Skip to content

chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.0#63065

Merged
potiuk merged 1 commit intomainfrom
dependabot/github_actions/actions/download-artifact-8.0.0
Mar 8, 2026
Merged

chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.0#63065
potiuk merged 1 commit intomainfrom
dependabot/github_actions/actions/download-artifact-8.0.0

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 7, 2026

Bumps actions/download-artifact from 4.3.0 to 8.0.0.

Release notes

Sourced from actions/download-artifact's releases.

v8.0.0

v8 - What's new

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to false.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

v6.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

... (truncated)

Commits
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • bd7976b Add a setting to specify what to do on hash mismatch and default it to error
  • ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
  • 15999bf Add note about package bumps
  • 974686e Bump the version to v8 and add release notes
  • fbe48b1 Update test names to make it clearer what they do
  • 96bf374 One more test fix
  • b8c4819 Fix skip decompress test
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Mar 7, 2026
@dependabot dependabot bot requested a review from potiuk as a code owner March 7, 2026 20:58
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Mar 7, 2026
@dependabot dependabot bot added the github_actions Pull requests that update GitHub Actions code label Mar 7, 2026
@boring-cyborg boring-cyborg bot added area:dev-tools backport-to-v3-1-test Mark PR with this label to backport to v3-1-test branch labels Mar 7, 2026
@potiuk potiuk added the backport-to-v2-11-test Mark PR with this label to backport to v2-11-test branch label Mar 7, 2026
@potiuk potiuk force-pushed the dependabot/github_actions/actions/download-artifact-8.0.0 branch from 1b63b89 to ac1d63d Compare March 7, 2026 21:58
@potiuk
Copy link
Member

potiuk commented Mar 7, 2026

I fixed ( I think) the issue with different teratment of patterns in the new version.

@potiuk potiuk force-pushed the dependabot/github_actions/actions/download-artifact-8.0.0 branch from ac1d63d to 400cf75 Compare March 7, 2026 22:32
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.3.0 to 8.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@d3f86a1...70fc10c)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@potiuk potiuk force-pushed the dependabot/github_actions/actions/download-artifact-8.0.0 branch from 400cf75 to 78137a6 Compare March 8, 2026 15:12
@potiuk
Copy link
Member

potiuk commented Mar 8, 2026

Already fixed in main.

@potiuk potiuk merged commit 2f4646c into main Mar 8, 2026
128 of 130 checks passed
@potiuk potiuk deleted the dependabot/github_actions/actions/download-artifact-8.0.0 branch March 8, 2026 18:02
@github-actions
Copy link

github-actions bot commented Mar 8, 2026

Backport failed to create: v2-11-test. View the failure log Run details

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status Branch Result
v2-11-test Commit Link

You can attempt to backport this manually by running:

cherry_picker 2f4646c v2-11-test

This should apply the commit to the v2-11-test branch and leave the commit in conflict state marking
the files that need manual conflict resolution.

After you have resolved the conflicts, you can continue the backport process by running:

cherry_picker --continue

If you don't have cherry-picker installed, see the installation guide.

@github-actions
Copy link

github-actions bot commented Mar 8, 2026

Backport failed to create: v3-1-test. View the failure log Run details

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status Branch Result
v3-1-test Commit Link

You can attempt to backport this manually by running:

cherry_picker 2f4646c v3-1-test

This should apply the commit to the v3-1-test branch and leave the commit in conflict state marking
the files that need manual conflict resolution.

After you have resolved the conflicts, you can continue the backport process by running:

cherry_picker --continue

If you don't have cherry-picker installed, see the installation guide.

potiuk pushed a commit that referenced this pull request Mar 8, 2026
… 8.0.0 (#63065)

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.3.0 to 8.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@d3f86a1...70fc10c)
(cherry picked from commit 2f4646c)

Co-authored-by: Dependabot [bot] <49699333+dependabot[bot]@users.noreply.github.com>

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
potiuk added a commit that referenced this pull request Mar 8, 2026
… 8.0.0 (#63065) (#63145)

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.3.0 to 8.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@d3f86a1...70fc10c)
(cherry picked from commit 2f4646c)



---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
wjddn279 pushed a commit to wjddn279/airflow that referenced this pull request Mar 9, 2026
…he#63065)

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.3.0 to 8.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@d3f86a1...70fc10c)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
vatsrahul1001 pushed a commit that referenced this pull request Mar 10, 2026
… 8.0.0 (#63065) (#63145)

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.3.0 to 8.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@d3f86a1...70fc10c)
(cherry picked from commit 2f4646c)



---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
pierrejeambrun added a commit that referenced this pull request Mar 10, 2026
* fix: Unhandled Exception in remote logging if connection doesn't exist(#59801) (#62979)

Cherry-picked from 3428dc9 with conflict resolution:
- context.py: Added `import inspect` (skip `import functools` as `from functools import cache` already exists)
- supervisor.py: Adopted early-return pattern and explicit `del` for GC, kept simpler env var handling (no `_AIRFLOW_PROCESS_CONTEXT` which doesn't exist in v3-1-test)
- test_supervisor.py: Replaced `@pytest.mark.xfail` workaround with proper `use_real_secrets_backends` fixture

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* CI: Upgrade important CI environment (#62981)

* chore(deps-dev): bump the core-ui-package-updates group across 1 directory with 3 updates (#62968)

Bumps the core-ui-package-updates group with 1 update in the /airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui directory: [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin).


