Redact rendered template fields while still structured to preserve nested-key masking on truncation by potiuk · Pull Request #65906 · apache/airflow

potiuk · 2026-04-26T21:05:22Z

When a rendered template field exceeds [core] max_templated_field_length, the
JSON-serializable serialization path stringifies the value before applying
redact(). That order loses the nested-key context that redact() uses to
mask values under sensitive keys such as password, token, secret, and
api_key — only registered mask_secret() value patterns survive the
truncation path.

This change applies redact() to the structured value first, then stringifies
the redacted result for truncation. Both nested-key-context masking and value-
pattern masking now behave consistently regardless of whether the rendered
field crosses the truncation boundary. The fit-in-limits branch is unchanged.

The same fix is applied in both airflow-core/src/airflow/serialization/helpers.py
(serialize_template_field) and task-sdk/src/airflow/sdk/execution_time/task_runner.py
(_serialize_template_field), since the two functions diverged into
near-duplicates after #59566 and carried the same bug pattern.

Test plan

Add test_serialize_template_field_masks_nested_sensitive_keys_on_truncation
to airflow-core/tests/unit/serialization/test_helpers.py covering the
structured-redact-before-stringify behaviour for an oversized nested
password payload.
Add test_rendered_templates_mask_nested_keys_with_truncation to
task-sdk/tests/task_sdk/execution_time/test_task_runner.py covering the
same behaviour through the runtime path.
Existing test_serialize_template_field_with_very_small_max_length and
test_rendered_templates_mask_secrets_with_truncation continue to pass.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

vatsrahul1001 · 2026-05-15T12:44:26Z

@potiuk can you resolve conflicts on this. I see it fixes security issue https://github.com/airflow-s/airflow-s/issues/345. Adding to 3.2.2 milestone

potiuk · 2026-05-15T17:23:14Z

@potiuk can you resolve conflicts on this. I see it fixes security issue airflow-s/airflow-s#345. Adding to 3.2.2 milestone

Damn . Will be away from my PC for few hours.. I hope it will be ok tif I so it later ?

…sted-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns).

potiuk · 2026-05-17T15:45:19Z

rebased and green @vatsrahul1001

potiuk · 2026-05-17T19:45:15Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

github-actions · 2026-05-18T13:59:18Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

… preserve nested-key masking on truncation (apache#65906) * Redact rendered template fields while still structured to preserve nested-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Isolate masker patterns in nested-key truncation test The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns). (cherry picked from commit 4ceb0db) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

… preserve nested-key masking on truncation (#65906) (#67117) * Redact rendered template fields while still structured to preserve nested-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Isolate masker patterns in nested-key truncation test The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns). (cherry picked from commit 4ceb0db) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>

potiuk · 2026-04-26T21:05:22Z

When a rendered template field exceeds [core] max_templated_field_length, the
JSON-serializable serialization path stringifies the value before applying
redact(). That order loses the nested-key context that redact() uses to
mask values under sensitive keys such as password, token, secret, and
api_key — only registered mask_secret() value patterns survive the
truncation path.

This change applies redact() to the structured value first, then stringifies
the redacted result for truncation. Both nested-key-context masking and value-
pattern masking now behave consistently regardless of whether the rendered
field crosses the truncation boundary. The fit-in-limits branch is unchanged.

The same fix is applied in both airflow-core/src/airflow/serialization/helpers.py
(serialize_template_field) and task-sdk/src/airflow/sdk/execution_time/task_runner.py
(_serialize_template_field), since the two functions diverged into
near-duplicates after #59566 and carried the same bug pattern.

Test plan

Add test_serialize_template_field_masks_nested_sensitive_keys_on_truncation
to airflow-core/tests/unit/serialization/test_helpers.py covering the
structured-redact-before-stringify behaviour for an oversized nested
password payload.
Add test_rendered_templates_mask_nested_keys_with_truncation to
task-sdk/tests/task_sdk/execution_time/test_task_runner.py covering the
same behaviour through the runtime path.
Existing test_serialize_template_field_with_very_small_max_length and
test_rendered_templates_mask_secrets_with_truncation continue to pass.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

vatsrahul1001 · 2026-05-15T12:44:26Z

@potiuk can you resolve conflicts on this. I see it fixes security issue https://github.com/airflow-s/airflow-s/issues/345. Adding to 3.2.2 milestone

potiuk · 2026-05-15T17:23:14Z

@potiuk can you resolve conflicts on this. I see it fixes security issue airflow-s/airflow-s#345. Adding to 3.2.2 milestone

Damn . Will be away from my PC for few hours.. I hope it will be ok tif I so it later ?

