o-nikolas commented on code in PR #76490:
URL: https://github.com/apache/airflow/pull/76490#discussion_r4483091996
##########
providers/fab/docs/changelog.rst:
##########
@@ -20,17 +20,53 @@
Changelog
---------
+3.11.0
+......
+
.. note::
- Airflow 3.4.1 gives Dag bundles their own ``Dag Bundles`` resource, which
``Op`` and ``Admin``
- get by default. Upgrade this provider together with Airflow 3.4.1: older
releases deny the Dag
- bundle pages and API to every role, including ``Admin``, while still
showing the Browse menu
- entry. Custom roles need ``can read`` and ``menu access`` on ``Dag
Bundles`` added by hand.
-
- ``POST /auth/token`` now checks a username and password only against the
configured
- ``AUTH_TYPE``: with ``AUTH_LDAP`` it no longer falls back to database
passwords, and with other
- authentication types (OAuth, remote user) it no longer issues tokens for a
username and
+ Airflow 3.4.1 gives Dag bundles their own ``Dag Bundles`` resource, which
only ``Op`` and
+ ``Admin`` get by default, so ``Viewer`` and ``User`` lose the Dag bundle
pages and API they
+ reached through Dag read access. Upgrade this provider together with
Airflow 3.4.1: older
+ releases deny the Dag bundle pages and API to every role, including
``Admin``, while still
+ showing the Browse menu entry. Custom roles need ``can read`` and ``menu
access`` on
+ ``Dag Bundles`` added by hand.
+
+ ``POST /auth/token`` and ``POST /auth/token/cli`` now check a username and
password only against
+ the configured ``AUTH_TYPE``: with ``AUTH_LDAP`` they no longer fall back
to database passwords, and
+ with other authentication types (OAuth, remote user) they no longer issue
tokens for a username and
password; use that type's own login flow instead. Passwords made only of
NUL bytes are rejected.
+Features
+~~~~~~~~
+
+* ``Give Dag bundles their own read permission (#76329)``
Review Comment:
Applied in 6f31dfa322, using your wording: ``Give Dag bundles their own read
permission, on Airflow 3.4.1+ (#76329)``.
---
Drafted-by: Kiro (Claude Opus 5.5) (no human review before posting)
##########
providers/keycloak/docs/changelog.rst:
##########
@@ -34,6 +37,23 @@ Changelog
``airflow keycloak-auth-manager create-team`` for each team, which removes
the Dag bundles menu
entry that team roles can no longer open.
+Features
+~~~~~~~~
+
+* ``Restrict the Dag bundles view to SuperAdmin in multi-team mode (#76329)``
Review Comment:
Applied in 6f31dfa322, same form: ``Restrict the Dag bundles view to
SuperAdmin in multi-team mode on Airflow 3.4.1+ (#76329)``.
---
Drafted-by: Kiro (Claude Opus 5.5) (no human review before posting)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
