DEVOURED
Airflow 2 reaches end of life
Apache Airflow 2 reached end of life on April 22, 2026, leaving production deployments without security patches or provider updates unless teams migrate to Airflow 3.
What: Apache Airflow 2.x is no longer receiving security patches, bug fixes, or provider package updates after reaching official end of life. Airflow 3.0 shipped a year ago, but many teams have delayed migration despite the announced timeline.
Why it matters: The risks compound over time: unpatched CVEs in Airflow 2 and dependencies will accumulate, while provider packages for data platforms like Snowflake and BigQuery will increasingly require Airflow 3, breaking backward compatibility. The migration involves architectural changes beyond a simple version bump, including removal of SubDAGs, deprecated context variables, and a split of the monolithic webserver into separate API and DAG processor components.
Takeaway: Spin up an Airflow 3 instance and run existing DAGs through migration tooling to identify breaking changes before the gap between your environment and the ecosystem widens further.
Deep dive
- Airflow 2 still runs but will not receive security patches for newly discovered CVEs, creating growing vulnerability exposure over time
- Provider packages for major data platforms will drop Airflow 2 compatibility as they advance, breaking integrations without clear migration paths
- SubDAGs have been completely removed in favor of Task Groups or dynamic task mapping, requiring DAG refactoring
- Legacy context variables like execution_date, prev_ds, and next_ds are gone, breaking code that relied on them
- The monolithic webserver architecture has been split into separate API server and DAG processor components, changing deployment patterns
- Built-in DAG versioning now tracks which version of a DAG was used for each run, eliminating custom versioning workarounds
- Event-driven scheduling enables triggering pipelines from message queues instead of polling with sensors
- Human-in-the-loop task execution provides native workflow pause capabilities for approval or validation steps
- The completely rebuilt UI delivers noticeable performance improvements and better usability
- Migration tooling exists but requires active testing to surface breaking changes specific to each deployment
Decoder
- Apache Airflow: Open source workflow orchestration platform for scheduling and monitoring data pipelines, widely used for ETL and batch processing
- DAG: Directed Acyclic Graph, the core abstraction in Airflow representing a workflow as tasks and their dependencies
- Provider packages: Modular integrations for connecting Airflow to external platforms like cloud data warehouses and data processing engines
- SubDAGs: Legacy pattern for nesting workflows inside other workflows, replaced by Task Groups in Airflow 3
- Taskflow API: Decorator-based syntax for defining tasks using Python functions instead of operator classes
- Deferrable operators: Operators that suspend and free up worker resources while waiting for long-running external tasks
- CVE: Common Vulnerabilities and Exposures, standardized identifiers for security vulnerabilities
Original article
Security patches and provider updates stopped last week.
Explore all 66 articles in today's digest
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi