October 08, 2026
- Airflow version: 3.3.2
- Python versions: 3.12 - 3.14 (default: 3.14)
- Runtime image:
astrocrpublic.azurecr.io/runtime:3.3-9
Additional improvements
- Upgrade to Airflow
3.3.2+astro.2, which includes: - Upgraded the minor and patch versions of some open-source provider packages. See Astro Runtime 3.3-9 provider packages.
Security fixes
- Fixed GHSA-3pq3-5fj3-cg6v
- Fixed GHSA-2gx3-rcp4-g85q
- Fixed GHSA-42vr-xj54-vc7v
- Fixed GHSA-8wjv-2p76-3863
- Fixed GHSA-9j54-fg26-wv3r
- Fixed GHSA-9v7f-9g4p-ffgj
- Fixed GHSA-ffc3-869f-jxw9
- Fixed GHSA-gvp8-978c-rx2q
- Fixed GHSA-hxm8-2xgr-2p9m
- Fixed GHSA-jwrc-g2q2-pq5p
- Fixed GHSA-p4g4-x82p-q773
- Fixed GHSA-r6x4-923q-g947
- Fixed GHSA-w2cx-738m-mc7w
- Fixed GHSA-w6j9-cwv2-h6wq
- Fixed GHSA-8988-9cw3-xx77
- Fixed GHSA-gh4c-6fx4-qh6g
- Fixed GHSA-vxq7-64xx-v4gw
- Fixed GHSA-hj66-6f7g-4r5v
- Fixed GHSA-xpv3-w29h-x7cv
- Fixed CVE-2026-102991
- Fixed CVE-2026-90467
- Fixed RUSTSEC-2026-0204
- Fixed RUSTSEC-2026-0285
- Fixed GHSA-27vj-qcqg-25rc
- Fixed GHSA-54p9-h82j-f925
- Fixed CVE-2026-12345
- Fixed CVE-2026-82049
- Fixed CVE-2026-19553
October 08, 2026
- Airflow version: 3.2.2
- Python versions: 3.12 - 3.14 (default: 3.13)
- Runtime image:
astrocrpublic.azurecr.io/runtime:3.2-11
Additional improvements
- Upgrade to Airflow
3.2.2+astro.7, which includes:- Revoke every credential presented to the Core API logout endpoint (#72649, #72933)
- Scope /assets/events to the Dags the caller may read (#71741, #71785)
- Require Dag edit to delete asset queued events (#71736, #71828)
- Resolve the caller from the explicit credential, not the session cookie (#72225, #72723)
- Fix backfill DagRuns being permanently starved from scheduling (#72730)
- Upgraded the minor and patch versions of some open-source provider packages. See Astro Runtime 3.2-11 provider packages.
Security fixes
- Fixed CVE-2026-75157
- Fixed CVE-2026-75158
- Fixed CVE-2026-82355
- Fixed CVE-2026-86473
- Fixed CVE-2026-102991
- Fixed GHSA-2gx3-rcp4-g85q
- Fixed GHSA-2j2x-hqr9-3h42
- Fixed GHSA-337j-9hxr-rhxg
- Fixed GHSA-3pq3-5fj3-cg6v
- Fixed GHSA-42h9-826w-cgv3
- Fixed GHSA-42vr-xj54-vc7v
- Fixed GHSA-44g4-m2mj-wpvx
- Fixed GHSA-49rj-9fvp-4h2h
- Fixed GHSA-4hqw-qxg8-jxx2
- Fixed GHSA-542g-h47m-68v8
- Fixed GHSA-7q8q-rj6j-mhjq
- Fixed GHSA-84g9-w2xq-vcv6
- Fixed GHSA-8646-j5j9-6r62
- Fixed GHSA-8988-9cw3-xx77
- Fixed GHSA-8wjv-2p76-3863
- Fixed GHSA-8x6r-g9mw-2r78
- Fixed GHSA-9fr6-4gfg-395g
- Fixed GHSA-9j54-fg26-wv3r
- Fixed GHSA-9v7f-9g4p-ffgj
- Fixed GHSA-chx6-hx7r-mcp5
- Fixed GHSA-f22v-gfqf-p8f3
- Fixed GHSA-f4gw-2p7v-4548
- Fixed GHSA-ffc3-869f-jxw9
- Fixed GHSA-gcfj-64vw-6mp9
- Fixed GHSA-gh4c-6fx4-qh6g
- Fixed GHSA-gvp8-978c-rx2q
- Fixed GHSA-h8fp-f39c-q6mh
- Fixed GHSA-hcpx-6fm6-wx23
- Fixed GHSA-hj66-6f7g-4r5v
- Fixed GHSA-hmw2-7cc7-3qxx
- Fixed GHSA-hxm8-2xgr-2p9m
- Fixed GHSA-j8rh-479h-cp32