…sted-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns).

potiuk · 2026-05-17T15:45:19Z

rebased and green @vatsrahul1001

potiuk · 2026-05-17T19:45:15Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

github-actions · 2026-05-18T13:59:18Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

… preserve nested-key masking on truncation (apache#65906) * Redact rendered template fields while still structured to preserve nested-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Isolate masker patterns in nested-key truncation test The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns). (cherry picked from commit 4ceb0db) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

… preserve nested-key masking on truncation (#65906) (#67117) * Redact rendered template fields while still structured to preserve nested-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Isolate masker patterns in nested-key truncation test The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns). (cherry picked from commit 4ceb0db) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>

potiuk · 2026-04-26T21:05:22Z

When a rendered template field exceeds [core] max_templated_field_length, the
JSON-serializable serialization path stringifies the value before applying
redact(). That order loses the nested-key context that redact() uses to
mask values under sensitive keys such as password, token, secret, and
api_key — only registered mask_secret() value patterns survive the
truncation path.

This change applies redact() to the structured value first, then stringifies
the redacted result for truncation. Both nested-key-context masking and value-
pattern masking now behave consistently regardless of whether the rendered
field crosses the truncation boundary. The fit-in-limits branch is unchanged.

The same fix is applied in both airflow-core/src/airflow/serialization/helpers.py
(serialize_template_field) and task-sdk/src/airflow/sdk/execution_time/task_runner.py
(_serialize_template_field), since the two functions diverged into
near-duplicates after #59566 and carried the same bug pattern.

Test plan

Add test_serialize_template_field_masks_nested_sensitive_keys_on_truncation
to airflow-core/tests/unit/serialization/test_helpers.py covering the
structured-redact-before-stringify behaviour for an oversized nested
password payload.
Add test_rendered_templates_mask_nested_keys_with_truncation to
task-sdk/tests/task_sdk/execution_time/test_task_runner.py covering the
same behaviour through the runtime path.
Existing test_serialize_template_field_with_very_small_max_length and
test_rendered_templates_mask_secrets_with_truncation continue to pass.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

vatsrahul1001 · 2026-05-15T12:44:26Z

@potiuk can you resolve conflicts on this. I see it fixes security issue https://github.com/airflow-s/airflow-s/issues/345. Adding to 3.2.2 milestone

potiuk · 2026-05-15T17:23:14Z

@potiuk can you resolve conflicts on this. I see it fixes security issue airflow-s/airflow-s#345. Adding to 3.2.2 milestone

Damn . Will be away from my PC for few hours.. I hope it will be ok tif I so it later ?

…sted-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns).

potiuk · 2026-05-17T15:45:19Z

rebased and green @vatsrahul1001

potiuk · 2026-05-17T19:45:15Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

github-actions · 2026-05-18T13:59:18Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

… preserve nested-key masking on truncation (apache#65906) * Redact rendered template fields while still structured to preserve nested-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Isolate masker patterns in nested-key truncation test The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns). (cherry picked from commit 4ceb0db) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

… preserve nested-key masking on truncation (#65906) (#67117) * Redact rendered template fields while still structured to preserve nested-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Isolate masker patterns in nested-key truncation test The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns). (cherry picked from commit 4ceb0db) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>

potiuk · 2026-04-26T21:05:22Z

When a rendered template field exceeds [core] max_templated_field_length, the
JSON-serializable serialization path stringifies the value before applying
redact(). That order loses the nested-key context that redact() uses to
mask values under sensitive keys such as password, token, secret, and
api_key — only registered mask_secret() value patterns survive the
truncation path.

This change applies redact() to the structured value first, then stringifies
the redacted result for truncation. Both nested-key-context masking and value-
pattern masking now behave consistently regardless of whether the rendered
field crosses the truncation boundary. The fit-in-limits branch is unchanged.

The same fix is applied in both airflow-core/src/airflow/serialization/helpers.py
(serialize_template_field) and task-sdk/src/airflow/sdk/execution_time/task_runner.py
(_serialize_template_field), since the two functions diverged into
near-duplicates after #59566 and carried the same bug pattern.

