> ## Documentation Index
> Fetch the complete documentation index at: https://astronomer.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Astro Runtime release notes
[Subscribe to Astro Runtime release notes](/docs/astro/release-notes-subscribe) to receive updates via RSS, email, or Slack.
Astro Runtime is a Docker image built and published by Astronomer that extends the Apache Airflow project to provide a differentiated data orchestration experience. This document provides a summary of changes made to each available version of Astro Runtime.
To upgrade Astro Runtime, see either [Upgrade Astro Runtime](/docs/runtime/upgrade-astro-runtime) or [Upgrade Astro Private Cloud Runtime](/docs/runtime/manage-airflow-versions). For general product release notes, see [Astro Release Notes](/docs/astro/release-notes). If you have any questions or a bug to report, contact [Astronomer support](https://cloud.astronomer.io/open-support-request).
For release notes and provider package reference of Astro Runtime versions 10.x and older, see [Astro Runtime docs archive](https://github.com/astronomer/astronomer-docs-resources/tree/main/astro/runtime).
Because Astronomer has separate [maintenance life cycles](/docs/runtime/runtime-version-lifecycle-policy) for each major version of Astro Runtime, the same change can be introduced multiple times across major versions, resulting in multiple identical release notes. When a new major version releases, such as Astro Runtime 8.0.0, all changes from previously released versions are included in the new major version.
If you're upgrading to receive a specific change, ensure the release note for the change appears either:
* Within your target major version.
* In any minor or patch version that was released before the first release (`X.0.0`) of your target major version. For example, a change in Astro Runtime 9.9.0, which released January 10 2024, is not guaranteed to appear in Runtime 10.0.0, which released December 8 2023, unless there is a release note for it in a subsequent Runtime 10 patch. However, a change in Astro Runtime 9.6.0, which released November 30 2023, is guaranteed to exist in Runtime 10.0.0 because 9.6.0 was released prior to 10.0.0.
* Airflow version: 3.3.0
* Python versions: 3.12 - 3.14 (default: 3.14)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.3-2`
### Additional improvements
* Upgrade to Airflow `3.3.0+astro.2`, which includes:
* Fixed compatibility with the Astro CLI Dag integrity tests.
* Airflow version: 3.3.0
* Python versions: 3.12 - 3.14 (default: 3.14)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.3-1`
### Introducing Airflow 3.3
Astro Runtime 3.3-1 includes support for Apache Airflow 3.3, which introduces a number of significant new features and improvements, including:
* **Task & Asset State Store (AIP-103):** Durable key-value state that persists across task retries and Dag runs without an external store.
* **Language Task SDK (AIP-108):** Author individual tasks in Java or Go while keeping orchestration in Python, with native Airflow logging and XCom support.
* **Pluggable retry policies (AIP-105):** Define custom retry logic, such as conditional retries based on exception type or custom backoff strategies.
* **Expanded asset partitioning:** New partition mappers, time windows, and wait policies for controlling downstream fan-out.
* **Dag Results API:** Designate task outputs as Dag results and retrieve them through the API.
* **UI enhancements:** Asset and task state viewers, bulk actions for Dag runs, and a full-screen code viewer.
For more information about the major changes and breaking changes in this release, see the [Airflow 3.3.0 blog post](https://airflow.apache.org/blog/airflow-3.3.0/) or the [Airflow release notes](https://airflow.apache.org/docs/apache-airflow/stable/release_notes.html).
### Additional improvements
* Upgrade to Airflow `3.3.0+astro.1`.
* Upgrade to Apache Airflow TaskSDK to `1.3.0+astro.1`.
* Upgrade the default Python version to 3.14. Astro Runtime 3.3 supports Python 3.12, 3.13, and 3.14.
* Upgrade `astronomer-kubernetes-executor` to `10.19.0+astro.1`.
* Upgrade `astronomer-providers-logging` to `1.6.7`.
* Upgraded the versions of many open-source provider packages. See [Astro Runtime 3.3-1 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-3-1).
### Security fixes
* Fixed [GHSA-4xgf-cpjx-pc3j](https://github.com/advisories/GHSA-4xgf-cpjx-pc3j)
* Fixed [GHSA-2943-9672-r45w](https://github.com/advisories/GHSA-2943-9672-r45w)
* Airflow version: 3.2.2
* Python versions: 3.12 - 3.14 (default: 3.13)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.2-6`
### Additional improvements
* Upgrade to Airflow `3.2.2+astro.3`, which includes:
* Fix an OpenTelemetry metrics scheduler crash for non-ASCII Dag and task names ([#68023](https://github.com/apache/airflow/pull/68023))
* Fix a DagProcessor crash by adding a missing `name_is_otel_safe()` guard to `gauge()` and `timer()` ([#68284](https://github.com/apache/airflow/pull/68284))
* Do not deserialize `trigger_kwargs` when loading serialized Dags ([#66002](https://github.com/apache/airflow/pull/66002))
* Remove the dead AIP-44 trigger-over-`BaseSerialization` path (`DAT.BASE_TRIGGER`) ([#68528](https://github.com/apache/airflow/pull/68528))
* Remove trigger kwargs from the REST API response ([#67868](https://github.com/apache/airflow/pull/67868))
* Fix a missing redaction in a Variable JSON value ([#67495](https://github.com/apache/airflow/pull/67495))
* Apply per-file authorization to the dag-source endpoint ([#67662](https://github.com/apache/airflow/pull/67662))
* Filter scheduling-dependencies graph edges by readable-Dag access ([#67627](https://github.com/apache/airflow/pull/67627))
* Mask per-key secrets-backend-kwarg overrides on the Config API ([#67622](https://github.com/apache/airflow/pull/67622))
* Fix a crash when tailing logs of a running task instance ([#69503](https://github.com/apache/airflow/pull/69503))
* Upgrade to Apache Airflow TaskSDK to `1.2.2+astro.3`
* Upgrade `astronomer-kubernetes-executor` to `10.19.0+astro.1`
* Upgrade `astronomer-providers-logging` to `1.6.7`
* Upgrade the `kubernetes` Python client to `36.0.2` and `kubernetes_asyncio` to `36.1.0`, fixing `NO_PROXY` handling for in-cluster Kubernetes API calls
### Security fixes
* Fixed [GHSA-hg6j-4rv6-33pg](https://github.com/advisories/GHSA-hg6j-4rv6-33pg)
* Fixed [GHSA-jg22-mg44-37j8](https://github.com/advisories/GHSA-jg22-mg44-37j8)
* Fixed [GHSA-cx3h-4qpv-8hc9](https://github.com/advisories/GHSA-cx3h-4qpv-8hc9)
* Fixed [GHSA-537c-gmf6-5ccf](https://github.com/advisories/GHSA-537c-gmf6-5ccf)
* Fixed [GHSA-5rvq-cxj2-64vf](https://github.com/advisories/GHSA-5rvq-cxj2-64vf)
* Fixed [GHSA-82w8-qh3p-5jfq](https://github.com/advisories/GHSA-82w8-qh3p-5jfq)
* Fixed [GHSA-4fvr-rgm6-gqmc](https://github.com/advisories/GHSA-4fvr-rgm6-gqmc)
* Fixed [GHSA-63hw-fmq6-xxg2](https://github.com/advisories/GHSA-63hw-fmq6-xxg2)
* Fixed [GHSA-g3cq-j2xw-wf74](https://github.com/advisories/GHSA-g3cq-j2xw-wf74)
* Fixed [GHSA-hpj7-wq8m-9hgp](https://github.com/advisories/GHSA-hpj7-wq8m-9hgp)
* Fixed [GHSA-pw6j-qg29-8w7f](https://github.com/advisories/GHSA-pw6j-qg29-8w7f)
* Fixed [GHSA-xcgm-r5h9-7989](https://github.com/advisories/GHSA-xcgm-r5h9-7989)
* Fixed [GHSA-2fqr-mr3j-6wp8](https://github.com/advisories/GHSA-2fqr-mr3j-6wp8)
* Fixed [GHSA-4m7w-qmgq-4wj5](https://github.com/advisories/GHSA-4m7w-qmgq-4wj5)
* Fixed [GHSA-6jv3-5f52-599m](https://github.com/advisories/GHSA-6jv3-5f52-599m)
* Fixed [GHSA-9x8q-7h8h-wcw9](https://github.com/advisories/GHSA-9x8q-7h8h-wcw9)
* Fixed [GHSA-jp82-jpqv-5vv3](https://github.com/advisories/GHSA-jp82-jpqv-5vv3)
* Fixed [GHSA-v9pg-7xvm-68hf](https://github.com/advisories/GHSA-v9pg-7xvm-68hf)
* Fixed [GHSA-vffw-93wf-4j4q](https://github.com/advisories/GHSA-vffw-93wf-4j4q)
* Fixed [GHSA-v3q9-hj7j-63hq](https://github.com/advisories/GHSA-v3q9-hj7j-63hq)
* Fixed [CVE-2026-33264](https://nvd.nist.gov/vuln/detail/CVE-2026-33264)
* Fixed [CVE-2026-48828](https://nvd.nist.gov/vuln/detail/CVE-2026-48828)
* Fixed [CVE-2026-48891](https://nvd.nist.gov/vuln/detail/CVE-2026-48891)
* Fixed [CVE-2026-48892](https://nvd.nist.gov/vuln/detail/CVE-2026-48892)
* Fixed [CVE-2026-49296](https://nvd.nist.gov/vuln/detail/CVE-2026-49296)
* Fixed [CVE-2026-49487](https://nvd.nist.gov/vuln/detail/CVE-2026-49487)
* Fixed [PYSEC-2026-2132](https://osv.dev/vulnerability/PYSEC-2026-2132)
* Airflow version: 3.2.2
* Python versions: 3.12 - 3.14 (default: 3.13)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.2-5`
### Additional improvements
* Upgrade to Airflow `3.2.2+astro.1`, which includes:
* Add `on_kill()` hook to `BaseTrigger` to handle user actions on triggers ([#65590](https://github.com/apache/airflow/pull/65590))
* Fix dag processor callback cleanup for versioned bundle files ([#66484](https://github.com/apache/airflow/pull/66484))
* Fix `Callback.handle_event` crash on OTel metrics with `dict` tag values ([#67527](https://github.com/apache/airflow/pull/67527))
* Add a compatibility layer for import errors caused by `AirflowSecretsBackendAccessDenied` ([#67560](https://github.com/apache/airflow/pull/67560))
* Fix Graph layout for TaskGroup tasks wired to external nodes ([#67720](https://github.com/apache/airflow/pull/67720))
* Fix scheduler orphaned task reset logging crash ([#67822](https://github.com/apache/airflow/pull/67822))
* Upgrade to Apache Airflow TaskSDK to `1.2.2+astro.1`
### Security fixes
* Fixed [GHSA-2h4p-vjrc-8xpq](https://github.com/advisories/GHSA-2h4p-vjrc-8xpq)
* Fixed [GHSA-mf9v-mfxr-j63j](https://github.com/advisories/GHSA-mf9v-mfxr-j63j)
* Fixed [GHSA-qccp-gfcp-xxvc](https://github.com/advisories/GHSA-qccp-gfcp-xxvc)
* Fixed [GHSA-pp6c-gr5w-3c5g](https://github.com/advisories/GHSA-pp6c-gr5w-3c5g)
* Fixed [GHSA-65pc-fj4g-8rjx](https://github.com/advisories/GHSA-65pc-fj4g-8rjx)
* Fixed [GHSA-g3jr-4jrm-jvqv](https://github.com/advisories/GHSA-g3jr-4jrm-jvqv)
* Fixed [PYSEC-2026-24](https://osv.dev/vulnerability/PYSEC-2026-24)
* Fixed [CVE-2025-62727](https://avd.aquasec.com/nvd/cve-2025-62727)
* Fixed [GHSA-cq8v-f236-94qc](https://github.com/advisories/GHSA-cq8v-f236-94qc)
* Fixed [GHSA-fp55-jw48-c537](https://github.com/advisories/GHSA-fp55-jw48-c537)
* Fixed [GHSA-xx64-wwv2-hcqq](https://github.com/advisories/GHSA-xx64-wwv2-hcqq)
* Fixed [PYSEC-2026-175](https://osv.dev/vulnerability/PYSEC-2026-175)
* Fixed [PYSEC-2026-177](https://osv.dev/vulnerability/PYSEC-2026-177)
* Fixed [PYSEC-2026-178](https://osv.dev/vulnerability/PYSEC-2026-178)
* Fixed [PYSEC-2026-179](https://osv.dev/vulnerability/PYSEC-2026-179)
### Requires action
The `apache-airflow-providers-smtp` provider is upgraded from `2.4.5` to `3.0.1` to fix [PYSEC-2026-24](https://osv.dev/vulnerability/PYSEC-2026-24). `SmtpHook` now validates the SMTP server's certificate against the system CA bundle during STARTTLS upgrades by default. If you point `SmtpHook` at a server with a self-signed or otherwise non-validating certificate, set the `ssl_context` field in your SMTP connection's extras to `none` to keep the previous behavior.
