8cf3c32cb45bb2815385a2af498300754", "tree": "fd6a447702c2abacccf4bcc514637ea532b8083b", "parents": [ "9b3cc52821e0fb47e155372265b81628b312d490" ], "author": { "name": "Sruthi", "email": "sruthianuvalasetty10@gmail.com", "time": "Wed Sep 02 21:53:17 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 03 12:53:17 2026 +0800" }, "message": "Add unit tests for common AI provider exceptions (#72082)\n\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e" }, { "commit": "9b3cc52821e0fb47e155372265b81628b312d490", "tree": "29a094bb046c6b47a3ea9421265aa7666bab251c", "parents": [ "d41f589538b1b5777a405c0806263a11d6017af1" ], "author": { "name": "M. Waqas Shahid", "email": "vikrocx@yahoo.com", "time": "Wed Sep 02 23:37:17 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 03 03:07:17 2026 +0530" }, "message": "Change the path from airflow.utils.state.TaskInstanceState to `airflow.sdk.TaskInstanceState` for informatica provider (#72445)\n\nCo-authored-by: w-shahid \u003cmwaqasshahid91@gmail.com\u003e" }, { "commit": "d41f589538b1b5777a405c0806263a11d6017af1", "tree": "c9f62baf41ccdaa6d8c8739714b141852cd1a7a2", "parents": [ "38401f8704162b4dfcdc642cd15150677f0fd14b" ], "author": { "name": "Yashraj Gangal", "email": "gangalyashraj@gmail.com", "time": "Wed Sep 02 15:04:40 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 15:04:40 2026 -0500" }, "message": "Add YashrajG to INTHEWILD (#72418)" }, { "commit": "38401f8704162b4dfcdc642cd15150677f0fd14b", "tree": "8a38c0c5cfac68de7f63e046447bed9a5c9fe2d3", "parents": [ "ab0e48e275d1f81e023168d10a9a7b7a9b9792a3" ], "author": { "name": "Vincent", "email": "97131062+vincbeck@users.noreply.github.com", "time": "Wed Sep 02 13:21:34 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 14:21:34 2026 -0400" }, "message": "Pin pnpm version for FAB and Edge3 UI so bumps keep security overrides (#72390)\n\nThese were the only two pnpm directories in the repo without a\n`packageManager` field. Without it, Dependabot resolves them with pnpm 11,\nwhich no longer reads `pnpm.overrides` from `package.json`. It therefore\nregenerates `pnpm-lock.yaml` with the `overrides:` block missing entirely,\nsilently dropping the pinned security patches for transitive dependencies and\nbreaking frozen installs for the pnpm 10 that the asset-compilation hooks use.\n\nThe version matches the one already used everywhere else in the repo." }, { "commit": "ab0e48e275d1f81e023168d10a9a7b7a9b9792a3", "tree": "a51d71cef16189f970223c64e5250eb1881c8ff4", "parents": [ "7036d244b138463acc7849d5e38b419cd800e990" ], "author": { "name": "LuisFelipeUrena", "email": "60860402+LuisFelipeUrena@users.noreply.github.com", "time": "Wed Sep 02 14:15:41 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 12:15:41 2026 -0600" }, "message": "Fix to Broken link in Tasks SDK Documentation (#72443)" }, { "commit": "7036d244b138463acc7849d5e38b419cd800e990", "tree": "bc679101b36ad6fa6361e9968bc8cca50ddad3d9", "parents": [ "b9d52f770c373d86e7d7195556b525a4fce49f31" ], "author": { "name": "KidAmnesiac1", "email": "conor.cadogan@gmail.com", "time": "Wed Sep 02 23:59:57 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 17:59:57 2026 +0200" }, "message": "Fix Helm chart rendering an invalid label for multi-team executors (#72200)\n\nThe scheduler Deployment copies the executor value into a pod label and sanitises \",\" and \":\" on the way through. Multi-team executor config uses \";\" and \"\u003d\" as its separators, and neither is legal in a Kubernetes label value, so a chart configured the documented multi-team way renders a label the API server rejects and the deploy fails outright.\n\nWhy this is worth fixing rather than working around: multi-team executors are what the edge worker\u0027s --team-name flag depends on. EdgeExecutor stamps each edge_job row with its executor\u0027s team, and a worker started with --team-name only picks up jobs whose team matches. Without a per-team executor entry the jobs get stamped NULL, the worker sits there reporting it has no work, and the tasks stay queued.\n\nThere isn\u0027t a good way around it from values.yaml. Quoting doesn\u0027t help, because the restriction is on the characters in the label rather than on the YAML. Setting config.core.executor instead is refused by the check in NOTES.txt. Overriding the label through .Values.labels does render, but it stamps the label on every object in the chart and breaks the migrations Job, whose pod template can\u0027t be changed in place.\n\nSanitising \";\" and \"\u003d\" alongside the separators the chart already handles keeps the label legal while airflow.cfg still gets the real value.\n\nCo-authored-by: Przemysław Mirowski \u003c17602603+Miretpl@users.noreply.github.com\u003e" }, { "commit": "b9d52f770c373d86e7d7195556b525a4fce49f31", "tree": "23c891bba08a6943362f48182ac128c1256dc2d6", "parents": [ "bdb9580de613078beeebe4fd9fa4417fde231af0" ], "author": { "name": "rjgoyln", "email": "151457491+rjgoyln@users.noreply.github.com", "time": "Wed Sep 02 22:39:43 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 22:39:43 2026 +0800" }, "message": "Remove dead type-mismatched guard in airflow-ctl command generation (#70945)\n\nThe condition compared a Pydantic model class against a dict keyed by\nmodel name, so it never held. It happened to be load-bearing: it forced\nthe field list to be rebuilt on every visit, which is what kept\ndatamodels shared by several operations (ConnectionBody, VariableBody,\nBackfillPostBody) from accumulating duplicate entries. Correcting the\ncomparison to match the key type would have silently introduced those\nduplicates, so the guard is dropped in favour of the unconditional reset\nit was already performing." }, { "commit": "bdb9580de613078beeebe4fd9fa4417fde231af0", "tree": "e33e23e9c9769dd70832d4f1cb873cd16bbf4aa7", "parents": [ "dbaf9c631998ccb6487bf0102d2c63fae9684a83" ], "author": { "name": "Y-C", "email": "easoneason0905@gmail.com", "time": "Wed Sep 02 22:09:13 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 16:09:13 2026 +0200" }, "message": "Helm: Point flower extraNetworkPolicies deprecation at the real key (#72052)\n\nThe deprecation notice has named `flower.networkPolicy.peers` since the\nparameter was restructured, but that key never shipped. `flower.networkPolicy`\nis declared with `additionalProperties: false`, so anyone who follows the\nnotice hits a schema validation error and cannot install or upgrade at all.\nThe warning fires only when the deprecated parameter is set, so it reaches\nexactly the users who are trying to migrate and sends them into a dead end.\n\nCo-authored-by: Eason09053360 \u003c185830721+Eason09053360@users.noreply.github.com\u003e" }, { "commit": "dbaf9c631998ccb6487bf0102d2c63fae9684a83", "tree": "23b7a70ac41111968fc9bc892c98bf3eee5d3ae2", "parents": [ "3e93c7722813d6fec2f3212df3ed15fdd6416561" ], "author": { "name": "Alejandro Morgante", "email": "62363051+AlejandroMorgante@users.noreply.github.com", "time": "Wed Sep 02 11:04:20 2026 -0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 09:04:20 2026 -0500" }, "message": "Add KubernetesPodExecOperator for existing Kubernetes Pods (#71244)" }, { "commit": "3e93c7722813d6fec2f3212df3ed15fdd6416561", "tree": "6cfba016512adbaf092ca04a805af9e814dcbdd6", "parents": [ "fb1d49d5d70fe2374b73d80dd5839b21a106195e" ], "author": { "name": "Baha Bouali", "email": "baha.bouali2020@gmail.com", "time": "Wed Sep 02 15:01:03 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 09:01:03 2026 -0500" }, "message": "Generate fab permission table (#72230)\n\n* Generate the FAB REST API permission table from source\n\n* Also cover FAB\u0027s own user and role endpoints\n\n* Generate the table in place to avoid the glob toctree\n\n* Generate the table in place to avoid the glob toctree" }, { "commit": "fb1d49d5d70fe2374b73d80dd5839b21a106195e", "tree": "4deee0a1e796e8a1bfd0d623ab7b4b36b4665bba", "parents": [ "dbeeb2c71bb1f40755dc6046572ef9986458b8e3" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 02 08:59:18 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 08:59:18 2026 -0500" }, "message": "Bump the edge-ui-package-updates group across 1 directory with 13 updates (#72257)\n\n* Bump the edge-ui-package-updates group across 1 directory with 13 updates\n\nBumps the edge-ui-package-updates group with 13 updates in the /providers/edge3/src/airflow/providers/edge3/plugins/www directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.4` | `5.102.3` |\n| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.3.0` |\n| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.2.5` |\n| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.67.0` | `8.68.0` |\n| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.67.0` | `8.68.0` |\n| [@typescript-eslint/utils](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/utils) | `8.67.0` | `8.68.0` |\n| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.0` |\n| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.10` | `4.1.11` |\n| [eslint](https://github.com/eslint/eslint) | `10.8.1` | `10.9.1` |\n| [happy-dom](https://github.com/capricorn86/happy-dom) | `20.11.2` | `20.11.6` |\n| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.67.0` | `8.68.0` |\n| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.2.2` |\n| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` |\n\n\n\nUpdates `@tanstack/react-query` from 5.101.4 to 5.102.3\n- [Release notes](https://github.com/TanStack/query/releases)\n- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)\n- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.102.3/packages/react-query)\n\nUpdates `@types/node` from 26.2.0 to 26.3.0\n- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)\n- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)\n\nUpdates `@types/react-dom` from 19.2.4 to 19.2.5\n- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)\n- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)\n\nUpdates `@typescript-eslint/eslint-plugin` from 8.67.0 to 8.68.0\n- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)\n- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)\n- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/eslint-plugin)\n\nUpdates `@typescript-eslint/parser` from 8.67.0 to 8.68.0\n- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)\n- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)\n- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/parser)\n\nUpdates `@typescript-eslint/utils` from 8.67.0 to 8.68.0\n- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)\n- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/utils/CHANGELOG.md)\n- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/utils)\n\nUpdates `@vitejs/plugin-react` from 6.0.5 to 6.1.0\n- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)\n- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)\n- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react)\n\nUpdates `@vitest/coverage-v8` from 4.1.10 to 4.1.11\n- [Release notes](https://github.com/vitest-dev/vitest/releases)\n- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)\n- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8)\n\nUpdates `eslint` from 10.8.1 to 10.9.1\n- [Release notes](https://github.com/eslint/eslint/releases)\n- [Commits](https://github.com/eslint/eslint/compare/v10.8.1...v10.9.1)\n\nUpdates `happy-dom` from 20.11.2 to 20.11.6\n- [Release notes](https://github.com/capricorn86/happy-dom/releases)\n- [Commits](https://github.com/capricorn86/happy-dom/compare/v20.11.2...v20.11.6)\n\nUpdates `typescript-eslint` from 8.67.0 to 8.68.0\n- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)\n- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)\n- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/typescript-eslint)\n\nUpdates `vite` from 8.2.1 to 8.2.2\n- [Release