apache-airflow-task-sdk 1.2.1rc3__tar.gz → 1.2.2__tar.gz

{apache_airflow_task_sdk-1.2.1rc3 → apache_airflow_task_sdk-1.2.2}/.pre-commit-config.yaml

@@ -16,7 +16,7 @@
 # under the License.
 ---
 default_stages: [pre-commit, pre-push]
-minimum_prek_version: '0.2.0'
+minimum_prek_version: '0.3.4'
 default_language_version:
   python: python3
   node: 22.19.0
@@ -58,7 +58,7 @@ repos:
       - id: mypy-task-sdk
         name: Run mypy for task-sdk
         language: python
-        entry: ../scripts/ci/prek/mypy_local_folder.py task-sdk
+        entry: ../scripts/ci/prek/run_mypy_full_dist_local_venv_or_breeze_in_ci.py task-sdk
         pass_filenames: false
         files: ^.*\.py$
         require_serial: true

{apache_airflow_task_sdk-1.2.1rc3 → apache_airflow_task_sdk-1.2.2}/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.4
 Name: apache-airflow-task-sdk
-Version: 1.2.1rc3
+Version: 1.2.2
 Summary: Python Task SDK for Apache Airflow DAG Authors
 Project-URL: Bug Tracker, https://github.com/apache/airflow/issues
-Project-URL: Documentation, https://airflow.staged.apache.org/docs/
-Project-URL: Homepage, https://airflow.staged.apache.org/
+Project-URL: Documentation, https://airflow.apache.org/docs/
+Project-URL: Homepage, https://airflow.apache.org/
 Project-URL: Slack Chat, https://s.apache.org/airflow-slack
 Project-URL: Source Code, https://github.com/apache/airflow
 Project-URL: Mastodon, https://fosstodon.org/@airflow
@@ -29,7 +29,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: System :: Monitoring
 Requires-Python: !=3.15,>=3.10
-Requires-Dist: apache-airflow-core<3.3.0,>=3.2.0rc1
+Requires-Dist: apache-airflow-core<3.3.0,>=3.2.0
 Requires-Dist: asgiref>=2.3.0; python_version < '3.14'
 Requires-Dist: asgiref>=3.11.1; python_version >= '3.14'
 Requires-Dist: attrs!=25.2.0,>=24.2.0

{apache_airflow_task_sdk-1.2.1rc3 → apache_airflow_task_sdk-1.2.2}/pyproject.toml

@@ -48,7 +48,7 @@ classifiers = [
     "Topic :: System :: Monitoring",
 ]
 dependencies = [
-    "apache-airflow-core<3.3.0,>=3.2.0rc1",
+    "apache-airflow-core<3.3.0,>=3.2.0",
     "asgiref>=2.3.0; python_version < '3.14'",
     "asgiref>=3.11.1; python_version >= '3.14'",
     "attrs>=24.2.0, !=25.2.0",
@@ -108,8 +108,8 @@ dependencies = [
 
 [project.urls]
 "Bug Tracker" = "https://github.com/apache/airflow/issues"
-Documentation = "https://airflow.staged.apache.org/docs/"
-Homepage = "https://airflow.staged.apache.org/"
+Documentation = "https://airflow.apache.org/docs/"
+Homepage = "https://airflow.apache.org/"
 "Slack Chat" = "https://s.apache.org/airflow-slack"
 "Source Code" = "https://github.com/apache/airflow"
 Mastodon = "https://fosstodon.org/@airflow"
@@ -120,11 +120,11 @@ YouTube = "https://www.youtube.com/channel/UCSXwxpWZQ7XZ1WL3wqevChA/"
 [build-system]
 requires = [
     "hatchling==1.29.0",
-    "packaging==26.1",
-    "pathspec==1.0.4",
+    "packaging==26.2",
+    "pathspec==1.1.1",
     "pluggy==1.6.0",
     "tomli==2.4.1; python_version < '3.11'",
-    "trove-classifiers==2026.1.14.14",
+    "trove-classifiers==2026.5.20.19",
 ]
 build-backend = "hatchling.build"
 
@@ -226,6 +226,10 @@ dev = [
 docs = [
     "apache-airflow-devel-common[docs]",
 ]
+mypy = [
+    "apache-airflow-devel-common[mypy]",
+]
+
 [tool.uv.sources]
 # These names must match the names as defined in the pyproject.toml of the workspace items,
 # *not* the workspace folder paths

