Just to put things into context from my perspective as a release manager: 1. I was aware of the changes to SFTP and SSH resulting from Vespa's PR while working on the release. I thought that it was an intended change - I didn't go deeper into whether there was a discussion, as I assumed that it had been agreed on during approval. 2. I asked the LLM to modify the titles in the CHANGELOG if they are unclear, and indeed it detected this issue and modified the entries on its own. 3. If we had added the upper bound "<4.0.0" as part of this PR, it would have indeed been an issue - because users who have already upgraded paramiko, might not be able to roll back. However, the upper bound had already been set to "<4.0.0" *before* Vespa's PR, which just increased the lower bound - and I agree here with Jarek that we do that all the time <https://github.com/apache/airflow/commits/main/?author=dependabot%5Bbot%5D> (even without discussing it). Nonetheless: Specifically here I would have expected this matter to be discussed in the PR as these changes seem unrelated, or even making them in separate PRs - it was a bit confusing for me as a release manager to figure out why these changes were needed.
I'll pay more attention to this matter in future releases and let you know beforehand if I encounter similar cases. No changes to my vote. Shahar On Thu, Apr 23, 2026, 14:15 Jarek Potiuk <[email protected]> wrote: > Hey Elad, > > But it's - IMHO - cler explained in the changelog: > > > https://airflow.staged.apache.org/docs/apache-airflow-providers-ssh/5.0.1/changelog.html > > https://airflow.staged.apache.org/docs/apache-airflow-providers-sftp/stable/changelog.html > > SSH: > > 5.0.1¶ > Release Date: 2026-04-22 > > Misc¶ > Bump paramiko lower bound to >=3.5.1 due to adding Vespa provider (#63988) > > SFTP" > > Changelog¶ > 5.7.4¶ > Release Date: 2026-04-22 > > Misc¶ > Bump paramiko lower bound to >=3.5.1 due to adding Vespa provider (#63988) > > Why do you think it needs more explanation? We usually do not do more > explanation when we bump minimum version - and here the explanation is > quite clear ? > > J. > > > > On Thu, Apr 23, 2026 at 1:02 PM Elad Kalif <[email protected]> wrote: > > > -1 (binding) for ssh and sftp providers. > > the changes in these providers are bumping paramiko min version which > came > > from a PR that adds vespa provider > > https://github.com/apache/airflow/pull/63988#discussion_r3130238616 > > There is no indication into why version was bumped and seems like we > missed > > it during review. > > Even if the version needs to be bumped that is not normally how we do it > > and generally lets leave this to when > > https://github.com/apache/airflow/pull/64898 is resolved. > > > > On Thu, Apr 23, 2026 at 1:01 PM Wei Lee <[email protected]> wrote: > > > > > +1 (binding), checked: > > > > > > - SVN > > > - in Docker installation > > > - Reproducible package builds > > > - Licence > > > - Signature > > > - Checksums > > > > > > Best regards, > > > Wei Lee > > > > > > Shahar Epstein <[email protected]> 於 2026年4月23日週四 上午7:55寫道： > > > > > > > Hey all, > > > > > > > > I have just cut the new wave Airflow Providers packages with release > > > > preparation date 2026-04-21. This email is calling a vote on the > > release, > > > > which will last for 72 hours - which means that it will end on > > 2026-04-25 > > > > 23:54 UTC and until 3 binding +1 votes have been received. > > > > > > > > > > > > Consider this my (binding) +1. > > > > Please note that we have an RC for a new provider, Vespa - I'd like > to > > > ask > > > > the stewards to test it well before shipping its first version > > (v0.1.0). > > > > > > > > > > > > Airflow Providers are available at: > > > > https://dist.apache.org/repos/dist/dev/airflow/providers/2026-04-21 > > > > > > > > *apache-airflow-providers-2026-04-21-source.tar.gz* is the full > source > > > > tarball