apache-airflow-providers-fab 3.0.0rc2__tar.gz → 3.1.2__tar.gz

apache_airflow_providers_fab-3.1.2/.pre-commit-config.yaml

@@ -0,0 +1,60 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+---
+default_stages: [pre-commit, pre-push]
+minimum_prek_version: '0.2.0'
+default_language_version:
+  python: python3
+  node: 22.19.0
+  golang: 1.24.0
+repos:
+  - repo: local
+    hooks:
+      - id: compile-fab-assets
+        name: Compile FAB provider assets
+        language: node
+        files: ^src/airflow/providers/fab/www/
+        exclude: |
+          (?x)
+          ^src/airflow/providers/fab/www/api_connexion/.*|
+          ^src/airflow/providers/fab/www/extensions/.*|
+          ^src/airflow/providers/fab/www/security/.*
+        entry: ../../scripts/ci/prek/compile_provider_assets.py fab
+        pass_filenames: false
+        additional_dependencies: ['yarn@1.22.21']
+      - id: generate-openapi-spec-fab
+        name: Generate the FastAPI API spec for FAB
+        language: python
+        entry: ../../scripts/ci/prek/generate_openapi_spec_providers.py fab
+        pass_filenames: false
+        files: ^src/airflow/providers/fab/auth_manager/api_fastapi/.*\.py$
+      - id: check-revision-heads-map-fab
+        name: Check that the REVISION_HEADS_MAP is up-to-date
+        language: python
+        entry: ../../scripts/ci/prek/check_revision_heads_map.py
+        pass_filenames: false
+        files: >
+          (?x)
+          ^src/airflow/providers/fab/migrations/versions/.*$|
+          ^src/airflow/providers/fab/migrations/versions|
+          ^src/airflow/providers/fab/auth_manager/models/db\.py$
+      - id: prevent-deprecated-sqlalchemy-usage-fab
+        name: Prevent deprecated sqlalchemy usage
+        entry: ../../scripts/ci/prek/prevent_deprecated_sqlalchemy_usage.py
+        language: python
+        files: ^.*\.py$
+        pass_filenames: true

{apache_airflow_providers_fab-3.0.0rc2 → apache_airflow_providers_fab-3.1.2}/3rd-party-licenses/LICENSES-ui.txt

@@ -1,5 +1,5 @@
 Apache Airflow
-Copyright 2016-2025 The Apache Software Foundation
+Copyright 2016-2026 The Apache Software Foundation
 
 This product includes software developed at The Apache Software
 Foundation (http://www.apache.org/).

{apache_airflow_providers_fab-3.0.0rc2 → apache_airflow_providers_fab-3.1.2}/NOTICE

@@ -1,5 +1,5 @@
 Apache Airflow
-Copyright 2016-2025 The Apache Software Foundation
+Copyright 2016-2026 The Apache Software Foundation
 
 This product includes software developed at The Apache Software
 Foundation (http://www.apache.org/).

{apache_airflow_providers_fab-3.0.0rc2 → apache_airflow_providers_fab-3.1.2}/PKG-INFO

@@ -1,12 +1,13 @@
 Metadata-Version: 2.4
 Name: apache-airflow-providers-fab
-Version: 3.0.0rc2
+Version: 3.1.2
 Summary: Provider package apache-airflow-providers-fab for Apache Airflow
 Keywords: airflow-provider,fab,airflow,integration
 Author-email: Apache Software Foundation <dev@airflow.apache.org>
 Maintainer-email: Apache Software Foundation <dev@airflow.apache.org>
 Requires-Python: >=3.10,!=3.13
 Description-Content-Type: text/x-rst
+License-Expression: Apache-2.0
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Environment :: Web Environment
@@ -14,23 +15,22 @@ Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: System Administrators
 Classifier: Framework :: Apache Airflow
 Classifier: Framework :: Apache Airflow :: Provider
-Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: System :: Monitoring
 License-File: 3rd-party-licenses/LICENSES-ui.txt
+License-File: LICENSE
 License-File: NOTICE
-Requires-Dist: apache-airflow>=3.0.2rc1
-Requires-Dist: apache-airflow-providers-common-compat>=1.2.1rc1
+Requires-Dist: apache-airflow>=3.0.2
+Requires-Dist: apache-airflow-providers-common-compat>=1.12.0
 Requires-Dist: blinker>=1.6.2; python_version < '3.13'
 Requires-Dist: flask>=2.2.1,<2.3; python_version < '3.13'
-Requires-Dist: flask-appbuilder==5.0.0; python_version < '3.13'
+Requires-Dist: flask-appbuilder==5.0.1; python_version < '3.13'
 Requires-Dist: flask-login>=0.6.2; python_version < '3.13'
 Requires-Dist: flask-session>=0.8.0; python_version < '3.13'
 Requires-Dist: msgpack>=1.0.0; python_version < '3.13'
 Requires-Dist: flask-sqlalchemy>=3.0.5; python_version < '3.13'
-Requires-Dist: sqlalchemy<2; python_version < '3.13'
 Requires-Dist: flask-wtf>=1.1.0; python_version < '3.13'
 Requires-Dist: connexion[flask]>=2.14.2,<3.0; python_version < '3.13'
 Requires-Dist: jmespath>=0.7.0; python_version < '3.13'
@@ -39,8 +39,8 @@ Requires-Dist: wtforms>=3.0,<4; python_version < '3.13'
 Requires-Dist: flask_limiter>3,<4,!=3.13
 Requires-Dist: kerberos>=1.3.0 ; extra == "kerberos" and ( python_version < '3.13')
 Project-URL: Bug Tracker, https://github.com/apache/airflow/issues
-Project-URL: Changelog, https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/3.0.0/changelog.html
-Project-URL: Documentation, https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/3.0.0
+Project-URL: Changelog, https://airflow.apache.org/docs/apache-airflow-providers-fab/3.1.2/changelog.html
+Project-URL: Documentation, https://airflow.apache.org/docs/apache-airflow-providers-fab/3.1.2
 Project-URL: Mastodon, https://fosstodon.org/@airflow
 Project-URL: Slack Chat, https://s.apache.org/airflow-slack
 Project-URL: Source Code, https://github.com/apache/airflow
@@ -72,7 +72,7 @@ Provides-Extra: kerberos
 
 Package ``apache-airflow-providers-fab``
 
-Release: ``3.0.0``
+Release: ``3.1.2``
 
 
 `Flask App Builder <https://flask-appbuilder.readthedocs.io/>`__
@@ -85,7 +85,7 @@ This is a provider package for ``fab`` provider. All classes for this provider p
 are in ``airflow.providers.fab`` python package.
 
 You can find package information and changelog for the provider
-in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.0.0/>`_.
+in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.1.2/>`_.
 
 Installation
 ------------
@@ -103,15 +103,14 @@ Requirements
 PIP package                                 Version required
 ==========================================  ==========================================
 ``apache-airflow``                          ``>=3.0.2``
-``apache-airflow-providers-common-compat``  ``>=1.2.1``
+``apache-airflow-providers-common-compat``  ``>=1.10.1``
 ``blinker``                                 ``>=1.6.2; python_version < "3.13"``
 ``flask``                                   ``>=2.2.1,<2.3; python_version < "3.13"``
-``flask-appbuilder``                        ``==5.0.0; python_version < "3.13"``
+``flask-appbuilder``                        ``==5.0.1; python_version < "3.13"``
 ``flask-login``                             ``>=0.6.2; python_version < "3.13"``
 ``flask-session``                           ``>=0.8.0; python_version < "3.13"``
 ``msgpack``                                 ``>=1.0.0; python_version < "3.13"``
 ``flask-sqlalchemy``                        ``>=3.0.5; python_version < "3.13"``
-``sqlalchemy``                              ``<2; python_version < "3.13"``
 ``flask-wtf``                               ``>=1.1.0; python_version < "3.13"``
 ``connexion[flask]``                        ``>=2.14.2,<3.0; python_version < "3.13"``
 ``jmespath``                                ``>=0.7.0; python_version < "3.13"``
@@ -149,5 +148,5 @@ Extra         Dependencies
 ============  ============================================
 
 The changelog for the provider package can be found in the
-`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.0.0/changelog.html>`_.
+`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.1.2/changelog.html>`_.
 