{apache_airflow_task_sdk-1.2.1rc3 → apache_airflow_task_sdk-1.2.2}/src/airflow/sdk/__init__.py

@@ -93,7 +93,7 @@ __all__ = [
     "teardown",
 ]
 
-__version__ = "1.2.1rc3"
+__version__ = "1.2.2"
 
 if TYPE_CHECKING:
     from airflow.sdk.api.datamodels._generated import DagRunState, TaskInstanceState, TriggerRule, WeightRule

{apache_airflow_task_sdk-1.2.1rc3 → apache_airflow_task_sdk-1.2.2}/src/airflow/sdk/_shared/configuration/parser.py

@@ -622,7 +622,7 @@ class AirflowConfigParser(ConfigParser):
             )
         if value is VALUE_NOT_FOUND_SENTINEL:
             value = fallback
-        if raw and value is not None:
+        if raw and isinstance(value, str):
             return value.replace("%", "%%")
         return value
 
@@ -844,7 +844,7 @@ class AirflowConfigParser(ConfigParser):
                 # when display_source = true, we know that the config_sources contains tuple
                 opt, source = config_sources[section][key]  # type: ignore
             else:
-                opt = config_sources[section][key]
+                opt = config_sources[section][key]  # type: ignore[assignment]
             if opt == self.get_default_value(section, key):
                 del config_sources[section][key]
 
@@ -1576,12 +1576,12 @@ class AirflowConfigParser(ConfigParser):
             raise ValueError(f"The value {section}/{key} should be set!")
         return value
 
-    def read(
+    def read(  # type: ignore[override]
         self,
         filenames: str | bytes | os.PathLike | Iterable[str | bytes | os.PathLike],
         encoding: str | None = None,
     ) -> list[str]:
-        return super().read(filenames=filenames, encoding=encoding)
+        return super().read(filenames=filenames, encoding=encoding)  # type: ignore[arg-type,return-value]
 
     def read_dict(  # type: ignore[override]
         self, dictionary: dict[str, dict[str, Any]], source: str = "<dict>"
@@ -1631,7 +1631,9 @@ class AirflowConfigParser(ConfigParser):
         )
         return list(dict.fromkeys(itertools.chain(all_options_from_defaults, my_own_options)))
 
-    def has_option(self, section: str, option: str, lookup_from_deprecated: bool = True, **kwargs) -> bool:
+    def has_option(  # type: ignore[override]
+        self, section: str, option: str, lookup_from_deprecated: bool = True, **kwargs
+    ) -> bool:
         """
         Check if option is defined.
 
@@ -1660,7 +1662,7 @@ class AirflowConfigParser(ConfigParser):
         except (NoOptionError, NoSectionError, AirflowConfigException):
             return False
 
-    def set(self, section: str, option: str, value: str | None = None) -> None:
+    def set(self, section: str, option: str, value: str | None = None) -> None:  # type: ignore[override]
         """
         Set an option to the given value.
 
@@ -1675,7 +1677,7 @@ class AirflowConfigParser(ConfigParser):
             self.add_section(section)
         super().set(section, option, value)
 
-    def remove_option(self, section: str, option: str, remove_default: bool = True):
+    def remove_option(self, section: str, option: str, remove_default: bool = True):  # type: ignore[override]
         """
         Remove an option if it exists in config from a file or default config.
 

{apache_airflow_task_sdk-1.2.1rc3 → apache_airflow_task_sdk-1.2.2}/src/airflow/sdk/_shared/logging/_noncaching.py

@@ -29,7 +29,8 @@ _IO = TypeVar("_IO", TextIO, BinaryIO)
 def make_file_io_non_caching(io: _IO) -> _IO:
     try:
         fd = io.fileno()
-        os.posix_fadvise(fd, 0, 0, os.POSIX_FADV_DONTNEED)
+        # posix_fadvise / POSIX_FADV_DONTNEED are Linux-only; ignored on other platforms at runtime.
+        os.posix_fadvise(fd, 0, 0, os.POSIX_FADV_DONTNEED)  # type: ignore[attr-defined,unused-ignore]
     except Exception:
         # in case either file descriptor cannot be retrieved or fadvise is not available
         # we should simply return the wrapper retrieved by FileHandler's open method

