tvalentyn commented on PR #66952: URL: https://github.com/apache/airflow/pull/66952#issuecomment-4927313175
> Again, Beam needs to explain why they can't do out of release schedule to mitigate. Airflow is doing ad hoc releases when needed. An adhoc release would require you to set the upper bound to `apache_beam>= 2.75.1` . Taking the best interests of Airflow users in mind, this might not be a great solution since if Beam 2.75.0 happens to be buggy, your users won't have an option to downgrade for a while. I agree that depending on 'beta' doesn't have great optics but beyond optics per se, i don't see an actual risk (i.e. vulnerability or introducing bugs). Arguably that was Beam's fault, not Airflow's fault and you are not adding this dependency intentionally. would it be ok for airflow to add a constraint `envoy_data_plane==1.0.3` instead of `betterproto==2.0.0b6` if you are concerned with mentioning a beta dependency in your codebase? Beam can do out-of-calendar releases but this is a nontrivial amount of work and the bar for that is high (for example an urgent dataloss issue or smth like log4j vulnerability that everyone was scrambilng to mitigate asap). During the entire project lifetime that happened perhaps 2 or 3 times . -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
