Skip to content

fix(security): bump apache-airflow 3.3.0 -> 3.3.1 for CVE-2026-67587 / CVE-2026-54183 #31861

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Khairajani wants to merge 4 commits into from
Closed

fix(security): bump apache-airflow 3.3.0 -> 3.3.1 for CVE-2026-67587 / CVE-2026-54183 #31861

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7db3fa4
fix(security): bump apache-airflow 3.3.0 -> 3.3.1 for CVE-2026-67587 …
Khairajani Aug 21, 2026
a14ecdb
fix(deps): drop the stale croniter<3 ceiling from the dagster extra
Khairajani Aug 21, 2026
7cf7ec5
Merge branch 'main' into fix/airflow-3.3.1-cve
Khairajani Aug 21, 2026
e3960d1
Merge branch 'main' into fix/airflow-3.3.1-cve
Khairajani Aug 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions ingestion/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
FROM mysql:8.3 AS mysql

FROM apache/airflow:3.3.0-python3.12
FROM apache/airflow:3.3.1-python3.12
USER root
RUN curl -fsSL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor -o /usr/share/keyrings/microsoft-prod.gpg \
&& echo "deb [arch=amd64,arm64,armhf signed-by=/usr/share/keyrings/microsoft-prod.gpg] https://packages.microsoft.com/debian/12/prod bookworm main" > /etc/apt/sources.list.d/mssql-release.list
Expand Down Expand Up @@ -122,7 +122,7 @@ ARG RI_VERSION="2.0.0.0.dev0"
RUN pip install --upgrade "pip>=26.2,<27" "setuptools<81"
# Pre-install cx-Oracle without build isolation to use the pinned setuptools
RUN pip install --no-build-isolation "cx_Oracle>=8.3.0,<9"
RUN pip install "openmetadata-managed-apis~=${RI_VERSION}" --constraint "https://raw.githubusercontent.com/apache/airflow/constraints-3.3.0/constraints-3.12.txt"
RUN pip install "openmetadata-managed-apis~=${RI_VERSION}" --constraint "https://raw.githubusercontent.com/apache/airflow/constraints-3.3.1/constraints-3.12.txt"
RUN pip install "openmetadata-ingestion[${INGESTION_DEPENDENCY}]~=${RI_VERSION}"


Expand Down
10 changes: 5 additions & 5 deletions ingestion/Dockerfile.ci
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
FROM mysql:8.3 AS mysql

FROM apache/airflow:3.3.0-python3.12
FROM apache/airflow:3.3.1-python3.12
USER root
RUN curl -fsSL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor -o /usr/share/keyrings/microsoft-prod.gpg \
&& echo "deb [arch=amd64,arm64,armhf signed-by=/usr/share/keyrings/microsoft-prod.gpg] https://packages.microsoft.com/debian/12/prod bookworm main" > /etc/apt/sources.list.d/mssql-release.list
Expand Down Expand Up @@ -94,7 +94,7 @@ COPY --chown=airflow:0 openmetadata-airflow-apis /home/airflow/openmetadata-airf
# Required for Airflow DAGs of Sample Data
COPY --chown=airflow:0 ingestion/examples/airflow/dags /opt/airflow/dags
COPY --chown=airflow:0 ingestion/examples/airflow/test_dags /opt/airflow/dags
COPY --chown=airflow:0 ingestion/airflow-constraints-3.3.0.txt /home/airflow/airflow-constraints-3.3.0.txt
COPY --chown=airflow:0 ingestion/airflow-constraints-3.3.1.txt /home/airflow/airflow-constraints-3.3.1.txt

# Refresh the interpreter-level pip before dropping privileges. The per-user
# pip upgrade below only reaches ~/.local, leaving the base image's
Expand Down Expand Up @@ -122,11 +122,11 @@ RUN pip install --upgrade "pip>=26.2,<27" "setuptools<81"
RUN pip install --no-build-isolation "cx_Oracle>=8.3.0,<9"

# Install FAB provider for Airflow 3.x Flask Blueprint compatibility
RUN pip install "apache-airflow-providers-fab>=1.0.0" --constraint "/home/airflow/airflow-constraints-3.3.0.txt" || true
RUN pip install "apache-airflow-providers-fab>=1.0.0" --constraint "/home/airflow/airflow-constraints-3.3.1.txt" || true


WORKDIR /home/airflow/openmetadata-airflow-apis
RUN pip install "." --constraint "/home/airflow/airflow-constraints-3.3.0.txt"
RUN pip install "." --constraint "/home/airflow/airflow-constraints-3.3.1.txt"

WORKDIR /home/airflow/ingestion

Expand Down Expand Up @@ -169,7 +169,7 @@ RUN pip install psycopg2 mysqlclient==2.1.1
RUN mkdir -p /opt/airflow/dag_generated_configs

EXPOSE 8080
# Airflow 3.3.0 requires universal-pathlib>=0.3.8, but prior installs in this image
# Airflow 3.3.1 requires universal-pathlib>=0.3.8, but prior installs in this image
# can leave stale 0.2.6 `upath` module files in site-packages that cause import
# errors at runtime. Force-remove the stale registration then pin to the required version.
RUN pip uninstall upath -y && pip install "universal-pathlib==0.3.10"
Expand Down
Loading
Loading