{apache_airflow_task_sdk-1.2.1rc3 → apache_airflow_task_sdk-1.2.2}/src/airflow/sdk/_shared/logging/structlog.py

@@ -24,6 +24,7 @@ import logging
 import os
 import re
 import sys
+import weakref
 from collections.abc import Callable, Iterable, Mapping, Sequence
 from functools import cache, cached_property, partial
 from pathlib import Path
@@ -60,6 +61,44 @@ JWT_PATTERN = re.compile(r"eyJ[\.A-Za-z0-9-_]*")
 LEVEL_TO_FILTERING_LOGGER: dict[int, type[Logger]] = {}
 
 
+# ``_parse_path`` was introduced in Python 3.12; older versions use a different
+# parsing path (``_flavour.parse_parts``) that does not call ``sys.intern``,
+# so the patch is neither necessary nor applicable there. Python 3.14 removed
+# the ``sys.intern`` call upstream, so the patch is unnecessary there too.
+if sys.version_info < (3, 12) or sys.version_info >= (3, 14):
+    _PatchedPath = Path  # type: ignore[misc, assignment]
+else:
+
+    class _PatchedPath(Path):
+        """
+        Backport of Python 3.14's ``PurePath._parse_path`` without ``sys.intern``.
+
+        The ``sys.intern`` call in the stock ``_parse_path`` causes memory
+        to grow unboundedly in long-running processes. Upstream removed it
+        in Python 3.14 (https://github.com/python/cpython/issues/119518);
+        this class applies the same fix for earlier versions.
+        """
+
+        @classmethod
+        def _parse_path(cls, path: str) -> tuple[str, str, list[str]]:
+            if not path:
+                return "", "", []
+            sep = os.path.sep
+            altsep = os.path.altsep
+            if altsep:
+                path = path.replace(altsep, sep)
+            drv, root, rel = os.path.splitroot(path)
+            if not root and drv.startswith(sep) and not drv.endswith(sep):
+                drv_parts = drv.split(sep)
+                if len(drv_parts) == 4 and drv_parts[2] not in "?.":
+                    # e.g. //server/share
+                    root = sep
+                elif len(drv_parts) == 6:
+                    # e.g. //?/unc/server/share
+                    root = sep
+            return drv, root, [x for x in rel.split(sep) if x and x != "."]
+
+
 def _make_airflow_structlogger(min_level):
     # This uses https://github.com/hynek/structlog/blob/2f0cc42d/src/structlog/_native.py#L126
     # as inspiration
@@ -165,24 +204,38 @@ def make_filtering_logger() -> Callable[..., BindableLogger]:
     return maker
 
 
+# structlog >= 26.1.0 added a `name` slot + kwarg to BytesLogger
+# (hynek/structlog#786). Detect it once so we can avoid a redundant slot and
+# forward `name` through the parent init. The same detection is applied to
+# WriteLogger so the analogous upstream change lands without a regression.
+_BYTES_LOGGER_HAS_NAME = "name" in getattr(structlog.BytesLogger, "__slots__", ())
+_WRITE_LOGGER_HAS_NAME = "name" in getattr(structlog.WriteLogger, "__slots__", ())
+
+
 class NamedBytesLogger(structlog.BytesLogger):
-    __slots__ = ("name",)
+    __slots__ = () if _BYTES_LOGGER_HAS_NAME else ("name",)
 
     def __init__(self, name: str | None = None, file: BinaryIO | None = None):
-        self.name = name
         if file is not None:
             file = make_file_io_non_caching(file)
-        super().__init__(file)
+        if _BYTES_LOGGER_HAS_NAME:
+            super().__init__(file, name=name)  # type: ignore[call-arg]
+        else:
+            super().__init__(file)
+            self.name = name
 
 
 class NamedWriteLogger(structlog.WriteLogger):
-    __slots__ = ("name",)
+    __slots__ = () if _WRITE_LOGGER_HAS_NAME else ("name",)
 
     def __init__(self, name: str | None = None, file: TextIO | None = None):
-        self.name = name
         if file is not None:
             file = make_file_io_non_caching(file)
-        super().__init__(file)
+        if _WRITE_LOGGER_HAS_NAME:
+            super().__init__(file, name=name)  # type: ignore[call-arg]
+        else:
+            super().__init__(file)
+            self.name = name
 
 
 LogOutputType = TypeVar("LogOutputType", bound=TextIO | BinaryIO)
@@ -555,6 +608,17 @@ def configure_logging(
             text_output = cast("TextIO", output)
         logger_factory = LoggerFactory(NamedWriteLogger, io=text_output)
 
+    # Replace structlog's WRITE_LOCKS dict with a WeakKeyDictionary so entries
+    # for closed file descriptors are garbage-collected instead of leaking.
+    # TODO: drop once structlog ships the upstream fix (tracked for 26.1.0).
+    try:
+        from structlog import _output as _structlog_output
+
+        if isinstance(_structlog_output.WRITE_LOCKS, dict):
+            _structlog_output.WRITE_LOCKS = weakref.WeakKeyDictionary()  # type: ignore[assignment]
+    except Exception:
+        pass
+
     structlog.configure(
         processors=shared_pre_chain + [for_structlog],
         cache_logger_on_first_use=cache_logger_on_first_use,
@@ -717,10 +781,16 @@ def init_log_folder(directory: str | os.PathLike[str], new_folder_permissions: i
     sure that the same group is set as default group for both - impersonated user and main airflow
     user.
     """
-    directory = Path(directory)
-    for parent in reversed(Path(directory).parents):
-        parent.mkdir(mode=new_folder_permissions, exist_ok=True)
-    directory.mkdir(mode=new_folder_permissions, exist_ok=True)
+    directory = _PatchedPath(directory)
+    try:
+        directory.mkdir(mode=new_folder_permissions, parents=True, exist_ok=True)
+    except OSError as e:
+        log.warning(
+            "Could not create log folder %s: %s. "
+            "Airflow will continue but logging to this directory may fail.",
+            directory,
+            e,
+        )
 
 
 def init_log_file(
@@ -737,7 +807,7 @@ def init_log_file(
 
     See above ``init_log_folder`` method for more detailed explanation.
     """
-    full_path = Path(base_log_folder, local_relative_path)
+    full_path = _PatchedPath(base_log_folder, local_relative_path)
     init_log_folder(full_path.parent, new_folder_permissions)
 
     try:

{apache_airflow_task_sdk-1.2.1rc3 → apache_airflow_task_sdk-1.2.2}/src/airflow/sdk/_shared/observability/common.py

@@ -48,13 +48,25 @@ def get_otel_data_exporter(
 
     # If the protocol env var isn't set, then it will be None,
     # and it will default to an http/protobuf exporter.
+    # The grpc and http variants are incompatible types to mypy but functionally interchangeable here.
+    OTLPMetricExporter: type
+    OTLPSpanExporter: type
     if env_endpoint and env_exporter_protocol == "grpc":
-        from opentelemetry.exporter.otlp.proto.grpc.metric_exporter import OTLPMetricExporter
-        from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import OTLPSpanExporter
+        from opentelemetry.exporter.otlp.proto.grpc.metric_exporter import (
+            OTLPMetricExporter,  # type: ignore[no-redef]
+        )
+        from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import (
+            OTLPSpanExporter,  # type: ignore[no-redef]
+        )
     else:
-        from opentelemetry.exporter.otlp.proto.http.metric_exporter import OTLPMetricExporter
-        from opentelemetry.exporter.otlp.proto.http.trace_exporter import OTLPSpanExporter
-
+        from opentelemetry.exporter.otlp.proto.http.metric_exporter import (
+            OTLPMetricExporter,  # type: ignore[no-redef]
+        )
+        from opentelemetry.exporter.otlp.proto.http.trace_exporter import (
+            OTLPSpanExporter,  # type: ignore[no-redef]
+        )
+
+    exporter: SpanExporter | MetricExporter
     if env_endpoint:
         if host is not None and port is not None:
             log.warning(

{apache_airflow_task_sdk-1.2.1rc3 → apache_airflow_task_sdk-1.2.2}/src/airflow/sdk/_shared/observability/metrics/metrics_template.yaml

@@ -292,6 +292,24 @@ metrics:
     legacy_name: "-"
     name_variables: []
 
+  - name: "api_server.dag_bag.cache_hit"
+    description: "Number of cache hits when retrieving SerializedDAG from DBDagBag in the API server"
+    type: "counter"
+    legacy_name: "-"
+    name_variables: []
+
+  - name: "api_server.dag_bag.cache_miss"
+    description: "Number of cache misses when retrieving SerializedDAG from DBDagBag in the API server"
+    type: "counter"
+    legacy_name: "-"
+    name_variables: []
+
+  - name: "api_server.dag_bag.cache_clear"
+    description: "Number of times the DBDagBag cache was cleared in the API server"
+    type: "counter"
+    legacy_name: "-"
+    name_variables: []
+
   # ==========
   # Gauges
   # ==========
@@ -301,6 +319,12 @@ metrics:
     legacy_name: "-"
     name_variables: []
 
+  - name: "api_server.dag_bag.cache_size"
+    description: "Current number of SerializedDAG objects cached in the API server's DBDagBag"
+    type: "gauge"
+    legacy_name: "-"
+    name_variables: []
+
   - name: "dag_processing.import_errors"
     description: "Number of errors from trying to parse Dag files"
     type: "gauge"

{apache_airflow_task_sdk-1.2.1rc3 → apache_airflow_task_sdk-1.2.2}/src/airflow/sdk/_shared/observability/metrics/otel_logger.py

@@ -418,7 +418,7 @@ def get_otel_logger(
 
     readers = [
         PeriodicExportingMetricReader(
-            exporter=metric_exporter,
+            exporter=metric_exporter,  # type: ignore[arg-type]
             export_interval_millis=interval,  # type: ignore[arg-type]
         )
     ]

{apache_airflow_task_sdk-1.2.1rc3 → apache_airflow_task_sdk-1.2.2}/src/airflow/sdk/_shared/observability/metrics/stats.py

@@ -65,6 +65,7 @@ def normalize_name_for_stats(name: str, log_warning: bool = True) -> str:
 class _Stats(type):
     factory: Callable[[], StatsLogger | NoStatsLogger] | None = None
     instance: StatsLogger | NoStatsLogger | None = None
+    _instance_pid: int | None = None
 
     def __getattr__(cls, name: str) -> str:
         factory = type.__getattribute__(cls, "factory")

{apache_airflow_task_sdk-1.2.1rc3 → apache_airflow_task_sdk-1.2.2}/src/airflow/sdk/_shared/plugins_manager/plugins_manager.py

@@ -119,9 +119,12 @@ class AirflowPlugin:
     # A list of timetable classes that can be used for Dag scheduling.
     timetables: list[Any] = []
 
-    # A list of timetable classes that can be used for Dag scheduling.
+    # A list of partition mapper classes that can be used for Dag scheduling.
     partition_mappers: list[Any] = []
 
+    # A list of deadline reference classes that can be used as custom deadlines in Dags.
+    deadline_references: list[Any] = []
+
     # A list of listeners that can be used for tracking task and Dag states.
     listeners: list[ModuleType | object] = []
 

{apache_airflow_task_sdk-1.2.1rc3 → apache_airflow_task_sdk-1.2.2}/src/airflow/sdk/_shared/secrets_backend/base.py

@@ -84,7 +84,7 @@ class BaseSecretsBackend(ABC):
     def _deserialize_connection_value(conn_class: type, conn_id: str, value: str):
         value = value.strip()
         if value[0] == "{":
-            return conn_class.from_json(value=value, conn_id=conn_id)
+            return conn_class.from_json(value=value, conn_id=conn_id)  # type: ignore[attr-defined]
 
         # TODO: Only sdk has from_uri defined on it. Is it worthwhile developing the core path or not?
         if hasattr(conn_class, "from_uri"):

{apache_airflow_task_sdk-1.2.1rc3 → apache_airflow_task_sdk-1.2.2}/src/airflow/sdk/_shared/secrets_masker/secrets_masker.py

@@ -54,8 +54,11 @@ DEFAULT_SENSITIVE_FIELDS = frozenset(
         "access_token",
         "api_key",
         "apikey",
+        "auth_header",
         "authorization",
+        "bearer",
         "connection_string",
+        "dsn",
         "passphrase",
         "passwd",
         "password",
@@ -64,9 +67,11 @@ DEFAULT_SENSITIVE_FIELDS = frozenset(
         "proxy_password",
         "proxies",
         "secret",
+        "service_account",
+        "service_key",
         "token",
         "keyfile_dict",
-        "service_account",
+        "webhook_url",
     }
 )
 """Names of fields (Connection extra, Variable key name etc.) that are deemed sensitive"""
@@ -344,14 +349,18 @@ class SecretsMasker(logging.Filter):
     def _redact(
         self, item: Redactable, name: str | None, depth: int, max_depth: int, replacement: str = "***"
     ) -> Redacted:
-        # Avoid spending too much effort on redacting on deeply nested
-        # structures. This also avoid infinite recursion if a structure has
-        # reference to self.
-        if depth > max_depth:
-            return item
         try:
+            # Key-name-based redaction is unbounded by depth — sensitive keys
+            # must fail closed at any nesting level. The depth cutoff below is
+            # only used to bound the work of pattern-based string masking and
+            # to terminate recursion through self-referential iterables.
             if name and self.should_hide_value_for_key(name):
                 return self._redact_all(item, depth, max_depth, replacement=replacement)
+            # Always walk dicts so deeper sensitive keys are still caught;
+            # JSON-loaded payloads cannot be self-referential, and any
+            # in-memory cycle hits Python's own recursion limit and is caught
+            # by the except clause below (which fails closed via
+            # "<redaction-failed>").
             if isinstance(item, dict):
                 to_return = {
                     dict_key: self._redact(
@@ -360,6 +369,10 @@ class SecretsMasker(logging.Filter):
                     for dict_key, subval in item.items()
                 }
                 return to_return
+            # Avoid spending too much effort on pattern-based masking of
+            # deeply nested non-dict structures.
+            if depth > max_depth:
+                return item
             if isinstance(item, Enum):
                 return self._redact(
                     item=item.value, name=name, depth=depth, max_depth=max_depth, replacement=replacement

{apache_airflow_task_sdk-1.2.1rc3 → apache_airflow_task_sdk-1.2.2}/src/airflow/sdk/_shared/timezones/timezone.py

@@ -107,7 +107,9 @@ def make_aware(value: DateTime, timezone: dt.tzinfo | None = None) -> DateTime:
 
 
 @overload
-def make_aware(value: dt.datetime, timezone: dt.tzinfo | None = None) -> dt.datetime: ...
+def make_aware(  # type: ignore[overload-cannot-match]
+    value: dt.datetime, timezone: dt.tzinfo | None = None
+) -> dt.datetime: ...
 
 
 def make_aware(value: dt.datetime | None, timezone: dt.tzinfo | None = None) -> dt.datetime | None:
@@ -200,7 +202,9 @@ def coerce_datetime(v: DateTime, tz: dt.tzinfo | None = None) -> DateTime: ...
 
 
 @overload
-def coerce_datetime(v: dt.datetime, tz: dt.tzinfo | None = None) -> DateTime: ...
+def coerce_datetime(  # type: ignore[overload-cannot-match]
+    v: dt.datetime, tz: dt.tzinfo | None = None
+) -> DateTime: ...
 
 
 def coerce_datetime(v: dt.datetime | None, tz: dt.tzinfo | None = None) -> DateTime | None:

{apache_airflow_task_sdk-1.2.1rc3 → apache_airflow_task_sdk-1.2.2}/src/airflow/sdk/api/client.py

@@ -419,6 +419,21 @@ class ConnectionOperations:
                     status_code=e.response.status_code,
                 )
                 return ErrorResponse(error=ErrorType.CONNECTION_NOT_FOUND, detail={"conn_id": conn_id})
+            if e.response.status_code in (HTTPStatus.UNAUTHORIZED, HTTPStatus.FORBIDDEN):
+                # Surface authz failures as a distinct ErrorType so the
+                # ExecutionAPISecretsBackend can refuse to fall back to a
+                # less-restrictive backend (e.g. env vars). 401/403 must
+                # not be conflated with "not found".
+                log.debug(
+                    "Connection access denied",
+                    conn_id=conn_id,
+                    detail=e.detail,
+                    status_code=e.response.status_code,
+                )
+                return ErrorResponse(
+                    error=ErrorType.PERMISSION_DENIED,
+                    detail={"conn_id": conn_id, "status_code": e.response.status_code},
+                )
             raise
         return ConnectionResponse.model_validate_json(resp.read())
 