* Airflow version: 3.2.1
* Python versions: 3.12 - 3.14 (default: 3.13)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.2-4`
### Additional improvements
* Upgrade to Airflow `3.2.1+astro.2`, which includes:
* Show the task ID attributes (`ti_id`, `task_id`, and so on) once, not on every log line ([#66036](https://github.com/apache/airflow/pull/66036))
* Don't re-emit `logical_date` when the previous `data_interval` is zero-length ([#66132](https://github.com/apache/airflow/pull/66132))
* Fix slow and incomplete trigger cleanup in the scheduler ([#66210](https://github.com/apache/airflow/pull/66210))
* Fix missing autoincrement sequence on `callback_request` downgrade ([#65230](https://github.com/apache/airflow/pull/65230))
* Fix triggerer crash when multiple triggers call sync SDK methods concurrently ([#66412](https://github.com/apache/airflow/pull/66412))
* Upgrade to Apache Airflow TaskSDK to `1.2.1+astro.2`, which includes:
* Fix triggerer crash when multiple triggers call sync SDK methods concurrently ([#66412](https://github.com/apache/airflow/pull/66412))
* Airflow version: 3.2.1
* Python versions: 3.12 - 3.14 (default: 3.13)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.2-3`
### Additional improvements
* Upgrade to Airflow `3.2.1+astro.1`
* Upgrade to Apache Airflow TaskSDK to `1.2.1+astro.1`
### Security fixes
* Fixed [GHSA-v92g-xgxw-vvmm](https://github.com/advisories/GHSA-v92g-xgxw-vvmm)
* Fixed [GHSA-965h-392x-2mh5](https://github.com/advisories/GHSA-965h-392x-2mh5)
* Fixed [GHSA-xgp8-3hg3-c2mh](https://github.com/advisories/GHSA-xgp8-3hg3-c2mh)
### Requires action
If you use custom user roles, users with read-only access to Dags can no longer view the Dag list in the Airflow UI because the endpoint now requires additional permissions. Astronomer-provided roles aren't affected. See [Upgrade considerations: Runtime 3.2-3 and later](/docs/runtime/version-upgrade-considerations#runtime-3-2-3-and-later) for details.
* Airflow version: 3.2.0
* Python versions: 3.12 - 3.14 (default: 3.13)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.2-2`
### Introducing Airflow 3.2
Astro Runtime 3.2-2 includes support for Apache Airflow 3.2, which introduces Asset partitioning for granular pipeline orchestration, synchronous deadline alert callbacks, and continued progress toward full Task SDK separation. Airflow 3.2 includes the following changes:
* Asset partitioning (AIP-76): Downstream Dags trigger only when the specific partition they depend on is updated, rather than firing on any partition change. This applies to date-partitioned S3 paths, Hive table partitions, BigQuery partitions, and other partitioned data stores. Includes `CronPartitionTimetable`, backfill support for partitioned Dags, and multi-asset partition scheduling.
* Synchronous deadline alert callbacks: Building on the deadline alerts system introduced in Airflow 3.1, this release adds synchronous callback support. `SyncCallback` executes directly on the worker through the executor, with optional targeting of a specific executor through the `executor` parameter. You can also configure multiple deadline alerts per Dag.
* Async `PythonOperator` support: `PythonOperator` now supports async callables. You can pass an async function as the `python_callable` and the operator correctly awaits it, enabling async I/O patterns without a custom operator.
* UI enhancements:
* Human-in-the-loop approval history with full audit trail
* XCom management directly from the UI (add, edit, and delete)
* Data redaction for sensitive fields in the UI and Public API
* Segmented state bars for collapsed task groups and mapped tasks
* One-click log copying, date range filters, and unified tooltips in Grid and Graph views
* Performance: Rendered task instance fields cleanup is approximately 42 times faster for Dags with many mapped tasks. Retention is now based on the N most recent Dag runs instead of N most recent task executions.
For more information about the changes in this release, see the [Airflow Blog](https://airflow.apache.org/blog/airflow-3.2.0/) or the [Airflow release notes](https://airflow.apache.org/docs/apache-airflow/3.2.0/release_notes.html).
### Additional improvements
* Fixed an issue where Astro environment manager connections were not found in Airflow.
* Upgraded to Airflow `3.2.0+astro.1`, which includes:
* Asset partitioning
* Synchronous deadline alert callbacks
* Async `PythonOperator` support
* Upgraded the RHEL UBI base image from UBI 9 to UBI 10, and changed the OS variant image tag suffix from `-ubi9` to `-ubi`. For more information, see [Operating system variant images](https://www.astronomer.io/docs/astro/runtime-image-architecture#operating-system-variant-images).
* Upgraded the versions of many open-source provider packages. See [Astro Runtime 3.2-2 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-2-2).
### Security fixes
* Fixed [GHSA-mj87-hwqh-73pj](https://github.com/advisories/GHSA-mj87-hwqh-73pj)
* Airflow version: 3.2.0
* Python versions: 3.12 - 3.14 (default: 3.13)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.2-1`
**Restricted release**
Astro Runtime 3.2-1 was restricted from use on April 16, 2026, after its initial release because of an issue where environment manager connections are not found. See [Restricted Runtime versions](/docs/runtime/runtime-version-lifecycle-policy#restricted-runtime-versions).
* Airflow version: 3.1.8
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-18`
### Additional improvements
* Upgrade to Airflow 3.1.8+astro.5
* Do not deserialize `trigger_kwargs` when loading serialized DAGs ([#66002](https://github.com/apache/airflow/pull/66002))
* Remove dead AIP-44 `trigger-over-BaseSerialization` path (`DAT.BASE_TRIGGER`) ([#68528](https://github.com/apache/airflow/pull/68528))
* Remove trigger kwargs from the REST API response ([#67868](https://github.com/apache/airflow/pull/67868))
* Fix the miss redact in variable Json value ([#67495](https://github.com/apache/airflow/pull/67495))
* Apply per-file authorization to `dag-source` endpoint ([#67662](https://github.com/apache/airflow/pull/67662))
* Filter scheduling-dependencies graph edges by readable-DAG access ([#67627](https://github.com/apache/airflow/pull/67627))
* Mask per-key secrets-backend-kwarg overrides on the Config API ([#67622](https://github.com/apache/airflow/pull/67622))
* Fix DAG processor callback cleanup for versioned bundle files ([#66484](https://github.com/apache/airflow/pull/66484))
* Reduce API server memory usage by eliminating `SerializedDAG` loads on task start ([#60803](https://github.com/apache/airflow/pull/60803))
* Add configurable LRU+TTL caching for API server DAG retrieval ([#60804](https://github.com/apache/airflow/pull/60804))
* Respect dag processor config option to show parsing logs on stdout ([#65528](https://github.com/apache/airflow/pull/65528))
* Fix duplicate deadline callbacks with HA scheduler replicas ([#64737](https://github.com/apache/airflow/pull/64737))
* Fix `run on latest version` not applied on task clear ([#65835](https://github.com/apache/airflow/pull/65835), [#68336](https://github.com/apache/airflow/pull/68336))
* Upgrade to Apache Airflow TaskSDK to 1.1.8+astro.5
* Upgrade `astronomer-kubernetes-executor` to `10.19.0+astro.1`
* Upgrade `astronomer-providers-logging` to `1.6.8`
* Upgraded several open-source provider packages. See [Astro Runtime 3.1-18 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-1-18).
### Security fixes
* Fixed [GHSA-2fqr-mr3j-6wp8](https://github.com/advisories/GHSA-2fqr-mr3j-6wp8)
* Fixed [GHSA-4fvr-rgm6-gqmc](https://github.com/advisories/GHSA-4fvr-rgm6-gqmc)
* Fixed [GHSA-4m7w-qmgq-4wj5](https://github.com/advisories/GHSA-4m7w-qmgq-4wj5)
* Fixed [GHSA-63hw-fmq6-xxg2](https://github.com/advisories/GHSA-63hw-fmq6-xxg2)
* Fixed [GHSA-9x8q-7h8h-wcw9](https://github.com/advisories/GHSA-9x8q-7h8h-wcw9)
* Fixed [GHSA-g3cq-j2xw-wf74](https://github.com/advisories/GHSA-g3cq-j2xw-wf74)
* Fixed [GHSA-xcgm-r5h9-7989](https://github.com/advisories/GHSA-xcgm-r5h9-7989)
* Fixed [GHSA-hpj7-wq8m-9hgp](https://github.com/advisories/GHSA-hpj7-wq8m-9hgp)
* Fixed [GHSA-3x9g-8vmp-wqvf](https://github.com/advisories/GHSA-3x9g-8vmp-wqvf)
* Fixed [GHSA-mgf9-4vpg-hj56](https://github.com/advisories/GHSA-mgf9-4vpg-hj56)
* Fixed [GHSA-pw6j-qg29-8w7f](https://github.com/advisories/GHSA-pw6j-qg29-8w7f)
* Fixed [GHSA-cx3h-4qpv-8hc9](https://github.com/advisories/GHSA-cx3h-4qpv-8hc9)
* Fixed [GHSA-537c-gmf6-5ccf](https://github.com/advisories/GHSA-537c-gmf6-5ccf)
* Fixed [GHSA-5rvq-cxj2-64vf](https://github.com/advisories/GHSA-5rvq-cxj2-64vf)
* Fixed [GHSA-6jv3-5f52-599m](https://github.com/advisories/GHSA-6jv3-5f52-599m)
* Fixed [GHSA-v9pg-7xvm-68hf](https://github.com/advisories/GHSA-v9pg-7xvm-68hf)
* Fixed [GHSA-vffw-93wf-4j4q](https://github.com/advisories/GHSA-vffw-93wf-4j4q)
* Fixed [GHSA-v3q9-hj7j-63hq](https://github.com/advisories/GHSA-v3q9-hj7j-63hq)
* Fixed [CVE-2026-7246](https://avd.aquasec.com/nvd/cve-2026-7246)
* Fixed [CVE-2026-33264](https://avd.aquasec.com/nvd/cve-2026-33264)
* Fixed [CVE-2026-49487](https://avd.aquasec.com/nvd/cve-2026-49487)
* Fixed [CVE-2026-48892](https://avd.aquasec.com/nvd/cve-2026-48892)
* Fixed [CVE-2026-48828](https://avd.aquasec.com/nvd/cve-2026-48828)
* Fixed [CVE-2026-49296](https://avd.aquasec.com/nvd/cve-2026-49296)
* Fixed [CVE-2026-48891](https://avd.aquasec.com/nvd/cve-2026-48891)
* Airflow version: 3.1.8
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-17`
### Additional improvements
* Upgrade to Airflow 3.1.8+astro.4
* Fix OTel metrics scheduler crash for non-ASCII DAG/task names ([#68023](https://github.com/apache/airflow/pull/68023))
* Add missing `name_is_otel_safe()` guard to `gauge()` and `timer()` ([#68284](https://github.com/apache/airflow/pull/68284))
* Upgrade to Apache Airflow TaskSDK to 1.1.8+astro.4
* Upgrade `astronomer-providers-logging` to `1.6.6`
* Airflow version: 3.1.8
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-16`
### Additional improvements
* Upgrade to Airflow 3.1.8+astro.3
* Apply per-DAG audit log permission to event log detail endpoint ([#67112](https://github.com/apache/airflow/pull/67112))
* Set JWT refresh cookie Secure flag when request is HTTPS ([#65348](https://github.com/apache/airflow/pull/65348))
* Refuse to follow log symlinks that resolve outside the base log folder ([#65325](https://github.com/apache/airflow/pull/65325))
* Validate SMTP server certificate on `STARTTLS` upgrade ([#65346](https://github.com/apache/airflow/pull/65346))
* Update the `is_url_safe` method to reject URLs with `///` ([#65557](https://github.com/apache/airflow/pull/65557))
* Filter external dependency nodes by readable DAGs in `structure_data` endpoint ([#65342](https://github.com/apache/airflow/pull/65342))
* Check sensitive key names before applying recursion-depth cutoff in secrets masker ([#65912](https://github.com/apache/airflow/pull/65912))
* Extend `DEFAULT_SENSITIVE_FIELDS` with common credential field names ([#66673](https://github.com/apache/airflow/pull/66673))
* Fix log server path extraction to use `removeprefix` ([#66749](https://github.com/apache/airflow/pull/66749))
* Upgrade to Apache Airflow TaskSDK to 1.1.8+astro.3
* Upgrade `astronomer-kubernetes-executor` to `10.17.1+astro.1`
* Upgrade `astronomer-providers-logging` to `1.6.5`
* Upgraded several open-source provider packages. See [Astro Runtime 3.1-16 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-1-16).
### Security fixes
* Fixed [CVE-2026-49298](https://avd.aquasec.com/nvd/cve-2026-49298)
* Fixed [GHSA-xgmm-8j9v-c9wx](https://github.com/advisories/GHSA-xgmm-8j9v-c9wx)
* Fixed [GHSA-w7vc-732c-9m39](https://github.com/advisories/GHSA-w7vc-732c-9m39)
* Fixed [GHSA-fhv5-28vv-h8m8](https://github.com/advisories/GHSA-fhv5-28vv-h8m8)
* Fixed [GHSA-jq35-7prp-9v3f](https://github.com/advisories/GHSA-jq35-7prp-9v3f)
* Fixed [GHSA-993g-76c3-p5m4](https://github.com/advisories/GHSA-993g-76c3-p5m4)
* Fixed [GHSA-65pc-fj4g-8rjx](https://github.com/advisories/GHSA-65pc-fj4g-8rjx)
* Fixed [GHSA-hg6j-4rv6-33pg](https://github.com/advisories/GHSA-hg6j-4rv6-33pg)
* Fixed [GHSA-jg22-mg44-37j8](https://github.com/advisories/GHSA-jg22-mg44-37j8)
* Fixed [GHSA-4gg8-gxpx-9rph](https://github.com/advisories/GHSA-4gg8-gxpx-9rph)
* Fixed [GHSA-3cv2-h65g-fgmm](https://github.com/advisories/GHSA-3cv2-h65g-fgmm)
* Fixed [GHSA-3pv8-6f4r-ffg2](https://github.com/advisories/GHSA-3pv8-6f4r-ffg2)
### Requires action
The `apache-airflow-providers-smtp` provider is upgraded from `2.4.5` to `3.0.1`, a major version upgrade. `SmtpHook` now validates the SMTP server's certificate against the system CA bundle during STARTTLS upgrades by default. If you point `SmtpHook` at a server with a self-signed or otherwise non-validating certificate, set the `ssl_context` field in your SMTP connection's extras to `none` to keep the previous behavior.
* Airflow version: 3.1.8
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-15`
### Additional improvements
* Upgrade to Airflow 3.1.8+astro.2
* Refactor xcom API to use shared serialisation constants ([#64148](https://github.com/apache/airflow/pull/64148))
* Fix task-level audit logs missing success/running events in Airflow 3.1.x ([#58655](https://github.com/apache/airflow/pull/58655))
* Don't crash the scheduler on a stray ADRQ ([#61932](https://github.com/apache/airflow/pull/61932))
* Fix: use Dag form when materializing asset ([#64211](https://github.com/apache/airflow/pull/64211))
* Improve xcom value handling in extra links API ([#61641](https://github.com/apache/airflow/pull/61641))
* Updates exception to hide sql statements on constraint failure ([#63028](https://github.com/apache/airflow/pull/63028))
* Add check for xcom permission when result is specified in DagRun wait API ([#64415](https://github.com/apache/airflow/pull/64415))
* Use default max depth to redact Variable ([#63480](https://github.com/apache/airflow/pull/63480))
* Fix: add RUN, `HITL_DETAIL`, `TASK_INSTANCE` entities to /dags endpoint as it returns nested entities in response ([#64822](https://github.com/apache/airflow/pull/64822))
* Add additional permission check in asset materialization ([#63338](https://github.com/apache/airflow/pull/63338))
* Don't re-emit `logical_date` when previous `data_interval` is zero-length ([#66132](https://github.com/apache/airflow/pull/66132))
* Show the task ID attributes (`ti_id`, `task_id`, etc.) once, not on every log line ([#66036](https://github.com/apache/airflow/pull/66036))
* Fix slow and incomplete trigger cleanup in scheduler ([#66210](https://github.com/apache/airflow/pull/66210))
* Fix triggerer crash when multiple triggers call sync SDK methods concurrently ([#66412](https://github.com/apache/airflow/pull/66412))
* Fix scheduler callback `bundle_version` when versioning disabled ([#66485](https://github.com/apache/airflow/pull/66485))
* Upgrade to Apache Airflow TaskSDK to 1.1.8+astro.2
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 3.1-15 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-1-15).
### Requires action
If you use custom user roles, users with read-only access to Dags can no longer view the Dag list in the Airflow UI because the endpoint now requires additional permissions. Astronomer-provided roles aren't affected. See [Upgrade considerations: Runtime 3.1-15 and later](/docs/runtime/version-upgrade-considerations#runtime-3-1-15-and-later) for details.
### Security fixes
* Fixed [GHSA-mj87-hwqh-73pj](https://github.com/advisories/GHSA-mj87-hwqh-73pj)
* Fixed [GHSA-mf9w-mj56-hr94](https://github.com/advisories/GHSA-mf9w-mj56-hr94)
* Fixed [GHSA-v92g-xgxw-vvmm](https://github.com/advisories/GHSA-v92g-xgxw-vvmm)
* Fixed [GHSA-2h4p-vjrc-8xpq](https://github.com/advisories/GHSA-2h4p-vjrc-8xpq)
* Fixed [GHSA-pp6c-gr5w-3c5g](https://github.com/advisories/GHSA-pp6c-gr5w-3c5g)
* Fixed [GHSA-mf9v-mfxr-j63j](https://github.com/advisories/GHSA-mf9v-mfxr-j63j)
* Fixed [GHSA-qccp-gfcp-xxvc](https://github.com/advisories/GHSA-qccp-gfcp-xxvc)
* Airflow version: 3.1.8
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-14`
### Additional improvements
* Upgrade to Airflow 3.1.8+astro.1
* Filter on `dag_id` when querying `task_instance` (#63291) ([#63291](https://github.com/apache/airflow/pull/63291))
* Fix: redact JWT token from worker logs for kubernetes executor ([#62964](https://github.com/apache/airflow/pull/62964))
* Upgrade to Apache Airflow TaskSDK to 1.1.8+astro.1
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 3.1-14 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-1-14).
### Security fixes
* Fixed [CVE-2026-32597](https://avd.aquasec.com/nvd/cve-2026-32597)
* Fixed [CVE-2026-31958](https://avd.aquasec.com/nvd/cve-2026-31958)
* Fixed [GHSA-78cv-mqj4-43f7](https://github.com/advisories/GHSA-78cv-mqj4-43f7)
* Fixed [CVE-2026-30922](https://avd.aquasec.com/nvd/cve-2026-30922)
* Airflow version: 3.1.7
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-13`
### Additional improvements
* Upgraded to Airflow `3.1.7+astro.2`
* Deprecate `BackfillDetails` and use `DagAcccessEntity.Run` for backfill ([#61400](https://github.com/apache/airflow/pull/61400))
* Fix list Dag versions permissions ([#61733](https://github.com/apache/airflow/pull/61733))
* Add gunicorn support for API server with rolling worker restarts ([#60940](https://github.com/apache/airflow/pull/60940))
* Remove explicit background color from filter buttons to fix pale appearance([#61457](https://github.com/apache/airflow/pull/61457))
* Fix secrets masking in Rendered Templates for complex objects ([#61763](https://github.com/apache/airflow/pull/61763))
* Upgraded Apache Airflow TaskSDK to `1.1.7+astro.2`
* Make `conn_type` optional in task SDK Connection datamodel ([#61728](https://github.com/apache/airflow/pull/61728))
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 3.1-13 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-1-13).
* Airflow version: 3.1.7
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-12`
### Additional improvements
* Upgraded to Airflow `3.1.7+astro.1`
* Flatten grid structure endpoint memory consumption ([#61393](https://github.com/apache/airflow/pull/61393))
* Upgraded Apache Airflow TaskSDK to `1.1.7+astro.1`
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 3.1-12 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-1-12).
### Security fixes
* Fixed [CVE-2026-0994](https://avd.aquasec.com/nvd/2026/cve-2026-0994)
* Fixed [CVE-2026-1703](https://avd.aquasec.com/nvd/2026/cve-2026-1703)
* Airflow version: 3.1.6
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-11`
### Additional improvements
* Upgrade to Airflow `3.1.6+astro.2`
* Avoid loading all `TaskInstances` when checking `DagVersion` in `write_dag` to fix DAG processor OOM.([#60962](https://github.com/apache/airflow/pull/60962))
* Fix unnecessary DAG version churn when DAG file paths change ([#60799](https://github.com/apache/airflow/pull/60799))
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 3.1-11 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-1-11).
### Security fixes
* Fixed [CVE-2026-23490](https://avd.aquasec.com/nvd/2026/cve-2026-23490)
* Airflow version: 3.1.6
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-10`
### Additional improvements
* Upgraded to Airflow `3.1.6+astro.1`, which includes:
* Bug fixes
* Upgraded Apache Airflow TaskSDK to `1.1.6+astro.1`
### Security fixes
* Fixed [CVE-2026-21441](https://avd.aquasec.com/nvd/CVE-2026-21441)
* Airflow version: 3.1.5
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-9`
### Additional improvements
* Upgraded to Airflow `3.1.5+astro.1`, which includes:
* Bug fixes
* Upgraded Apache Airflow TaskSDK to `1.1.5+astro.1`
* Airflow version: 3.1.4
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-8`
**Restricted release**
Astro Runtime 3.1-8 was restricted from use on December 16, 2025, after its initial release because the Airflow version it is based on, Apache Airflow 3.1.4, was yanked from the OSS Airflow project.
* Airflow version: 3.1.3
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-7`
### Additional improvements
* Upgraded to Airflow `3.1.3+astro.2`, which includes:
* Fix TypeError in `parseStreamingLogContent` for non-string data ([#58314](https://github.com/apache/airflow/pull/58314))
* Airflow version: 3.1.3
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-6`
### Additional improvements
* Upgrade to Apache Airflow TaskSDK to `1.1.3+astro.2`
* Redact secrets in rendered templates properly to not expose them on UI ([#58767](https://github.com/apache/airflow/pull/58767))
* Mask secrets properly when using deprecated import path ([#58662](https://github.com/apache/airflow/pull/58662))
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 3.1-6 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-1-6).
* Enforce `SQLAlchemy==1.4.54`, even when users extend the image
* Airflow version: 3.1.3
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-5`
### Additional improvements
* Upgraded to Airflow `3.1.3+astro.1`, which includes:
* Bug fixes
* Fix atomicity issue in `SerializedDagModel.write_dag` preventing orphaned DagVersions ([#58281](https://github.com/apache/airflow/pull/58281))
* Upgraded to Apache Airflow TaskSDK to `1.1.3+astro.1`
* Airflow version: 3.1.2
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-4`
### Additional improvements
* Upgraded to Airflow `3.1.2+astro.1`, which includes:
* Bug fixes
* Ensure that DB migrations handles all kinds of NaN values in historical xcoms ([#57893](https://github.com/apache/airflow/pull/57893))
* Revert "Fix text selection jumping in logs pane to match text editor behavior (#57309)" ([#57874](https://github.com/apache/airflow/pull/57874))
* Upgraded to Apache Airflow TaskSDK to `1.1.2+astro.1`
* Ensure task in the context is always correct ([#57892](https://github.com/apache/airflow/pull/57892))
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 3.1-4 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-1-4).
### Security fixes
* Fixed [GHSA-pqhf-p39g-3x64](https://github.com/advisories/GHSA-pqhf-p39g-3x64)
* Airflow version: 3.1.1
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-3`
### Additional improvements
* Upgraded to Airflow `3.1.1+astro.1`, which includes:
* Bug fixes
* Fix memory leak in Client via SSL context creation ([#57334](https://github.com/apache/airflow/pull/57334))
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 3.1-3 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-1-3).
### Security fixes
* Fixed [CVE-2025-62611](https://nvd.nist.gov/vuln/detail/CVE-2025-62611)
* Airflow version: 3.1.0
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-2`
**Known Issue**
This version of Runtime has a significant memory leak for Celery Workers. Astronomer recommends upgrading directly to Runtime 3.1-3 or switching to Astro Executor.
### Additional improvements
* Upgraded to Airflow `3.1.0+astro.2`, which includes:
* Fix scheduler crash with email notifications ([#56429](https://github.com/apache/airflow/pull/56429))
* Emit log stream stopped warning as ndjson ([#56474](https://github.com/apache/airflow/pull/56474))
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 3.1-2 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-1-2).
* Airflow version: 3.1.0
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.1-1`
**Known Issue**
This version of Runtime has a significant memory leak for Celery Workers. Astronomer recommends upgrading directly to Runtime 3.1-3 or switching to Astro Executor.
### Introducing Airflow 3.1
Astro Runtime 3.1-1 includes support for Apache Airflow 3.1, which includes a number of new features and improvements. Airflow 3.1 includes the following changes:
* Human-in-the-loop: Bridge between fully automated processes and human expertise
* Many UI enhancements:
* Internationalization with 17 supported languages
* Calendar and gantt views
* Robust plugin support
* Deadline alerts
For more information about the major changes in this release, see the [Airflow Blog](https://airflow.apache.org/blog/airflow-3.1.0/) or the [Airflow release notes](https://airflow.apache.org/docs/apache-airflow/stable/release_notes.html#airflow-3-1-0-2025-09-25).
### Additional improvements
* Upgraded to Airflow `3.1.0+astro.1`, which includes:
* New features and improvements in Airflow 3.1.0
* Enhanced performance and stability
* Bug fixes
* Upgraded the versions of many open-source provider packages. See [Astro Runtime 3.1-1 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-1-1).
### Behavior change
This Runtime version introduces a new default behavior that could cause breaks depending on your configurations.
* The Astro Runtime no longer installs Apache Airflow MySQL and PostgreSQL providers by default. If you need these providers, you must install them explicitly. See [Add Airflow providers, Python packages, and operating system packages](/docs/cli/v1.43/add-providers-packages) for how to add Airflow providers to your Astro project.
* Airflow version: 3.0.6
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.0-16`
### Additional improvements
* Upgrade to Airflow 3.0.6+astro.7
* Apply per-DAG audit log permission to event log detail endpoint ([#67112](https://github.com/apache/airflow/pull/67112))
* Refuse to follow log symlinks that resolve outside the base log folder ([#65325](https://github.com/apache/airflow/pull/65325))
* Validate SMTP server certificate on `STARTTLS` upgrade ([#65346](https://github.com/apache/airflow/pull/65346))
* Update the `is_url_safe` method to reject URLs with `///` ([#65557](https://github.com/apache/airflow/pull/65557))
* Filter external dependency nodes by readable DAGs in `structure_data` endpoint ([#65342](https://github.com/apache/airflow/pull/65342))
* Check sensitive key names before applying `recursion-depth` cutoff in secrets masker ([#65912](https://github.com/apache/airflow/pull/65912))
* Extend `DEFAULT_SENSITIVE_FIELDS` with common credential field names ([#66673](https://github.com/apache/airflow/pull/66673))
* Fix OTel metrics scheduler crash for non-ASCII DAG/task names ([#68023](https://github.com/apache/airflow/pull/68023))
* Add missing `name_is_otel_safe()` guard to `gauge()` and `timer()` ([#68284](https://github.com/apache/airflow/pull/68284))
* Remove Airflow 2 code path in executors ([#51009](https://github.com/apache/airflow/pull/51009))
* Upgrade to Apache Airflow TaskSDK to 1.0.6+astro.5
* Upgrade `astronomer-kubernetes-executor` to `10.18.0+astro.1`
* Upgrade `astronomer-providers-logging` to `1.6.6`
* Upgraded several open-source provider packages. See [Astro Runtime 3.0-16 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-0-16).
### Security fixes
* Fixed [CVE-2026-49298](https://avd.aquasec.com/nvd/cve-2026-49298)
* Fixed [GHSA-xgmm-8j9v-c9wx](https://github.com/advisories/GHSA-xgmm-8j9v-c9wx)
* Fixed [GHSA-w7vc-732c-9m39](https://github.com/advisories/GHSA-w7vc-732c-9m39)
* Fixed [GHSA-fhv5-28vv-h8m8](https://github.com/advisories/GHSA-fhv5-28vv-h8m8)
* Fixed [GHSA-jq35-7prp-9v3f](https://github.com/advisories/GHSA-jq35-7prp-9v3f)
* Fixed [GHSA-993g-76c3-p5m4](https://github.com/advisories/GHSA-993g-76c3-p5m4)
* Fixed [GHSA-65pc-fj4g-8rjx](https://github.com/advisories/GHSA-65pc-fj4g-8rjx)
* Fixed [GHSA-hg6j-4rv6-33pg](https://github.com/advisories/GHSA-hg6j-4rv6-33pg)
* Fixed [GHSA-jg22-mg44-37j8](https://github.com/advisories/GHSA-jg22-mg44-37j8)
* Fixed [GHSA-4gg8-gxpx-9rph](https://github.com/advisories/GHSA-4gg8-gxpx-9rph)
* Fixed [GHSA-3cv2-h65g-fgmm](https://github.com/advisories/GHSA-3cv2-h65g-fgmm)
* Fixed [GHSA-3pv8-6f4r-ffg2](https://github.com/advisories/GHSA-3pv8-6f4r-ffg2)
* Fixed [GHSA-cx3h-4qpv-8hc9](https://github.com/advisories/GHSA-cx3h-4qpv-8hc9)
* Fixed [GHSA-537c-gmf6-5ccf](https://github.com/advisories/GHSA-537c-gmf6-5ccf)
* Fixed [GHSA-5rvq-cxj2-64vf](https://github.com/advisories/GHSA-5rvq-cxj2-64vf)
* Fixed [GHSA-4fvr-rgm6-gqmc](https://github.com/advisories/GHSA-4fvr-rgm6-gqmc)
* Fixed [GHSA-63hw-fmq6-xxg2](https://github.com/advisories/GHSA-63hw-fmq6-xxg2)
* Fixed [GHSA-g3cq-j2xw-wf74](https://github.com/advisories/GHSA-g3cq-j2xw-wf74)
* Fixed [GHSA-hpj7-wq8m-9hgp](https://github.com/advisories/GHSA-hpj7-wq8m-9hgp)
* Fixed [GHSA-pw6j-qg29-8w7f](https://github.com/advisories/GHSA-pw6j-qg29-8w7f)
* Fixed [GHSA-xcgm-r5h9-7989](https://github.com/advisories/GHSA-xcgm-r5h9-7989)
* Fixed [GHSA-2fqr-mr3j-6wp8](https://github.com/advisories/GHSA-2fqr-mr3j-6wp8)
* Fixed [GHSA-4m7w-qmgq-4wj5](https://github.com/advisories/GHSA-4m7w-qmgq-4wj5)
* Fixed [GHSA-6jv3-5f52-599m](https://github.com/advisories/GHSA-6jv3-5f52-599m)
* Fixed [GHSA-9x8q-7h8h-wcw9](https://github.com/advisories/GHSA-9x8q-7h8h-wcw9)
* Fixed [GHSA-v9pg-7xvm-68hf](https://github.com/advisories/GHSA-v9pg-7xvm-68hf)
* Fixed [GHSA-vffw-93wf-4j4q](https://github.com/advisories/GHSA-vffw-93wf-4j4q)
### Requires action
The `apache-airflow-providers-smtp` provider is upgraded from `2.4.2` to `3.0.1`, a major version upgrade. `SmtpHook` now validates the SMTP server's certificate against the system CA bundle during STARTTLS upgrades by default. If you point `SmtpHook` at a server with a self-signed or otherwise non-validating certificate, set the `ssl_context` field in your SMTP connection's extras to `none` to keep the previous behavior.
* Airflow version: 3.0.6
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.0-15`
### Additional improvements
* Upgrade to Airflow 3.0.6+astro.6
* Add additional permission check in asset materialization ([#63338](https://github.com/apache/airflow/pull/63338))
* Use default max depth to redact Variable ([#63480](https://github.com/apache/airflow/pull/63480))
* Updates exception to hide sql statements on constraint failure ([#63028](https://github.com/apache/airflow/pull/63028))
* Improve xcom value handling in extra links API ([#61641](https://github.com/apache/airflow/pull/61641))
* Exclude JWT token from workload repr to prevent log exposure ([#62964](https://github.com/apache/airflow/pull/62964))
* Add `access_key` and `connection_string` to `DEFAULT_SENSITIVE_FIELDS` ([#61580](https://github.com/apache/airflow/pull/61580))
* Add readable dags checks for the dependencies endpoint ([#62046](https://github.com/apache/airflow/pull/62046))
* Fix list dag versions permissions ([#61675](https://github.com/apache/airflow/pull/61675))
* Fix invalid TypeVar inside Redactable constraints in `secrets_masker`
* Add `proxy` and `proxies` to `DEFAULT_SENSITIVE_FIELDS` ([#59688](https://github.com/apache/airflow/pull/59688))
* Don't re-emit `logical_date` when previous `data_interval` is zero-length ([#66132](https://github.com/apache/airflow/pull/66132))
* Fix scheduler callback `bundle_version` when versioning disabled ([#66485](https://github.com/apache/airflow/pull/66485))
* Ensure JWTValidator handles GUESS algorithm with JWKS ([#63115](https://github.com/apache/airflow/pull/63115))
* Fix JWT token generation with unset issuer/audience config ([#61278](https://github.com/apache/airflow/pull/61278))
* Upgrade to Apache Airflow TaskSDK to 1.0.6+astro.4
### Security fixes
* Fixed [GHSA-2h4p-vjrc-8xpq](https://github.com/advisories/GHSA-2h4p-vjrc-8xpq)
* Fixed [GHSA-jr27-m4p2-rc6r](https://github.com/advisories/GHSA-jr27-m4p2-rc6r)
* Fixed [GHSA-27jp-wm6q-gp25](https://github.com/advisories/GHSA-27jp-wm6q-gp25)
* Fixed [GHSA-29vq-49wr-vm6x](https://github.com/advisories/GHSA-29vq-49wr-vm6x)
* Fixed [GHSA-6w46-j5rx-g56g](https://github.com/advisories/GHSA-6w46-j5rx-g56g)
* Fixed [GHSA-gc5v-m9x4-r6x2](https://github.com/advisories/GHSA-gc5v-m9x4-r6x2)
* Fixed [GHSA-mf9w-mj56-hr94](https://github.com/advisories/GHSA-mf9w-mj56-hr94)
* Fixed [GHSA-v92g-xgxw-vvmm](https://github.com/advisories/GHSA-v92g-xgxw-vvmm)
* Fixed [GHSA-5239-wwwm-4pmq](https://github.com/advisories/GHSA-5239-wwwm-4pmq)
* Fixed [GHSA-pjjw-68hj-v9mw](https://github.com/advisories/GHSA-pjjw-68hj-v9mw)
* Fixed [GHSA-6vgw-5pg2-w6jp](https://github.com/advisories/GHSA-6vgw-5pg2-w6jp)
* Fixed [GHSA-752w-5fwx-jx9f](https://github.com/advisories/GHSA-752w-5fwx-jx9f)
* Fixed [GHSA-pp6c-gr5w-3c5g](https://github.com/advisories/GHSA-pp6c-gr5w-3c5g)
* Fixed [GHSA-wp53-j4wj-2cfg](https://github.com/advisories/GHSA-wp53-j4wj-2cfg)
* Fixed [GHSA-mj87-hwqh-73pj](https://github.com/advisories/GHSA-mj87-hwqh-73pj)
* Fixed [GHSA-mf9v-mfxr-j63j](https://github.com/advisories/GHSA-mf9v-mfxr-j63j)
* Fixed [GHSA-qccp-gfcp-xxvc](https://github.com/advisories/GHSA-qccp-gfcp-xxvc)
* Airflow version: 3.0.6
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.0-14`
### Additional improvements
* Upgrade to Airflow `3.0.6+astro.5`
* Eager-load `DagRun` asset relationships before creating `DagRunContext` ([#59714](https://github.com/apache/airflow/pull/59714))
* Avoid loading all `TaskInstances` when checking `DagVersion` in `write_dag` to fix DAG processor OOM.([#60962](https://github.com/apache/airflow/pull/60962))
* Upgrade to Apache Airflow TaskSDK to 1.0.6+astro.3
* Mask kwargs on illegal args ([#58252](https://github.com/apache/airflow/pull/58252))
* Redact secrets in rendered templates properly to not expose them on UI ([#58767](https://github.com/apache/airflow/pull/58767))
* Redact secrets in rendered templates properly when truncating it ([#59566](https://github.com/apache/airflow/pull/59566))
* Upgrade `astronomer-kubernetes-executor` to `10.8.1+astro.1`
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 3.0-14 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-0-14).
### Security fixes
* Fixed [CVE-2025-62727](https://nvd.nist.gov/vuln/detail/CVE-2025-62727) - Starlette DoS via Range header merging in FileResponse
* Fixed [CVE-2025-65995](https://nvd.nist.gov/vuln/detail/CVE-2025-65995) - Airflow: Disclosure of secrets to UI via kwargs
* Fixed [CVE-2025-66388](https://nvd.nist.gov/vuln/detail/CVE-2025-66388) - Airflow: Secrets in rendered templates not redacted properly and exposed in the UI
* Fixed [CVE-2026-21441](https://avd.aquasec.com/nvd/CVE-2026-21441)
* Fixed [CVE-2025-69223](https://avd.aquasec.com/nvd/cve-2025-69223)
* Fixed [CVE-2025-69227](https://avd.aquasec.com/nvd/cve-2025-69227)
* Fixed [CVE-2025-69228](https://avd.aquasec.com/nvd/cve-2025-69228)
* Fixed [CVE-2025-69229](https://avd.aquasec.com/nvd/cve-2025-69229)
* Fixed [CVE-2025-69224](https://avd.aquasec.com/nvd/cve-2025-69224)
* Fixed [CVE-2025-69225](https://avd.aquasec.com/nvd/cve-2025-69225)
* Fixed [CVE-2025-69226](https://avd.aquasec.com/nvd/cve-2025-69226)
* Fixed [CVE-2025-69230](https://avd.aquasec.com/nvd/cve-2025-69230)
* Fixed [CVE-2026-21860](https://avd.aquasec.com/nvd/2026/cve-2026-21860)
* Fixed [CVE-2026-23490](https://avd.aquasec.com/nvd/2026/cve-2026-23490)
* Airflow version: 3.0.6
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.0-13`
### Additional improvements
* Upgraded to Airflow `3.0.6+astro.4`, which includes:
* Fix DAG processor crash with pre-import module optimization ([#56773](https://github.com/apache/airflow/pull/56773))
* Prevent unnecessary kubernetes client imports in workers ([#56692](https://github.com/apache/airflow/pull/56692))
* Upgraded Apache Airflow TaskSDK to `1.0.6+astro.2`which includes:
* Fix memory leak in remote logging connection cache ([#56695](https://github.com/apache/airflow/pull/56695))
* Fix memory leak in Client via SSL context creation ([#57334](https://github.com/apache/airflow/pull/57334))
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 3.0-13 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-0-13).
### Security fixes
* Fixed [CVE-2025-62611](https://nvd.nist.gov/vuln/detail/CVE-2025-62611)
* Fixed [CVE-2025-62503](https://nvd.nist.gov/vuln/detail/CVE-2025-62503)
* Fixed [CVE-2025-62402](https://nvd.nist.gov/vuln/detail/CVE-2025-62402)
* Fixed [GHSA-pqhf-p39g-3x64](https://github.com/advisories/GHSA-pqhf-p39g-3x64)
* Airflow version: 3.0.6
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.0-12`
**Known Issue**
This version of Runtime has a significant memory leak for Celery Workers. Astronomer recommends upgrading directly to Runtime 3.1-3 or switching to Astro Executor.
### Additional improvements
* Upgraded to Airflow `3.0.6+astro.3`, which includes:
* Handle trigger calls to `get_connection` ([#55799](https://github.com/apache/airflow/pull/55799))
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 3.0-12 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-0-12).
* Airflow version: 3.0.6
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.0-11`
**Known Issue**
This version of Runtime has a significant memory leak for Celery Workers. Astronomer recommends upgrading directly to Runtime 3.1-3 or switching to Astro Executor.
### Additional improvements
* Upgraded to Airflow `3.0.6+astro.2`, which includes:
* Fix query client retry strategy ([#55528](https://github.com/apache/airflow/pull/55528))
* Fix FAB related db downgrade issues ([#55738](https://github.com/apache/airflow/pull/55738)), ([#55231](https://github.com/apache/airflow/pull/55231))
* Reduce default API server workers to 1 ([#55707](https://github.com/apache/airflow/pull/55707))
* Remove `python_callable` as string from mapped operator in serialized dag ([#55288](https://github.com/apache/airflow/pull/55288))
* Minor optimizations to serialized dag storage and retrieval to reduce size
* Airflow version: 3.0.6
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.0-10`
**Known Issue**
This version of Runtime has a significant memory leak for Celery Workers. Astronomer recommends upgrading directly to Runtime 3.1-3 or switching to Astro Executor.
### Additional improvements
* Upgraded to Airflow `3.0.6+astro.1`. See [Airflow Release Notes](https://airflow.apache.org/docs/apache-airflow/stable/release_notes.html#airflow-3-0-6-2025-08-29) for more information.
* Upgraded Apache Airflow TaskSDK to `1.0.6+astro.1`.
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 3.0-10 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-0-10).
* Airflow version: 3.0.5
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.0-9`
**Known Issue**
This version of Runtime has a significant memory leak for Celery Workers. Astronomer recommends upgrading directly to Runtime 3.1-3 or switching to Astro Executor.
### Restricted version
Airflow 3.0.5 was `yanked` due to a bug with `conn.extra_dejson` masking that causes tasks to fail ([#54768](https://github.com/apache/airflow/issues/54768)).
This means that the Astro Runtime 3.0-9 is also yanked. See [Restricted Runtime versions](/docs/runtime/runtime-version-lifecycle-policy#restricted-runtime-versions).
* Airflow version: 3.0.4
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.0-8`
**Known Issue**
This version of Runtime has a significant memory leak for Celery Workers. Astronomer recommends upgrading directly to Runtime 3.1-3 or switching to Astro Executor.
### Additional improvements
* Upgrade to Airflow 3.0.4+astro.2, which includes:
* Fix scheduler crashes with DetachedInstanceError when processing executor events. [#54334](https://github.com/apache/airflow/pull/54334)
* Fix DetachedInstanceError when accessing DagRun.`created_dag_version`. [#54362](https://github.com/apache/airflow/pull/54362)
* Fix custom XCom backends not being used when BaseXCom.`get_all`() is called. [#53814](https://github.com/apache/airflow/pull/53814)
* Fix `xcom_pull` ignoring `include_prior_dates` parameter when `map_indexes` is not specified. [#53809](https://github.com/apache/airflow/pull/53809)
* Restore `get_previous_dagrun` functionality for task context. [#53655](https://github.com/apache/airflow/pull/53655)
* Fix log retrieval failures for in-progress tasks by properly configuring JWT authentication. [#54444](https://github.com/apache/airflow/pull/54444)
* Upgrade to Apache Airflow Task SDK 1.0.4+astro.2, which includes:
* Fix custom XCom backends not being used when BaseXCom.`get_all`() is called. [#53814](https://github.com/apache/airflow/pull/53814)
* Fix `xcom_pull` ignoring `include_prior_dates` parameter when `map_indexes` is not specified. [#53809](https://github.com/apache/airflow/pull/53809)
* Restore `get_previous_dagrun` functionality for task context. [#53655](https://github.com/apache/airflow/pull/53655)
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 3.0-8 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-0-8).
* Fixed [CVE-2025-53643](https://nvd.nist.gov/vuln/detail/CVE-2025-53643) for AIOHTTP vulnerable by upgrading to version 3.12.14.
* Fixed [CVE-2025-54368](https://nvd.nist.gov/vuln/detail/CVE-2025-54368) for uv by upgrading to version 0.8.6.
* Airflow version: 3.0.4
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.0-7`
**Known Issue**
This version of Runtime has a significant memory leak for Celery Workers. Astronomer recommends upgrading directly to Runtime 3.1-3 or switching to Astro Executor.
### Additional improvements
* Upgraded to Airflow 3.0.4. See [Airflow Release Notes](https://airflow.apache.org/docs/apache-airflow/3.0.4/release_notes.html#airflow-3-0-4-2025-08-08) for more information.
* Upgraded Apache Airflow TaskSDK to `1.0.4+astro.1`.
* Upgraded `astronomer-logging-providers==1.6.4` which enables exporting the logs to secondary GCS bucket.
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 3.0-7 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-0-7).
* Airflow version: 3.0.3
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.0-6`
**Known Issue**
This version of Runtime has a significant memory leak for Celery Workers. Astronomer recommends upgrading directly to Runtime 3.1-3 or switching to Astro Executor.
### Additional improvements
* Upgraded to `Airflow 3.0.3+astro.2`, which includes:
* Skips empty dag-run config rows and raises the SQL timeout for XCom migrations to avoid lock-timeout errors. [#50788](https://github.com/apache/airflow/pull/50788)
* Fixes sensor skipping in 3.x branching operators by correcting the SkipMixin import path. [#53455](https://github.com/apache/airflow/pull/53455)
* Triggers task-failure callbacks on the Dag processor when tasks are externally killed. [#53143](https://github.com/apache/airflow/pull/53143)
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 3.0-6 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-0-6).
### Security fixes
* Fixed [CVE-2025-53528](https://avd.aquasec.com/nvd/cve-2025-53528)
* Airflow version: 3.0.3
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.0-5`
### Additional improvements
* Upgraded to Airflow 3.0.3. See [Airflow Release Notes](https://airflow.apache.org/docs/apache-airflow/3.0.3/release_notes.html#airflow-3-0-3-2025-07-14) for more information.
* Upgrade Apache Airflow TaskSDK to `1.0.3+astro.1`.
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 3.0-5 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-0-5).
* Airflow version: 3.0.2
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.0-4`
### Bug fixes
* Fixed various bugs in `AstroAuthManager`.
* Fixed text alignment of **Back to Astro** button.
* Airflow version: 3.0.2
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.0-3`
### Additional improvements
* Upgraded to Airflow 3.0.2. See [Airflow Release Notes](https://airflow.apache.org/docs/apache-airflow/3.0.2/release_notes.html#airflow-3-0-2-2025-06-10) for more information.
* Upgrade to `Airflow 3.0.2+astro.1`.
* Upgrade Apache Airflow TaskSDK to `1.0.2+astro.1`.
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 3.0-3 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-0-3)
* Airflow version: 3.0.1
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.0-2`
### Additional improvements
* Added `SCARF_NO_ANALYTICS=True` in Runtime images to disable telemetry by default.
* Updated `astronomer-providers-logging` to `1.6.1`.
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 3.0-2 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-0-2)
### Known issues
Remote execution has a known incompatibility with Runtime 3.0-2. If you use remote execution, do not upgrade to or create Remote Deployments that use this version. A fix for the incompatibility will be released in v3.0-3.
If you created a new remote Deployment with 3.0-2, you cannot rollback to 3.0-1. You must either create a new remote Deployment with 3.0-1 or wait until the 3.0-3 patch and then upgrade.
If you upgraded a Deployment from 3.0-1 to 3.0-2, Astronomer advises you to downgrade your Deployments or rollback to 3.0-1 by using a Dockerfile change or by rolling back your Deployment in the Astro UI.
* [Roll back to previous deploys](/docs/astro/deploy-history#what-happens-during-a-deploy-rollback)
* [Roll back Deployments after a broken upgrade](/docs/astro/best-practices/upgrading-astro-runtime#roll-back-deployments-after-a-broken-upgrade)
* Airflow version: 3.0.0
* Python versions: 3.11 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/runtime:3.0-1`
### Introducing Airflow 3.0
Astro Runtime 3.0-1 includes same-day support for Apache Airflow 3.0, which includes a number of new features and improvements. Airflow 3.0 includes the following changes:
* Support for dag versioning
* Enhanced and improved React-based Airflow UI
* Support for remote dag execution
* Scheduler-managed backfill
* Event-driven and asset-driven scheduling
For more information about the major changes in this release, see the [Airflow release notes](https://airflow.apache.org/docs/apache-airflow/stable/release_notes.html).
### Behavior changes
* New naming convention for Runtime release versions. Previously, versions were noted as `XX.X.X`, now versions are named as `XX.X-X`.
* Astro Runtime for 3.0 and higher includes only the [provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-3-0-1) required to run on Astro. Previous versions contained additional providers, and if you are using those providers you must explicitly add them to your `requirements.txt`.
* Runtime docs for versions that are past their **End of Basic Support** date, below v6.0.0, have been moved to the [Astronomer Docs Resources](https://github.com/astronomer/astronomer-docs-resources) archive.
* The Docker registry URL for Runtime images has changed for Airflow 3.x. For details, see [Docker Registry URL changes](#docker-registry-url-changes).
#### Pip package resolution
With Runtime 3.0, Python package resolution has switched by default from pip to [uv](https://docs.astral.sh/uv/), which is intended as a fast [drop in replacement](https://docs.astral.sh/uv/pip/compatibility/) for pip. However, uv has a different behavior for packages that exist on [multiple indexes](https://docs.astral.sh/uv/pip/compatibility/#packages-that-exist-on-multiple-indexes), because pip's behavior is unsafe against dependency confusion attacks. If you rely on the pip behavior, you can add `# ASTRO_RUNTIME_USE_PIP` to your `requirements.txt` file to use pip instead of uv. You can also opt to install your dependencies in a separate `RUN` line on your Dockerfile instead of using Runtime's built-in pip installation.
#### Docker Compose override changes
When using `astro dev start`, you can specify a [docker-`compose.override.yml`](/docs/cli/v1.43/run-airflow-locally#override-the-astro-cli-docker-compose-file). If you specified any overrides for the `webserver` container, these break your ability to use `astro dev start` because there is no longer a `webserver` container. Replace all references to `webserver` with `api-server`.
#### Docker Registry URL changes
Starting with Airflow 3.x, Runtime Docker images are hosted at a new registry:
```text wrap theme={null}
astrocrpublic.azurecr.io/runtime:
```
Airflow 2.x images are still available under the original registry:
```text wrap theme={null}
quay.io/astronomer/astro-runtime:
```
but can also be pulled from the new domain as an alternative:
```text wrap theme={null}
astrocrpublic.azurecr.io/astronomer/astro-runtime:
```
* Airflow version: 2.11.2
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:13.9.0`
### Additional improvements
* Upgrade to Airflow `2.11.2+astro.5` which includes:
* Stop exposing trigger kwargs in the REST API response [#67868](https://github.com/apache/airflow/pull/67868)
* Mask per-key secrets-backend-kwarg overrides on the Config API [#67622](https://github.com/apache/airflow/pull/67622)
* Do not deserialize `trigger_kwargs` when loading serialized DAGs [#66002](https://github.com/apache/airflow/pull/66002)
* Fix truncated details tabs and page overflow in the grid view [#68750](https://github.com/apache/airflow/pull/68750)
* Upgrade `astronomer-providers-logging` to `1.6.8`
* Upgrade `apache-airflow-providers-cncf-kubernetes` to `10.20.0`
* Update `astronomer-kubernetes-executor` to `10.20.0+astro.1`
* Upgraded the minor and patch versions of several open-source provider packages.
### Security fixes
* Fixed [GHSA-2wc2-fm75-p42x](https://github.com/advisories/GHSA-2wc2-fm75-p42x)
* Fixed [GHSA-836r-79rf-4m37](https://github.com/advisories/GHSA-836r-79rf-4m37)
* Fixed [GHSA-8ppf-4f7h-5ppj](https://github.com/advisories/GHSA-8ppf-4f7h-5ppj)
* Fixed [GHSA-hm4w-wwcw-mr6r](https://github.com/advisories/GHSA-hm4w-wwcw-mr6r)
* Fixed [PYSEC-2026-2132](https://osv.dev/vulnerability/PYSEC-2026-2132)
* Fixed [PYSEC-2026-3444](https://osv.dev/vulnerability/PYSEC-2026-3444)
* Fixed [PYSEC-2026-3455](https://osv.dev/vulnerability/PYSEC-2026-3455)
* Fixed [GHSA-h35f-9h28-mq5c](https://github.com/advisories/GHSA-h35f-9h28-mq5c)
* Airflow version: 2.11.2
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:13.8.0`
### Additional improvements
* Upgrade to Airflow `2.11.2+astro.4` which includes:
* Improve `/home` load time on deployments with many DAGs by skipping the per-DAG authorization filter for users with global DAG access
* Fix OTel metrics crash for non-ASCII DAG/task names [#68023](https://github.com/apache/airflow/pull/68023)
* Fix DagProcessor crash: add missing `name_is_otel_safe()` guard to `gauge()` and `timer()` [#68284](https://github.com/apache/airflow/pull/68284)
* Extend `DEFAULT_SENSITIVE_FIELDS` with `webhook_url`, `bearer`, `dsn`, `auth_header`, and `service_key` [#66673](https://github.com/apache/airflow/pull/66673)
* Check sensitive key names before applying recursion-depth cutoff in secrets masker [#65912](https://github.com/apache/airflow/pull/65912)
* Refuse to follow log symlinks that resolve outside the base log folder [#65325](https://github.com/apache/airflow/pull/65325)
* Validate SMTP server certificate on `STARTTLS` upgrade [#65346](https://github.com/apache/airflow/pull/65346)
* Upgrade `astronomer-providers-logging` to `1.6.6`
* Upgrade `apache-airflow-providers-cncf-kubernetes` to `10.18.0`
### Security fixes
* Fixed [GHSA-65pc-fj4g-8rjx](https://github.com/advisories/GHSA-65pc-fj4g-8rjx)
* Fixed [PYSEC-2026-24](https://osv.dev/vulnerability/PYSEC-2026-24)
* Fixed [PYSEC-2026-113](https://osv.dev/vulnerability/PYSEC-2026-113)
* Fixed [CVE-2026-45192](https://avd.aquasec.com/nvd/cve-2026-45192)
* Fixed [CVE-2026-42358](https://avd.aquasec.com/nvd/cve-2026-42358)
* Fixed [CVE-2026-40861](https://avd.aquasec.com/nvd/cve-2026-40861)
* Fixed [CVE-2026-49267](https://avd.aquasec.com/nvd/cve-2026-49267)
* Fixed [GHSA-29h4-r29x-hchv](https://github.com/advisories/GHSA-29h4-r29x-hchv)
* Fixed [PYSEC-2026-175](https://osv.dev/vulnerability/PYSEC-2026-175)
* Fixed [PYSEC-2026-177](https://osv.dev/vulnerability/PYSEC-2026-177)
* Fixed [PYSEC-2026-178](https://osv.dev/vulnerability/PYSEC-2026-178)
* Fixed [PYSEC-2026-179](https://osv.dev/vulnerability/PYSEC-2026-179)
* Fixed [GHSA-hg6j-4rv6-33pg](https://github.com/advisories/GHSA-hg6j-4rv6-33pg)
* Fixed [GHSA-jg22-mg44-37j8](https://github.com/advisories/GHSA-jg22-mg44-37j8)
* Fixed [GHSA-cx3h-4qpv-8hc9](https://github.com/advisories/GHSA-cx3h-4qpv-8hc9)
* Fixed [GHSA-537c-gmf6-5ccf](https://github.com/advisories/GHSA-537c-gmf6-5ccf)
* Fixed [GHSA-pw6j-qg29-8w7f](https://github.com/advisories/GHSA-pw6j-qg29-8w7f)
* Fixed [GHSA-4fvr-rgm6-gqmc](https://github.com/advisories/GHSA-4fvr-rgm6-gqmc)
* Fixed [GHSA-63hw-fmq6-xxg2](https://github.com/advisories/GHSA-63hw-fmq6-xxg2)
* Fixed [GHSA-g3cq-j2xw-wf74](https://github.com/advisories/GHSA-g3cq-j2xw-wf74)
* Fixed [GHSA-hpj7-wq8m-9hgp](https://github.com/advisories/GHSA-hpj7-wq8m-9hgp)
* Fixed [GHSA-xcgm-r5h9-7989](https://github.com/advisories/GHSA-xcgm-r5h9-7989)
* Fixed [GHSA-2fqr-mr3j-6wp8](https://github.com/advisories/GHSA-2fqr-mr3j-6wp8)
* Fixed [GHSA-4m7w-qmgq-4wj5](https://github.com/advisories/GHSA-4m7w-qmgq-4wj5)
* Fixed [GHSA-9x8q-7h8h-wcw9](https://github.com/advisories/GHSA-9x8q-7h8h-wcw9)
### Breaking changes
* `apache-airflow-providers-smtp` bumped 2.4.5 → 3.0.1 to fix [PYSEC-2026-24](https://osv.dev/vulnerability/PYSEC-2026-24). `SmtpHook` STARTTLS upgrades now validate the SMTP server's certificate against the system CA bundle by default. Deployments pointing `SmtpHook` at servers with self-signed or otherwise non-validating certs must set the `ssl_context` field in the SMTP connection extras to `"none"` to preserve the previous behavior.