Test plan

Add test_serialize_template_field_masks_nested_sensitive_keys_on_truncation
to airflow-core/tests/unit/serialization/test_helpers.py covering the
structured-redact-before-stringify behaviour for an oversized nested
password payload.
Add test_rendered_templates_mask_nested_keys_with_truncation to
task-sdk/tests/task_sdk/execution_time/test_task_runner.py covering the
same behaviour through the runtime path.
Existing test_serialize_template_field_with_very_small_max_length and
test_rendered_templates_mask_secrets_with_truncation continue to pass.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

vatsrahul1001 · 2026-05-15T12:44:26Z

@potiuk can you resolve conflicts on this. I see it fixes security issue https://github.com/airflow-s/airflow-s/issues/345. Adding to 3.2.2 milestone

potiuk · 2026-05-15T17:23:14Z

@potiuk can you resolve conflicts on this. I see it fixes security issue airflow-s/airflow-s#345. Adding to 3.2.2 milestone

Damn . Will be away from my PC for few hours.. I hope it will be ok tif I so it later ?

…sted-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns).

potiuk · 2026-05-17T15:45:19Z

rebased and green @vatsrahul1001

potiuk · 2026-05-17T19:45:15Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

github-actions · 2026-05-18T13:59:18Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

… preserve nested-key masking on truncation (apache#65906) * Redact rendered template fields while still structured to preserve nested-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Isolate masker patterns in nested-key truncation test The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns). (cherry picked from commit 4ceb0db) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

… preserve nested-key masking on truncation (#65906) (#67117) * Redact rendered template fields while still structured to preserve nested-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Isolate masker patterns in nested-key truncation test The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns). (cherry picked from commit 4ceb0db) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>

potiuk · 2026-04-26T21:05:22Z

When a rendered template field exceeds [core] max_templated_field_length, the
JSON-serializable serialization path stringifies the value before applying
redact(). That order loses the nested-key context that redact() uses to
mask values under sensitive keys such as password, token, secret, and
api_key — only registered mask_secret() value patterns survive the
truncation path.

This change applies redact() to the structured value first, then stringifies
the redacted result for truncation. Both nested-key-context masking and value-
pattern masking now behave consistently regardless of whether the rendered
field crosses the truncation boundary. The fit-in-limits branch is unchanged.

The same fix is applied in both airflow-core/src/airflow/serialization/helpers.py
(serialize_template_field) and task-sdk/src/airflow/sdk/execution_time/task_runner.py
(_serialize_template_field), since the two functions diverged into
near-duplicates after #59566 and carried the same bug pattern.

Test plan

Add test_serialize_template_field_masks_nested_sensitive_keys_on_truncation
to airflow-core/tests/unit/serialization/test_helpers.py covering the
structured-redact-before-stringify behaviour for an oversized nested
password payload.
Add test_rendered_templates_mask_nested_keys_with_truncation to
task-sdk/tests/task_sdk/execution_time/test_task_runner.py covering the
same behaviour through the runtime path.
Existing test_serialize_template_field_with_very_small_max_length and
test_rendered_templates_mask_secrets_with_truncation continue to pass.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

vatsrahul1001 · 2026-05-15T12:44:26Z

@potiuk can you resolve conflicts on this. I see it fixes security issue https://github.com/airflow-s/airflow-s/issues/345. Adding to 3.2.2 milestone

potiuk · 2026-05-15T17:23:14Z

@potiuk can you resolve conflicts on this. I see it fixes security issue airflow-s/airflow-s#345. Adding to 3.2.2 milestone

Damn . Will be away from my PC for few hours.. I hope it will be ok tif I so it later ?

…sted-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns).

potiuk · 2026-05-17T15:45:19Z

rebased and green @vatsrahul1001

potiuk · 2026-05-17T19:45:15Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

github-actions · 2026-05-18T13:59:18Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

… preserve nested-key masking on truncation (apache#65906) * Redact rendered template fields while still structured to preserve nested-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Isolate masker patterns in nested-key truncation test The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns). (cherry picked from commit 4ceb0db) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

… preserve nested-key masking on truncation (#65906) (#67117) * Redact rendered template fields while still structured to preserve nested-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Isolate masker patterns in nested-key truncation test The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns). (cherry picked from commit 4ceb0db) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>

potiuk · 2026-04-26T21:05:22Z

When a rendered template field exceeds [core] max_templated_field_length, the
JSON-serializable serialization path stringifies the value before applying
redact(). That order loses the nested-key context that redact() uses to
mask values under sensitive keys such as password, token, secret, and
api_key — only registered mask_secret() value patterns survive the
truncation path.

This change applies redact() to the structured value first, then stringifies
the redacted result for truncation. Both nested-key-context masking and value-
pattern masking now behave consistently regardless of whether the rendered
field crosses the truncation boundary. The fit-in-limits branch is unchanged.

The same fix is applied in both airflow-core/src/airflow/serialization/helpers.py
(serialize_template_field) and task-sdk/src/airflow/sdk/execution_time/task_runner.py
(_serialize_template_field), since the two functions diverged into
near-duplicates after #59566 and carried the same bug pattern.

Test plan

Add test_serialize_template_field_masks_nested_sensitive_keys_on_truncation
to airflow-core/tests/unit/serialization/test_helpers.py covering the
structured-redact-before-stringify behaviour for an oversized nested
password payload.
Add test_rendered_templates_mask_nested_keys_with_truncation to
task-sdk/tests/task_sdk/execution_time/test_task_runner.py covering the
same behaviour through the runtime path.
Existing test_serialize_template_field_with_very_small_max_length and
test_rendered_templates_mask_secrets_with_truncation continue to pass.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

vatsrahul1001 · 2026-05-15T12:44:26Z

@potiuk can you resolve conflicts on this. I see it fixes security issue https://github.com/airflow-s/airflow-s/issues/345. Adding to 3.2.2 milestone

potiuk · 2026-05-15T17:23:14Z

@potiuk can you resolve conflicts on this. I see it fixes security issue airflow-s/airflow-s#345. Adding to 3.2.2 milestone

Damn . Will be away from my PC for few hours.. I hope it will be ok tif I so it later ?

…sted-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns).

potiuk · 2026-05-17T15:45:19Z

rebased and green @vatsrahul1001

potiuk · 2026-05-17T19:45:15Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

github-actions · 2026-05-18T13:59:18Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

… preserve nested-key masking on truncation (apache#65906) * Redact rendered template fields while still structured to preserve nested-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Isolate masker patterns in nested-key truncation test The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns). (cherry picked from commit 4ceb0db) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

… preserve nested-key masking on truncation (#65906) (#67117) * Redact rendered template fields while still structured to preserve nested-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Isolate masker patterns in nested-key truncation test The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns). (cherry picked from commit 4ceb0db) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>

potiuk · 2026-04-26T21:05:22Z

When a rendered template field exceeds [core] max_templated_field_length, the
JSON-serializable serialization path stringifies the value before applying
redact(). That order loses the nested-key context that redact() uses to
mask values under sensitive keys such as password, token, secret, and
api_key — only registered mask_secret() value patterns survive the
truncation path.

This change applies redact() to the structured value first, then stringifies
the redacted result for truncation. Both nested-key-context masking and value-
pattern masking now behave consistently regardless of whether the rendered
field crosses the truncation boundary. The fit-in-limits branch is unchanged.

The same fix is applied in both airflow-core/src/airflow/serialization/helpers.py
(serialize_template_field) and task-sdk/src/airflow/sdk/execution_time/task_runner.py
(_serialize_template_field), since the two functions diverged into
near-duplicates after #59566 and carried the same bug pattern.

Test plan

Add test_serialize_template_field_masks_nested_sensitive_keys_on_truncation
to airflow-core/tests/unit/serialization/test_helpers.py covering the
structured-redact-before-stringify behaviour for an oversized nested
password payload.
Add test_rendered_templates_mask_nested_keys_with_truncation to
task-sdk/tests/task_sdk/execution_time/test_task_runner.py covering the
same behaviour through the runtime path.
Existing test_serialize_template_field_with_very_small_max_length and
test_rendered_templates_mask_secrets_with_truncation continue to pass.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

vatsrahul1001 · 2026-05-15T12:44:26Z

@potiuk can you resolve conflicts on this. I see it fixes security issue https://github.com/airflow-s/airflow-s/issues/345. Adding to 3.2.2 milestone

potiuk · 2026-05-15T17:23:14Z

@potiuk can you resolve conflicts on this. I see it fixes security issue airflow-s/airflow-s#345. Adding to 3.2.2 milestone

Damn . Will be away from my PC for few hours.. I hope it will be ok tif I so it later ?

