Skip to content

chore(deps): bump the pip group across 12 directories with 7 updates#19

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/bigquery/bqml/pip-8b7481c148
Open

chore(deps): bump the pip group across 12 directories with 7 updates#19
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/bigquery/bqml/pip-8b7481c148

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 16, 2024

Copy link
Copy Markdown

Bumps the pip group with 1 update in the /bigquery/bqml directory: pyarrow.
Bumps the pip group with 2 updates in the /bigquery/datalab-migration directory: pyarrow and grpcio.
Bumps the pip group with 2 updates in the /bigquery/pandas-gbq-migration directory: pyarrow and grpcio.
Bumps the pip group with 1 update in the /codelabs/flex_and_vision directory: gunicorn.
Bumps the pip group with 5 updates in the /composer/cicd_sample directory:

Package From To
pyarrow 3.0.0 14.0.1
grpcio 1.38.1 1.53.2
gunicorn 20.1.0 22.0.0
apache-airflow 2.1.2 2.9.0
cryptography 3.4.7 42.0.4

Bumps the pip group with 5 updates in the /composer/workflows directory:

Package From To
pyarrow 3.0.0 14.0.1
grpcio 1.38.1 1.53.2
gunicorn 20.1.0 22.0.0
apache-airflow 2.2.2 2.9.0
cryptography 3.4.7 42.0.4

Bumps the pip group with 1 update in the /compute/encryption directory: cryptography.
Bumps the pip group with 1 update in the /data-science-onramp/data-processing directory: pyarrow.
Bumps the pip group with 2 updates in the /iap directory: gunicorn and cryptography.
Bumps the pip group with 2 updates in the /kubernetes_engine/django_tutorial directory: gunicorn and django.
Bumps the pip group with 1 update in the /media/transcoder directory: grpcio.
Bumps the pip group with 1 update in the /people-and-planet-ai/image-classification directory: pillow.

Updates pyarrow from 6.0.1 to 14.0.1

Commits

Updates pyarrow from 6.0.1 to 14.0.1

Commits

Updates grpcio from 1.42.0 to 1.53.2

Release notes

Sourced from grpcio's releases.

Release v1.53.2

This is release gRPC Core 1.53.2 (glockenspiel).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

Core

Release v1.53.1

This is release gRPC Core 1.53.1 (glockenspiel).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

Release v1.53.0

This is release 1.53.0 (glockenspiel) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

  • xDS: fix crash when removing the last endpoint from the last locality in weighted_target. (#32592)
  • filter stack: pass peer name up via recv_initial_metadata batch. (#31933)
  • [EventEngine] Add advice against blocking work in callbacks. (#32397)
  • [http2] Dont drop connections on metadata limit exceeded. (#32309)
  • xDS: reject aggregate cluster with empty cluster list. (#32238)
  • Fix Python epoll1 Fork Support. (#32196)
  • server: introduce ServerMetricRecorder API and move per-call reporting from a C++ interceptor to a C-core filter. (#32106)
  • [EventEngine] Add invalid handle types to the public API. (#32202)
  • [EventEngine] Refactoring the EventEngine Test Suite: Part 1. (#32127)
  • xDS: fix WeightedClusters total weight handling. (#32134)

C++

  • Update minimum MSVC version to 2019. (#32615)
  • Use CMake variables for paths in pkg-config files. (#31671)

... (truncated)

Changelog

Sourced from grpcio's changelog.

gRPC Release Schedule

Below is the release schedule for gRPC Java, Go and Core and its dependent languages C++, C#, Objective-C, PHP, Python and Ruby.

Releases are scheduled every six weeks on Tuesdays on a best effort basis. In some unavoidable situations a release may be delayed or released early or a language may skip a release altogether and do the next release to catch up with other languages. See the past releases in the links above. A six-week cycle gives us a good balance between delivering new features/fixes quickly and keeping the release overhead low.

The gRPC release support policy can be found here.

Releases are cut from release branches. For Core and Java repos, the release branch is cut two weeks before the scheduled release date. For Go, the branch is cut just before the release. An RC (release candidate) is published for Core and its dependent languages just after the branch cut. This RC is later promoted to release version if no further changes are made to the release branch. We do our best to keep head of master branch stable at all times regardless of release schedule. Daily build packages from master branch for C#, PHP, Python, Ruby and Protoc plugins are published on packages.grpc.io. If you depend on gRPC in production we recommend to set up your CI system to test the RCs and, if possible, the daily builds.

Names of gRPC releases are here.