- Fixed GHSA-jqh4-m9w3-8hp9
- Fixed GHSA-jwrc-g2q2-pq5p
- Fixed GHSA-m8m8-qj5v-23w3
- Fixed GHSA-mghh-pgcx-3jjj
- Fixed GHSA-mmx7-hfxf-jppx
- Fixed GHSA-mwf2-3pr3-8698
- Fixed GHSA-p4g4-x82p-q773
- Fixed GHSA-pmv8-rq9r-6j72
- Fixed GHSA-qwww-vcr4-c8h2
- Fixed GHSA-r6x4-923q-g947
- Fixed GHSA-rxv8-25v2-qmq8
- Fixed GHSA-vh66-26gq-q6x8
- Fixed GHSA-vxq7-64xx-v4gw
- Fixed GHSA-w2cx-738m-mc7w
- Fixed GHSA-w6j9-cwv2-h6wq
- Fixed GHSA-wrjc-x8rr-h8h6
- Fixed GHSA-x97p-jq2g-jp4f
- Fixed GHSA-xj6q-8x83-jv6g
- Fixed GHSA-xpv3-w29h-x7cv
- Fixed RUSTSEC-2026-0204
- Fixed RUSTSEC-2026-0285
- Fixed GHSA-27vj-qcqg-25rc
- Fixed GHSA-54p9-h82j-f925
- Fixed CVE-2026-12345
- Fixed CVE-2026-82049
- Fixed CVE-2026-19553
September 24, 2026
- Airflow version: 3.2.2
- Python versions: 3.12 - 3.14 (default: 3.13)
- Runtime image:
astrocrpublic.azurecr.io/runtime:3.2-10
Additional improvements
- Upgrade to Apache Airflow TaskSDK to
1.2.2+astro.6, which includes:- Allow opting into
fork+exectask processes to avoid a fork-time deadlock (#72164)
- Allow opting into
- Upgrade
astronomer-kubernetes-executorto10.22.0+astro.1
Security fixes
- Fixed GHSA-82r6-8w77-94w6
- Fixed GHSA-mpf4-983q-p7j4
- Fixed GHSA-5p39-cfhj-2xmp
- Fixed GHSA-8423-8fgw-73vq
- Fixed GHSA-wwv5-g3v4-889x
September 23, 2026
- Airflow version: 3.3.2
- Python versions: 3.12 - 3.14 (default: 3.14)
- Runtime image:
astrocrpublic.azurecr.io/runtime:3.3-8
Additional improvements
- Upgrade to Airflow
3.3.2+astro.1 - Upgrade to Apache Airflow TaskSDK to
1.3.2+astro.1, which includes:- Allow opting into
fork+exectask processes viaexecute_tasks_new_python_interpreter(#72164)
- Allow opting into
- Upgrade
astronomer-kubernetes-executorto10.22.0+astro.1 - Upgraded the minor and patch versions of some open-source provider packages. See Astro Runtime 3.3-8 provider packages.
Security fixes
- Fixed GHSA-mpf4-983q-p7j4
- Fixed GHSA-8423-8fgw-73vq
- Fixed GHSA-wwv5-g3v4-889x
- Fixed GHSA-82r6-8w77-94w6
- Fixed GHSA-5p39-cfhj-2xmp
September 17, 2026
- Airflow version: 2.11.2
- Python versions: 3.10 - 3.12 (default: 3.12)
- Runtime image:
astrocrpublic.azurecr.io/astronomer/astro-runtime:13.11.0
Additional improvements
- Upgrade to Airflow
2.11.2+astro.7 - Upgrade
apache-airflow-providers-amazonto9.35.1 - Upgraded the minor and patch versions of several open-source provider packages.
Security fixes
- Fixed GHSA-8423-8fgw-73vq
- Fixed GHSA-mpf4-983q-p7j4
- Fixed GHSA-wwv5-g3v4-889x
- Fixed CVE-2026-54183
- Fixed CVE-2026-58076
September 15, 2026
- Airflow version: 3.0.6
- Python versions: 3.11 - 3.12 (default: 3.12)
- Runtime image:
astrocrpublic.azurecr.io/runtime:3.0-18
Additional improvements
- Upgrade to Airflow
3.0.6+astro.10 - Upgrade to Apache Airflow TaskSDK to
1.0.6+astro.7 - Upgraded several open-source provider packages. See Astro Runtime 3.0-18 provider packages.
Security fixes
- Fixed CVE-2026-54183
- Fixed CVE-2026-58076
- Fixed CVE-2026-59244
- Fixed CVE-2026-68969
- Fixed CVE-2026-68970
- Fixed GHSA-8423-8fgw-73vq
- Fixed GHSA-mpf4-983q-p7j4
- Fixed GHSA-wwv5-g3v4-889x
September 10, 2026
- Airflow version: 3.1.8
- Python versions: 3.11 - 3.12 (default: 3.12)
- Runtime image:
astrocrpublic.azurecr.io/runtime:3.1-21
Additional improvements
- Upgrade to Airflow
3.1.8+astro.8, which includes:- Do not import the stored path when rebuilding a callback from serialized data (#70704)
- Reject reserved XCom serialization keys submitted as JSON string literals (#69378, #69462)
- Resolve
backfill_idin the access dependency with the type the routes declare (#70889) - Resolve a Dag’s team when authorizing a Dag found by lookup (#70893, #71107)
- Upgrade to Apache Airflow TaskSDK to
1.1.8+astro.7 - Upgraded the minor and patch versions of some open-source provider packages. See Astro Runtime 3.1-21 provider packages.
Security fixes
- Fixed GHSA-8423-8fgw-73vq
- Fixed GHSA-mpf4-983q-p7j4
- Fixed GHSA-wwv5-g3v4-889x
- Fixed CVE-2026-54183
- Fixed CVE-2026-58076
- Fixed CVE-2026-59244
- Fixed CVE-2026-65017
- Fixed CVE-2026-68969
- Fixed CVE-2026-68970
August 31, 2026
- Airflow version: 3.3.1
- Python versions: 3.12 - 3.14 (default: 3.14)
- Runtime image:
astrocrpublic.azurecr.io/runtime:3.3-7
Additional improvements
- Upgrade to Apache Airflow TaskSDK to
1.3.1+astro.2, which includes:- Authenticate only once per task process to external secrets backends (#71756)
Security fixes
- Fixed GHSA-vxj7-4xrp-5vr4
August 31, 2026
- Airflow version: 3.2.2
- Python versions: 3.12 - 3.14 (default: 3.13)
- Runtime image:
astrocrpublic.azurecr.io/runtime:3.2-9
Additional improvements
- Upgrade to Airflow
3.2.2+astro.6, which includes:- Do not import the stored path when rebuilding a Callback from serialized data (#70704)
- Reject reserved XCom serialization keys submitted as JSON string literals (#69378, #69462)
- Resolve backfill_id in the access dependency with the type the routes declare (#70889)
- Resolve the Dag’s team when authorizing a Dag found by lookup (#70893, #71107)
- Fail task instances whose stored next_kwargs cannot be processed (#70685)
- Upgrade to Apache Airflow TaskSDK to
1.2.2+astro.5, which includes:- Authenticate only once per task process to external secrets backends (#71756)
- Upgraded the minor and patch versions of some open-source provider packages. See Astro Runtime 3.2-9 provider packages.
Security fixes
- Fixed CVE-2026-54183
- Fixed CVE-2026-58076
- Fixed CVE-2026-59244
- Fixed CVE-2026-65017
- Fixed CVE-2026-68076
- Fixed CVE-2026-68969
- Fixed CVE-2026-68970
August 26, 2026
- Airflow version: 3.3.1
- Python versions: 3.12 - 3.14 (default: 3.14)
- Runtime image:
astrocrpublic.azurecr.io/runtime:3.3-6
Additional improvements
- Upgrade to Airflow
3.3.1+astro.4, which includes: - Upgraded the minor and patch versions of some open-source provider packages. See Astro Runtime 3.3-6 provider packages.
August 26, 2026
- Airflow version: 3.0.6
- Python versions: 3.11 - 3.12 (default: 3.12)
- Runtime image:
astrocrpublic.azurecr.io/runtime:3.0-17
Additional improvements
- Upgrade to Airflow 3.0.6+astro.9
- Do not deserialize
trigger_kwargswhen loading serialized DAGs (#66002) - Remove dead AIP-44 trigger-over-BaseSerialization path (
DAT.BASE_TRIGGER) (#68528) - Remove trigger kwargs from the REST API response (#67868)
- Fix a missed redaction of variable JSON values (#67495)
- Apply per-file authorization to the
dag-sourceendpoint (#67662) - Filter scheduling-dependencies graph edges by readable-DAG access (#67627)
- Mask per-key secrets-backend-kwarg overrides on the Config API (#67622)
- Fix DAG processor callback cleanup for versioned bundle files (#66484)
- Fix a 500 error for event logs with a
NULLdttm(#68338) - Display
owner_display_namein the audit log (#68833) - Add
get_display_nameto theBaseUserinterface (#70583) - Decode
start_trigger_argskwargs when deferring, so tasks usingstart_from_triggerresume with their real kwargs
- Do not deserialize
- Upgrade to Apache Airflow TaskSDK to 1.0.6+astro.6
- Upgrade
astronomer-kubernetes-executorto10.21.0+astro.1 - Upgrade
astronomer-providers-loggingto1.6.8 - Upgraded several open-source provider packages. See Astro Runtime 3.0-17 provider packages.
Security fixes
- Fixed CVE-2026-7246
- Fixed CVE-2026-33264
- Fixed CVE-2026-49487
- Fixed CVE-2026-48892
- Fixed CVE-2026-48828
- Fixed CVE-2026-49296
- Fixed CVE-2026-48891
- Fixed GHSA-3496-9g83-7v6x
- Fixed GHSA-cq5v-8q36-5273
- Fixed GHSA-f2ff-p2ww-7p4p
- Fixed GHSA-g6cj-pr64-35w5
- Fixed GHSA-jwv3-5hgf-82ww
- Fixed GHSA-m2h6-j472-rp4c
- Fixed GHSA-mfx4-hv73-q22v
- Fixed GHSA-mq44-7p77-q5h7
- Fixed GHSA-prg7-hcfm-mfcr
- Fixed GHSA-pwgv-4x5q-6m9f
August 24, 2026
- Airflow version: 3.2.2
- Python versions: 3.12 - 3.14 (default: 3.13)
- Runtime image:
astrocrpublic.azurecr.io/runtime:3.2-8
Additional improvements
- Upgrade to Airflow
3.2.2+astro.5, which includes: - Upgrade
astronomer-kubernetes-executorto10.21.0+astro.1
Security fixes
- Fixed GHSA-3496-9g83-7v6x
- Fixed GHSA-f2ff-p2ww-7p4p
- Fixed GHSA-prg7-hcfm-mfcr
- Fixed GHSA-pwgv-4x5q-6m9f
August 24, 2026
- Airflow version: 3.1.8
- Python versions: 3.11 - 3.12 (default: 3.12)
- Runtime image:
astrocrpublic.azurecr.io/runtime:3.1-20
Additional improvements
- Upgrade to Airflow
3.1.8+astro.7, which includes:- Remove eager loading of all task instances in the scheduler, reducing scheduler memory use on large Dags (#60956)
- Determine the latest Dag version by version number rather than creation time (#68389)
- Fix a scheduler crashloop when the last task instance predates Dag versioning (#68253)
- Fix cleared tasks getting stuck when a Dag run has no version (#71696)
- Upgrade
astronomer-kubernetes-executorto10.21.0+astro.1 - Upgraded the minor and patch versions of some open-source provider packages. See Astro Runtime 3.1-20 provider packages.
Security fixes
- Fixed GHSA-3496-9g83-7v6x
- Fixed GHSA-f2ff-p2ww-7p4p
- Fixed GHSA-prg7-hcfm-mfcr
- Fixed GHSA-pwgv-4x5q-6m9f
August 22, 2026
- Airflow version: 2.11.2
- Python versions: 3.10 - 3.12 (default: 3.12)
- Runtime image:
astrocrpublic.azurecr.io/astronomer/astro-runtime:13.10.0
Additional improvements
- Upgrade to Airflow
2.11.2+astro.6which includes:- Fix Logs tab controls disappearing on long log pages #71786
- Update
airflow/wwwdependencies to clear UI CVEs
- Upgrade
apache-airflow-providers-cncf-kubernetesto10.21.0 - Update
astronomer-kubernetes-executorto10.21.0+astro.1 - Upgraded the minor and patch versions of several open-source provider packages.
Security fixes
- Fixed GHSA-4jhm-jv67-739f
- Fixed GHSA-cq5v-8q36-5273
- Fixed GHSA-mfx4-hv73-q22v
- Fixed GHSA-mq44-7p77-q5h7
- Fixed GHSA-f2ff-p2ww-7p4p
- Fixed GHSA-prg7-hcfm-mfcr
- Fixed GHSA-pwgv-4x5q-6m9f
- Fixed GHSA-3496-9g83-7v6x
- Fixed GHSA-6hr6-w5qg-qmwg
- Fixed GHSA-jwv3-5hgf-82ww
- Fixed GHSA-m2h6-j472-rp4c
- Fixed GHSA-g6cj-pr64-35w5
- Fixed PYSEC-2026-3721
August 21, 2026
- Airflow version: 3.3.1
- Python versions: 3.12 - 3.14 (default: 3.14)
- Runtime image:
astrocrpublic.azurecr.io/runtime:3.3-5