…sted-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns).

potiuk · 2026-05-17T15:45:19Z

rebased and green @vatsrahul1001

potiuk · 2026-05-17T19:45:15Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

github-actions · 2026-05-18T13:59:18Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

… preserve nested-key masking on truncation (apache#65906) * Redact rendered template fields while still structured to preserve nested-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Isolate masker patterns in nested-key truncation test The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns). (cherry picked from commit 4ceb0db) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

… preserve nested-key masking on truncation (#65906) (#67117) * Redact rendered template fields while still structured to preserve nested-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Isolate masker patterns in nested-key truncation test The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns). (cherry picked from commit 4ceb0db) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>

potiuk · 2026-04-26T21:05:22Z

When a rendered template field exceeds [core] max_templated_field_length, the
JSON-serializable serialization path stringifies the value before applying
redact(). That order loses the nested-key context that redact() uses to
mask values under sensitive keys such as password, token, secret, and
api_key — only registered mask_secret() value patterns survive the
truncation path.

This change applies redact() to the structured value first, then stringifies
the redacted result for truncation. Both nested-key-context masking and value-
pattern masking now behave consistently regardless of whether the rendered
field crosses the truncation boundary. The fit-in-limits branch is unchanged.

The same fix is applied in both airflow-core/src/airflow/serialization/helpers.py
(serialize_template_field) and task-sdk/src/airflow/sdk/execution_time/task_runner.py
(_serialize_template_field), since the two functions diverged into
near-duplicates after #59566 and carried the same bug pattern.

Test plan

Add test_serialize_template_field_masks_nested_sensitive_keys_on_truncation
to airflow-core/tests/unit/serialization/test_helpers.py covering the
structured-redact-before-stringify behaviour for an oversized nested
password payload.
Add test_rendered_templates_mask_nested_keys_with_truncation to
task-sdk/tests/task_sdk/execution_time/test_task_runner.py covering the
same behaviour through the runtime path.
Existing test_serialize_template_field_with_very_small_max_length and
test_rendered_templates_mask_secrets_with_truncation continue to pass.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

vatsrahul1001 · 2026-05-15T12:44:26Z

@potiuk can you resolve conflicts on this. I see it fixes security issue https://github.com/airflow-s/airflow-s/issues/345. Adding to 3.2.2 milestone

potiuk · 2026-05-15T17:23:14Z

@potiuk can you resolve conflicts on this. I see it fixes security issue airflow-s/airflow-s#345. Adding to 3.2.2 milestone

Damn . Will be away from my PC for few hours.. I hope it will be ok tif I so it later ?

…sted-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns).

potiuk · 2026-05-17T15:45:19Z

rebased and green @vatsrahul1001

potiuk · 2026-05-17T19:45:15Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

github-actions · 2026-05-18T13:59:18Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

… preserve nested-key masking on truncation (apache#65906) * Redact rendered template fields while still structured to preserve nested-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Isolate masker patterns in nested-key truncation test The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns). (cherry picked from commit 4ceb0db) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

… preserve nested-key masking on truncation (#65906) (#67117) * Redact rendered template fields while still structured to preserve nested-key masking on truncation Generated-by: Claude Opus 4.7 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Isolate masker patterns in nested-key truncation test The new test_rendered_templates_mask_nested_keys_with_truncation shares the singleton SecretsMasker with earlier tests in the file. One of those (test_get_connection_from_context) fetches a connection whose password fixture value happens to be the literal string "password", which the SDK runtime registers as a regex mask via mask_secret(). When the new test runs after it, that regex substitutes the literal token "password" inside str(redacted) -- including the dict KEY name -- so the assertion "'password': '***'" fails because the key itself is also masked. Reset patterns/replacer for the test via monkeypatch (auto-restored on teardown) so the assertion isolates value-masking (the behavior under test) from key-token replacement (a side effect of leaked patterns). (cherry picked from commit 4ceb0db) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>

potiuk requested review from amoghrajesh, ashb, bolkedebruin and kaxil as code owners April 26, 2026 21:05

boring-cyborgBot added area:DAG-processing area:task-sdk labels Apr 26, 2026

potiuk added the backport-to-v3-2-test label Apr 26, 2026

vatsrahul1001 added this to the Airflow 3.2.2 milestone May 15, 2026

potiuk added 2 commits May 17, 2026 15:31

potiuk force-pushed the redact-rendered-template-fields-before-truncation branch from 4304e53 to e8380b2Compare May 17, 2026 13:34