{apache_airflow_providers_fab-3.0.0rc2 → apache_airflow_providers_fab-3.1.2}/README.rst

@@ -23,7 +23,7 @@
 
 Package ``apache-airflow-providers-fab``
 
-Release: ``3.0.0``
+Release: ``3.1.2``
 
 
 `Flask App Builder <https://flask-appbuilder.readthedocs.io/>`__
@@ -36,7 +36,7 @@ This is a provider package for ``fab`` provider. All classes for this provider p
 are in ``airflow.providers.fab`` python package.
 
 You can find package information and changelog for the provider
-in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.0.0/>`_.
+in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.1.2/>`_.
 
 Installation
 ------------
@@ -54,15 +54,14 @@ Requirements
 PIP package                                 Version required
 ==========================================  ==========================================
 ``apache-airflow``                          ``>=3.0.2``
-``apache-airflow-providers-common-compat``  ``>=1.2.1``
+``apache-airflow-providers-common-compat``  ``>=1.10.1``
 ``blinker``                                 ``>=1.6.2; python_version < "3.13"``
 ``flask``                                   ``>=2.2.1,<2.3; python_version < "3.13"``
-``flask-appbuilder``                        ``==5.0.0; python_version < "3.13"``
+``flask-appbuilder``                        ``==5.0.1; python_version < "3.13"``
 ``flask-login``                             ``>=0.6.2; python_version < "3.13"``
 ``flask-session``                           ``>=0.8.0; python_version < "3.13"``
 ``msgpack``                                 ``>=1.0.0; python_version < "3.13"``
 ``flask-sqlalchemy``                        ``>=3.0.5; python_version < "3.13"``
-``sqlalchemy``                              ``<2; python_version < "3.13"``
 ``flask-wtf``                               ``>=1.1.0; python_version < "3.13"``
 ``connexion[flask]``                        ``>=2.14.2,<3.0; python_version < "3.13"``
 ``jmespath``                                ``>=0.7.0; python_version < "3.13"``
@@ -100,4 +99,4 @@ Extra         Dependencies
 ============  ============================================
 
 The changelog for the provider package can be found in the
-`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.0.0/changelog.html>`_.
+`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/3.1.2/changelog.html>`_.

{apache_airflow_providers_fab-3.0.0rc2 → apache_airflow_providers_fab-3.1.2}/docs/auth-manager/access-control.rst

@@ -333,7 +333,7 @@ It's also possible to add Dag Runs resource permissions in a similar way, but ex
         dag_id="example_fine_grained_access",
         start_date=pendulum.datetime(2021, 1, 1, tz="UTC"),
         access_control={
-            "Viewer": {"Dags": {"can_edit", "can_read", "can_delete"}, "Dag Runs": {"can_create"}},
+            "Viewer": {"DAGs": {"can_edit", "can_read", "can_delete"}, "DAG Runs": {"can_create"}},
         },
     )
 

{apache_airflow_providers_fab-3.0.0rc2 → apache_airflow_providers_fab-3.1.2}/docs/auth-manager/api-authentication.rst

@@ -38,9 +38,9 @@ command as in the example below.
 
 .. versionchanged:: 3.0.0
 
-    In Airflow, the default setting is using token based authentication.
-    This approach is independent from which ``auth_backend`` is used.
-    The default setting is using Airflow public API to create a token (JWT) first and use this token in the requests to access the API.
+    Airflow now uses token-based authentication for the public API.
+    This mechanism is independent of the configured ``auth_backend``.
+    Clients must first obtain a JWT token using :doc:`token`, then include that token in subsequent API requests.
 
 Kerberos authentication
 '''''''''''''''''''''''

{apache_airflow_providers_fab-3.0.0rc2 → apache_airflow_providers_fab-3.1.2}/docs/auth-manager/configuring-flask-app.rst

@@ -33,6 +33,6 @@ as the `app context <https://flask.palletsprojects.com/en/2.3.x/appcontext/>`_ i
     from flask import current_app as app
 
 
-    @app.before_requestq
+    @app.before_request
     def print_custom_message() -> None:
         print("Executing before every request")

{apache_airflow_providers_fab-3.0.0rc2 → apache_airflow_providers_fab-3.1.2}/docs/auth-manager/sso.rst

@@ -59,7 +59,33 @@ Configuration Steps
 
    This replaces the default ``SimpleAuthManager``.
 
-2. **Install Required Packages**
+2. **Enable OAuth Authentication Type**
+
+   Set ``AUTH_TYPE`` to ``AUTH_OAUTH`` in your ``webserver_config.py`` file
+   (located at ``$AIRFLOW_HOME/webserver_config.py`` by default, configurable via
+   ``[fab] config_file`` in ``airflow.cfg``):
+
+   .. code-block:: python
+
+      from flask_appbuilder.const import AUTH_OAUTH
+
+      AUTH_TYPE = AUTH_OAUTH
+
+   .. important::
+      This step is required. Without setting ``AUTH_TYPE = AUTH_OAUTH``,
+      the OAuth providers will not be activated even if ``OAUTH_PROVIDERS``
+      is configured. The default ``AUTH_TYPE = AUTH_DB`` uses database
+      authentication only.
+
+   .. note::
+      If the ``webserver_config.py`` file does not exist in your environment,
+      you need to create it manually. A template with default values and examples
+      can be found in the Airflow source at
+      ``airflow-core/src/airflow/config_templates/default_webserver_config.py``.
+      You can copy this file to ``$AIRFLOW_HOME/webserver_config.py`` and modify
+      it for your needs.
+
+3. **Install Required Packages**
 
    If not already installed, ensure the FAB provider is available:
 
@@ -71,7 +97,7 @@ Configuration Steps
       The FAB Auth Manager provider is not installed by default in Airflow 3.
       You must install it explicitly to use OAuth2-based SSO.
 
-3. **Configure OAuth2 Provider**
+4. **Configure OAuth2 Provider**
 
    FAB Auth Manager reads provider configuration from the ``[fab]`` section
    of ``airflow.cfg`` or from environment variables.
@@ -119,13 +145,13 @@ Configuration Steps
 
    Adjust these values according to your provider's documentation.
 
-4. **Restart Airflow Webserver**
+5. **Restart Airflow Webserver**
 
    .. code-block:: bash
 
       airflow webserver --reload
 
-5. **Test SSO Login**
+6. **Test SSO Login**
 
    Open the Airflow UI. You should see a login option for your SSO provider.
 