@@ -442,6 +457,19 @@ class VariableOperations:
                     status_code=e.response.status_code,
                 )
                 return ErrorResponse(error=ErrorType.VARIABLE_NOT_FOUND, detail={"key": key})
+            if e.response.status_code in (HTTPStatus.UNAUTHORIZED, HTTPStatus.FORBIDDEN):
+                # See ConnectionOperations.get() above for rationale —
+                # authz failures must not be conflated with "not found".
+                log.debug(
+                    "Variable access denied",
+                    key=key,
+                    detail=e.detail,
+                    status_code=e.response.status_code,
+                )
+                return ErrorResponse(
+                    error=ErrorType.PERMISSION_DENIED,
+                    detail={"key": key, "status_code": e.response.status_code},
+                )
             raise
         return VariableResponse.model_validate_json(resp.read())
 

{apache_airflow_task_sdk-1.2.1rc3 → apache_airflow_task_sdk-1.2.2}/src/airflow/sdk/api/datamodels/_generated.py

@@ -662,3 +662,4 @@ class TIRunContext(BaseModel):
     next_kwargs: Annotated[dict[str, Any] | str | None, Field(title="Next Kwargs")] = None
     xcom_keys_to_clear: Annotated[list[str] | None, Field(title="Xcom Keys To Clear")] = None
     should_retry: Annotated[bool | None, Field(title="Should Retry")] = False
+    start_date: Annotated[AwareDatetime | None, Field(title="Start Date")] = None

{apache_airflow_task_sdk-1.2.1rc3 → apache_airflow_task_sdk-1.2.2}/src/airflow/sdk/exceptions.py

@@ -57,6 +57,17 @@ class AirflowNotFoundException(AirflowException):
     status_code = HTTPStatus.NOT_FOUND
 
 
+class AirflowSecretsBackendAccessDenied(PermissionError):
+    """
+    Authoritative deny from a secrets backend; dispatcher must NOT fall through.
+
+    Distinct from a generic ``PermissionError`` (e.g. an incidental filesystem
+    ``OSError``-family raise from inside an unrelated backend) so the
+    secrets-backend dispatcher loops can re-raise only this signal and keep
+    treating other exceptions as "try the next backend".
+    """
+
+
 class AirflowDagCycleException(AirflowException):
     """Raise when there is a cycle in Dag definition."""
 
@@ -81,6 +92,11 @@ class ErrorType(enum.Enum):
     XCOM_NOT_FOUND = "XCOM_NOT_FOUND"
     ASSET_NOT_FOUND = "ASSET_NOT_FOUND"
     DAGRUN_ALREADY_EXISTS = "DAGRUN_ALREADY_EXISTS"
+    # Distinct from API_SERVER_ERROR: signals an explicit 401/403 from the
+    # Execution API. Callers like ExecutionAPISecretsBackend treat this as
+    # a deny rather than a "not found" so the secrets-backend dispatcher
+    # does NOT fall through to a less-restrictive backend (e.g. env vars).
+    PERMISSION_DENIED = "PERMISSION_DENIED"
     GENERIC_ERROR = "GENERIC_ERROR"
     API_SERVER_ERROR = "API_SERVER_ERROR"
 

{apache_airflow_task_sdk-1.2.1rc3 → apache_airflow_task_sdk-1.2.2}/src/airflow/sdk/execution_time/comms.py

@@ -133,7 +133,7 @@ def _new_encoder() -> msgspec.msgpack.Encoder:
     return msgspec.msgpack.Encoder(enc_hook=_msgpack_enc_hook)
 
 
-class _RequestFrame(msgspec.Struct, array_like=True, frozen=True, omit_defaults=True):
+class _RequestFrame(msgspec.Struct, array_like=True, frozen=True, omit_defaults=True):  # type: ignore[call-arg]
     id: int
     """
     The request id, set by the sender.
@@ -159,7 +159,7 @@ class _RequestFrame(msgspec.Struct, array_like=True, frozen=True, omit_defaults=
         return buffer
 
 
-class _ResponseFrame(_RequestFrame, frozen=True):
+class _ResponseFrame(_RequestFrame, frozen=True):  # type: ignore[call-arg]
     id: int
     """
     The id of the request this is a response to