Release Scheduled Branch Cut Scheduled Release Date
v1.17.0 Nov 19, 2018 Dec 4, 2018
v1.18.0 Jan 2, 2019 Jan 15, 2019
v1.19.0 Feb 12, 2019 Feb 26, 2019
v1.20.0 Mar 26, 2019 Apr 9, 2019
v1.21.0 May 7, 2019 May 21, 2019
v1.22.0 Jun 18, 2019 Jul 2, 2019
v1.23.0 Jul 30, 2019 Aug 13, 2019
v1.24.0 Sept 10, 2019 Sept 24, 2019
v1.25.0 Oct 22, 2019 Nov 5, 2019
v1.26.0 Dec 3, 2019 Dec 17, 2019
v1.27.0 Jan 14, 2020 Jan 28, 2020
v1.28.0 Feb 25, 2020 Mar 10, 2020
v1.29.0 Apr 7, 2020 Apr 21, 2020
v1.30.0 May 19, 2020 Jun 2, 2020
v1.31.0 Jul 14, 2020 Jul 28, 2020
v1.32.0 Aug 25, 2020 Sep 8, 2020
v1.33.0 Oct 6, 2020 Oct 20, 2020
v1.34.0 Nov 17, 2020 Dec 1, 2020
v1.35.0 Dec 29, 2020 Jan 12, 2021
v1.36.0 Feb 9, 2021 Feb 23, 2021
v1.37.0 Mar 23, 2021 Apr 6, 2021
v1.38.0 May 4, 2021 May 18, 2021
v1.39.0 Jun 15, 2021 Jun 29, 2021
v1.40.0 Jul 27, 2021 Aug 10, 2021
v1.41.0 Sep 7, 2021 Sep 21, 2021
Commits
  • afb307f [v1.53.x][Interop] Backport Python image update (#33864)
  • 7a9373b [Backport] [dependency] Restrict cython to less than 3.X (#33770)
  • fdb64a6 [v1.53][Build] Update Phusion baseimage (#33767) (#33836)
  • cdf4186 [PSM Interop] Legacy tests: fix xDS test client build (v1.53.x backport) (#33...
  • ce5b93a [PSM Interop] Legacy test builds always pull the driver from master (v1.53.x ...
  • b24b6ea [release] Bump release version to 1.53.2 (#33709)
  • 1e86ca5 [backport][iomgr][EventEngine] Improve server handling of file descriptor exh...
  • aff3066 [PSM interop] Don't fail url_map target if sub-target already failed (v1.53.x...
  • 539d75c [PSM interop] Don't fail target if sub-target already failed (#33222) (v1.53....
  • 3e79c88 [Release] Bump version to 1.53.1 (on v1.53.x branch) (#33047)
  • Additional commits viewable in compare view

Updates pyarrow from 6.0.1 to 14.0.1

Commits

Updates grpcio from 1.42.0 to 1.53.2

Release notes

Sourced from grpcio's releases.

Release v1.53.2

This is release gRPC Core 1.53.2 (glockenspiel).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

Core

Release v1.53.1

This is release gRPC Core 1.53.1 (glockenspiel).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

Release v1.53.0

This is release 1.53.0 (glockenspiel) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

  • xDS: fix crash when removing the last endpoint from the last locality in weighted_target. (#32592)
  • filter stack: pass peer name up via recv_initial_metadata batch. (#31933)
  • [EventEngine] Add advice against blocking work in callbacks. (#32397)
  • [http2] Dont drop connections on metadata limit exceeded. (#32309)
  • xDS: reject aggregate cluster with empty cluster list. (#32238)
  • Fix Python epoll1 Fork Support. (#32196)
  • server: introduce ServerMetricRecorder API and move per-call reporting from a C++ interceptor to a C-core filter. (#32106)
  • [EventEngine] Add invalid handle types to the public API. (#32202)
  • [EventEngine] Refactoring the EventEngine Test Suite: Part 1. (#32127)
  • xDS: fix WeightedClusters total weight handling. (#32134)

C++

  • Update minimum MSVC version to 2019. (#32615)
  • Use CMake variables for paths in pkg-config files. (#31671)

... (truncated)

Changelog

Sourced from grpcio's changelog.

gRPC Release Schedule

Below is the release schedule for gRPC Java, Go and Core and its dependent languages C++, C#, Objective-C, PHP, Python and Ruby.

Releases are scheduled every six weeks on Tuesdays on a best effort basis. In some unavoidable situations a release may be delayed or released early or a language may skip a release altogether and do the next release to catch up with other languages. See the past releases in the links above. A six-week cycle gives us a good balance between delivering new features/fixes quickly and keeping the release overhead low.

The gRPC release support policy can be found here.