* `azure-datalake-store` bumped 0.0.53 → 1.0.1. Version 1.0.0 switched ADLS authentication to the generic Azure token credential (replacing the legacy `lib.auth`) and dropped end-of-life Python versions. Deployments using Azure Data Lake (ADLS) hooks/operators should validate authentication after upgrading. The `cryptography<47` cap that previously blocked upgrading `cryptography` to 48.0.1 for [GHSA-537c-gmf6-5ccf](https://github.com/advisories/GHSA-537c-gmf6-5ccf) came from `msal`, which this release bumps 1.32.3 → 1.37.0.
* Airflow version: 2.11.2
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:13.7.0`
### Additional improvements
* Upgrade to Airflow `2.11.2+astro.3` which includes:
* Skip dataset-triggered dags without SerializedDagModel [#63546](https://github.com/apache/airflow/pull/63546)
* Prevent scheduler crash on AF3.2+ downgrade (interval timetables)
* Fix log groups collapsing on auto-refresh in Logs view [#65378](https://github.com/apache/airflow/pull/65378)
* Guard Grid task-group selections in legacy details flow
* Add INFO-level logging to dataset scheduling path [#63958](https://github.com/apache/airflow/pull/63958)
* Remove sunset Astronomer Registry link from Airflow UI [#3144](https://github.com/astronomer/astro-runtime/pull/3144)
### Security fixes
* Fix 22 endorctl-flagged CVEs by bumping `aiohttp`, `urllib3`, `requests`, `microsoft-kiota-http`, `Mako`, `Authlib`, `Pygments`, `lxml`, `pytest`, and `pyarrow`
### Breaking changes
* Bumped `snowflake-connector-python` 3.15.0 → 4.5.0 and `lxml` 5.3.2 → 6.1.0 to fix CVEs. Snowflake 4.x and lxml 6.x each drop deprecated APIs — review DAGs that use them directly.
* Airflow version: 2.11.2
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:13.6.0`
### Additional improvements
* Upgrade to Airflow `2.11.2+astro.2` which includes:
* Prevent stale zombie callbacks from failing newer task attempts [#63726](https://github.com/apache/airflow/pull/63726)
### Security fixes
* Fixed [CVE-2026-28802](https://avd.aquasec.com/nvd/cve-2026-28802)
* Fixed [CVE-2025-69219](https://avd.aquasec.com/nvd/cve-2025-69219) by upgrading `apache-airflow-providers-http` from 5.6.4 to 6.0.0
* Fixed [CVE-2026-32597](https://avd.aquasec.com/nvd/cve-2026-32597)
* Fixed [CVE-2026-31958](https://avd.aquasec.com/nvd/cve-2026-31958)
* Fixed [GHSA-78cv-mqj4-43f7](https://github.com/advisories/GHSA-78cv-mqj4-43f7)
* Fixed [CVE-2026-27962](https://avd.aquasec.com/nvd/cve-2026-27962)
* Fixed [CVE-2026-28490](https://avd.aquasec.com/nvd/cve-2026-28490)
* Fixed [CVE-2026-28498](https://avd.aquasec.com/nvd/cve-2026-28498)
* Fixed [CVE-2026-30922](https://avd.aquasec.com/nvd/cve-2026-30922)
* Airflow version: 2.11.1
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:13.5.1`
### Additional improvements
* Upgrade to Airflow `2.11.1+astro.2` which includes:
* Fix webserver 500 error when upgrading to FAB provider 1.5.4 [#62412](https://github.com/apache/airflow/pull/62412)
* Lazily import fs and `package_index` hook in providers manager [#62357](https://github.com/apache/airflow/pull/62356)
* Airflow version: 2.11.1
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:13.5.0`
### Restricted version
Astro Runtime 13.5.0 has been restricted from use due to a known issue where the Airflow webserver returns 500 errors for existing user sessions when upgrading from previous versions. This is caused by an incompatibility between session cookies from earlier versions and the updated flask-session dependency included in `FAB 1.5.4`. See [Restricted Runtime versions](/docs/runtime/runtime-version-lifecycle-policy#restricted-runtime-versions).
### Additional improvements
* Upgrade to Airflow `2.11.1+astro.1` which includes:
* Mask proxy and proxies in logs [#59688](https://github.com/apache/airflow/pull/59688)
* Fix permissions check in import error APIs [#60801](https://github.com/apache/airflow/pull/60801)
* Fix import errors not showing on UI [#61163](https://github.com/apache/airflow/pull/61163)
* Fix base url for Dag dependencies
* Fix home page pagination when running filter is active
### Security fixes
* Fixed [CVE-2025-68675](https://avd.aquasec.com/nvd/cve-2025-68675)
* Fixed [CVE-2025-15467](https://avd.aquasec.com/nvd/cve-2025-15467)
* Fixed [CVE-2025-69419](https://avd.aquasec.com/nvd/cve-2025-69419)
* Fixed [CVE-2025-69421](https://avd.aquasec.com/nvd/cve-2025-69421)
* Fixed [CVE-2025-68160](https://avd.aquasec.com/nvd/cve-2025-68160)
* Fixed [CVE-2025-69418](https://avd.aquasec.com/nvd/cve-2025-69418)
* Fixed [CVE-2025-69420](https://avd.aquasec.com/nvd/cve-2025-69420)
* Fixed [CVE-2026-22795](https://avd.aquasec.com/nvd/cve-2026-22795)
* Fixed [CVE-2026-22796](https://avd.aquasec.com/nvd/cve-2026-22796)
* Fixed [CVE-2026-21226](https://avd.aquasec.com/nvd/cve-2026-21226)
* Fixed [CVE-2026-22701](https://avd.aquasec.com/nvd/cve-2026-22701)
* Fixed [CVE-2026-23949](https://avd.aquasec.com/nvd/cve-2026-23949)
* Fixed [CVE-2026-1703](https://avd.aquasec.com/nvd/cve-2026-1703)
* Fixed [CVE-2026-0994](https://avd.aquasec.com/nvd/cve-2026-0994)
* Fixed [CVE-2026-23490](https://avd.aquasec.com/nvd/cve-2026-23490)
* Fixed [CVE-2026-22702](https://avd.aquasec.com/nvd/cve-2026-22702)
* Fixed [CVE-2026-24049](https://avd.aquasec.com/nvd/cve-2026-24049)
* Fixed [CVE-2026-27199](https://avd.aquasec.com/nvd/cve-2026-27199)
* Fixed [GHSA-27jp-wm6q-gp25](https://github.com/advisories/GHSA-27jp-wm6q-gp25)
* Airflow version: 2.11.0
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:13.4.0`
### Additional improvements
* Upgrade to Airflow `2.11.0+astro.4` which includes:
* Fix Redirection on Dag Dependencies Page
* Fix downgrade for 2.9.0 audit log migration [#57131](https://github.com/apache/airflow/pull/57131)
### Security fixes
* Fixed [CVE-2025-69223](https://avd.aquasec.com/nvd/cve-2025-69223)
* Fixed [CVE-2025-69227](https://avd.aquasec.com/nvd/cve-2025-69227)
* Fixed [CVE-2025-69228](https://avd.aquasec.com/nvd/cve-2025-69228)
* Fixed [CVE-2025-69229](https://avd.aquasec.com/nvd/cve-2025-69229)
* Fixed [CVE-2025-69224](https://avd.aquasec.com/nvd/cve-2025-69224)
* Fixed [CVE-2025-69225](https://avd.aquasec.com/nvd/cve-2025-69225)
* Fixed [CVE-2025-69226](https://avd.aquasec.com/nvd/cve-2025-69226)
* Fixed [CVE-2025-69230](https://avd.aquasec.com/nvd/cve-2025-69230)
* Fixed [CVE-2025-68146](https://avd.aquasec.com/nvd/cve-2025-68146)
* Fixed [CVE-2025-68480](https://avd.aquasec.com/nvd/cve-2025-68480)
* Fixed [CVE-2025-66418](https://avd.aquasec.com/nvd/cve-2025-66418)
* Fixed [CVE-2025-66471](https://avd.aquasec.com/nvd/cve-2025-66471)
* Fixed [CVE-2026-21441](https://avd.aquasec.com/nvd/cve-2026-21441)
* Fixed [CVE-2025-68158](https://avd.aquasec.com/nvd/cve-2025-68158)
* Fixed [CVE-2025-12758](https://github.com/advisories/GHSA-vghf-hv5q-vc2g)
* Airflow version: 2.11.0
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:13.3.0`
### Additional improvements
* Updated `astronomer-kubernetes-executor` to version `10.8.1+astro.1`.
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 13.3.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-13-3-0).
* Upgrade `astronomer-airflow-scripts` to `0.0.8`
### Security fixes
* Fixed [CVE-2025-59420](https://nvd.nist.gov/vuln/detail/CVE-2025-59420), [CVE-2026-61920](https://nvd.nist.gov/vuln/detail/CVE-2026-61920), and [CVE-2025-62706](https://nvd.nist.gov/vuln/detail/CVE-2025-62706) for Authlib by upgrading to version 1.6.5.
* Fixed [CVE-2025-62611](https://nvd.nist.gov/vuln/detail/CVE-2025-62611) for aiomysql by upgrading to version 0.3.2.
* Fixed [CVE-2025-8869](https://nvd.nist.gov/vuln/detail/CVE-2025-8869) for pip by upgrading to version 25.x.
* Fixed [CVE-2025-6965](https://nvd.nist.gov/vuln/detail/CVE-2025-6965)
* Fixed [CVE-2023-31484](https://nvd.nist.gov/vuln/detail/CVE-2023-31484)
* Fixed [CVE-2025-40909](https://nvd.nist.gov/vuln/detail/CVE-2025-40909)
* Fixed [CVE-2025-4802](https://nvd.nist.gov/vuln/detail/CVE-2025-4802)
* Fixed [CVE-2025-8058](https://nvd.nist.gov/vuln/detail/CVE-2025-8058)
* Fixed [CVE-2025-8714](https://nvd.nist.gov/vuln/detail/CVE-2025-8714)
* Fixed [CVE-2025-8715](https://nvd.nist.gov/vuln/detail/CVE-2025-8715)
* Fixed [CVE-2025-8713](https://nvd.nist.gov/vuln/detail/CVE-2025-8713)
* Fixed [CVE-2023-52969](https://nvd.nist.gov/vuln/detail/CVE-2023-52969)
* Fixed [CVE-2023-52970](https://nvd.nist.gov/vuln/detail/CVE-2023-52970)
* Fixed [CVE-2023-52971](https://nvd.nist.gov/vuln/detail/CVE-2023-52971)
* Fixed [CVE-2025-30693](https://nvd.nist.gov/vuln/detail/CVE-2025-30693)
* Fixed [CVE-2025-30722](https://nvd.nist.gov/vuln/detail/CVE-2025-30722)
* Fixed [CVE-2025-3576](https://nvd.nist.gov/vuln/detail/CVE-2025-3576)
* Fixed [CVE-2025-9230](https://nvd.nist.gov/vuln/detail/CVE-2025-9230)
* Fixed [CVE-2025-9232](https://nvd.nist.gov/vuln/detail/CVE-2025-9232)
* Airflow version: 2.11.0
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:13.2.0`
### Additional improvements
* Upgrade to Airflow 2.11.0+astro.3 which includes:
* Make CronTriggerTimetable startup behavior intuitive. [#41558](https://github.com/apache/airflow/pull/41558)
* Timetable that runs on multiple cron expressions. [#46451](https://github.com/apache/airflow/pull/46451)
* Fix MultipleCronTriggerTimetable deserialization. [#46886](https://github.com/apache/airflow/pull/46886)
* Update astronomer-kubernetes-executor to 10.7.0+astro.1.
