Tighten deserialization allowlist regex to require full-string match by potiuk · Pull Request #66499 · apache/airflow

potiuk · 2026-05-07T00:22:05Z

Tighten the deserialization allowlist ([core] allowed_deserialization_classes_regexp)
to use re.fullmatch() instead of re.match(). Previously a pattern such as
airflow\.models\.Variable admitted not only the intended class but also
airflow.models.Variable_Malicious — re.match only anchors at the start
of the string. Using fullmatch requires the pattern to match the entire
classname, eliminating the prefix-bypass footgun.

Updated the config description so admins know patterns are full-match and
that .* is needed for prefix-style allowances. Updated the existing test
that relied on prefix-match semantics, and added a dedicated test for the
bypass scenario.

Compatibility note for reviewers

This is a behaviour change for any deployment that configured
allowed_deserialization_classes_regexp with patterns relying on
prefix-match semantics (e.g. airflow\.models\. to mean "any class under
airflow.models"). Such deployments need to add .* to the pattern.
The default value is empty, so out-of-the-box deployments are unaffected.
Default off, admin-only config — leaving the newsfragment decision to the
reviewer.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines

The ``allowed_deserialization_classes_regexp`` allowlist used ``re.match()``, which only anchors at the start of the string. A pattern like ``airflow\.models\.Variable`` therefore also admitted classnames such as ``airflow.models.Variable_Malicious``. Switch to ``re.fullmatch()`` so the admin's pattern matches the entire classname; document the semantics in the config description so operators know to use ``.*`` for prefix-style allowances.

potiuk · 2026-05-17T19:45:14Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

vatsrahul1001 · 2026-05-18T04:27:08Z

LGTM!, love to get another pair of eyes @amoghrajesh @kaxil @ashb

github-actions · 2026-05-18T09:14:35Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

…tring match (#66499) (#67096) * Tighten deserialization allowlist regex to use full-string match The ``allowed_deserialization_classes_regexp`` allowlist used ``re.match()``, which only anchors at the start of the string. A pattern like ``airflow\.models\.Variable`` therefore also admitted classnames such as ``airflow.models.Variable_Malicious``. Switch to ``re.fullmatch()`` so the admin's pattern matches the entire classname; document the semantics in the config description so operators know to use ``.*`` for prefix-style allowances. * Add newsfragment for #66499 --------- (cherry picked from commit 80f1ab4) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>

potiuk · 2026-05-07T00:22:05Z

Tighten the deserialization allowlist ([core] allowed_deserialization_classes_regexp)
to use re.fullmatch() instead of re.match(). Previously a pattern such as
airflow\.models\.Variable admitted not only the intended class but also
airflow.models.Variable_Malicious — re.match only anchors at the start
of the string. Using fullmatch requires the pattern to match the entire
classname, eliminating the prefix-bypass footgun.

Updated the config description so admins know patterns are full-match and
that .* is needed for prefix-style allowances. Updated the existing test
that relied on prefix-match semantics, and added a dedicated test for the
bypass scenario.

Compatibility note for reviewers

This is a behaviour change for any deployment that configured
allowed_deserialization_classes_regexp with patterns relying on
prefix-match semantics (e.g. airflow\.models\. to mean "any class under
airflow.models"). Such deployments need to add .* to the pattern.
The default value is empty, so out-of-the-box deployments are unaffected.
Default off, admin-only config — leaving the newsfragment decision to the
reviewer.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines

The ``allowed_deserialization_classes_regexp`` allowlist used ``re.match()``, which only anchors at the start of the string. A pattern like ``airflow\.models\.Variable`` therefore also admitted classnames such as ``airflow.models.Variable_Malicious``. Switch to ``re.fullmatch()`` so the admin's pattern matches the entire classname; document the semantics in the config description so operators know to use ``.*`` for prefix-style allowances.

potiuk · 2026-05-17T19:45:14Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

vatsrahul1001 · 2026-05-18T04:27:08Z

LGTM!, love to get another pair of eyes @amoghrajesh @kaxil @ashb

github-actions · 2026-05-18T09:14:35Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

…tring match (#66499) (#67096) * Tighten deserialization allowlist regex to use full-string match The ``allowed_deserialization_classes_regexp`` allowlist used ``re.match()``, which only anchors at the start of the string. A pattern like ``airflow\.models\.Variable`` therefore also admitted classnames such as ``airflow.models.Variable_Malicious``. Switch to ``re.fullmatch()`` so the admin's pattern matches the entire classname; document the semantics in the config description so operators know to use ``.*`` for prefix-style allowances. * Add newsfragment for #66499 --------- (cherry picked from commit 80f1ab4) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>

potiuk · 2026-05-07T00:22:05Z

Tighten the deserialization allowlist ([core] allowed_deserialization_classes_regexp)
to use re.fullmatch() instead of re.match(). Previously a pattern such as
airflow\.models\.Variable admitted not only the intended class but also
airflow.models.Variable_Malicious — re.match only anchors at the start
of the string. Using fullmatch requires the pattern to match the entire
classname, eliminating the prefix-bypass footgun.

Updated the config description so admins know patterns are full-match and
that .* is needed for prefix-style allowances. Updated the existing test
that relied on prefix-match semantics, and added a dedicated test for the
bypass scenario.

Compatibility note for reviewers

This is a behaviour change for any deployment that configured
allowed_deserialization_classes_regexp with patterns relying on
prefix-match semantics (e.g. airflow\.models\. to mean "any class under
airflow.models"). Such deployments need to add .* to the pattern.
The default value is empty, so out-of-the-box deployments are unaffected.
Default off, admin-only config — leaving the newsfragment decision to the
reviewer.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines

The ``allowed_deserialization_classes_regexp`` allowlist used ``re.match()``, which only anchors at the start of the string. A pattern like ``airflow\.models\.Variable`` therefore also admitted classnames such as ``airflow.models.Variable_Malicious``. Switch to ``re.fullmatch()`` so the admin's pattern matches the entire classname; document the semantics in the config description so operators know to use ``.*`` for prefix-style allowances.

potiuk · 2026-05-17T19:45:14Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

vatsrahul1001 · 2026-05-18T04:27:08Z

LGTM!, love to get another pair of eyes @amoghrajesh @kaxil @ashb

github-actions · 2026-05-18T09:14:35Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

…tring match (#66499) (#67096) * Tighten deserialization allowlist regex to use full-string match The ``allowed_deserialization_classes_regexp`` allowlist used ``re.match()``, which only anchors at the start of the string. A pattern like ``airflow\.models\.Variable`` therefore also admitted classnames such as ``airflow.models.Variable_Malicious``. Switch to ``re.fullmatch()`` so the admin's pattern matches the entire classname; document the semantics in the config description so operators know to use ``.*`` for prefix-style allowances. * Add newsfragment for #66499 --------- (cherry picked from commit 80f1ab4) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>

potiuk · 2026-05-07T00:22:05Z

Tighten the deserialization allowlist ([core] allowed_deserialization_classes_regexp)
to use re.fullmatch() instead of re.match(). Previously a pattern such as
airflow\.models\.Variable admitted not only the intended class but also
airflow.models.Variable_Malicious — re.match only anchors at the start
of the string. Using fullmatch requires the pattern to match the entire
classname, eliminating the prefix-bypass footgun.

Updated the config description so admins know patterns are full-match and
that .* is needed for prefix-style allowances. Updated the existing test
that relied on prefix-match semantics, and added a dedicated test for the
bypass scenario.

Compatibility note for reviewers

This is a behaviour change for any deployment that configured
allowed_deserialization_classes_regexp with patterns relying on
prefix-match semantics (e.g. airflow\.models\. to mean "any class under
airflow.models"). Such deployments need to add .* to the pattern.
The default value is empty, so out-of-the-box deployments are unaffected.
Default off, admin-only config — leaving the newsfragment decision to the
reviewer.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines

The ``allowed_deserialization_classes_regexp`` allowlist used ``re.match()``, which only anchors at the start of the string. A pattern like ``airflow\.models\.Variable`` therefore also admitted classnames such as ``airflow.models.Variable_Malicious``. Switch to ``re.fullmatch()`` so the admin's pattern matches the entire classname; document the semantics in the config description so operators know to use ``.*`` for prefix-style allowances.

potiuk · 2026-05-17T19:45:14Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

vatsrahul1001 · 2026-05-18T04:27:08Z

LGTM!, love to get another pair of eyes @amoghrajesh @kaxil @ashb

github-actions · 2026-05-18T09:14:35Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

…tring match (#66499) (#67096) * Tighten deserialization allowlist regex to use full-string match The ``allowed_deserialization_classes_regexp`` allowlist used ``re.match()``, which only anchors at the start of the string. A pattern like ``airflow\.models\.Variable`` therefore also admitted classnames such as ``airflow.models.Variable_Malicious``. Switch to ``re.fullmatch()`` so the admin's pattern matches the entire classname; document the semantics in the config description so operators know to use ``.*`` for prefix-style allowances. * Add newsfragment for #66499 --------- (cherry picked from commit 80f1ab4) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>

potiuk · 2026-05-07T00:22:05Z

Tighten the deserialization allowlist ([core] allowed_deserialization_classes_regexp)
to use re.fullmatch() instead of re.match(). Previously a pattern such as
airflow\.models\.Variable admitted not only the intended class but also
airflow.models.Variable_Malicious — re.match only anchors at the start
of the string. Using fullmatch requires the pattern to match the entire
classname, eliminating the prefix-bypass footgun.

Updated the config description so admins know patterns are full-match and
that .* is needed for prefix-style allowances. Updated the existing test
that relied on prefix-match semantics, and added a dedicated test for the
bypass scenario.

Compatibility note for reviewers

This is a behaviour change for any deployment that configured
allowed_deserialization_classes_regexp with patterns relying on
prefix-match semantics (e.g. airflow\.models\. to mean "any class under
airflow.models"). Such deployments need to add .* to the pattern.
The default value is empty, so out-of-the-box deployments are unaffected.
Default off, admin-only config — leaving the newsfragment decision to the
reviewer.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines

The ``allowed_deserialization_classes_regexp`` allowlist used ``re.match()``, which only anchors at the start of the string. A pattern like ``airflow\.models\.Variable`` therefore also admitted classnames such as ``airflow.models.Variable_Malicious``. Switch to ``re.fullmatch()`` so the admin's pattern matches the entire classname; document the semantics in the config description so operators know to use ``.*`` for prefix-style allowances.

potiuk · 2026-05-17T19:45:14Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

vatsrahul1001 · 2026-05-18T04:27:08Z

LGTM!, love to get another pair of eyes @amoghrajesh @kaxil @ashb

github-actions · 2026-05-18T09:14:35Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

…tring match (#66499) (#67096) * Tighten deserialization allowlist regex to use full-string match The ``allowed_deserialization_classes_regexp`` allowlist used ``re.match()``, which only anchors at the start of the string. A pattern like ``airflow\.models\.Variable`` therefore also admitted classnames such as ``airflow.models.Variable_Malicious``. Switch to ``re.fullmatch()`` so the admin's pattern matches the entire classname; document the semantics in the config description so operators know to use ``.*`` for prefix-style allowances. * Add newsfragment for #66499 --------- (cherry picked from commit 80f1ab4) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>

potiuk · 2026-05-07T00:22:05Z

Tighten the deserialization allowlist ([core] allowed_deserialization_classes_regexp)
to use re.fullmatch() instead of re.match(). Previously a pattern such as
airflow\.models\.Variable admitted not only the intended class but also
airflow.models.Variable_Malicious — re.match only anchors at the start
of the string. Using fullmatch requires the pattern to match the entire
classname, eliminating the prefix-bypass footgun.

Updated the config description so admins know patterns are full-match and
that .* is needed for prefix-style allowances. Updated the existing test
that relied on prefix-match semantics, and added a dedicated test for the
bypass scenario.

Compatibility note for reviewers

This is a behaviour change for any deployment that configured
allowed_deserialization_classes_regexp with patterns relying on
prefix-match semantics (e.g. airflow\.models\. to mean "any class under
airflow.models"). Such deployments need to add .* to the pattern.
The default value is empty, so out-of-the-box deployments are unaffected.
Default off, admin-only config — leaving the newsfragment decision to the
reviewer.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines

The ``allowed_deserialization_classes_regexp`` allowlist used ``re.match()``, which only anchors at the start of the string. A pattern like ``airflow\.models\.Variable`` therefore also admitted classnames such as ``airflow.models.Variable_Malicious``. Switch to ``re.fullmatch()`` so the admin's pattern matches the entire classname; document the semantics in the config description so operators know to use ``.*`` for prefix-style allowances.

potiuk · 2026-05-17T19:45:14Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

vatsrahul1001 · 2026-05-18T04:27:08Z

LGTM!, love to get another pair of eyes @amoghrajesh @kaxil @ashb

github-actions · 2026-05-18T09:14:35Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

…tring match (#66499) (#67096) * Tighten deserialization allowlist regex to use full-string match The ``allowed_deserialization_classes_regexp`` allowlist used ``re.match()``, which only anchors at the start of the string. A pattern like ``airflow\.models\.Variable`` therefore also admitted classnames such as ``airflow.models.Variable_Malicious``. Switch to ``re.fullmatch()`` so the admin's pattern matches the entire classname; document the semantics in the config description so operators know to use ``.*`` for prefix-style allowances. * Add newsfragment for #66499 --------- (cherry picked from commit 80f1ab4) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>

potiuk · 2026-05-07T00:22:05Z

Tighten the deserialization allowlist ([core] allowed_deserialization_classes_regexp)
to use re.fullmatch() instead of re.match(). Previously a pattern such as
airflow\.models\.Variable admitted not only the intended class but also
airflow.models.Variable_Malicious — re.match only anchors at the start
of the string. Using fullmatch requires the pattern to match the entire
classname, eliminating the prefix-bypass footgun.

Updated the config description so admins know patterns are full-match and
that .* is needed for prefix-style allowances. Updated the existing test
that relied on prefix-match semantics, and added a dedicated test for the
bypass scenario.

Compatibility note for reviewers

This is a behaviour change for any deployment that configured
allowed_deserialization_classes_regexp with patterns relying on
prefix-match semantics (e.g. airflow\.models\. to mean "any class under
airflow.models"). Such deployments need to add .* to the pattern.
The default value is empty, so out-of-the-box deployments are unaffected.
Default off, admin-only config — leaving the newsfragment decision to the
reviewer.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines

The ``allowed_deserialization_classes_regexp`` allowlist used ``re.match()``, which only anchors at the start of the string. A pattern like ``airflow\.models\.Variable`` therefore also admitted classnames such as ``airflow.models.Variable_Malicious``. Switch to ``re.fullmatch()`` so the admin's pattern matches the entire classname; document the semantics in the config description so operators know to use ``.*`` for prefix-style allowances.

potiuk · 2026-05-17T19:45:14Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

vatsrahul1001 · 2026-05-18T04:27:08Z

LGTM!, love to get another pair of eyes @amoghrajesh @kaxil @ashb

github-actions · 2026-05-18T09:14:35Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

…tring match (#66499) (#67096) * Tighten deserialization allowlist regex to use full-string match The ``allowed_deserialization_classes_regexp`` allowlist used ``re.match()``, which only anchors at the start of the string. A pattern like ``airflow\.models\.Variable`` therefore also admitted classnames such as ``airflow.models.Variable_Malicious``. Switch to ``re.fullmatch()`` so the admin's pattern matches the entire classname; document the semantics in the config description so operators know to use ``.*`` for prefix-style allowances. * Add newsfragment for #66499 --------- (cherry picked from commit 80f1ab4) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>

potiuk · 2026-05-07T00:22:05Z

Tighten the deserialization allowlist ([core] allowed_deserialization_classes_regexp)
to use re.fullmatch() instead of re.match(). Previously a pattern such as
airflow\.models\.Variable admitted not only the intended class but also
airflow.models.Variable_Malicious — re.match only anchors at the start
of the string. Using fullmatch requires the pattern to match the entire
classname, eliminating the prefix-bypass footgun.

Updated the config description so admins know patterns are full-match and
that .* is needed for prefix-style allowances. Updated the existing test
that relied on prefix-match semantics, and added a dedicated test for the
bypass scenario.

Compatibility note for reviewers

This is a behaviour change for any deployment that configured
allowed_deserialization_classes_regexp with patterns relying on
prefix-match semantics (e.g. airflow\.models\. to mean "any class under
airflow.models"). Such deployments need to add .* to the pattern.
The default value is empty, so out-of-the-box deployments are unaffected.
Default off, admin-only config — leaving the newsfragment decision to the
reviewer.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines

The ``allowed_deserialization_classes_regexp`` allowlist used ``re.match()``, which only anchors at the start of the string. A pattern like ``airflow\.models\.Variable`` therefore also admitted classnames such as ``airflow.models.Variable_Malicious``. Switch to ``re.fullmatch()`` so the admin's pattern matches the entire classname; document the semantics in the config description so operators know to use ``.*`` for prefix-style allowances.

potiuk · 2026-05-17T19:45:14Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

vatsrahul1001 · 2026-05-18T04:27:08Z

LGTM!, love to get another pair of eyes @amoghrajesh @kaxil @ashb

github-actions · 2026-05-18T09:14:35Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

…tring match (#66499) (#67096) * Tighten deserialization allowlist regex to use full-string match The ``allowed_deserialization_classes_regexp`` allowlist used ``re.match()``, which only anchors at the start of the string. A pattern like ``airflow\.models\.Variable`` therefore also admitted classnames such as ``airflow.models.Variable_Malicious``. Switch to ``re.fullmatch()`` so the admin's pattern matches the entire classname; document the semantics in the config description so operators know to use ``.*`` for prefix-style allowances. * Add newsfragment for #66499 --------- (cherry picked from commit 80f1ab4) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>

potiuk requested review from amoghrajesh, ashb and kaxil as code owners May 7, 2026 00:22

boring-cyborgBot added area:ConfigTemplates area:task-sdk labels May 7, 2026

potiuk added a commit to potiuk/airflow that referenced this pull request May 7, 2026
Add newsfragment forapache#66499
89c56f5

potiuk added 2 commits May 17, 2026 21:44

Add newsfragment forapache#66499
fa69b78

potiuk force-pushed the serde-fullmatch-allowlist branch from 89c56f5 to fa69b78Compare May 17, 2026 19:44

potiuk added this to the Airflow 3.2.2 milestone May 17, 2026

potiuk added the backport-to-v3-2-test label May 17, 2026

vatsrahul1001 approved these changes May 18, 2026
View reviewed changes

Lee-W approved these changes May 18, 2026
View reviewed changes

amoghrajesh approved these changes May 18, 2026
View reviewed changes

Merge branch 'main' into serde-fullmatch-allowlist
367911b

vatsrahul1001 merged commit 80f1ab4 into apache:mainMay 18, 2026
7 checks passed

github-actionsBot mentioned this pull request May 18, 2026
[v3-2-test] Tighten deserialization allowlist regex to require full-string match (#66499) #67096
Merged

vatsrahul1001 mentioned this pull request May 21, 2026
Status of testing of Apache Airflow 3.2.2rc3 #67282
Closed

potiuk mentioned this pull request May 24, 2026
Docs: refresh JWT and security model for v3.2 with mermaid diagrams #67435
Merged
1 task

phanikumv mentioned this pull request Jun 4, 2026
Clarify logging_config_class contract and document REMOTE_TASK_LOG#67104
Merged
1 task