of airflow repo - snapshot taken at the moment of provider's > > > > release. > > > > > > > > *apache-airflow-providers-<PROVIDER>-*.tar.gz* are the convenience > > python > > > > "sdist" distributions that we publish in PyPI > > > > > > > > *apache_airflow_providers_<PROVIDER>-*.whl are the convenience Python > > > > "wheel" distributions that we publish in PyPI. > > > > > > > > The test procedure for PMC members is described in > > > > > > > > > > > > > > https://github.com/apache/airflow/blob/main/dev/README_RELEASE_PROVIDERS.md#verify-the-release-candidate-by-pmc-members > > > > > > > > The test procedure for and Contributors who would like to test this > RC > > is > > > > described in: > > > > > > > > > > > > > > https://github.com/apache/airflow/blob/main/dev/README_RELEASE_PROVIDERS.md#verify-the-release-candidate-by-contributors > > > > > > > > > > > > Public keys are available at: > > > > https://dist.apache.org/repos/dist/release/airflow/KEYS > > > > > > > > Please vote accordingly: > > > > > > > > [ ] +1 approve > > > > [ ] +0 no opinion > > > > [ ] -1 disapprove with the reason > > > > > > > > Only votes from PMC members are binding, but members of the community > > are > > > > encouraged to test the release and vote with "(non-binding)". > > > > > > > > Please note that the version number excludes the 'rcX' string. > > > > This will allow us to rename the artifact without modifying > > > > the artifact checksums when we actually release it. > > > > > > > > The status of testing the providers by the community is kept here: > > > > https://github.com/apache/airflow/issues/65702 > > > > > > > > The issue is also the easiest way to see important PRs included in > the > > RC > > > > candidates. > > > > Detailed changelog for the providers will be published in the > > > documentation > > > > after the > > > > RC candidates are released. > > > > > > > > You can find the RC packages in PyPI following these links: > > > > > > > > https://pypi.org/project/apache-airflow-providers-amazon/9.26.0rc1/ > > > > > > > > > > https://pypi.org/project/apache-airflow-providers-apache-kafka/1.13.3rc1/ > > > > https://pypi.org/project/apache-airflow-providers-celery/3.19.0rc1/ > > > > > > > > > > > > > > https://pypi.org/project/apache-airflow-providers-cncf-kubernetes/10.16.1rc1/ > > > > > https://pypi.org/project/apache-airflow-providers-common-ai/0.1.1rc1/ > > > > > > https://pypi.org/project/apache-airflow-providers-common-sql/1.35.0rc1/ > > > > > > https://pypi.org/project/apache-airflow-providers-databricks/7.13.0rc1/ > > > > https://pypi.org/project/apache-airflow-providers-edge3/3.5.0rc1/ > > > > > > > > > > https://pypi.org/project/apache-airflow-providers-elasticsearch/6.5.3rc1/ > > > > https://pypi.org/project/apache-airflow-providers-fab/3.6.2rc1/ > > > > https://pypi.org/project/apache-airflow-providers-google/21.2.0rc1/ > > > > > https://pypi.org/project/apache-airflow-providers-hashicorp/4.6.0rc1/ > > > > https://pypi.org/project/apache-airflow-providers-jdbc/5.4.4rc1/ > > > > > > > > > > > > > > https://pypi.org/project/apache-airflow-providers-microsoft-azure/13.1.2rc1/ > > > > > > https://pypi.org/project/apache-airflow-providers-openlineage/2.15.0rc1/ > > > > > https://pypi.org/project/apache-airflow-providers-opensearch/1.9.1rc1/ > > > > > https://pypi.org/project/apache-airflow-providers-papermill/3.13.0rc1/ > > > > https://pypi.org/project/apache-airflow-providers-sendgrid/4.2.3rc1/ > > > > https://pypi.org/project/apache-airflow-providers-sftp/5.7.4rc1/ > > > > https://pypi.org/project/apache-airflow-providers-smtp/3.0.0rc1/ > > > > > https://pypi.org/project/apache-airflow-providers-snowflake/6.12.2rc1/ > > > > https://pypi.org/project/apache-airflow-providers-ssh/5.0.1rc1/ > > > > https://pypi.org/project/apache-airflow-providers-vespa/0.1.0rc1/ > > > > > > > > Cheers, > > > > Shahar Epstein > > > > > > > > > >
