github-actions[bot] opened a new pull request, #75106: URL: https://github.com/apache/airflow/pull/75106
* Mask provider-declared sensitive connection extras by connection type The connections API masks ``extra`` values by field name only, so a field a provider declares as a secret (``format: password`` in its ``conn-fields``) is returned in cleartext when its name is too generic to be on the global list -- ``config`` is a secret for apprise and harmless for other connection types. After the name-based masking, also mask the fields the connection type's own provider declares sensitive, read from provider metadata without importing hooks. Generated-by: Claude Opus 5 * Add newsfragment Generated-by: Claude Opus 5 * Restore provider-declared sensitive extras when saving a masked connection Generated-by: Claude Opus 5 * Restore provider-sensitive extras only when the connection type is unchanged Generated-by: Claude Opus 5 * Keep provider-declared sensitive extras masked after a connection type change Generated-by: Claude Opus 5 * Describe masking of provider-declared sensitive extras across connection types Generated-by: Claude Opus 5 * Look up provider-declared sensitive extra keys in one set Checking each key against every connection type's declared fields did the same work on every key of every response; building the plain and prefixed names once keeps the lookup a single membership test. (cherry picked from commit a1109f86030199a4b71aa34c9ff9edaa86f2e39a) Co-authored-by: Jarek Potiuk <[email protected]> Generated-by: Claude Opus 5 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
