Skip to content

v2.2.0

Choose a tag to compare

View all tags
@muditbhargava66 muditbhargava66 released this 18 Apr 16:54
· 18 commits to main since this release
version-2.2.0
77fb453

Overview

Version 2.2.0 resolves 20+ Dependabot vulnerabilities targeting the apache-airflow dependency tree.

Security Fixes

Updated apache-airflow from >=3.1.7 to >=3.2.0 to address three critical upstream vulnerabilities:

  • CVE-2025-57735: Invalidated JWT session tokens persisting post-logout.
  • CVE-2026-33858: Mitigated arbitrary code execution risks via legacy XCom API unsafe deserialization.
  • CVE-2025-54550: Patched a race condition enabling remote code execution.

Dependency Updates & Transitive Remediation

  • Transitive CVE Extermination: Executed an aggressive native uv lock --upgrade systematically patching exactly 18 downstream Dependabot vulnerabilities clustered inside nested topological transients.
  • Removed the strict upper bound (<0.118.0) on fastapi inside pyproject.toml to satisfy the new Airflow requirements.
  • Re-generated uv.lock and requirements.txt to enforce the updated dependency map globally.

Testing Integrity

  • 100% of integration and unit tests pass with the updated constraints.
Assets 2
Loading