Updates `@typescript-eslint/eslint-plugin` from 8.50.0 to 8.56.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.56.1/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.50.0 to 8.56.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.56.1/packages/parser)

Updates `ts-morph` from 23.0.0 to 27.0.2
- [Release notes](https://github.com/dsherret/ts-morph/releases)
- [Commits](dsherret/ts-morph@23.0.0...27.0.2)

---
updated-dependencies:
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.56.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: core-ui-package-updates
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.56.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: core-ui-package-updates
- dependency-name: ts-morph
  dependency-version: 27.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: core-ui-package-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [v3-1-test] fix: gracefully handle 404 from worker log server for historical retry attempts (#62475) (#63000)

* fix: gracefully handle 404 from worker log server for historical retry attempts
(cherry picked from commit 25e9284)

Co-authored-by: Pradeep Kalluri <128097794+kalluripradeep@users.noreply.github.com>

* [v3-1-test] Remove issue_number option from newsfragment guidance in PR template (#63006) (#63012)

The CI workflow added in #62975 validates that newsfragment filenames use
the PR number, so allowing issue numbers would cause false CI failures.
Align the PR template with the contributing docs and the new validation.
(cherry picked from commit 41969f4)

Co-authored-by: Xiaodong DENG <xddeng@apache.org>

* [v3-1-test] CI: Upgrade important CI environment (#62989) (#63005)

* [v3-1-test] CI: Upgrade important CI environment (#62989)
(cherry picked from commit 60b52b7)

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

* Fix rebase

---------

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

* [v3-1-test] Align integration LocalStack docker-compose with e2e LocalStack config (#62980) (#62993)

(cherry picked from commit 6722c4b)

Co-authored-by: Jason(Zhe-You) Liu <68415893+jason810496@users.noreply.github.com>

* [v3-1-test] Fallback to no constraint builds for docker-context-files installation (#63051) (#63057)

When building PROD from docker-context-files - i.e. when we run main
build with providers built from sources, we should fall back to
no constraints build when there is a conflict with constraints.

This is a follow up after #62378
(cherry picked from commit fef2e62)

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

* Fill Turkish Translation Gap in v3-1-test (#63010)

* Remove global from FastAPI app.py (#59772) (#62997)

* Remove global from FastAPI app.py

* Remove global from FastAPI app.py

Co-authored-by: Jens Scheffler <95105677+jscheffl@users.noreply.github.com>

* chore(deps): bump actions/setup-java from 4.7.1 to 5.2.0 (#63102)

Bumps [actions/setup-java](https://github.com/actions/setup-java) from 4.7.1 to 5.2.0.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@c5195ef...be666c2)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump actions/stale from 9.1.0 to 10.2.0 (#63099)

Bumps [actions/stale](https://github.com/actions/stale) from 9.1.0 to 10.2.0.
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@5bef64f...b5d41d4)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-version: 10.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump actions/checkout from 4.2.2 to 6.0.2 (#63096)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11bd719...de0fac2)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump actions/setup-python from 5.6.0 to 6.2.0 (#63098)

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.6.0 to 6.2.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@a26af69...a309ff8)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump actions/github-script from 7.0.1 to 8.0.0 (#63090)

Bumps [actions/github-script](https://github.com/actions/github-script) from 7.0.1 to 8.0.0.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@60a0d83...ed59741)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [v3-1-test] Split npm dependabot minor+patch and major version PRs (#62889) (#63007)

* Ignore major npm dependabot upgrades

* Move major versions to different group
(cherry picked from commit a2e3613)

Co-authored-by: Brent Bovenzi <brent@astronomer.io>

* chore(deps): bump the core-ui-package-updates group across 1 directory with 2 updates (#63069)

Bumps the core-ui-package-updates group with 2 updates in the /airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui directory: [@chakra-ui/react](https://github.com/chakra-ui/chakra-ui/tree/HEAD/packages/react) and [happy-dom](https://github.com/capricorn86/happy-dom).

