Releasing security patches¶
Apache Airflow® uses a consistent and predictable approach for releasing security patches - both for the Apache Airflow package and Apache Airflow providers (security patches in providers are treated separately from security patches in Airflow core package).
Releasing Airflow with security patches¶
Apache Airflow uses a strict SemVer versioning policy, which means that we strive for
any release of a given MAJOR
Version (version “2” currently) to be backwards compatible. When we
release a MINOR
version, the development continues in the main
branch where we prepare the next
MINOR
version, but we release PATCHLEVEL
releases with selected bugfixes (including security
bugfixes) cherry-picked to the latest released MINOR
line of Apache Airflow. At the moment, when we
release a new MINOR
version, we stop releasing PATCHLEVEL
releases for the previous MINOR
version.
For example, once we released 2.6.0
version on April 30, 2023 all the security patches will be cherry-picked and released in 2.6.*
versions until we release 2.7.0
version. There will be no
2.5.*
versions released after 2.6.0
has been released.
This means that in order to apply security fixes in Apache Airflow, you
MUST upgrade to the latest MINOR
and PATCHLEVEL
version of Airflow.
Releasing Airflow providers with security patches¶
Similarly to Airflow, providers uses a strict SemVer versioning policy, and the same
policies apply for providers as for Airflow itself. This means that you need to upgrade to the latest
MINOR
and PATCHLEVEL
version of the provider to get the latest security fixes.
Airflow providers are released independently from Airflow itself and the information about vulnerabilities
is published separately. You can upgrade providers independently from Airflow itself, following the
instructions found in Managing providers separately from Airflow core.