chore(deps-dev): bump apache-airflow from 2.11.2 to 3.2.2

[dependabot]

Bumps apache-airflow from 2.11.2 to 3.2.2.

Release notes

Sourced from apache-airflow's releases.

Apache Airflow 3.2.2

📦 PyPI: https://pypi.org/project/apache-airflow/3.2.2/ 📚 Docs: https://airflow.apache.org/docs/apache-airflow/3.2.2/ 🛠 Release Notes: https://airflow.apache.org/docs/apache-airflow/3.2.2/release_notes.html 🐳 Docker Image: "docker pull apache/airflow:3.2.2" 🚏 Constraints: https://github.com/apache/airflow/tree/constraints-3.2.2

Significant Changes

• The SMTP STARTTLS upgrade performed by airflow.utils.email.send_email now validates the SMTP server's certificate against the system's trusted CA bundle by default. Previously the starttls() call was made without an SSL context, so any certificate was accepted. Deployments that intentionally point Airflow at an SMTP server with a self-signed or otherwise non-validating certificate and need to preserve the previous behaviour must set email.ssl_context = "none" in airflow.cfg. The "default" value (now also the default when the option is unset) uses :func:ssl.create_default_context. Previously this option applied only to the SMTP_SSL path; it now applies to the STARTTLS path as well. (#65346)

• In #64963, the Airflow UI switched from full-match *_pattern REST API query parameters to the new index-friendly *_prefix_pattern parameters on list endpoints. This is a behavioral change for search-as-you-type filters in the UI: matches are prefix-based (LIKE 'term%' via a range scan) instead of substring-based (ILIKE '%term%'), which means the database can use B-tree indexes and search stays fast on large deployments. The REST API itself keeps both forms: existing *_pattern parameters still behave exactly as before. In #66015, a per-search-bar "Match anywhere" toggle was added so users who relied on the previous substring behavior can opt back into it from the UI. Each search input and each text filter pill now has a small regex-icon toggle next to the value; flipping it on switches that input from *_prefix_pattern to *_pattern. (#66015)

• Fix triggerer race condition and deadlock that caused deferred tasks to stall indefinitely

  Triggers that call synchronous SDK methods (e.g. get_task_states used by safe_to_cancel in several Google provider operators) could crash the triggerer's internal subprocess. The triggerer would then continue to heartbeat normally — appearing healthy to the scheduler — while silently processing zero triggers, causing every deferred task to time out. This was first reported in issue #64620; a partial fix shipped in Airflow 3.2.1 (#64882) but introduced a new deadlock with the same visible symptom under load.

  Both issues are fixed by replacing the lock-based serialization with response multiplexing: each request now carries a unique ID and the response is routed back to the correct caller, so concurrent requests from trigger threads no longer contend or deadlock regardless of how many triggers are running or what SDK methods they call.

  New: triggerer subprocess watchdog

  Even with the race fixed, a trigger that blocks the event loop (e.g. by calling time.sleep() or performing blocking I/O directly in async def run()) would previously leave the triggerer appearing healthy indefinitely.

  A new [triggerer] runner_health_check_threshold config option (default: 30 seconds) adds a watchdog: if the triggerer subprocess goes silent for longer than the threshold, the parent process stops updating the heartbeat so the scheduler can detect the hang and reassign triggers rather than waiting for them to individually time out. Set the option to 0 to disable the watchdog. (#66412)

• Tighten [core] allowed_deserialization_classes_regexp to require full-string matches

  Patterns in [core] allowed_deserialization_classes_regexp are now matched against the entire classname using re.fullmatch() instead of re.match(). Previously a pattern such as airflow\.models\.Variable admitted not only the intended class but also names that started with it (e.g. airflow.models.Variable_Malicious), because re.match only anchors at the start of the string.

... (truncated)

Commits

• cde4885 Updating release notes for 3.2.2rc3
• 9b1bd3d [v3-2-test] UI: Rewrite modulepreload hrefs to the api-server static path (#6...
• a8b7bc2 [v3-2-test] CI: Upgrade important CI environment (#67533)
• f8404c9 Fix Callback.handle_event crash on OTel metrics with dict tag values (#67527)...
• d5dac01 Updating release notes for 3.2.2rc2
• 8367346 [v3-2-test] fix localhost access regression in dual-stack API server startup ...
• 54bd89c [v3-2-test] Cap pymysql<1.2 in PyPI constraints generation (#67491) (#67492)
• 3e19a0c Require starlette>=1.0.1 for Host header parsing fix (#67326) (#67460)
• 42d3ad1 [v3-2-test] Return raw import-error stacktrace when file has no registered Da...
• 7bccf36 [v3-2-test] CI: fix milestone-tag-assistant race when labels change post-merg...
• Additional commits viewable in compare view

[jiayuasu]

Closing — this isn't a security bump but an Airflow 2→3 major migration (it relaxes the supported cap <3 → <4 and moves the whole tree to airflow 3.2.2, which has breaking API changes). Airflow 3.x support is tracked deliberately in #63. The CVEs this would resolve are dev-only (apache-airflow is a dev dependency; the published provider ships only wherobots-python-dbapi + pydantic).

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.