notes](https://github.com/vitejs/vite/releases)\n- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)\n- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)\n\nUpdates `vitest` from 4.1.10 to 4.1.11\n- [Release notes](https://github.com/vitest-dev/vitest/releases)\n- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)\n- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)\n\n---\nupdated-dependencies:\n- dependency-name: \"@tanstack/react-query\"\n dependency-version: 5.102.3\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: edge-ui-package-updates\n- dependency-name: \"@types/node\"\n dependency-version: 26.3.0\n dependency-type: direct:development\n update-type: version-update:semver-minor\n dependency-group: edge-ui-package-updates\n- dependency-name: \"@types/react-dom\"\n dependency-version: 19.2.5\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: edge-ui-package-updates\n- dependency-name: \"@typescript-eslint/eslint-plugin\"\n dependency-version: 8.68.0\n dependency-type: direct:development\n update-type: version-update:semver-minor\n dependency-group: edge-ui-package-updates\n- dependency-name: \"@typescript-eslint/parser\"\n dependency-version: 8.68.0\n dependency-type: direct:development\n update-type: version-update:semver-minor\n dependency-group: edge-ui-package-updates\n- dependency-name: \"@typescript-eslint/utils\"\n dependency-version: 8.68.0\n dependency-type: direct:development\n update-type: version-update:semver-minor\n dependency-group: edge-ui-package-updates\n- dependency-name: \"@vitejs/plugin-react\"\n dependency-version: 6.1.0\n dependency-type: direct:development\n update-type: version-update:semver-minor\n dependency-group: edge-ui-package-updates\n- dependency-name: \"@vitest/coverage-v8\"\n dependency-version: 4.1.11\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: edge-ui-package-updates\n- dependency-name: eslint\n dependency-version: 10.9.1\n dependency-type: direct:development\n update-type: version-update:semver-minor\n dependency-group: edge-ui-package-updates\n- dependency-name: happy-dom\n dependency-version: 20.11.6\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: edge-ui-package-updates\n- dependency-name: typescript-eslint\n dependency-version: 8.68.0\n dependency-type: direct:development\n update-type: version-update:semver-minor\n dependency-group: edge-ui-package-updates\n- dependency-name: vite\n dependency-version: 8.2.2\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: edge-ui-package-updates\n- dependency-name: vitest\n dependency-version: 4.1.11\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: edge-ui-package-updates\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\n\n* Restore pnpm overrides in the Edge UI lockfile\n\nDependabot regenerates pnpm-lock.yaml without applying the pnpm.overrides\nblock from package.json, so the lockfile loses its overrides section and\nevery frozen install fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. The\noverrides carry security-advisory pins, so dropping them would also silently\nundo those. Regenerated with the pinned pnpm 10.28.1.\n\nGenerated-by: Claude Code (Opus 5)\n\n---------\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: Jarek Potiuk \u003cjarek@potiuk.com\u003e" }, { "commit": "dbeeb2c71bb1f40755dc6046572ef9986458b8e3", "tree": "6d0c9dc5f55501cccbed30a04beb00274cb6168b", "parents": [ "bf976c8805ad1a9e9664723aefcd0a62b659d627" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 02 08:37:20 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 08:37:20 2026 -0500" }, "message": "Bump the fab-ui-package-updates group across 1 directory with 4 updates (#72383)\n\n* Bump the fab-ui-package-updates group across 1 directory with 4 updates\n\nBumps the fab-ui-package-updates group with 4 updates in the /providers/fab/src/airflow/providers/fab/www directory: [css-loader](https://github.com/webpack/css-loader), [eslint](https://github.com/eslint/eslint), [webpack](https://github.com/webpack/webpack) and [webpack-cli](https://github.com/webpack/webpack-cli).\n\n\nUpdates `css-loader` from 7.1.4 to 7.1.5\n- [Release notes](https://github.com/webpack/css-loader/releases)\n- [Changelog](https://github.com/webpack/css-loader/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/webpack/css-loader/compare/v7.1.4...v7.1.5)\n\nUpdates `eslint` from 10.9.0 to 10.9.1\n- [Release notes](https://github.com/eslint/eslint/releases)\n- [Commits](https://github.com/eslint/eslint/compare/v10.9.0...v10.9.1)\n\nUpdates `webpack` from 5.109.2 to 5.110.1\n- [Release notes](https://github.com/webpack/webpack/releases)\n- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/webpack/webpack/compare/v5.109.2...v5.110.1)\n\nUpdates `webpack-cli` from 7.2.2 to 7.2.3\n- [Release notes](https://github.com/webpack/webpack-cli/releases)\n- [Changelog](https://github.com/webpack/webpack-cli/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/webpack/webpack-cli/compare/webpack-cli@7.2.2...webpack-cli@7.2.3)\n\n---\nupdated-dependencies:\n- dependency-name: css-loader\n dependency-version: 7.1.5\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: fab-ui-package-updates\n- dependency-name: eslint\n dependency-version: 10.9.1\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: fab-ui-package-updates\n- dependency-name: webpack\n dependency-version: 5.110.1\n dependency-type: direct:development\n update-type: version-update:semver-minor\n dependency-group: fab-ui-package-updates\n- dependency-name: webpack-cli\n dependency-version: 7.2.3\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: fab-ui-package-updates\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\n\n* Update lock file\n\n---------\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: vincbeck \u003cvincbeck@amazon.com\u003e" }, { "commit": "bf976c8805ad1a9e9664723aefcd0a62b659d627", "tree": "4db529b7f544293978f9d40b34de1634809c505c", "parents": [ "2aae2829723826065e99c3de7b68e54fa5eb48ed" ], "author": { "name": "Aakcht", "email": "aakcht@gmail.com", "time": "Wed Sep 02 05:35:44 2026 +0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 02:35:44 2026 +0200" }, "message": "Fix documentation example for scheduler resources (#72099)" }, { "commit": "2aae2829723826065e99c3de7b68e54fa5eb48ed", "tree": "941627b41678424c52f7effe7dc9c4f789e6dbac", "parents": [ "24d8c66ee11e3003801b51511c4308e97a944a97" ], "author": { "name": "Dheeraj Turaga", "email": "dheerajturaga@gmail.com", "time": "Tue Sep 01 18:07:40 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 18:07:40 2026 -0500" }, "message": "Support multiple_outputs in @task.bash (#71808)" }, { "commit": "24d8c66ee11e3003801b51511c4308e97a944a97", "tree": "68469fb4274fa1a11b608d385156e18608192216", "parents": [ "a32662cc0ef6c877c883478fe7f09ee9574b2e57" ], "author": { "name": "Y-C", "email": "easoneason0905@gmail.com", "time": "Tue Sep 01 15:17:24 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 14:17:24 2026 +0700" }, "message": "Prevent Dag CLI subcommands from being silently dropped (#72340)" }, { "commit": "a32662cc0ef6c877c883478fe7f09ee9574b2e57", "tree": "d463ce95ee1a456c70274b5cd959d0299c6468a6", "parents": [ "c951918e0f5ceace7d4683440f2adf5344977eac" ], "author": { "name": "Shubham Kapoor", "email": "shubham.kapoor992@gmail.com", "time": "Tue Sep 01 11:50:26 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 08:20:26 2026 +0200" }, "message": "IBM Db2 provider: skip None-valued extra parameters to avoid KEY\u003dNone in connection strings (#72025)\n\n* IBM Db2 provider: skip None-valued extra parameters to avoid KEY\u003dNone in connection strings\n\nWhen a user leaves an optional extra field blank in the Airflow connection\nform, the JSON stored in the extra field contains null values (e.g.\n{\"SSLServerCertificate\": null}). Previously these were emitted verbatim\ninto both the ibm_db connection string (KEY\u003dNone;) and the SQLAlchemy URI\nquery string (?KEY\u003dNone), causing the Db2 driver to receive the literal\nstring \"None\" as a parameter value. This either triggers a connection\nerror or silently passes a bad value to the driver.\n\nFix: skip any extra key whose value is None before building the connection\nstring in get_conn() and before building the query string in get_uri().\n\nAdd parametrized tests covering both methods to prevent regression.\n\n* Merge skips-None-extra tests into one parametrized test covering both get_conn and get_uri\n\n---------\n\nCo-authored-by: Shubham Kapoor \u003cshubhamkapoor@Shubhams-MacBook-Pro.local\u003e" }, { "commit": "c951918e0f5ceace7d4683440f2adf5344977eac", "tree": "8fe96ed787e39cc508c3fd01476b735a1829465c", "parents": [ "f806187dc85343d82fa4ab477ae5e7c71c1c50f1" ], "author": { "name": "Ryan Hamilton", "email": "ryan@ryanahamilton.com", "time": "Mon Aug 31 17:07:06 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 17:07:06 2026 -0400" }, "message": "UI: Rename components/ui to system-components and group imports (#72349)\n\n* UI: Rename components/ui to system-components\n\nThe directory holds the project\u0027s customized Chakra primitives — its\ndesign system — but sitting under components/ it read as just another\ncomponents subfolder, to the point that AGENTS.md needed a line telling\ncontributors not to put generic app components there. Promoting it to a\ntop-level directory makes that boundary structural rather than documented.\n\n* UI: Remove the unused Tag system component\n\nNothing imports it and it was never re-exported from the barrel, so it\nhas been dead since it was added. Chakra\u0027s Tag is available directly for\nanyone who needs one.\n\n* UI: Export every system component from the barrel\n\nFive components were reachable only by deep path, so files needing one of\nthem ended up importing the design system twice — once from the barrel and\nonce from a subpath. Completing the barrel lets every consumer use a single\nimport, and callers no longer need to know which file a component lives in.\n\nMenu and Modal keep sibling-relative imports rather than going through the\nbarrel, which would make the barrel depend on its own members.\n\n* UI: Group imports by architectural layer\n\nImport blocks previously collapsed the design system, pages, components and\nevery other src layer into one undifferentiated block, so a file\u0027s\ndependencies gave no sense of which layers it actually reached into.\nSplitting them into blank-line-separated groups makes that legible at a\nglance, and makes a layering violation visible in review.\n\nOrdering stays with the existing Prettier plugin rather than moving to an\nESLint rule: the prek hook runs eslint --fix before prettier --write, so\nan ESLint rule would be overwritten on disk and leave lint unfixable." }, { "commit": "f806187dc85343d82fa4ab477ae5e7c71c1c50f1", "tree": "c54b73bd7c00431a1f1d91961efe6568cf329223", "parents": [ "c6854682bc579dc2db693d9e8cb5d68327e45bdb" ], "author": { "name": "Vincent", "email": "97131062+vincbeck@users.noreply.github.com", "time": "Mon Aug 31 16:25:01 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 16:25:01 2026 -0400" }, "message": "UI: Add team column and filter to the deadlines list (#72060)\n\n* UI: Add team column and filter to the deadlines list\n\nWhen multi-team mode is enabled, operators watching deadlines across teams need\nto see which team owns each deadline and to scope the list to a single team when\ntriaging that team\u0027s misses.\n\nThe column and the filter render only when the `multi_team` configuration is\nenabled, and no team data is loaded when it is off, so single-team deployments\nare unaffected.