vatsrahul1001 approved these changes May 18, 2026
View reviewed changes

vatsrahul1001 added the ready for maintainer review Set after triaging when all criteria pass. label May 18, 2026

vatsrahul1001 merged commit 4ceb0db into apache:mainMay 18, 2026
113 checks passed

nixpkgs-security-trackerBot mentioned this pull request Jun 2, 2026
Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking NixOS/nixpkgs#527010
Closed

potiuk requested review from amoghrajesh, ashb, bolkedebruin and kaxil as code owners April 26, 2026 21:05

boring-cyborgBot added area:DAG-processing area:task-sdk labels Apr 26, 2026

potiuk added the backport-to-v3-2-test label Apr 26, 2026

vatsrahul1001 added this to the Airflow 3.2.2 milestone May 15, 2026

potiuk added 2 commits May 17, 2026 15:31

potiuk force-pushed the redact-rendered-template-fields-before-truncation branch from 4304e53 to e8380b2Compare May 17, 2026 13:34

vatsrahul1001 approved these changes May 18, 2026
View reviewed changes

vatsrahul1001 added the ready for maintainer review Set after triaging when all criteria pass. label May 18, 2026

vatsrahul1001 merged commit 4ceb0db into apache:mainMay 18, 2026
113 checks passed

nixpkgs-security-trackerBot mentioned this pull request Jun 2, 2026
Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking NixOS/nixpkgs#527010
Closed

potiuk requested review from amoghrajesh, ashb, bolkedebruin and kaxil as code owners April 26, 2026 21:05

boring-cyborgBot added area:DAG-processing area:task-sdk labels Apr 26, 2026

potiuk added the backport-to-v3-2-test label Apr 26, 2026

vatsrahul1001 added this to the Airflow 3.2.2 milestone May 15, 2026

potiuk added 2 commits May 17, 2026 15:31

potiuk force-pushed the redact-rendered-template-fields-before-truncation branch from 4304e53 to e8380b2Compare May 17, 2026 13:34

vatsrahul1001 approved these changes May 18, 2026
View reviewed changes

vatsrahul1001 added the ready for maintainer review Set after triaging when all criteria pass. label May 18, 2026

vatsrahul1001 merged commit 4ceb0db into apache:mainMay 18, 2026
113 checks passed

nixpkgs-security-trackerBot mentioned this pull request Jun 2, 2026
Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking NixOS/nixpkgs#527010
Closed

potiuk requested review from amoghrajesh, ashb, bolkedebruin and kaxil as code owners April 26, 2026 21:05

boring-cyborgBot added area:DAG-processing area:task-sdk labels Apr 26, 2026

potiuk added the backport-to-v3-2-test label Apr 26, 2026

vatsrahul1001 added this to the Airflow 3.2.2 milestone May 15, 2026

potiuk added 2 commits May 17, 2026 15:31

potiuk force-pushed the redact-rendered-template-fields-before-truncation branch from 4304e53 to e8380b2Compare May 17, 2026 13:34

vatsrahul1001 approved these changes May 18, 2026
View reviewed changes

vatsrahul1001 added the ready for maintainer review Set after triaging when all criteria pass. label May 18, 2026

vatsrahul1001 merged commit 4ceb0db into apache:mainMay 18, 2026
113 checks passed

nixpkgs-security-trackerBot mentioned this pull request Jun 2, 2026
Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking NixOS/nixpkgs#527010
Closed

potiuk requested review from amoghrajesh, ashb, bolkedebruin and kaxil as code owners April 26, 2026 21:05

boring-cyborgBot added area:DAG-processing area:task-sdk labels Apr 26, 2026

potiuk added the backport-to-v3-2-test label Apr 26, 2026

vatsrahul1001 added this to the Airflow 3.2.2 milestone May 15, 2026

potiuk added 2 commits May 17, 2026 15:31

potiuk force-pushed the redact-rendered-template-fields-before-truncation branch from 4304e53 to e8380b2Compare May 17, 2026 13:34

vatsrahul1001 approved these changes May 18, 2026
View reviewed changes

vatsrahul1001 added the ready for maintainer review Set after triaging when all criteria pass. label May 18, 2026

vatsrahul1001 merged commit 4ceb0db into apache:mainMay 18, 2026
113 checks passed

nixpkgs-security-trackerBot mentioned this pull request Jun 2, 2026
Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking NixOS/nixpkgs#527010
Closed

