> ## Documentation Index
> Fetch the complete documentation index at: https://astronomer.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Latest Astro Runtime releases

> The 15 most recent Astro Runtime releases across all versions, in release date order. This page is the source of the Astro Runtime release notes RSS feed.

<Tip>[Subscribe to Astro Runtime release notes](/docs/astro/release-notes-subscribe) to receive updates via RSS, email, or Slack.</Tip>

This page lists the 15 most recent Astro Runtime releases across all versions, newest first. A new patch for an older version appears here as soon as it is released. For release notes grouped by version, including older releases, see [Astro Runtime release notes](/docs/runtime/runtime-release-notes).

<Update label="Astro Runtime 3.3-9" description="October 08, 2026" rss={{ date: "2026-10-08" }}>
  * Airflow version: 3.3.2
  * Python versions: 3.12 - 3.14 (default: 3.14)
  * Runtime image: `astrocrpublic.azurecr.io/runtime:3.3-9`

  ### Additional improvements

  * Upgrade to Airflow `3.3.2+astro.2`, which includes:
    * Fix backfill DagRuns being permanently starved from scheduling ([#72730](https://github.com/apache/airflow/pull/72730))
    * Fix Dag callbacks dropped when bundle versioning is disabled ([#72930](https://github.com/apache/airflow/pull/72930))
  * Upgraded the minor and patch versions of some open-source provider packages. See [Astro Runtime 3.3-9 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-3-9).

  ### Security fixes

  * Fixed [GHSA-3pq3-5fj3-cg6v](https://github.com/advisories/GHSA-3pq3-5fj3-cg6v)
  * Fixed [GHSA-2gx3-rcp4-g85q](https://github.com/advisories/GHSA-2gx3-rcp4-g85q)
  * Fixed [GHSA-42vr-xj54-vc7v](https://github.com/advisories/GHSA-42vr-xj54-vc7v)
  * Fixed [GHSA-8wjv-2p76-3863](https://github.com/advisories/GHSA-8wjv-2p76-3863)
  * Fixed [GHSA-9j54-fg26-wv3r](https://github.com/advisories/GHSA-9j54-fg26-wv3r)
  * Fixed [GHSA-9v7f-9g4p-ffgj](https://github.com/advisories/GHSA-9v7f-9g4p-ffgj)
  * Fixed [GHSA-ffc3-869f-jxw9](https://github.com/advisories/GHSA-ffc3-869f-jxw9)
  * Fixed [GHSA-gvp8-978c-rx2q](https://github.com/advisories/GHSA-gvp8-978c-rx2q)
  * Fixed [GHSA-hxm8-2xgr-2p9m](https://github.com/advisories/GHSA-hxm8-2xgr-2p9m)
  * Fixed [GHSA-jwrc-g2q2-pq5p](https://github.com/advisories/GHSA-jwrc-g2q2-pq5p)
  * Fixed [GHSA-p4g4-x82p-q773](https://github.com/advisories/GHSA-p4g4-x82p-q773)
  * Fixed [GHSA-r6x4-923q-g947](https://github.com/advisories/GHSA-r6x4-923q-g947)
  * Fixed [GHSA-w2cx-738m-mc7w](https://github.com/advisories/GHSA-w2cx-738m-mc7w)
  * Fixed [GHSA-w6j9-cwv2-h6wq](https://github.com/advisories/GHSA-w6j9-cwv2-h6wq)
  * Fixed [GHSA-8988-9cw3-xx77](https://github.com/advisories/GHSA-8988-9cw3-xx77)
  * Fixed [GHSA-gh4c-6fx4-qh6g](https://github.com/advisories/GHSA-gh4c-6fx4-qh6g)
  * Fixed [GHSA-vxq7-64xx-v4gw](https://github.com/advisories/GHSA-vxq7-64xx-v4gw)
  * Fixed [GHSA-hj66-6f7g-4r5v](https://github.com/advisories/GHSA-hj66-6f7g-4r5v)
  * Fixed [GHSA-xpv3-w29h-x7cv](https://github.com/advisories/GHSA-xpv3-w29h-x7cv)
  * Fixed [CVE-2026-102991](https://avd.aquasec.com/nvd/cve-2026-102991)
  * Fixed [CVE-2026-90467](https://avd.aquasec.com/nvd/cve-2026-90467)
  * Fixed [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204)
  * Fixed [RUSTSEC-2026-0285](https://osv.dev/vulnerability/RUSTSEC-2026-0285)
  * Fixed [GHSA-27vj-qcqg-25rc](https://github.com/advisories/GHSA-27vj-qcqg-25rc)
  * Fixed [GHSA-54p9-h82j-f925](https://github.com/advisories/GHSA-54p9-h82j-f925)
  * Fixed [CVE-2026-12345](https://avd.aquasec.com/nvd/cve-2026-12345)
  * Fixed [CVE-2026-82049](https://avd.aquasec.com/nvd/cve-2026-82049)
  * Fixed [CVE-2026-19553](https://avd.aquasec.com/nvd/cve-2026-19553)
</Update>

<Update label="Astro Runtime 3.2-11" description="October 08, 2026" rss={{ date: "2026-10-08" }}>
  * Airflow version: 3.2.2
  * Python versions: 3.12 - 3.14 (default: 3.13)
  * Runtime image: `astrocrpublic.azurecr.io/runtime:3.2-11`

  ### Additional improvements

  * Upgrade to Airflow `3.2.2+astro.7`, which includes:
    * Revoke every credential presented to the Core API logout endpoint ([#72649](https://github.com/apache/airflow/pull/72649), [#72933](https://github.com/apache/airflow/pull/72933))
    * Scope /assets/events to the Dags the caller may read ([#71741](https://github.com/apache/airflow/pull/71741), [#71785](https://github.com/apache/airflow/pull/71785))
    * Require Dag edit to delete asset queued events ([#71736](https://github.com/apache/airflow/pull/71736), [#71828](https://github.com/apache/airflow/pull/71828))
    * Resolve the caller from the explicit credential, not the session cookie ([#72225](https://github.com/apache/airflow/pull/72225), [#72723](https://github.com/apache/airflow/pull/72723))
    * Fix backfill DagRuns being permanently starved from scheduling ([#72730](https://github.com/apache/airflow/pull/72730))
  * Upgraded the minor and patch versions of some open-source provider packages. See [Astro Runtime 3.2-11 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-2-11).

  ### Security fixes

  * Fixed [CVE-2026-75157](https://avd.aquasec.com/nvd/cve-2026-75157)
  * Fixed [CVE-2026-75158](https://avd.aquasec.com/nvd/cve-2026-75158)
  * Fixed [CVE-2026-82355](https://avd.aquasec.com/nvd/cve-2026-82355)
  * Fixed [CVE-2026-86473](https://avd.aquasec.com/nvd/cve-2026-86473)
  * Fixed [CVE-2026-102991](https://avd.aquasec.com/nvd/cve-2026-102991)
  * Fixed [GHSA-2gx3-rcp4-g85q](https://github.com/advisories/GHSA-2gx3-rcp4-g85q)
  * Fixed [GHSA-2j2x-hqr9-3h42](https://github.com/advisories/GHSA-2j2x-hqr9-3h42)
  * Fixed [GHSA-337j-9hxr-rhxg](https://github.com/advisories/GHSA-337j-9hxr-rhxg)
  * Fixed [GHSA-3pq3-5fj3-cg6v](https://github.com/advisories/GHSA-3pq3-5fj3-cg6v)
  * Fixed [GHSA-42h9-826w-cgv3](https://github.com/advisories/GHSA-42h9-826w-cgv3)
  * Fixed [GHSA-42vr-xj54-vc7v](https://github.com/advisories/GHSA-42vr-xj54-vc7v)
  * Fixed [GHSA-44g4-m2mj-wpvx](https://github.com/advisories/GHSA-44g4-m2mj-wpvx)
  * Fixed [GHSA-49rj-9fvp-4h2h](https://github.com/advisories/GHSA-49rj-9fvp-4h2h)
  * Fixed [GHSA-4hqw-qxg8-jxx2](https://github.com/advisories/GHSA-4hqw-qxg8-jxx2)
  * Fixed [GHSA-542g-h47m-68v8](https://github.com/advisories/GHSA-542g-h47m-68v8)
  * Fixed [GHSA-7q8q-rj6j-mhjq](https://github.com/advisories/GHSA-7q8q-rj6j-mhjq)
  * Fixed [GHSA-84g9-w2xq-vcv6](https://github.com/advisories/GHSA-84g9-w2xq-vcv6)
  * Fixed [GHSA-8646-j5j9-6r62](https://github.com/advisories/GHSA-8646-j5j9-6r62)
  * Fixed [GHSA-8988-9cw3-xx77](https://github.com/advisories/GHSA-8988-9cw3-xx77)
  * Fixed [GHSA-8wjv-2p76-3863](https://github.com/advisories/GHSA-8wjv-2p76-3863)
  * Fixed [GHSA-8x6r-g9mw-2r78](https://github.com/advisories/GHSA-8x6r-g9mw-2r78)
  * Fixed [GHSA-9fr6-4gfg-395g](https://github.com/advisories/GHSA-9fr6-4gfg-395g)
  * Fixed [GHSA-9j54-fg26-wv3r](https://github.com/advisories/GHSA-9j54-fg26-wv3r)
  * Fixed [GHSA-9v7f-9g4p-ffgj](https://github.com/advisories/GHSA-9v7f-9g4p-ffgj)
  * Fixed [GHSA-chx6-hx7r-mcp5](https://github.com/advisories/GHSA-chx6-hx7r-mcp5)
  * Fixed [GHSA-f22v-gfqf-p8f3](https://github.com/advisories/GHSA-f22v-gfqf-p8f3)
  * Fixed [GHSA-f4gw-2p7v-4548](https://github.com/advisories/GHSA-f4gw-2p7v-4548)
  * Fixed [GHSA-ffc3-869f-jxw9](https://github.com/advisories/GHSA-ffc3-869f-jxw9)
  * Fixed [GHSA-gcfj-64vw-6mp9](https://github.com/advisories/GHSA-gcfj-64vw-6mp9)
  * Fixed [GHSA-gh4c-6fx4-qh6g](https://github.com/advisories/GHSA-gh4c-6fx4-qh6g)
  * Fixed [GHSA-gvp8-978c-rx2q](https://github.com/advisories/GHSA-gvp8-978c-rx2q)
  * Fixed [GHSA-h8fp-f39c-q6mh](https://github.com/advisories/GHSA-h8fp-f39c-q6mh)
  * Fixed [GHSA-hcpx-6fm6-wx23](https://github.com/advisories/GHSA-hcpx-6fm6-wx23)
  * Fixed [GHSA-hj66-6f7g-4r5v](https://github.com/advisories/GHSA-hj66-6f7g-4r5v)
  * Fixed [GHSA-hmw2-7cc7-3qxx](https://github.com/advisories/GHSA-hmw2-7cc7-3qxx)
  * Fixed [GHSA-hxm8-2xgr-2p9m](https://github.com/advisories/GHSA-hxm8-2xgr-2p9m)
  * Fixed [GHSA-j8rh-479h-cp32](https://github.com/advisories/GHSA-j8rh-479h-cp32)
  * Fixed [GHSA-jqh4-m9w3-8hp9](https://github.com/advisories/GHSA-jqh4-m9w3-8hp9)
  * Fixed [GHSA-jwrc-g2q2-pq5p](https://github.com/advisories/GHSA-jwrc-g2q2-pq5p)
  * Fixed [GHSA-m8m8-qj5v-23w3](https://github.com/advisories/GHSA-m8m8-qj5v-23w3)
  * Fixed [GHSA-mghh-pgcx-3jjj](https://github.com/advisories/GHSA-mghh-pgcx-3jjj)
  * Fixed [GHSA-mmx7-hfxf-jppx](https://github.com/advisories/GHSA-mmx7-hfxf-jppx)
  * Fixed [GHSA-mwf2-3pr3-8698](https://github.com/advisories/GHSA-mwf2-3pr3-8698)
  * Fixed [GHSA-p4g4-x82p-q773](https://github.com/advisories/GHSA-p4g4-x82p-q773)
  * Fixed [GHSA-pmv8-rq9r-6j72](https://github.com/advisories/GHSA-pmv8-rq9r-6j72)
  * Fixed [GHSA-qwww-vcr4-c8h2](https://github.com/advisories/GHSA-qwww-vcr4-c8h2)
  * Fixed [GHSA-r6x4-923q-g947](https://github.com/advisories/GHSA-r6x4-923q-g947)
  * Fixed [GHSA-rxv8-25v2-qmq8](https://github.com/advisories/GHSA-rxv8-25v2-qmq8)
  * Fixed [GHSA-vh66-26gq-q6x8](https://github.com/advisories/GHSA-vh66-26gq-q6x8)
  * Fixed [GHSA-vxq7-64xx-v4gw](https://github.com/advisories/GHSA-vxq7-64xx-v4gw)
  * Fixed [GHSA-w2cx-738m-mc7w](https://github.com/advisories/GHSA-w2cx-738m-mc7w)
  * Fixed [GHSA-w6j9-cwv2-h6wq](https://github.com/advisories/GHSA-w6j9-cwv2-h6wq)
  * Fixed [GHSA-wrjc-x8rr-h8h6](https://github.com/advisories/GHSA-wrjc-x8rr-h8h6)
  * Fixed [GHSA-x97p-jq2g-jp4f](https://github.com/advisories/GHSA-x97p-jq2g-jp4f)
  * Fixed [GHSA-xj6q-8x83-jv6g](https://github.com/advisories/GHSA-xj6q-8x83-jv6g)
  * Fixed [GHSA-xpv3-w29h-x7cv](https://github.com/advisories/GHSA-xpv3-w29h-x7cv)
  * Fixed [RUSTSEC-2026-0204](https://rustsec.org/advisories/RUSTSEC-2026-0204.html)
  * Fixed [RUSTSEC-2026-0285](https://rustsec.org/advisories/RUSTSEC-2026-0285.html)
  * Fixed [GHSA-27vj-qcqg-25rc](https://github.com/advisories/GHSA-27vj-qcqg-25rc)
  * Fixed [GHSA-54p9-h82j-f925](https://github.com/advisories/GHSA-54p9-h82j-f925)
  * Fixed [CVE-2026-12345](https://avd.aquasec.com/nvd/cve-2026-12345)
  * Fixed [CVE-2026-82049](https://avd.aquasec.com/nvd/cve-2026-82049)
  * Fixed [CVE-2026-19553](https://avd.aquasec.com/nvd/cve-2026-19553)
</Update>

<Update label="Astro Runtime 3.2-10" description="September 24, 2026" rss={{ date: "2026-09-24" }}>
  * Airflow version: 3.2.2
  * Python versions: 3.12 - 3.14 (default: 3.13)
  * Runtime image: `astrocrpublic.azurecr.io/runtime:3.2-10`

  ### Additional improvements

  * Upgrade to Apache Airflow TaskSDK to `1.2.2+astro.6`, which includes:
    * Allow opting into `fork+exec` task processes to avoid a fork-time deadlock ([#72164](https://github.com/apache/airflow/pull/72164))
  * Upgrade `astronomer-kubernetes-executor` to `10.22.0+astro.1`

  ### Security fixes

  * Fixed [GHSA-82r6-8w77-94w6](https://github.com/advisories/GHSA-82r6-8w77-94w6)
  * Fixed [GHSA-mpf4-983q-p7j4](https://github.com/advisories/GHSA-mpf4-983q-p7j4)
  * Fixed [GHSA-5p39-cfhj-2xmp](https://github.com/advisories/GHSA-5p39-cfhj-2xmp)
  * Fixed [GHSA-8423-8fgw-73vq](https://github.com/advisories/GHSA-8423-8fgw-73vq)
  * Fixed [GHSA-wwv5-g3v4-889x](https://github.com/advisories/GHSA-wwv5-g3v4-889x)
</Update>

<Update label="Astro Runtime 3.3-8" description="September 23, 2026" rss={{ date: "2026-09-23" }}>
  * Airflow version: 3.3.2
  * Python versions: 3.12 - 3.14 (default: 3.14)
  * Runtime image: `astrocrpublic.azurecr.io/runtime:3.3-8`

  ### Additional improvements

  * Upgrade to Airflow `3.3.2+astro.1`
  * Upgrade to Apache Airflow TaskSDK to `1.3.2+astro.1`, which includes:
    * Allow opting into `fork+exec` task processes via `execute_tasks_new_python_interpreter` ([#72164](https://github.com/apache/airflow/pull/72164))
  * Upgrade `astronomer-kubernetes-executor` to `10.22.0+astro.1`
  * Upgraded the minor and patch versions of some open-source provider packages. See [Astro Runtime 3.3-8 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-3-8).

  ### Security fixes

  * Fixed [GHSA-mpf4-983q-p7j4](https://github.com/advisories/GHSA-mpf4-983q-p7j4)
  * Fixed [GHSA-8423-8fgw-73vq](https://github.com/advisories/GHSA-8423-8fgw-73vq)
  * Fixed [GHSA-wwv5-g3v4-889x](https://github.com/advisories/GHSA-wwv5-g3v4-889x)
  * Fixed [GHSA-82r6-8w77-94w6](https://github.com/advisories/GHSA-82r6-8w77-94w6)
  * Fixed [GHSA-5p39-cfhj-2xmp](https://github.com/advisories/GHSA-5p39-cfhj-2xmp)
</Update>

<Update label="Astro Runtime 13.11.0" description="September 17, 2026" rss={{ date: "2026-09-17" }}>
  * Airflow version: 2.11.2
  * Python versions: 3.10 - 3.12 (default: 3.12)
  * Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:13.11.0`

  ### Additional improvements

  * Upgrade to Airflow `2.11.2+astro.7`
  * Upgrade `apache-airflow-providers-amazon` to `9.35.1`
  * Upgraded the minor and patch versions of several open-source provider packages.

  ### Security fixes

  * Fixed [GHSA-8423-8fgw-73vq](https://github.com/advisories/GHSA-8423-8fgw-73vq)
  * Fixed [GHSA-mpf4-983q-p7j4](https://github.com/advisories/GHSA-mpf4-983q-p7j4)
  * Fixed [GHSA-wwv5-g3v4-889x](https://github.com/advisories/GHSA-wwv5-g3v4-889x)
  * Fixed [CVE-2026-54183](https://avd.aquasec.com/nvd/cve-2026-54183)
  * Fixed [CVE-2026-58076](https://avd.aquasec.com/nvd/cve-2026-58076)
</Update>

<Update label="Astro Runtime 3.0-18" description="September 15, 2026" rss={{ date: "2026-09-15" }}>
  * Airflow version: 3.0.6
  * Python versions: 3.11 - 3.12 (default: 3.12)
  * Runtime image: `astrocrpublic.azurecr.io/runtime:3.0-18`

  ### Additional improvements

  * Upgrade to Airflow `3.0.6+astro.10`
  * Upgrade to Apache Airflow TaskSDK to `1.0.6+astro.7`
  * Upgraded several open-source provider packages. See [Astro Runtime 3.0-18 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-0-18).

  ### Security fixes

  * Fixed [CVE-2026-54183](https://avd.aquasec.com/nvd/cve-2026-54183)
  * Fixed [CVE-2026-58076](https://avd.aquasec.com/nvd/cve-2026-58076)
  * Fixed [CVE-2026-59244](https://avd.aquasec.com/nvd/cve-2026-59244)
  * Fixed [CVE-2026-68969](https://avd.aquasec.com/nvd/cve-2026-68969)
  * Fixed [CVE-2026-68970](https://avd.aquasec.com/nvd/cve-2026-68970)
  * Fixed [GHSA-8423-8fgw-73vq](https://github.com/advisories/GHSA-8423-8fgw-73vq)
  * Fixed [GHSA-mpf4-983q-p7j4](https://github.com/advisories/GHSA-mpf4-983q-p7j4)
  * Fixed [GHSA-wwv5-g3v4-889x](https://github.com/advisories/GHSA-wwv5-g3v4-889x)
</Update>

<Update label="Astro Runtime 3.1-21" description="September 10, 2026" rss={{ date: "2026-09-10" }}>
  * Airflow version: 3.1.8
  * Python versions: 3.11 - 3.12 (default: 3.12)
  * Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-21`

  ### Additional improvements

  * Upgrade to Airflow `3.1.8+astro.8`, which includes:
    * Do not import the stored path when rebuilding a callback from serialized data ([#70704](https://github.com/apache/airflow/pull/70704))
    * Reject reserved XCom serialization keys submitted as JSON string literals ([#69378](https://github.com/apache/airflow/pull/69378), [#69462](https://github.com/apache/airflow/pull/69462))
    * Resolve `backfill_id` in the access dependency with the type the routes declare ([#70889](https://github.com/apache/airflow/pull/70889))
    * Resolve a Dag's team when authorizing a Dag found by lookup ([#70893](https://github.com/apache/airflow/pull/70893), [#71107](https://github.com/apache/airflow/pull/71107))
  * Upgrade to Apache Airflow TaskSDK to `1.1.8+astro.7`
  * Upgraded the minor and patch versions of some open-source provider packages. See [Astro Runtime 3.1-21 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-1-21).

  ### Security fixes

  * Fixed [GHSA-8423-8fgw-73vq](https://github.com/advisories/GHSA-8423-8fgw-73vq)
  * Fixed [GHSA-mpf4-983q-p7j4](https://github.com/advisories/GHSA-mpf4-983q-p7j4)
  * Fixed [GHSA-wwv5-g3v4-889x](https://github.com/advisories/GHSA-wwv5-g3v4-889x)
  * Fixed [CVE-2026-54183](https://avd.aquasec.com/nvd/cve-2026-54183)
  * Fixed [CVE-2026-58076](https://avd.aquasec.com/nvd/cve-2026-58076)
  * Fixed [CVE-2026-59244](https://avd.aquasec.com/nvd/cve-2026-59244)
  * Fixed [CVE-2026-65017](https://avd.aquasec.com/nvd/cve-2026-65017)
  * Fixed [CVE-2026-68969](https://avd.aquasec.com/nvd/cve-2026-68969)
  * Fixed [CVE-2026-68970](https://avd.aquasec.com/nvd/cve-2026-68970)
</Update>

<Update label="Astro Runtime 3.3-7" description="August 31, 2026" rss={{ date: "2026-08-31" }}>
  * Airflow version: 3.3.1
  * Python versions: 3.12 - 3.14 (default: 3.14)
  * Runtime image: `astrocrpublic.azurecr.io/runtime:3.3-7`

  ### Additional improvements

  * Upgrade to Apache Airflow TaskSDK to `1.3.1+astro.2`, which includes:
    * Authenticate only once per task process to external secrets backends ([#71756](https://github.com/apache/airflow/pull/71756))

  ### Security fixes

  * Fixed [GHSA-vxj7-4xrp-5vr4](https://github.com/advisories/GHSA-vxj7-4xrp-5vr4)
</Update>

<Update label="Astro Runtime 3.2-9" description="August 31, 2026" rss={{ date: "2026-08-31" }}>
  * Airflow version: 3.2.2
  * Python versions: 3.12 - 3.14 (default: 3.13)
  * Runtime image: `astrocrpublic.azurecr.io/runtime:3.2-9`

  ### Additional improvements

  * Upgrade to Airflow `3.2.2+astro.6`, which includes:
    * Do not import the stored path when rebuilding a Callback from serialized data ([#70704](https://github.com/apache/airflow/pull/70704))
    * Reject reserved XCom serialization keys submitted as JSON string literals ([#69378](https://github.com/apache/airflow/pull/69378), [#69462](https://github.com/apache/airflow/pull/69462))
    * Resolve backfill\_id in the access dependency with the type the routes declare ([#70889](https://github.com/apache/airflow/pull/70889))
    * Resolve the Dag's team when authorizing a Dag found by lookup ([#70893](https://github.com/apache/airflow/pull/70893), [#71107](https://github.com/apache/airflow/pull/71107))
    * Fail task instances whose stored next\_kwargs cannot be processed ([#70685](https://github.com/apache/airflow/pull/70685))
  * Upgrade to Apache Airflow TaskSDK to `1.2.2+astro.5`, which includes:
    * Authenticate only once per task process to external secrets backends ([#71756](https://github.com/apache/airflow/pull/71756))
  * Upgraded the minor and patch versions of some open-source provider packages. See [Astro Runtime 3.2-9 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-2-9).

  ### Security fixes

  * Fixed [CVE-2026-54183](https://nvd.nist.gov/vuln/detail/CVE-2026-54183)
  * Fixed [CVE-2026-58076](https://nvd.nist.gov/vuln/detail/CVE-2026-58076)
  * Fixed [CVE-2026-59244](https://nvd.nist.gov/vuln/detail/CVE-2026-59244)
  * Fixed [CVE-2026-65017](https://nvd.nist.gov/vuln/detail/CVE-2026-65017)
  * Fixed [CVE-2026-68076](https://nvd.nist.gov/vuln/detail/CVE-2026-68076)
  * Fixed [CVE-2026-68969](https://nvd.nist.gov/vuln/detail/CVE-2026-68969)
  * Fixed [CVE-2026-68970](https://nvd.nist.gov/vuln/detail/CVE-2026-68970)
</Update>

<Update label="Astro Runtime 3.3-6" description="August 26, 2026" rss={{ date: "2026-08-26" }}>
  * Airflow version: 3.3.1
  * Python versions: 3.12 - 3.14 (default: 3.14)
  * Runtime image: `astrocrpublic.azurecr.io/runtime:3.3-6`

  ### Additional improvements

  * Upgrade to Airflow `3.3.1+astro.4`, which includes:
    * Display `owner_display_name` in Audit Log ([#68833](https://github.com/apache/airflow/pull/68833))
    * Add `get_display_name` to `BaseUser` interface ([#70583](https://github.com/apache/airflow/pull/70583))
    * Show user display names for triggered runs and HITL responses ([#70836](https://github.com/apache/airflow/pull/70836))
  * Upgraded the minor and patch versions of some open-source provider packages. See [Astro Runtime 3.3-6 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-3-6).
</Update>

<Update label="Astro Runtime 3.0-17" description="August 26, 2026" rss={{ date: "2026-08-26" }}>
  * Airflow version: 3.0.6
  * Python versions: 3.11 - 3.12 (default: 3.12)
  * Runtime image: `astrocrpublic.azurecr.io/runtime:3.0-17`

  ### Additional improvements

  * Upgrade to Airflow 3.0.6+astro.9
    * Do not deserialize `trigger_kwargs` when loading serialized DAGs ([#66002](https://github.com/apache/airflow/pull/66002))
    * Remove dead AIP-44 trigger-over-BaseSerialization path (`DAT.BASE_TRIGGER`) ([#68528](https://github.com/apache/airflow/pull/68528))
    * Remove trigger kwargs from the REST API response ([#67868](https://github.com/apache/airflow/pull/67868))
    * Fix a missed redaction of variable JSON values ([#67495](https://github.com/apache/airflow/pull/67495))
    * Apply per-file authorization to the `dag-source` endpoint ([#67662](https://github.com/apache/airflow/pull/67662))
    * Filter scheduling-dependencies graph edges by readable-DAG access ([#67627](https://github.com/apache/airflow/pull/67627))
    * Mask per-key secrets-backend-kwarg overrides on the Config API ([#67622](https://github.com/apache/airflow/pull/67622))
    * Fix DAG processor callback cleanup for versioned bundle files ([#66484](https://github.com/apache/airflow/pull/66484))
    * Fix a 500 error for event logs with a `NULL` `dttm` ([#68338](https://github.com/apache/airflow/pull/68338))
    * Display `owner_display_name` in the audit log ([#68833](https://github.com/apache/airflow/pull/68833))
    * Add `get_display_name` to the `BaseUser` interface ([#70583](https://github.com/apache/airflow/pull/70583))
    * Decode `start_trigger_args` kwargs when deferring, so tasks using `start_from_trigger` resume with their real kwargs
  * Upgrade to Apache Airflow TaskSDK to 1.0.6+astro.6
  * Upgrade `astronomer-kubernetes-executor` to `10.21.0+astro.1`
  * Upgrade `astronomer-providers-logging` to `1.6.8`
  * Upgraded several open-source provider packages. See [Astro Runtime 3.0-17 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-0-17).

  ### Security fixes

  * Fixed [CVE-2026-7246](https://avd.aquasec.com/nvd/cve-2026-7246)
  * Fixed [CVE-2026-33264](https://avd.aquasec.com/nvd/cve-2026-33264)
  * Fixed [CVE-2026-49487](https://avd.aquasec.com/nvd/cve-2026-49487)
  * Fixed [CVE-2026-48892](https://avd.aquasec.com/nvd/cve-2026-48892)
  * Fixed [CVE-2026-48828](https://avd.aquasec.com/nvd/cve-2026-48828)
  * Fixed [CVE-2026-49296](https://avd.aquasec.com/nvd/cve-2026-49296)
  * Fixed [CVE-2026-48891](https://avd.aquasec.com/nvd/cve-2026-48891)
  * Fixed [GHSA-3496-9g83-7v6x](https://github.com/advisories/GHSA-3496-9g83-7v6x)
  * Fixed [GHSA-cq5v-8q36-5273](https://github.com/advisories/GHSA-cq5v-8q36-5273)
  * Fixed [GHSA-f2ff-p2ww-7p4p](https://github.com/advisories/GHSA-f2ff-p2ww-7p4p)
  * Fixed [GHSA-g6cj-pr64-35w5](https://github.com/advisories/GHSA-g6cj-pr64-35w5)
  * Fixed [GHSA-jwv3-5hgf-82ww](https://github.com/advisories/GHSA-jwv3-5hgf-82ww)
  * Fixed [GHSA-m2h6-j472-rp4c](https://github.com/advisories/GHSA-m2h6-j472-rp4c)
  * Fixed [GHSA-mfx4-hv73-q22v](https://github.com/advisories/GHSA-mfx4-hv73-q22v)
  * Fixed [GHSA-mq44-7p77-q5h7](https://github.com/advisories/GHSA-mq44-7p77-q5h7)
  * Fixed [GHSA-prg7-hcfm-mfcr](https://github.com/advisories/GHSA-prg7-hcfm-mfcr)
  * Fixed [GHSA-pwgv-4x5q-6m9f](https://github.com/advisories/GHSA-pwgv-4x5q-6m9f)
</Update>

<Update label="Astro Runtime 3.2-8" description="August 24, 2026" rss={{ date: "2026-08-24" }}>
  * Airflow version: 3.2.2
  * Python versions: 3.12 - 3.14 (default: 3.13)
  * Runtime image: `astrocrpublic.azurecr.io/runtime:3.2-8`

  ### Additional improvements

  * Upgrade to Airflow `3.2.2+astro.5`, which includes:
    * Determine the latest Dag version by version number rather than creation time ([#68389](https://github.com/apache/airflow/pull/68389))
    * Fix a scheduler crashloop when the last task instance predates Dag versioning ([#68253](https://github.com/apache/airflow/pull/68253))
    * Fix cleared tasks getting stuck when a Dag run has no version ([#71696](https://github.com/apache/airflow/pull/71696))
  * Upgrade `astronomer-kubernetes-executor` to `10.21.0+astro.1`

  ### Security fixes

  * Fixed [GHSA-3496-9g83-7v6x](https://github.com/advisories/GHSA-3496-9g83-7v6x)
  * Fixed [GHSA-f2ff-p2ww-7p4p](https://github.com/advisories/GHSA-f2ff-p2ww-7p4p)
  * Fixed [GHSA-prg7-hcfm-mfcr](https://github.com/advisories/GHSA-prg7-hcfm-mfcr)
  * Fixed [GHSA-pwgv-4x5q-6m9f](https://github.com/advisories/GHSA-pwgv-4x5q-6m9f)
</Update>

<Update label="Astro Runtime 3.1-20" description="August 24, 2026" rss={{ date: "2026-08-24" }}>
  * Airflow version: 3.1.8
  * Python versions: 3.11 - 3.12 (default: 3.12)
  * Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-20`

  ### Additional improvements

  * Upgrade to Airflow `3.1.8+astro.7`, which includes:
    * Remove eager loading of all task instances in the scheduler, reducing scheduler memory use on large Dags ([#60956](https://github.com/apache/airflow/pull/60956))
    * Determine the latest Dag version by version number rather than creation time ([#68389](https://github.com/apache/airflow/pull/68389))
    * Fix a scheduler crashloop when the last task instance predates Dag versioning ([#68253](https://github.com/apache/airflow/pull/68253))
    * Fix cleared tasks getting stuck when a Dag run has no version ([#71696](https://github.com/apache/airflow/pull/71696))
  * Upgrade `astronomer-kubernetes-executor` to `10.21.0+astro.1`
  * Upgraded the minor and patch versions of some open-source provider packages. See [Astro Runtime 3.1-20 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-1-20).

  ### Security fixes

  * Fixed [GHSA-3496-9g83-7v6x](https://github.com/advisories/GHSA-3496-9g83-7v6x)
  * Fixed [GHSA-f2ff-p2ww-7p4p](https://github.com/advisories/GHSA-f2ff-p2ww-7p4p)
  * Fixed [GHSA-prg7-hcfm-mfcr](https://github.com/advisories/GHSA-prg7-hcfm-mfcr)
  * Fixed [GHSA-pwgv-4x5q-6m9f](https://github.com/advisories/GHSA-pwgv-4x5q-6m9f)
</Update>

<Update label="Astro Runtime 13.10.0" description="August 22, 2026" rss={{ date: "2026-08-22" }}>
  * Airflow version: 2.11.2
  * Python versions: 3.10 - 3.12 (default: 3.12)
  * Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:13.10.0`

  ### Additional improvements

  * Upgrade to Airflow `2.11.2+astro.6` which includes:
    * Fix Logs tab controls disappearing on long log pages [#71786](https://github.com/apache/airflow/pull/71786)
    * Update `airflow/www` dependencies to clear UI CVEs
  * Upgrade `apache-airflow-providers-cncf-kubernetes` to `10.21.0`
  * Update `astronomer-kubernetes-executor` to `10.21.0+astro.1`
  * Upgraded the minor and patch versions of several open-source provider packages.

  ### Security fixes

  * Fixed [GHSA-4jhm-jv67-739f](https://github.com/advisories/GHSA-4jhm-jv67-739f)
  * Fixed [GHSA-cq5v-8q36-5273](https://github.com/advisories/GHSA-cq5v-8q36-5273)
  * Fixed [GHSA-mfx4-hv73-q22v](https://github.com/advisories/GHSA-mfx4-hv73-q22v)
  * Fixed [GHSA-mq44-7p77-q5h7](https://github.com/advisories/GHSA-mq44-7p77-q5h7)
  * Fixed [GHSA-f2ff-p2ww-7p4p](https://github.com/advisories/GHSA-f2ff-p2ww-7p4p)
  * Fixed [GHSA-prg7-hcfm-mfcr](https://github.com/advisories/GHSA-prg7-hcfm-mfcr)
  * Fixed [GHSA-pwgv-4x5q-6m9f](https://github.com/advisories/GHSA-pwgv-4x5q-6m9f)
  * Fixed [GHSA-3496-9g83-7v6x](https://github.com/advisories/GHSA-3496-9g83-7v6x)
  * Fixed [GHSA-6hr6-w5qg-qmwg](https://github.com/advisories/GHSA-6hr6-w5qg-qmwg)
  * Fixed [GHSA-jwv3-5hgf-82ww](https://github.com/advisories/GHSA-jwv3-5hgf-82ww)
  * Fixed [GHSA-m2h6-j472-rp4c](https://github.com/advisories/GHSA-m2h6-j472-rp4c)
  * Fixed [GHSA-g6cj-pr64-35w5](https://github.com/advisories/GHSA-g6cj-pr64-35w5)
  * Fixed [PYSEC-2026-3721](https://osv.dev/vulnerability/PYSEC-2026-3721)
</Update>

<Update label="Astro Runtime 3.3-5" description="August 21, 2026" rss={{ date: "2026-08-21" }}>
  * Airflow version: 3.3.1
  * Python versions: 3.12 - 3.14 (default: 3.14)
  * Runtime image: `astrocrpublic.azurecr.io/runtime:3.3-5`

  ### Additional improvements

  * Upgrade to Airflow `3.3.1+astro.3`, which includes:
    * Bound the scheduler's deserialized Dag cache ([#71704](https://github.com/apache/airflow/pull/71704))
    * Stop the Dag processor warning on every normalized file path ([#71091](https://github.com/apache/airflow/pull/71091))
    * Fix Dag callbacks silently dropped when version inflation check blocks parsing ([#70987](https://github.com/apache/airflow/pull/70987))
</Update>