\n\n* Make deadlines UI tests recover from leftover team rows\n\nattach_dag_to_team commits its bundle and team before yielding, so a test run\ninterrupted inside that context manager leaves the rows behind. On a persistent\ndatabase every later run then failed with a duplicate-key error until the rows\nwere deleted by hand." }, { "commit": "c6854682bc579dc2db693d9e8cb5d68327e45bdb", "tree": "fc503dbfb279f40611c38fb9ebada8464b4e3a1e", "parents": [ "4dae472e41a619e529f26885d596b9d03416776a" ], "author": { "name": "Vincent", "email": "97131062+vincbeck@users.noreply.github.com", "time": "Mon Aug 31 16:24:19 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 16:24:19 2026 -0400" }, "message": "UI: Add team column and filter to the XComs list (#72158)\n\nWhen multi-team mode is enabled, operators inspecting cross-task communication\nacross teams need to see which team owns each XCom entry and to scope the list\nto a single team while investigating that team\u0027s Dags.\n\nThe column and the filter render only when the `multi_team` configuration is\nenabled, and no team data is loaded when it is off, so single-team deployments\nare unaffected." }, { "commit": "4dae472e41a619e529f26885d596b9d03416776a", "tree": "3b29b4cab8244df1e5c6c6e6e34fe6792c3d6ca5", "parents": [ "15c8d68f84d11b74e16aec5ea1f7d7e82c0e283c" ], "author": { "name": "warreee", "email": "schodtsward@gmail.com", "time": "Mon Aug 31 21:05:01 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 15:05:01 2026 -0400" }, "message": "Respect the limit search param in the task overview duration chart (#72147)\n\nThe duration chart on the task overview always requested the last 14 task\ninstances, ignoring the number of dag runs the user picked. The dag details\nlayout already writes that choice to the limit search param, and the dag\noverview page reads a value of its own, so the task page was the only view\nthat could not be widened.\n\nRead the same limit search param the details layout writes, falling back to\nthe same default of 10, so the chart follows the selector and can be shared\nthrough the URL.\n\nThe remaining limit on the failed task instance query is left alone: that\nquery only reads total_entries and never renders the rows it fetches." }, { "commit": "15c8d68f84d11b74e16aec5ea1f7d7e82c0e283c", "tree": "06a0e169cb68c29a766fadeae8cff86ff42cbeb4", "parents": [ "f7a2f4e6b0de898f97768313583cddf0cf1c61ef" ], "author": { "name": "rjgoyln", "email": "151457491+rjgoyln@users.noreply.github.com", "time": "Tue Sep 01 00:35:42 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 12:35:42 2026 -0400" }, "message": "Make Dags list e2e filters wait on the request that actually fires (#72040)\n\nThe Dags list is served by /ui/dags, but the status-filter and clear-search\nhelpers waited on /api/v2/dags and swallowed the timeout that followed, so every\ncall spent its full budget waiting for a response that could never arrive and\nsynchronised nothing. Clearing the search has no request to wait for at all: it\nreturns to a query react-query still holds, so the list comes back from cache.\nChoosing which run-state control to click from the pill\u0027s visibility read an\nelement that leaves the DOM while the filter is being edited, so the answer\ndepended on where the click landed relative to that transition." }, { "commit": "f7a2f4e6b0de898f97768313583cddf0cf1c61ef", "tree": "7fd9cd50cde61c606f63b4cf63978ebdfe0d569c", "parents": [ "b9b471177c6a3663a0762a4eefdcf730de0d6adb" ], "author": { "name": "rjgoyln", "email": "151457491+rjgoyln@users.noreply.github.com", "time": "Tue Sep 01 00:31:43 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 12:31:43 2026 -0400" }, "message": "UI: Show duration chart tooltips in the selected timezone (#72024)\n\nThe Last N Dag Runs / Task Instances chart formatted its bar labels in the\nbrowser\u0027s local timezone while the x-axis ticks and the rest of the UI follow\nthe timezone picked in the header. Anyone whose machine sits in a different\ntimezone read a tooltip timestamp that did not identify the run they were\npointing at, which makes the chart misleading exactly when it is used to\ncompare runs.\n\nRelated: #72018" }, { "commit": "b9b471177c6a3663a0762a4eefdcf730de0d6adb", "tree": "e2561040de5ad8cab1328f55af6ad87428f2d3d8", "parents": [ "7818b16048cdfa03d1b4b4cefc64fef226ae9b7c" ], "author": { "name": "Software Developer", "email": "7852635+dsuhinin@users.noreply.github.com", "time": "Mon Aug 31 17:26:45 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 11:26:45 2026 -0400" }, "message": "Extend user settings with additional configuration (#71699)\n\n* add a new configuration to the user settings:\n- make it possible to configure default landing page.\n- make it possible to configure default instance tab.\n\n* UI: Limit settings translations to the new default landing page and task tab keys\n\nThe default-settings change bundled full settings-block translations into the\nnon-English locales, including keys unrelated to this feature. Those belong to\na separate translation PR, so keep only the general (landing page) and task\ninstance (default tab) keys this change actually introduces.\n\n* revert translations for other languages then eng.\n\n* added Russian translation\n\n* remove Russian translation\n\n* addressing PR comments.\n\n* consolidate TaskInstanceTab with tab.ts. add more related tests." }, { "commit": "7818b16048cdfa03d1b4b4cefc64fef226ae9b7c", "tree": "4cb923cf5f31588e392ec1ad37ac41d6265c5d8a", "parents": [ "6402213dc52540cce6094f9a300d1145d7460000" ], "author": { "name": "Baha Bouali", "email": "baha.bouali2020@gmail.com", "time": "Mon Aug 31 16:10:36 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 11:10:36 2026 -0400" }, "message": "UI: Translate durations and relative times in the selected language (#72309)\n\ndayjs keeps one global locale and bundles only English, and the UI never\ntold it which language i18next had resolved. Sentences assembled from both\ncatalogues came out half translated: a deadline tooltip read \"Must complete\nwithin 2 hours of queue time\" with everything but the interval in Arabic,\nand every \"Next Run\" relative time stayed English too. No translation key\nwas missing, so the completeness checks could never surface it.\n\nThe locale data is registered eagerly rather than imported on demand\nbecause react-i18next re-renders synchronously on languageChanged; a\ndynamic import would resolve after that render and leave the previous\nlanguage\u0027s durations on screen." }, { "commit": "6402213dc52540cce6094f9a300d1145d7460000", "tree": "574eb8a2e8d48d0ca19a5e9bbe1bb3ed84dfa964", "parents": [ "b0721979b92e4cddc13afe294b5a034ec90d0e49" ], "author": { "name": "Y-C", "email": "easoneason0905@gmail.com", "time": "Mon Aug 31 16:49:32 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 16:49:32 2026 +0800" }, "message": "Export AIRFLOW_TEST_MODE from airflow tasks test without --env-vars (#72291)\n\n* Export AIRFLOW_TEST_MODE from airflow tasks test without --env-vars\n\nThe test-mode signal has been hostage to an unrelated flag since it was\nintroduced in 2020, so Dag code that branches on it never saw it during a\nplain `airflow tasks test` run. In Airflow 3 this is the only working\ntest-mode signal, because the `test_mode` task-context variable is\ncurrently disabled.\n\n* Stop the env-vars test leaking its writes into the pytest session\n\nmonkeypatch.delenv records an undo entry only when the key is already set,\nso on a clean worker the values task_test writes to the real process\nenvironment survived teardown. Seeding a sentinel instead also tightens the\nassertion: the command now has to overwrite a pre-existing value rather than\nmerely populate an absent one.\n\n---------\n\nCo-authored-by: Eason09053360 \u003c185830721+Eason09053360@users.noreply.github.com\u003e" }, { "commit": "b0721979b92e4cddc13afe294b5a034ec90d0e49", "tree": "15764a4433e9675cc8665ef906fd7a0cacf22e23", "parents": [ "f2db94d08d13607ec58edf82ad0e54c0f2e44bd1" ], "author": { "name": "Aaron Chen", "email": "nailo2c@gmail.com", "time": "Mon Aug 31 02:31:02 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 02:31:02 2026 +0800" }, "message": "Fix connection metadata test across Python versions (#72293)" }, { "commit": "f2db94d08d13607ec58edf82ad0e54c0f2e44bd1", "tree": "40485c069e3ab883d51f591a7cd999143edcab1c", "parents": [ "14397bc547c828b0598bb60cc6a991b922964bd2" ], "author": { "name": "Taehoon Kim", "email": "taehoonkim.dev@gmail.com", "time": "Mon Aug 31 03:00:52 2026 +0900" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Aug 30 13:00:52 2026 -0500" }, "message": "Refactor validate_key to raise ValueError instead of AirflowException (#68890)\n\n* Replace AirflowException with ValueError in validate_key\n\n* Update Kubernetes tests and known exceptions for refactor\n\n* Fix backwards compatibility in Kubernetes tests for validate_key\n\n* Align validate_key error message with Task SDK\n\n* Add newsfragment for KubernetesPodOperator behavior change" }, { "commit": "14397bc547c828b0598bb60cc6a991b922964bd2", "tree": "74f00f86ab759a4a41a90fc06b58c79184bb81a7", "parents": [ "0a13635c64ef0e31f60a0fe908f4959aef6e0685" ], "author": { "name": "rjgoyln", "email": "151457491+rjgoyln@users.noreply.github.com", "time": "Mon Aug 31 00:59:16 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Aug 30 11:59:16 2026 -0500" }, "message": "Make the CI unit test timeout fire before the job timeout does (#72259)\n\n* Make the CI unit test timeout fire before the job timeout does\n\nThe test timeout exists so that a hanging test group is stopped while the job\nstill has time to dump the container logs and upload them as artifacts. It\nnever got that chance. The alarm is armed in the last step of the job, but the\njob budget starts at the first one, and checking out the repo, pulling the CI\nimage and running the migration tests routinely take twenty minutes or more\nbefore any test runs. A fixed sixty minute test timeout could therefore only\nfire in a job GitHub had already cancelled, so every hang surfaced as a bare\njob timeout with no logs to explain it.\n\n* Print the CI test budget in minutes and seconds\n\nThe line reported the budget left in seconds next to a job timeout in minutes,\nso anyone reading it had to convert one to compare them." }, { "commit": "0a13635c64ef0e31f60a0fe908f4959aef6e0685", "tree": "8eeb5920aa0b7688ae56878bed068c6dfb365ca6", "parents": [ "f760ac1c03b7277f3cb69071b8ead56d27ecbff7" ], "author": { "name": "Steve Ahn", "email": "steveahnahn@g.ucla.edu", "time": "Sun Aug 30 09:21:52 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Aug 30 11:21:52 2026 -0500" }, "message": "Cancel Snowflake queries when a user kills the deferred task (#69635)\n\nKilling a deferred task previously left the Snowflake statements running, so\nthe warehouse kept burning credits with no task left to observe it. The worker\npath already cancelled on kill; only the deferred path did not, which made the\nbehaviour depend on whether the operator happened to be deferred.\n\nCancellation is per statement and best-effort: a failure cancelling one id no\nlonger aborts the rest, since the ids most likely to error are the completed\nearly statements while the still-running later ones are the ones that matter." }, { "commit": "f760ac1c03b7277f3cb69071b8ead56d27ecbff7", "tree": "f23177473f1acea3b717dc9db91bc5abdb34866f", "parents": [ "caa8f286a061a68f4a4a615d9d9dbfa8d863fe7a" ], "author": { "name": "rjgoyln", "email": "151457491+rjgoyln@users.noreply.github.com", "time": "Sun Aug 30 23:09:11 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Aug 30 10:09:11 2026 -0500" }, "message": "Stop airflowctl e2e xcom tests failing on a slow compose stack (#72260)\n\nThe xcom commands can only run once their Dag run has finished, and the\nwait that enforces that gave a freshly booted PROD compose stack only 60\nseconds. Every sample cost a full airflowctl subprocess, so a slow machine\ngot barely a dozen looks in before the budget ran out. Because all five\nxcom commands share one Dag run, a single slow boot failed all of them at\nonce, behind a message that said nothing about how far the run had got." }, { "commit": "caa8f286a061a68f4a4a615d9d9dbfa8d863fe7a", "tree": "c24dec3fc91b8040b4591155404c5193a98e40e8", "parents": [ "5dabdb8f586d9f022de5269a064be05f6fa7aafe" ], "author": { "name": "Niko Oliveira", "email": "onikolas@apache.org", "time": "Sat Aug 29 17:51:24 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 20:51:24 2026 -0400" }, "message": "Update providers metadata 2026-08-29 (#72274)" }, { "commit": "5dabdb8f586d9f022de5269a064be05f6fa7aafe", "tree": "50e9f614042a704bc256e7ebe3bf1046f54a520f", "parents": [ "618d6489b34397f2156211fa6da84d594e231a1e" ], "author": { "name": "Aaron Chen", "email": "nailo2c@gmail.com", "time": "Sun Aug 30 08:39:16 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 19:39:16 2026 -0500" }, "message": "Improve code coverage for the connection hook metadata service (#72248)\n\n* Improve code coverage for the connection hook metadata service\n\n* Add tests for HookMetaService and enhance make_widget function" }, { "commit": "618d6489b34397f2156211fa6da84d594e231a1e", "tree": "f6b0317774447580281b53220a785bb83293ed4f", "parents": [ "40f76fc1080ae67a24fd6d82ecc3960bbe12698a" ], "author": { "name": "Justin Pakzad", "email": "114518232+justinpakzad@users.noreply.github.com", "time": "Sat Aug 29 19:55:13 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 18:55:13 2026 -0500" }, "message": "Remove redundant _set_context in SnowflakeSqlApiTrigger (#71659)" }, { "commit": "40f76fc1080ae67a24fd6d82ecc3960bbe12698a", "tree": "af45007bfa94d4031a682affa08a917c257d7928", "parents": [ "af0a3770a687458a357cd8820cbda07918a90cda" ], "author": { "name": "Jeongseok Kang", "email": "piono623@naver.com", "time": "Sun Aug 30 08:28:35 2026 +0900" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 18:28:35 2026 -0500" }, "message": "Add example DAG demonstrating Deadline Alerts (#66269)\n\n* Add example DAG demonstrating Deadline Alerts\n\nAdds airflow-core/src/airflow/example_dags/example_deadline_alert.py so\nusers can try the Deadline Alerts feature on a fresh Airflow install\nwithout writing a custom DAG.\n\nAlso fixes airflow.sdk\u0027s type stub (__init__.pyi) which was missing\nAsyncCallback, SyncCallback, DeadlineAlert, and DeadlineReference -\nthey exist at runtime via lazy imports but the stub had no entries,\ncausing `from airflow.sdk import DeadlineAlert` (the form used in\ndocs/howto/deadline-alerts.rst) to fail mypy attr-defined checks.\n\nrelated: #66268\n\n* Update airflow-core/src/airflow/example_dags/example_deadline_alert.py\n\nCo-authored-by: hojeong park \u003cparkhj062@gmail.com\u003e\n\n* Update airflow-core/src/airflow/example_dags/example_deadline_alert.py\n\nCo-authored-by: hojeong park \u003cparkhj062@gmail.com\u003e\n\n* Allow deadline UUIDs in serialized DAG schema\n\n`SerializedDagModel.write_dag` rewrites `dag.deadline` from a\nlist of encoded alert dicts to a list of UUIDv7 strings before\npersisting, but the JSON schema only permitted dict / list[dict] /\nnull. Validating any DAG with a deadline against the post-write\nshape therefore raised `ValidationError`. Add `list[str]` to the\n`deadline` `anyOf` so the schema matches what is actually stored.\n\n* Make example deadline alert DAG actually trip the alert\n\nAddress PR review feedback:\n\n- Switch the example from `DAGRUN_LOGICAL_DATE` to `DAGRUN_QUEUED_AT`.\n Logical date for a manual run can be far in the past or future, so\n `LOGICAL_DATE + interval` rarely produces a meaningful deadline for\n a demo DAG. Queued-at is predictable and matches what a reader would\n expect when triggering the example.\n- Drop the interval from one hour to thirty seconds and sleep for a\n minute inside the task so triggering the example DAG actually\n observably crosses the deadline and fires the alert.\n- Drop the `SyncCallback` stub entry from `airflow.sdk.__init__.pyi`.\n The example only uses `AsyncCallback`; `SyncCallback` is mid-rollout\n and out of scope for this PR.\n\n* Add regression test for deadline UUID schema acceptance\n\nwrite_dag rewrites dag.deadline from list[dict] to list[str] (UUIDv7)\nbefore persistence (_generate_deadline_uuids), so the JSON schema\u0027s\ndeadline anyOf must accept list[str]. test_write_dag exposes this\ntransitively via re-validation of stored data; this commit adds a\nfocused unit test that guards the contract directly, plus a docstring\ncross-reference in _generate_deadline_uuids so the schema coupling is\nvisible from the rewrite site.\n\n* Add SyncCallback to airflow.sdk type stub\n\nRuntime __init__.py exports SyncCallback via lazy import (alongside\nAsyncCallback, DeadlineAlert, DeadlineReference) and the deadline-alerts\ndocumentation imports it directly. Aligning the .pyi stub avoids mypy\nattr-defined errors for users following the docs.\n\n* Clarify why example_deadline_alert sleeps synchronously\n\nThe 60s sleep is a deliberate choice — a deferred sensor would\ndemonstrate the same trip path but obscure the DeadlineAlert focus.\nReplace the two-line WHAT comment with one line that captures the WHY.\n\n* Make deadline callback context parameter explicit in example DAG\n\n* chore: Remove out-of-scope core changes\n\n* refactor: Remove redundant import aliasing\n\n---------\n\nCo-authored-by: hojeong park \u003cparkhj062@gmail.com\u003e\nCo-authored-by: Jarek Potiuk \u003cjarek@potiuk.com\u003e" }, { "commit": "af0a3770a687458a357cd8820cbda07918a90cda", "tree": "553af2a9735a323daf7b596ea656c99860208a3b", "parents": [ "166a1ba1eecf969ed33ad17dd1232b20d7ce5aea" ], "author": { "name": "Deepak kumar", "email": "deepakkumar@meta.com", "time": "Sat Aug 29 16:27:20 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 18:27:20 2026 -0500" }, "message": "Enable ruff B023 (function-uses-loop-variable) and fix violations (#70640)\n\nB023 catches the late-binding closure-over-loop-variable footgun where\na function defined inside a loop captures the loop variable by\nreference, so every function in the resulting list sees the same\n(final) value — a classic silent-bug source in Python\n(https://docs.python.org/3/faq/programming.html#why-do-lambdas-defined-in-a-loop-with-different-values-all-return-the-same-result).\n\nThe one user-visible fix is in providers/standard/.../triggers/file.py,\nwhere the FileTrigger\u0027s os.walk lambda was dispatched to a worker\nthread via anyio.to_thread.run_sync while the outer glob iteration\ncould advance, potentially walking the wrong path.\n\nThe rest are pre-existing latent-bug or false-positive sites in a\nmigration script, breeze translation helpers, sphinx extensions, a\nsystem-test example DAG, the SMTP OAuth2 auth callback, secrets_masker\nsubclass compat shim, and two provider unit tests — fixed by binding\nthe loop-derived variable as a default argument on the inner function\nor lambda.\n\nCo-authored-by: Jarek Potiuk \u003cjarek@potiuk.com\u003e" }, { "commit": "166a1ba1eecf969ed33ad17dd1232b20d7ce5aea", "tree": "b71345ed08b06dd24e9145f1e86f737fbc61bb36", "parents": [ "7b79b81a1e295a17b5e6d71a307ea275bae7e179" ], "author": { "name": "Nguyen Van Hiep", "email": "hiep12092001@gmail.com", "time": "Sun Aug 30 02:34:20 2026 +0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 21:34:20 2026 +0200" }, "message": "Validate deferred trigger classpath resolves to a BaseTrigger subclass (#69792)\n\nThe triggerer resolves a trigger from the ``classpath`` carried in the\ndeferred-task Execution API payload via ``import_string(classpath)`` and then\ninstantiates it with ``trigger_class(**kwargs)``. ``get_trigger_by_classpath``\ndid not check that the imported object is actually a ``BaseTrigger`` subclass,\nso any importable callable (e.g. ``subprocess.check_output``) could be loaded\nand invoked in the long-running triggerer process.\n\nHarden this by rejecting, before caching and before instantiation, any\n``classpath`` that does not resolve to a ``type`` that is a ``BaseTrigger``\nsubclass. Legitimate triggers are unaffected (they are always ``BaseTrigger``\nsubclasses); an invalid classpath now fails the trigger cleanly instead of\nbeing instantiated. Adds a unit test covering both the accepted and rejected\ncases." }, { "commit": "7b79b81a1e295a17b5e6d71a307ea275bae7e179", "tree": "d2fafc98dd51e449878b97b02286fc3a88a9002c", "parents": [ "b61f35966ca3c445758fe8a45a29e732857f0328" ], "author": { "name": "Dr Alex Mitre", "email": "bedr10_capacitacion@hotmail.com", "time": "Sat Aug 29 12:02:35 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 21:02:35 2026 +0200" }, "message": "Keep Campaign Manager delete report provision check in __init__ (#70530)\n\nThe check only asks which of report_name / report_id was supplied, never\nwhat the values are, so it belongs in the constructor: a static authoring\nmistake should surface once at Dag parse time rather than on every task\ninstance and retry on a worker. Moving it to execute() would also misreport\na supplied argument as missing under render_template_as_native_obj\u003dTrue,\nwhere a provided field can render to None.\n\nSee https://github.com/apache/airflow/issues/70296 for the rule this follows." }, { "commit": "b61f35966ca3c445758fe8a45a29e732857f0328", "tree": "3854c3ce0295ab2d42ef5764782017060ae6a7e5", "parents": [ "31fb1d28f2feb6429f037941eda5dae7b9692e6d" ], "author": { "name": "Jyun-An Chen", "email": "jun930436@gmail.com", "time": "Sun Aug 30 02:12:51 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Aug 30 02:12:51 2026 +0800" }, "message": "Remove stale is_async docstring param from await_pod_start (#72261)\n\nThe function determines async mode internally via isinstance check\nrather than accepting an is_async parameter, so the docstring was\ndescribing an argument that doesn\u0027t exist in the signature." }, { "commit": "31fb1d28f2feb6429f037941eda5dae7b9692e6d", "tree": "80153eb5edcd79cd7ee4cec1f40058efe8fe9533", "parents": [ "c0ae2127e174205b8faa43f25b5c912c09353bd1" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Aug 29 20:03:11 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 20:03:11 2026 +0200" }, "message": "Bump the ts-sdk-package-updates group across 1 directory with 4 updates (#72213)" }, { "commit": "c0ae2127e174205b8faa43f25b5c912c09353bd1", "tree": "1d03621966b3553d7b3544f57d64d2cdb7ffc099", "parents": [ "3c011c888b9b8215eea4c79b6d039b2ea4f4085d" ], "author": { "name": "Dan Kalenga", "email": "117305234+kada2004@users.noreply.github.com", "time": "Sat Aug 29 19:26:11 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 19:26:11 2026 +0200" }, "message": "Fix passphrase quoting in decrypt_remote_file_to_string for Windows (#69908)\n\n* Fix passphrase quoting in decrypt_remote_file_to_string for Windows remotes\n\n* Restored shlex.quote on remote path and drop misleading password \u003d None\n\n---------\n\nCo-authored-by: kada2004 \u003cdankalenga3@gmail,com\u003e" }, { "commit": "3c011c888b9b8215eea4c79b6d039b2ea4f4085d", "tree": "4b8988731b1b3ee4a96b40a1196369c73657a997", "parents": [ "49789f2846e06c25fe7b78505e0f6ea1a4fa874b" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Aug 29 19:01:09 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 19:01:09 2026 +0200" }, "message": "Bump the typescript group across 1 directory with 4 updates (#71897)" }, { "commit": "49789f2846e06c25fe7b78505e0f6ea1a4fa874b", "tree": "d0008c4212aad09f4d23e5c5765da1512471b9ce", "parents": [ "1f51acbed1944728a1cf3b9d5aa231a7e07c8098" ], "author": { "name": "Oleksii Maksymiv", "email": "aleks.maksymiv@gmail.com", "time": "Sat Aug 29 19:12:33 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 18:12:33 2026 +0200" }, "message": "Fix plugin registration returning early on duplicate names in Task SDK (#72253)\n\n__register_plugins used `return` instead of `continue` when encountering\na duplicate plugin name, so the first duplicate abandoned the rest of the\nbatch and every plugin after it was silently dropped.\n\nairflow-core carries a duplicate of this function and was fixed twice: in\n#60498 (`return` became a warning plus `continue`) and in #66649 (also\nrecord the duplicate in import_errors). Neither fix reached the Task SDK\ncopy. Because that copy is the one used by the task-running process,\nplugins would load for the scheduler and API server but silently go\nmissing inside tasks - most visibly, task instance listeners registered\nby a plugin would never fire.\n\nThe __register_plugins body is now byte-identical to the airflow-core one." }, { "commit": "1f51acbed1944728a1cf3b9d5aa231a7e07c8098", "tree": "72592fa27db16150ab32bc0168d62388b1db3db2", "parents": [ "f8957f62a4624d96e2fc8d5cd18d08114e5c9de9" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Aug 29 18:08:33 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 18:08:33 2026 +0200" }, "message": "Bind Keycloak cookie tokens to the Airflow session identity (#72207)\n\n* Bind Keycloak cookie tokens to the Airflow session identity\n\nFor Airflow 3.3+ the Keycloak access and refresh tokens are no longer carried in\nthe signed Airflow JWT; they travel in separate _access_token and _refresh_token\ncookies. get_user_from_token validated the Airflow JWT and then attached whatever\nthose cookies contained, without checking that they described the same subject.\n\nA caller could therefore pair their own Airflow session with another subject\u0027s\nKeycloak token. Every authorization decision goes to Keycloak carrying that\ntoken, so the effective privileges were the token\u0027s, while get_id() and\nget_name() - used for the session identity, audit records and logging - stayed\nthose of the Airflow JWT.\n\nThe access token\u0027s sub is now compared against the user id the signed JWT\nestablished before the token is attached. Both are the Keycloak subject: every\nplace a KeycloakAuthManagerUser is constructed sets user_id from userinfo[sub],\nin the interactive login, the password grant and the client_credentials grant\nalike. A token whose payload cannot be read yields no subject and so matches\nnothing.\n\nThe subject is read without signature verification, which is sufficient here:\nthe value is only ever compared against an identity the signed Airflow JWT has\nalready established, a forged token is refused by Keycloak when presented, and a\ngenuine token belonging to somebody else is what the comparison exists to catch.\n\nThe two existing tests passed the literal string \"access_token\" as a cookie\nvalue; they now build a JWT-shaped token naming the same subject. Adds coverage\nfor a token naming another subject and for one that cannot be parsed.\n\n* Refuse malformed Keycloak access-token cookies with 403, not 500\n\nA Keycloak access-token cookie whose payload decodes to valid JSON that is\nnot an object reached the subject lookup as a non-mapping, so reading the\nclaim raised an error the middleware does not translate. The cookie is\nattacker-supplied, so any shape it can take has to end in the same refusal\nas a token naming the wrong subject.\n\n* Drop the Keycloak changelog note about token-to-session binding\n\nEvery place a session is established sets the Airflow user id from the\nKeycloak subject, so the two can only disagree in a request whose cookies\nwere assembled by hand. No deployment reaches the new refusal by ordinary\nuse, which leaves the note describing a change nobody observes." }, { "commit": "f8957f62a4624d96e2fc8d5cd18d08114e5c9de9", "tree": "f0b1bb070a1e59bda7ac6c202500dedc0eafb969", "parents": [ "144a87dfe94747f322e4ddcab476fb40dd1a24d4" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Aug 29 17:37:30 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 17:37:30 2026 +0200" }, "message": "Bump eslint from 10.9.0 to 10.9.1 in /airflow-core/src/airflow/ui in the eslint group across 1 directory (#72233)" }, { "commit": "144a87dfe94747f322e4ddcab476fb40dd1a24d4", "tree": "ca92e17b0d76032fab33837fc453d9837dd67cf1", "parents": [ "aab7ed86c574d96a0f814db932e2d7460ecad9dd" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Aug 29 16:19:33 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 16:19:33 2026 +0200" }, "message": "Bump the core-ui-package-updates group across 1 directory with 16 updates (#72234)" }, { "commit": "aab7ed86c574d96a0f814db932e2d7460ecad9dd", "tree": "87aa9fa7135dbdc9eb812c9e6a7de794cf7b882b", "parents": [ "fbea214082de098fb79aabe0803fd97fce367ae2" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Aug 29 16:16:41 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 16:16:41 2026 +0200" }, "message": "Bump the ui-plugin-template-package-updates group across 1 directory with 9 updates (#72217)" }, { "commit": "fbea214082de098fb79aabe0803fd97fce367ae2", "tree": "79e8a97bc4d337d43a9a493d45822111a04f43cc", "parents": [ "e671bcb031e54cd9ecd229bf47abad5bc2b5eecd" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Sat Aug 29 16:16:11 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 16:16:11 2026 +0200" }, "message": "Monitor the workflow run breeze actually dispatched (#71305)\n\n* Monitor the workflow run breeze actually dispatched\n\nThe docs-publish driver looked up the newest run of the workflow right\nafter dispatching it. When the dispatch had not registered yet, that is\nthe previous run - typically already finished - so the driver reported\nsuccess and moved straight on to the airflow-site refresh and the\nS3-to-GitHub sync while the docs build it was supposed to gate on was\nstill running. A scheduled run, or a run someone else started, was picked\nup the same way.\n\nTerminal conclusions other than success and failure were also treated as\nnothing to report, so a cancelled or timed-out run let the rest of the\nchain proceed as if the docs had been published.\n\n* Keep breeze workflow-run monitoring on the dispatched run only\n\nSeveral of the workflows breeze dispatches - apache/airflow-site\u0027s build.yml\namong them - also run on push and pull request. Such a run registering while\nwe poll would be taken for the one we dispatched, so only workflow_dispatch\nruns are considered now.\n\nA transient gh failure during that poll also aborted the whole publishing\nchain, even though the caller is already retrying." }, { "commit": "e671bcb031e54cd9ecd229bf47abad5bc2b5eecd", "tree": "6ab74d7f0ef1b4285c001c54826be36df149abe7", "parents": [ "39b5871e16f8b89e6c1a4b7fdabd39220bef22bf" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat Aug 29 16:14:02 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 16:14:02 2026 +0200" }, "message": "Bump sqlparse from 0.5.5 to 0.6.0 (#71739)" }, { "commit": "39b5871e16f8b89e6c1a4b7fdabd39220bef22bf", "tree": "6ab74d7f0ef1b4285c001c54826be36df149abe7", "parents": [ "5dcee04992a075af7f8505801b5be0904e25ca9d" ], "author": { "name": "Chareonwit Kunna", "email": "21arenabreakout12@gmail.com", "time": "Sat Aug 29 20:44:52 2026 +0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 15:44:52 2026 +0200" }, "message": "Fix grammar, casing, and typo across testing docs and prek scripts (#72252)\n\n- Follow Dag naming conventions in dag_testing.rst and airflow_e2e_tests.rst.\n- Fix missing preposition and casing in airflow_e2e_tests.rst.\n- Fix typo \u0027consolidte\u0027 -\u003e \u0027consolidate\u0027 in check_supervisor_schemas_versions.py." }, { "commit": "5dcee04992a075af7f8505801b5be0904e25ca9d", "tree": "55ebb695e818f7a02faa7b00f4d9f5ce4db4b537", "parents": [ "39b48040226be44a6a113b4ea1bddeca80dc39b7" ], "author": { "name": "deepinsight coder", "email": "32898216+Vamsi-klu@users.noreply.github.com", "time": "Sat Aug 29 06:32:14 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 15:32:14 2026 +0200" }, "message": "Add warning for HttpOperator deferrable with non-idempotent methods (#69748)\n\n* Add warning for HttpOperator deferrable with non-idempotent methods\n\nHttpOperator(deferrable\u003dTrue) executes the HTTP request inside\nHttpTrigger.run() in the Triggerer. On triggerer restart, the trigger\nis re-created from serialize() and run() re-executes, causing duplicate\nPOST/PATCH requests. This is silent data duplication.\n\nAdd UserWarning when deferrable\u003dTrue is used with POST/PATCH etc,\nguiding users to idempotent methods or sensor-based polling pattern\nlike AirbyteOperator (side-effect in worker, trigger polls with GET).\n\nLong-term fix should execute non-idempotent requests in worker and\nonly poll in trigger.\n\nFixes: #67945\n\n* Avoid duplicate HTTP deferrable warnings\n\nThe deferrable HTTP warning should stay visible for unsafe methods without showing the operator and trigger versions together, so the shared wording now has focused coverage for both entry points.\n\n* Warn once for non-idempotent deferrable HTTP methods\n\nTrigger reconstruction can happen repeatedly in the Triggerer, where warnings do not reach Dag authors. Surface the guidance where the deferrable choice is made without producing repeated trigger-side noise.\n\n* Warn once from HttpOperator.execute for non-idempotent deferrable methods\n\nAddress review feedback on the delivery mechanism:\n\n- Emit a single self.log.warning from HttpOperator.execute() when\n deferrable\u003dTrue and the method is not idempotent (RFC 9110 §9.2.2),\n so Dag authors see the advisory in task logs once per attempt.\n- Do not warn from __init__ (parse-time flood) or HttpTrigger (Triggerer\n reconstructs from serialized kwargs on every resume/restart).\n- No catch_warnings/filterwarnings suppression path.\n- Cover method case, None, pagination cardinality, PUT/DELETE silence,\n PATCH/custom methods, deferrable\u003dFalse, and trigger deserialize.\n\nFixes: #67945\n\n* Allow silencing HttpOperator deferrable non-idempotent warnings\n\nDag authors who accept Triggerer-restart retry risk need a per-task\nopt-out, and task logs should point at provider docs rather than a\nGitHub issue that operators cannot act on.\n\n* Add a silence flag and docs for the HttpOperator deferrable warning\n\nDag authors who intentionally POST in deferrable mode had no documented\nopt-out, and the advisory pointed at a GitHub issue instead of provider docs.\n\n---------\n\nCo-authored-by: probe \u003cprobe@example.com\u003e\nCo-authored-by: Cursor Agent \u003ccursoragent@cursor.com\u003e" }, { "commit": "39b48040226be44a6a113b4ea1bddeca80dc39b7", "tree": "e458d53102b629bb2c4b0e7ee24f5d657f4e3236", "parents": [ "82215cf97c7c96fd3cdc413be17f9692513b8374" ], "author": { "name": "deepinsight coder", "email": "32898216+Vamsi-klu@users.noreply.github.com", "time": "Sat Aug 29 06:24:26 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Aug 29 15:24:26 2026 +0200" }, "message": "Avoid extra_dejson in ADF and Synapse async hooks (#72130)\n\nextra_dejson can mask secrets via a sync send on the triggerer event\nloop, which raises AsyncToSync. Parse extras with json.loads instead,\nmatching the MSGraph workaround.\n\ncloses: #55728" }, { "commit": "82215cf97c7c96fd3cdc413be17f9692513b8374", "tree": "2387091ac77ea2438ec21d7d84e4f2c3eb601fb1", "parents": [ "e00e53257e90a5380731cf5e148d2db57961f417" ], "author": { "name": "Sean Ghaeli", "email": "58916776+seanghaeli@users.noreply.github.com", "time": "Fri Aug 28 21:02:59 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 21:02:59 2026 -0700" }, "message": "Add single-use callback token for deadline callback context fetch (#71192)\n\nDeadline callbacks run in a subprocess that needs to read the DagRun\ncontext (and connections/variables/xcoms) from the Execution API. PR\nalso accept the long-lived ``workload`` token via ``token:workload``\nopt-ins. That over-broadened the workload token\u0027s reach (scope creep):\na long-lived token could read arbitrary DagRun/connection/variable/xcom\ndata for the whole queue-wait lifetime, and Ash asked for a single-use\ncredential instead.\n\nThis re-lands the security core of #66608 with a tighter design:\n\n---------\n\nCo-authored-by: Ash Berlin-Taylor \u003cash_github@firemirror.com\u003e" }, { "commit": "e00e53257e90a5380731cf5e148d2db57961f417", "tree": "3f888ec1dd163dbf5708910116d9abba89343a21", "parents": [ "ff601cb5b75e77c1f28aaf014914f4e9d5cb0947" ], "author": { "name": "SameerMesiah97", "email": "75502260+SameerMesiah97@users.noreply.github.com", "time": "Sat Aug 29 04:48:16 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 20:48:16 2026 -0700" }, "message": "Add SerializedVariableInterval for deadline alerts (#71802)" }, { "commit": "ff601cb5b75e77c1f28aaf014914f4e9d5cb0947", "tree": "a8e90cba2989bdcb6363d6baf6886a8c1637121e", "parents": [ "b908c63ae6352884b639eeecdd98acb1e9aa491a" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Fri Aug 28 22:49:17 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 22:49:17 2026 +0200" }, "message": "Compare session and user identifiers consistently when resetting a password (#72198)\n\nreset_user_sessions() decoded each stored session and compared its _user_id\nagainst user.id directly. Flask-Login stores whatever User.get_id() returns,\nwhich is a string, while user.id is the integer column, so the comparison was\nnever true and no session was ever deleted. Both sides are now compared as\nstrings, and a session row without a _user_id is skipped rather than matched.\n\nThe existing test passed because its fixture wrote an integer _user_id into\nthe session row by hand, exercising a comparison that does not occur in\npractice. It now stores what get_id() returns. Added coverage for sessions\nwritten before get_id() returned a string, and for a row carrying no\n_user_id at all." }, { "commit": "b908c63ae6352884b639eeecdd98acb1e9aa491a", "tree": "c0c229f4234a53421e472229e91820a7b89b70fe", "parents": [ "188a744c0b94010e15329cec81ff73248ec43fa1" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Fri Aug 28 22:05:34 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 22:05:34 2026 +0200" }, "message": "Use a structured SecretCache key instead of a concatenated string (#72201)\n\nThe cache key was built by concatenating the prefix, an optional \u0027_{team}_\u0027\nsegment and the entry key. That mapping is not injective while the team\nsegment is optional: for a team \u0027analytics\u0027 and key \u0027DB_PASSWORD\u0027 the composed\nstring is identical to the one produced with no team and key\n\u0027_analytics_DB_PASSWORD\u0027, so the two entries share a slot. Reads, writes and\ninvalidations all resolve through the same composed string, so distinct\nentries could read, overwrite or evict one another.\n\nThe parts are now carried in a _CacheKey NamedTuple, which is injective by\nconstruction and needs no escaping, and names each part at the call site. It\nis declared at module level so it pickles by qualified name across the\nmultiprocessing manager the cache is stored in. The prefixes are private to\nthis module, so no caller depends on the previous key shape.\n\nAdded coverage for entries that shared a slot under the old scheme, on the\nread, write and invalidate paths, plus team names that share a prefix." }, { "commit": "188a744c0b94010e15329cec81ff73248ec43fa1", "tree": "de5db4a790717f012237d7be53449e4d791804cd", "parents": [ "cdc5d9faceca4d33791692fc679ec38466c6d91c" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Fri Aug 28 22:05:08 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 22:05:08 2026 +0200" }, "message": "Reject tokens naming a deactivated account in the FAB auth manager (#72199)\n\ndeserialize_user resolved the token subject by id alone, so a bearer issued\nbefore an account was deactivated continued to resolve to that user. The\npassword path already refuses an inactive account in auth_user_db; the token\npath did not. The account state is now re-checked when the user is loaded,\nand a null \u0027active\u0027 column is treated as inactive to match auth_user_db.\n\nThe check runs when the user is loaded, so it is bounded by the existing\n[fab] cache_ttl window (30s by default) rather than being immediate.\n\ntest_is_logged_in_with_inactive_user set is_active via return_value, but\nis_active is a property, so the mock stayed truthy and the assertion held\nregardless of the state under test. It now sets the attribute, and an\nactive-user counterpart was added alongside it." }, { "commit": "cdc5d9faceca4d33791692fc679ec38466c6d91c", "tree": "bc48427a7f041a03a4ac277c13a03f7c1b7e7a69", "parents": [ "b9e4957975b86a93dd751df58bb0ee83d9d3c25f" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Fri Aug 28 22:04:44 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 22:04:44 2026 +0200" }, "message": "Accept only the configured client on the Keycloak client_credentials grant (#72205)\n\ncreate_client_credentials_token built a Keycloak client from the caller-supplied\nclient_id and client_secret and minted an Airflow session token for whichever\nservice account came back. The route reaching it is unauthenticated, so the\ncredentials of any confidential client in the realm were usable to obtain an\nAirflow token, not only those of the client Airflow is configured with.\n\nThe client_id is now compared against [keycloak_auth_manager] client_id before\nanything is sent to Keycloak. The rejection reuses the response of a failed\ncredential exchange so the endpoint cannot be used to discover which client ids\nexist in the realm, and returns before the exchange so it cannot be used to test\nanother client\u0027s secret either.\n\nThe two existing client_credentials tests passed an arbitrary client_id with no\nconfigured value; they now declare one. Added a test that another realm client is\nrefused without any exchange being attempted, and one asserting a wrong id and a\nwrong secret stay indistinguishable." }, { "commit": "b9e4957975b86a93dd751df58bb0ee83d9d3c25f", "tree": "43412175adc4060ed792807d10248906f076dd52", "parents": [ "7f81eb4537f2004e1a896a5ca576f5364969de7f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Aug 28 22:00:56 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 22:00:56 2026 +0200" }, "message": "Bump the eslint group across 1 directory with 2 updates (#72212)\n\nBumps the eslint group with 2 updates in the /airflow-core/src/airflow/ui directory: [eslint](https://github.com/eslint/eslint) and [eslint-plugin-jsonc](https://github.com/ota-meshi/eslint-plugin-jsonc).\n\n\nUpdates `eslint` from 10.8.1 to 10.9.0\n- [Release notes](https://github.com/eslint/eslint/releases)\n- [Commits](https://github.com/eslint/eslint/compare/v10.8.1...v10.9.0)\n\nUpdates `eslint-plugin-jsonc` from 3.4.1 to 3.4.2\n- [Release notes](https://github.com/ota-meshi/eslint-plugin-jsonc/releases)\n- [Changelog](https://github.com/ota-meshi/eslint-plugin-jsonc/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/ota-meshi/eslint-plugin-jsonc/compare/v3.4.1...v3.4.2)\n\n---\nupdated-dependencies:\n- dependency-name: eslint\n dependency-version: 10.9.0\n dependency-type: direct:development\n update-type: version-update:semver-minor\n dependency-group: eslint\n- dependency-name: eslint-plugin-jsonc\n dependency-version: 3.4.2\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: eslint\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "7f81eb4537f2004e1a896a5ca576f5364969de7f", "tree": "0415271bb841ffd988aa3c538ce98a723a91a440", "parents": [ "96b2af5cbd65f5f9760e03299f89eb688ff061b4" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Aug 28 22:00:07 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 22:00:07 2026 +0200" }, "message": "Bump swagger-ui-dist (#71893)\n\nBumps the registry-package-updates group with 1 update in the /registry directory: [swagger-ui-dist](https://github.com/swagger-api/swagger-ui).\n\n\nUpdates `swagger-ui-dist` from 5.32.12 to 5.32.14\n- [Release notes](https://github.com/swagger-api/swagger-ui/releases)\n- [Commits](https://github.com/swagger-api/swagger-ui/compare/v5.32.12...v5.32.14)\n\n---\nupdated-dependencies:\n- dependency-name: swagger-ui-dist\n dependency-version: 5.32.13\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: registry-package-updates\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "96b2af5cbd65f5f9760e03299f89eb688ff061b4", "tree": "a77e26b7306b4d58b595d28f115e57d3c6b2954f", "parents": [ "964407f66ca7ce07d231add5fdfcb12263b9d0d2" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Aug 28 21:59:43 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 21:59:43 2026 +0200" }, "message": "Bump @types/react-dom (#72211)\n\nBumps the react group with 1 update in the /airflow-core/src/airflow/ui directory: [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom).\n\n\nUpdates `@types/react-dom` from 19.2.4 to 19.2.5\n- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)\n- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)\n\n---\nupdated-dependencies:\n- dependency-name: \"@types/react-dom\"\n dependency-version: 19.2.5\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: react\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "964407f66ca7ce07d231add5fdfcb12263b9d0d2", "tree": "63ed514afd20b1b4a6ae0e63d96547bca82fe244", "parents": [ "449e589da21f776edf3f6d0fa00c6db0ee1ddd70" ], "author": { "name": "rjgoyln", "email": "151457491+rjgoyln@users.noreply.github.com", "time": "Sat Aug 29 03:55:02 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 21:55:02 2026 +0200" }, "message": "Fix static checks randomly failing with \"PYTHONWARNINGS not set\" (#72226)\n\nThe generated docker-compose env file lists the variables Compose forwards\ninto the container, and every Breeze invocation rewrites it from its own\nenvironment. prek runs Breeze-backed hooks concurrently and only the\nprovider.yaml and template-fields checks ask for PYTHONWARNINGS, so any\nother hook regenerating the file between that write and `docker compose\nrun` took the variable away again — leaving contributors with static check\nfailures that had nothing to do with their change and passed on a rerun." }, { "commit": "449e589da21f776edf3f6d0fa00c6db0ee1ddd70", "tree": "d21283f93abab178ce9a0b6fd50bc077603b50c2", "parents": [ "15217b00c274dbc0c49cd50b6a567e61a65e755e" ], "author": { "name": "PoAn Yang", "email": "payang@apache.org", "time": "Sat Aug 29 04:12:40 2026 +0900" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 21:12:40 2026 +0200" }, "message": "Restrict MSGraph deferrable pagination to the configured host (#71842)\n\nSigned-off-by: PoAn Yang \u003cpayang@apache.org\u003e" }, { "commit": "15217b00c274dbc0c49cd50b6a567e61a65e755e", "tree": "2d96058703382cb69fc63e5319cb4435d3f0a413", "parents": [ "33222eaeeb57be071be992e9ce5a25d2c3a56b2e" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Aug 28 14:00:26 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 14:00:26 2026 -0400" }, "message": "Bump the auth-ui-package-updates group across 1 directory with 7 updates (#72215)\n\nBumps the auth-ui-package-updates group with 7 updates in the /airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.4` | `5.102.2` |\n| [react-hook-form](https://github.com/react-hook-form/react-hook-form) | `7.85.0` | `7.86.0` |\n| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.2.5` |\n| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.10` | `4.1.11` |\n| [eslint](https://github.com/eslint/eslint) | `10.8.1` | `10.9.0` |\n| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.2.2` |\n| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` |\n\n\n\nUpdates `@tanstack/react-query` from 5.101.4 to 5.102.2\n- [Release notes](https://github.com/TanStack/query/releases)\n- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)\n- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.102.2/packages/react-query)\n\nUpdates `react-hook-form` from 7.85.0 to 7.86.0\n- [Release notes](https://github.com/react-hook-form/react-hook-form/releases)\n- [Changelog](https://github.com/react-hook-form/react-hook-form/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/react-hook-form/react-hook-form/compare/v7.85.0...v7.86.0)\n\nUpdates `@types/react-dom` from 19.2.4 to 19.2.5\n- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)\n- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)\n\nUpdates `@vitest/coverage-v8` from 4.1.10 to 4.1.11\n- [Release notes](https://github.com/vitest-dev/vitest/releases)\n- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)\n- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8)\n\nUpdates `eslint` from 10.8.1 to 10.9.0\n- [Release notes](https://github.com/eslint/eslint/releases)\n- [Commits](https://github.com/eslint/eslint/compare/v10.8.1...v10.9.0)\n\nUpdates `vite` from 8.2.1 to 8.2.2\n- [Release notes](https://github.com/vitejs/vite/releases)\n- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)\n- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)\n\nUpdates `vitest` from 4.1.10 to 4.1.11\n- [Release notes](https://github.com/vitest-dev/vitest/releases)\n- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)\n- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)\n\n---\nupdated-dependencies:\n- dependency-name: \"@tanstack/react-query\"\n dependency-version: 5.102.2\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: auth-ui-package-updates\n- dependency-name: react-hook-form\n dependency-version: 7.86.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: auth-ui-package-updates\n- dependency-name: \"@types/react-dom\"\n dependency-version: 19.2.5\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: auth-ui-package-updates\n- dependency-name: \"@vitest/coverage-v8\"\n dependency-version: 4.1.11\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: auth-ui-package-updates\n- dependency-name: eslint\n dependency-version: 10.9.0\n dependency-type: direct:development\n update-type: version-update:semver-minor\n dependency-group: auth-ui-package-updates\n- dependency-name: vite\n dependency-version: 8.2.2\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: auth-ui-package-updates\n- dependency-name: vitest\n dependency-version: 4.1.11\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: auth-ui-package-updates\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "33222eaeeb57be071be992e9ce5a25d2c3a56b2e", "tree": "2c219bbd6d1cb1af2c02ab32c5bcb6be35a08eaa", "parents": [ "f5e083dfbbf09ef5da44d07cace652eea4a88da5" ], "author": { "name": "rjgoyln", "email": "151457491+rjgoyln@users.noreply.github.com", "time": "Sat Aug 29 01:47:00 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 19:47:00 2026 +0200" }, "message": "Drop provider dependency from airflow-core secrets backend tests (#71677)\n\nThese tests cover how core loads and configures a custom secrets backend,\nnot how any particular backend behaves. Pinning them to the amazon and\nhashicorp providers made a core-only environment unable to run them, and\nkept them skipped whenever the full provider set is not installed." }, { "commit": "f5e083dfbbf09ef5da44d07cace652eea4a88da5", "tree": "a9d104d4de2183dec8443024d884bff7fd540596", "parents": [ "9d54ac94826d8f46c0d6d1032ee7d9988e562d70" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Aug 28 19:44:10 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 19:44:10 2026 +0200" }, "message": "Bump the github-actions-updates group across 1 directory with 5 updates (#72224)\n\nBumps the github-actions-updates group with 5 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/setup-java](https://github.com/actions/setup-java) | `5.7.0` | `6.0.0` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.6` | `4.37.8` |\n| [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.37.6` | `4.37.8` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.6` | `4.37.8` |\n| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `9.0.0` | `10.0.1` |\n\n\n\nUpdates `actions/setup-java` from 5.7.0 to 6.0.0\n- [Release notes](https://github.com/actions/setup-java/releases)\n- [Commits](https://github.com/actions/setup-java/compare/b6effb05e454b25005698d916606bdc6ffcbf961...dd06d9cba3e5552c54d9f8ea23572deb30010f7c)\n\nUpdates `github/codeql-action/init` from 4.37.6 to 4.37.8\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28)\n\nUpdates `github/codeql-action/autobuild` from 4.37.6 to 4.37.8\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28)\n\nUpdates `github/codeql-action/analyze` from 4.37.6 to 4.37.8\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28)\n\nUpdates `astral-sh/setup-uv` from 9.0.0 to 10.0.1\n- [Release notes](https://github.com/astral-sh/setup-uv/releases)\n- [Commits](https://github.com/astral-sh/setup-uv/compare/c771a70e6277c0a99b617c7a806ffedaca235ff9...20cfd1bf945f4377ade1205e4dbc17946fc9a30d)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-java\n dependency-version: 6.0.0\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: github-actions-updates\n- dependency-name: github/codeql-action/init\n dependency-version: 4.37.8\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: github-actions-updates\n- dependency-name: github/codeql-action/autobuild\n dependency-version: 4.37.8\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: github-actions-updates\n- dependency-name: github/codeql-action/analyze\n dependency-version: 4.37.8\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: github-actions-updates\n- dependency-name: astral-sh/setup-uv\n dependency-version: 10.0.1\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: github-actions-updates\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "9d54ac94826d8f46c0d6d1032ee7d9988e562d70", "tree": "f598988108217c65570f05bdc1fc22a151d7c887", "parents": [ "fdb8594e6bfa89c675ff44e86fb700cc5c77b067" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Fri Aug 28 16:51:24 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 10:51:24 2026 -0400" }, "message": "Fix docs spellcheck failure in the IBM Db2 provider (#72203)\n\nThe nightly docs build fails spellcheck on the Db2 hook because the\nmodule name in the get_conn docstring is unquoted prose, so the checker\ntreats part of it as a misspelled word." }, { "commit": "fdb8594e6bfa89c675ff44e86fb700cc5c77b067", "tree": "6a2a7c1fc5903cd619edc767fb1ead2fd0d1c829", "parents": [ "66b942ed2d94250587c9f76751049aeb4209d931" ], "author": { "name": "Takayoshi Makabe", "email": "48040599+takayoshi-makabe@users.noreply.github.com", "time": "Fri Aug 28 23:30:57 2026 +0900" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 16:30:57 2026 +0200" }, "message": "Fix /ui/assets picking a stale \"last event\" under concurrent asset writes (#71047)\n\n* Fix /ui/assets picking a stale \"last event\" under concurrent asset writes\n\n* Add Unit Test" }, { "commit": "66b942ed2d94250587c9f76751049aeb4209d931", "tree": "4994aaf3fb61592bead9a9dfb4b564a886f4d1e7", "parents": [ "db815a56abbb0b3fc892c12dd3eaad649c45e2c4" ], "author": { "name": "github-actions[bot]", "email": "41898282+github-actions[bot]@users.noreply.github.com", "time": "Fri Aug 28 16:28:18 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 16:28:18 2026 +0200" }, "message": "[main] CI: Upgrade important CI environment (#72091)\n\nCo-authored-by: github-actions[bot] \u003c41898282+github-actions[bot]@users.noreply.github.com\u003e" }, { "commit": "db815a56abbb0b3fc892c12dd3eaad649c45e2c4", "tree": "cec2c8eed3948609d40ee620ca34be997e2e284a", "parents": [ "2d82de6f37491cd6bd2f26561cdf07a1f5abdb50" ], "author": { "name": "olegkachur-e", "email": "qwsqad@gmail.com", "time": "Fri Aug 28 14:26:11 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 16:26:11 2026 +0200" }, "message": "Refactor bigquery_async_query test (#72193)\n\nImprove test stability by making the insert SQL query idempotent.\nThis prevents downstream \u0027check_*\u0027 tasks from failing due to multiple inserts upon a task retry.\n\nCo-authored-by: Oleg Kachur \u003ckachur@google.com\u003e" }, { "commit": "2d82de6f37491cd6bd2f26561cdf07a1f5abdb50", "tree": "eca25a2ead23faaeb968df554073a1174323819d", "parents": [ "da2d9fde79ca466bf41f649856485577f35c6ebc" ], "author": { "name": "KidAmnesiac1", "email": "conor.cadogan@gmail.com", "time": "Fri Aug 28 21:55:23 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 15:55:23 2026 +0200" }, "message": "Change edge worker heartbeat message from info to debug (#72197)" }, { "commit": "da2d9fde79ca466bf41f649856485577f35c6ebc", "tree": "ec4cd5733d55cbfd3ddb6576dc7bc1bf99bad922", "parents": [ "62ecde055c8c3d9973df0e088c048deccc734994" ], "author": { "name": "Pankaj Singh", "email": "98807258+pankajastro@users.noreply.github.com", "time": "Fri Aug 28 19:09:57 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 21:39:57 2026 +0800" }, "message": "Document the missing resource category in common.ai retry policy docs (#72189)" }, { "commit": "62ecde055c8c3d9973df0e088c048deccc734994", "tree": "0f1ad9f0de8d2fbec08d61ba5a40e558db84475c", "parents": [ "dca333a6484b1de98099c6253c171110692c0be5" ], "author": { "name": "Stefan Wang", "email": "1fannnw@gmail.com", "time": "Fri Aug 28 08:42:32 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 08:42:32 2026 -0400" }, "message": "Reduce Iceberg snapshot watcher thread use (#72173)\n\nThe trigger already runs on the event loop, so synchronous state access needlessly consumes worker threads and blocks async-only state stores." }, { "commit": "dca333a6484b1de98099c6253c171110692c0be5", "tree": "20ea17fc3195a591f6831a90edf52ef498c81ed6", "parents": [ "9da89e70ac036e8d8c23208777f9575cf6eee22d" ], "author": { "name": "Niko Oliveira", "email": "onikolas@apache.org", "time": "Fri Aug 28 05:40:56 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 08:40:56 2026 -0400" }, "message": "Write doc-only marker when change classification overrides the answer (#72167)\n\nWhile preparing provider documentation the release manager is asked whether\na provider has changes beyond doc-only. Answering yes then classifies each\nchange individually, and that classification can conclude every change is\ndocumentation. The provider is doc-only after all, but the\n\u0027.latest-doc-only-change.txt\u0027 marker was left untouched, so the next release\nwave replays the same changes and asks about them again." }, { "commit": "9da89e70ac036e8d8c23208777f9575cf6eee22d", "tree": "7ef5ef50d344b0e2a87b1287355a976cabd2eef8", "parents": [ "51ebe32acc11cf39b168566e1906c26fd063557b" ], "author": { "name": "Jung-Hyun Andrew Kim", "email": "jhakimcs03@outlook.com", "time": "Fri Aug 28 05:35:05 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 08:35:05 2026 -0400" }, "message": "Feature expand health endpoint reporting (#70416)" }, { "commit": "51ebe32acc11cf39b168566e1906c26fd063557b", "tree": "a647202c98a6c4ba63d86ac27914735a0a021049", "parents": [ "6171e2bf9922f21db4729062356eb28963bec978" ], "author": { "name": "Ramit Kataria", "email": "hi@ramit.ca", "time": "Fri Aug 28 04:45:01 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 13:45:01 2026 +0200" }, "message": "Stop Breeze container SSH setup from modifying the host ~/.ssh (#72182)\n\nWhen Breeze runs with --forward-credentials, the host\u0027s ~/.ssh is\nbind-mounted read-write at /root/.ssh and the container start used to\noperate on it directly. Every start overwrote the user\u0027s id_rsa with a\nthrowaway key, appended that key to authorized_keys and three localhost\nentries to known_hosts (observed to accumulate hundreds of entries), left\na dangling authorized_keys2 symlink, and ran \u0027chmod 600 ~/.ssh/*\u0027. That\nchmod also strips the execute bit from the ~/.ssh/agent directory that\nOpenSSH 10.x uses for agent sockets. On macOS this kills the\nlaunchd-managed ssh-agent and, after the next reboot, makes every ssh on\nthe host hang waiting on the dead agent socket.\n\nThe ssh-to-localhost setup, which the real-connection SSH and SFTP\nprovider tests rely on, now lives entirely in /root/.breeze-ssh, a path\nthat is never mounted from the host. sshd accepts the generated key via\nan sshd_config.d drop-in, the OpenSSH client finds it via an ssh_config.d\ndrop-in, and paramiko-based hooks, which read neither, discover it\nthrough an ssh-agent started by the entrypoint. entrypoint_exec.sh\nexports the agent socket so \u0027breeze exec\u0027 shells get it too. The\nauthorized_keys2 symlink had no consumers anywhere in the repo and is\ndropped." }, { "commit": "6171e2bf9922f21db4729062356eb28963bec978", "tree": "a43701f1b7f3f89e701a0127c5d8de133dacbbb5", "parents": [ "3d4216a7c1fef4ab5bd15deea3826688559c7e37" ], "author": { "name": "Jyun-An Chen", "email": "jun930436@gmail.com", "time": "Fri Aug 28 16:51:26 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 10:51:26 2026 +0200" }, "message": "Remove the unreachable 404 from the create Variable endpoint (#71245)\n\nThe branch guards a read-back of the row Variable.set() upserted moments earlier\nthrough the same session, so it cannot be reached. It exists only to narrow a type:\nSQLAlchemy 2 declares Session.scalar() as returning Optional, and a raise is what\nconvinces mypy the value is not None.\n\nPaying for that with an HTTP status is the problem. A 404 on a create endpoint tells\na caller the variable they just created was not found, which left the endpoint\nchoosing between publishing a response it can never return and leaving its spec\nincomplete. Asking the session for exactly one row states the same invariant where\nit belongs — in the query — so neither control flow nor a status code is needed to\nexpress it." }, { "commit": "3d4216a7c1fef4ab5bd15deea3826688559c7e37", "tree": "cfc1b01f503fa67deacdec69aa8da2f95de8702e", "parents": [ "1e6ff912bfc1626601f8d72a55681d84f5ac3fc8" ], "author": { "name": "Wei Lee", "email": "weilee@apache.org", "time": "Fri Aug 28 08:32:40 2026 +0900" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 07:32:40 2026 +0800" }, "message": "Fix common.ai Vertex model example to use a valid pydantic-ai prefix (#72011)" }, { "commit": "1e6ff912bfc1626601f8d72a55681d84f5ac3fc8", "tree": "55e65f6edc2d2f4b1b83bc2e3349f70f2650bfc0", "parents": [ "ee15456649aa6dfed1dd5385888d81d672bc21ad" ], "author": { "name": "Wei Lee", "email": "weilee@apache.org", "time": "Fri Aug 28 08:30:54 2026 +0900" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 28 07:30:54 2026 +0800" }, "message": "Fill in missing zh-TW translations for common.json (#72154)\n\nCo-authored-by: Guan-Ming Chiu \u003c105915352+guan404ming@users.noreply.github.com\u003e" }, { "commit": "ee15456649aa6dfed1dd5385888d81d672bc21ad", "tree": "9197e5cd87c0aaec0e4f2ca22b579c6b82180e4b", "parents": [ "e6691964993bd0212e510a2a4ee52ec0b32d906c" ], "author": { "name": "Jed Cunningham", "email": "66968678+jedcunningham@users.noreply.github.com", "time": "Thu Aug 27 15:14:52 2026 -0600" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 15:14:52 2026 -0600" }, "message": "Clean up comments and tests for the Dag version inflation checker (#72028)\n\nThe comments described how the code used to behave rather than what it does now,\nand the removed test covered the same case as the one above it." }, { "commit": "e6691964993bd0212e510a2a4ee52ec0b32d906c", "tree": "960b2fd5d2fcf890f82f42d7bd90796b78126a69", "parents": [ "a26f17fcef435c0fbf0693401305d7b7f13d15a3" ], "author": { "name": "Niko Oliveira", "email": "onikolas@apache.org", "time": "Thu Aug 27 13:51:39 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 22:51:39 2026 +0200" }, "message": "Derive the testing issue title date from RELEASE_DATE (#72168)\n\nThe title placeholder had to be filled in by hand, from today\u0027s date, even\nthough the wave already has a date the release manager exported as\nRELEASE_DATE." }, { "commit": "a26f17fcef435c0fbf0693401305d7b7f13d15a3", "tree": "3504b8e40218e728fb5c6b3a063acbba05ea9efe", "parents": [ "b294df20c32f7405e9dd8346688b3b36e5aed8ea" ], "author": { "name": "Niko Oliveira", "email": "onikolas@apache.org", "time": "Thu Aug 27 13:51:13 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 22:51:13 2026 +0200" }, "message": "Document the access a first-time provider release manager must request (#72169)\n\nTwo steps of the release depend on access someone else has to grant, and both\nfail in ways that are hard to read mid-release. Add a pre-reqs step to\ncover them both." }, { "commit": "b294df20c32f7405e9dd8346688b3b36e5aed8ea", "tree": "c66c1adc9c599c56a5b2d3d6d69a39b55f78af6c", "parents": [ "d868c8c714448eff8f020b9aa0d56772b0db7021" ], "author": { "name": "Niko Oliveira", "email": "onikolas@apache.org", "time": "Thu Aug 27 13:50:40 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 22:50:40 2026 +0200" }, "message": "Be specific on how to create the PyPI token for a provider release (#72170)\n\nThe upload steps described the token policy but not how to actually create one.\nAlso suggest using env vars (in a more secure way) for the token. Suggesting edits\nto \u0027~/.pypirc\u0027 is the riskier option since it writes the token to disk and\npossibly interacts with credentials a release manager may already have configured\nfor other projects." }, { "commit": "d868c8c714448eff8f020b9aa0d56772b0db7021", "tree": "5c1c785bce91e7bcf4328a5a277a8edc649de1a9", "parents": [ "02dbd2f6170448bcd8bf83e83617fe84c1bddb21" ], "author": { "name": "rjgoyln", "email": "151457491+rjgoyln@users.noreply.github.com", "time": "Fri Aug 28 04:32:28 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 22:32:28 2026 +0200" }, "message": "Make breeze setup recover from a broken legacy uv tool install (#72059)\n\n`uv tool list` leaves out a tool whose environment is corrupted, so a leftover\n`uv tool install` of breeze went unnoticed by the legacy-install check even\nthough it still owned ~/.local/bin/breeze. Setup stopped instead at the generic\n\"not the shim managed by this script\" message, which says nothing about the\n`uv tool uninstall` step that actually resolves it.\n\nUninstalling such a tool cannot retract its entry point either — uv has already\nlost the metadata recording it — so a dangling symlink survives that neither -e\nnor -f sees, and the following run wrote through the dead link into the tool\ndirectory that was no longer there.\n\nBoth halves of the migration to the uvx shim described in ADR 0017 now complete\nwithout manual cleanup." }, { "commit": "02dbd2f6170448bcd8bf83e83617fe84c1bddb21", "tree": "0f531de46115ea01c1a599a81248153928132f00", "parents": [ "5a7a4bc19b4aed071e36341d62736115de2f2956" ], "author": { "name": "rjgoyln", "email": "151457491+rjgoyln@users.noreply.github.com", "time": "Fri Aug 28 00:33:54 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 18:33:54 2026 +0200" }, "message": "Stop backfill endpoints disclosing ids across Dags you cannot see (#71113)\n\n* Stop backfill endpoints disclosing which backfill ids exist across Dags\n\nThe routes that name a backfill in their path resolved the authorization\nsubject from the request when the id matched no row, so a caller could tell\n\"no such backfill\" apart from \"a backfill you may not see\" and enumerate ids\nbelonging to Dags they have no access to.\n\nThe path names the backfill, so nothing the caller supplies alongside it can\nbe the subject, and an id they may not see has to answer exactly as a missing\none does. A caller who may read the Dag keeps the Forbidden answer: they can\nalready list that Dag\u0027s backfills, so hiding it would only cost them the\nreason their request was refused.\n\ncloses: #71080\n\n* Add newsfragment for the backfill authorization change\n\n* Give every backfill route one answer for an id that is not there\n\nFor an id named in the path the access dependency now answers before the handler\ndoes, so the three different messages the handlers used to describe that single\ncondition are no longer what a caller sees. A client matching on the detail string\nwould otherwise have to know which route it hit, and which of the two places\nanswered." }, { "commit": "5a7a4bc19b4aed071e36341d62736115de2f2956", "tree": "525d5951defd9c8df91adab73f890646ab53b241", "parents": [ "562e7307c2cffa1af1dc74813a215221d4c7ad9b" ], "author": { "name": "Joe Bergin", "email": "112728082+joseph-bergin@users.noreply.github.com", "time": "Thu Aug 27 11:07:35 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 12:07:35 2026 -0400" }, "message": "Migrate exasol provider to pyexasol 2.x and remove the \u003c2 cap (#72119)" }, { "commit": "562e7307c2cffa1af1dc74813a215221d4c7ad9b", "tree": "6cd0cea23f418242886dd939fa775ba374b880f1", "parents": [ "dd6d28df3ec7d0ecde107180e4bb9d4de01cc2d2" ], "author": { "name": "Jyun-An Chen", "email": "jun930436@gmail.com", "time": "Thu Aug 27 23:21:22 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 17:21:22 2026 +0200" }, "message": "Fix N+1 query in bulk update for Variables and Pools (#71918)\n\nBulkVariableService.handle_bulk_update and BulkPoolService.handle_bulk_update\neach ran one batched existence-check query up front, then discarded the\nresult and re-queried every entity individually inside the loop. The\nsibling handle_bulk_delete methods in the same two files, and\nconnections.py\u0027s handle_bulk_update, already reuse the batched-lookup\ndict correctly -- this was the one spot left over from the earlier\nbulk-delete N+1 fixes.\n\nupdate_orm_from_pydantic in both files now takes the already-fetched\nORM object instead of a key/name string, matching the design\nconnections.py already uses, so the update loop no longer needs its\nown per-item query." }, { "commit": "dd6d28df3ec7d0ecde107180e4bb9d4de01cc2d2", "tree": "6dd3771b7328a4c83223d5c8faaa87abaf7e9c8a", "parents": [ "44ea07505c6e312a6322dbdb2b72cdb79b4484c4" ], "author": { "name": "Yuseok Jo", "email": "yuseok89@gmail.com", "time": "Thu Aug 27 23:29:20 2026 +0900" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 23:29:20 2026 +0900" }, "message": "i18n(ko): add missing translations(Aug 25) (#72050)\n\n* Add missing Korean translations\n\n* Match new ko strings to wording already used in the locale" }, { "commit": "44ea07505c6e312a6322dbdb2b72cdb79b4484c4", "tree": "6be1181b02119bbd89a6af9e798fca3f47a28de4", "parents": [ "14fd8202a5bf5c43b87cdd57cf941e1b77b9775b" ], "author": { "name": "Guan-Ming Chiu", "email": "105915352+guan404ming@users.noreply.github.com", "time": "Thu Aug 27 22:05:07 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 22:05:07 2026 +0800" }, "message": "Skip downstream tasks on LLMBranchOperator reject (#71073)\n\n* Skip downstream tasks on LLMBranchOperator reject\n\n* Keep teardowns running and log reviewer on reject\n\n* Scope teardown carve-out docs to the reject path" }, { "commit": "14fd8202a5bf5c43b87cdd57cf941e1b77b9775b", "tree": "32ea4f5433eca4184fc4367ac3a5702ef2a657f9", "parents": [ "8dad501a08665c7eba07b9990f062c6fe3ba1f97" ], "author": { "name": "deepinsight coder", "email": "32898216+Vamsi-klu@users.noreply.github.com", "time": "Thu Aug 27 05:16:04 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 14:16:04 2026 +0200" }, "message": "Honor gzip and mime_type on SFTPToGCS stream path (#72132)\n\nuse_stream already skips the tempfile. It still dropped gzip and\nmime_type, and docs never mentioned the flag. Apply those on the\nblob writer, pin tests against a tempfile regression, and floor\nthe sftp extra at 5.3.3 for BlobWriter getfo.\n\ncloses: #34995" } ], "next": "8dad501a08665c7eba07b9990f062c6fe3ba1f97" }