potiuk requested review from amoghrajesh, ashb, bolkedebruin and kaxil as code owners April 26, 2026 21:05

boring-cyborgBot added area:DAG-processing area:task-sdk labels Apr 26, 2026

potiuk added the backport-to-v3-2-test label Apr 26, 2026

vatsrahul1001 added this to the Airflow 3.2.2 milestone May 15, 2026

potiuk added 2 commits May 17, 2026 15:31

potiuk force-pushed the redact-rendered-template-fields-before-truncation branch from 4304e53 to e8380b2Compare May 17, 2026 13:34

vatsrahul1001 approved these changes May 18, 2026
View reviewed changes

vatsrahul1001 added the ready for maintainer review Set after triaging when all criteria pass. label May 18, 2026

vatsrahul1001 merged commit 4ceb0db into apache:mainMay 18, 2026
113 checks passed

nixpkgs-security-trackerBot mentioned this pull request Jun 2, 2026
Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking NixOS/nixpkgs#527010
Closed

potiuk requested review from amoghrajesh, ashb, bolkedebruin and kaxil as code owners April 26, 2026 21:05

boring-cyborgBot added area:DAG-processing area:task-sdk labels Apr 26, 2026

potiuk added the backport-to-v3-2-test label Apr 26, 2026

vatsrahul1001 added this to the Airflow 3.2.2 milestone May 15, 2026

potiuk added 2 commits May 17, 2026 15:31

potiuk force-pushed the redact-rendered-template-fields-before-truncation branch from 4304e53 to e8380b2Compare May 17, 2026 13:34

vatsrahul1001 approved these changes May 18, 2026
View reviewed changes

vatsrahul1001 added the ready for maintainer review Set after triaging when all criteria pass. label May 18, 2026

vatsrahul1001 merged commit 4ceb0db into apache:mainMay 18, 2026
113 checks passed

nixpkgs-security-trackerBot mentioned this pull request Jun 2, 2026
Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking NixOS/nixpkgs#527010
Closed

potiuk requested review from amoghrajesh, ashb, bolkedebruin and kaxil as code owners April 26, 2026 21:05

boring-cyborgBot added area:DAG-processing area:task-sdk labels Apr 26, 2026

potiuk added the backport-to-v3-2-test label Apr 26, 2026

vatsrahul1001 added this to the Airflow 3.2.2 milestone May 15, 2026

potiuk added 2 commits May 17, 2026 15:31

potiuk force-pushed the redact-rendered-template-fields-before-truncation branch from 4304e53 to e8380b2Compare May 17, 2026 13:34

vatsrahul1001 approved these changes May 18, 2026
View reviewed changes

vatsrahul1001 added the ready for maintainer review Set after triaging when all criteria pass. label May 18, 2026

vatsrahul1001 merged commit 4ceb0db into apache:mainMay 18, 2026
113 checks passed

nixpkgs-security-trackerBot mentioned this pull request Jun 2, 2026
Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking NixOS/nixpkgs#527010
Closed

Uh oh!

Conversation

potiuk commented Apr 26, 2026

Test plan

Was generative AI tooling used to co-author this PR?

Uh oh!

vatsrahul1001 commented May 15, 2026

Uh oh!

potiuk commented May 15, 2026

Uh oh!

potiuk commented May 17, 2026

Uh oh!

potiuk commented May 17, 2026

Uh oh!

Uh oh!

github-actionsBot commented May 18, 2026

Backport successfully created: v3-2-test

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

potiuk commented Apr 26, 2026

Test plan

Was generative AI tooling used to co-author this PR?

Uh oh!

vatsrahul1001 commented May 15, 2026

Uh oh!

potiuk commented May 15, 2026

Uh oh!

potiuk commented May 17, 2026

Uh oh!

potiuk commented May 17, 2026

Uh oh!

Uh oh!

github-actionsBot commented May 18, 2026

Backport successfully created: v3-2-test

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

potiuk commented Apr 26, 2026

Test plan

Was generative AI tooling used to co-author this PR?

Uh oh!

vatsrahul1001 commented May 15, 2026

Uh oh!

potiuk commented May 15, 2026

Uh oh!

potiuk commented May 17, 2026

Uh oh!

potiuk commented May 17, 2026

Uh oh!

Uh oh!

github-actionsBot commented May 18, 2026

Backport successfully created: v3-2-test

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation