-
Notifications
You must be signed in to change notification settings - Fork 16.3k
Mask secrets properly when using deprecated import path #58662
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
amoghrajesh
merged 1 commit into
apache:main
from
amoghrajesh:compat-shim-for-masker-proper
Nov 26, 2025
Merged
Mask secrets properly when using deprecated import path #58662
amoghrajesh
merged 1 commit into
apache:main
from
amoghrajesh:compat-shim-for-masker-proper
Nov 26, 2025
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sunank200
approved these changes
Nov 25, 2025
Collaborator
sunank200
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Overall good change
potiuk
approved these changes
Nov 25, 2025
Contributor
Author
|
I will try the fix for automatic backport on this PR: #58705 |
github-actions bot
pushed a commit
to aws-mwaa/upstream-to-airflow
that referenced
this pull request
Nov 26, 2025
…pache#58662) (cherry picked from commit 0afe6d3) Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com>
potiuk
pushed a commit
that referenced
this pull request
Nov 28, 2025
ephraimbuddy
pushed a commit
that referenced
this pull request
Dec 3, 2025
itayweb
pushed a commit
to itayweb/airflow
that referenced
this pull request
Dec 6, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The deprecated import path 'airflow.sdk.execution_time.secrets_masker' was redirecting mask_secret() to a single-process implementation that only masked secrets in the task subprocess. This caused secrets to not be masked in logs because the supervisor process (which writes logs) did not receive masking instructions through this message: https://github.com/apache/airflow/blob/main/task-sdk/src/airflow/sdk/log.py#L244-L250
Users importing
mask_secretfrom the old path would see their secrets appear unmasked in task logs despite callingmask_secret()successfully.The compatibility shim now redirects
mask_secretto the supervisor aware implementation inairflow.sdk.logthat properly masks secrets in both the task and supervisor processes.Testing
DAG used:
Before the change:

After the change:
I also fixed the deprecation warning which was not being emitted.
^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named
{pr_number}.significant.rstor{issue_number}.significant.rst, in airflow-core/newsfragments.