Releases are cut from release branches. For Core and Java repos, the release branch is cut two weeks before the scheduled release date. For Go, the branch is cut just before the release. An RC (release candidate) is published for Core and its dependent languages just after the branch cut. This RC is later promoted to release version if no further changes are made to the release branch. We do our best to keep head of master branch stable at all times regardless of release schedule. Daily build packages from master branch for C#, PHP, Python, Ruby and Protoc plugins are published on packages.grpc.io. If you depend on gRPC in production we recommend to set up your CI system to test the RCs and, if possible, the daily builds.

Names of gRPC releases are here.

Release Scheduled Branch Cut Scheduled Release Date
v1.17.0 Nov 19, 2018 Dec 4, 2018
v1.18.0 Jan 2, 2019 Jan 15, 2019
v1.19.0 Feb 12, 2019 Feb 26, 2019
v1.20.0 Mar 26, 2019 Apr 9, 2019
v1.21.0 May 7, 2019 May 21, 2019
v1.22.0 Jun 18, 2019 Jul 2, 2019
v1.23.0 Jul 30, 2019 Aug 13, 2019
v1.24.0 Sept 10, 2019 Sept 24, 2019
v1.25.0 Oct 22, 2019 Nov 5, 2019
v1.26.0 Dec 3, 2019 Dec 17, 2019
v1.27.0 Jan 14, 2020 Jan 28, 2020
v1.28.0 Feb 25, 2020 Mar 10, 2020
v1.29.0 Apr 7, 2020 Apr 21, 2020
v1.30.0 May 19, 2020 Jun 2, 2020
v1.31.0 Jul 14, 2020 Jul 28, 2020
v1.32.0 Aug 25, 2020 Sep 8, 2020
v1.33.0 Oct 6, 2020 Oct 20, 2020
v1.34.0 Nov 17, 2020 Dec 1, 2020
v1.35.0 Dec 29, 2020 Jan 12, 2021
v1.36.0 Feb 9, 2021 Feb 23, 2021
v1.37.0 Mar 23, 2021 Apr 6, 2021
v1.38.0 May 4, 2021 May 18, 2021
v1.39.0 Jun 15, 2021 Jun 29, 2021
v1.40.0 Jul 27, 2021 Aug 10, 2021
v1.41.0 Sep 7, 2021 Sep 21, 2021
Commits
  • afb307f [v1.53.x][Interop] Backport Python image update (#33864)
  • 7a9373b [Backport] [dependency] Restrict cython to less than 3.X (#33770)
  • fdb64a6 [v1.53][Build] Update Phusion baseimage (#33767) (#33836)
  • cdf4186 [PSM Interop] Legacy tests: fix xDS test client build (v1.53.x backport) (#33...
  • ce5b93a [PSM Interop] Legacy test builds always pull the driver from master (v1.53.x ...
  • b24b6ea [release] Bump release version to 1.53.2 (#33709)
  • 1e86ca5 [backport][iomgr][EventEngine] Improve server handling of file descriptor exh...
  • aff3066 [PSM interop] Don't fail url_map target if sub-target already failed (v1.53.x...
  • 539d75c [PSM interop] Don't fail target if sub-target already failed (#33222) (v1.53....
  • 3e79c88 [Release] Bump version to 1.53.1 (on v1.53.x branch) (#33047)
  • Additional commits viewable in compare view

Updates gunicorn from 20.0.4 to 22.0.0

Release notes

Sourced from gunicorn's releases.

Gunicorn 22.0 has been released

Gunicorn 22.0.0 has been released. This version fix the numerous security vulnerabilities. You're invited to upgrade asap your own installation.

Changes:

22.0.0 - 2024-04-17
===================

    

  • use utime to notify workers liveness
    • 

  • migrate setup to pyproject.toml
    • 

  • fix numerous security vulnerabilities in HTTP parser (closing some request smuggling vectors)
    • 

  • parsing additional requests is no longer attempted past unsupported request framing
    • 

  • on HTTP versions < 1.1 support for chunked transfer is refused (only used in exploits)
    • 

  • requests conflicting configured or passed SCRIPT_NAME now produce a verbose error
    • 

  • Trailer fields are no longer inspected for headers indicating secure scheme
    • 

  • support Python 3.12
    • 



** Breaking changes **


    

  • minimum version is Python 3.7
    • 

  • the limitations on valid characters in the HTTP method have been bounded to Internet Standards
    • 

  • requests specifying unsupported transfer coding (order) are refused by default (rare)
    • 

  • HTTP methods are no longer casefolded by default (IANA method registry contains none affected)
    • 

  • HTTP methods containing the number sign (#) are no longer accepted by default (rare)
    • 

  • HTTP versions < 1.0 or >= 2.0 are no longer accepted by default (rare, only HTTP/1.1 is supported)
    • 

  • HTTP versions consisting of multiple digits or containing a prefix/suffix are no longer accepted
    • 

  • HTTP header field names Gunicorn cannot safely map to variables are silently dropped, as in other software
    • 

  • HTTP headers with empty field name are refused by default (no legitimate use cases, used in exploits)
    • 

  • requests with both Transfer-Encoding and Content-Length are refused by default (such a message might indicate an attempt to perform request smuggling)
    • 

  • empty transfer codings are no longer permitted (reportedly seen with really old & broken proxies)
    • 



** SECURITY **


    

  • fix CVE-2024-1135
  1. Documentation is available there: https://docs.gunicorn.org/en/stable/news.html
  2. Packages: https://pypi.org/project/gunicorn/

Gunicorn 21.2.0 has been released

Gunicorn 21.2.0 has been released. This version fix the issue introduced in the threaded worker.

Changes:

21.2.0 - 2023-07-19
===================
fix thread worker: revert change considering connection as idle .
</tr></table>

... (truncated)

Commits
  • f63d59e bump to 22.0
  • 4ac81e0 Merge pull request #3175 from e-kwsm/typo
  • 401cecf Merge pull request #3179 from dhdaines/exclude-eventlet-0360
  • 0243ec3 fix(deps): exclude eventlet 0.36.0
  • 628a0bc chore: fix typos
  • 88fc4a4 Merge pull request #3131 from pajod/patch-py12-rebased
  • deae2fc CI: back off the agressive timeout
  • f470382 docs: promise 3.12 compat
  • 5e30bfa add changelog to project.urls (updated for PEP621)
  • 481c3f9 remove setup.cfg - overridden by pyproject.toml
  • Additional commits viewable in compare view

Updates pyarrow from 3.0.0 to 14.0.1

Commits

Updates grpcio from 1.38.1 to 1.53.2

Release notes

Sourced from grpcio's releases.

Release v1.53.2

This is release gRPC Core 1.53.2 (glockenspiel).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

Core

Release v1.53.1

This is release gRPC Core 1.53.1 (glockenspiel).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

Release v1.53.0

This is release 1.53.0 (glockenspiel) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

  • xDS: fix crash when removing the last endpoint from the last locality in weighted_target. (#32592)
  • filter stack: pass peer name up via recv_initial_metadata batch. (#31933)
  • [EventEngine] Add advice against blocking work in callbacks. (#32397)
  • [http2] Dont drop connections on metadata limit exceeded. (#32309)
  • xDS: reject aggregate cluster with empty cluster list. (#32238)
  • Fix Python epoll1 Fork Support. (#32196)
  • server: introduce ServerMetricRecorder API and move per-call reporting from a C++ interceptor to a C-core filter. (#32106)
  • [EventEngine] Add invalid handle types to the public API. (#32202)
  • [EventEngine] Refactoring the EventEngine Test Suite: Part 1. (#32127)
  • xDS: fix WeightedClusters total weight handling. (#32134)

C++

  • Update minimum MSVC version to 2019. (#32615)
  • Use CMake variables for paths in pkg-config files. (#31671)

... (truncated)

Changelog

Sourced from grpcio's changelog.

gRPC Release Schedule

Below is the release schedule for gRPC Java, Go and Core and its dependent languages C++, C#, Objective-C, PHP, Python and Ruby.

Releases are scheduled every six weeks on Tuesdays on a best effort basis. In some unavoidable situations a release may be delayed or released early or a language may skip a release altogether and do the next release to catch up with other languages. See the past releases in the links above. A six-week cycle gives us a good balance between delivering new features/fixes quickly and keeping the release overhead low.

The gRPC release support policy can be found here.

Releases are cut from release branches. For Core and Java repos, the release branch is cut two weeks before the scheduled release date. For Go, the branch is cut just before the release. An RC (release candidate) is published for Core and its dependent languages just after the branch cut. This RC is later promoted to release version if no further changes are made to the release branch. We do our best to keep head of master branch stable at all times regardless of release schedule. Daily build packages from master branch for C#, PHP, Python, Ruby and Protoc plugins are published on packages.grpc.io. If you depend on gRPC in production we recommend to set up your CI system to test the RCs and, if possible, the daily builds.

Names of gRPC releases are here.

Release Scheduled Branch Cut Scheduled Release Date
v1.17.0 Nov 19, 2018 Dec 4, 2018
v1.18.0 Jan 2, 2019 Jan 15, 2019
v1.19.0 Feb 12, 2019 Feb 26, 2019
v1.20.0 Mar 26, 2019 Apr 9, 2019
v1.21.0 May 7, 2019 May 21, 2019
v1.22.0 Jun 18, 2019 Jul 2, 2019
v1.23.0 Jul 30, 2019 Aug 13, 2019
v1.24.0 Sept 10, 2019 Sept 24, 2019
v1.25.0 Oct 22, 2019 Nov 5, 2019
v1.26.0 Dec 3, 2019 Dec 17, 2019
v1.27.0 Jan 14, 2020 Jan 28, 2020
v1.28.0 Feb 25, 2020 Mar 10, 2020
v1.29.0 Apr 7, 2020 Apr 21, 2020
v1.30.0 May 19, 2020 Jun 2, 2020
v1.31.0 Jul 14, 2020 Jul 28, 2020
v1.32.0 Aug 25, 2020 Sep 8, 2020
v1.33.0 Oct 6, 2020 Oct 20, 2020
v1.34.0 Nov 17, 2020 Dec 1, 2020
v1.35.0 Dec 29, 2020 Jan 12, 2021
v1.36.0 Feb 9, 2021 Feb 23, 2021
v1.37.0 Mar 23, 2021 Apr 6, 2021
v1.38.0 May 4, 2021 May 18, 2021
v1.39.0 Jun 15, 2021 Jun 29, 2021
v1.40.0 Jul 27, 2021 Aug 10, 2021
v1.41.0 Sep 7, 2021 Sep 21, 2021
Commits
  • afb307f [v1.53.x][Interop] Backport Python image update (#33864)
  • 7a9373b [Backport] [dependency] Restrict cython to less than 3.X (#33770)
  • fdb64a6 [v1.53][Build] Update Phusion baseimage (#33767) (#33836)
  • cdf4186 [PSM Interop] Legacy tests: fix xDS test client build (v1.53.x backport) (#33...
  • ce5b93a [PSM Interop] Legacy test builds always pull the driver from master (v1.53.x ...
  • b24b6ea [release] Bump release version to 1.53.2 (#33709)
  • 1e86ca5 [backport][iomgr][EventEngine] Improve server handling of file descriptor exh...
  • aff3066 [PSM interop] Don't fail url_map target if sub-target already failed (v1.53.x...
  • 539d75c [PSM interop] Don't fail target if sub-target already failed (#33222) (v1.53....
  • 3e79c88 [Release] Bump version to 1.53.1 (on v1.53.x branch) (#33047)
  • Additional commits viewable in compare view

Updates gunicorn from 20.1.0 to 22.0.0

Release notes

Sourced from gunicorn's releases.

Gunicorn 22.0 has been released

Gunicorn 22.0.0 has been released. This version fix the numerous security vulnerabilities. You're invited to upgrade asap your own installation.

Changes:

22.0.0 - 2024-04-17
===================

    

  • use utime to notify workers liveness
    • 

  • migrate setup to pyproject.toml
    • 

  • fix numerous security vulnerabilities in HTTP parser (closing some request smuggling vectors)
    • 

  • parsing additional requests is no longer attempted past unsupported request framing
    • 

  • on HTTP versions < 1.1 support for chunked transfer is refused (only used in exploits)
    • 

  • requests conflicting configured or passed SCRIPT_NAME now produce a verbose error
    • 

  • Trailer fields are no longer inspected for headers indicating secure scheme
    • 

  • support Python 3.12
    • 



** Breaking changes **


    

  • minimum version is Python 3.7
    • 

  • the limitations on valid characters in the HTTP method have been bounded to Internet Standards
    • 

  • requests specifying unsupported transfer coding (order) are refused by default (rare)
    • 

  • HTTP methods are no longer casefolded by default (IANA method registry contains none affected)
    • 

  • HTTP methods containing the number sign (#) are no longer accepted by default (rare)
    • 

  • HTTP versions < 1.0 or >= 2.0 are no longer accepted by default (rare, only HTTP/1.1 is supported)
    • 

  • HTTP versions consisting of multiple digits or containing a prefix/suffix are no longer accepted
    • 

  • HTTP header field names Gunicorn cannot safely map to variables are silently dropped, as in other software
    • 

  • HTTP headers with empty field name are refused by default (no legitimate use cases, used in exploits)
    • 

  • requests with both Transfer-Encoding and Content-Length are refused by default (such a message might indicate an attempt to perform request smuggling)
    • 

  • empty transfer codings are no longer permitted (reportedly seen with really old & broken proxies)
    • 



** SECURITY **


    

  • fix CVE-2024-1135
  1. Documentation is available there: https://docs.gunicorn.org/en/stable/news.html
  2. Packages: https://pypi.org/project/gunicorn/

Gunicorn 21.2.0 has been released

Gunicorn 21.2.0 has been released. This version fix the issue introduced in the threaded worker.

Changes:

21.2.0 - 2023-07-19
===================
fix thread worker: revert change considering connection as idle .
</tr></table>

... (truncated)

Commits
  • f63d59e bump to 22.0
  • 4ac81e0 Merge pull request #3175 from e-kwsm/typo
  • 401cecf Merge pull request #3179 from dhdaines/exclude-eventlet-0360
  • 0243ec3 fix(deps): exclude eventlet 0.36.0
  • 628a0bc chore: fix typos
  • 88fc4a4 Merge pull request #3131 from pajod/patch-py12-rebased
  • deae2fc CI: back off the agressive timeout
  • f470382 docs: promise 3.12 compat
  • 5e30bfa add changelog to project.urls (updated for PEP621)
  • 481c3f9 remove setup.cfg - overridden by pyproject.toml
  • Additional commits viewable in compare view

Updates apache-airflow from 2.1.2 to 2.9.0

Release notes

Sourced from apache-airflow's releases.

Apache Airflow 2.9.0

Significant Changes

Following Listener API methods are considered stable and can be used for production system (were experimental feature in older Airflow versions) (#36376):

Lifecycle events:

  • on_starting
  • before_stopping

DagRun State Change Events:

  • on_dag_run_running
  • on_dag_run_success
  • on_dag_run_failed

TaskInstance State Change Events:

  • on_task_instance_running
  • on_task_instance_success
  • on_task_instance_failed

Support for Microsoft SQL-Server for Airflow Meta Database has been removed (#36514)

After discussion <https://lists.apache.org/thread/r06j306hldg03g2my1pd4nyjxg78b3h4>__ and a voting process <https://lists.apache.org/thread/pgcgmhf6560k8jbsmz8nlyoxosvltph2>__, the Airflow's PMC and Committers have reached a resolution to no longer maintain MsSQL as a supported Database Backend.

As of Airflow 2.9.0 support of MsSQL has been removed for Airflow Database Backend.

A migration script which can help migrating the database before upgrading to Airflow 2.9.0 is available in airflow-mssql-migration repo on Github <https://github.com/apache/airflow-mssql-migration>_. Note that the migration script is provided without support and warranty.

This does not affect the existing provider packages (operators and hooks), DAGs can still access and process data from MsSQL.

Dataset URIs are now validated on input (#37005)

Datasets must use a URI that conform to rules laid down in AIP-60, and the value will be automatically normalized when the DAG file is parsed. See documentation on Datasets <https://airflow.apache.org/docs/apache-airflow/stable/authoring-and-scheduling/datasets.html>_ for a more detailed description on the rules.

You may need to change your Dataset identifiers if they look like a URI, but are used in a less mainstream way, such as relying on the URI's auth section, or have a case-sensitive protocol name.

The method get_permitted_menu_items in BaseAuthManager has been renamed filter_permitted_menu_items (#37627)

Add REST API actions to Audit Log events (#37734)

... (truncated)

Changelog

Sourced from apache-airflow's changelog.

Airflow 2.9.0 (2024-04-08)

Significant Changes ^^^^^^^^^^^^^^^^^^^

Following Listener API methods are considered stable and can be used for production system (were experimental feature in older Airflow versions) (#36376): """""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" Lifecycle events:

  • on_starting
  • before_stopping

DagRun State Change Events:

  • on_dag_run_running
  • on_dag_run_success
  • on_dag_run_failed

TaskInstance State Change Events:

  • on_task_instance_running
  • on_task_instance_success
  • on_task_instance_failed

Support for Microsoft SQL-Server for Airflow Meta Database has been removed (#36514) """"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""

After discussion <https://lists.apache.org/thread/r06j306hldg03g2my1pd4nyjxg78b3h4>__ and a voting process <https://lists.apache.org/thread/pgcgmhf6560k8jbsmz8nlyoxosvltph2>__, the Airflow's PMC and Committers have reached a resolution to no longer maintain MsSQL as a supported Database Backend.

As of Airflow 2.9.0 support of MsSQL has been removed for Airflow Database Backend.

A migration script which can help migrating the database before upgrading to Airflow 2.9.0 is available in airflow-mssql-migration repo on Github <https://github.com/apache/airflow-mssql-migration>_. Note that the migration script is provided without support and warranty.

This does not affect the existing provider packages (operators and hooks), DAGs can still access and process data from MsSQL.

Dataset URIs are now validated on input (#37005) """"""""""""""""""""""""""""""""""""""""""""""""

Datasets must use a URI that conform to rules laid down in AIP-60, and the value will be automatically normalized when the DAG file is parsed. See documentation on Datasets <https://airflow.apache.org/docs/apache-airflow/stable/authoring-and-scheduling/datasets.html>_ for a more detailed description on the rules.

You may need to change your Dataset identifiers if they look like a URI, but are used in a less mainstream way, such as relying on the URI's auth section, or

... (truncated)

Commits

Updates cryptography from 3.4.7 to 42.0.4

Changelog

Sourced from cryptography's changelog.

42.0.4 - 2024-02-20


* Fixed a null-pointer-dereference and segfault that could occur when creating
  a PKCS#12 bundle. Credit to **Alexander-Programming** for reporting the
  issue. **CVE-2024-26130**
* Fixed ASN.1 encoding for PKCS7/SMIME signed messages. The fields ``SMIMECapabilities``
  and ``SignatureAlgorithmIdentifier`` should now be correctly encoded according to the
  definitions in :rfc:`2633` :rfc:`3370`.

.. _v42-0-3:


42.0.3 - 2024-02-15

  • Fixed an initialization issue that caused key loading failures for some users.

.. _v42-0-2:

42.0.2 - 2024-01-30


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.2.1.
* Fixed an issue that prevented the use of Python buffer protocol objects in
  ``sign`` and ``verify`` methods on asymmetric keys.
* Fixed an issue with incorrect keyword-argument naming with ``EllipticCurvePrivateKey``
  :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey.exchange`,
  ``X25519PrivateKey``
  :meth:`~cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey.exchange`,
  ``X448PrivateKey``
  :meth:`~cryptography.hazmat.primitives.asymmetric.x448.X448PrivateKey.exchange`,
  and ``DHPrivateKey``
  :meth:`~cryptography.hazmat.primitives.asymmetric.dh.DHPrivateKey.exchange`.

.. _v42-0-1:


42.0.1 - 2024-01-24

  • Fixed an issue with incorrect keyword-argument naming with EllipticCurvePrivateKey :meth:~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey.sign.
  • Resolved compatibility issue with loading certain RSA public keys in :func:~cryptography.hazmat.primitives.serialization.load_pem_public_key.

.. _v42-0-0:

42.0.0 - 2024-01-22


</tr></table>

... (truncated)

Commits

@dependabot
chore(deps): bump the pip group across 12 directories with 7 updates
2069362 
Bumps the pip group with 1 update in the /bigquery/bqml directory: [pyarrow](https://github.com/apache/arrow).
Bumps the pip group with 2 updates in the /bigquery/datalab-migration directory: [pyarrow](https://github.com/apache/arrow) and [grpcio](https://github.com/grpc/grpc).
Bumps the pip group with 2 updates in the /bigquery/pandas-gbq-migration directory: [pyarrow](https://github.com/apache/arrow) and [grpcio](https://github.com/grpc/grpc).
Bumps the pip group with 1 update in the /codelabs/flex_and_vision directory: [gunicorn](https://github.com/benoitc/gunicorn).
Bumps the pip group with 5 updates in the /composer/cicd_sample directory:

| Package | From | To |
| --- | --- | --- |
| [pyarrow](https://github.com/apache/arrow) | `3.0.0` | `14.0.1` |
| [grpcio](https://github.com/grpc/grpc) | `1.38.1` | `1.53.2` |
| [gunicorn](https://github.com/benoitc/gunicorn) | `20.1.0` | `22.0.0` |
| [apache-airflow](https://github.com/apache/airflow) | `2.1.2` | `2.9.0` |
| [cryptography](https://github.com/pyca/cryptography) | `3.4.7` | `42.0.4` |

Bumps the pip group with 5 updates in the /composer/workflows directory:

| Package | From | To |
| --- | --- | --- |
| [pyarrow](https://github.com/apache/arrow) | `3.0.0` | `14.0.1` |
| [grpcio](https://github.com/grpc/grpc) | `1.38.1` | `1.53.2` |
| [gunicorn](https://github.com/benoitc/gunicorn) | `20.1.0` | `22.0.0` |
| [apache-airflow](https://github.com/apache/airflow) | `2.2.2` | `2.9.0` |
| [cryptography](https://github.com/pyca/cryptography) | `3.4.7` | `42.0.4` |

Bumps the pip group with 1 update in the /compute/encryption directory: [cryptography](https://github.com/pyca/cryptography).
Bumps the pip group with 1 update in the /data-science-onramp/data-processing directory: [pyarrow](https://github.com/apache/arrow).
Bumps the pip group with 2 updates in the /iap directory: [gunicorn](https://github.com/benoitc/gunicorn) and [cryptography](https://github.com/pyca/cryptography).
Bumps the pip group with 2 updates in the /kubernetes_engine/django_tutorial directory: [gunicorn](https://github.com/benoitc/gunicorn) and [django](https://github.com/django/django).
Bumps the pip group with 1 update in the /media/transcoder directory: [grpcio](https://github.com/grpc/grpc).
Bumps the pip group with 1 update in the /people-and-planet-ai/image-classification directory: [pillow](https://github.com/python-pillow/Pillow).


