fix(deps): vuln major upgrades — 4 packages (major: 2 · minor: 2) [providers/cncf/kubernetes]

[gh-worker-campaigns-3e9aa4]

Summary: Critical-severity security update — 4 packages upgraded (MAJOR changes included)

Manifests changed:

• providers/cncf/kubernetes (uv)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
apache-airflow	2.11.0	3.2.2	major	Direct	4 CRITICAL, 9 HIGH, 19 MEDIUM
urllib3	2.1.0	2.7.0	minor	Direct	8 HIGH, 4 MEDIUM
cryptography	44.0.3	49.0.0	major	Direct	3 HIGH, 3 LOW
asgiref	3.5.2	3.11.1	minor	Direct	-

---

Warning

Major Version Upgrade

This update includes major version changes that may contain breaking changes. Please:

• Review the changelog/release notes for breaking changes
• Test thoroughly in a staging environment
• Update any code that depends on changed APIs
• Ensure all tests pass before merging

Security Details

🚨 Critical & High Severity (24 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
apache-airflow	PYSEC-2023-314	critical	-	2.11.0	3.1.1	-
apache-airflow	GHSA-j69x-v4wc-3fpf	CRITICAL	Apache Airflow Sqoop Provider Improper Input Validation vulnerability	2.11.0	-	-
apache-airflow	CVE-2023-25693	critical	-	2.11.0	-	-
apache-airflow	PYSEC-2026-275	critical	Apache Airflow Sqoop Provider Improper Input Validation vulnerability	2.11.0	-	-
apache-airflow	CVE-2024-56373	HIGH	-	2.11.0	-	-
apache-airflow	PYSEC-2026-10	HIGH	-	2.11.0	3.1.6	-
apache-airflow	GHSA-q2hg-643c-gw8h	HIGH	Apache Airflow: RCE by race condition in example_xcom dag	2.11.0	3.2.0	-
apache-airflow	GHSA-r837-hpv7-pc2f	HIGH	Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table	2.11.0	2.11.1	-
apache-airflow	PYSEC-2026-186	high	-	2.11.0	3.2.2	-
apache-airflow	GHSA-6ffj-2wg2-w45j	HIGH	Apache Airflow allows code execution through crafted XCom payloads	2.11.0	-	-
apache-airflow	PYSEC-2026-13	HIGH	-	2.11.0	3.2.0	-
apache-airflow	GHSA-7c2f-r6gc-h92h	HIGH	Apache Airflow proxy credentials for various providers might leak in task logs	2.11.0	3.1.6	-
apache-airflow	CVE-2025-68675	HIGH	-	2.11.0	-	-
cryptography	GHSA-r6ph-v2qm-q3c2	HIGH	cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves	44.0.3	46.0.5	-
cryptography	GHSA-537c-gmf6-5ccf	HIGH	Vulnerable OpenSSL included in cryptography wheels	44.0.3	48.0.1	-
cryptography	CVE-2026-26007	HIGH	cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves	44.0.3	-	-
urllib3	GHSA-gm62-xv2j-4w53	HIGH	urllib3 allows an unbounded number of links in the decompression chain	2.1.0	2.6.0	-
urllib3	CVE-2026-21441	HIGH	urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)	2.1.0	-	-
urllib3	GHSA-38jv-5279-wg99	HIGH	Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)	2.1.0	2.6.3	-
urllib3	CVE-2025-66471	HIGH	urllib3 Streaming API improperly handles highly compressed data	2.1.0	-	-
urllib3	CVE-2025-66418	HIGH	urllib3 allows an unbounded number of links in the decompression chain	2.1.0	-	-
urllib3	GHSA-2xpw-w6gg-jr37	HIGH	urllib3 streaming API improperly handles highly compressed data	2.1.0	2.6.0	-
urllib3	PYSEC-2026-141	HIGH	-	2.1.0	2.7.0	-
urllib3	GHSA-qccp-gfcp-xxvc	HIGH	urllib3: Sensitive headers forwarded across origins in proxied low-level redirects	2.1.0	2.7.0	-

ℹ️ Other Vulnerabilities (26)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
apache-airflow	PYSEC-2026-173	medium	-	2.11.0	3.2.2	-
apache-airflow	PYSEC-2026-181	medium	-	2.11.0	3.2.2	-
apache-airflow	PYSEC-2026-172	medium	-	2.11.0	3.2.2	-
apache-airflow	PYSEC-2026-187	medium	-	2.11.0	3.2.2	-
apache-airflow	PYSEC-2025-85	medium	-	2.11.0	-	-
apache-airflow	CVE-2025-54831	medium	-	2.11.0	-	-
apache-airflow	GHSA-8r55-rv5w-6pfm	MODERATE	Apache Airflow exposes sensitive information in its log files	2.11.0	2.11.1	-
apache-airflow	CVE-2025-65995	MODERATE	-	2.11.0	-	-
apache-airflow	GHSA-q475-2pgm-7hvp	MODERATE	Apache Airflow: Connection sensitive details exposed to users with READ permissions	2.11.0	3.0.4	-
apache-airflow	GHSA-p3v3-229h-mc63	MODERATE	Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record	2.11.0	3.2.1rc1	-
apache-airflow	CVE-2025-27555	MODERATE	-	2.11.0	-	-
apache-airflow	PYSEC-2026-12	MODERATE	-	2.11.0	3.1.7	-
apache-airflow	GHSA-5g2w-9f8g-g5q7	MODERATE	Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users	2.11.0	3.1.7	-
apache-airflow	GHSA-w7cf-2pmc-5m4c	MODERATE	Apache Airflow exposes SQL stack trace despite "api/expose_stack_traces" set to false	2.11.0	-	-
apache-airflow	PYSEC-2026-18	MODERATE	-	2.11.0	3.2.0	-
apache-airflow	CVE-2026-24098	MODERATE	-	2.11.0	-	-
apache-airflow	GHSA-w7rc-q6cm-f5gm	MODERATE	Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions	2.11.0	3.2.1rc1	-
apache-airflow	GHSA-4g48-54q2-fg7q	MODERATE	Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access	2.11.0	3.1.8	-
apache-airflow	GHSA-gfw7-2v73-69wg	MODERATE	Apache Airflow error reporting may expose full kwargs	2.11.0	2.11.1	-
urllib3	CVE-2024-37891	MODERATE	Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3	2.1.0	-	-
urllib3	GHSA-pq67-6m6q-mj2v	MODERATE	urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation	2.1.0	2.5.0	-
urllib3	CVE-2025-50181	MODERATE	urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation	2.1.0	-	-
urllib3	GHSA-34jh-p97f-mpxf	MODERATE	urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects	2.1.0	1.26.19	-
cryptography	PYSEC-2026-35	LOW	-	44.0.3	46.0.6	-
cryptography	CVE-2026-34073	LOW	cryptography has incomplete DNS name constraint enforcement on peer names	44.0.3	-	-
cryptography	GHSA-m959-cc7f-wv43	LOW	cryptography has incomplete DNS name constraint enforcement on peer names	44.0.3	46.0.6	-

⚠️ Dependencies that have Reached EOL (1)

Dependency	Unsafe Version	EOL Date	New Version	Path
cryptography	44.0.3	-	49.0.0	providers/cncf/kubernetes/pyproject.toml

---

Review Checklist

Extra review is recommended for this update:

• Review changes for compatibility with your code
• Check release notes for breaking changes
• Run integration tests to verify service behavior
• Test in staging environment before production
• Monitor key metrics after deployment
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with main — rebased onto b3cc48d.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}