apache_airflow_providers_fab-3.1.2/docs/auth-manager/token.rst

@@ -0,0 +1,155 @@
+ .. Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+ ..   http://www.apache.org/licenses/LICENSE-2.0
+
+ .. Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+Generate JWT token with FAB auth manager
+========================================
+
+.. note::
+    This guide only applies if your environment is configured with FAB auth manager.
+
+To use the :doc:`Airflow public API <apache-airflow:stable-rest-api-ref>`, you first need to obtain a JWT Token for
+authentication.
+Once you have the token, include it in the ``Authorization`` header when making requests to the public API.
+
+You can generate a JWT token using the ``Create Token`` API endpoint,
+documented in :doc:`/api-ref/fab-token-api-ref`.
+
+Example
+'''''''
+
+Use the following example to generate a token via username and password.
+
+.. code-block:: bash
+
+    ENDPOINT_URL="http://localhost:8080"
+    curl -X 'POST' \
+        "${ENDPOINT_URL}/auth/token" \
+        -H 'Content-Type: application/json' \
+        -d '{
+        "username": "<username>",
+        "password": "<password>"
+        }'
+
+If successful, this request returns a JWT token that you can use for subsequent Airflow public API calls.
+
+Only users authenticated via the database (``AUTH_TYPE = AUTH_DB``) or LDAP
+(``AUTH_TYPE = AUTH_LDAP``) can generate tokens using this method.
+For more details, see :doc:`webserver-authentication`.
+
+If you need to generate a token using a different authentication mechanism, see the next section.
+
+Custom authentication implementation
+------------------------------------
+
+By default, JWT tokens for the Airflow public API can only be generated using
+basic authentication (username and password) for database or LDAP users.
+
+If you want to support another authentication mechanism, such as oauth, you can do so by overriding the
+``create_token`` method in the FAB auth manager.
+
+Example
+'''''''
+
+.. code-block:: python
+
+    class MyAuthManager(FabAuthManager):
+
+        def create_token(self, headers: dict[str, str], body: dict[str, Any]) -> User:
+            """
+            Return the authenticated user for a given payload.
+
+            Implement your own custom token creation logic here.
+            """
+            ...
+
+Oauth example
+'''''''''''''
+
+Below is an example implementation that uses OAuth to allow users to obtain a JWT token.
+This custom logic overrides the default ``create_token`` method from the FAB authentication manager.
+
+.. warning::
+    The example shown below disables signature verification (``verify_signature=False``).
+    This is **insecure** and should only be used for testing. Always validate tokens properly in production.
+    Furthermore you need to make sure that the claims of the JWT are valid.
+    Critical claims that you must verify are for example (but not limited to):
+    - ``iss`` (issuer)
+    - ``aud`` (audience)
+    - ``nbf`` (not before time)
+    - ``exp`` (expiration time)
+    Refer to the documentation of your identity provider for more information.
+
+.. code-block:: python
+
+    class MyAuthManager(FabAuthManager):
+
+        def create_token(self, headers: dict[str, str], body: dict[str, Any]) -> User:
+            """
+            Return the authenticated user derived from an OAuth access token.
+
+            Implement your own custom token validation and user mapping logic here.
+            """
+            user = None
+
+            # Handle OAuth-based authentication
+            if self.security_manager.auth_type == AUTH_OAUTH:
+                # Require a Bearer token
+                auth_header = headers.get("Authorization")
+                if not auth_header:
+                    return None
+
+                token = auth_header.replace("Bearer ", "")
+
+                # Example token decoding
+                #
+                # With signature validation (recommended):
+                # me = jwt.decode(
+                #     token,
+                #     public_key,
+                #     algorithms=['HS256', 'RS256'],
+                #     audience=CLIENT_ID,
+                #     issuer=ISSUER_URL,
+                # )
+                #
+                # Without signature validation (not recommended):
+                me = jwt.decode(token, options={"verify_signature": False})
+
+                # Extract groups/roles (example schema — adjust to your provider)
+                groups = me["resource_access"]["airflow"]["roles"]  # requires validation
+                if not groups:
+                    groups = ["airflow_public"]
+                else:
+                    groups = [g for g in groups if "airflow" in g]
+
+                # Build user info payload for FAB
+                userinfo = {
+                    "username": me.get("preferred_username"),
+                    "email": me.get("email"),
+                    "first_name": me.get("given_name"),
+                    "last_name": me.get("family_name"),
+                    "role_keys": groups,
+                }
+
+                user = self.security_manager.auth_user_oauth(userinfo, rotate_session_id=False)
+
+            # Fall back to the default implementation
+            else:
+                user = super().create_token(headers=headers, body=body)
+
+            log.info("User: %s", user)
+
+            return user

{apache_airflow_providers_fab-3.0.0rc2 → apache_airflow_providers_fab-3.1.2}/docs/auth-manager/webserver-authentication.rst

@@ -23,7 +23,9 @@ FAB auth manager authentication
    While this documentation refers to authentication using the ``apache-airflow-providers-fab`` package, please note:
 
    - The **FAB auth provider** is actively maintained and compatible with the latest versions of Airflow.
-   - The legacy ``webserver_config.py`` file referenced in older docs is **no longer used** in recent versions of Airflow. Instead, authentication is handled via the new ``auth_manager`` framework configured in ``airflow.cfg``.
+   - It is preferred to configure supported authentication options using the new ``auth_manager`` framework configured in ``airflow.cfg``.
+   - The ``webserver_config.py`` file is still used for more advanced options,
+     such as Single Sign-On with OAuth.
 
    For more, see the :doc:`token`.
 

{apache_airflow_providers_fab-3.0.0rc2 → apache_airflow_providers_fab-3.1.2}/docs/changelog.rst

@@ -20,6 +20,174 @@
 Changelog
 ---------
 
+3.1.2
+.....
+
+Bug Fixes
+~~~~~~~~~
+
+* ``Fab Auth Manager add xcom missing perms (#60315)``
+* ``Fix typos in CLI commands (#60227)``
+* ``Hide Groups field from User edit form in FAB Auth Manager (#60019)``
+* ``Fix user creation in FAB fails when no role specified (#60015)``
+
+Misc
+~~~~
+
+* ``Change starlette import to fastapi (#60382)``
+* ``New year means updated Copyright notices (#60344)``
+* ``rename names of data models related to roles for consistency across requests and responses (#60312)``
+* ``Introduce a "cli" section in provider metadata (#59805)``
+* ``Move over plugins_manager to a shared library (#59956)``
+* ``Bump the fab-ui-package-updates group across 1 directory with 4 updates (#59717)``
+* ``Make FAB AirflowAppBuilder use scoped_session (#59953)``
+* ``Upgrade SQLAlchemy (SQLA) to 2.0 (#59218)``
+
+Doc-only
+~~~~~~~~
+
+* ``Clarify note re: webserver_config.py deprecation (#59529)``
+* ``#59475 (docs): added few clarification docs for OAuth Authentication type (#60109)``
+
+.. Below changes are excluded from the changelog. Move them to
+   appropriate section above if needed. Do not delete the lines(!):
+
+3.1.1
+.....
+
+Misc
+~~~~
+
+* ``Remove global from plugins_manager (#59851)``
+* ``Replace imports from airflow.security.permissions module in fab provider due to future deprecation of the module. (#59755)``
+* ``Split SerializedBaseOperator from serde logic (#59627)``
+* ``Adaptions for custom auth manager example in documentation (#59355)``
+* ``Pnpm upgrade to 10.x and prevent script execution (#59466)``
+* ``Bump the fab-ui-package-updates group across 1 directory with 3 updates (#59242)``
+
+Doc-only
+~~~~~~~~
+
+* ``Add hints for claim validation to auth manager documentation (#59320)``
+* ``Fix release process issues after going through 2025-12-09 release (#59261)``
+
+.. Below changes are excluded from the changelog. Move them to
+   appropriate section above if needed. Do not delete the lines(!):
+
+3.1.0
+.....
+
+Features
+~~~~~~~~
+
+* ``Create 'create_token' method in FAB auth manager (#59245)``
+
+Bug Fixes
+~~~~~~~~~
+
+* ``Permit 'airflow db migrate -r' with an empty database (#59205)``
+
+Misc
+~~~~
+
+* ``Add backcompat for exceptions in providers (#58727)``
+* ``Remove global statement from Fab provider (#59018)``
+* ``Bump the fab-ui-package-updates group across 1 directory with 2 updates (#58954)``
+* ``Bump minimum prek version to 0.2.0 (#58952)``
+* ``Use 'HTTP_422_UNPROCESSABLE_CONTENT' instead of 'HTTP_422_UNPROCESSABLE_ENTITY' (#58828)``
+
+Doc-only
+~~~~~~~~
+
+* ``docs: adjust misleading docs (#59228)``
+
+.. Below changes are excluded from the changelog. Move them to
+   appropriate section above if needed. Do not delete the lines(!):
+
+
+3.0.3
+.....
+
+Misc
+~~~~
+
+* ``Bump stylelint from 16.25.0 to 16.26.0 in /providers/fab/src/airflow/providers/fab/www in the fab-ui-package-updates group across 1 directory (#58678)``
+* ``Remove deprecation warning in Fab provider (#58686)``
+* ``Fix mypy errors in providers (#58644)``
+* ``Bump webpack from 5.102.1 to 5.103.0 in /providers/fab/src/airflow/providers/fab/www in the fab-ui-package-updates group across 1 directory (#58634)``
+* ``Upgrade js-yaml to 4.1.1 in FAB (#58501)``
+* ``Migrate FAB PATCH /roles/{name} to FastAPI (#58023)``
+
+.. Below changes are excluded from the changelog. Move them to
+   appropriate section above if needed. Do not delete the lines(!):
+   * ``Updates to release process of providers (#58316)``
+
+3.0.2
+.....
+
+Bug Fixes
+~~~~~~~~~
+
+* ``Fix duplicated SQLAlchemy sessions caused transactions fail to close (#58196)``
+* ``Fix logout in Fab and Keycloak auth managers (#57992)``
+* ``Fix double redirection while authenticating in Fab auth manager (#57993)``
+* ``Fix remote user authentication in Fab auth manager (#57775)``
+* ``Fix Fab auth manager with 'securecookie' as session backend (#57578)``
+
+Misc
+~~~~
+
+* ``Convert all airflow distributions to be compliant with ASF requirements (#58138)``
+* ``Migrate FAB GET /roles/{name} to FastAPI (#58009)``
+* ``Migrate FAB DELETE /roles to FastAPI (#57780)``
+* ``Bump the fab-ui-package-updates group across 1 directory with 2 updates (#57760)``
+* ``Migrate FAB GET /roles to FastAPI (#57411)``
+* ``Synchronize boto3 and sqlalchemy dependency lower-binds (#57385)``
+* ``Bump the fab-ui-package-updates group across 1 directory with 4 updates (#57160)``
+* ``Migrate FAB POST /roles to FastAPI (#57199)``
+* ``Upgrade 'flask-appbuilder' to 5.0.1 (#57170)``
+* ``refactor: migrate models to use mapped_column for SQLAlchemy 2.0 compatibility (#56827)``
+
+Doc-only
+~~~~~~~~
+
+* ``Fixing some typos and spelling errors (#57186)``
+
+.. Below changes are excluded from the changelog. Move them to
+   appropriate section above if needed. Do not delete the lines(!):
+   * ``Delete all unnecessary LICENSE Files (#58191)``
+   * ``Enable pt006 rule and fix new generate errors (#58238)``
+   * ``Enable ruff PLW2101,PLW2901,PLW3301 rule (#57700)``
+   * ``Revert "Fix duplicated SQLAlchemy sessions caused transactions fail to close (#57815)" (#58097)``
+   * ``Fix duplicated SQLAlchemy sessions caused transactions fail to close (#57815)``
+   * ``Synchronize default versions in all split .pre-commit-config.yaml (#57851)``
+   * ``Fix mypy static errors in fab provider (#57761)``
+   * ``Fix mypy static errors in main (#57755)``
+   * ``Fix mypy type errors in providers/standard/ in external_task.py for SQLAlchemy 2 migration (#57369)``
+   * ``Enable ruff PLW1641 rule (#57679)``
+   * ``Extract prek hooks for FAB provider (#57181)``
+
+3.0.1
+.....
+
+Bug Fixes
+~~~~~~~~~
+
+* ``Update authentication to handle JWT token in backend (#56633)``
+* ``Add Werkzeug version check (#56398)``
+
+Misc
+~~~~
+
+* ``SQLA2/FAB: fix some type hints (#56928)``
+* ``FAB: reuse ORM type hints from common-compat (#56903)``
+* ``Bump eslint from 9.37.0 to 9.38.0 in /providers/fab/src/airflow/providers/fab/www in the fab-ui-package-updates group across 1 directory (#56847)``
+* ``Bump the fab-ui-package-updates group across 1 directory with 3 updates (#56436)``
+
+
+.. Below changes are excluded from the changelog. Move them to
+   appropriate section above if needed. Do not delete the lines(!):
+
 3.0.0
 .....
 
@@ -230,7 +398,7 @@ Doc-only
 Bug Fixes
 ~~~~~~~~~
 
-* ``Fix: allow users with specific DAG permissions to access DAGs when no pecific DAG is requested (#51462)``
+* ``Fix: allow users with specific DAG permissions to access DAGs when no specific DAG is requested (#51462)``
 * ``Fix fab asset compilation hashing script (#51446)``
 * ``Fix default setting for hash algorithm for FAB password hash (#51858)``
 
@@ -634,8 +802,6 @@ Misc
    appropriate section above if needed. Do not delete the lines(!):
    * ``Add TODOs in providers code for Subdag code removal (#41963)``
    * ``Add fixes by breeze/precommit-lint static checks (#41604) (#41618)``
-
-.. Review and move the new changes to one of the sections above:
    * ``Fix pre-commit for auto update of fab migration versions (#42382)``
    * ``Handle 'AUTH_ROLE_PUBLIC' in FAB auth manager (#42280)``