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 13.2.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-13-2-0).
### Security fixes
* Fixed [CVE-2025-53643](https://nvd.nist.gov/vuln/detail/CVE-2025-53643)
* Fixed [CVE-2025-57804](https://nvd.nist.gov/vuln/detail/CVE-2025-57804)
* Fixed [CVE-2024-47081](https://nvd.nist.gov/vuln/detail/CVE-2024-47081)
* Fixed [CVE-2025-50181](https://nvd.nist.gov/vuln/detail/CVE-2025-50181)
* Fixed [CVE-2025-50182](https://nvd.nist.gov/vuln/detail/CVE-2025-50182)
* Fixed [CVE-2025-32988](https://avd.aquasec.com/nvd/cve-2025-32988)
* Fixed [CVE-2025-32990](https://avd.aquasec.com/nvd/cve-2025-32990)
* Fixed [CVE-2025-32989](https://avd.aquasec.com/nvd/cve-2025-32989)
* Fixed [CVE-2025-6395](https://avd.aquasec.com/nvd/cve-2025-6395)
* Airflow version: 2.11.0
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:13.1.0`
### Additional improvements
* Stop streaming task logs if the end of log mark is missing [#50715](https://github.com/apache/airflow/pull/50715)
* Correctly treat re-queues on reschedule sensors as resets after each reschedule [#51410](https://github.com/apache/airflow/pull/51410)
* Fix archival for cascading deletes by archiving dependent tables first [#51952](https://github.com/apache/airflow/pull/51952)
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 13.1.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-13-1-0).
* Airflow version: 2.11.0
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:13.0.0`
### Additional improvements
* Upgrade to Airflow `2.11.0+astro.1`.
* Update `astronomer-providers-logging` to `1.6.2`. This adds support for writing task logs to a secondary S3 bucket.
* Fix `get_health` endpoint to return `None` for inactive standalone Dag processors, preventing them from being reported as unhealthy.
* Upgraded the major, minor, and patch versions of several open-source provider packages. See [Astro Runtime 13.0.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-13-0-0). As this release includes major provider updates, this release introduces breaking changes in dags. These issues can be resolved by updating provider-specific changes in the dags.
* Airflow version: 2.10.5
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:12.12.0`
### Additional improvements
* Upgrade to Airflow `2.10.5+astro.4` which includes:
* Mask proxy and proxies in logs
* Mask details while creating connections using json & uri [#61882](https://github.com/apache/airflow/pull/61882)
* Fix redaction of illegal args [#61883](https://github.com/apache/airflow/pull/61883)
* Fix permissions check in import error APIs [#60801](https://github.com/apache/airflow/pull/60801)
* Fix import errors not showing on UI [#61163](https://github.com/apache/airflow/pull/61163)
* Disable use of `LogTemplate` table by default [#61880](https://github.com/apache/airflow/pull/61880)
* Updated `astronomer-logging-provider` to version `1.6.2`.
### Security fixes
* Fixed [CVE-2025-69223](https://avd.aquasec.com/nvd/cve-2025-69223)
* Fixed [CVE-2025-69227](https://avd.aquasec.com/nvd/cve-2025-69227)
* Fixed [CVE-2025-69228](https://avd.aquasec.com/nvd/cve-2025-69228)
* Fixed [CVE-2025-69229](https://avd.aquasec.com/nvd/cve-2025-69229)
* Fixed [CVE-2025-69229](https://avd.aquasec.com/nvd/cve-2025-69229)
* Fixed [CVE-2025-69229](https://avd.aquasec.com/nvd/cve-2025-69229)
* Fixed [CVE-2025-69224](https://avd.aquasec.com/nvd/cve-2025-69224)
* Fixed [CVE-2025-69225](https://avd.aquasec.com/nvd/cve-2025-69225)
* Fixed [CVE-2025-69226](https://avd.aquasec.com/nvd/cve-2025-69226)
* Fixed [CVE-2025-69230](https://avd.aquasec.com/nvd/cve-2025-69230)
* Fixed [CVE-2025-68146](https://avd.aquasec.com/nvd/cve-2025-68146)
* Fixed [CVE-2025-66418](https://avd.aquasec.com/nvd/cve-2025-66418)
* Fixed [CVE-2025-66471](https://avd.aquasec.com/nvd/cve-2025-66471)
* Fixed [CVE-2026-21441](https://avd.aquasec.com/nvd/cve-2026-21441)
* Fixed [CVE-2026-22702](https://avd.aquasec.com/nvd/cve-2026-22702)
* Fixed [CVE-2026-21226](https://avd.aquasec.com/nvd/cve-2026-21226)
* Fixed [CVE-2026-22701](https://avd.aquasec.com/nvd/cve-2026-22701)
* Fixed [CVE-2026-1703](https://avd.aquasec.com/nvd/cve-2026-1703)
* Fixed [CVE-2026-0994](https://avd.aquasec.com/nvd/cve-2026-0994)
* Fixed [CVE-2026-23490](https://avd.aquasec.com/nvd/cve-2026-23490)
* Fixed [CVE-2026-22702](https://avd.aquasec.com/nvd/cve-2026-22702)
* Fixed [CVE-2026-24049](https://avd.aquasec.com/nvd/cve-2026-24049)
* Fixed [CVE-2026-23949](https://avd.aquasec.com/nvd/cve-2026-23949)
* Fixed [GHSA-27jp-wm6q-gp25](https://github.com/advisories/GHSA-27jp-wm6q-gp25)
* Airflow version: 2.10.5
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:12.11.0`
### Additional improvements
* Updated `astronomer-kubernetes-executor` to version `10.7.0+astro.1`.
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 12.11.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-12-11-0).
* Upgrade `astronomer-airflow-scripts` to `0.0.8`
* Airflow version: 2.10.5
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:12.10.0`
### Additional improvements
* Stop streaming task logs if the end of log mark is missing [#50715](https://github.com/apache/airflow/pull/50715)
* Correctly treat re-queues on reschedule sensors as resets after each reschedule [#51410](https://github.com/apache/airflow/pull/51410)
* Fix archival for cascading deletes by archiving dependent tables first [#51952](https://github.com/apache/airflow/pull/51952)
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 12.10.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-12-10-0).
* Airflow version: 2.10.5
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:12.9.0`
### Additional improvements
* Add `SCARF_NO_ANALYTICS=True` in Runtime images to disable telemetry by default.
* Update `astronomer-providers-logging` to `1.6.0`.
* Update `astronomer-kubernetes-executor` to `10.4.2+astro.1` to allow internal retries when a pending Kubernetes Pod is deleted.
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 12.9.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-12-9-0)
* Airflow version: 2.10.5
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:12.8.0`
### Additional improvements
* Upgraded `apache-airflow-providers-celery==3.10.0` to `apache-airflow-providers-celery==3.10.5`
* Upgraded `celery==5.4.0` to `celery==5.5.0`.
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 12.8.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-12-8-0)
* Airflow version: 2.10.5
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:12.7.1`
### Early access Airflow bug fixes
* Improved `CronTriggerTimetable` startup behavior [#41558](https://github.com/apache/airflow/pull/41558)
* Introduced `MultipleCronTriggerTimetable` that allows scheduling dag runs based on multiple cron expressions [#46451](https://github.com/apache/airflow/pull/46451)
### Additional improvements
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 12.7.1 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-12-7-1)
* Airflow version: 2.10.5
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:12.7.0`
### Additional improvements
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 12.7.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-12-7-0)
* Airflow version: 2.10.4
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:12.6.0`
### Additional improvements
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 12.6.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-12-6-0)
* Airflow version: 2.10.3
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:12.5.0`
### RHEL UBI 9 images are officially supported
RHEL UBI 9 images are now officially supported starting with version 12.5. In addition, the following changes have been made since the initial release:
* **Removed Packages:** `glibc`, `krb5-libs`, `systemd-sysv`, `wget`, `lz4`, `libicu`
* PostgreSQL installation is now sourced from the UBI repository instead of [download.postgresql.org](https://download.postgresql.org)
* The EPEL repository has been removed from the UBI image
### Early access Airflow bug fixes
* You can now retry tasks that are stuck in `queued` state [#43520](https://github.com/apache/airflow/pull/43520)
### Additional improvements
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 12.5.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-12-5-0)
* Airflow version: 2.10.3
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:12.4.0`
### Additional improvements
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 12.4.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-12-4-0)
* Airflow version: 2.10.3
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:12.3.0`
### Additional improvements
* (Experimental) Introduced a new [RHEL UBI 9](/docs/runtime/runtime-image-architecture#operating-system-support) based image option.
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 12.3.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-12-3-0)
* Airflow version: 2.10.2
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:12.2.0`
### Early access Airflow bug fixes
* Fixed a bug where the executor would not clean up terminated task instances that go too long without a heartbeat [#43065](https://github.com/apache/airflow/pull/43065)
* Fixed a bug that caused `StaleDataError` by using a different session for writing and deleting recent task instance failures [#42928](https://github.com/apache/airflow/pull/42928)
### Additional improvements
* [Scarf telemetry collected by Airflow](https://airflow.apache.org/docs/apache-airflow/stable/faq.html#does-airflow-collect-any-telemetry-data) is disabled by default.
* Airflow version: 2.10.2
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:12.1.1`
### Additional improvements
* Upgraded to Airflow 2.10.2. See [Airflow Release Notes](https://airflow.apache.org/docs/apache-airflow/2.10.2/release_notes.html#airflow-2-10-2-2024-09-18) for more information.
* Airflow version: 2.10.1
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:12.1.0`
### Additional improvements
* Upgraded to Airflow 2.10.1. See [Airflow Release Notes](https://airflow.apache.org/docs/apache-airflow/2.10.1/release_notes.html#airflow-2-10-1-2024-09-05) for more information.
* Updated the Airflow startup sequence to better isolate dag authors.
* Upgraded the minor and patch versions of some open-source provider packages. See [Astro Runtime 12.1.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-12-1-0)
### Security fixes
* Fixed [CVE-2024-45034](https://www.cve.org/CVERecord?id=CVE-2024-45034)
* Fixed [CVE-2024-45498](https://www.cve.org/CVERecord?id=CVE-2024-45498)
* Airflow version: 2.10.0
* Python versions: 3.10 - 3.12 (default: 3.12)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:12.0.0`
### Airflow 2.10.0
Astro Runtime 12.0.0 includes same-day support for Apache Airflow 2.10, which includes a number of new features and improvements. Airflow 2.10 includes the following changes:
* Adds decorators for task flow (`@skip_if`, `@run_if`) to make it easier to apply whether or not to skip a task.
* You can now see `TaskInstance` **Try History** in the Airflow UI
* Enable ending the task directly from the triggerer without going into the worker.
* Extended dataset dependencies to support dynamic Dataset Event Emission and Dataset Creation.
* A new object, `DatasetAlias`, is available to support dynamic Dataset Event Emission and Dataset Creation ([#40478](https://github.com/apache/airflow/pull/40478))
* Implement accessors to read dataset events defined as inlet ([#39367](https://github.com/apache/airflow/pull/39367))
For more information about the major changes in this release, see the [Airflow Blog](https://airflow.apache.org/blog/airflow-2.10.0/) or the [Airflow release notes](https://airflow.apache.org/docs/apache-airflow/2.10.0/release_notes.html#airflow-2-10-0-2024-08-15).
### Additional improvements
* Updated OS to Debian 12.6 (bookworm)
* Updated Python version to 3.12 in default image
* Upgraded the minor and patch versions of some open-source provider packages. See [Astro Runtime 12.0.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-12-0-0)
### Behavior change
* Since Airflow 2.10 uses Python 3.12, some Python modules have reached end of life, like `imp`, that might create errors in your dags if you still use them. See [Upgrade considerations: Runtime 12](/docs/runtime/version-upgrade-considerations#runtime-12-airflow-2-10) for more information.
* Airflow version: 2.9.3
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.20.0`
### Additional improvements
* Upgraded to Airflow `2.9.3+astro.13`, which includes:
* Fix `try_number` in backport of [#51410](https://github.com/apache/airflow/pull/51410)
### Security fixes
* [CVE-2024-35255](https://www.cve.org/CVERecord?id=CVE-2024-35255)
* [CVE-2024-47081](https://www.cve.org/CVERecord?id=CVE-2024-47081)
* [CVE-2024-52304](https://www.cve.org/CVERecord?id=CVE-2024-52304)
* [CVE-2024-37891](https://www.cve.org/CVERecord?id=CVE-2024-37891)
* [CVE-2025-50181](https://www.cve.org/CVERecord?id=CVE-2025-50181)
* [CVE-2025-50182](https://www.cve.org/CVERecord?id=CVE-2025-50182)
* [CVE-2025-8869](https://www.cve.org/CVERecord?id=CVE-2025-8869)
* [CVE-2024-56201](https://www.cve.org/CVERecord?id=CVE-2024-56201)
* [CVE-2024-56326](https://www.cve.org/CVERecord?id=CVE-2024-56326)
* [CVE-2025-27516](https://www.cve.org/CVERecord?id=CVE-2025-27516)
* Airflow version: 2.9.3
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.19.0`
### Additional improvements
* Stop streaming task logs if the end of log mark is missing [#50715](https://github.com/apache/airflow/pull/50715)
* Correctly treat re-queues on reschedule sensors as resets after each reschedule [#51410](https://github.com/apache/airflow/pull/51410)
* Fix archival for cascading deletes by archiving dependent tables first [#51952](https://github.com/apache/airflow/pull/51952)
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 11.19.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-11-19-0).
* Airflow version: 2.9.3
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.18.0`
### Additional improvements
* Add `SCARF_NO_ANALYTICS=True` in Runtime images to disable telemetry by default.
* Upgraded `apache-airflow-providers-celery==3.10.0` to `apache-airflow-providers-celery==3.10.6`
* Upgraded `celery==5.4.0` to `celery==5.5.0`.
* Update `astronomer-kubernetes-executor` to `10.4.2+astro.1` to allow internal retries when a pending Kubernetes Pod is deleted.
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 11.18.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-11-18-0)
* Airflow version: 2.9.3
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.17.0`
### Early access Airflow bug fixes
* Improved `CronTriggerTimetable` startup behavior [#41558](https://github.com/apache/airflow/pull/41558)
* Introduced `MultipleCronTriggerTimetable` that allows scheduling dag runs based on multiple cron expressions [#46451](https://github.com/apache/airflow/pull/46451)
* Mask connection details when creating connections using JSON or URI to ensure consistency with other methods [#46595](https://github.com/apache/airflow/pull/46595)
### Additional improvements
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 11.17.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-11-17-0)
* Airflow version: 2.9.3
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.16.0`
### Early access Airflow bug fixes
* Fixed a bug where the executor would not clean up terminated task instances that go too long without a heartbeat [#42932](https://github.com/apache/airflow/pull/42932)
### Additional improvements
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 11.16.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-11-16-0)
* Airflow version: 2.9.3
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.15.1`
### Early access Airflow bug fixes
* Restore `add_input_dataset` and `add_output_dataset` in NoOpCollector for backward compatibility. [#44681](https://github.com/apache/airflow/pull/44681)
* Airflow version: 2.9.3
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.15.0`
### Early access Airflow bug fixes
* You can now retry tasks that are stuck in `queued` state [#43520](https://github.com/apache/airflow/pull/43520)
### Additional improvements
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 11.15.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-11-15-0)
* Airflow version: 2.9.3
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.14.0`
### Early access Airflow bug fixes
* Improved handling value masking of the set variable [#43123](https://github.com/apache/airflow/pull/43123)
* Masked configuration values that are irrelevant to the dag author [#43040](https://github.com/apache/airflow/pull/43040)
### Additional improvements
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 11.14.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-11-14-0)
* Airflow version: 2.9.3
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.13.0`
### Additional improvements
* (Experimental) Introduced a new [RHEL UBI 9](/docs/runtime/runtime-image-architecture#operating-system-support) based image option.
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 11.13.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-11-13-0)
* Airflow version: 2.9.3
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.12.0`
### Early access Airflow bug fixes
* Revert "Fix: Dags are not marked as stale if the dags folder change" [#42197](https://github.com/apache/airflow/pull/42197)
* Revert "Handle Example dags case when checking for missing files" [#42193](https://github.com/apache/airflow/pull/42193)
### Additional improvements
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 11.12.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-11-12-0)
* Airflow version: 2.9.3
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.11.0`
### Early access Airflow bug fixes
* Fixed a bug in the check served logs logic that caused the UI to show an erroneous 404 error if the user was looking at the logs for a non-running try [#41272](https://github.com/apache/airflow/pull/41272)
* Fixed a bug where clicking on a `run_id` in a `task_instance` or `dag_run` list incorrectly opened a different `run_id` [#42138](https://github.com/apache/airflow/pull/42138)
### Additional improvements
* Add logging around listener.
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 11.11.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-11-11-0)
* Airflow version: 2.9.3
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.10.1`
### Additional improvements
* Updated the Airflow startup sequence to better isolate dag authors.
* Included open-source provider packages reference. See [Astro Runtime 11.10.1 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-11-10-0)
### Security fixes
* Fixed [CVE-2024-45034](https://www.cve.org/CVERecord?id=CVE-2024-45034)
* Airflow version: 2.9.3
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.10.0`
### Additional improvements
* Upgraded the minor and patch versions of several open-source provider packages. See [Astro Runtime 11.10.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-11-10-0)
### Bug fixes
* Resolved a dag parsing issue where dags were not marked as stale if the `AIRFLOW__CORE__DAGS_FOLDER` was changed. ([#41433](https://github.com/apache/airflow/pull/41433))
* LocalTaskJob no longer fails on heartbeat due to temporary database connection losses. ([#41704](https://github.com/apache/airflow/pull/41704))
* Airflow version: 2.9.3
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.9.0`
### Additional improvements
* Downgrade `apache-airflow-providers-openlineage` to `1.8.0` to prevent scheduler OOM with complex dags
* Airflow version: 2.9.3
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.8.0`
### Additional improvements
* Fixed the Tasks API endpoint for scenarios when a dag doesn't have a `start_date` ([#40878](https://github.com/apache/airflow/pull/40878))
* Added validation for the project URL that comes from installed providers, before displaying the URL in views ([#40933](https://github.com/apache/airflow/pull/40933))
* Upgraded the minor and patch versions of some open-source provider packages. See [Astro Runtime 11.8.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-11-8-0)
* Airflow version: 2.9.3
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.7.0`
### Airflow 2.9.3
Astro Runtime 11.7.0 includes same-day support for Apache Airflow 2.9.3. Airflow 2.9.3 contains a number of bug fixes and new features including:
* The time unit for `scheduled_duration` and `queued_duration` metrics has changed to milliseconds instead of seconds [#37936](https://github.com/apache/airflow/pull/37936)
* Support for OpenTelemetry metrics on Airflow are now considered **Stable**, and was previously added in Airflow version 2.7.0 as **Experimental** [#40286](https://github.com/apache/airflow/pull/40286)
For more information, see the [Apache Airflow release notes](https://airflow.apache.org/docs/apache-airflow/stable/release_notes.html#airflow-2-9-3-2024-07-15).
### Additional improvements
* Upgraded the minor and patch versions of some Astro open source provider packages. See [Astro Runtime 11.7.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-11-7-0)
### Security fixes
* Fixed [CVE-2024-6345](https://www.cvedetails.com/cve/CVE-2024-6345/)
* Fixed [CVE-2024-39863](https://www.cve.org/CVERecord?id=CVE-2024-39863)
* Fixed [CVE-2024-39877](https://www.cve.org/CVERecord?id=CVE-2024-39877)
* Airflow version: 2.9.2
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.6.0`
### Early access Airflow bug fixes
* Fixed a bug where FAB config options, such as `[fab] update_fab_perms`, were not checking for values in the deprecated webserver config section. For example, `[webserver] update_fab_perms` ([#40317](https://github.com/apache/airflow/pull/40317))
### Additional improvements
* Upgraded the minor and patch versions of some Astro open source provider packages. See [Astro Runtime 11.6.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-11-6-0)
* Airflow version: 2.9.2
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.5.0`
### Airflow 2.9.2
Astro Runtime 11.5.0 includes same-day support for Apache Airflow 2.9.2. Airflow 2.9.2 contains a number of bug fixes including:
* Resolved a bug where valid dags that worked in Airflow 2.8 and had outlet datasets with specific URIs stopped working depending on how the URI was formatted [(#39670)](https://github.com/apache/airflow/pull/39670)
* Resolved an issue where the object storage XCOM backend did not serialize correctly, causing custom XCOM backends to sometimes fail [(#39313)](https://github.com/apache/airflow/pull/39313)
For more information, see the [Apache Airflow release notes](https://airflow.apache.org/docs/apache-airflow/stable/release_notes.html#airflow-2-9-2-2024-06-10).
### Additional improvements
* Upgraded the minor and patch versions of some Astro open source provider packages. See [Astro Runtime 11.5.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-11-5-0)
### Security fixes
* [CVE-2024-25142](https://www.cve.org/CVERecord?id=CVE-2024-25142)
* Airflow version: 2.9.1
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.4.0`
### Additional improvements
* Upgraded some OSS providers' minor and patch versions. See [Astro Runtime 11.4.0 provider packages](https://www.astronomer.io/docs/astro/runtime-provider-reference#astro-runtime-11-4-0)
* Added a centralized reference page with all OSS provider package versions listed for each Astro Runtime version. See [Provider package reference](https://www.astronomer.io/docs/astro/runtime-provider-reference)
* Airflow version: 2.9.1
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.3.0`
### Early access Airflow bug fixes
* Fixed a bug affecting custom actions in Airflow plugins that prevents users from running an Astro Runtime environment locally for Astro Runtime versions `11.0.0`-`11.2.0`. Deployments running these versions on Astro are not affected. To continue using `11.0.0`-`11.2.0` locally, set `AIRFLOW__ASTRONOMER__UPDATE_CHECK_INTERVAL=0` in your Astro project `.env` file ([#39421](https://github.com/apache/airflow/pull/39421))
### Additional improvements
* Upgraded some OSS providers' minor and patch versions
### Security fixes
* [CVE-2024-30251](https://www.cve.org/CVERecord?id=CVE-2024-30251)
* Airflow version: 2.9.0
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.2.0`
Due to an [issue related to using custom FAB actions in Airflow plugins](https://github.com/apache/airflow/issues/39144), you might experience an error when you run this version of Astro Runtime locally using the Astro CLI. To resolve this issue, either upgrade directly to Astro Runtime 11.3.0 or set `AIRFLOW__ASTRONOMER__UPDATE_CHECK_INTERVAL=0` in your Astro project `.env` file.
### Early access Airflow bug fixes
* Fixed a bug where `airflow db migrate` would throw an error ([#39246](https://github.com/apache/airflow/pull/39246))
### Additional improvements
* Added the [`apache-airflow-providers-mysql`](https://airflow.apache.org/docs/apache-airflow-providers-mysql/stable/index.html) provider
* Upgraded some OSS providers' minor and patch versions
### Security fixes
* [CVE-2024-4340](https://www.cve.org/CVERecord?id=CVE-2024-4340)
* Airflow version: 2.9.0
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.1.0`
Due to an [issue related to using custom FAB actions in Airflow plugins](https://github.com/apache/airflow/issues/39144), you might experience an error when you run this version of Astro Runtime locally using the Astro CLI. To resolve this issue, either upgrade directly to Astro Runtime 11.3.0 or set `AIRFLOW__ASTRONOMER__UPDATE_CHECK_INTERVAL=0` in your Astro project `.env` file.
### Additional improvements
* Updated `sqlparse` to `0.5.0`.
* Upgraded [Gunicorn](https://gunicorn.org/) to `22.0.0`.
* Added functionality for using plugins to generate custom menu items in the Airflow UI. This feature will be fully available on Astro in a future release.
* Airflow version: 2.9.0
* Python versions: 3.9 - 3.11 (default: 3.11)
* Runtime image: `astrocrpublic.azurecr.io/astronomer/astro-runtime:11.0.0`
Due to an [issue related to using custom FAB actions in Airflow plugins](https://github.com/apache/airflow/issues/39144), you might experience an error when you run this version of Astro Runtime locally using the Astro CLI. To resolve this issue, either upgrade directly to Astro Runtime 11.3.0 or set `AIRFLOW__ASTRONOMER__UPDATE_CHECK_INTERVAL=0` in your Astro project `.env` file.
### Airflow 2.9.0
Astro Runtime 11.0.0 includes same-day support for Apache Airflow 2.9, which includes a number of new features and improvements. Airflow 2.9 includes the following changes:
* New data-aware scheduling lets you use conditional logic (AND / OR) to schedule dags.
* You can now create your own labels for dynamically mapped tasks with templates, which makes it easier to search through mapped task instances.
* External XCom backends can now be configured to use object storage.
* Delivered several significant improvements to the Airflow UI. For example, you can now filter, view, and create datasets through the Airflow UI.
* New Listener API methods are considered stable and suitable for use in production.
* Added the ability to automatically pause a dag after a pre-defined number of sequentially failed runs.
* Dataset URIs are validated when you enter them, and must conform to the rules set in AIP-60. See the [Dataset documentation](https://airflow.apache.org/docs/apache-airflow/stable/authoring-and-scheduling/datasets.html) for more information.
For more information about the major changes in this release, see the [Airflow Blog](https://airflow.apache.org/blog/airflow-2.9.0/) or the [Airflow release notes](https://airflow.apache.org/docs/apache-airflow/2.9.0/release_notes.html#airflow-2-9-0-2024-04-08).
#### Upgrade to Python 3.12
Airflow now supports Python 3.12. However, [Pendulum](https://pendulum.eustace.io/) 2 does not support Python 3.12. If you upgrade to Python 3.12 and want to use Airflow, you also need to upgrade to Pendulum 3.
Refer to the [Airflow release notes](https://airflow.apache.org/docs/apache-airflow/2.9.0/release_notes.html#official-support-for-python-3-12-38025) for more information about any limitations in Python 3.12 support.
#### Bug fixes
* Fixed a bug where after a task failed, and no longer exists in a dag, you can now still access details about the dag in the Grid View of the Airflow UI.
* Fixed a bug where Airflow would show `failed_upstream` when a dynamically mapped task was `skipped`.
* In the Python task decorator, you can only have `None` as the default parameter for context parameters.