Updates `@chakra-ui/react` from 3.33.0 to 3.34.0
- [Release notes](https://github.com/chakra-ui/chakra-ui/releases)
- [Changelog](https://github.com/chakra-ui/chakra-ui/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/chakra-ui/chakra-ui/commits/@chakra-ui/react@3.34.0/packages/react)

Updates `happy-dom` from 20.7.0 to 20.8.3
- [Release notes](https://github.com/capricorn86/happy-dom/releases)
- [Commits](capricorn86/happy-dom@v20.7.0...v20.8.3)

---
updated-dependencies:
- dependency-name: "@chakra-ui/react"
  dependency-version: 3.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: core-ui-package-updates
- dependency-name: happy-dom
  dependency-version: 20.8.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: core-ui-package-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.0 (#63128)

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...bbbca2d)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump actions/setup-go from 5.5.0 to 6.3.0 (#63124)

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.5.0 to 6.3.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@d35c59a...4b73464)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump aws-actions/configure-aws-credentials (#63123)

Bumps [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) from 4.0.1 to 6.0.0.
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](aws-actions/configure-aws-credentials@010d0da...8df5847)

---
updated-dependencies:
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump actions/setup-node from 4.4.0 to 6.3.0 (#63119)

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4.4.0 to 6.3.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@49933ea...53b8394)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [v3-1-test] chore(deps): bump actions/setup-go from 5.5.0 to 6.3.0 (#63133) (#63138)

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.5.0 to 6.3.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@d35c59a...4b73464)
(cherry picked from commit 274c2b0)



---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [v3-1-test] chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.0 (#63065) (#63145)

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.3.0 to 8.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@d3f86a1...70fc10c)
(cherry picked from commit 2f4646c)



---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump the github-actions-updates group with 2 updates (#63157)

Bumps the github-actions-updates group with 2 updates: [pnpm/action-setup](https://github.com/pnpm/action-setup) and [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action).


Updates `pnpm/action-setup` from 4.0.0 to 4.2.0
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@fe02b34...41ff726)

Updates `slackapi/slack-github-action` from 2.0.0 to 2.1.1
- [Release notes](https://github.com/slackapi/slack-github-action/releases)
- [Commits](slackapi/slack-github-action@485a9d4...91efab1)

---
updated-dependencies:
- dependency-name: pnpm/action-setup
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-updates
- dependency-name: slackapi/slack-github-action
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [v3-1-test] perf: use load_only() in get_dag_runs eager loading to reduce data fetched per task instance (#62482) (#62996)

* perf: use load_only() in eager_load_dag_run_for_validation to reduce data fetched

The get_dag_runs API endpoint was slow on large deployments because
eager_load_dag_run_for_validation() used selectinload on task_instances and
task_instances_histories without restricting which columns were fetched.
This caused SQLAlchemy to load all heavyweight columns (executor_config with
pickled data, hostname, rendered fields, etc.) for every task instance across
every DAG run in the result page — even though only dag_version_id is needed
to traverse the association proxy to DagVersion.

Add load_only(TaskInstance.dag_version_id) and
load_only(TaskInstanceHistory.dag_version_id) to the selectinload chains so
the SELECT for task instances fetches only the identity columns and the FK
needed to resolve the dag_version relationship, significantly reducing the
volume of data transferred from the database on busy deployments.

Fixes #62025

* Fix static checks

---------
(cherry picked from commit 13af96b)

Co-authored-by: Lakshmi Sravya <38032391+LakshmiSravyaVedantham@users.noreply.github.com>
Co-authored-by: pierrejeambrun <pierrejbrun@gmail.com>

* perf(api): optimize /ui/dags endpoint serialization (#61483) (#63001)

This PR addresses a significant performance issue in the /ui/dags endpoint
where page load times scaled poorly with the number of DAGs (12-16 seconds
for just 25 DAGs in our testing).

Two optimizations are implemented:

1. Cache URLSafeSerializer for file_token generation
   - Previously, a new URLSafeSerializer was instantiated and
     conf.get_mandatory_value() was called for every DAG
   - Now uses @lru_cache to create the serializer once and reuse it

2. Eliminate redundant Pydantic validation in response construction
   - The original pattern used model_validate -> model_dump -> model_validate
     which caused triple serialization overhead per DAG
   - Now validates once with DAGResponse.model_validate(), then uses
     model_construct() to build DAGWithLatestDagRunsResponse

Together, these changes reduced page load time from 12-16 seconds to
~130ms in our dev environment.


(cherry picked from commit a915216)

Co-authored-by: john-rodriguez-mgni <107643943+john-rodriguez-mgni@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

* [v3-1-test] Bump astroid>=4 (#63170) (#63174)

(cherry picked from commit 0a985ea)

Co-authored-by: Elad Kalif <45845474+eladkal@users.noreply.github.com>

* chore(deps): bump the core-ui-package-updates group across 1 directory with 2 updates (#63153)

Bumps the core-ui-package-updates group with 1 update in the /airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui directory: [@chakra-ui/react](https://github.com/chakra-ui/chakra-ui/tree/HEAD/packages/react).


Updates `@chakra-ui/react` from 3.33.0 to 3.34.0
- [Release notes](https://github.com/chakra-ui/chakra-ui/releases)
- [Changelog](https://github.com/chakra-ui/chakra-ui/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/chakra-ui/chakra-ui/commits/@chakra-ui/react@3.34.0/packages/react)

Updates `happy-dom` from 20.7.0 to 20.8.3
- [Release notes](https://github.com/capricorn86/happy-dom/releases)
- [Commits](capricorn86/happy-dom@v20.7.0...v20.8.3)

---
updated-dependencies:
- dependency-name: "@chakra-ui/react"
  dependency-version: 3.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: core-ui-package-updates
- dependency-name: happy-dom
  dependency-version: 20.8.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: core-ui-package-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [v3-1-test] Further limit setuptools after 82.0.1 is released (until redoc fixes it) (#63202) (#63203)

(cherry picked from commit b528e50)

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

* Fix race condition in auth manager initialization (#62431) (#62995)

FAB FastAPI routes call get_application_builder() on every request,
which creates a new Flask app and invokes init_app(). Concurrent calls
race on the singleton auth_manager's appbuilder and security_manager,
causing KeyError: 'AUTH_USER_REGISTRATION' and AttributeError.

Add _init_app_lock around the critical section in init_app() that
mutates the singleton auth_manager state and registers views, so
concurrent get_application_builder() calls are serialized.

Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com>

* chore(deps): bump github/codeql-action (#63223)

Bumps the github-actions-updates group with 1 update: [github/codeql-action](https://github.com/github/codeql-action).


Updates `github/codeql-action` from 3.29.0 to 4.32.6
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@ce28f5b...0d579ff)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.32.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* [v3-1-test] Clarify docs on max_active_tasks parameter on a Dag (#63217) (#63228)

(cherry picked from commit 9ae1875)

Co-authored-by: Jens Scheffler <95105677+jscheffl@users.noreply.github.com>

* [v3-1-test] Fix undefined variable in install_from_external_spec error message (#63233) (#63237)

The error message in install_from_external_spec() referenced
${INSTALLATION_METHOD} which does not exist — the correct variable
is ${AIRFLOW_INSTALLATION_METHOD}. With set -u active, hitting this
error path would crash with an "unbound variable" error instead of
printing the intended user-friendly message.

The typo was introduced in a1717a6 and carried forward into the
inlined copies in both Dockerfiles.
(cherry picked from commit 2ab6f94)

Co-authored-by: Xiaodong DENG <xddeng@apache.org>

* Fix grid view URL for dynamic task groups (#63205)

Dynamic task groups with isMapped=true were getting /mapped appended
to their URL in the grid view, producing URLs like
/tasks/group/{groupId}/mapped which has no matching route (404).

The graph view correctly handles this by not appending /mapped for groups.
This fix adds the same guard to buildTaskInstanceUrl.

closes: #63197
(cherry picked from commit 7bc23ef)

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Dev-iL <6509619+Dev-iL@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Wei Lee <weilee.rx@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Pradeep Kalluri <128097794+kalluripradeep@users.noreply.github.com>
Co-authored-by: Xiaodong DENG <xddeng@apache.org>
Co-authored-by: Bugra Ozturk <bugraoz93@users.noreply.github.com>
Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
Co-authored-by: Jason(Zhe-You) Liu <68415893+jason810496@users.noreply.github.com>
Co-authored-by: Vincent <97131062+vincbeck@users.noreply.github.com>
Co-authored-by: Jens Scheffler <95105677+jscheffl@users.noreply.github.com>
Co-authored-by: Brent Bovenzi <brent@astronomer.io>
Co-authored-by: Lakshmi Sravya <38032391+LakshmiSravyaVedantham@users.noreply.github.com>
Co-authored-by: john-rodriguez-mgni <107643943+john-rodriguez-mgni@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Elad Kalif <45845474+eladkal@users.noreply.github.com>
Co-authored-by: Young-Ki Kim <kimyoungi99@naver.com>
Co-authored-by: Subham <subhamsangwan26@gmail.com>
dominikhei pushed a commit to dominikhei/airflow that referenced this pull request Mar 11, 2026
…he#63065)

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.3.0 to 8.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@d3f86a1...70fc10c)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Pyasma pushed a commit to Pyasma/airflow that referenced this pull request Mar 13, 2026
…he#63065)

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.3.0 to 8.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@d3f86a1...70fc10c)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:dev-tools backport-to-v2-11-test Mark PR with this label to backport to v2-11-test branch backport-to-v3-1-test Mark PR with this label to backport to v3-1-test branch dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants