potiuk opened a new pull request, #73625: URL: https://github.com/apache/airflow/pull/73625
Airflow's built-in serde deserializers are allowed implicitly, on top of `[core] allowed_deserialization_classes`, and there was no way to switch any of them off. This change: - stops implicitly allowing `deltalake.table.DeltaTable` and `pyiceberg.table.Table`. Deserializing them opens the table or loads the catalog from the serialized values, so they should be opt-in. Deployments that pass these objects through XCom add them to `[core] allowed_deserialization_classes`; - adds `[core] denied_deserialization_classes` (glob list, default empty). A match is rejected even when the class is otherwise allowed, including the built-in serializers, so a deployment can disable any of them. Test plan: - [x] New unit tests in `task-sdk/tests/task_sdk/serde/test_serde.py` covering the default allow set, the two opt-in classes, deny-over-allow precedence and an empty deny list - [x] Existing DeltaTable / Iceberg round-trip tests in `test_serializers.py` now allow-list their class - [x] `uv run --project task-sdk pytest task-sdk/tests/task_sdk/serde` passes locally (the k8s tests need the cncf provider installed) ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Claude Opus 5) Generated-by: Claude Code (Claude Opus 5) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