Updates `pyarrow` from 6.0.1 to 14.0.1
- [Commits](apache/arrow@go/v6.0.1...go/v14.0.1)

Updates `pyarrow` from 6.0.1 to 14.0.1
- [Commits](apache/arrow@go/v6.0.1...go/v14.0.1)

Updates `grpcio` from 1.42.0 to 1.53.2
- [Release notes](https://github.com/grpc/grpc/releases)
- [Changelog](https://github.com/grpc/grpc/blob/master/doc/grpc_release_schedule.md)
- [Commits](grpc/grpc@v1.42.0...v1.53.2)

Updates `pyarrow` from 6.0.1 to 14.0.1
- [Commits](apache/arrow@go/v6.0.1...go/v14.0.1)

Updates `grpcio` from 1.42.0 to 1.53.2
- [Release notes](https://github.com/grpc/grpc/releases)
- [Changelog](https://github.com/grpc/grpc/blob/master/doc/grpc_release_schedule.md)
- [Commits](grpc/grpc@v1.42.0...v1.53.2)

Updates `gunicorn` from 20.0.4 to 22.0.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@20.0.4...22.0.0)

Updates `pyarrow` from 3.0.0 to 14.0.1
- [Commits](apache/arrow@go/v6.0.1...go/v14.0.1)

Updates `grpcio` from 1.38.1 to 1.53.2
- [Release notes](https://github.com/grpc/grpc/releases)
- [Changelog](https://github.com/grpc/grpc/blob/master/doc/grpc_release_schedule.md)
- [Commits](grpc/grpc@v1.42.0...v1.53.2)

Updates `gunicorn` from 20.1.0 to 22.0.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@20.0.4...22.0.0)

Updates `apache-airflow` from 2.1.2 to 2.9.0
- [Release notes](https://github.com/apache/airflow/releases)
- [Changelog](https://github.com/apache/airflow/blob/main/RELEASE_NOTES.rst)
- [Commits](apache/airflow@2.1.2...2.9.0)

Updates `cryptography` from 3.4.7 to 42.0.4
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@3.4.7...42.0.4)

Updates `pyarrow` from 3.0.0 to 14.0.1
- [Commits](apache/arrow@go/v6.0.1...go/v14.0.1)

Updates `grpcio` from 1.38.1 to 1.53.2
- [Release notes](https://github.com/grpc/grpc/releases)
- [Changelog](https://github.com/grpc/grpc/blob/master/doc/grpc_release_schedule.md)
- [Commits](grpc/grpc@v1.42.0...v1.53.2)

Updates `gunicorn` from 20.1.0 to 22.0.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@20.0.4...22.0.0)

Updates `apache-airflow` from 2.2.2 to 2.9.0
- [Release notes](https://github.com/apache/airflow/releases)
- [Changelog](https://github.com/apache/airflow/blob/main/RELEASE_NOTES.rst)
- [Commits](apache/airflow@2.1.2...2.9.0)

Updates `cryptography` from 3.4.7 to 42.0.4
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@3.4.7...42.0.4)

Updates `cryptography` from 36.0.0 to 42.0.4
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@3.4.7...42.0.4)

Updates `pyarrow` from 6.0.1 to 14.0.1
- [Commits](apache/arrow@go/v6.0.1...go/v14.0.1)

Updates `gunicorn` from 20.1.0 to 22.0.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@20.0.4...22.0.0)

Updates `cryptography` from 36.0.0 to 42.0.4
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@3.4.7...42.0.4)

Updates `gunicorn` from 20.0.4 to 22.0.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@20.0.4...22.0.0)

Updates `django` from 3.2.9 to 3.2.25
- [Commits](django/django@3.2.9...3.2.25)

Updates `grpcio` from 1.42.0 to 1.53.2
- [Release notes](https://github.com/grpc/grpc/releases)
- [Changelog](https://github.com/grpc/grpc/blob/master/doc/grpc_release_schedule.md)
- [Commits](grpc/grpc@v1.42.0...v1.53.2)

Updates `pillow` from 8.4.0 to 10.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@8.4.0...10.3.0)

---
updated-dependencies:
- dependency-name: pyarrow
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pyarrow
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: grpcio
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pyarrow
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: grpcio
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: gunicorn
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pyarrow
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: grpcio
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: gunicorn
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: apache-airflow
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: cryptography
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pyarrow
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: grpcio
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: gunicorn
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: apache-airflow
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: cryptography
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: cryptography
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pyarrow
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: gunicorn
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: cryptography
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: gunicorn
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: django
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: grpcio
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pillow
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Apr 16, 2024
This was referenced Apr 16, 2024
Closed
Closed
Closed
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants