mirror of
https://github.com/apache/airflow.git
synced 2026-11-04 07:12:48 +00:00
fd9298bf79
* Chart: Bump PgBouncer to 1.25.2 and exporter to 0.21.0 to fix CVEs Update the default PgBouncer image to PgBouncer 1.25.2, which fixes CVE-2026-6664, CVE-2026-6665 and CVE-2026-6666. CVE-2026-6664 lets an unauthenticated client crash PgBouncer with a malformed SCRAM packet, and the chart uses scram-sha-256 by default. Update the PgBouncer exporter image to 0.21.0 built with Go 1.27.2. Exporter 0.18.0 cannot parse the SHOW STATS columns added in PgBouncer 1.24, which is why the previous 1.24 bump was rolled back. Both images are rebuilt on the current Alpine 3.23 with apk upgrade, and unused runtime packages (libressl, libressl-dev, openssl) are dropped. * Rename PgBouncer newsfragment to PR number * Clarify which PgBouncer behaviour changes can be restored Review feedback: 1.25.2 also fixes CVE-2026-6667, and not every behaviour change listed can be set back through pgbouncer.extraIni. reserve_pool is a per-database setting whose old name still works, and the KILL_CLIENT and auth_query changes are security fixes. --------- Co-authored-by: Mathieu Monet <mathieu.monet@infrabel.be> Co-authored-by: David Blain <info@dabla.be>
Those are images that are needed for the Helm Chart.
In each of the images you can find "build_and_push.sh" script that builds and pushes the image.
You need to be a PMC member with direct push access to "apache/airflow" DockerHub registry to be able to push to the Airflow DockerHub registry.
You can set the DOCKERHUB_USER variable to push to your own DockerHub user if you want to test the image or build your own image.