From e9f61f4440c2540fb49b5ac7c0dc333a8a73c911 Mon Sep 17 00:00:00 2001
From: "Jason(Zhe-You) Liu" <68415893+jason810496@users.noreply.github.com>
Date: Thu, 25 Jun 2026 11:10:45 +0900
Subject: [PATCH 01/29] [v3-3-test] Correct the example config for the
 coordinators (#68929) (#68940)

* Correct the example and docstring for the coordinators

* Guard the config.yml coordinators example against drift
(cherry picked from commit 4aafb95)
---
 .../src/airflow/config_templates/config.yml   |  7 ++++
 .../coordinators/executable/coordinator.py    |  7 ++--
 .../sdk/coordinators/java/coordinator.py      |  9 +++---
 .../execution_time/test_coordinator.py        | 32 ++++++++++++++++++-
 4 files changed, 45 insertions(+), 10 deletions(-)

diff --git a/airflow-core/src/airflow/config_templates/config.yml b/airflow-core/src/airflow/config_templates/config.yml
index 29763f422feb7..39423755a6841 100644
--- a/airflow-core/src/airflow/config_templates/config.yml
+++ b/airflow-core/src/airflow/config_templates/config.yml
@@ -2091,6 +2091,7 @@ sdk:
           "jdk-17": {
             "classpath": "airflow.sdk.coordinators.java.JavaCoordinator",
             "kwargs": {
+              "jars_root": ["/opt/airflow/java-bundles"],
               "java_executable": "/usr/lib/jvm/java-17-openjdk/bin/java",
               "jvm_args": ["-Xmx1024m"]
             },
@@ -2099,6 +2100,12 @@ sdk:
               "worker_container_repository": "apache/airflow",
               "worker_container_tag": "3.3.0"
             }
+          },
+          "go-sdk": {
+            "classpath": "airflow.sdk.coordinators.executable.ExecutableCoordinator",
+            "kwargs": {
+              "executables_root": ["/opt/airflow/executable-bundles"]
+            }
           }
         }
       default: ~
diff --git a/task-sdk/src/airflow/sdk/coordinators/executable/coordinator.py b/task-sdk/src/airflow/sdk/coordinators/executable/coordinator.py
index ed11f97165d1a..2275628d0b1c8 100644
--- a/task-sdk/src/airflow/sdk/coordinators/executable/coordinator.py
+++ b/task-sdk/src/airflow/sdk/coordinators/executable/coordinator.py
@@ -370,12 +370,11 @@ class ExecutableCoordinator(SubprocessCoordinator):
     Configuration is taken from the ``[sdk] coordinators`` entry that constructs
     this instance::
 
-        {
-            "name": "go",
+        "go": {
             "classpath": "airflow.sdk.coordinators.executable.ExecutableCoordinator",
             "kwargs": {
-                "executables_root": ["~/airflow/executable-bundles"],
-            },
+                "executables_root": ["~/airflow/executable-bundles"]
+            }
         }
 
     :param executables_root: A list of directories scanned for executable
diff --git a/task-sdk/src/airflow/sdk/coordinators/java/coordinator.py b/task-sdk/src/airflow/sdk/coordinators/java/coordinator.py
index cb74c64dfd48f..da35d0f37b84e 100644
--- a/task-sdk/src/airflow/sdk/coordinators/java/coordinator.py
+++ b/task-sdk/src/airflow/sdk/coordinators/java/coordinator.py
@@ -174,14 +174,13 @@ class JavaCoordinator(SubprocessCoordinator):
     Configuration is taken from the ``[sdk] coordinators`` entry that constructs
     this instance::
 
-        {
-            "name": "jdk-17",
+        "jdk-17": {
             "classpath": "airflow.sdk.coordinators.java.JavaCoordinator",
             "kwargs": {
-                "java_executable": "/usr/lib/jvm/java-17-openjdk/bin/java",
-                "jvm_args": ["-Xmx1024m"],
                 "jars_root": ["~/airflow/jars"],
-            },
+                "java_executable": "/usr/lib/jvm/java-17-openjdk/bin/java",
+                "jvm_args": ["-Xmx1024m"]
+            }
         }
 
     :param java_executable: Path to the ``java`` command (defaults to
diff --git a/task-sdk/tests/task_sdk/execution_time/test_coordinator.py b/task-sdk/tests/task_sdk/execution_time/test_coordinator.py
index 475b587bf7f1f..40db5378afccf 100644
--- a/task-sdk/tests/task_sdk/execution_time/test_coordinator.py
+++ b/task-sdk/tests/task_sdk/execution_time/test_coordinator.py
@@ -22,7 +22,8 @@
 
 import pytest
 
-from airflow.sdk.configuration import conf
+from airflow.sdk._shared.module_loading import import_string
+from airflow.sdk.configuration import conf, retrieve_configuration_description
 from airflow.sdk.execution_time.coordinator import (
     BaseCoordinator,
     CoordinatorManager,
@@ -199,3 +200,32 @@ def test_extra_for_queue_does_not_instantiate_coordinator(self, sdk_config):
             "pod_template_file": "/opt/airflow/pod_templates/boom.yaml"
         }
         assert manager._created_coordinators == {}
+
+
+class TestConfigYamlCoordinatorsExample:
+    """Guard the ``[sdk] coordinators`` example in ``config.yml`` against drift.
+
+    Nothing else exercises the example, so a broken one (e.g. dropping the
+    required ``jars_root`` kwarg) can ship unnoticed. Loading it through
+    CoordinatorManager and constructing every entry keeps the example honest.
+    """
+
+    def test_every_example_coordinator_constructs(self, sdk_config):
+        description = retrieve_configuration_description()
+        coordinators_example = description["sdk"]["options"]["coordinators"]["example"]
+        specs = json.loads(coordinators_example)
+        assert specs, "config.yml [sdk] coordinators example must not be empty"
+
+        # The example's own queue_to_coordinator illustrates different keys, so
+        # route every coordinator through a synthetic queue to construct each one.
+        queue_to_coordinator = {f"queue-{key}": key for key in specs}
+        sdk_config(
+            coordinators=coordinators_example,
+            queue_to_coordinator=json.dumps(queue_to_coordinator),
+        )
+        manager = CoordinatorManager.from_config()
+        assert set(manager._coordinator_specs) == set(specs)
+
+        for queue, key in queue_to_coordinator.items():
+            coordinator = manager.for_queue(queue)
+            assert isinstance(coordinator, import_string(specs[key]["classpath"]))

From cb174a6937aeff42e8bbb8d1a62089e60cfc7071 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 25 Jun 2026 11:08:14 +0200
Subject: [PATCH 02/29] [v3-3-test] Fix race condition on sort param when
 returning dagRuns (#68842) (#68948)

(cherry picked from commit 31f7ba742092432bd5a686ca028f62d55c257184)

Co-authored-by: Hasnain Raza <4294680+HasnainRaz@users.noreply.github.com>
---
 .../airflow/api_fastapi/common/parameters.py  |  2 +-
 .../api_fastapi/common/test_parameters.py     | 21 +++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/airflow-core/src/airflow/api_fastapi/common/parameters.py b/airflow-core/src/airflow/api_fastapi/common/parameters.py
index 17185fe20e251..935b547c1a7cf 100644
--- a/airflow-core/src/airflow/api_fastapi/common/parameters.py
+++ b/airflow-core/src/airflow/api_fastapi/common/parameters.py
@@ -718,7 +718,7 @@ def dynamic_depends(self, default: str | Sequence[str] | None = None) -> Callabl
         )
 
         def inner(order_by: list[str] = _order_by_query) -> SortParam:
-            return self.set_value(order_by)
+            return SortParam(self.allowed_attrs, self.model, self.to_replace).set_value(order_by)
 
         return inner
 
diff --git a/airflow-core/tests/unit/api_fastapi/common/test_parameters.py b/airflow-core/tests/unit/api_fastapi/common/test_parameters.py
index d02496ae87d30..4d2f473f4f830 100644
--- a/airflow-core/tests/unit/api_fastapi/common/test_parameters.py
+++ b/airflow-core/tests/unit/api_fastapi/common/test_parameters.py
@@ -165,6 +165,27 @@ def test_primary_key_is_not_duplicated_when_alias_maps_to_pk(self):
         resolved = param.get_resolved_columns()
         assert [name for name, _col, _desc in resolved] == ["import_error_id"]
 
+    def test_dynamic_depends_returns_independent_instances(self):
+        """Each call to the inner closure must produce a separate SortParam instance.
+
+        Two concurrent requests with different order_by values must not share state —
+        a mutation on one must not affect the other.
+        """
+        sort_param = SortParam(["id", "run_id", "logical_date"], DagRun, {"dag_run_id": "run_id"})
+        inner = sort_param.dynamic_depends(default="id")
+
+        instance_a = inner(order_by=["logical_date"])
+        instance_b = inner(order_by=["run_id"])
+
+        assert instance_a is not instance_b
+        assert instance_a.value == ["logical_date"]
+        assert instance_b.value == ["run_id"]
+        # Resolving one must not affect the other.
+        cols_a = [name for name, _col, _desc in instance_a.get_resolved_columns()]
+        cols_b = [name for name, _col, _desc in instance_b.get_resolved_columns()]
+        assert cols_a[0] == "logical_date"
+        assert cols_b[0] == "run_id"
+
 
 def _compile(statement):
     return str(statement.compile(compile_kwargs={"literal_binds": True})).lower()

From eda27d177151ad3335cc1294330c23b3d48a5bc0 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 25 Jun 2026 17:46:08 +0100
Subject: [PATCH 03/29] [v3-3-test] Allow missing `api_auth.jwt_secret` for
 `InProcessExecutionAPI` (#68980) (#68982)

PR #68840 fixed an issue where exceptions thrown by the FastAPI
lifecycle hook were swallowed. In doing so, it exposed a pre-existing
problem where the lifecycle hook couldn't run when the JWT secret was
not provided.

As the `InProcessExecutionAPI` overrides auth, it doesn't need a JWT
secret, and we certainly don't want to start crashing processes that
previously ran fine as a result of a missing secret that we don't need.

This commit stubs out the registered `JWTValidator` in the FastAPI app
created for the `InProcessExecutionAPI`. This is done in an isolated
services registry to ensure we don't leak this into any real app
instantiations.
(cherry picked from commit e886dfd05eee4b8b38efdbd34f2fae5ae49ac6cd)

Co-authored-by: Nick Stenning <nick@whiteink.com>
---
 .../airflow/api_fastapi/execution_api/app.py  | 19 +++++++++++++++----
 .../api_fastapi/execution_api/test_app.py     | 10 ++++++++++
 task-sdk/dev/generate_task_sdk_models.py      |  2 --
 3 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/airflow-core/src/airflow/api_fastapi/execution_api/app.py b/airflow-core/src/airflow/api_fastapi/execution_api/app.py
index 449019db7998d..5a87cdb81e04c 100644
--- a/airflow-core/src/airflow/api_fastapi/execution_api/app.py
+++ b/airflow-core/src/airflow/api_fastapi/execution_api/app.py
@@ -99,8 +99,11 @@ async def lifespan(app: FastAPI, registry: svcs.Registry):
     app.state.svcs_registry = registry
 
     registry.register_factory(JWTGenerator, _jwt_generator)
-    # Create an app scoped validator, so that we don't have to fetch it every time
-    registry.register_value(JWTValidator, _jwt_validator(), ping=JWTValidator.status)
+
+    # InProcessExecutionAPI stubs out JWTValidator: don't re-register in that case.
+    if JWTValidator not in registry:
+        # Create an app scoped validator, so that we don't have to fetch it every time
+        registry.register_value(JWTValidator, _jwt_validator(), ping=JWTValidator.status)
 
     yield
 
@@ -282,7 +285,7 @@ def _inject_trace_context_dep(routes, mode: str) -> None:
                     route.dependencies.append(dep)
 
 
-def create_task_execution_api_app() -> FastAPI:
+def create_task_execution_api_app(lifespan: svcs.fastapi.lifespan = lifespan) -> FastAPI:
     """Create FastAPI app for task execution API."""
     from airflow.api_fastapi.execution_api.routes import execution_api_router
     from airflow.api_fastapi.execution_api.versions import bundle
@@ -388,7 +391,15 @@ def app(self):
             from airflow.api_fastapi.execution_api.routes.xcoms import has_xcom_access
             from airflow.api_fastapi.execution_api.security import _jwt_bearer
 
-            self._app = create_task_execution_api_app()
+            # Give this app its own lifespan + services registry so that stubbing services
+            # (e.g. JWTValidator) doesn't affect the module-level ``lifespan.registry``.
+            registry = svcs.Registry()
+            private_lifespan = attrs.evolve(lifespan, registry=registry)
+            self._app = create_task_execution_api_app(lifespan=private_lifespan)
+
+            # In-process callers don't need a real JWTValidator: auth is bypassed below via
+            # ``dependency_overrides``.
+            registry.register_value(JWTValidator, None)
 
             # Set up dag_bag in app state for dependency injection
             self._app.state.dag_bag = create_dag_bag()
diff --git a/airflow-core/tests/unit/api_fastapi/execution_api/test_app.py b/airflow-core/tests/unit/api_fastapi/execution_api/test_app.py
index 32880773ade2e..d4b9ce5ac88d7 100644
--- a/airflow-core/tests/unit/api_fastapi/execution_api/test_app.py
+++ b/airflow-core/tests/unit/api_fastapi/execution_api/test_app.py
@@ -22,6 +22,7 @@
 from unittest import mock
 from uuid import UUID
 
+import httpx
 import pytest
 from fastapi import Request
 from fastapi.params import Security as SecurityParam
@@ -137,6 +138,15 @@ def test_routes_with_task_instance_id_param_enforce_ti_self(client):
     )
 
 
+@conf_vars({("api_auth", "jwt_secret"): None})
+def test_in_process_execution_api_runs_without_jwt_secret():
+    """The in-process API must not require ``api_auth/jwt_secret`` to be configured."""
+    api = InProcessExecutionAPI()
+    with httpx.Client(transport=api.transport) as client:
+        response = client.get("http://localhost/health")
+    assert response.status_code == 200
+
+
 def test_in_process_execution_api_transport_lifecycle():
     """The background loop + thread lifecycle is tied to the ``.transport``, not the factory instance.
 
diff --git a/task-sdk/dev/generate_task_sdk_models.py b/task-sdk/dev/generate_task_sdk_models.py
index 74a1cb7f756a8..bb19fffc4497c 100644
--- a/task-sdk/dev/generate_task_sdk_models.py
+++ b/task-sdk/dev/generate_task_sdk_models.py
@@ -33,8 +33,6 @@
 from openapi_spec_validator import validate_spec
 
 os.environ["_AIRFLOW__AS_LIBRARY"] = "1"
-# Set a placeholder secret to allow the in-process FastAPI app to run its lifecycle hooks.
-os.environ.setdefault("AIRFLOW__API_AUTH__JWT_SECRET", "task-sdk-model-generation")
 
 AIRFLOW_ROOT_PATH = Path(__file__).parents[2].resolve()
 AIRFLOW_TASK_SDK_ROOT_PATH = AIRFLOW_ROOT_PATH / "task-sdk"

From fce31dd2c952964a2303d2554d93ec28b92be033 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 08:56:13 +0800
Subject: [PATCH 04/29] [v3-3-test] Rename PartitionAtRuntime as
 PartitionedAtRuntime for consistency (#68978) (#68987)

Co-authored-by: Wei Lee <weilee.rx@gmail.com>
---
 .../docs/authoring-and-scheduling/assets.rst  | 12 ++++-----
 .../example_dags/example_asset_partition.py   | 12 ++++-----
 .../src/airflow/serialization/encoders.py     |  8 +++---
 airflow-core/src/airflow/timetables/base.py   |  2 +-
 airflow-core/src/airflow/timetables/simple.py |  6 ++---
 .../tests/unit/api/common/test_trigger_dag.py | 12 ++++-----
 .../core_api/routes/public/test_assets.py     |  6 ++---
 .../core_api/routes/public/test_dag_run.py    | 26 +++++++++----------
 .../tests/unit/assets/test_manager.py         |  4 +--
 .../unit/dag_processing/test_collection.py    |  4 +--
 .../tests/unit/jobs/test_scheduler_job.py     |  6 ++---
 airflow-core/tests/unit/models/test_dag.py    |  6 ++---
 .../tests/unit/models/test_taskinstance.py    | 20 +++++++-------
 .../serialization/test_dag_serialization.py   | 10 +++----
 task-sdk/docs/api.rst                         |  2 +-
 task-sdk/src/airflow/sdk/__init__.py          |  6 ++---
 task-sdk/src/airflow/sdk/__init__.pyi         |  4 +--
 task-sdk/src/airflow/sdk/bases/timetable.py   |  2 +-
 .../sdk/definitions/timetables/assets.py      |  2 +-
 .../tests/task_sdk/definitions/test_dag.py    | 17 +++++++++---
 20 files changed, 88 insertions(+), 79 deletions(-)

diff --git a/airflow-core/docs/authoring-and-scheduling/assets.rst b/airflow-core/docs/authoring-and-scheduling/assets.rst
index d039fbfd1ffd3..a74664302da5f 100644
--- a/airflow-core/docs/authoring-and-scheduling/assets.rst
+++ b/airflow-core/docs/authoring-and-scheduling/assets.rst
@@ -781,7 +781,7 @@ semantics (the default).
         DAG,
         Asset,
         FixedKeyMapper,
-        PartitionAtRuntime,
+        PartitionedAtRuntime,
         PartitionedAssetTimetable,
         RollupMapper,
         SegmentWindow,
@@ -792,7 +792,7 @@ semantics (the default).
 
     @asset(
         uri="file://incoming/player-stats/multi-region.csv",
-        schedule=PartitionAtRuntime(),
+        schedule=PartitionedAtRuntime(),
     )
     def multi_region_player_stats(self, outlet_events):
         # Emit one event per region in a single run.
@@ -836,17 +836,17 @@ Setting partition keys at runtime
 When the partition key is not known ahead of time (for example, a watermark
 discovered from the source data, a late-arriving file, or a backfill request),
 let the producing task decide it while it runs. Schedule the producer with
-``PartitionAtRuntime()`` and record the key(s) on the emitted event with
+``PartitionedAtRuntime()`` and record the key(s) on the emitted event with
 ``outlet_events[self].add_partitions(...)``:
 
 .. code-block:: python
 
-    from airflow.sdk import PartitionAtRuntime, asset
+    from airflow.sdk import PartitionedAtRuntime, asset
 
 
     @asset(
         uri="file://incoming/player-stats/live-region.csv",
-        schedule=PartitionAtRuntime(),
+        schedule=PartitionedAtRuntime(),
     )
     def live_region_player_stats(self, outlet_events):
         # The key is only known once the task runs.
@@ -862,7 +862,7 @@ keys collapse to a single event:
 
     @asset(
         uri="file://incoming/player-stats/multi-region.csv",
-        schedule=PartitionAtRuntime(),
+        schedule=PartitionedAtRuntime(),
     )
     def multi_region_player_stats(self, outlet_events):
         outlet_events[self].add_partitions(["us", "eu", "apac"])
diff --git a/airflow-core/src/airflow/example_dags/example_asset_partition.py b/airflow-core/src/airflow/example_dags/example_asset_partition.py
index a7929ed92581f..f4171bb46f1e7 100644
--- a/airflow-core/src/airflow/example_dags/example_asset_partition.py
+++ b/airflow-core/src/airflow/example_dags/example_asset_partition.py
@@ -30,8 +30,8 @@
     IdentityMapper,
     MinimumCount,
     MonthWindow,
-    PartitionAtRuntime,
     PartitionedAssetTimetable,
+    PartitionedAtRuntime,
     ProductMapper,
     RollupMapper,
     SegmentWindow,
@@ -160,7 +160,7 @@ def check_partition_alignment():
 
 with DAG(
     dag_id="ingest_regional_sales",
-    schedule=PartitionAtRuntime(),
+    schedule=PartitionedAtRuntime(),
     tags=["example", "sales", "ingestion"],
 ):
     """Produce regional sales data with composite ``region|timestamp`` partition keys at runtime."""
@@ -207,7 +207,7 @@ def aggregate_sales(dag_run=None):
 
 with DAG(
     dag_id="ingest_region_stats",
-    schedule=PartitionAtRuntime(),
+    schedule=PartitionedAtRuntime(),
     tags=["example", "player-stats", "regional"],
 ):
     """
@@ -244,14 +244,14 @@ def regional_stats_breakdown():
 
 @asset(
     uri="file://incoming/player-stats/live-region.csv",
-    schedule=PartitionAtRuntime(),
+    schedule=PartitionedAtRuntime(),
     tags=["player-stats", "runtime"],
 )
 def live_region_player_stats(self, outlet_events):
     """
     Produce a single region partition whose key is decided at runtime.
 
-    This asset demonstrates PartitionAtRuntime, which records the partition key on the
+    This asset demonstrates PartitionedAtRuntime, which records the partition key on the
     emitted event with ``add_partitions`` while the task runs rather than from a timetable.
     """
     outlet_events[self].add_partitions("us")
@@ -281,7 +281,7 @@ def summarize_live_region(dag_run=None):
 
 @asset(
     uri="file://incoming/player-stats/multi-region.csv",
-    schedule=PartitionAtRuntime(),
+    schedule=PartitionedAtRuntime(),
     tags=["player-stats", "runtime"],
 )
 def multi_region_player_stats(self, outlet_events):
diff --git a/airflow-core/src/airflow/serialization/encoders.py b/airflow-core/src/airflow/serialization/encoders.py
index b31b7c828c68c..8ab533b888ae5 100644
--- a/airflow-core/src/airflow/serialization/encoders.py
+++ b/airflow-core/src/airflow/serialization/encoders.py
@@ -70,8 +70,8 @@
 from airflow.sdk.definitions.asset import AssetRef
 from airflow.sdk.definitions.timetables.assets import (
     AssetTriggeredTimetable,
-    PartitionAtRuntime,
     PartitionedAssetTimetable,
+    PartitionedAtRuntime,
 )
 from airflow.sdk.definitions.timetables.simple import ContinuousTimetable, NullTimetable, OnceTimetable
 from airflow.sdk.definitions.timetables.trigger import CronPartitionTimetable
@@ -329,7 +329,7 @@ class _Serializer:
         MultipleCronTriggerTimetable: "airflow.timetables.trigger.MultipleCronTriggerTimetable",
         NullTimetable: "airflow.timetables.simple.NullTimetable",
         OnceTimetable: "airflow.timetables.simple.OnceTimetable",
-        PartitionAtRuntime: "airflow.timetables.simple.PartitionAtRuntime",
+        PartitionedAtRuntime: "airflow.timetables.simple.PartitionedAtRuntime",
         PartitionedAssetTimetable: "airflow.timetables.simple.PartitionedAssetTimetable",
     }
 
@@ -355,9 +355,9 @@ def serialize_timetable(self, timetable: BaseTimetable | CoreTimetable) -> dict[
     @serialize_timetable.register(ContinuousTimetable)
     @serialize_timetable.register(NullTimetable)
     @serialize_timetable.register(OnceTimetable)
-    @serialize_timetable.register(PartitionAtRuntime)
+    @serialize_timetable.register(PartitionedAtRuntime)
     def _(
-        self, timetable: ContinuousTimetable | NullTimetable | OnceTimetable | PartitionAtRuntime
+        self, timetable: ContinuousTimetable | NullTimetable | OnceTimetable | PartitionedAtRuntime
     ) -> dict[str, Any]:
         return {}
 
diff --git a/airflow-core/src/airflow/timetables/base.py b/airflow-core/src/airflow/timetables/base.py
index 4bee4ab38a368..84d8aa2e46fee 100644
--- a/airflow-core/src/airflow/timetables/base.py
+++ b/airflow-core/src/airflow/timetables/base.py
@@ -240,7 +240,7 @@ class Timetable(Protocol):
     partitioned_at_runtime: bool = False
     """Whether this timetable defers partition selection to task runtime.
 
-    *True* for :class:`~airflow.timetables.simple.PartitionAtRuntime`;
+    *True* for :class:`~airflow.timetables.simple.PartitionedAtRuntime`;
     downstream code can branch on this flag instead of using ``isinstance``.
     """
 
diff --git a/airflow-core/src/airflow/timetables/simple.py b/airflow-core/src/airflow/timetables/simple.py
index a8b499dbe50ba..87741a8eb0d7e 100644
--- a/airflow-core/src/airflow/timetables/simple.py
+++ b/airflow-core/src/airflow/timetables/simple.py
@@ -186,11 +186,11 @@ def next_dagrun_info(
         return DagRunInfo.interval(start, end)
 
 
-class PartitionAtRuntime(NullTimetable):
+class PartitionedAtRuntime(NullTimetable):
     """
     Timetable that never schedules anything; partition keys are set at runtime.
 
-    This corresponds to ``schedule=PartitionAtRuntime()``.
+    This corresponds to ``schedule=PartitionedAtRuntime()``.
 
     A run's ``partition_key`` (run-level provenance) must be supplied at trigger
     time — for example via the REST API's ``partition_key`` field. Partition keys
@@ -204,7 +204,7 @@ class PartitionAtRuntime(NullTimetable):
 
     @property
     def summary(self) -> str:
-        return "PartitionAtRuntime"
+        return "PartitionedAtRuntime"
 
 
 class AssetTriggeredTimetable(_TrivialTimetable):
diff --git a/airflow-core/tests/unit/api/common/test_trigger_dag.py b/airflow-core/tests/unit/api/common/test_trigger_dag.py
index 6fc48bd081411..e1837426bc188 100644
--- a/airflow-core/tests/unit/api/common/test_trigger_dag.py
+++ b/airflow-core/tests/unit/api/common/test_trigger_dag.py
@@ -25,7 +25,7 @@
 from airflow.exceptions import InvalidPartitionKeyError
 from airflow.models import DagModel
 from airflow.providers.standard.operators.empty import EmptyOperator
-from airflow.timetables.simple import PartitionAtRuntime
+from airflow.timetables.simple import PartitionedAtRuntime
 from airflow.timetables.trigger import CronPartitionTimetable
 from airflow.utils.types import DagRunTriggeredByType, DagRunType
 
@@ -129,18 +129,18 @@ def test_trigger_dag_raises_invalid_partition_key_for_cron_partition_timetable(d
         )
 
 
-def test_trigger_dag_partition_at_runtime_leaves_partition_date_none(dag_maker, session):
-    """PartitionAtRuntime Dags accept arbitrary keys; partition_date stays None."""
+def test_trigger_dag_partitioned_at_runtime_leaves_partition_date_none(dag_maker, session):
+    """PartitionedAtRuntime Dags accept arbitrary keys; partition_date stays None."""
     with dag_maker(
         session=session,
-        dag_id="TEST_PARTITION_AT_RUNTIME",
-        schedule=PartitionAtRuntime(),
+        dag_id="TEST_PARTITIONED_AT_RUNTIME",
+        schedule=PartitionedAtRuntime(),
     ):
         EmptyOperator(task_id="mytask")
     session.commit()
 
     dag_run = trigger_dag(
-        dag_id="TEST_PARTITION_AT_RUNTIME",
+        dag_id="TEST_PARTITIONED_AT_RUNTIME",
         triggered_by=DagRunTriggeredByType.REST_API,
         partition_key="arbitrary-runtime-key",
         session=session,
diff --git a/airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_assets.py b/airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_assets.py
index b65036b72d9b3..33c43785a55a8 100644
--- a/airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_assets.py
+++ b/airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_assets.py
@@ -41,7 +41,7 @@
 from airflow.models.serialized_dag import SerializedDagModel
 from airflow.models.trigger import Trigger
 from airflow.providers.standard.operators.empty import EmptyOperator
-from airflow.timetables.simple import PartitionAtRuntime
+from airflow.timetables.simple import PartitionedAtRuntime
 from airflow.utils.session import provide_session
 from airflow.utils.state import DagRunState
 from airflow.utils.types import DagRunType
@@ -1519,9 +1519,9 @@ def create_dags(self, setup, dag_maker, session):
             i: am.to_serialized() for i, am in enumerate(self.create_assets(session=session, num=3), start=1)
         }
         # DAG_ASSET1_ID is materialized with a partition_key in several tests below, so it must be a
-        # partitioned Dag. PartitionAtRuntime accepts runtime-discovered partition keys without
+        # partitioned Dag. PartitionedAtRuntime accepts runtime-discovered partition keys without
         # requiring a partitioned timetable.
-        with dag_maker(self.DAG_ASSET1_ID, schedule=PartitionAtRuntime(), session=session):
+        with dag_maker(self.DAG_ASSET1_ID, schedule=PartitionedAtRuntime(), session=session):
             EmptyOperator(task_id="task", outlets=assets[1])
         with dag_maker(self.DAG_ASSET2_ID_A, schedule=None, session=session):
             EmptyOperator(task_id="task", outlets=assets[2])
diff --git a/airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_dag_run.py b/airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_dag_run.py
index 5b5a0293ffc4b..39a391f80f1b4 100644
--- a/airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_dag_run.py
+++ b/airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_dag_run.py
@@ -45,7 +45,7 @@
 from airflow.sdk import Asset, Param, result, task
 from airflow.settings import _configure_async_session
 from airflow.timetables.interval import CronDataIntervalTimetable
-from airflow.timetables.simple import PartitionAtRuntime, PartitionedAssetTimetable
+from airflow.timetables.simple import PartitionedAssetTimetable, PartitionedAtRuntime
 from airflow.timetables.trigger import CronPartitionTimetable
 from airflow.utils.session import provide_session
 from airflow.utils.state import DagRunState, State
@@ -1619,8 +1619,8 @@ class TestGetDagRunAssetTriggerEvents:
     def test_should_respond_200(self, partition_key, test_client, dag_maker, session):
         asset1 = Asset(name="ds1", uri="file:///da1")
 
-        # Use PartitionAtRuntime for partitioned cases so the partition_key gate does not reject the key.
-        source_schedule = PartitionAtRuntime() if partition_key is not None else timedelta(days=1)
+        # Use PartitionedAtRuntime for partitioned cases so the partition_key gate does not reject the key.
+        source_schedule = PartitionedAtRuntime() if partition_key is not None else timedelta(days=1)
         with dag_maker(
             dag_id="source_dag", start_date=START_DATE1, schedule=source_schedule, session=session
         ):
@@ -1639,7 +1639,7 @@ def test_should_respond_200(self, partition_key, test_client, dag_maker, session
         )
         session.add(event)
 
-        trigger_schedule = PartitionAtRuntime() if partition_key is not None else timedelta(days=1)
+        trigger_schedule = PartitionedAtRuntime() if partition_key is not None else timedelta(days=1)
         with dag_maker(
             dag_id="TEST_DAG_ID", start_date=START_DATE1, schedule=trigger_schedule, session=session
         ):
@@ -1650,7 +1650,7 @@ def test_should_respond_200(self, partition_key, test_client, dag_maker, session
             "partition_key": partition_key,
         }
         if partition_key is not None:
-            # PartitionAtRuntime is a null-timetable with no scheduled runs; supply logical_date=None
+            # PartitionedAtRuntime is a null-timetable with no scheduled runs; supply logical_date=None
             # explicitly so dag_maker does not try to infer it via next_dagrun_info (which returns None).
             create_dagrun_kwargs["logical_date"] = None
         dr = dag_maker.create_dagrun(**create_dagrun_kwargs)
@@ -3503,18 +3503,18 @@ def test_should_respond_200_when_partition_key_given_for_partitioned_dag(
         assert response.status_code == 200
 
     @pytest.mark.usefixtures("configure_git_connection_for_dag_bundle")
-    def test_should_respond_200_when_partition_key_given_for_partition_at_runtime_dag(
+    def test_should_respond_200_when_partition_key_given_for_partitioned_at_runtime_dag(
         self, dag_maker, test_client, session
     ):
-        """partition_key on a PartitionAtRuntime Dag must also be accepted (deferred validation).
+        """partition_key on a PartitionedAtRuntime Dag must also be accepted (deferred validation).
 
         partitioned_at_runtime=True means the Dag accepts runtime-discovered partition keys, so
         the REST layer must not reject it even though timetable.partitioned is False.
         """
-        runtime_dag_id = "test_partition_at_runtime_dag_trigger"
+        runtime_dag_id = "test_partitioned_at_runtime_dag_trigger"
         with dag_maker(
             dag_id=runtime_dag_id,
-            schedule=PartitionAtRuntime(),
+            schedule=PartitionedAtRuntime(),
             start_date=START_DATE1,
             session=session,
             serialized=True,
@@ -3638,14 +3638,14 @@ def test_trigger_partitioned_dag_invalid_key_returns_400(self, dag_maker, test_c
         assert response.status_code == 400
 
     @pytest.mark.usefixtures("configure_git_connection_for_dag_bundle")
-    def test_trigger_partition_at_runtime_dag_leaves_partition_date_none(
+    def test_trigger_partitioned_at_runtime_dag_leaves_partition_date_none(
         self, dag_maker, test_client, session
     ):
-        """PartitionAtRuntime Dag with an arbitrary key must produce partition_date=None."""
-        runtime_dag_id = "test_trigger_partition_at_runtime_none_date"
+        """PartitionedAtRuntime Dag with an arbitrary key must produce partition_date=None."""
+        runtime_dag_id = "test_trigger_partitioned_at_runtime_none_date"
         with dag_maker(
             dag_id=runtime_dag_id,
-            schedule=PartitionAtRuntime(),
+            schedule=PartitionedAtRuntime(),
             start_date=START_DATE1,
             session=session,
             serialized=True,
diff --git a/airflow-core/tests/unit/assets/test_manager.py b/airflow-core/tests/unit/assets/test_manager.py
index 54ddd66a2d496..b788b9ab28699 100644
--- a/airflow-core/tests/unit/assets/test_manager.py
+++ b/airflow-core/tests/unit/assets/test_manager.py
@@ -494,10 +494,10 @@ def test_queue_partitioned_dags_stamps_rollup_fingerprint(self, session, dag_mak
         # partition-at-runtime Dag so its run can carry a ``partition_key`` that
         # the emitted ``AssetEvent`` inherits.
         from airflow.models.taskinstance import TaskInstance
-        from airflow.sdk import PartitionAtRuntime
+        from airflow.sdk import PartitionedAtRuntime
 
         with dag_maker(
-            dag_id="stamp-producer", schedule=PartitionAtRuntime(), session=session
+            dag_id="stamp-producer", schedule=PartitionedAtRuntime(), session=session
         ) as producer_dag:
             from airflow.providers.standard.operators.empty import EmptyOperator
 
diff --git a/airflow-core/tests/unit/dag_processing/test_collection.py b/airflow-core/tests/unit/dag_processing/test_collection.py
index fe15045598ff5..ee8d7fa0fcd22 100644
--- a/airflow-core/tests/unit/dag_processing/test_collection.py
+++ b/airflow-core/tests/unit/dag_processing/test_collection.py
@@ -64,7 +64,7 @@
 from airflow.serialization.definitions.assets import SerializedAsset
 from airflow.serialization.encoders import encode_trigger, ensure_serialized_asset
 from airflow.serialization.serialized_objects import LazyDeserializedDAG
-from airflow.timetables.simple import PartitionAtRuntime
+from airflow.timetables.simple import PartitionedAtRuntime
 from airflow.triggers.base import BaseEventTrigger
 from airflow.utils.types import DagRunType
 
@@ -136,7 +136,7 @@ def test_statement_latest_runs_loads_timetable_fields(dag_maker, session):
 
 @pytest.mark.db_test
 def test_statement_latest_runs_partitioned_sorted_by_partition_date(dag_maker, session):
-    with dag_maker("fake-dag", schedule=PartitionAtRuntime()):
+    with dag_maker("fake-dag", schedule=PartitionedAtRuntime()):
         pass
     dag_maker.sync_dagbag_to_db()
     for i, (run_id, partition_key, partition_date) in enumerate(
diff --git a/airflow-core/tests/unit/jobs/test_scheduler_job.py b/airflow-core/tests/unit/jobs/test_scheduler_job.py
index 3b950f71d5b4c..e2d5977eb86f7 100644
--- a/airflow-core/tests/unit/jobs/test_scheduler_job.py
+++ b/airflow-core/tests/unit/jobs/test_scheduler_job.py
@@ -132,8 +132,8 @@
 from airflow.serialization.serialized_objects import LazyDeserializedDAG
 from airflow.timetables.base import DagRunInfo, DataInterval, compute_rollup_fingerprint
 from airflow.timetables.simple import (
-    PartitionAtRuntime,
     PartitionedAssetTimetable as CorePartitionedAssetTimetable,
+    PartitionedAtRuntime,
 )
 from airflow.utils.session import NEW_SESSION, create_session, provide_session
 from airflow.utils.sqlalchemy import with_row_locks
@@ -10255,7 +10255,7 @@ def _produce_and_register_asset_event(
     if expected_partition_key is None:
         expected_partition_key = partition_key
 
-    with dag_maker(dag_id=dag_id, schedule=PartitionAtRuntime(), session=session) as dag:
+    with dag_maker(dag_id=dag_id, schedule=PartitionedAtRuntime(), session=session) as dag:
         EmptyOperator(task_id="hi", outlets=[asset])
 
     dr = dag_maker.create_dagrun(
@@ -10707,7 +10707,7 @@ def test_consumer_dag_run_partition_date_is_none_when_task_key_diverges(
 
     with dag_maker(
         dag_id="asset-event-producer",
-        schedule=PartitionAtRuntime(),
+        schedule=PartitionedAtRuntime(),
         session=session,
     ) as dag:
         EmptyOperator(task_id="hi", outlets=[asset_1])
diff --git a/airflow-core/tests/unit/models/test_dag.py b/airflow-core/tests/unit/models/test_dag.py
index 090cd2d4756e0..ad4ed2c134d13 100644
--- a/airflow-core/tests/unit/models/test_dag.py
+++ b/airflow-core/tests/unit/models/test_dag.py
@@ -71,7 +71,7 @@
     DAG,
     BaseOperator,
     CronPartitionTimetable,
-    PartitionAtRuntime,
+    PartitionedAtRuntime,
     TaskGroup,
     setup,
     task as task_decorator,
@@ -1559,7 +1559,7 @@ def test_create_dagrun_int_partition_key_rejected_for_partitioned_dag(self, dag_
         """DagRun-level type check rejects int partition_key even for partitioned Dags."""
         with dag_maker(
             "test_create_dagrun_partitioned_int_key",
-            schedule=PartitionAtRuntime(),
+            schedule=PartitionedAtRuntime(),
         ):
             ...
         with pytest.raises(
@@ -1582,7 +1582,7 @@ def test_create_dagrun_int_partition_key_rejected_for_partitioned_dag(self, dag_
             ("my-key", None, True),
             (None, None, False),
             ("my-key", CronPartitionTimetable("@daily", timezone="UTC"), False),
-            ("my-key", PartitionAtRuntime(), False),
+            ("my-key", PartitionedAtRuntime(), False),
         ],
     )
     def test_serialized_dag_validate_partition_key(
diff --git a/airflow-core/tests/unit/models/test_taskinstance.py b/airflow-core/tests/unit/models/test_taskinstance.py
index 97ec0242235b4..89ac6b12048e3 100644
--- a/airflow-core/tests/unit/models/test_taskinstance.py
+++ b/airflow-core/tests/unit/models/test_taskinstance.py
@@ -106,7 +106,7 @@
 from airflow.ti_deps.deps.base_ti_dep import TIDepStatus
 from airflow.ti_deps.deps.ready_to_reschedule import ReadyToRescheduleDep
 from airflow.ti_deps.deps.trigger_rule_dep import TriggerRuleDep, _UpstreamTIStates
-from airflow.timetables.simple import PartitionAtRuntime
+from airflow.timetables.simple import PartitionedAtRuntime
 from airflow.utils.session import create_session, provide_session
 from airflow.utils.span_status import SpanStatus
 from airflow.utils.state import DagRunState, State, TaskInstanceState
@@ -3568,7 +3568,7 @@ def test_register_asset_changes_in_db_no_outlets_is_a_noop(dag_maker, session):
 
 def test_when_dag_run_has_partition_then_asset_does(dag_maker, session):
     asset = Asset(name="hello")
-    with dag_maker(dag_id="asset_event_tester", schedule=PartitionAtRuntime()) as dag:
+    with dag_maker(dag_id="asset_event_tester", schedule=PartitionedAtRuntime()) as dag:
         EmptyOperator(task_id="hi", outlets=[asset])
     dr = dag_maker.create_dagrun(partition_key="abc123", session=session)
     assert dr.partition_key == "abc123"
@@ -3591,7 +3591,7 @@ def test_when_dag_run_has_partition_and_downstreams_listening_then_tables_popula
     session,
 ):
     asset = Asset(name="hello")
-    with dag_maker(dag_id="asset_event_tester", schedule=PartitionAtRuntime(), session=session) as dag:
+    with dag_maker(dag_id="asset_event_tester", schedule=PartitionedAtRuntime(), session=session) as dag:
         EmptyOperator(task_id="hi", outlets=[asset])
     dag1_id = dag.dag_id
     dr = dag_maker.create_dagrun(partition_key="abc123", session=session)
@@ -3657,7 +3657,7 @@ def test_runtime_partition_key_does_not_backfill_dag_run_when_none(dag_maker, se
 def test_runtime_partition_key_does_not_overwrite_scheduler_partition(dag_maker, session):
     """Task-emitted key lands on the AssetEvent but does NOT overwrite a scheduler-set DagRun.partition_key."""
     asset = Asset(name="hello")
-    with dag_maker(dag_id="rt_pk_no_overwrite", schedule=PartitionAtRuntime()) as dag:
+    with dag_maker(dag_id="rt_pk_no_overwrite", schedule=PartitionedAtRuntime()) as dag:
         EmptyOperator(task_id="hi", outlets=[asset])
     dr = dag_maker.create_dagrun(partition_key="scheduler-key", session=session)
     [ti] = dr.get_task_instances(session=session)
@@ -3708,7 +3708,7 @@ def test_runtime_partition_key_inherits_dag_run_key_when_event_has_no_key(dag_ma
     can still be routed correctly.
     """
     asset = Asset(name="hello")
-    with dag_maker(dag_id="rt_pk_none", schedule=PartitionAtRuntime()) as dag:
+    with dag_maker(dag_id="rt_pk_none", schedule=PartitionedAtRuntime()) as dag:
         EmptyOperator(task_id="hi", outlets=[asset])
     dr = dag_maker.create_dagrun(partition_key="from-run", session=session)
     [ti] = dr.get_task_instances(session=session)
@@ -3728,7 +3728,7 @@ def test_runtime_partition_key_inherits_dag_run_key_when_event_has_no_key(dag_ma
 def test_runtime_partition_key_mixed_events_for_same_asset(dag_maker, session):
     """One event with an explicit key + one without produce two AssetEvents (explicit key + inherited run key)."""
     asset = Asset(name="hello")
-    with dag_maker(dag_id="rt_pk_mixed", schedule=PartitionAtRuntime()) as dag:
+    with dag_maker(dag_id="rt_pk_mixed", schedule=PartitionedAtRuntime()) as dag:
         EmptyOperator(task_id="hi", outlets=[asset])
     dr = dag_maker.create_dagrun(partition_key="from-run", session=session)
     [ti] = dr.get_task_instances(session=session)
@@ -3773,17 +3773,17 @@ def test_runtime_partition_key_event_stays_none_when_no_key_and_no_run_key(dag_m
     assert event.partition_key is None
 
 
-def test_runtime_partition_key_does_not_backfill_partition_at_runtime_run(dag_maker, session):
-    """Task-emitted key lands on AssetEvent but does NOT back-fill DagRun.partition_key on a PartitionAtRuntime run.
+def test_runtime_partition_key_does_not_backfill_partitioned_at_runtime_run(dag_maker, session):
+    """Task-emitted key lands on AssetEvent but does NOT back-fill DagRun.partition_key on a PartitionedAtRuntime run.
 
     Provenance contract: DagRun.partition_key is set only at run-creation/trigger time.
-    A PartitionAtRuntime Dag triggered via REST without a partition_key starts with
+    A PartitionedAtRuntime Dag triggered via REST without a partition_key starts with
     partition_key=None. Even when a task discovers a partition at runtime and emits an
     outlet event carrying an explicit key, DagRun.partition_key must remain None — the
     key belongs to the AssetEvent, not to the run's provenance.
     """
     asset = Asset(name="hello")
-    with dag_maker(dag_id="rt_pk_par_backfill", schedule=PartitionAtRuntime()) as dag:
+    with dag_maker(dag_id="rt_pk_par_backfill", schedule=PartitionedAtRuntime()) as dag:
         EmptyOperator(task_id="hi", outlets=[asset])
     dr = dag_maker.create_dagrun(session=session)
     assert dr.partition_key is None
diff --git a/airflow-core/tests/unit/serialization/test_dag_serialization.py b/airflow-core/tests/unit/serialization/test_dag_serialization.py
index 61a66c60fb647..07459a2011711 100644
--- a/airflow-core/tests/unit/serialization/test_dag_serialization.py
+++ b/airflow-core/tests/unit/serialization/test_dag_serialization.py
@@ -93,7 +93,7 @@
     validate_and_load_priority_weight_strategy,
 )
 from airflow.ti_deps.deps.ready_to_reschedule import ReadyToRescheduleDep
-from airflow.timetables.simple import NullTimetable, OnceTimetable, PartitionAtRuntime
+from airflow.timetables.simple import NullTimetable, OnceTimetable, PartitionedAtRuntime
 from airflow.timetables.trigger import CronPartitionTimetable
 from airflow.triggers.base import StartTriggerArgs
 from airflow.utils.types import DagRunType
@@ -2778,11 +2778,11 @@ def test_create_dagrun_accepts_partition_key_for_partitioned_dag(self, dag_maker
         assert dr.partition_key == "2025-01-01T00:00:00"
 
     @pytest.mark.db_test
-    def test_create_dagrun_accepts_partition_key_for_partition_at_runtime_dag(self, dag_maker):
-        """create_dagrun does not raise when partition_key is passed to a PartitionAtRuntime Dag."""
+    def test_create_dagrun_accepts_partition_key_for_partitioned_at_runtime_dag(self, dag_maker):
+        """create_dagrun does not raise when partition_key is passed to a PartitionedAtRuntime Dag."""
         with dag_maker(
-            dag_id="test_partition_at_runtime",
-            schedule=PartitionAtRuntime(),
+            dag_id="test_partitioned_at_runtime",
+            schedule=PartitionedAtRuntime(),
             serialized=True,
         ):
             pass
diff --git a/task-sdk/docs/api.rst b/task-sdk/docs/api.rst
index d31695f486eae..984b0cd7261d2 100644
--- a/task-sdk/docs/api.rst
+++ b/task-sdk/docs/api.rst
@@ -214,7 +214,7 @@ Timetables
 
 .. autoapiclass:: airflow.sdk.MultipleCronTriggerTimetable
 
-.. autoapiclass:: airflow.sdk.PartitionAtRuntime
+.. autoapiclass:: airflow.sdk.PartitionedAtRuntime
 
 .. autoapiclass:: airflow.sdk.PartitionedAssetTimetable
 
diff --git a/task-sdk/src/airflow/sdk/__init__.py b/task-sdk/src/airflow/sdk/__init__.py
index 8e8953a8aca88..f3452389d17db 100644
--- a/task-sdk/src/airflow/sdk/__init__.py
+++ b/task-sdk/src/airflow/sdk/__init__.py
@@ -67,7 +67,7 @@
     "ObjectStoragePath",
     "Param",
     "ParamsDict",
-    "PartitionAtRuntime",
+    "PartitionedAtRuntime",
     "PartitionedAssetTimetable",
     "PartitionMapper",
     "PokeReturnValue",
@@ -199,8 +199,8 @@
     from airflow.sdk.definitions.template import literal
     from airflow.sdk.definitions.timetables.assets import (
         AssetOrTimeSchedule,
-        PartitionAtRuntime,
         PartitionedAssetTimetable,
+        PartitionedAtRuntime,
     )
     from airflow.sdk.definitions.timetables.events import EventsTimetable
     from airflow.sdk.definitions.timetables.interval import (
@@ -269,7 +269,7 @@
     "ObjectStoragePath": ".io.path",
     "Param": ".definitions.param",
     "ParamsDict": ".definitions.param",
-    "PartitionAtRuntime": ".definitions.timetables.assets",
+    "PartitionedAtRuntime": ".definitions.timetables.assets",
     "PartitionedAssetTimetable": ".definitions.timetables.assets",
     "PartitionMapper": ".definitions.partition_mappers.base",
     "PokeReturnValue": ".bases.sensor",
diff --git a/task-sdk/src/airflow/sdk/__init__.pyi b/task-sdk/src/airflow/sdk/__init__.pyi
index 273b0579f3ec3..d48bf614407f8 100644
--- a/task-sdk/src/airflow/sdk/__init__.pyi
+++ b/task-sdk/src/airflow/sdk/__init__.pyi
@@ -110,8 +110,8 @@ from airflow.sdk.definitions.taskgroup import TaskGroup as TaskGroup
 from airflow.sdk.definitions.template import literal as literal
 from airflow.sdk.definitions.timetables.assets import (
     AssetOrTimeSchedule,
-    PartitionAtRuntime,
     PartitionedAssetTimetable,
+    PartitionedAtRuntime,
 )
 from airflow.sdk.definitions.timetables.events import EventsTimetable
 from airflow.sdk.definitions.timetables.interval import (
@@ -177,7 +177,7 @@ __all__ = [
     "ObjectStoragePath",
     "Param",
     "PokeReturnValue",
-    "PartitionAtRuntime",
+    "PartitionedAtRuntime",
     "PartitionedAssetTimetable",
     "PartitionMapper",
     "ProductMapper",
diff --git a/task-sdk/src/airflow/sdk/bases/timetable.py b/task-sdk/src/airflow/sdk/bases/timetable.py
index bd37a6a0a7955..27769d6b31c1f 100644
--- a/task-sdk/src/airflow/sdk/bases/timetable.py
+++ b/task-sdk/src/airflow/sdk/bases/timetable.py
@@ -51,7 +51,7 @@ class BaseTimetable:
     """
     Whether this timetable defers partition selection to task runtime.
 
-    *True* for :class:`~airflow.sdk.PartitionAtRuntime`; downstream code can
+    *True* for :class:`~airflow.sdk.PartitionedAtRuntime`; downstream code can
     branch on this flag instead of using ``isinstance``.
     """
 
diff --git a/task-sdk/src/airflow/sdk/definitions/timetables/assets.py b/task-sdk/src/airflow/sdk/definitions/timetables/assets.py
index a0c6493692572..22208693588de 100644
--- a/task-sdk/src/airflow/sdk/definitions/timetables/assets.py
+++ b/task-sdk/src/airflow/sdk/definitions/timetables/assets.py
@@ -54,7 +54,7 @@ class PartitionedAssetTimetable(AssetTriggeredTimetable):
     default_partition_mapper: PartitionMapper = IdentityMapper()
 
 
-class PartitionAtRuntime(BaseTimetable):
+class PartitionedAtRuntime(BaseTimetable):
     """Marker timetable indicating that partition key(s) are determined at runtime."""
 
     can_be_scheduled = False
diff --git a/task-sdk/tests/task_sdk/definitions/test_dag.py b/task-sdk/tests/task_sdk/definitions/test_dag.py
index 0e9f6c78b3801..b8f9d01b5b016 100644
--- a/task-sdk/tests/task_sdk/definitions/test_dag.py
+++ b/task-sdk/tests/task_sdk/definitions/test_dag.py
@@ -25,7 +25,16 @@
 
 import pytest
 
-from airflow.sdk import DAG, Context, Label, Param, PartitionAtRuntime, TaskGroup, dag as dag_decorator, task
+from airflow.sdk import (
+    DAG,
+    Context,
+    Label,
+    Param,
+    PartitionedAtRuntime,
+    TaskGroup,
+    dag as dag_decorator,
+    task,
+)
 from airflow.sdk.bases.operator import BaseOperator
 from airflow.sdk.bases.timetable import BaseTimetable
 from airflow.sdk.definitions.param import DagParam, ParamsDict
@@ -438,8 +447,8 @@ def test_continuous_schedule_linmits_max_active_runs(self):
         with pytest.raises(ValueError, match="ContinuousTimetable requires max_active_runs <= 1"):
             dag = DAG("continuous", start_date=DEFAULT_DATE, schedule="@continuous", max_active_runs=25)
 
-    def test_only_partition_at_runtime_has_partitioned_at_runtime_flag(self):
-        """Regression guard: across every BaseTimetable subclass, only PartitionAtRuntime sets partitioned_at_runtime=True."""
+    def test_only_partitioned_at_runtime_has_partitioned_at_runtime_flag(self):
+        """Regression guard: across every BaseTimetable subclass, only PartitionedAtRuntime sets partitioned_at_runtime=True."""
 
         def all_subclasses(cls):
             for sub in cls.__subclasses__():
@@ -447,7 +456,7 @@ def all_subclasses(cls):
                 yield from all_subclasses(sub)
 
         flagged = {c for c in all_subclasses(BaseTimetable) if c.partitioned_at_runtime}
-        assert flagged == {PartitionAtRuntime}
+        assert flagged == {PartitionedAtRuntime}
 
     def test_dag_add_task_checks_trigger_rule(self):
         # A non fail stop dag should allow any trigger rule

From 9856115f815cd3dfab2411a7036dedd5ec785b6d Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 08:56:52 +0800
Subject: [PATCH 05/29] [v3-3-test] Add partition_date to DagRun detail page
 (#68969) (#68977)

Co-authored-by: Wei Lee <weilee.rx@gmail.com>
---
 .../src/airflow/ui/public/i18n/locales/en/common.json     | 1 +
 .../src/airflow/ui/public/i18n/locales/zh-TW/common.json  | 1 +
 airflow-core/src/airflow/ui/src/pages/Run/Details.tsx     | 8 ++++++++
 3 files changed, 10 insertions(+)

diff --git a/airflow-core/src/airflow/ui/public/i18n/locales/en/common.json b/airflow-core/src/airflow/ui/public/i18n/locales/en/common.json
index 3aaa5115bb2f5..7b5f37c9cfd3b 100644
--- a/airflow-core/src/airflow/ui/public/i18n/locales/en/common.json
+++ b/airflow-core/src/airflow/ui/public/i18n/locales/en/common.json
@@ -72,6 +72,7 @@
     "expectedDuration": "Expected Duration",
     "lastSchedulingDecision": "Last Scheduling Decision",
     "mappedPartitionKey": "Mapped Partition key",
+    "partitionDate": "Partition Date",
     "partitionKey": "Partition key",
     "queuedAt": "Queued At",
     "runAfter": "Run After",
diff --git a/airflow-core/src/airflow/ui/public/i18n/locales/zh-TW/common.json b/airflow-core/src/airflow/ui/public/i18n/locales/zh-TW/common.json
index 90debb241c24b..a98d200635ce3 100644
--- a/airflow-core/src/airflow/ui/public/i18n/locales/zh-TW/common.json
+++ b/airflow-core/src/airflow/ui/public/i18n/locales/zh-TW/common.json
@@ -72,6 +72,7 @@
     "expectedDuration": "預計時長",
     "lastSchedulingDecision": "最後排程決策",
     "mappedPartitionKey": "映射分區鍵",
+    "partitionDate": "資產分區日期",
     "partitionKey": "資產分區鍵",
     "queuedAt": "開始排隊時間",
     "runAfter": "最早可執行時間",
diff --git a/airflow-core/src/airflow/ui/src/pages/Run/Details.tsx b/airflow-core/src/airflow/ui/src/pages/Run/Details.tsx
index e233c528b54cc..e7ec9fa836437 100644
--- a/airflow-core/src/airflow/ui/src/pages/Run/Details.tsx
+++ b/airflow-core/src/airflow/ui/src/pages/Run/Details.tsx
@@ -145,6 +145,14 @@ export const Details = () => {
             <Time datetime={dagRun.data_interval_end} />
           </Table.Cell>
         </Table.Row>
+        {dagRun.partition_date !== null && (
+          <Table.Row>
+            <Table.Cell>{translate("dagRun.partitionDate")}</Table.Cell>
+            <Table.Cell>
+              <Time datetime={dagRun.partition_date} />
+            </Table.Cell>
+          </Table.Row>
+        )}
         <Table.Row>
           <Table.Cell>{translate("dagRun.triggeredBy")}</Table.Cell>
           <Table.Cell>{dagRun.triggered_by}</Table.Cell>

From c38ee15dc038e581cb5bcf8b7a47335ecfe0e4e1 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 08:57:45 +0800
Subject: [PATCH 06/29] [v3-3-test] Fix grammar in PR guidelines (#68992)
 (#68994)

Co-authored-by: Andrew Chang <69671930+Andrushika@users.noreply.github.com>
---
 contributing-docs/05_pull_requests.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/contributing-docs/05_pull_requests.rst b/contributing-docs/05_pull_requests.rst
index 624b7ca5299e4..2b3c692283bbf 100644
--- a/contributing-docs/05_pull_requests.rst
+++ b/contributing-docs/05_pull_requests.rst
@@ -102,7 +102,7 @@ these guidelines:
     programmatically (either because they are too hard or just not yet done).
 
 -   Maintainers will not merge a PR that regresses linting or does not pass CI tests (unless you have good
-    justification that it a transient error or something that is being fixed in other PR).
+    justification that it is a transient error or something that is being fixed in other PR).
 
 -   Maintainers will not merge PRs that have unresolved conversation.
 

From 520346f16e6c20d2b120df7e106fb1253d8b4830 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 10:09:51 +0300
Subject: [PATCH 07/29] [v3-3-test] Add owners for Java and Go SDKs (#69009)
 (#69012)

(cherry picked from commit 4b925364105cbe8871abe1cbbf96ace6e41f6086)

Co-authored-by: Tzu-ping Chung <uranusjr@gmail.com>
---
 .github/CODEOWNERS | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 68536fe6e7418..11887935420f3 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -163,7 +163,10 @@ Dockerfile.ci @potiuk @ashb @gopidesupavan @amoghrajesh @jscheffl @bugraoz93 @ja
 /task-sdk/ @ashb @kaxil @amoghrajesh
 
 # Golang SDK
-/go-sdk/ @ashb @amoghrajesh
+/go-sdk/ @ashb @amoghrajesh @jason810496
+
+# Java SDK
+/java-sdk/ @uranusjr @jason810496
 
 # Shared Libraries
 /shared/ @ashb @amoghrajesh @potiuk

From a807b2857370628db28da97c5c0e908d3095ddb7 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 17:08:49 +0800
Subject: [PATCH 08/29] [v3-3-test] Add example plugins and expand docs for
 asset partitions (#68889) (#69017)

Co-authored-by: Wei Lee <weilee.rx@gmail.com>
---
 .../docs/authoring-and-scheduling/assets.rst  | 267 ++++++++++++++++++
 .../example_dags/example_asset_partition.py   |  10 +-
 .../plugins/custom_partition_mapper.py        |  96 +++++++
 .../plugins/custom_partition_timetable.py     |  55 ++++
 .../core_api/routes/public/test_plugins.py    |  10 +-
 .../unit/plugins/test_plugins_manager.py      |   4 +-
 6 files changed, 434 insertions(+), 8 deletions(-)
 create mode 100644 airflow-core/src/airflow/example_dags/plugins/custom_partition_mapper.py
 create mode 100644 airflow-core/src/airflow/example_dags/plugins/custom_partition_timetable.py

diff --git a/airflow-core/docs/authoring-and-scheduling/assets.rst b/airflow-core/docs/authoring-and-scheduling/assets.rst
index a74664302da5f..b5561392587db 100644
--- a/airflow-core/docs/authoring-and-scheduling/assets.rst
+++ b/airflow-core/docs/authoring-and-scheduling/assets.rst
@@ -523,6 +523,33 @@ creates asset events with a partition key on each run.
 Partitioned events are intended for partition-aware downstream scheduling, and
 do not trigger non-partition-aware Dags.
 
+Pre-determined vs runtime partitioning
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Both kinds attach a partition key to a Dag run — the difference is *when* and
+*by whom* the key is decided:
+
+* **Pre-determined partitioning** — the partition key is worked out before the
+  task runs, using the timetable's schedule cadence and partition mappers to match
+  upstream keys to downstream keys and trigger partition-based Dag runs.
+  :class:`~airflow.sdk.CronPartitionTimetable` uses this kind as a producer;
+  :class:`~airflow.sdk.PartitionedAssetTimetable` uses it as a consumer.
+
+* **Runtime partitioning** — the partition key is deferred to task runtime:
+  the producing task records key(s) via ``outlet_events[self].add_partitions(...)``.
+  :class:`~airflow.sdk.PartitionedAtRuntime` uses this kind and never schedules on its
+  own (``can_be_scheduled=False``); a schedulable timetable can also defer to runtime
+  by subclassing :class:`~airflow.timetables.trigger.CronTriggerTimetable` and setting
+  ``partitioned_at_runtime = True`` (see the custom plugin example below).
+
+A timetable uses one kind or the other, not both: it either resolves partitions
+ahead of the run or defers them to task runtime.
+
+**Practical rule:** use :class:`~airflow.sdk.CronPartitionTimetable` when the
+partition key follows from the schedule cadence; use :class:`~airflow.sdk.PartitionedAtRuntime`
+when the key is only known once the task runs (e.g. a watermark from source data);
+use :class:`~airflow.sdk.PartitionedAssetTimetable` downstream to consume either kind.
+
 For downstream partition-aware scheduling, use ``PartitionedAssetTimetable``:
 
 .. code-block:: python
@@ -753,6 +780,62 @@ so the run is held indefinitely) and the fall-back day has twenty-five (the repe
 hour is dropped). Use a UTC-based upstream mapper for any rollup that crosses a DST
 boundary; see the ``DayWindow`` class docstring for the full discussion.
 
+Wait policies
+~~~~~~~~~~~~~
+
+:class:`~airflow.sdk.RollupMapper` accepts an optional ``wait_policy`` argument
+that decides when the downstream Dag run fires given the expected window vs the
+upstream keys that have actually arrived.
+
+* :class:`~airflow.sdk.WaitForAll` (the default) holds the run until every expected
+  upstream key in the window has arrived.
+* :class:`~airflow.sdk.MinimumCount` ``(n)`` fires early once at least ``n`` of the
+  expected keys have arrived — useful to tolerate a slow or missing upstream partition
+  rather than holding the run indefinitely.
+
+.. code-block:: python
+
+    from airflow.sdk import (
+        DAG,
+        Asset,
+        FixedKeyMapper,
+        MinimumCount,
+        PartitionedAtRuntime,
+        PartitionedAssetTimetable,
+        RollupMapper,
+        SegmentWindow,
+        asset,
+    )
+
+
+    @asset(
+        uri="file://incoming/player-stats/multi-region.csv",
+        schedule=PartitionedAtRuntime(),
+    )
+    def multi_region_player_stats(self, outlet_events):
+        outlet_events[self].add_partitions(["us", "eu", "apac"])
+
+
+    # Consumer: fires once at least two of the three declared region partitions arrive.
+    with DAG(
+        dag_id="segment_region_stats_early_rollup",
+        schedule=PartitionedAssetTimetable(
+            assets=Asset.ref(name="multi_region_player_stats"),
+            default_partition_mapper=RollupMapper(
+                upstream_mapper=FixedKeyMapper("all_regions"),
+                window=SegmentWindow(["us", "eu", "apac"]),
+                wait_policy=MinimumCount(2),
+            ),
+        ),
+        catchup=False,
+    ):
+        ...
+
+``MinimumCount(-1)`` is the relative spelling of the same threshold — "at most one
+missing" — and is equivalent to ``MinimumCount(2)`` for a three-member window.
+Pass :class:`~airflow.sdk.WaitForAll` explicitly when you want to document intent
+rather than relying on the default.
+
 .. _segment-categorical-rollup:
 
 Segment (categorical) rollup
@@ -872,5 +955,189 @@ When a runtime run emits exactly one partition key, the producing
 these events the same way as timetable-produced partitions, through
 ``PartitionedAssetTimetable``.
 
+Fan-out mappers
+~~~~~~~~~~~~~~~
+
+.. versionadded:: 3.3.0
+
+:class:`~airflow.sdk.FanOutMapper` is the mirror of :class:`~airflow.sdk.RollupMapper`:
+instead of holding many upstream events until one downstream run can fire, a single
+upstream event fans *out* to one downstream Dag run per window member. It composes an
+``upstream_mapper`` (which normalizes the upstream key to the window anchor) with a
+:class:`~airflow.sdk.Window` that enumerates the downstream period, and an optional
+``downstream_mapper`` that converts each window member into a downstream partition key
+string.
+
+For temporal windows (:class:`~airflow.sdk.WeekWindow`, :class:`~airflow.sdk.MonthWindow`,
+etc.) a default ``downstream_mapper`` is applied automatically — for example
+:class:`~airflow.sdk.WeekWindow` defaults to :class:`~airflow.sdk.StartOfDayMapper`,
+so each of the seven daily members is encoded as a ``YYYY-MM-DD`` string. For
+:class:`~airflow.sdk.SegmentWindow` there is no default-table entry, so an explicit
+``downstream_mapper`` is required.
+
+The following example fans a weekly model artifact out to seven daily inference runs —
+one Dag run per day in the week:
+
+.. code-block:: python
+
+    from airflow.sdk import (
+        DAG,
+        Asset,
+        CronPartitionTimetable,
+        FanOutMapper,
+        PartitionedAssetTimetable,
+        StartOfWeekMapper,
+        WeekWindow,
+        task,
+    )
+
+    weekly_model_artifact = Asset(uri="file://artifacts/models/weekly.bin", name="weekly_model_artifact")
+
+    # Producer: emits one partitioned event per week (key is the Monday date).
+    with DAG(
+        dag_id="train_weekly_model",
+        schedule=CronPartitionTimetable("0 0 * * 1", timezone="UTC"),
+        catchup=False,
+    ):
+
+        @task(outlets=[weekly_model_artifact])
+        def train_model():
+            pass
+
+        train_model()
+
+
+    # Consumer: one Dag run per day derived from the weekly upstream event.
+    with DAG(
+        dag_id="daily_inference",
+        schedule=PartitionedAssetTimetable(
+            assets=weekly_model_artifact,
+            default_partition_mapper=FanOutMapper(
+                upstream_mapper=StartOfWeekMapper(),
+                window=WeekWindow(),
+                max_downstream_keys=7,
+            ),
+        ),
+        catchup=False,
+    ):
+
+        @task
+        def run_inference(dag_run=None):
+            # dag_run.partition_key is one daily key, e.g. "2026-03-10".
+            print(dag_run.partition_key)
+
+        run_inference()
+
+``max_downstream_keys`` caps how many downstream Dag runs one upstream event may
+create. When exceeded, the runs for that event are **not** queued and a "partition
+fan-out exceeded" audit-log entry is recorded instead. Omitting it falls back to the
+global ``[scheduler] partition_mapper_max_downstream_keys`` config (default 1000).
+Set it explicitly to document intent and guard against accidental fan-out explosions.
+
+Window direction: FORWARD and BACKWARD
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Every :class:`~airflow.sdk.Window` supports a ``direction`` parameter that controls
+which period the window enumerates relative to its anchor.
+
+* ``Window.Direction.FORWARD`` (the default) — yields the period *starting* at the
+  upstream key. For a weekly upstream key ``"2026-03-09"`` (Monday),
+  ``WeekWindow()`` yields the seven days ``2026-03-09`` through ``2026-03-15``.
+* ``Window.Direction.BACKWARD`` — yields the trailing period *ending* at the key.
+  The same ``"2026-03-09"`` key with ``WeekWindow(direction=Window.Direction.BACKWARD)``
+  yields the seven days ending on that Monday (``2026-03-03`` through ``2026-03-09``).
+
+.. code-block:: python
+
+    from airflow.sdk import FanOutMapper, PartitionedAssetTimetable, StartOfWeekMapper, WeekWindow, Window
+
+    PartitionedAssetTimetable(
+        assets=weekly_model_artifact,
+        default_partition_mapper=FanOutMapper(
+            upstream_mapper=StartOfWeekMapper(),
+            window=WeekWindow(direction=Window.Direction.BACKWARD),
+        ),
+    )
+
+Direction applies to rollup windows too — ``RollupMapper`` uses the same window
+classes, so ``DayWindow(direction=Window.Direction.BACKWARD)`` holds a downstream
+run until the twenty-four hours *preceding* midnight of the downstream key have
+all arrived.
+
+Custom partition mappers, windows, and timetables in plugins
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Custom :class:`~airflow.partition_mappers.base.PartitionMapper`,
+:class:`~airflow.partition_mappers.window.Window`, and partition-aware
+:class:`Timetable <airflow.timetables.base.Timetable>` classes can be shipped as
+Airflow plugins by listing them in ``AirflowPlugin.partition_mappers``,
+``.windows``, and ``.timetables`` respectively.  Once a plugin is installed,
+these classes become usable in :class:`~airflow.sdk.PartitionedAssetTimetable`
+and :class:`~airflow.partition_mappers.base.RollupMapper` without modifying core
+Airflow.
+
+**Custom partition mapper** — strip a namespace prefix so that upstream keys
+like ``"eu::daily-sales"`` and ``"us::daily-sales"`` both collapse to the
+downstream key ``"daily-sales"``:
+
+.. exampleinclude:: /../src/airflow/example_dags/plugins/custom_partition_mapper.py
+    :language: python
+    :start-after: [START custom_partition_mapper]
+    :end-before: [END custom_partition_mapper]
+
+**Custom rollup window** — yield only weekday period-starts from a calendar
+month so a downstream asset waits only for business-day upstream partitions:
+
+.. exampleinclude:: /../src/airflow/example_dags/plugins/business_day_window.py
+    :language: python
+    :start-after: [START custom_window]
+    :end-before: [END custom_window]
+
+**Custom runtime-partitioned timetable** — a schedulable cron timetable that
+defers the partition key to task runtime, so the producing task can check whether
+the period's data exists before emitting a partition:
+
+.. exampleinclude:: /../src/airflow/example_dags/plugins/custom_partition_timetable.py
+    :language: python
+    :start-after: [START custom_partition_timetable]
+    :end-before: [END custom_partition_timetable]
+
+A producer Dag schedules on the timetable's cron cadence and decides the
+partition key at runtime — emitting it only when the period's upstream data is
+present. If the data has not arrived, the task simply does not call
+``add_partitions`` (an empty or ``None`` key is rejected anyway), so no
+partitioned event — and therefore no downstream ``PartitionedAssetTimetable``
+run — is produced for that period:
+
+.. code-block:: python
+
+    from airflow.sdk import DAG, Asset, task
+
+    # ScheduledRuntimePartitionTimetable is provided by the plugin registered above.
+    from my_plugin.plugins import ScheduledRuntimePartitionTimetable
+
+    daily_export = Asset(uri="file://exports/daily.csv", name="daily_export")
+
+    with DAG(
+        dag_id="export_when_ready",
+        schedule=ScheduledRuntimePartitionTimetable("0 6 * * *", timezone="UTC"),
+        catchup=False,
+    ):
+
+        @task(outlets=[daily_export])
+        def export(*, outlet_events):
+            # Fires every day at 06:00 UTC. The partition key is not fixed by the
+            # schedule — decide it at runtime from the data itself: find which
+            # day's source file has actually landed.
+            partition_key = latest_ready_day("s3://raw")  # your own check; e.g. "2026-06-23" or None
+            if partition_key:
+                build_export(partition_key)
+                outlet_events[daily_export].add_partitions(partition_key)
+            # If nothing is ready, emit nothing: with no partition key recorded,
+            # no partitioned event is produced and no downstream
+            # PartitionedAssetTimetable run is triggered for this period.
+
+        export()
+
 For complete runnable examples, see
 ``airflow-core/src/airflow/example_dags/example_asset_partition.py``.
diff --git a/airflow-core/src/airflow/example_dags/example_asset_partition.py b/airflow-core/src/airflow/example_dags/example_asset_partition.py
index f4171bb46f1e7..e7151680404ed 100644
--- a/airflow-core/src/airflow/example_dags/example_asset_partition.py
+++ b/airflow-core/src/airflow/example_dags/example_asset_partition.py
@@ -44,6 +44,7 @@
     WeekWindow,
     Window,
     asset,
+    get_current_context,
     task,
 )
 
@@ -217,9 +218,14 @@ def aggregate_sales(dag_run=None):
     """
 
     @task(outlets=[region_raw_stats])
-    def ingest_region():
+    def ingest_region(dag_run=None):
         """Materialize player statistics for a single region partition."""
-        pass
+        context = get_current_context()
+        if TYPE_CHECKING:
+            assert dag_run
+        print(
+            f"dag_run partition key {dag_run.partition_key} context partition key {context['partition_key']}"
+        )
 
     ingest_region()
 
diff --git a/airflow-core/src/airflow/example_dags/plugins/custom_partition_mapper.py b/airflow-core/src/airflow/example_dags/plugins/custom_partition_mapper.py
new file mode 100644
index 0000000000000..ab6ff673044d7
--- /dev/null
+++ b/airflow-core/src/airflow/example_dags/plugins/custom_partition_mapper.py
@@ -0,0 +1,96 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from airflow.partition_mappers.base import PartitionMapper
+from airflow.plugins_manager import AirflowPlugin
+
+if TYPE_CHECKING:
+    from typing import Any
+
+
+# [START custom_partition_mapper]
+class PrefixStripMapper(PartitionMapper):
+    """
+    A partition mapper that strips a fixed namespace prefix from upstream keys.
+
+    Upstream systems often qualify partition keys with a region or environment
+    prefix — for example ``"eu::daily-sales"`` or ``"us::daily-sales"``.  A
+    downstream asset that aggregates across regions only cares about the base key
+    (``"daily-sales"``).  ``PrefixStripMapper`` strips the given prefix (including
+    a configurable separator) so that all upstream namespaces collapse to the
+    same downstream partition key.
+
+    If the upstream key does not start with the configured prefix the key is
+    returned unchanged, which is deliberate: keys that already live in the target
+    namespace pass through without modification.
+
+    This class demonstrates registering a custom :class:`PartitionMapper
+    <airflow.partition_mappers.base.PartitionMapper>` subclass via the
+    ``AirflowPlugin.partition_mappers`` registry. Any plugin that lists it in
+    ``partition_mappers = [...]`` makes it available to
+    :class:`~airflow.sdk.PartitionedAssetTimetable` and
+    :class:`~airflow.partition_mappers.base.RollupMapper` without modifying core
+    Airflow.
+
+    :param prefix: The namespace prefix to strip, e.g. ``"eu"``.
+    :param separator: The string that separates the prefix from the base key.
+        Defaults to ``"::"`` to match a common ``"region::key"`` convention.
+    """
+
+    def __init__(
+        self,
+        prefix: str,
+        *,
+        separator: str = "::",
+        max_downstream_keys: int | None = None,
+    ) -> None:
+        super().__init__(max_downstream_keys=max_downstream_keys)
+        if not prefix:
+            raise ValueError("prefix must be a non-empty string.")
+        self.prefix = prefix
+        self.separator = separator
+
+    def to_downstream(self, key: str) -> str:
+        full_prefix = self.prefix + self.separator
+        if key.startswith(full_prefix):
+            return key[len(full_prefix) :]
+        return key
+
+    def serialize(self) -> dict[str, Any]:
+        data: dict[str, Any] = {"prefix": self.prefix, "separator": self.separator}
+        if self.max_downstream_keys is not None:
+            data["max_downstream_keys"] = self.max_downstream_keys
+        return data
+
+    @classmethod
+    def deserialize(cls, data: dict[str, Any]) -> PartitionMapper:
+        return cls(
+            prefix=data["prefix"],
+            separator=data.get("separator", "::"),
+            max_downstream_keys=data.get("max_downstream_keys"),
+        )
+
+
+class PrefixStripMapperPlugin(AirflowPlugin):
+    name = "prefix_strip_mapper_plugin"
+    partition_mappers = [PrefixStripMapper]
+
+
+# [END custom_partition_mapper]
diff --git a/airflow-core/src/airflow/example_dags/plugins/custom_partition_timetable.py b/airflow-core/src/airflow/example_dags/plugins/custom_partition_timetable.py
new file mode 100644
index 0000000000000..f74bc99b62ebc
--- /dev/null
+++ b/airflow-core/src/airflow/example_dags/plugins/custom_partition_timetable.py
@@ -0,0 +1,55 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+from __future__ import annotations
+
+from airflow.plugins_manager import AirflowPlugin
+from airflow.timetables.trigger import CronTriggerTimetable
+
+
+# [START custom_partition_timetable]
+class ScheduledRuntimePartitionTimetable(CronTriggerTimetable):
+    """
+    A schedulable timetable whose partition key is decided at task runtime.
+
+    Runs fire on the given cron cadence, exactly like an ordinary
+    :class:`~airflow.timetables.trigger.CronTriggerTimetable`. The partition key,
+    however, is not derived from the schedule: it is set while the producing task
+    runs — typically after the task checks whether the period's source data has
+    arrived — by calling ``outlet_events[self].add_partitions(...)``.
+
+    This uses runtime partitioning on a regular cron schedule: the timetable stays
+    schedulable (``can_be_scheduled`` is ``True``) yet sets
+    ``partitioned_at_runtime = True`` so the partition key is deferred to task
+    runtime. It differs from :class:`~airflow.sdk.PartitionedAtRuntime` (which also
+    defers the key to runtime but never schedules a run on its own) and from
+    :class:`~airflow.timetables.trigger.CronPartitionTimetable` (which works out the
+    partition key from the cadence ahead of the run). ``partitioned`` stays
+    ``False``: no partition key is worked out ahead of the run.
+
+    Registering it via the ``AirflowPlugin.timetables`` registry makes it usable
+    by Dag authors without modifying core Airflow.
+    """
+
+    partitioned_at_runtime = True
+
+
+class ScheduledRuntimePartitionTimetablePlugin(AirflowPlugin):
+    name = "scheduled_runtime_partition_timetable_plugin"
+    timetables = [ScheduledRuntimePartitionTimetable]
+
+
+# [END custom_partition_timetable]
diff --git a/airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_plugins.py b/airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_plugins.py
index 42df1955ba574..6bca49d8052ea 100644
--- a/airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_plugins.py
+++ b/airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_plugins.py
@@ -34,7 +34,7 @@ class TestGetPlugins:
             # Filters
             (
                 {},
-                16,
+                18,
                 [
                     "InformaticaProviderPlugin",
                     "MetadataCollectionPlugin",
@@ -49,21 +49,23 @@ class TestGetPlugins:
                     "plugin-b",
                     "plugin-c",
                     "postload",
+                    "prefix_strip_mapper_plugin",
                     "priority_weight_strategy_plugin",
+                    "scheduled_runtime_partition_timetable_plugin",
                     "test_plugin",
                     "workday_timetable_plugin",
                 ],
             ),
             (
                 {"limit": 3, "offset": 3},
-                16,
+                18,
                 [
                     "business_day_window_plugin",
                     "databricks_workflow",
                     "decreasing_priority_weight_strategy_plugin",
                 ],
             ),
-            ({"limit": 1}, 16, ["InformaticaProviderPlugin"]),
+            ({"limit": 1}, 18, ["InformaticaProviderPlugin"]),
         ],
     )
     def test_should_respond_200(
@@ -166,7 +168,7 @@ def test_invalid_external_view_destination_should_log_warning_and_continue(self,
         assert len(plugins_page) == 7
         assert "test_plugin_invalid" not in [p["name"] for p in plugins_page]
 
-        assert body["total_entries"] == 16
+        assert body["total_entries"] == 18
 
 
 @skip_if_force_lowest_dependencies_marker
diff --git a/airflow-core/tests/unit/plugins/test_plugins_manager.py b/airflow-core/tests/unit/plugins/test_plugins_manager.py
index 4970b180ad2cf..ce55db1e269ea 100644
--- a/airflow-core/tests/unit/plugins/test_plugins_manager.py
+++ b/airflow-core/tests/unit/plugins/test_plugins_manager.py
@@ -80,7 +80,7 @@ def test_loads_filesystem_plugins(self, caplog):
             example_plugins_module="airflow.example_dags.plugins",
         )
 
-        assert len(plugins) == 11
+        assert len(plugins) == 13
         assert not import_errors
         for plugin in plugins:
             if "AirflowTestOnLoadPlugin" in str(plugin):
@@ -103,7 +103,7 @@ def test_loads_filesystem_plugins_exception(self, caplog, tmp_path):
         ):
             plugins, import_errors = plugins_manager._get_plugins()
 
-        assert len(plugins) == 4  # four are loaded from examples
+        assert len(plugins) == 6  # four are loaded from examples
         assert len(import_errors) == 1
 
         received_logs = caplog.text

From 26a91d4c4d0654f6703968726222c7a8ee248192 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 12:25:27 +0300
Subject: [PATCH 09/29] [v3-3-test] Fix Java coordinator rejecting macOS
 dual-stack loopback connections (#68960) (#68973)

## Why

On macOS the task JVM's dual-stack loopback connection is reported by psutil in the IPv4-compatible form (`::127.0.0.1`), which the coordinator's ownership check did not normalize (only the IPv4-mapped `::ffff:127.0.0.1` form was), so every Java task was rejected with "process exited with 1 before connecting".

## What

- Canonicalize IPv4-compatible IPv6 (`::a.b.c.d`) to plain IPv4 in `_socket_address`, excluding `::` and `::1`, alongside the existing IPv4-mapped handling.
- Add `test_matches_dual_stack_ipv4_compatible_connection` regression test.
(cherry picked from commit a2f8a7ab39d55300531edba310e0453bb2546cf3)



---

##### Was generative AI tooling used to co-author this PR?

- [x] Yes, with help of Claude Code Opus 4.8 following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)

Signed-off-by: LIU ZHE YOU <zhu424.dev@gmail.com>
Co-authored-by: Jason(Zhe-You) Liu <68415893+jason810496@users.noreply.github.com>
---
 .../airflow/sdk/coordinators/_subprocess.py   | 20 ++++++++---
 .../task_sdk/coordinators/test_subprocess.py  | 35 +++++++++++++++++++
 2 files changed, 50 insertions(+), 5 deletions(-)

diff --git a/task-sdk/src/airflow/sdk/coordinators/_subprocess.py b/task-sdk/src/airflow/sdk/coordinators/_subprocess.py
index 9550fdd0bc438..a0c3f518fb068 100644
--- a/task-sdk/src/airflow/sdk/coordinators/_subprocess.py
+++ b/task-sdk/src/airflow/sdk/coordinators/_subprocess.py
@@ -72,16 +72,26 @@ def _socket_address(value: tuple | str) -> tuple[str, int] | None:
         return None
     host, port = value[:2]
     host = str(host)
-    # Canonicalize IPv4-mapped IPv6 ("::ffff:127.0.0.1" -> "127.0.0.1") so a dual-stack
-    # client (e.g. the JVM, shown v4-mapped in /proc/net/tcp6) matches the AF_INET
-    # supervisor socket's plain-IPv4 address in the ownership check below.
+    # Canonicalize an IPv4 address that a dual-stack client embeds in IPv6 so it matches
+    # the AF_INET supervisor socket's plain-IPv4 address in the ownership check below. A
+    # dual-stack JVM's loopback connection is rendered in two different forms depending on
+    # the platform, and both must collapse to plain "127.0.0.1":
+    #   * IPv4-mapped     "::ffff:127.0.0.1" -> "127.0.0.1"  (Linux, via /proc/net/tcp6)
+    #   * IPv4-compatible "::127.0.0.1"      -> "127.0.0.1"  (macOS, via psutil)
+    # Otherwise the JVM's connection fails the check and every Java task is rejected with
+    # "process exited with 1 before connecting".
     try:
         parsed = ipaddress.ip_address(host)
     except ValueError:
         pass
     else:
-        if isinstance(parsed, ipaddress.IPv6Address) and parsed.ipv4_mapped is not None:
-            host = str(parsed.ipv4_mapped)
+        if isinstance(parsed, ipaddress.IPv6Address):
+            if parsed.ipv4_mapped is not None:
+                host = str(parsed.ipv4_mapped)
+            elif 1 < int(parsed) <= 0xFFFFFFFF:
+                # IPv4-compatible IPv6: ::/96 with the IPv4 in the low 32 bits. Exclude
+                # "::" (unspecified) and "::1" (IPv6 loopback), which are not IPv4.
+                host = str(ipaddress.IPv4Address(int(parsed)))
     return host, int(port)
 
 
diff --git a/task-sdk/tests/task_sdk/coordinators/test_subprocess.py b/task-sdk/tests/task_sdk/coordinators/test_subprocess.py
index 5a89c73e780d4..62b7fbcf39c17 100644
--- a/task-sdk/tests/task_sdk/coordinators/test_subprocess.py
+++ b/task-sdk/tests/task_sdk/coordinators/test_subprocess.py
@@ -372,6 +372,41 @@ def test_matches_dual_stack_ipv4_mapped_connection(self):
             client.close()
             server.close()
 
+    def test_matches_dual_stack_ipv4_compatible_connection(self):
+        """A dual-stack child whose loopback is rendered in IPv4-compatible form is accepted.
+
+        Companion to :meth:`test_matches_dual_stack_ipv4_mapped_connection` for macOS
+        (#68938): there the JVM's loopback connection is reported by ``psutil`` as the
+        deprecated IPv4-compatible ``::127.0.0.1`` rather than the IPv4-mapped
+        ``::ffff:127.0.0.1`` seen on Linux. Both forms must canonicalize to plain
+        ``127.0.0.1`` or the ownership check rejects the Java task. The OS will not
+        reliably establish a routable ``::`` connection on demand, so ``psutil``'s view of
+        the child's connections is mocked to the form macOS actually reports.
+        """
+        server = _start_server()
+        _, server_port = server.getsockname()
+        client = socket.socket()
+        client.connect(("127.0.0.1", server_port))
+        conn, _ = server.accept()
+        child_port = conn.getpeername()[1]
+        mock_proc = MagicMock(spec=subprocess.Popen)
+        mock_proc.pid = os.getpid()
+
+        # On macOS psutil reports the child's dual-stack loopback in IPv4-compatible form.
+        compat_conn = MagicMock(
+            laddr=("::127.0.0.1", child_port),
+            raddr=("::127.0.0.1", server_port),
+        )
+        try:
+            with patch("airflow.sdk.coordinators._subprocess.psutil.Process") as mock_process:
+                mock_process.return_value.children.return_value = []
+                mock_process.return_value.net_connections.return_value = [compat_conn]
+                assert _is_connection_from_process(conn, mock_proc) is True
+        finally:
+            conn.close()
+            client.close()
+            server.close()
+
     def test_rejects_tcp_connection_not_owned_by_child_process(self):
         server = _start_server()
         _, port = server.getsockname()

From c5bc7502c2adf2966f414ec9aacc4c41d91ad7bf Mon Sep 17 00:00:00 2001
From: "Jason(Zhe-You) Liu" <68415893+jason810496@users.noreply.github.com>
Date: Fri, 26 Jun 2026 22:13:29 +0900
Subject: [PATCH 10/29] [v3-3-test] Defer Cadwyn import to keep FastAPI off the
 Task SDK worker path (#69016) (#69029)

The Task SDK supervisor imports the execution-time schema package on every
worker, and that package imported cadwyn at module load. cadwyn pulls in
FastAPI, Starlette and Jinja2, which are only needed on the foreign-language-SDK
schema-migration path and never for a pure-Python worker. Because the supervisor
is imported lazily after the Celery prefork, each pool worker paid this import
in private (non copy-on-write) pages, raising worker memory on Python 3.14.

Defer the cadwyn import behind a cached bundle accessor and into _versioned_class
so importing the schema package no longer loads FastAPI. The foreign-SDK path is
unchanged; a regression test asserts the worker import graph stays cadwyn-free.
(cherry picked from commit 85aa9b6)
---
 .../sdk/execution_time/schema/__init__.py     | 13 ++++++-
 .../sdk/execution_time/schema/migrator.py     |  9 +++--
 .../schema/versions/__init__.py               | 36 ++++++++++++++++---
 .../execution_time/schema/test_migrator.py    | 35 ++++++++++++++++++
 4 files changed, 85 insertions(+), 8 deletions(-)

diff --git a/task-sdk/src/airflow/sdk/execution_time/schema/__init__.py b/task-sdk/src/airflow/sdk/execution_time/schema/__init__.py
index 1963e8b8e6614..585bc84a33e2d 100644
--- a/task-sdk/src/airflow/sdk/execution_time/schema/__init__.py
+++ b/task-sdk/src/airflow/sdk/execution_time/schema/__init__.py
@@ -52,7 +52,6 @@
     SchemaVersionMigrator,
     get_schema_version_migrator,
 )
-from airflow.sdk.execution_time.schema.versions import bundle
 
 if TYPE_CHECKING:
     from collections.abc import Iterable
@@ -119,6 +118,18 @@ def resolve_body_class(body: Any) -> type[BaseModel] | None:
     return registered_models_by_name().get(name)
 
 
+def __getattr__(name: str) -> Any:
+    # Re-export ``bundle`` lazily so importing this package does not import ``cadwyn`` (-> FastAPI/
+    # Starlette) until something actually accesses ``schema.bundle``. The Task SDK supervisor imports
+    # this package on every worker, but only the foreign-language-SDK migration path touches the
+    # bundle, so a pure-Python worker never pays the cadwyn import.
+    if name == "bundle":
+        from airflow.sdk.execution_time.schema.versions import get_bundle
+
+        return get_bundle()
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
+
+
 __all__ = [
     "SchemaVersionMigrator",
     "bundle",
diff --git a/task-sdk/src/airflow/sdk/execution_time/schema/migrator.py b/task-sdk/src/airflow/sdk/execution_time/schema/migrator.py
index 9560f6de41905..d2a7a9e305f06 100644
--- a/task-sdk/src/airflow/sdk/execution_time/schema/migrator.py
+++ b/task-sdk/src/airflow/sdk/execution_time/schema/migrator.py
@@ -33,7 +33,6 @@
 from typing import TYPE_CHECKING, Any, cast
 
 import attrs
-from cadwyn import generate_versioned_models
 
 if TYPE_CHECKING:
     from cadwyn import VersionBundle
@@ -103,6 +102,11 @@ class SchemaVersionMigrator:
 
     def _versioned_class(self, version: str, model: type[BaseModel]) -> type[BaseModel]:
         """Get the Cadwyn-generated class for *model* at *version*."""
+        # Imported here, not at module scope, so importing this module (and the parent ``schema``
+        # package the Task SDK supervisor pulls in) does not import ``cadwyn`` -> FastAPI/Starlette.
+        # Only the foreign-language-SDK migration path reaches this; a pure-Python worker never does.
+        from cadwyn import generate_versioned_models
+
         if self._versioned_models is None:
             self._versioned_models = generate_versioned_models(self._bundle)
         return self._versioned_models[version][model]
@@ -207,8 +211,9 @@ def get_schema_version_migrator() -> SchemaVersionMigrator:
     no per-call state, so concurrent callers can share a single
     instance safely.
     """
-    from airflow.sdk.execution_time.schema.versions import bundle
+    from airflow.sdk.execution_time.schema.versions import get_bundle
 
+    bundle = get_bundle()
     return SchemaVersionMigrator(bundle=bundle, supervisor_version=bundle.versions[0].value)
 
 
diff --git a/task-sdk/src/airflow/sdk/execution_time/schema/versions/__init__.py b/task-sdk/src/airflow/sdk/execution_time/schema/versions/__init__.py
index d8ae4e4580ed5..9491a8993fdc3 100644
--- a/task-sdk/src/airflow/sdk/execution_time/schema/versions/__init__.py
+++ b/task-sdk/src/airflow/sdk/execution_time/schema/versions/__init__.py
@@ -17,9 +17,35 @@
 
 from __future__ import annotations
 
-from cadwyn import HeadVersion, Version, VersionBundle
+import functools
+from typing import TYPE_CHECKING, Any
 
-bundle = VersionBundle(
-    HeadVersion(),
-    Version("2026-06-16"),
-)
+if TYPE_CHECKING:
+    from cadwyn import VersionBundle
+
+
+@functools.cache
+def get_bundle() -> VersionBundle:
+    """
+    Build the supervisor schema ``VersionBundle`` lazily.
+
+    The ``cadwyn`` import is deferred to here so importing this module -- and the parent ``schema``
+    package, which the Task SDK supervisor pulls in on every worker -- does not import ``cadwyn``,
+    which drags in FastAPI/Starlette/Jinja2. The bundle (and its cadwyn machinery) is only needed on
+    the foreign-language-SDK migration path; a pure-Python worker never builds it. Cached so the
+    bundle is constructed once per process.
+    """
+    from cadwyn import HeadVersion, Version, VersionBundle
+
+    return VersionBundle(
+        HeadVersion(),
+        Version("2026-06-16"),
+    )
+
+
+def __getattr__(name: str) -> Any:
+    # Keep ``from ...versions import bundle`` working for existing callers without forcing the
+    # cadwyn import at module load (only resolves the bundle when ``bundle`` is actually accessed).
+    if name == "bundle":
+        return get_bundle()
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
diff --git a/task-sdk/tests/task_sdk/execution_time/schema/test_migrator.py b/task-sdk/tests/task_sdk/execution_time/schema/test_migrator.py
index e051d046078ce..05218aded3d3b 100644
--- a/task-sdk/tests/task_sdk/execution_time/schema/test_migrator.py
+++ b/task-sdk/tests/task_sdk/execution_time/schema/test_migrator.py
@@ -28,6 +28,8 @@
 
 from __future__ import annotations
 
+import subprocess
+import sys
 from typing import Literal
 
 import pytest
@@ -334,3 +336,36 @@ def test_known_discriminator_returns_head_class(self, mock_registry):
     def test_extra_fields_in_body_do_not_affect_resolution(self, mock_registry):
         body = {"type": "_LangSdkRequest", "ti_id": "t1", "field_a": 7}
         assert resolve_body_class(body) is _LangSdkRequest
+
+
+class TestLazyCadwynImport:
+    """``cadwyn`` (which imports FastAPI/Starlette/Jinja2) must stay off the worker import path.
+
+    The Task SDK supervisor imports the schema package on every Celery pool worker, but ``cadwyn`` is
+    only needed on the foreign-language-SDK migration path, so its import is deferred. Each check runs
+    in a fresh interpreter because ``sys.modules`` is process-global and other tests import cadwyn.
+    """
+
+    @pytest.mark.parametrize(
+        "module",
+        [
+            "airflow.sdk.execution_time.schema",
+            "airflow.sdk.execution_time.supervisor",
+        ],
+    )
+    def test_importing_worker_path_does_not_load_cadwyn(self, module):
+        code = (
+            f"import sys; import {module}; "
+            "assert 'cadwyn' not in sys.modules, sorted(m for m in sys.modules if 'cadwyn' in m); "
+            "assert 'fastapi' not in sys.modules, 'fastapi was imported'"
+        )
+        subprocess.run([sys.executable, "-c", code], check=True, capture_output=True, text=True)
+
+    def test_accessing_bundle_loads_cadwyn(self):
+        # The foreign-SDK migration path does need cadwyn; accessing the bundle is where it loads.
+        code = (
+            "import sys; from airflow.sdk.execution_time.schema import bundle; "
+            "assert bundle.versions, 'bundle should be built'; "
+            "assert 'cadwyn' in sys.modules, 'cadwyn should load when the bundle is accessed'"
+        )
+        subprocess.run([sys.executable, "-c", code], check=True, capture_output=True, text=True)

From 6ad3c2c5eb143007e77a2fbcdd48e215aa1be86d Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 14:48:16 -0400
Subject: [PATCH 11/29] [v3-3-test] Don't force full CI tests for non-test
 workflow and prek-only changes (#68802) (#68999)

ENVIRONMENT_FILES forced the full test matrix on any .github/workflows
change and on any scripts/ci/prek change. Those over-match: non-test
workflows (security scans, doc publishing, notifications, backporting,
stale/calendar bots) cannot affect test outcomes, and prek hooks drive
static checks rather than the test matrix.

Exclude non-test workflows from ENVIRONMENT_FILES (test/CI-config
workflows like ci-amd, run-unit-tests, k8s-tests still force full), and
move scripts/ci/prek to a new PREK_FILES group that triggers only the CI
image build (so mypy-scripts and image-based static checks still run for
a prek-only change) without forcing the full matrix.

Static checks still run on every PR regardless; this only stops the
unnecessary full test matrix for changes that cannot affect tests.
(cherry picked from commit a4c269a6f9e0176995fbea971dd4e01ac9ae3123)

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
---
 dev/breeze/doc/ci/04_selective_checks.md      | 23 +++++++--
 .../airflow_breeze/utils/selective_checks.py  | 23 ++++++++-
 dev/breeze/tests/test_selective_checks.py     | 48 ++++++++++++++++++-
 3 files changed, 85 insertions(+), 9 deletions(-)

diff --git a/dev/breeze/doc/ci/04_selective_checks.md b/dev/breeze/doc/ci/04_selective_checks.md
index fb081df0aa1fc..5dbaf289f9eb0 100644
--- a/dev/breeze/doc/ci/04_selective_checks.md
+++ b/dev/breeze/doc/ci/04_selective_checks.md
@@ -160,7 +160,7 @@ not matter because any single hit forces the full matrix:
 flowchart TD
     A([full_tests_needed]) --> M{_should_run_all_tests_and_versions?}
     M -->|yes| T[TRUE - full matrix]
-    M -->|no| E1{environment files?<br/>.github/workflows, dev/breeze/src,<br/>Dockerfile, scripts/ci, ...}
+    M -->|no| E1{environment files?<br/>test workflows, dev/breeze/src,<br/>Dockerfile, scripts/ci/docker-compose+kubernetes, ...<br/>excl. prek + non-test workflows}
     E1 -->|yes| T
     E1 -->|no| E2{API contract / codegen?<br/>generated OpenAPI spec or generator}
     E2 -->|yes| T
@@ -240,6 +240,8 @@ representative examples (file → effect):
 | `airflow-core/src/airflow/jobs/scheduler_job_runner.py` | unit tests with **all** core test types                            | a core/other file → escape hatch runs all core types |
 | `pyproject.toml`                                       | **full matrix, all versions**                                        | dependency surface changed → `_should_run_all_tests_and_versions` |
 | `.github/workflows/ci-amd.yml` or `dev/breeze/src/...` | **full matrix**                                                      | environment files → can change the whole CI environment |
+| `.github/workflows/codeql-analysis.yml` (non-test workflow) | **basic checks only**                                           | non-test workflow → cannot affect tests (env-files carve-out) |
+| `scripts/ci/prek/check_*.py` (static-check hook)       | CI image + static checks, **no full matrix**                         | prek hooks are static checks → `Prek files` carve-out |
 | the generated OpenAPI spec                             | **full matrix**                                                      | the API *contract* ripples to UI codegen + every client |
 | `chart/templates/...yaml` (on `main`)                  | `run_helm_tests` (+ PROD image)                                      | matches `HELM_FILES`; Helm tests only on `main` |
 | `airflow-core/src/airflow/ui/...tsx` only              | `run_ui_tests`, **no** unit tests                                    | "only new-UI files" short-circuit skips Python unit tests |
@@ -279,9 +281,11 @@ flowchart TD
 2. **Pull request, core change** (`scheduler_job_runner.py`). Still `full_tests_needed=False`, but the
    core/other escape hatch adds **all core test types**. Providers are not pulled in (no provider files
    changed). Default versions.
-3. **Pull request that changes `pyproject.toml`** (or `.github/workflows/...`, or the OpenAPI spec).
-   `full_tests_needed=True` (and for `pyproject.toml` also `all_versions=True`). The PR runs the **full
-   matrix** — same as a canary — because the change can affect everything.
+3. **Pull request that changes `pyproject.toml`** (or a *test* workflow like `.github/workflows/ci-amd.yml`,
+   or the OpenAPI spec). `full_tests_needed=True` (and for `pyproject.toml` also `all_versions=True`). The
+   PR runs the **full matrix** — same as a canary — because the change can affect everything. (A *non-test*
+   workflow such as `codeql-analysis.yml`, or a `scripts/ci/prek/...` static-check hook, does **not** force
+   the full matrix — see the `Environment files` carve-outs above.)
 4. **Push / merge to `main`.** `_should_run_all_tests_and_versions()` is true for PUSH on `main` →
    `full_tests_needed=True`, `all_versions=True`, `is_canary_run=True`. The full matrix plus all
    canary-only jobs run. This is the safety net that backstops aggressive PR-time optimisation.
@@ -333,7 +337,16 @@ The authoritative, exhaustive rule list (kept in sync with the code) is in
 We have the following Groups of files for CI that determine which tests are run:
 
 * `Environment files` - if any of those changes, that forces 'full tests needed' mode, because changes
-  there might simply change the whole environment of what is going on in CI (Container image, dependencies)
+  there might simply change the whole environment of what is going on in CI (Container image, dependencies).
+  Two deliberate carve-outs do **not** force full tests: **static-check hooks** (`scripts/ci/prek/...`)
+  drive prek static checks rather than the test matrix, so they only trigger the CI image build (via the
+  `Prek files` group) — `mypy-scripts` and the image-based static checks still run, but the full test
+  matrix does not; and **non-test workflows** (`.github/workflows/` for security scans, doc publishing,
+  notifications, backporting, calendar/stale bots, …) cannot change test outcomes. Workflows that run or
+  configure the test suite (`ci-amd`, `ci-arm`, `run-unit-tests`, `k8s-tests`, `helm-tests`, image builds,
+  …) still force the full matrix.
+* `Prek files` - `scripts/ci/prek/...` static-check hooks. They do not force full tests, but they trigger
+  the CI image build so `mypy-scripts` and the image-based static checks run for a prek-only change.
 * `Python production files` and `Javascript production files` - this area is useful in CodeQL Security scanning
   - if any of the python or javascript files for airflow "production" changed, this means that the security
     scans should run
diff --git a/dev/breeze/src/airflow_breeze/utils/selective_checks.py b/dev/breeze/src/airflow_breeze/utils/selective_checks.py
index 8d4c512ff1a28..fcaf8ae5c0a27 100644
--- a/dev/breeze/src/airflow_breeze/utils/selective_checks.py
+++ b/dev/breeze/src/airflow_breeze/utils/selective_checks.py
@@ -149,6 +149,7 @@ class FileGroupForCi(Enum):
     DEVEL_TOML_FILES = auto()
     SCRIPTS_FILES = auto()
     UV_LOCK_FILE = auto()
+    PREK_FILES = auto()
     KERBEROS_FILES = auto()
     OTEL_FILES = auto()
     CELERY_FILES = auto()
@@ -171,7 +172,15 @@ def __hash__(self):
 CI_FILE_GROUP_MATCHES: HashableDict[FileGroupForCi] = HashableDict(
     {
         FileGroupForCi.ENVIRONMENT_FILES: [
-            r"^.github/workflows",
+            # Only workflows that actually run or configure the test suite force the full
+            # matrix. Non-test workflows (security scans, doc publishing, notifications,
+            # backporting, stale/calendar bots, …) cannot affect test outcomes, so they
+            # are excluded here to avoid accidental full-matrix runs.
+            r"^\.github/workflows/(?!("
+            r"asf-allowlist-check|automatic-backport|backport-cli|ci-duration-monitor|ci-notification|"
+            r"codeql-analysis|e2e-flaky-tests-report|milestone-tag-assistant|notify-uv-lock-conflicts|"
+            r"publish-docs-to-s3|recheck-old-bug-report|scheduled-verify-release-calendar|stale"
+            r")\.yml$)",
             r"^dev/breeze/src",
             r"^dev/breeze/pyproject\.toml",
             r"^dev/breeze/uv\.lock",
@@ -179,7 +188,10 @@ def __hash__(self):
             r"^Dockerfile",
             r"^scripts/ci/docker-compose",
             r"^scripts/ci/kubernetes",
-            r"^scripts/ci/prek",
+            # NOTE: scripts/ci/prek (static-check hooks) is intentionally NOT here. prek
+            # hooks drive static checks, not the test matrix, so they must not force the
+            # full matrix. They still build the CI image via FileGroupForCi.PREK_FILES
+            # below (so mypy-scripts and all static checks still run).
             r"^scripts/docker",
             r"^scripts/in_container",
         ],
@@ -438,6 +450,9 @@ def __hash__(self):
             r"^scripts/tools/.*\.py$",
             r"^scripts/tests/.*\.py$",
         ],
+        FileGroupForCi.PREK_FILES: [
+            r"^scripts/ci/prek",
+        ],
         FileGroupForCi.UV_LOCK_FILE: [
             r"^uv\.lock$",
         ],
@@ -1100,6 +1115,10 @@ def ci_image_build(self) -> bool:
             or self.pyproject_toml_changed
             or self.any_provider_yaml_or_pyproject_toml_changed
             or self.prod_image_build
+            # prek hooks no longer force the full test matrix (they are static checks, not
+            # tests), but they still need the CI image so mypy-scripts and the image-based
+            # static checks run for a prek-only change.
+            or bool(self._matching_files(FileGroupForCi.PREK_FILES, CI_FILE_GROUP_MATCHES))
         )
 
     @cached_property
diff --git a/dev/breeze/tests/test_selective_checks.py b/dev/breeze/tests/test_selective_checks.py
index 98cf2333a46de..7b2848a6f467f 100644
--- a/dev/breeze/tests/test_selective_checks.py
+++ b/dev/breeze/tests/test_selective_checks.py
@@ -1768,9 +1768,13 @@ def test_excluded_providers():
             pytest.param(
                 ("scripts/ci/prek/file.sh",),
                 {
-                    "full-tests-needed": "true",
+                    # prek hooks are static checks, not tests: they must not force the full
+                    # test matrix, but they still build the CI image so mypy-scripts and the
+                    # image-based static checks run.
+                    "full-tests-needed": "false",
+                    "ci-image-build": "true",
                 },
-                id="Full tests needed when prek scripts change",
+                id="prek scripts build the CI image but do not force full tests",
             )
         ),
         (
@@ -1812,6 +1816,46 @@ def test_full_test_needed_when_scripts_changes(files: tuple[str, ...], expected_
     assert_outputs_are_printed(expected_outputs, str(stderr))
 
 
+@pytest.mark.parametrize(
+    ("files", "expected_outputs"),
+    [
+        pytest.param(
+            (".github/workflows/ci-amd.yml",),
+            {"full-tests-needed": "true"},
+            id="Test workflow (ci-amd) forces full tests",
+        ),
+        pytest.param(
+            (".github/workflows/run-unit-tests.yml",),
+            {"full-tests-needed": "true"},
+            id="Test workflow (run-unit-tests) forces full tests",
+        ),
+        pytest.param(
+            (".github/workflows/codeql-analysis.yml",),
+            {"full-tests-needed": "false"},
+            id="Non-test workflow (codeql) does not force full tests",
+        ),
+        pytest.param(
+            (".github/workflows/publish-docs-to-s3.yml",),
+            {"full-tests-needed": "false"},
+            id="Non-test workflow (publish-docs-to-s3) does not force full tests",
+        ),
+        pytest.param(
+            (".github/workflows/ci-notification.yml",),
+            {"full-tests-needed": "false"},
+            id="Non-test workflow (ci-notification) does not force full tests",
+        ),
+    ],
+)
+def test_non_test_workflows_do_not_force_full_tests(files: tuple[str, ...], expected_outputs: dict[str, str]):
+    stderr = SelectiveChecks(
+        files=files,
+        github_event=GithubEvents.PULL_REQUEST,
+        commit_ref=NEUTRAL_COMMIT,
+        default_branch="main",
+    )
+    assert_outputs_are_printed(expected_outputs, str(stderr))
+
+
 @pytest.mark.parametrize(
     ("files", "pr_labels", "default_branch", "expected_outputs"),
     [

From 579757d0e9f05ee728caabc4b5aa827c4fe9ada5 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 14:54:18 -0400
Subject: [PATCH 12/29] [v3-3-test] Java SDK docs: JUL setup(), pin
 java_executable, config-reload note (#68938) (#69020)

(cherry picked from commit 7d96ee13a7ff1f82d85dcc4868e50e3383324548)

Co-authored-by: Jason(Zhe-You) Liu <68415893+jason810496@users.noreply.github.com>
---
 .../language-sdks/java.rst                    | 42 +++++++++++++++++--
 1 file changed, 39 insertions(+), 3 deletions(-)

diff --git a/airflow-core/docs/authoring-and-scheduling/language-sdks/java.rst b/airflow-core/docs/authoring-and-scheduling/language-sdks/java.rst
index 25dac2e2e1043..55a80f9967fce 100644
--- a/airflow-core/docs/authoring-and-scheduling/language-sdks/java.rst
+++ b/airflow-core/docs/authoring-and-scheduling/language-sdks/java.rst
@@ -340,13 +340,15 @@ Add the artifact:
 
     implementation("org.apache.airflow:airflow-sdk-jul:${version}")
 
-and call ``AirflowJulHandler.install()`` on startup to attach the handler to the
-JUL root logger before any task runs:
+and call ``AirflowJulHandler.setup()`` on startup, before any task runs. It clears the JUL root
+logger's existing handlers (including the default ``ConsoleHandler``, whose stderr output Airflow
+would otherwise capture as ``task.stderr`` at ERROR level, duplicating each record and mislabeling
+its level) and installs ``AirflowJulHandler`` in their place:
 
 .. code-block:: java
 
     public static void main(String[] args) {
-        AirflowJulHandler.install();
+        AirflowJulHandler.setup();
         Server.create(args).serve(new MyBundle());
     }
 
@@ -669,6 +671,40 @@ All ``kwargs`` in the ``coordinators`` config entry are passed to the
      - Seconds to wait for the JVM subprocess to connect after launch.  Increase this if your
        JVM startup is slow (e.g. on constrained hardware or with a large classpath).
 
+.. note::
+
+  The ``[sdk]`` configuration is read at startup, so changes to ``coordinators`` or
+  ``queue_to_coordinator`` (for example adding ``jvm_args``) only take effect after you restart the
+  scheduler (or ``airflow standalone``). A rebuilt bundle JAR, by contrast, is picked up on the next
+  task launch without a restart, because a fresh JVM is spawned per task instance.
+
+.. _java-sdk/java-executable:
+
+Pinning the Java executable
+---------------------------
+
+As a general recommendation, set ``java_executable`` to an absolute path rather than relying on
+``java`` resolving from ``$PATH``. This pins tasks to a known JDK, which matters most in production or
+corporate environments where the Airflow admin may not control the system-wide ``java`` (the same
+reasoning behind pinning a Python version).
+
+For example, if you install the JDK with Homebrew on macOS, its ``java`` is not on ``$PATH``, so
+point ``java_executable`` at it explicitly:
+
+.. code-block:: ini
+
+    [sdk]
+    coordinators = {
+      "java-jdk17": {
+        "classpath": "airflow.sdk.coordinators.java.JavaCoordinator",
+        "kwargs": {
+          "jars_root": ["/opt/airflow/jars"],
+          "java_executable": "/opt/homebrew/opt/openjdk@17/bin/java"
+        }
+      }
+    }
+    queue_to_coordinator = {"java": "java-jdk17"}
+
 .. _java-sdk/limitations:
 
 Limitations

From 5edc9f21d69206fed4b07d48e0b1c31af2fc9b0d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 14:54:54 -0400
Subject: [PATCH 13/29] Bump the github-actions-updates group across 1
 directory with 3 updates (#68811)

Bumps the github-actions-updates group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-java](https://github.com/actions/setup-java) and [pnpm/action-setup](https://github.com/pnpm/action-setup).


Updates `actions/checkout` from 6.0.2 to 7.0.0
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v6.0.2...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0)

Updates `actions/setup-java` from 5.2.0 to 5.3.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](https://github.com/actions/setup-java/compare/be666c2fcd27ec809703dec50e508c2fdc7f6654...ad2b38190b15e4d6bdf0c97fb4fca8412226d287)

Updates `pnpm/action-setup` from 6.0.8 to 6.0.9
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](https://github.com/pnpm/action-setup/compare/0e279bb959325dab635dd2c09392533439d90093...0ebf47130e4866e96fce0953f49152a61190b271)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-updates
- dependency-name: actions/setup-java
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-updates
- dependency-name: pnpm/action-setup
  dependency-version: 6.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .../workflows/additional-ci-image-checks.yml  |  2 +-
 .../workflows/additional-prod-image-tests.yml |  8 +++---
 .../workflows/airflow-distributions-tests.yml |  2 +-
 .github/workflows/airflow-e2e-tests.yml       |  2 +-
 .github/workflows/asf-allowlist-check.yml     |  2 +-
 .github/workflows/backport-cli.yml            |  2 +-
 .github/workflows/basic-tests.yml             | 26 +++++++++----------
 .github/workflows/ci-amd.yml                  | 20 +++++++-------
 .github/workflows/ci-arm.yml                  | 20 +++++++-------
 .github/workflows/ci-duration-monitor.yml     |  2 +-
 .github/workflows/ci-image-build.yml          |  2 +-
 .github/workflows/ci-image-checks.yml         | 10 +++----
 .github/workflows/ci-notification.yml         |  2 +-
 .github/workflows/codeql-analysis.yml         |  4 +--
 .github/workflows/e2e-flaky-tests-report.yml  |  2 +-
 .github/workflows/finalize-tests.yml          |  6 ++---
 .github/workflows/generate-constraints.yml    |  2 +-
 .github/workflows/helm-tests.yml              |  4 +--
 .../workflows/integration-system-tests.yml    |  6 ++---
 .github/workflows/k8s-tests.yml               |  2 +-
 .github/workflows/milestone-tag-assistant.yml |  2 +-
 .../workflows/notify-uv-lock-conflicts.yml    |  2 +-
 .github/workflows/prod-image-build.yml        |  4 +--
 .github/workflows/publish-docs-to-s3.yml      | 10 +++----
 .github/workflows/push-image-cache.yml        |  4 +--
 .github/workflows/registry-backfill.yml       |  6 ++---
 .github/workflows/registry-build.yml          |  4 +--
 .github/workflows/registry-tests.yml          |  2 +-
 .github/workflows/release_dockerhub_image.yml |  2 +-
 .../release_single_dockerhub_image.yml        |  4 +--
 .github/workflows/run-unit-tests.yml          |  2 +-
 .../scheduled-verify-release-calendar.yml     |  2 +-
 .github/workflows/test-providers.yml          |  4 +--
 .github/workflows/ui-e2e-tests.yml            |  4 +--
 .../update-constraints-on-push-stable.yml     |  8 +++---
 .../workflows/update-constraints-on-push.yml  |  8 +++---
 .github/workflows/upgrade-check.yml           |  2 +-
 37 files changed, 98 insertions(+), 98 deletions(-)

diff --git a/.github/workflows/additional-ci-image-checks.yml b/.github/workflows/additional-ci-image-checks.yml
index 6319967ae2285..f66a6627917b0 100644
--- a/.github/workflows/additional-ci-image-checks.yml
+++ b/.github/workflows/additional-ci-image-checks.yml
@@ -137,7 +137,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Install Breeze"
diff --git a/.github/workflows/additional-prod-image-tests.yml b/.github/workflows/additional-prod-image-tests.yml
index 85124ef3801cc..bfb21345c4d20 100644
--- a/.github/workflows/additional-prod-image-tests.yml
+++ b/.github/workflows/additional-prod-image-tests.yml
@@ -143,7 +143,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 2
           persist-credentials: false
@@ -181,7 +181,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 2
           persist-credentials: false
@@ -212,7 +212,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 2
           persist-credentials: false
@@ -372,7 +372,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 2
           persist-credentials: false
diff --git a/.github/workflows/airflow-distributions-tests.yml b/.github/workflows/airflow-distributions-tests.yml
index 6927c23d29933..d6eb98fddbae3 100644
--- a/.github/workflows/airflow-distributions-tests.yml
+++ b/.github/workflows/airflow-distributions-tests.yml
@@ -90,7 +90,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Prepare breeze & CI image: ${{ matrix.python-version }}"
diff --git a/.github/workflows/airflow-e2e-tests.yml b/.github/workflows/airflow-e2e-tests.yml
index f047d2a86809c..3a87ea525f7b5 100644
--- a/.github/workflows/airflow-e2e-tests.yml
+++ b/.github/workflows/airflow-e2e-tests.yml
@@ -100,7 +100,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 2
           persist-credentials: false
diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml
index a46b53dfe0a37..7a1d0b4d56f80 100644
--- a/.github/workflows/asf-allowlist-check.yml
+++ b/.github/workflows/asf-allowlist-check.yml
@@ -28,7 +28,7 @@ jobs:
   asf-allowlist-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - uses: apache/infrastructure-actions/allowlist-check@4e9c961f587f72b170874b6f5cd4ac15f7f26eb8  # main
diff --git a/.github/workflows/backport-cli.yml b/.github/workflows/backport-cli.yml
index 170493b1bb7ce..46fbe0cae6f57 100644
--- a/.github/workflows/backport-cli.yml
+++ b/.github/workflows/backport-cli.yml
@@ -53,7 +53,7 @@ jobs:
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
         id: checkout-for-backport
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: true
           fetch-depth: 0
diff --git a/.github/workflows/basic-tests.yml b/.github/workflows/basic-tests.yml
index c6a9f4684cdd0..714aef1139ca4 100644
--- a/.github/workflows/basic-tests.yml
+++ b/.github/workflows/basic-tests.yml
@@ -87,7 +87,7 @@ jobs:
       - name: "Cleanup repo"
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           # Need to fetch all history for selective checks tests
           fetch-depth: 0
@@ -106,7 +106,7 @@ jobs:
       - name: "Cleanup repo"
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -115,7 +115,7 @@ jobs:
       - name: "Install SVN"
         run: sudo apt-get update && sudo apt-get install -y subversion
       - name: "Install Java (for Apache RAT)"
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654  # v5.2.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287  # v5.3.0
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -134,7 +134,7 @@ jobs:
     runs-on: ${{ fromJSON(inputs.runners) }}
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 1
           persist-credentials: false
@@ -159,7 +159,7 @@ jobs:
     if: inputs.run-scripts-tests == 'true'
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 1
           persist-credentials: false
@@ -188,11 +188,11 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: Setup pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093  # v6.0.8
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271  # v6.0.9
         with:
           version: 9
           run_install: false
@@ -250,7 +250,7 @@ jobs:
     runs-on: ${{ fromJSON(inputs.runners) }}
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Install Breeze"
@@ -271,7 +271,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Install Breeze"
@@ -285,7 +285,7 @@ jobs:
           platform: ${{ inputs.platform }}
           save-cache: true
       - name: Fetch incoming commit ${{ github.sha }} with its parent
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: ${{ github.sha }}
           fetch-depth: 2
@@ -306,7 +306,7 @@ jobs:
     runs-on: ["windows-2025"]
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 2
           persist-credentials: false
@@ -327,7 +327,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Install Breeze"
@@ -374,7 +374,7 @@ jobs:
       FORCE_COLOR: 1
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Install uv"
diff --git a/.github/workflows/ci-amd.yml b/.github/workflows/ci-amd.yml
index 43276945a9c69..722f2cd09758a 100644
--- a/.github/workflows/ci-amd.yml
+++ b/.github/workflows/ci-amd.yml
@@ -165,11 +165,11 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: Fetch incoming commit ${{ github.sha }} with its parent
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: ${{ github.sha }}
           fetch-depth: 2
@@ -362,7 +362,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Prepare breeze & CI image: ${{ needs.build-info.outputs.default-python-version }}"
@@ -404,7 +404,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Prepare breeze & CI image: ${{ needs.build-info.outputs.default-python-version }}"
@@ -939,7 +939,7 @@ jobs:
       VERBOSE: "true"
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       # keep this in sync with go.mod in go-sdk/
@@ -976,11 +976,11 @@ jobs:
       VERBOSE: "true"
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: Setup Java
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654  # v5.2.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287  # v5.3.0
         with:
           distribution: 'temurin'
           java-version: ${{ env.JAVA_VERSION }}
@@ -1006,7 +1006,7 @@ jobs:
       VERBOSE: "true"
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Install Breeze"
@@ -1109,7 +1109,7 @@ jobs:
     runs-on: ["ubuntu-22.04"]
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Get failing jobs"
@@ -1222,7 +1222,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Free up disk space"
diff --git a/.github/workflows/ci-arm.yml b/.github/workflows/ci-arm.yml
index 688408aa8e49d..b3a05486fe2c6 100644
--- a/.github/workflows/ci-arm.yml
+++ b/.github/workflows/ci-arm.yml
@@ -155,11 +155,11 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: Fetch incoming commit ${{ github.sha }} with its parent
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: ${{ github.sha }}
           fetch-depth: 2
@@ -352,7 +352,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Prepare breeze & CI image: ${{ needs.build-info.outputs.default-python-version }}"
@@ -394,7 +394,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Prepare breeze & CI image: ${{ needs.build-info.outputs.default-python-version }}"
@@ -929,7 +929,7 @@ jobs:
       VERBOSE: "true"
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       # keep this in sync with go.mod in go-sdk/
@@ -966,11 +966,11 @@ jobs:
       VERBOSE: "true"
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: Setup Java
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654  # v5.2.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287  # v5.3.0
         with:
           distribution: 'temurin'
           java-version: ${{ env.JAVA_VERSION }}
@@ -996,7 +996,7 @@ jobs:
       VERBOSE: "true"
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Install Breeze"
@@ -1099,7 +1099,7 @@ jobs:
     runs-on: ["ubuntu-22.04"]
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Get failing jobs"
@@ -1212,7 +1212,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Free up disk space"
diff --git a/.github/workflows/ci-duration-monitor.yml b/.github/workflows/ci-duration-monitor.yml
index bc0f093203abe..2f3e1398d29ab 100644
--- a/.github/workflows/ci-duration-monitor.yml
+++ b/.github/workflows/ci-duration-monitor.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/ci-image-build.yml b/.github/workflows/ci-image-build.yml
index d5a638dd44add..7f1fa61fe609e 100644
--- a/.github/workflows/ci-image-build.yml
+++ b/.github/workflows/ci-image-build.yml
@@ -118,7 +118,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout target branch"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Free up disk space"
diff --git a/.github/workflows/ci-image-checks.yml b/.github/workflows/ci-image-checks.yml
index d678fc2c096ae..5eba03f950cae 100644
--- a/.github/workflows/ci-image-checks.yml
+++ b/.github/workflows/ci-image-checks.yml
@@ -130,7 +130,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Prepare breeze & CI image: ${{ inputs.default-python-version }}"
@@ -183,7 +183,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Prepare breeze & CI image: ${{ inputs.default-python-version }}"
@@ -351,7 +351,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Prepare breeze & CI image: ${{ inputs.default-python-version }}"
@@ -476,12 +476,12 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 2
           persist-credentials: false
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           repository: "apache/airflow-client-python"
           fetch-depth: 1
diff --git a/.github/workflows/ci-notification.yml b/.github/workflows/ci-notification.yml
index 5ed31a99ff51e..c896a94a937b8 100644
--- a/.github/workflows/ci-notification.yml
+++ b/.github/workflows/ci-notification.yml
@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 624368905e3f6..20dbac2c97e7d 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -110,13 +110,13 @@ jobs:
       security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
 
       - name: Setup Java
         if: matrix.language == 'java'
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654  # v5.2.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287  # v5.3.0
         with:
           distribution: 'temurin'
           java-version: '11'
diff --git a/.github/workflows/e2e-flaky-tests-report.yml b/.github/workflows/e2e-flaky-tests-report.yml
index 4deb9f3cb762a..b4408985236ef 100644
--- a/.github/workflows/e2e-flaky-tests-report.yml
+++ b/.github/workflows/e2e-flaky-tests-report.yml
@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/finalize-tests.yml b/.github/workflows/finalize-tests.yml
index 7d8f479969588..e03d6f35e98fe 100644
--- a/.github/workflows/finalize-tests.yml
+++ b/.github/workflows/finalize-tests.yml
@@ -99,7 +99,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           # Needed to perform push action
           persist-credentials: false
@@ -107,7 +107,7 @@ jobs:
         id: constraints-branch
         run: ./scripts/ci/constraints/ci_branch_constraints.sh >> ${GITHUB_OUTPUT}
       - name: Checkout ${{ steps.constraints-branch.outputs.branch }}
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           path: "constraints"
           ref: ${{ steps.constraints-branch.outputs.branch }}
@@ -139,7 +139,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Prepare breeze & CI image: ${{ matrix.python-version }}"
diff --git a/.github/workflows/generate-constraints.yml b/.github/workflows/generate-constraints.yml
index 5b6a839a4f3d3..55604039f7734 100644
--- a/.github/workflows/generate-constraints.yml
+++ b/.github/workflows/generate-constraints.yml
@@ -77,7 +77,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Install prek"
diff --git a/.github/workflows/helm-tests.yml b/.github/workflows/helm-tests.yml
index 933728eb2b938..1f94a9a37fc56 100644
--- a/.github/workflows/helm-tests.yml
+++ b/.github/workflows/helm-tests.yml
@@ -76,7 +76,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Prepare breeze & CI image: ${{ inputs.default-python-version }}"
@@ -107,7 +107,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Install Breeze"
diff --git a/.github/workflows/integration-system-tests.yml b/.github/workflows/integration-system-tests.yml
index a7c23458a74b2..466de7b0d0c31 100644
--- a/.github/workflows/integration-system-tests.yml
+++ b/.github/workflows/integration-system-tests.yml
@@ -98,7 +98,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Prepare breeze & CI image: ${{ inputs.default-python-version }}"
@@ -149,7 +149,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Prepare breeze & CI image: ${{ inputs.default-python-version }}"
@@ -194,7 +194,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Prepare breeze & CI image: ${{ inputs.default-python-version }}"
diff --git a/.github/workflows/k8s-tests.yml b/.github/workflows/k8s-tests.yml
index 34026d1393a75..04f587edf9640 100644
--- a/.github/workflows/k8s-tests.yml
+++ b/.github/workflows/k8s-tests.yml
@@ -81,7 +81,7 @@ jobs:
           echo "PYTHON_MAJOR_MINOR_VERSION=${KUBERNETES_COMBO}" | sed 's/-.*//' >> $GITHUB_ENV
           echo "KUBERNETES_VERSION=${KUBERNETES_COMBO}" | sed 's/=[^-]*-/=/'  >> $GITHUB_ENV
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       # env.PYTHON_MAJOR_MINOR_VERSION, env.KUBERNETES_VERSION are set in the previous
diff --git a/.github/workflows/milestone-tag-assistant.yml b/.github/workflows/milestone-tag-assistant.yml
index 48d7af9fb1f8b..27f7b2030f91e 100644
--- a/.github/workflows/milestone-tag-assistant.yml
+++ b/.github/workflows/milestone-tag-assistant.yml
@@ -101,7 +101,7 @@ jobs:
 
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
           # Always checkout main to ensure Breeze with set-milestone command is available
diff --git a/.github/workflows/notify-uv-lock-conflicts.yml b/.github/workflows/notify-uv-lock-conflicts.yml
index 69889eb2363b0..b45ae572e5f8a 100644
--- a/.github/workflows/notify-uv-lock-conflicts.yml
+++ b/.github/workflows/notify-uv-lock-conflicts.yml
@@ -33,7 +33,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Install uv"
diff --git a/.github/workflows/prod-image-build.yml b/.github/workflows/prod-image-build.yml
index b7d1e60d7df22..a5a120ae127db 100644
--- a/.github/workflows/prod-image-build.yml
+++ b/.github/workflows/prod-image-build.yml
@@ -125,7 +125,7 @@ jobs:
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
         if: inputs.upload-package-artifact == 'true'
       - name: "Checkout target branch"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Make /mnt writeable"
@@ -220,7 +220,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout target branch"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Make /mnt writeable"
diff --git a/.github/workflows/publish-docs-to-s3.yml b/.github/workflows/publish-docs-to-s3.yml
index 27cf7394cb59f..739be11a17379 100644
--- a/.github/workflows/publish-docs-to-s3.yml
+++ b/.github/workflows/publish-docs-to-s3.yml
@@ -116,7 +116,7 @@ jobs:
       ]'), github.event.sender.login)
     steps:
       - name: "Checkout for wave provider derivation"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
           ref: ${{ inputs.ref }}
@@ -235,7 +235,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout current version first to clean-up stuff"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
           path: current-version
@@ -253,7 +253,7 @@ jobs:
       # registry buildx cache pushed by the last "main" Test workflow so that layer rebuilds
       # are avoided whenever the ref is close enough to main for the cache to apply.
       - name: "Checkout ${{ inputs.ref }} "
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
           ref: ${{ inputs.ref }}
@@ -362,7 +362,7 @@ jobs:
       built: ${{ steps.sdk-present.outputs.exists }}
     steps:
       - name: "Checkout ${{ inputs.ref }}"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
           ref: ${{ inputs.ref }}
@@ -427,7 +427,7 @@ jobs:
         # but it will build the CI image from the version of Airflow that is used to check out things
         # We also fetch the whole history to be able to prepare SBOM files
       - name: "Checkout current version with all history for SBOM"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 0
diff --git a/.github/workflows/push-image-cache.yml b/.github/workflows/push-image-cache.yml
index f01ac884824a1..04e62eeb2b0f5 100644
--- a/.github/workflows/push-image-cache.yml
+++ b/.github/workflows/push-image-cache.yml
@@ -114,7 +114,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Free up disk space"
@@ -184,7 +184,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Free up disk space"
diff --git a/.github/workflows/registry-backfill.yml b/.github/workflows/registry-backfill.yml
index 0ce6cbee29895..6bd6493a09ee7 100644
--- a/.github/workflows/registry-backfill.yml
+++ b/.github/workflows/registry-backfill.yml
@@ -126,7 +126,7 @@ jobs:
       packages: read
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -217,7 +217,7 @@ jobs:
             --provider "${PROVIDER}" ${VERSION_ARGS}
 
       - name: "Setup pnpm"
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093  # v6.0.8
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271  # v6.0.9
         with:
           version: 10
 
@@ -284,7 +284,7 @@ jobs:
     name: "Publish versions.json"
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/registry-build.yml b/.github/workflows/registry-build.yml
index cd4294144108c..81847483ea448 100644
--- a/.github/workflows/registry-build.yml
+++ b/.github/workflows/registry-build.yml
@@ -112,7 +112,7 @@ jobs:
       contents: read
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
           # Tags drive the phantom-version filter in extract_metadata.py
@@ -231,7 +231,7 @@ jobs:
           fi
 
       - name: "Setup pnpm"
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093  # v6.0.8
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271  # v6.0.9
         with:
           version: 10
 
diff --git a/.github/workflows/registry-tests.yml b/.github/workflows/registry-tests.yml
index 1faa918952ed1..7a0cb3c518eed 100644
--- a/.github/workflows/registry-tests.yml
+++ b/.github/workflows/registry-tests.yml
@@ -45,7 +45,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/release_dockerhub_image.yml b/.github/workflows/release_dockerhub_image.yml
index 293229a90b59a..4973425b06c67 100644
--- a/.github/workflows/release_dockerhub_image.yml
+++ b/.github/workflows/release_dockerhub_image.yml
@@ -86,7 +86,7 @@ jobs:
           sudo rm -rf ${GITHUB_WORKSPACE}/*
 
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Install Breeze"
diff --git a/.github/workflows/release_single_dockerhub_image.yml b/.github/workflows/release_single_dockerhub_image.yml
index 0c50521bed653..c3926659bbc6d 100644
--- a/.github/workflows/release_single_dockerhub_image.yml
+++ b/.github/workflows/release_single_dockerhub_image.yml
@@ -77,7 +77,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Install Breeze"
@@ -171,7 +171,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Install Breeze"
diff --git a/.github/workflows/run-unit-tests.yml b/.github/workflows/run-unit-tests.yml
index 9417049bd5f5a..d1aa896615026 100644
--- a/.github/workflows/run-unit-tests.yml
+++ b/.github/workflows/run-unit-tests.yml
@@ -183,7 +183,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Make /mnt writeable"
diff --git a/.github/workflows/scheduled-verify-release-calendar.yml b/.github/workflows/scheduled-verify-release-calendar.yml
index fceb957cdaca6..36fd1b938ddf8 100644
--- a/.github/workflows/scheduled-verify-release-calendar.yml
+++ b/.github/workflows/scheduled-verify-release-calendar.yml
@@ -31,7 +31,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Install uv"
diff --git a/.github/workflows/test-providers.yml b/.github/workflows/test-providers.yml
index 81cc0d037d84a..d4dbe902a8d8e 100644
--- a/.github/workflows/test-providers.yml
+++ b/.github/workflows/test-providers.yml
@@ -89,7 +89,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Install prek"
@@ -199,7 +199,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Install prek"
diff --git a/.github/workflows/ui-e2e-tests.yml b/.github/workflows/ui-e2e-tests.yml
index 4057cda0533fc..ee0e417d9632d 100644
--- a/.github/workflows/ui-e2e-tests.yml
+++ b/.github/workflows/ui-e2e-tests.yml
@@ -103,7 +103,7 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           fetch-depth: 2
           persist-credentials: false
@@ -121,7 +121,7 @@ jobs:
         uses: ./.github/actions/breeze
         if: github.event_name == 'workflow_dispatch'
       - name: "Setup pnpm"
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093  # v6.0.8
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271  # v6.0.9
         with:
           version: 9
           run_install: false
diff --git a/.github/workflows/update-constraints-on-push-stable.yml b/.github/workflows/update-constraints-on-push-stable.yml
index 384ad3bdb3842..2ad9cbf85bc0a 100644
--- a/.github/workflows/update-constraints-on-push-stable.yml
+++ b/.github/workflows/update-constraints-on-push-stable.yml
@@ -47,11 +47,11 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: Fetch incoming commit ${{ github.sha }} with its parent
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: ${{ github.sha }}
           fetch-depth: 2
@@ -127,14 +127,14 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Set constraints branch name"
         id: constraints-branch
         run: ./scripts/ci/constraints/ci_branch_constraints.sh >> ${GITHUB_OUTPUT}
       - name: Checkout ${{ steps.constraints-branch.outputs.branch }}
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           path: "constraints"
           ref: ${{ steps.constraints-branch.outputs.branch }}
diff --git a/.github/workflows/update-constraints-on-push.yml b/.github/workflows/update-constraints-on-push.yml
index 5e3edb2a50479..16460bd89cbb0 100644
--- a/.github/workflows/update-constraints-on-push.yml
+++ b/.github/workflows/update-constraints-on-push.yml
@@ -50,11 +50,11 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: Fetch incoming commit ${{ github.sha }} with its parent
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: ${{ github.sha }}
           fetch-depth: 2
@@ -130,14 +130,14 @@ jobs:
         shell: bash
         run: sudo rm -rf ${GITHUB_WORKSPACE}/*
       - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: "Set constraints branch name"
         id: constraints-branch
         run: ./scripts/ci/constraints/ci_branch_constraints.sh >> ${GITHUB_OUTPUT}
       - name: Checkout ${{ steps.constraints-branch.outputs.branch }}
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           path: "constraints"
           ref: ${{ steps.constraints-branch.outputs.branch }}
diff --git a/.github/workflows/upgrade-check.yml b/.github/workflows/upgrade-check.yml
index fd416c9d1945c..cd3dce4d4e510 100644
--- a/.github/workflows/upgrade-check.yml
+++ b/.github/workflows/upgrade-check.yml
@@ -51,7 +51,7 @@ jobs:
           -u 0:0 bash -c "rm -rf /workspace/*"
       - name: >-
           [${{ inputs.target-branch }}] Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           ref: ${{ inputs.target-branch }}
           fetch-depth: 0

From 650efd91af4957ccb9ba87927feb839f4bb9e7e6 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 14:55:18 -0400
Subject: [PATCH 14/29] [v3-3-test] AIP-103: Allow for
 `get`/`set`/`delete`/`clear` to run for `AssetStateStoreAccessor` on
 Triggerer (#68900) (#68966)

(cherry picked from commit feea09d6107bc877c675e00c91b3d42d234502d5)

Co-authored-by: Jake McGrath <116606359+jroachgolf84@users.noreply.github.com>
Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com>
---
 .../docs/core-concepts/asset-state-store.rst  |  74 ++++++++
 .../execution_api/routes/asset_state_store.py |  38 ++--
 .../src/airflow/jobs/triggerer_job_runner.py  |  48 +++++
 .../versions/head/test_asset_state_store.py   |  72 ++++++++
 .../tests/unit/jobs/test_triggerer_job.py     | 117 ++++++++++--
 .../sdk/execution_time/request_handlers.py    |  94 ++++++++++
 .../execution_time/test_request_handlers.py   | 167 ++++++++++++++++++
 7 files changed, 587 insertions(+), 23 deletions(-)
 create mode 100644 task-sdk/tests/task_sdk/execution_time/test_request_handlers.py

diff --git a/airflow-core/docs/core-concepts/asset-state-store.rst b/airflow-core/docs/core-concepts/asset-state-store.rst
index 1f019d89d224b..3aa7ff7719f8a 100644
--- a/airflow-core/docs/core-concepts/asset-state-store.rst
+++ b/airflow-core/docs/core-concepts/asset-state-store.rst
@@ -150,6 +150,80 @@ Deletes *all* asset state store keys for the asset.
     # Using context
     context["asset_state_store"][my_asset].clear()
 
+Using ``asset_state_store`` inside a Watcher Trigger
+-----------------------------------------------------
+
+:class:`~airflow.triggers.base.BaseEventTrigger` subclasses (watcher triggers) can read and write asset state store directly from within ``run()``. The triggerer injects ``self.asset_state_store`` before ``run()`` is called, scoped to the asset the trigger is watching. It is not available during ``__init__`` or ``serialize()``, only access it from within ``run()``.
+
+Unlike task-based access (where the asset is identified by an inlet or outlet declaration), the accessor in a watcher trigger is automatically bound to the watched asset, so no subscripting is needed.
+
+.. code-block:: python
+
+    import asyncio
+    from collections.abc import AsyncIterator
+    from typing import Any
+
+    from airflow.triggers.base import BaseEventTrigger, TriggerEvent
+
+
+    class PollEventsTrigger(BaseEventTrigger):
+        def __init__(self, source: str, waiter_delay: int, **kwargs):
+            super().__init__(**kwargs)
+            self.source = source
+            self.waiter_delay = waiter_delay
+
+        def serialize(self) -> tuple[str, dict[str, Any]]:
+            return (
+                f"{self.__class__.__module__}.{self.__class__.__qualname__}",
+                {"source": self.source, "waiter_delay": self.waiter_delay},
+            )
+
+        def _poll_for_new_record(self, source: str, last_seen: str) -> str | None:
+            ...  # Add logic for polling a certain source
+            return None
+
+        async def run(self) -> AsyncIterator[TriggerEvent]:
+            while True:
+                last_seen = self.asset_state_store.get("last_seen_id", default=0)
+                new_id = self._poll_for_new_record(
+                    source=self.source,
+                    last_seen=last_seen,
+                )
+
+                if new_id is not None:
+                    self.asset_state_store.set("last_seen_id", new_id)
+                    yield TriggerEvent({"status": "success", "record_id": new_id})
+                    return
+
+                await asyncio.sleep(self.waiter_delay)
+
+The corresponding :class:`~airflow.sdk.definitions.asset.AssetWatcher` wires the trigger to the asset:
+
+.. code-block:: python
+
+    from airflow.sdk import Asset, AssetWatcher
+
+    from my_dag.triggers import PollEventsTrigger
+
+    my_asset = Asset(
+        name="orders_api",
+        watchers=[
+            AssetWatcher(
+                name="orders_api_watcher",
+                trigger=PollEventsTrigger(source="orders", waiter_delay=30),
+            )
+        ],
+    )
+
+    ...
+
+``self.asset_state_store`` behaves identically to the per-asset accessor described in the task sections above: ``get``, ``set``, ``delete``, and ``clear`` are all available. Values written by the trigger are visible to any task that declares ``my_asset`` as an inlet or outlet, and vice versa.
+
+.. note::
+
+   ``self.asset_state_store`` is only available inside :class:`~airflow.triggers.base.BaseEventTrigger` subclasses. Plain :class:`~airflow.triggers.base.BaseTrigger` subclasses (used for task deferral) do not have access to asset state store.
+
+
 Some Example Use cases
 ----------------------
 
diff --git a/airflow-core/src/airflow/api_fastapi/execution_api/routes/asset_state_store.py b/airflow-core/src/airflow/api_fastapi/execution_api/routes/asset_state_store.py
index f602962528e7f..4424e4ad3f180 100644
--- a/airflow-core/src/airflow/api_fastapi/execution_api/routes/asset_state_store.py
+++ b/airflow-core/src/airflow/api_fastapi/execution_api/routes/asset_state_store.py
@@ -30,6 +30,7 @@
 
 import json
 from typing import Annotated
+from uuid import UUID
 
 from cadwyn import VersionedAPIRouter
 from fastapi import HTTPException, Query, status
@@ -49,6 +50,7 @@
 from airflow.state.metastore import MetastoreBackend
 
 _TIWriterFields = tuple[str, str, str, int]
+NULL_UUID = UUID(int=0)
 
 
 def _fetch_ti_writer_fields(token: TIToken, session: SessionDep) -> _TIWriterFields:
@@ -130,18 +132,30 @@ def _put_asset_state_store(
 ) -> None:
     backend = get_state_backend()
     if isinstance(backend, MetastoreBackend):
-        dag_id, run_id, task_id, map_index = _fetch_ti_writer_fields(token, session)
-        backend.set_asset_state_store(
-            scope,
-            key,
-            json.dumps(body.value),
-            kind=AssetStateStoreWriterKind.TASK,
-            dag_id=dag_id,
-            run_id=run_id,
-            task_id=task_id,
-            map_index=map_index,
-            session=session,
-        )
+        if token.id == NULL_UUID:
+            # Since the asset state store routes do not have `task_instance_id` in their path params, the default kicks in which is"00000000-0000-0000-0000-000000000000"
+            backend.set_asset_state_store(
+                scope,
+                key,
+                json.dumps(body.value),
+                kind=AssetStateStoreWriterKind.WATCHER,
+                session=session,
+            )
+        else:
+            ti_fields = _fetch_ti_writer_fields(token, session)
+            dag_id, run_id, task_id, map_index = ti_fields
+
+            backend.set_asset_state_store(
+                scope,
+                key,
+                json.dumps(body.value),
+                kind=AssetStateStoreWriterKind.TASK,
+                dag_id=dag_id,
+                run_id=run_id,
+                task_id=task_id,
+                map_index=map_index,
+                session=session,
+            )
     else:
         backend.set(scope, key, json.dumps(body.value), session=session)
 
diff --git a/airflow-core/src/airflow/jobs/triggerer_job_runner.py b/airflow-core/src/airflow/jobs/triggerer_job_runner.py
index b29978e52a943..eccd9d2fc048d 100644
--- a/airflow-core/src/airflow/jobs/triggerer_job_runner.py
+++ b/airflow-core/src/airflow/jobs/triggerer_job_runner.py
@@ -60,13 +60,20 @@
 from airflow.sdk.api.datamodels._generated import HITLDetailResponse
 from airflow.sdk.definitions.asset import Asset
 from airflow.sdk.execution_time.comms import (
+    AssetStateStoreResult,
+    ClearAssetStateStoreByName,
+    ClearAssetStateStoreByUri,
     CommsDecoder,
     ConnectionResult,
     DagRunStateResult,
+    DeleteAssetStateStoreByName,
+    DeleteAssetStateStoreByUri,
     DeleteVariable,
     DeleteXCom,
     DRCount,
     ErrorResponse,
+    GetAssetStateStoreByName,
+    GetAssetStateStoreByUri,
     GetConnection,
     GetDagRunState,
     GetDRCount,
@@ -80,6 +87,8 @@
     MaskSecret,
     OKResponse,
     PutVariable,
+    SetAssetStateStoreByName,
+    SetAssetStateStoreByUri,
     SetXCom,
     TaskStatesResult,
     TICount,
@@ -92,8 +101,14 @@
 )
 from airflow.sdk.execution_time.context import AssetStateStoreAccessors
 from airflow.sdk.execution_time.request_handlers import (
+    handle_clear_asset_state_store_by_name,
+    handle_clear_asset_state_store_by_uri,
+    handle_delete_asset_state_store_by_name,
+    handle_delete_asset_state_store_by_uri,
     handle_delete_variable,
     handle_delete_xcom,
+    handle_get_asset_state_store_by_name,
+    handle_get_asset_state_store_by_uri,
     handle_get_connection,
     handle_get_dag_run_state,
     handle_get_dr_count,
@@ -105,6 +120,8 @@
     handle_get_xcom,
     handle_mask_secret,
     handle_put_variable,
+    handle_set_asset_state_store_by_name,
+    handle_set_asset_state_store_by_uri,
     handle_set_xcom,
 )
 from airflow.sdk.execution_time.supervisor import WatchedSubprocess, make_buffered_socket_reader
@@ -353,6 +370,7 @@ def from_api_response(cls, response: HITLDetailResponse) -> HITLDetailResponseRe
     | DRCount
     | TICount
     | TaskStatesResult
+    | AssetStateStoreResult
     | HITLDetailResponseResult
     | ErrorResponse
     | OKResponse,
@@ -376,6 +394,14 @@ def from_api_response(cls, response: HITLDetailResponse) -> HITLDetailResponseRe
     | SetXCom
     | GetTICount
     | GetTaskStates
+    | ClearAssetStateStoreByName
+    | ClearAssetStateStoreByUri
+    | DeleteAssetStateStoreByName
+    | DeleteAssetStateStoreByUri
+    | GetAssetStateStoreByName
+    | GetAssetStateStoreByUri
+    | SetAssetStateStoreByName
+    | SetAssetStateStoreByUri
     | GetDagRunState
     | GetDRCount
     | GetPreviousTI
@@ -622,6 +648,28 @@ def _handle_request(self, msg: ToTriggerSupervisor, log: FilteringBoundLogger, r
             resp = HITLDetailResponseResult.from_api_response(response=api_resp)
         elif isinstance(msg, MaskSecret):
             handle_mask_secret(msg)
+        elif isinstance(msg, ClearAssetStateStoreByName):
+            handle_clear_asset_state_store_by_name(self.client, msg)
+            resp = OKResponse(ok=True)
+        elif isinstance(msg, ClearAssetStateStoreByUri):
+            handle_clear_asset_state_store_by_uri(self.client, msg)
+            resp = OKResponse(ok=True)
+        elif isinstance(msg, DeleteAssetStateStoreByName):
+            handle_delete_asset_state_store_by_name(self.client, msg)
+            resp = OKResponse(ok=True)
+        elif isinstance(msg, DeleteAssetStateStoreByUri):
+            handle_delete_asset_state_store_by_uri(self.client, msg)
+            resp = OKResponse(ok=True)
+        elif isinstance(msg, GetAssetStateStoreByName):
+            resp, dump_opts = handle_get_asset_state_store_by_name(self.client, msg)
+        elif isinstance(msg, GetAssetStateStoreByUri):
+            resp, dump_opts = handle_get_asset_state_store_by_uri(self.client, msg)
+        elif isinstance(msg, SetAssetStateStoreByName):
+            handle_set_asset_state_store_by_name(self.client, msg)
+            resp = OKResponse(ok=True)
+        elif isinstance(msg, SetAssetStateStoreByUri):
+            handle_set_asset_state_store_by_uri(self.client, msg)
+            resp = OKResponse(ok=True)
         else:
             raise ValueError(f"Unknown message type {type(msg)}")
 
diff --git a/airflow-core/tests/unit/api_fastapi/execution_api/versions/head/test_asset_state_store.py b/airflow-core/tests/unit/api_fastapi/execution_api/versions/head/test_asset_state_store.py
index 57b4623365324..86a64b34a9aa2 100644
--- a/airflow-core/tests/unit/api_fastapi/execution_api/versions/head/test_asset_state_store.py
+++ b/airflow-core/tests/unit/api_fastapi/execution_api/versions/head/test_asset_state_store.py
@@ -380,3 +380,75 @@ def test_get_inactive_asset_by_name_returns_404(self, client: TestClient, inacti
     def test_get_inactive_asset_by_uri_returns_404(self, client: TestClient, inactive_asset: AssetModel):
         response = client.get(_BY_URI_VALUE, params={"uri": inactive_asset.uri, "key": "watermark"})
         assert response.status_code == 404
+
+
+class TestPutAssetStateWatcherWrite:
+    """PUT routes record WATCHER kind when no TI backs the token (WATCHER/triggerer path)."""
+
+    @pytest.fixture(autouse=True)
+    def setup_null_uuid_auth(self, exec_app: FastAPI):
+        from uuid import UUID
+
+        async def _watcher_auth(request: Request) -> TIToken:
+            return TIToken(
+                id=UUID("00000000-0000-0000-0000-000000000000"), claims=TIClaims(scope="execution")
+            )
+
+        exec_app.dependency_overrides[require_auth] = _watcher_auth
+
+    def test_put_by_name_creates_row(self, client: TestClient, asset: AssetModel, session):
+        response = client.put(
+            _BY_NAME_VALUE, params={"name": asset.name, "key": "watermark"}, json={"value": "2026-01-01"}
+        )
+
+        assert response.status_code == 204
+
+        row = session.scalar(
+            select(AssetStateStoreModel).where(
+                AssetStateStoreModel.asset_id == asset.id,
+                AssetStateStoreModel.key == "watermark",
+            )
+        )
+
+        assert row is not None
+        assert row.value == '"2026-01-01"'
+
+    def test_put_by_name_records_watcher_kind(self, client: TestClient, asset: AssetModel, session):
+        client.put(
+            _BY_NAME_VALUE, params={"name": asset.name, "key": "watermark"}, json={"value": "2026-01-01"}
+        )
+
+        row = session.scalar(
+            select(AssetStateStoreModel).where(
+                AssetStateStoreModel.asset_id == asset.id,
+                AssetStateStoreModel.key == "watermark",
+            )
+        )
+
+        assert row is not None
+        assert row.last_updated_by_kind == "watcher"
+        assert row.last_updated_by_dag_id is None
+        assert row.last_updated_by_run_id is None
+        assert row.last_updated_by_task_id is None
+        assert row.last_updated_by_map_index is None
+
+    def test_put_by_uri_records_watcher_kind(self, client: TestClient, asset: AssetModel, session):
+        response = client.put(
+            _BY_URI_VALUE, params={"uri": asset.uri, "key": "watermark"}, json={"value": "2026-06-01"}
+        )
+
+        assert response.status_code == 204
+
+        row = session.scalar(
+            select(AssetStateStoreModel).where(
+                AssetStateStoreModel.asset_id == asset.id,
+                AssetStateStoreModel.key == "watermark",
+            )
+        )
+
+        assert row is not None
+        assert row.last_updated_by_kind == "watcher"
+        assert row.last_updated_by_dag_id is None
+        assert row.last_updated_by_run_id is None
+        assert row.last_updated_by_task_id is None
+        assert row.last_updated_by_map_index is None
diff --git a/airflow-core/tests/unit/jobs/test_triggerer_job.py b/airflow-core/tests/unit/jobs/test_triggerer_job.py
index 0bfdbc171c292..9ad31b4e5c251 100644
--- a/airflow-core/tests/unit/jobs/test_triggerer_job.py
+++ b/airflow-core/tests/unit/jobs/test_triggerer_job.py
@@ -76,10 +76,21 @@
 from airflow.providers.standard.triggers.file import FileDeleteTrigger
 from airflow.providers.standard.triggers.temporal import DateTimeTrigger, TimeDeltaTrigger
 from airflow.sdk import DAG, Asset, BaseHook, BaseOperator
+from airflow.sdk.api.client import Client
+from airflow.sdk.api.datamodels._generated import AssetStateStoreResponse
+from airflow.sdk.exceptions import ErrorType
 from airflow.sdk.execution_time.comms import (
     AssetStateStoreResult,
+    ClearAssetStateStoreByName,
+    ClearAssetStateStoreByUri,
+    DeleteAssetStateStoreByName,
+    DeleteAssetStateStoreByUri,
+    ErrorResponse,
     GetAssetStateStoreByName,
+    GetAssetStateStoreByUri,
+    OKResponse,
     SetAssetStateStoreByName,
+    SetAssetStateStoreByUri,
     ToSupervisor,
     ToTask,
     _RequestFrame,
@@ -834,6 +845,99 @@ async def test_create_triggers_asset_state_store_accessor_reads_and_writes(
     await runner.cleanup_finished_triggers()
 
 
+class TestTriggerSupervisorAssetStateStore:
+    """Supervisor side of the asset-state-store round trip.
+
+    The accessor-only test above asserts the messages a watcher trigger emits, but never
+    exercises ``TriggerRunnerSupervisor._handle_request``. These drive the supervisor
+    directly so a broken (or missing) branch can't pass silently.
+    """
+
+    @pytest.fixture
+    def supervisor(self, jobless_supervisor, mocker):
+        jobless_supervisor.client = mocker.MagicMock(spec=Client)
+        mocker.patch.object(TriggerRunnerSupervisor, "send_msg")
+        return jobless_supervisor
+
+    @staticmethod
+    def _handle(supervisor, msg):
+        supervisor._handle_request(msg, log=MagicMock(spec=FilteringBoundLogger), req_id=7)
+
+    def test_get_by_name_wraps_response_and_replies(self, supervisor):
+        supervisor.client.asset_state_store.get.return_value = AssetStateStoreResponse(value="2026-01-01")
+
+        self._handle(supervisor, GetAssetStateStoreByName(name="asset_a", key="watermark"))
+
+        supervisor.client.asset_state_store.get.assert_called_once_with(key="watermark", name="asset_a")
+        supervisor.send_msg.assert_called_once_with(
+            AssetStateStoreResult(value="2026-01-01"), request_id=7, error=None
+        )
+
+    def test_get_by_uri_wraps_response_and_replies(self, supervisor):
+        supervisor.client.asset_state_store.get.return_value = AssetStateStoreResponse(value="2026-01-01")
+
+        self._handle(supervisor, GetAssetStateStoreByUri(uri="s3://bucket/a", key="watermark"))
+
+        supervisor.client.asset_state_store.get.assert_called_once_with(key="watermark", uri="s3://bucket/a")
+        supervisor.send_msg.assert_called_once_with(
+            AssetStateStoreResult(value="2026-01-01"), request_id=7, error=None
+        )
+
+    def test_get_passes_through_not_found_error(self, supervisor):
+        err = ErrorResponse(error=ErrorType.ASSET_STORE_NOT_FOUND, detail={"key": "watermark"})
+        supervisor.client.asset_state_store.get.return_value = err
+
+        self._handle(supervisor, GetAssetStateStoreByName(name="asset_a", key="watermark"))
+
+        supervisor.send_msg.assert_called_once_with(err, request_id=7, error=None)
+
+    def test_set_by_name(self, supervisor):
+        self._handle(
+            supervisor, SetAssetStateStoreByName(name="asset_a", key="watermark", value="2026-01-01")
+        )
+
+        supervisor.client.asset_state_store.set.assert_called_once_with(
+            key="watermark", value="2026-01-01", name="asset_a"
+        )
+        supervisor.send_msg.assert_called_once_with(OKResponse(ok=True), request_id=7, error=None)
+
+    def test_set_by_uri(self, supervisor):
+        self._handle(
+            supervisor, SetAssetStateStoreByUri(uri="s3://bucket/a", key="watermark", value="2026-01-01")
+        )
+
+        supervisor.client.asset_state_store.set.assert_called_once_with(
+            key="watermark", value="2026-01-01", uri="s3://bucket/a"
+        )
+        supervisor.send_msg.assert_called_once_with(OKResponse(ok=True), request_id=7, error=None)
+
+    def test_delete_by_name(self, supervisor):
+        self._handle(supervisor, DeleteAssetStateStoreByName(name="asset_a", key="watermark"))
+
+        supervisor.client.asset_state_store.delete.assert_called_once_with(key="watermark", name="asset_a")
+        supervisor.send_msg.assert_called_once_with(OKResponse(ok=True), request_id=7, error=None)
+
+    def test_delete_by_uri(self, supervisor):
+        self._handle(supervisor, DeleteAssetStateStoreByUri(uri="s3://bucket/a", key="watermark"))
+
+        supervisor.client.asset_state_store.delete.assert_called_once_with(
+            key="watermark", uri="s3://bucket/a"
+        )
+        supervisor.send_msg.assert_called_once_with(OKResponse(ok=True), request_id=7, error=None)
+
+    def test_clear_by_name(self, supervisor):
+        self._handle(supervisor, ClearAssetStateStoreByName(name="asset_a"))
+
+        supervisor.client.asset_state_store.clear.assert_called_once_with(name="asset_a")
+        supervisor.send_msg.assert_called_once_with(OKResponse(ok=True), request_id=7, error=None)
+
+    def test_clear_by_uri(self, supervisor):
+        self._handle(supervisor, ClearAssetStateStoreByUri(uri="s3://bucket/a"))
+
+        supervisor.client.asset_state_store.clear.assert_called_once_with(uri="s3://bucket/a")
+        supervisor.send_msg.assert_called_once_with(OKResponse(ok=True), request_id=7, error=None)
+
+
 def test_trigger_lifecycle(spy_agency: SpyAgency, session, testing_dag_bundle):
     """
     Checks that the triggerer will correctly see a new Trigger in the database
@@ -2368,19 +2472,11 @@ def get_type_names(union_type):
             "CreateHITLDetailPayload",
             "SetRenderedMapIndex",
             "GetDag",
-            # AIP-103 task/asset store — triggerer has no task execution context.
+            # AIP-103 task store — triggerer has no task execution context.
             "GetTaskStateStore",
             "SetTaskStateStore",
             "DeleteTaskStateStore",
             "ClearTaskStateStore",
-            "GetAssetStateStoreByName",
-            "GetAssetStateStoreByUri",
-            "SetAssetStateStoreByName",
-            "SetAssetStateStoreByUri",
-            "DeleteAssetStateStoreByName",
-            "DeleteAssetStateStoreByUri",
-            "ClearAssetStateStoreByName",
-            "ClearAssetStateStoreByUri",
         }
 
         in_task_but_not_in_trigger_runner = {
@@ -2402,9 +2498,8 @@ def get_type_names(union_type):
             "PreviousTIResult",
             "HITLDetailRequestResult",
             "DagResult",
-            # AIP-103 task/asset store results — worker-only responses to the above messages.
+            # AIP-103 task store result — worker-only response to the above messages.
             "TaskStateStoreResult",
-            "AssetStateStoreResult",
         }
 
         supervisor_diff = (
diff --git a/task-sdk/src/airflow/sdk/execution_time/request_handlers.py b/task-sdk/src/airflow/sdk/execution_time/request_handlers.py
index 959be43fe93cf..a31596b3d2b82 100644
--- a/task-sdk/src/airflow/sdk/execution_time/request_handlers.py
+++ b/task-sdk/src/airflow/sdk/execution_time/request_handlers.py
@@ -31,6 +31,7 @@
 from uuid import UUID
 
 from airflow.sdk.api.datamodels._generated import (
+    AssetStateStoreResponse,
     ConnectionResponse,
     DagRunStateResponse,
     TaskStatesResponse,
@@ -40,10 +41,17 @@
     XComSequenceSliceResponse,
 )
 from airflow.sdk.execution_time.comms import (
+    AssetStateStoreResult,
+    ClearAssetStateStoreByName,
+    ClearAssetStateStoreByUri,
     ConnectionResult,
     DagRunStateResult,
+    DeleteAssetStateStoreByName,
+    DeleteAssetStateStoreByUri,
     DeleteVariable,
     DeleteXCom,
+    GetAssetStateStoreByName,
+    GetAssetStateStoreByUri,
     GetConnection,
     GetDagRunState,
     GetDRCount,
@@ -60,6 +68,8 @@
     MaskSecret,
     PrevSuccessfulDagRunResult,
     PutVariable,
+    SetAssetStateStoreByName,
+    SetAssetStateStoreByUri,
     SetXCom,
     TaskStatesResult,
     VariableKeysResult,
@@ -272,3 +282,87 @@ def handle_get_xcom(client: Client, msg: GetXCom) -> tuple[BaseModel | None, dic
         xcom_result = XComResult.from_xcom_response(xcom)
         return xcom_result, {"exclude_unset": True}
     return xcom, {}
+
+
+def handle_get_asset_state_store_by_name(
+    client: Client, msg: GetAssetStateStoreByName
+) -> tuple[BaseModel | None, dict[str, bool]]:
+    asset_state = client.asset_state_store.get(
+        key=msg.key,
+        name=msg.name,
+    )
+
+    if isinstance(asset_state, AssetStateStoreResponse):
+        return AssetStateStoreResult.from_asset_state_store_response(asset_state), {}
+
+    return asset_state, {}
+
+
+def handle_get_asset_state_store_by_uri(
+    client: Client, msg: GetAssetStateStoreByUri
+) -> tuple[BaseModel | None, dict[str, bool]]:
+    asset_state = client.asset_state_store.get(
+        key=msg.key,
+        uri=msg.uri,
+    )
+
+    if isinstance(asset_state, AssetStateStoreResponse):
+        return AssetStateStoreResult.from_asset_state_store_response(asset_state), {}
+
+    return asset_state, {}
+
+
+def handle_set_asset_state_store_by_name(
+    client: Client, msg: SetAssetStateStoreByName
+) -> tuple[BaseModel | None, dict[str, bool]]:
+    client.asset_state_store.set(
+        key=msg.key,
+        value=msg.value,
+        name=msg.name,
+    )
+    return None, {}
+
+
+def handle_set_asset_state_store_by_uri(
+    client: Client, msg: SetAssetStateStoreByUri
+) -> tuple[BaseModel | None, dict[str, bool]]:
+    client.asset_state_store.set(
+        key=msg.key,
+        value=msg.value,
+        uri=msg.uri,
+    )
+    return None, {}
+
+
+def handle_delete_asset_state_store_by_name(
+    client: Client, msg: DeleteAssetStateStoreByName
+) -> tuple[BaseModel | None, dict[str, bool]]:
+    client.asset_state_store.delete(
+        key=msg.key,
+        name=msg.name,
+    )
+    return None, {}
+
+
+def handle_delete_asset_state_store_by_uri(
+    client: Client, msg: DeleteAssetStateStoreByUri
+) -> tuple[BaseModel | None, dict[str, bool]]:
+    client.asset_state_store.delete(
+        key=msg.key,
+        uri=msg.uri,
+    )
+    return None, {}
+
+
+def handle_clear_asset_state_store_by_name(
+    client: Client, msg: ClearAssetStateStoreByName
+) -> tuple[BaseModel | None, dict[str, bool]]:
+    client.asset_state_store.clear(name=msg.name)
+    return None, {}
+
+
+def handle_clear_asset_state_store_by_uri(
+    client: Client, msg: ClearAssetStateStoreByUri
+) -> tuple[BaseModel | None, dict[str, bool]]:
+    client.asset_state_store.clear(uri=msg.uri)
+    return None, {}
diff --git a/task-sdk/tests/task_sdk/execution_time/test_request_handlers.py b/task-sdk/tests/task_sdk/execution_time/test_request_handlers.py
new file mode 100644
index 0000000000000..c3999f9baca9a
--- /dev/null
+++ b/task-sdk/tests/task_sdk/execution_time/test_request_handlers.py
@@ -0,0 +1,167 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+from __future__ import annotations
+
+from unittest.mock import MagicMock
+
+import pytest
+
+from airflow.sdk.api import client as sdk_client
+from airflow.sdk.api.datamodels._generated import AssetStateStoreResponse
+from airflow.sdk.exceptions import ErrorType
+from airflow.sdk.execution_time.comms import (
+    AssetStateStoreResult,
+    ClearAssetStateStoreByName,
+    ClearAssetStateStoreByUri,
+    DeleteAssetStateStoreByName,
+    DeleteAssetStateStoreByUri,
+    ErrorResponse,
+    GetAssetStateStoreByName,
+    GetAssetStateStoreByUri,
+    SetAssetStateStoreByName,
+    SetAssetStateStoreByUri,
+)
+from airflow.sdk.execution_time.request_handlers import (
+    handle_clear_asset_state_store_by_name,
+    handle_clear_asset_state_store_by_uri,
+    handle_delete_asset_state_store_by_name,
+    handle_delete_asset_state_store_by_uri,
+    handle_get_asset_state_store_by_name,
+    handle_get_asset_state_store_by_uri,
+    handle_set_asset_state_store_by_name,
+    handle_set_asset_state_store_by_uri,
+)
+
+
+@pytest.fixture
+def client():
+    return MagicMock(spec=sdk_client.Client)
+
+
+def test_get_asset_state_store_by_name_wraps_response_as_result(client):
+    client.asset_state_store.get.return_value = AssetStateStoreResponse(value="2026-01-01")
+
+    result, dump_opts = handle_get_asset_state_store_by_name(
+        client, GetAssetStateStoreByName(name="asset_a", key="watermark")
+    )
+
+    client.asset_state_store.get.assert_called_once_with(key="watermark", name="asset_a")
+    assert result == AssetStateStoreResult(value="2026-01-01")
+    assert dump_opts == {}
+
+
+def test_get_asset_state_store_by_name_passes_through_error_response(client):
+    err = ErrorResponse(error=ErrorType.ASSET_STORE_NOT_FOUND, detail={"key": "watermark"})
+    client.asset_state_store.get.return_value = err
+
+    result, dump_opts = handle_get_asset_state_store_by_name(
+        client, GetAssetStateStoreByName(name="asset_a", key="watermark")
+    )
+
+    assert result is err
+    assert dump_opts == {}
+
+
+def test_get_asset_state_store_by_uri_wraps_response_as_result(client):
+    client.asset_state_store.get.return_value = AssetStateStoreResponse(value="2026-01-01")
+
+    result, dump_opts = handle_get_asset_state_store_by_uri(
+        client, GetAssetStateStoreByUri(uri="s3://bucket/a", key="watermark")
+    )
+
+    client.asset_state_store.get.assert_called_once_with(key="watermark", uri="s3://bucket/a")
+    assert result == AssetStateStoreResult(value="2026-01-01")
+    assert dump_opts == {}
+
+
+def test_get_asset_state_store_by_uri_passes_through_error_response(client):
+    err = ErrorResponse(error=ErrorType.ASSET_STORE_NOT_FOUND, detail={"key": "watermark"})
+    client.asset_state_store.get.return_value = err
+
+    result, dump_opts = handle_get_asset_state_store_by_uri(
+        client, GetAssetStateStoreByUri(uri="s3://bucket/a", key="watermark")
+    )
+
+    assert result is err
+    assert dump_opts == {}
+
+
+@pytest.mark.parametrize(
+    ("handler", "msg", "call_kwargs", "method"),
+    [
+        (
+            handle_set_asset_state_store_by_name,
+            SetAssetStateStoreByName,
+            {
+                "name": "asset_a",
+                "key": "watermark",
+                "value": "2026-01-01",
+            },
+            "set",
+        ),
+        (
+            handle_set_asset_state_store_by_uri,
+            SetAssetStateStoreByUri,
+            {
+                "uri": "s3://bucket/a",
+                "key": "watermark",
+                "value": "2026-01-01",
+            },
+            "set",
+        ),
+        (
+            handle_delete_asset_state_store_by_name,
+            DeleteAssetStateStoreByName,
+            {
+                "name": "asset_a",
+                "key": "watermark",
+            },
+            "delete",
+        ),
+        (
+            handle_delete_asset_state_store_by_uri,
+            DeleteAssetStateStoreByUri,
+            {
+                "uri": "s3://bucket/a",
+                "key": "watermark",
+            },
+            "delete",
+        ),
+        (
+            handle_clear_asset_state_store_by_name,
+            ClearAssetStateStoreByName,
+            {
+                "name": "asset_a",
+            },
+            "clear",
+        ),
+        (
+            handle_clear_asset_state_store_by_uri,
+            ClearAssetStateStoreByUri,
+            {
+                "uri": "s3://bucket/a",
+            },
+            "clear",
+        ),
+    ],
+)
+def test_asset_store_delegates_to_client(client, handler, msg, call_kwargs, method):
+    result, dump_opts = handler(client, msg(**call_kwargs))
+
+    getattr(client.asset_state_store, method).assert_called_once_with(**call_kwargs)
+    assert result is None
+    assert dump_opts == {}

From 8f25ac3bd480fb972cb2b265f0c8d35b0e503ef9 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 16:05:48 -0400
Subject: [PATCH 15/29] [v3-3-test] Stabilize testcontainers provider tests on
 slow (ARM) CI runners (#68963) (#69054)

The mongo provider tests boot a real mongo:8.0 container via testcontainers
in the setup phase of the first test that uses the session fixture. That
bring-up -- image pull, container start, readiness ping -- has to fit inside
the per-test pytest setup-timeout (60s). On the GitHub-hosted ARM canary,
where the image cache is cold and registry/disk throughput is lower, the
pull alone can eat most of that budget, so setup times out and cascades into
"ERROR at setup" across every TestMongoHook test. AMD does not hit this
because it runs on every PR with warm caches; ARM only runs on the cron
canary.

Two complementary changes:

- Pre-pull the testcontainers images (mongo:8.0 + ryuk) on the shared host
  daemon before the timed run, but only in CI and only when the owning
  provider's tests are actually in the selection -- so the slow cold-cache
  pull happens outside the per-test setup timeout. Locally it stays a no-op.

- Give pytest setup/teardown timeouts a higher floor (180s) for container-
  backed fixtures, while keeping execution-timeout at the per-test value so
  genuinely hung tests are still caught quickly.
(cherry picked from commit 9b0fe283845e749428f134bd5a53655ea6702783)

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
---
 .../commands/testing_commands.py              | 25 ++++++
 .../src/airflow_breeze/global_constants.py    | 11 +++
 .../src/airflow_breeze/utils/run_tests.py     | 36 ++++++++-
 dev/breeze/tests/test_run_test_args.py        | 79 ++++++++++++++++++-
 4 files changed, 147 insertions(+), 4 deletions(-)

diff --git a/dev/breeze/src/airflow_breeze/commands/testing_commands.py b/dev/breeze/src/airflow_breeze/commands/testing_commands.py
index cc48ee0fb9996..c3c210d9e8c6b 100644
--- a/dev/breeze/src/airflow_breeze/commands/testing_commands.py
+++ b/dev/breeze/src/airflow_breeze/commands/testing_commands.py
@@ -89,6 +89,7 @@
     ALL_TEST_TYPE,
     ALLOWED_KUBERNETES_VERSIONS,
     ALLOWED_TEST_TYPE_CHOICES,
+    TESTCONTAINERS_IMAGES_BY_PROVIDER,
     GroupOfTests,
     all_selective_core_test_types,
     providers_test_type,
@@ -105,6 +106,7 @@
     perform_environment_checks,
     remove_docker_networks,
 )
+from airflow_breeze.utils.environment_check import is_ci_environment
 from airflow_breeze.utils.parallel import (
     GenericRegexpProgressMatcher,
     SummarizeAfter,
@@ -117,6 +119,7 @@
     are_all_test_paths_excluded,
     file_name_from_test_type,
     generate_args_for_pytest,
+    is_provider_selected_in_test_types,
     run_docker_compose_tests,
 )
 from airflow_breeze.utils.run_utils import RunCommandResult, run_command
@@ -429,6 +432,28 @@ def pull_images_for_docker_compose(shell_params: ShellParams):
         "pull",
     ]
     run_command(pull_cmd, output=None, check=False, env=env)
+    pull_testcontainers_images(shell_params)
+
+
+def pull_testcontainers_images(shell_params: ShellParams):
+    """Pre-pull images that specific provider tests start directly via testcontainers.
+
+    These bypass docker compose, so ``docker compose pull`` does not warm them. Only in CI, and only
+    when the owning provider's tests are actually in the run, pull the image on the shared host daemon
+    before the timed run -- keeping the (cold-cache, ARM-slow) pull out of the per-test setup timeout.
+    Locally this is a no-op: testcontainers pulls on demand as usual.
+    """
+    if not is_ci_environment() or shell_params.test_group != GroupOfTests.PROVIDERS:
+        return
+    test_types = shell_params.parallel_test_types_list or (
+        [shell_params.test_type] if shell_params.test_type else []
+    )
+    env = shell_params.env_variables_for_docker_commands
+    for provider_id, images in TESTCONTAINERS_IMAGES_BY_PROVIDER.items():
+        if not is_provider_selected_in_test_types(provider_id, test_types):
+            continue
+        for image in images:
+            run_command(["docker", "pull", image], output=None, check=False, env=env)
 
 
 def run_tests_in_parallel(
diff --git a/dev/breeze/src/airflow_breeze/global_constants.py b/dev/breeze/src/airflow_breeze/global_constants.py
index 4d95234189181..202f98f0fcaa8 100644
--- a/dev/breeze/src/airflow_breeze/global_constants.py
+++ b/dev/breeze/src/airflow_breeze/global_constants.py
@@ -72,6 +72,17 @@
 ALLOWED_BACKENDS = [SQLITE_BACKEND, MYSQL_BACKEND, POSTGRES_BACKEND, NONE_BACKEND, CUSTOM_BACKEND]
 ALLOWED_PROD_BACKENDS = [MYSQL_BACKEND, POSTGRES_BACKEND]
 DEFAULT_BACKEND = ALLOWED_BACKENDS[0]
+# Docker images that specific provider tests pull directly via testcontainers (bypassing docker
+# compose, so the "docker compose pull" pre-pull does not cover them). Keyed by the provider
+# distribution (dotted id) whose tests pull them, so an image is only pre-pulled when that provider's
+# tests are actually in the run. Pre-pulling (in CI only, before the timed run) keeps the pull -- slow
+# on cold caches, notably the GitHub-hosted ARM canary -- out of the per-test setup timeout. Keep the
+# tags in sync with the provider test conftests that use them (currently
+# providers/mongo/tests/conftest.py: MONGO_IMAGE + the testcontainers ryuk reaper).
+TESTCONTAINERS_IMAGES_BY_PROVIDER: dict[str, list[str]] = {
+    "mongo": ["mongo:8.0", "testcontainers/ryuk:0.8.1"],
+}
+
 TESTABLE_CORE_INTEGRATIONS = ["kerberos", "otel", "redis"]
 TESTABLE_PROVIDERS_INTEGRATIONS = [
     "celery",
diff --git a/dev/breeze/src/airflow_breeze/utils/run_tests.py b/dev/breeze/src/airflow_breeze/utils/run_tests.py
index 3bc2a2e0f7b1d..ef87dd1f6e3a7 100644
--- a/dev/breeze/src/airflow_breeze/utils/run_tests.py
+++ b/dev/breeze/src/airflow_breeze/utils/run_tests.py
@@ -62,6 +62,11 @@
     GroupOfTests.PYTHON_API_CLIENT,
 ]
 
+# Floor for pytest setup/teardown timeouts. Container-backed fixtures (testcontainers) pull an image
+# and boot a container during setup; on slower runners this can exceed the regular per-test timeout.
+# Execution-timeout is kept at the per-test value so hung tests are still caught quickly.
+MIN_SETUP_TEARDOWN_TIMEOUT = 180
+
 
 def verify_an_image(
     image_name: str,
@@ -365,6 +370,27 @@ def find_all_other_tests() -> list[str]:
 PROVIDERS_LIST_EXCLUDE_PREFIX = "Providers[-"
 
 
+def is_provider_selected_in_test_types(provider_id: str, test_types: list[str]) -> bool:
+    """Whether a provider's tests are included by any of the given pytest test-type selectors.
+
+    A bare selector such as ``Providers`` (no bracket) runs every provider; ``Providers[a,b]`` runs
+    only the listed ones; ``Providers[-a,b]`` runs all except the listed ones.
+    """
+    for test_type in test_types:
+        if test_type.startswith(PROVIDERS_LIST_EXCLUDE_PREFIX):
+            excluded = test_type[len(PROVIDERS_LIST_EXCLUDE_PREFIX) : -1].split(",")
+            if provider_id not in excluded:
+                return True
+        elif test_type.startswith(PROVIDERS_LIST_PREFIX):
+            included = test_type[len(PROVIDERS_LIST_PREFIX) : -1].split(",")
+            if provider_id in included:
+                return True
+        else:
+            # A non-bracketed selector (e.g. "Providers", "All") runs every provider.
+            return True
+    return False
+
+
 def convert_test_type_to_pytest_args(
     *,
     test_group: GroupOfTests,
@@ -475,6 +501,12 @@ def generate_args_for_pytest(
     integration: tuple | None = None,
 ):
     result_log_file, warnings_file, coverage_file = test_paths(test_type, backend)
+    # Container-backed fixtures (e.g. the testcontainers MongoDB used by provider tests) pull their
+    # image and boot the container in the *setup* phase of the first test that uses them. On slower
+    # runners -- notably the GitHub-hosted ARM canary, where the image cache is cold -- that can exceed
+    # the regular per-test timeout. Give setup/teardown a higher floor so the bring-up fits, while
+    # keeping execution-timeout tight so a genuinely hung test is still caught quickly.
+    setup_teardown_timeout = max(test_timeout, MIN_SETUP_TEARDOWN_TIMEOUT)
     if skip_db_tests and parallel_test_types_list:
         args = convert_parallel_types_to_folders(
             test_group=test_group,
@@ -496,9 +528,9 @@ def generate_args_for_pytest(
             f"--junitxml={result_log_file}",
             # timeouts in seconds for individual tests
             "--timeouts-order=moi",
-            f"--setup-timeout={test_timeout}",
+            f"--setup-timeout={setup_teardown_timeout}",
             f"--execution-timeout={test_timeout}",
-            f"--teardown-timeout={test_timeout}",
+            f"--teardown-timeout={setup_teardown_timeout}",
             "--disable-warnings",
             # Only display summary for non-expected cases
             #
diff --git a/dev/breeze/tests/test_run_test_args.py b/dev/breeze/tests/test_run_test_args.py
index 454787eb74bda..bac6d67288a3a 100644
--- a/dev/breeze/tests/test_run_test_args.py
+++ b/dev/breeze/tests/test_run_test_args.py
@@ -20,8 +20,8 @@
 
 import pytest
 
-from airflow_breeze.commands.testing_commands import _run_test
-from airflow_breeze.global_constants import GroupOfTests
+from airflow_breeze.commands.testing_commands import _run_test, pull_testcontainers_images
+from airflow_breeze.global_constants import TESTCONTAINERS_IMAGES_BY_PROVIDER, GroupOfTests
 from airflow_breeze.params.shell_params import ShellParams
 
 
@@ -152,3 +152,78 @@ def test_none_test_type_with_extra_args_does_not_skip(mock_run_command):
         skip_docker_compose_down=True,
     )
     assert mock_run_command.call_count >= 2  # compose down + compose run
+
+
+@pytest.mark.parametrize(
+    ("test_timeout", "expected_setup_teardown", "expected_execution"),
+    [
+        # Below the floor: setup/teardown are raised to the floor, execution stays tight.
+        (60, 180, 60),
+        # At/above the floor: all three follow the requested per-test timeout.
+        (300, 300, 300),
+    ],
+)
+def test_setup_teardown_timeout_has_minimum_floor(
+    mock_run_command, test_timeout, expected_setup_teardown, expected_execution
+):
+    """Container-backed fixtures boot in the setup phase, so setup/teardown get a higher floor while
+    execution-timeout stays at the per-test value to keep catching hung tests quickly."""
+    _run_test(
+        shell_params=ShellParams(test_group=GroupOfTests.PROVIDERS, test_type="Providers"),
+        extra_pytest_args=(),
+        python_version="3.9",
+        output=None,
+        test_timeout=test_timeout,
+        skip_docker_compose_down=True,
+    )
+    arg_str = " ".join(mock_run_command.call_args_list[1].args[0])
+    assert f"--setup-timeout={expected_setup_teardown}" in arg_str
+    assert f"--teardown-timeout={expected_setup_teardown}" in arg_str
+    assert f"--execution-timeout={expected_execution}" in arg_str
+
+
+@pytest.fixture
+def mock_is_ci_environment():
+    with patch("airflow_breeze.commands.testing_commands.is_ci_environment") as mck:
+        mck.return_value = True
+        yield mck
+
+
+def _pulled_images(mock_run_command):
+    return {
+        call.args[0][-1]
+        for call in mock_run_command.call_args_list
+        if call.args and call.args[0][:2] == ["docker", "pull"]
+    }
+
+
+@pytest.mark.parametrize(
+    ("test_group", "test_types", "expected"),
+    [
+        # mongo provider in the selection -> its testcontainers images are pre-pulled
+        (GroupOfTests.PROVIDERS, ["Providers[mongo]"], set(TESTCONTAINERS_IMAGES_BY_PROVIDER["mongo"])),
+        # a bare "Providers" selector runs every provider -> mongo included
+        (GroupOfTests.PROVIDERS, ["Providers"], set(TESTCONTAINERS_IMAGES_BY_PROVIDER["mongo"])),
+        # mongo excluded by name -> nothing pulled
+        (GroupOfTests.PROVIDERS, ["Providers[mysql,neo4j]"], set()),
+        (GroupOfTests.PROVIDERS, ["Providers[-mongo]"], set()),
+        # not the providers group -> nothing pulled
+        (GroupOfTests.CORE, ["Providers[mongo]"], set()),
+    ],
+    ids=["mongo-listed", "all-providers", "mongo-not-listed", "mongo-excluded", "core-group"],
+)
+def test_pull_testcontainers_images_scoped_to_selected_providers(
+    mock_run_command, mock_is_ci_environment, test_group, test_types, expected
+):
+    """In CI, a provider's testcontainers images are pulled only when that provider is in the run."""
+    pull_testcontainers_images(ShellParams(test_group=test_group, parallel_test_types_list=test_types))
+    assert _pulled_images(mock_run_command) == expected
+
+
+def test_pull_testcontainers_images_noop_outside_ci(mock_run_command, mock_is_ci_environment):
+    """Outside CI it is a no-op -- testcontainers pulls on demand as usual."""
+    mock_is_ci_environment.return_value = False
+    pull_testcontainers_images(
+        ShellParams(test_group=GroupOfTests.PROVIDERS, parallel_test_types_list=["Providers[mongo]"])
+    )
+    assert _pulled_images(mock_run_command) == set()

From 226c44782b467db743aba2cce5fb432f0bd33e15 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 16:06:05 -0400
Subject: [PATCH 16/29] [v3-3-test] Make test_cli_run_time tolerant of
 slow/cold CI runners (#68968) (#69053)

The test asserted the best of 3 "airflow --help" startup samples was under a
tight 5s bound. On a loaded or cold runner (e.g. the Pendulum2 special-test job,
which runs in a freshly rebuilt env) the whole-provider-load startup consistently
sits just over it -- the best of 3 was 5.49s -- even though nothing regressed.

Take the min of more samples and loosen the threshold so the test still guards
against gross startup regressions without flaking on small fluctuations.
(cherry picked from commit b24194f48d991b0b6c892092f07c149cf768a783)

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
---
 airflow-core/tests/unit/cli/test_cli_parser.py | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/airflow-core/tests/unit/cli/test_cli_parser.py b/airflow-core/tests/unit/cli/test_cli_parser.py
index c4d8a95f008ba..acba2fa5d2e26 100644
--- a/airflow-core/tests/unit/cli/test_cli_parser.py
+++ b/airflow-core/tests/unit/cli/test_cli_parser.py
@@ -629,12 +629,14 @@ def test_cli_run_time(self):
 
         # Warm-up run
         subprocess.run(command, env=env, capture_output=True, check=False)
-        # Limit the number of samples otherwise the test will take a very long time
-        num_samples = 3
-        threshold = 5
+        # Take the min across several samples to measure best-case startup and tolerate transient CI
+        # slowness; keep the count bounded so the test does not take a very long time. The threshold is
+        # deliberately loose -- this guards against gross startup regressions, not small fluctuations,
+        # and a tight bound flakes on loaded/cold runners (e.g. the Pendulum2 special-test job).
+        num_samples = 5
+        threshold = 8
         raw_times = timeit.repeat(stmt=timing_code, setup=setup_code, number=1, repeat=num_samples)
         timing_result = min(raw_times)
-        # Minimum run time of Airflow CLI should at least be within 5s
         assert timing_result < threshold
 
     def test_airflow_config_contains_providers(self):

From 715dd0c3b2cd361770feb43fbfc71f0db1bf4df1 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 16:40:46 -0400
Subject: [PATCH 17/29] [v3-3-test] Reduce canary schedule frequency (AMD
 4->2/day, ARM 8->2/day) (#68821) (#69039)

The scheduled canary runs the full matrix on all versions and is by far the most
expensive run type. AMD ran 4x/day and ARM 8x/day; halving AMD alone saves
~1,900 compute-h / 2 weeks (~6% of AMD CI), and cutting ARM 8->2/day removes 75%
of the ARM canary schedule.

The two crons are interleaved (AMD 01:58 & 13:58, ARM 07:28 & 19:28) so a
full-matrix canary still runs roughly every ~6h, alternating architecture - so
the 'trust earned on main' backstop keeps a ~6h effective cadence for
arch-agnostic regressions (12h for arch-specific ones) while the scheduled
compute drops substantially. It also relieves runner-pool queuing, since each
canary is the heaviest job-flood.

check_ci_workflows_in_sync.py expected blocks updated to match.
(cherry picked from commit 5226a1ba7f940fa81d36ed1aafc1e21094168049)

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
---
 .github/workflows/ci-amd.yml                  |  9 +++++----
 .github/workflows/ci-arm.yml                  |  6 +++++-
 scripts/ci/prek/check_ci_workflows_in_sync.py | 15 ++++++++++-----
 3 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci-amd.yml b/.github/workflows/ci-amd.yml
index 722f2cd09758a..a1e07e1f16c15 100644
--- a/.github/workflows/ci-amd.yml
+++ b/.github/workflows/ci-amd.yml
@@ -26,10 +26,11 @@
 name: Tests (AMD)
 on:  # yamllint disable-line rule:truthy
   schedule:
-    # Mirror of the previous AMD canary cron from before the AMD/ARM split (PR #66348),
-    # offset by 30 min from ARM's `:28` slot in `ci-arm.yml` so the two scheduled
-    # canaries don't compete for runners at exactly the same minute.
-    - cron: '58 1,7,13,19 * * *'
+    # AMD canary runs 2x/day (01:58, 13:58), interleaved with ARM's 2x/day (07:28, 19:28)
+    # in `ci-arm.yml` so a full-matrix canary still runs roughly every ~6h (alternating
+    # architecture) while halving the scheduled AMD compute. The `:58` vs ARM's `:28`
+    # offset keeps the two from competing for runners at exactly the same minute.
+    - cron: '58 1,13 * * *'
   pull_request:
     branches:
       - main
diff --git a/.github/workflows/ci-arm.yml b/.github/workflows/ci-arm.yml
index b3a05486fe2c6..71847cc44b5c7 100644
--- a/.github/workflows/ci-arm.yml
+++ b/.github/workflows/ci-arm.yml
@@ -26,7 +26,11 @@
 name: Tests (ARM)
 on:  # yamllint disable-line rule:truthy
   schedule:
-    - cron: '28 1,3,7,9,13,15,19,21 * * *'
+    # ARM canary runs 2x/day (07:28, 19:28), interleaved with AMD's 2x/day (01:58, 13:58)
+    # in `ci-amd.yml` so a full-matrix canary still runs roughly every ~6h (alternating
+    # architecture). The `:28` vs AMD's `:58` offset keeps the two from competing for
+    # runners at exactly the same minute.
+    - cron: '28 7,19 * * *'
   push:
     # Post-merge pushes to release-prep / providers branches run on both
     # AMD and ARM (the matching block lives in the other wrapper too —
diff --git a/scripts/ci/prek/check_ci_workflows_in_sync.py b/scripts/ci/prek/check_ci_workflows_in_sync.py
index b64600cd16576..d6116d856b8bf 100755
--- a/scripts/ci/prek/check_ci_workflows_in_sync.py
+++ b/scripts/ci/prek/check_ci_workflows_in_sync.py
@@ -107,14 +107,19 @@
 # file and must NOT appear in the other. The blocks are stripped before
 # diffing so they don't show up as drift.
 ARM_ONLY_BLOCK = """  schedule:
-    - cron: '28 1,3,7,9,13,15,19,21 * * *'
+    # ARM canary runs 2x/day (07:28, 19:28), interleaved with AMD's 2x/day (01:58, 13:58)
+    # in `ci-amd.yml` so a full-matrix canary still runs roughly every ~6h (alternating
+    # architecture). The `:28` vs AMD's `:58` offset keeps the two from competing for
+    # runners at exactly the same minute.
+    - cron: '28 7,19 * * *'
 """
 
 AMD_ONLY_BLOCK = """  schedule:
-    # Mirror of the previous AMD canary cron from before the AMD/ARM split (PR #66348),
-    # offset by 30 min from ARM's `:28` slot in `ci-arm.yml` so the two scheduled
-    # canaries don't compete for runners at exactly the same minute.
-    - cron: '58 1,7,13,19 * * *'
+    # AMD canary runs 2x/day (01:58, 13:58), interleaved with ARM's 2x/day (07:28, 19:28)
+    # in `ci-arm.yml` so a full-matrix canary still runs roughly every ~6h (alternating
+    # architecture) while halving the scheduled AMD compute. The `:58` vs ARM's `:28`
+    # offset keeps the two from competing for runners at exactly the same minute.
+    - cron: '58 1,13 * * *'
   pull_request:
     branches:
       - main

From 9f5e0da848a6872894a0353645903f2f7be63fef Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 16:41:21 -0400
Subject: [PATCH 18/29] [v3-3-test] Remove stale `dag_` parameter from
 create_test_pipeline docstring (#68787) (#69013)

(cherry picked from commit 473e33259cdc54d5c9ecdd1d4e010e4f9e857e08)

Co-authored-by: Kenan Adel <kenanadel153@gmail.com>
---
 airflow-core/src/airflow/example_dags/example_skip_dag.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/airflow-core/src/airflow/example_dags/example_skip_dag.py b/airflow-core/src/airflow/example_dags/example_skip_dag.py
index a2fe914c0356d..f5eed85f2de17 100644
--- a/airflow-core/src/airflow/example_dags/example_skip_dag.py
+++ b/airflow-core/src/airflow/example_dags/example_skip_dag.py
@@ -48,7 +48,6 @@ def create_test_pipeline(suffix, trigger_rule):
 
     :param str suffix: Suffix to append to the operator task_ids
     :param str trigger_rule: TriggerRule for the join task
-    :param DAG dag_: The DAG to run the operators on
     """
     skip_operator = EmptySkipOperator(task_id=f"skip_operator_{suffix}")
     always_true = EmptyOperator(task_id=f"always_true_{suffix}")

From af73b586f5325ce9cfe10cffd57102784563f292 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 16:41:43 -0400
Subject: [PATCH 19/29] [v3-3-test] Exclude non-successful runs from
 AVERAGE_RUNTIME deadline calculation (#68647) (#68949)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

DeadlineReference.AVERAGE_RUNTIME computes a deadline from the average duration of
past DAG runs, but the query filtered only on dag_id + start/end-date present — with
no DagRun.state filter. Failed runs (which may have died fast or hung before failing)
were folded into the average, skewing the computed deadline: a fast-failing history
makes it too short (spurious misses), a slow-then-failed history makes it too long
(real slowness never trips it).

Filter the duration query to successful runs only. Add tests asserting failed runs
are excluded from the average and that the deadline is skipped when too few
successful runs exist.

---------
(cherry picked from commit 88e61106fdc468ac7f2c922e077906fc7d3fa283)

Co-authored-by: Sean Ghaeli <58916776+seanghaeli@users.noreply.github.com>
Co-authored-by: Sean Ghaeli <ghaeli@amazon.com>
Co-authored-by: Ramit Kataria <ramitkat@amazon.com>
---
 airflow-core/docs/howto/deadline-alerts.rst   |  6 +-
 .../serialization/definitions/deadline.py     | 11 +++-
 .../tests/unit/models/test_deadline.py        | 65 +++++++++++++++++++
 3 files changed, 78 insertions(+), 4 deletions(-)

diff --git a/airflow-core/docs/howto/deadline-alerts.rst b/airflow-core/docs/howto/deadline-alerts.rst
index e36908009a0f1..8e729516fefcb 100644
--- a/airflow-core/docs/howto/deadline-alerts.rst
+++ b/airflow-core/docs/howto/deadline-alerts.rst
@@ -110,14 +110,14 @@ Airflow provides several built-in reference points that you can use with Deadlin
     Specifies a fixed point in time. Useful when Dags must complete by a specific time.
 
 ``DeadlineReference.AVERAGE_RUNTIME``
-    Calculates deadlines based on the average runtime of previous Dag runs. This reference
+    Calculates deadlines based on the average runtime of previous successful Dag runs. This reference
     analyzes historical execution data to predict when the current run should complete.
     The deadline is set to the current time plus the calculated average runtime plus the interval.
     If insufficient historical data exists, no deadline is created.
 
     Parameters:
-        * ``max_runs`` (int, optional): Maximum number of recent Dag runs to analyze. Defaults to 10.
-        * ``min_runs`` (int, optional): Minimum number of completed runs required to calculate average. Defaults to same value as ``max_runs``.
+        * ``max_runs`` (int, optional): Maximum number of successful recent Dag runs to analyze. Defaults to 10.
+        * ``min_runs`` (int, optional): Minimum number of successful recent Dag runs required to calculate average. Defaults to same value as ``max_runs``.
 
     Example usage:
 
diff --git a/airflow-core/src/airflow/serialization/definitions/deadline.py b/airflow-core/src/airflow/serialization/definitions/deadline.py
index 89e231cba24dc..20fac2b54e874 100644
--- a/airflow-core/src/airflow/serialization/definitions/deadline.py
+++ b/airflow-core/src/airflow/serialization/definitions/deadline.py
@@ -207,6 +207,7 @@ def _evaluate_with(self, *, session: Session, **kwargs: Any) -> datetime | None:
             from sqlalchemy import func, select, text
 
             from airflow.models import DagRun
+            from airflow.utils.state import DagRunState
 
             dag_id = kwargs["dag_id"]
 
@@ -222,9 +223,17 @@ def _evaluate_with(self, *, session: Session, **kwargs: Any) -> datetime | None:
             else:
                 raise ValueError(f"Unsupported database dialect: {dialect}")
 
+            # Only SUCCESSFUL runs represent a "normal" runtime. A run that failed fast or hung
+            # before failing would otherwise skew the average and produce a misleading deadline
+            # (too short -> spurious misses, or too long -> real slowness never trips it).
             query = (
                 select(duration_expr)
-                .filter(DagRun.dag_id == dag_id, DagRun.start_date.isnot(None), DagRun.end_date.isnot(None))
+                .filter(
+                    DagRun.dag_id == dag_id,
+                    DagRun.state == DagRunState.SUCCESS,
+                    DagRun.start_date.isnot(None),
+                    DagRun.end_date.isnot(None),
+                )
                 .order_by(DagRun.logical_date.desc())
                 .limit(self.max_runs)
             )
diff --git a/airflow-core/tests/unit/models/test_deadline.py b/airflow-core/tests/unit/models/test_deadline.py
index 3635bcadcbea5..4fc1aada1cc02 100644
--- a/airflow-core/tests/unit/models/test_deadline.py
+++ b/airflow-core/tests/unit/models/test_deadline.py
@@ -519,6 +519,71 @@ def test_average_runtime_min_runs_validation(self):
         with pytest.raises(ValueError, match="min_runs must be at least 1"):
             DeadlineReference.AVERAGE_RUNTIME(max_runs=10, min_runs=-1)
 
+    def test_average_runtime_excludes_non_successful_runs(self, session, dag_maker):
+        """Only SUCCESSFUL runs contribute to the average; FAILED runs must be ignored.
+
+        A failed run's duration is not representative of a normal runtime, so including it
+        would skew the computed deadline. Seed an equal mix of fast-successful and
+        slow-failed runs and assert the average reflects only the successful ones.
+        """
+        with dag_maker(DAG_ID):
+            EmptyOperator(task_id="test_task")
+
+        base_time = DEFAULT_DATE
+        success_duration = 60  # the only durations that should count
+        failed_duration = 36000  # 10h — would massively skew the average if (wrongly) counted
+
+        # Interleave 3 successful (60s) and 3 failed (36000s) runs.
+        specs = [
+            (DagRunState.SUCCESS, success_duration),
+            (DagRunState.FAILED, failed_duration),
+            (DagRunState.SUCCESS, success_duration),
+            (DagRunState.FAILED, failed_duration),
+            (DagRunState.SUCCESS, success_duration),
+            (DagRunState.FAILED, failed_duration),
+        ]
+        for i, (state, duration) in enumerate(specs):
+            logical_date = base_time + timedelta(days=i)
+            start_time = logical_date + timedelta(minutes=5)
+            dagrun = dag_maker.create_dagrun(logical_date=logical_date, run_id=f"mix_run_{i}", state=state)
+            dagrun.start_date = start_time
+            dagrun.end_date = start_time + timedelta(seconds=duration)
+
+        session.commit()
+
+        # min_runs=3 so the 3 successful runs alone satisfy the minimum.
+        reference = SerializedReferenceModels.AverageRuntimeDeadline(max_runs=10, min_runs=3)
+        interval = timedelta(hours=1)
+
+        with mock.patch("airflow._shared.timezones.timezone.utcnow") as mock_utcnow:
+            mock_utcnow.return_value = DEFAULT_DATE
+            result = reference.evaluate_with(session=session, interval=interval, dag_id=DAG_ID)
+
+        # Average must be over the 3 successful 60s runs only (not the 36000s failures).
+        expected = DEFAULT_DATE + timedelta(seconds=success_duration) + interval
+        assert result.replace(second=0, microsecond=0) == expected.replace(second=0, microsecond=0)
+
+    def test_average_runtime_skips_when_too_few_successful_runs(self, session, dag_maker):
+        """If only FAILED runs exist (fewer than min_runs successful), no deadline is created."""
+        with dag_maker(DAG_ID):
+            EmptyOperator(task_id="test_task")
+
+        base_time = DEFAULT_DATE
+        for i in range(5):
+            logical_date = base_time + timedelta(days=i)
+            start_time = logical_date + timedelta(minutes=5)
+            dagrun = dag_maker.create_dagrun(
+                logical_date=logical_date, run_id=f"failed_run_{i}", state=DagRunState.FAILED
+            )
+            dagrun.start_date = start_time
+            dagrun.end_date = start_time + timedelta(seconds=3600)
+
+        session.commit()
+
+        reference = SerializedReferenceModels.AverageRuntimeDeadline(max_runs=10, min_runs=3)
+        result = reference.evaluate_with(session=session, interval=timedelta(hours=1), dag_id=DAG_ID)
+        assert result is None
+
 
 class TestDeadlineReference:
     """DeadlineReference lives in definitions/deadlines.py but properly testing them requires DB access."""

From c2b9615602ea9a5adbe566ebbc1fc54a70e44a7d Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 26 Jun 2026 16:42:44 -0400
Subject: [PATCH 20/29] [v3-3-test] Fix scheduled CI upgrade failing when its
 PR already exists (#69018) (#69055)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The scheduled "breeze ci upgrade" job force-pushes a stable branch
(ci-upgrade-<branch>) and then looks for an existing PR before creating
one. The lookup passed the "owner:branch" head label to "gh pr list
--head", but that flag filters by the bare branch name only and does not
support the "owner:branch" syntax, so the existing PR was never found and
the job fell through to "gh pr create" — which rejected the duplicate and
failed the run.

Use the bare branch name for the "gh pr list" and "gh pr ready" lookups
(only "gh pr create --head" needs the cross-fork "owner:branch" label),
and treat an "already exists" creation error as success since the branch
has already been force-pushed.
(cherry picked from commit 419ac06e8ac3dec8bd80716bde915b5f166623a8)

Co-authored-by: Shahar Epstein <60007259+shahar1@users.noreply.github.com>
---
 .../airflow_breeze/commands/ci_commands.py    | 21 ++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/dev/breeze/src/airflow_breeze/commands/ci_commands.py b/dev/breeze/src/airflow_breeze/commands/ci_commands.py
index 46c1588827dc6..686def2fc0b8c 100644
--- a/dev/breeze/src/airflow_breeze/commands/ci_commands.py
+++ b/dev/breeze/src/airflow_breeze/commands/ci_commands.py
@@ -906,7 +906,9 @@ def upgrade(
         pr_title = f"[{target_branch}] Upgrade important CI environment"
         pr_body = "This PR upgrades important dependencies of the CI environment."
 
-        # Check if there's already an open PR for this branch
+        # Check if there's already an open PR for this branch.
+        # gh pr list / gh pr ready filter by the bare head-branch name, not the
+        # "owner:branch" label that gh pr create needs for cross-fork PRs.
         existing_pr_result = run_command(
             [
                 "gh",
@@ -915,7 +917,7 @@ def upgrade(
                 "--repo",
                 "apache/airflow",
                 "--head",
-                head_ref,
+                branch_name,
                 "--base",
                 target_branch,
                 "--state",
@@ -945,7 +947,7 @@ def upgrade(
                         "--repo",
                         "apache/airflow",
                         "--undo",
-                        head_ref,
+                        branch_name,
                     ],
                     capture_output=True,
                     text=True,
@@ -981,10 +983,15 @@ def upgrade(
                 env=command_env,
             )
             if pr_result.returncode != 0:
-                console_print(f"[error]Failed to create PR:\n{pr_result.stdout}\n{pr_result.stderr}[/]")
-                sys.exit(1)
-            pr_url = pr_result.stdout.strip() if pr_result.returncode == 0 else ""
-            console_print(f"[success]PR created successfully: {pr_url}.[/]")
+                # The branch was already force-pushed, so an existing PR is already
+                # up to date — treat a duplicate as success rather than failing the run.
+                if "already exists" in pr_result.stderr:
+                    console_print(f"[success]PR already exists for {head_ref}, updated with force push.[/]")
+                else:
+                    console_print(f"[error]Failed to create PR:\n{pr_result.stdout}\n{pr_result.stderr}[/]")
+                    sys.exit(1)
+            else:
+                console_print(f"[success]PR created successfully: {pr_result.stdout.strip()}.[/]")
 
         # Switch back to appropriate branch and delete the temporary branch
         console_print(f"[info]Cleaning up temporary branch {branch_name}...[/]")

From a54d73007aff0825c3941c063e75f071aca715a3 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sun, 28 Jun 2026 19:34:34 +0530
Subject: [PATCH 21/29] [v3-3-test] Document that Dag bundle kwargs should
 reference a Connection, not inline credentials (#68373) (#69105)

* Document that Dag bundle kwargs should reference a Connection, not inline credentials

Generated-by: Claude Opus 4.8 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions

* Fix docs spelling: reword 'inlined' (sphinx spellcheck)
(cherry picked from commit 8c74f8e99dbe0ade70354644aa1a1f0b017f2e1e)


Generated-by: Claude Opus 4.8 (1M context)

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
---
 .../dag-bundles.rst                            | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/airflow-core/docs/administration-and-deployment/dag-bundles.rst b/airflow-core/docs/administration-and-deployment/dag-bundles.rst
index 7e1eaf0123b20..354e6ecda1626 100644
--- a/airflow-core/docs/administration-and-deployment/dag-bundles.rst
+++ b/airflow-core/docs/administration-and-deployment/dag-bundles.rst
@@ -61,6 +61,24 @@ Configuring Dag bundles
 
 Dag bundles are configured in :ref:`config:dag_processor__dag_bundle_config_list`. You can add one or more Dag bundles here.
 
+.. warning:: Reference credentials through a Connection — do not inline them
+
+    Bundle ``kwargs`` are stored in the ``[dag_processor] dag_bundle_config_list``
+    configuration, which Airflow exposes through the Config API when
+    :ref:`config:api__expose_config` is enabled. Any user authorized to read the
+    configuration can read these values verbatim, so they must not contain secrets.
+
+    Do **not** embed credentials directly in bundle ``kwargs`` — for example a
+    token placed directly in a ``repo_url`` like
+    ``https://x-access-token:<token>@github.com/org/repo.git``. Instead reference
+    an Airflow :doc:`Connection <../authoring-and-scheduling/connections>`
+    (``git_conn_id`` for Git, ``aws_conn_id`` for S3, ``gcp_conn_id`` for GCS) and
+    keep the credential in your
+    :doc:`secrets backend <../security/secrets/secrets-backend/index>`. Connection
+    fields are resolved at runtime and are not written into
+    ``dag_bundle_config_list``.
+
+
 By default, Airflow adds a ``LocalDagBundle`` pointing at the configured Dags folder, maintaining the same behaviour as Airflow 2's Dags folder. The only kwarg is ``path``, which defaults to the value of :ref:`config:core__dags_folder` when omitted:
 
 .. code-block:: ini

From 1fd5c9049518d03af909e9f4d11e17369bc95ea3 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sun, 28 Jun 2026 19:37:08 +0530
Subject: [PATCH 22/29] [v3-3-test] Add code owners for coordinators (#69098)
 (#69101)

(cherry picked from commit 0f3161ef28b5f4d2ec977810a0d18b6a0e75576c)

Co-authored-by: Tzu-ping Chung <uranusjr@gmail.com>
---
 .github/CODEOWNERS | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 11887935420f3..6b0836ce2b909 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -162,6 +162,10 @@ Dockerfile.ci @potiuk @ashb @gopidesupavan @amoghrajesh @jscheffl @bugraoz93 @ja
 # Python SDK
 /task-sdk/ @ashb @kaxil @amoghrajesh
 
+# AIP-108 - Coordinators
+/task-sdk/src/airflow/sdk/coordinators/ @jason810496 @uranusjr
+/task-sdk/src/airflow/sdk/execution_time/coordinator.py @jason810496 @uranusjr
+
 # Golang SDK
 /go-sdk/ @ashb @amoghrajesh @jason810496
 

From 50f1a5bacb8c610a05bc1d4a472aa2edda883efb Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sun, 28 Jun 2026 19:37:22 +0530
Subject: [PATCH 23/29] [v3-3-test] Remove dependabot updates for the
 v2-11-test branch (#69061) (#69066)

Airflow 2.11 has reached end of life, so dependabot no longer needs to raise
dependency-update PRs against v2-11-test. Drop the three update blocks targeting
that branch (github-actions, pip, npm) and their "2.11 branch as well" section.
The v3-3-test and main update blocks are unchanged.
(cherry picked from commit a3415620fe5d4123cc32bcdf0438c59e469485be)

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
---
 .github/dependabot.yml | 46 ------------------------------------------
 1 file changed, 46 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 68a622477fc6a..f0337bb052b80 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -42,19 +42,6 @@ updates:
         patterns:
           - "*"
 
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    cooldown:
-      default-days: 4
-    schedule:
-      # Check for updates to GitHub Actions every week
-      interval: "weekly"
-    target-branch: v2-11-test
-    groups:
-      github-actions-updates:
-        patterns:
-          - "*"
-
   - package-ecosystem: pip
     cooldown:
       default-days: 4
@@ -260,39 +247,6 @@ updates:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
 
-  # Repeat dependency updates on 2.11 branch as well
-  - package-ecosystem: pip
-    cooldown:
-      default-days: 4
-    directories:
-      - /clients/python
-      - /dev/breeze
-      - /docker_tests
-      - /
-    schedule:
-      interval: "weekly"
-    target-branch: v2-11-test
-    groups:
-      pip-dependency-updates:
-        patterns:
-          - "*"
-
-  - package-ecosystem: npm
-    cooldown:
-      default-days: 4
-    directories:
-      - /airflow/www/
-    schedule:
-      interval: "weekly"
-    target-branch: v2-11-test
-    groups:
-      legacy-ui-package-updates:
-        patterns:
-          - "*"
-    ignore:
-      - dependency-name: "*"
-        update-types: ["version-update:semver-major"]
-
   - package-ecosystem: "uv"
     cooldown:
       default-days: 4

From 2a6d16c46cfd7f11e6c4beed608f929214a1da6d Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sun, 28 Jun 2026 23:18:04 +0300
Subject: [PATCH 24/29] [v3-3-test] Make airflow dags test wait for
 Human-in-the-loop input instead of hanging (#68492) (#69104)

* Make airflow dags test wait for Human-in-the-loop input instead of hanging

Previously a HITL task that parked in awaiting_input made `airflow dags
test` loop "No tasks to run. unrunnable tasks: ..." once per second
forever, with no way to make progress (the in-process runner also
swallows SIGTERM, so even `timeout` could not stop it).

dag.test() now treats parked HITL tasks as waiting rather than
unrunnable, and never resolves them itself: the run stays alive, logging
which tasks await input, until a response recorded from outside flips
them back to SCHEDULED -- at which point the existing loop resumes them.
This matches how a parked task behaves on a real deployment, and the
existing response channels work unchanged: the Required Actions UI or
the HITL REST API (PATCH .../hitlDetails) of an api-server sharing the
metadata database (e.g. airflow standalone). Humans and AI agents can
drive HITL pipelines locally by running dags test and submitting the
response through that API.

Interactive console prompting in the dags test CLI is left for a
follow-up.

* Document the HITL REST API calls for responding during dags test
(cherry picked from commit 63cee22e9be3e1901b9002dc6be58198ed09eef1)

Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com>
Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>
---
 airflow-core/docs/tutorial/hitl.rst         |  31 ++++++
 airflow-core/tests/unit/models/test_dag.py  | 101 ++++++++++++++++++++
 task-sdk/src/airflow/sdk/definitions/dag.py |  19 +++-
 3 files changed, 149 insertions(+), 2 deletions(-)

diff --git a/airflow-core/docs/tutorial/hitl.rst b/airflow-core/docs/tutorial/hitl.rst
index 8e89b49d88de4..aea843486f404 100644
--- a/airflow-core/docs/tutorial/hitl.rst
+++ b/airflow-core/docs/tutorial/hitl.rst
@@ -196,6 +196,37 @@ When the operator creates an HITL request that is waiting for a human response,
    :end-before: [END howto_hitl_entry_operator]
 
 
+Testing HITL Dags locally
+-------------------------
+
+``airflow dags test`` (and the underlying ``dag.test()``) supports HITL tasks. A task that reaches
+the ``awaiting_input`` state stays parked -- the test run never resolves it itself -- and the run
+waits, logging which tasks await input, until a response is recorded from outside. The response
+goes through the same channels as on a real deployment: the Required Actions page or the HITL REST
+API (``PATCH .../hitlDetails``) of an api-server sharing the metadata database (for example
+``airflow standalone``, or a separately started ``airflow api-server``). Once the response lands,
+the test run resumes the task and continues with downstream tasks.
+
+This also lets AI agents drive a HITL pipeline end-to-end locally: run ``airflow dags test``, watch
+for the waiting log line, ask the human, and submit their answer through the HITL REST API. The two
+calls involved (``~`` works as a wildcard for ``dag_id`` and ``dag_run_id``):
+
+.. code-block:: text
+
+    # Discover pending requests (subject, options, params, run/task identifiers)
+    GET /api/v2/dags/~/dagRuns/~/hitlDetails?response_received=false
+
+    # Submit the response; the test run resumes the task on its next poll.
+    # map_index is -1 for non-mapped tasks.
+    PATCH /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances/{task_id}/{map_index}/hitlDetails
+    {"chosen_options": ["Approve"], "params_input": {}}
+
+.. note::
+
+    ``response_timeout`` and timeout defaults are enforced by the scheduler, which does not run
+    under ``airflow dags test``. A parked task therefore waits indefinitely for a response; supply
+    one through the UI or REST API to let the run finish.
+
 Benefits and Common Use Cases
 -----------------------------
 
diff --git a/airflow-core/tests/unit/models/test_dag.py b/airflow-core/tests/unit/models/test_dag.py
index ad4ed2c134d13..81198d8e41810 100644
--- a/airflow-core/tests/unit/models/test_dag.py
+++ b/airflow-core/tests/unit/models/test_dag.py
@@ -22,6 +22,7 @@
 import os
 import pickle
 import re
+import time
 from contextlib import nullcontext
 from datetime import timedelta
 from pathlib import Path
@@ -62,8 +63,10 @@
 from airflow.models.dagbundle import DagBundleModel
 from airflow.models.dagrun import DagRun
 from airflow.models.deadline_alert import DeadlineAlert as DeadlineAlertModel
+from airflow.models.hitl import HITLDetail
 from airflow.models.serialized_dag import SerializedDagModel
 from airflow.models.taskinstance import TaskInstance as TI
+from airflow.models.trigger import handle_event_submit
 from airflow.providers.standard.operators.bash import BashOperator
 from airflow.providers.standard.operators.empty import EmptyOperator
 from airflow.providers.standard.operators.python import PythonOperator
@@ -83,6 +86,8 @@
 from airflow.sdk.definitions.callback import AsyncCallback
 from airflow.sdk.definitions.deadline import DeadlineAlert, DeadlineReference
 from airflow.sdk.definitions.param import Param
+from airflow.sdk.exceptions import TaskAwaitingInput
+from airflow.sdk.execution_time.hitl import upsert_hitl_detail
 from airflow.serialization.definitions.dag import SerializedDAG
 from airflow.serialization.encoders import coerce_to_core_timetable
 from airflow.serialization.serialized_objects import LazyDeserializedDAG
@@ -93,6 +98,7 @@
     NullTimetable,
     OnceTimetable,
 )
+from airflow.triggers.base import TriggerEvent
 from airflow.utils.file import list_py_file_paths
 from airflow.utils.session import create_session
 from airflow.utils.state import DagRunState, State, TaskInstanceState
@@ -1826,6 +1832,101 @@ def check_task_2(my_input):
         mock_task_object_1.assert_called()
         mock_task_object_2.assert_not_called()
 
+    @staticmethod
+    def _make_awaiting_input_dag(dag_id, resume_calls):
+        """Build a Dag whose single task parks in AWAITING_INPUT (Human-in-the-loop)."""
+
+        class AskOperator(BaseOperator):
+            def execute(self, context):
+                upsert_hitl_detail(
+                    ti_id=context["task_instance"].id,
+                    options=["Approve", "Reject"],
+                    subject="Deploy?",
+                    multiple=False,
+                    params={},
+                )
+                raise TaskAwaitingInput(method_name="execute_complete")
+
+            def execute_complete(self, context, event):
+                resume_calls.append((event["chosen_options"], event["params_input"]))
+                return event["chosen_options"]
+
+        dag = DAG(dag_id=dag_id, schedule=None, start_date=DEFAULT_DATE)
+        with dag:
+            AskOperator(task_id="ask")
+        sync_dag_to_db(dag)
+        return dag
+
+    @pytest.mark.execution_timeout(60)
+    def test_dag_test_hitl_task_stays_parked_until_external_response(
+        self, testing_dag_bundle, monkeypatch, caplog
+    ):
+        """
+        The dag.test() contract for Human-in-the-loop: a task that parks in AWAITING_INPUT is
+        never resolved by dag.test() itself. The run waits until a response recorded from
+        outside (here through an independent session, the way the API response handler does)
+        flips it back to SCHEDULED, at which point the loop resumes it.
+
+        The loop's time.sleep is the synchronization point: patching it to deliver the
+        external response keeps the test deterministic, with no real-time waits.
+        """
+        resume_calls: list = []
+        dag = self._make_awaiting_input_dag("test_dag_test_hitl_external", resume_calls)
+
+        parked_states_seen = []
+        spins = 0
+
+        def deliver_external_response():
+            """Record an Approve through an independent session, as the API handler would."""
+            with create_session(scoped=False) as external_session:
+                parked_ti = external_session.scalar(
+                    select(TI).where(
+                        TI.dag_id == "test_dag_test_hitl_external",
+                        TI.task_id == "ask",
+                        TI.state == TaskInstanceState.AWAITING_INPUT,
+                    )
+                )
+                if parked_ti is None:
+                    return
+                parked_states_seen.append(parked_ti.state)
+                detail = external_session.get(HITLDetail, parked_ti.id)
+                detail.chosen_options = ["Approve"]
+                detail.params_input = {}
+                detail.responded_at = timezone.utcnow()
+                detail.responded_by = {"id": "external", "name": "external"}
+                external_session.add(detail)
+                handle_event_submit(
+                    TriggerEvent(detail.as_resume_event_payload()),
+                    task_instance=parked_ti,
+                    session=external_session,
+                )
+
+        def respond_once_waiting(seconds):
+            # Replaces the loop's real sleep to keep the test fast, and delivers the response
+            # only once dag.test() has logged that it is parked on the HITL task -- so the
+            # assertions below prove the task resumed through the new awaiting_input branch
+            # rather than any other path.
+            nonlocal spins
+            spins += 1
+            assert spins < 50, "dag.test() never logged that it was waiting on the parked task"
+            if "Waiting for Human-in-the-loop input" in caplog.text:
+                deliver_external_response()
+
+        monkeypatch.setattr(time, "sleep", respond_once_waiting)
+
+        with caplog.at_level(logging.INFO, logger="airflow.sdk.definitions.dag"):
+            dr = dag.test()
+
+        # The task must take the new "waiting for input" branch, not the old "unrunnable" one.
+        assert "Waiting for Human-in-the-loop input" in caplog.text
+        assert "No tasks to run" not in caplog.text
+
+        ti = dr.get_task_instance("ask")
+        assert ti is not None
+        assert ti.state == TaskInstanceState.SUCCESS
+        assert parked_states_seen == [TaskInstanceState.AWAITING_INPUT]
+        assert resume_calls == [(["Approve"], {})]
+
     def test_dag_connection_file(self, tmp_path, testing_dag_bundle):
         test_connections_string = """
 ---
diff --git a/task-sdk/src/airflow/sdk/definitions/dag.py b/task-sdk/src/airflow/sdk/definitions/dag.py
index 46794edbe4a68..42924fb6aaec8 100644
--- a/task-sdk/src/airflow/sdk/definitions/dag.py
+++ b/task-sdk/src/airflow/sdk/definitions/dag.py
@@ -1404,8 +1404,23 @@ def test(
                 # triggerer may mark tasks scheduled so we read from DB
                 all_tis = set(dr.get_task_instances(session=session))
                 scheduled_tis = {x for x in all_tis if x.state == TaskInstanceState.SCHEDULED}
-                ids_unrunnable = {x for x in all_tis if x.state not in FINISHED_STATES} - scheduled_tis
-                if not scheduled_tis and ids_unrunnable:
+                awaiting_input_tis = {x for x in all_tis if x.state == TaskInstanceState.AWAITING_INPUT}
+                ids_unrunnable = (
+                    {x for x in all_tis if x.state not in FINISHED_STATES}
+                    - scheduled_tis
+                    - awaiting_input_tis
+                )
+                if not scheduled_tis and awaiting_input_tis:
+                    # Human-in-the-loop tasks stay parked in AWAITING_INPUT: dag.test() never
+                    # resolves them itself. Keep the run alive until a response recorded from
+                    # outside -- the Required Actions UI or the HITL REST API of an api-server
+                    # sharing this metadata DB -- flips them back to SCHEDULED.
+                    log.info(
+                        "Waiting for Human-in-the-loop input for tasks: %s",
+                        sorted(x.task_id for x in awaiting_input_tis),
+                    )
+                    time.sleep(1)
+                elif not scheduled_tis and ids_unrunnable:
                     log.warning("No tasks to run. unrunnable tasks: %s", ids_unrunnable)
                     time.sleep(1)
 

From 2141a7b746dbf2313a738291e9589ae29aaa021c Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 08:42:02 +0530
Subject: [PATCH 25/29] [v3-3-test] Move known_airflow_exceptions.txt out of
 scripts/ into generated/ (#69057) (#69060)

The check-no-new-airflow-exceptions hook keeps its allowlist baseline in
scripts/ci/prek/known_airflow_exceptions.txt. That file is touched by any PR
that legitimately adds, removes, or moves a raise AirflowException -- typically
provider or core changes that have nothing to do with dev tooling. Because it
lived under scripts/, boring-cyborg matched it against the scripts/**/* glob and
auto-applied area:dev-tools and, worse, backport-to-v3-3-test, triggering wrong
automated backports of unrelated provider PRs.

Move the generated allowlist to generated/known_airflow_exceptions.txt, which no
boring-cyborg rule matches, so editing it no longer looks like a dev-tools change.
The hook script reads/writes it from the repo-root generated/ directory; .txt
files carry no license header, so nothing else changes.
(cherry picked from commit 78263d0c538ab489005b6ea1f104051a44fe60af)

Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>
---
 .../ci/prek => generated}/known_airflow_exceptions.txt |  0
 scripts/ci/prek/check_new_airflow_exception_usage.py   | 10 +++++-----
 2 files changed, 5 insertions(+), 5 deletions(-)
 rename {scripts/ci/prek => generated}/known_airflow_exceptions.txt (100%)

diff --git a/scripts/ci/prek/known_airflow_exceptions.txt b/generated/known_airflow_exceptions.txt
similarity index 100%
rename from scripts/ci/prek/known_airflow_exceptions.txt
rename to generated/known_airflow_exceptions.txt
diff --git a/scripts/ci/prek/check_new_airflow_exception_usage.py b/scripts/ci/prek/check_new_airflow_exception_usage.py
index 88132824558b2..6ba97db865e50 100755
--- a/scripts/ci/prek/check_new_airflow_exception_usage.py
+++ b/scripts/ci/prek/check_new_airflow_exception_usage.py
@@ -23,8 +23,8 @@
 # ///
 """Check that no new ``raise AirflowException`` usages are introduced.
 
-All *existing* usages are recorded in ``known_airflow_exceptions.txt`` next to
-this script as ``relative/path::N`` entries (one per file), where ``N`` is the
+All *existing* usages are recorded in ``generated/known_airflow_exceptions.txt``
+as ``relative/path::N`` entries (one per file), where ``N`` is the
 maximum number of ``raise AirflowException`` occurrences allowed in that file.
 A file whose current count exceeds the recorded limit is treated as a violation
 – use a dedicated exception class instead.
@@ -36,7 +36,7 @@
     When a file's count has *decreased*, the allowlist entry is tightened
     automatically and the hook exits with a non-zero code so that pre-commit
     reports the modified allowlist — just stage
-    ``scripts/ci/prek/known_airflow_exceptions.txt`` and re-run.
+    ``generated/known_airflow_exceptions.txt`` and re-run.
 
 ``--all-files``:
     Walk the whole repository and check every ``.py`` file.
@@ -201,7 +201,7 @@ def _check_airflow_exception_usage(
                 "If this usage is intentional and pre-existing, run:\n\n"
                 "  [cyan]uv run ./scripts/ci/prek/check_new_airflow_exception_usage.py --generate[/cyan]\n\n"
                 "to regenerate the allowlist, then commit the updated\n"
-                "[cyan]scripts/ci/prek/known_airflow_exceptions.txt[/cyan].",
+                "[cyan]generated/known_airflow_exceptions.txt[/cyan].",
                 title="[red]❌ Check failed[/red]",
                 border_style="red",
             )
@@ -239,7 +239,7 @@ def main(argv: list[str] | None = None) -> int:
     )
     args = parser.parse_args(argv)
 
-    manager = AllowlistManager(Path(__file__).parent / "known_airflow_exceptions.txt")
+    manager = AllowlistManager(REPO_ROOT / "generated" / "known_airflow_exceptions.txt")
 
     if args.generate:
         return manager.generate()

From 61fd2e5f0175b88c61bec711b7e9357b3b0b7628 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 17:05:40 +0530
Subject: [PATCH 26/29] [v3-3-test] Bump the uv-dependency-updates group across
 1 directory with 2 updates (#69044) (#69059)

Bumps the uv-dependency-updates group with 2 updates in the /dev/breeze directory: [pytest](https://github.com/pytest-dev/pytest) and [boto3](https://github.com/boto/boto3).

Updates `pytest` from 9.1.0 to 9.1.1
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pytest/compare/9.1.0...9.1.1)

Updates `boto3` from 1.43.32 to 1.43.34
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](https://github.com/boto/boto3/compare/1.43.32...1.43.34)
(cherry picked from commit 9517b492391e2a159f4d561739d97b4b8518353b)



---
updated-dependencies:
- dependency-name: pytest
  dependency-version: 9.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-dependency-updates
- dependency-name: boto3
  dependency-version: 1.43.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-dependency-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com>
---
 dev/breeze/uv.lock | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/dev/breeze/uv.lock b/dev/breeze/uv.lock
index d7301aa7ce1fe..43ace16d91142 100644
--- a/dev/breeze/uv.lock
+++ b/dev/breeze/uv.lock
@@ -253,30 +253,30 @@ wheels = [
 
 [[package]]
 name = "boto3"
-version = "1.43.32"
+version = "1.43.34"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "botocore" },
     { name = "jmespath" },
     { name = "s3transfer" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/88/34/5cd5603cf76730cac3e92c04bf7f076d5a2686fc57af8371e3f37f30ac88/boto3-1.43.32.tar.gz", hash = "sha256:15544d42af8aa8f775ea636f77c9c97fbc90ff28c0e5a0d1d47c8acd9f5b1982", size = 113169, upload-time = "2026-06-17T20:30:08.475Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/01/ac/178eb7f96bb6d5771105fe998b8b34512ef3f7ce9e2f1ab8d018df935bee/boto3-1.43.34.tar.gz", hash = "sha256:444207c6c883d4df3ea3b2c36df43ad492b86e0b889eebd2fc1d5ea8db0a8a1a", size = 112656, upload-time = "2026-06-19T19:33:39.366Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e3/96/ab658327b0d628b6deb14dd0e4898557f495a7b236e5db0f437c4c2c0a38/boto3-1.43.32-py3-none-any.whl", hash = "sha256:a3d7d7a9489c18cc9c806aca9be689677779d17ddbf919fe300146576c1bdee2", size = 140533, upload-time = "2026-06-17T20:30:06.615Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/5f/ac0872df61c3cea3539252f867cf8d76c226e4952f52a981b3fa54381060/boto3-1.43.34-py3-none-any.whl", hash = "sha256:42595057324606928c6e2432b3093978e4d722e0d432bce942f2a385702c0a43", size = 140029, upload-time = "2026-06-19T19:33:37.807Z" },
 ]
 
 [[package]]
 name = "botocore"
-version = "1.43.32"
+version = "1.43.34"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "jmespath" },
     { name = "python-dateutil" },
     { name = "urllib3" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/28/f2/3052825265c331886a92da823212ae4830471efd726ac901349d1a6b7c51/botocore-1.43.32.tar.gz", hash = "sha256:88ed52268b8f7e8ff8f9df5adbbf61e5bbb5dc618ee50de4346cabe93a482792", size = 15580749, upload-time = "2026-06-17T20:29:57.182Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/3c/0d/559cdceb9f6acea6b91404970b7973e28a4434fa8a70eb1416b0af478d86/botocore-1.43.34.tar.gz", hash = "sha256:ccc973cf30c6445b30afe5760f6dc949a80f1f862cb23d9c45747f2c814ece77", size = 15591382, upload-time = "2026-06-19T19:33:28.561Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/f6/20/b09c65e5903dc61ebbb3e000f725403e8c3dfc7b0f4697db84b5902032d0/botocore-1.43.32-py3-none-any.whl", hash = "sha256:429796537fde1301df90d394808985d88cd51b36a6e769e5c12f6a6877605428", size = 15264015, upload-time = "2026-06-17T20:29:54.138Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/ea/dc5aab38e2b3f63380810465fab92c836e9e8bce458eba4a8a896f25e1d2/botocore-1.43.34-py3-none-any.whl", hash = "sha256:238a0269f33c5914b9343900b44767e783b3e8b6dcb6e065eac8b4495601c5df", size = 15277590, upload-time = "2026-06-19T19:33:24.562Z" },
 ]
 
 [[package]]
@@ -585,7 +585,7 @@ name = "exceptiongroup"
 version = "1.3.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
+    { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/50/79/66800aadf48771f6b62f7eb014e352e5d06856655206165d775e675a02c9/exceptiongroup-1.3.1.tar.gz", hash = "sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219", size = 30371, upload-time = "2025-11-21T23:01:54.787Z" }
 wheels = [
@@ -1451,7 +1451,7 @@ wheels = [
 
 [[package]]
 name = "pytest"
-version = "9.1.0"
+version = "9.1.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "colorama", marker = "sys_platform == 'win32'" },
@@ -1462,9 +1462,9 @@ dependencies = [
     { name = "pygments" },
     { name = "tomli", marker = "python_full_version < '3.11'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/84/0e/b5858858d74958632c49b72cb25a3976ff9f632397626715be71c89d3971/pytest-9.1.0.tar.gz", hash = "sha256:41dd9148c08072446394cefd3d79701701335a9f4cae69ba92e39f6c7f5c061c", size = 1634181, upload-time = "2026-06-13T18:52:45.983Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e4/47/b9efed96c114afcfa3c9d3fe98a76a1d14c74a9e266d397cf6eb64be5e01/pytest-9.1.1.tar.gz", hash = "sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313", size = 1636369, upload-time = "2026-06-19T10:58:32.857Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/8b/5a/ba30a81239b909821b3153e303e7def45178bf353da4f72380e6c5e8793b/pytest-9.1.0-py3-none-any.whl", hash = "sha256:8ebb0e7888bdf2bdfc602ec51f8f62d50200af37356c74e503c79a94f5c81f32", size = 386453, upload-time = "2026-06-13T18:52:44.045Z" },
+    { url = "https://files.pythonhosted.org/packages/24/25/1de2678b631f5a49215c6c96fff41ba892b0a34df68d6d80292b1b48aa7f/pytest-9.1.1-py3-none-any.whl", hash = "sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c", size = 386536, upload-time = "2026-06-19T10:58:31.347Z" },
 ]
 
 [[package]]

From 5bea5753536f7b7b28989264d9ef646197f063cf Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 29 Jun 2026 17:06:12 +0530
Subject: [PATCH 27/29] [v3-3-test] Expose upstream partition key on triggering
 asset events (#69115) (#69120)

(cherry picked from commit 1dcdcd7dca42268cc23903733a95f0b694f58f07)

Co-authored-by: Wei Lee <weilee.rx@gmail.com>
---
 .../execution_api/datamodels/taskinstance.py  |  1 +
 .../execution_api/versions/v2026_04_06.py     | 10 +++-
 .../versions/head/test_task_instances.py      | 32 +++++++++++
 .../v2026_04_06/test_task_instances.py        | 54 ++++++++++++++++++-
 .../airflow/sdk/api/datamodels/_generated.py  |  1 +
 .../sdk/execution_time/schema/schema.json     | 12 +++++
 .../task_sdk/execution_time/test_context.py   | 18 +++++++
 7 files changed, 125 insertions(+), 3 deletions(-)

diff --git a/airflow-core/src/airflow/api_fastapi/execution_api/datamodels/taskinstance.py b/airflow-core/src/airflow/api_fastapi/execution_api/datamodels/taskinstance.py
index bf20bcbc30c55..ad051b3e6d340 100644
--- a/airflow-core/src/airflow/api_fastapi/execution_api/datamodels/taskinstance.py
+++ b/airflow-core/src/airflow/api_fastapi/execution_api/datamodels/taskinstance.py
@@ -317,6 +317,7 @@ class AssetEventDagRunReference(StrictBaseModel):
     source_map_index: int | None
     source_aliases: list[AssetAliasReferenceAssetEventDagRun]
     timestamp: UtcDateTime
+    partition_key: str | None = None
 
 
 class DagRun(StrictBaseModel):
diff --git a/airflow-core/src/airflow/api_fastapi/execution_api/versions/v2026_04_06.py b/airflow-core/src/airflow/api_fastapi/execution_api/versions/v2026_04_06.py
index 5a3b0f0f5fc2d..e3b995011f4cf 100644
--- a/airflow-core/src/airflow/api_fastapi/execution_api/versions/v2026_04_06.py
+++ b/airflow-core/src/airflow/api_fastapi/execution_api/versions/v2026_04_06.py
@@ -29,6 +29,7 @@
 )
 from airflow.api_fastapi.execution_api.datamodels.dagrun import TriggerDAGRunPayload
 from airflow.api_fastapi.execution_api.datamodels.taskinstance import (
+    AssetEventDagRunReference,
     DagRun,
     TIDeferredStatePayload,
     TIRunContext,
@@ -43,6 +44,7 @@ class AddPartitionKeyField(VersionChange):
     instructions_to_migrate_to_previous_version = (
         schema(DagRun).field("partition_key").didnt_exist,
         schema(AssetEventResponse).field("partition_key").didnt_exist,
+        schema(AssetEventDagRunReference).field("partition_key").didnt_exist,
         schema(TriggerDAGRunPayload).field("partition_key").didnt_exist,
         schema(DagRunAssetReference).field("partition_key").didnt_exist,
     )
@@ -50,8 +52,12 @@ class AddPartitionKeyField(VersionChange):
     @convert_response_to_previous_version_for(TIRunContext)  # type: ignore[arg-type]
     def remove_partition_key_from_dag_run(response: ResponseInfo) -> None:  # type: ignore[misc]
         """Remove the `partition_key` field from the dag_run object when converting to the previous version."""
-        if "dag_run" in response.body and isinstance(response.body["dag_run"], dict):
-            response.body["dag_run"].pop("partition_key", None)
+        dag_run = response.body.get("dag_run")
+        if isinstance(dag_run, dict):
+            dag_run.pop("partition_key", None)
+            for event in dag_run.get("consumed_asset_events") or ():
+                if isinstance(event, dict):
+                    event.pop("partition_key", None)
 
     @convert_response_to_previous_version_for(AssetEventsResponse)  # type: ignore[arg-type]
     def remove_partition_key_from_asset_events(response: ResponseInfo) -> None:  # type: ignore[misc]
diff --git a/airflow-core/tests/unit/api_fastapi/execution_api/versions/head/test_task_instances.py b/airflow-core/tests/unit/api_fastapi/execution_api/versions/head/test_task_instances.py
index 90325bb9c8542..67e0a4ee4aee7 100644
--- a/airflow-core/tests/unit/api_fastapi/execution_api/versions/head/test_task_instances.py
+++ b/airflow-core/tests/unit/api_fastapi/execution_api/versions/head/test_task_instances.py
@@ -164,12 +164,44 @@ def setup_method(self):
         clear_db_runs()
         clear_db_serialized_dags()
         clear_db_dags()
+        clear_db_assets()
 
     def teardown_method(self):
         clear_db_logs()
         clear_db_runs()
         clear_db_serialized_dags()
         clear_db_dags()
+        clear_db_assets()
+
+    def test_ti_run_context_exposes_consumed_event_partition_key(self, client, session, create_task_instance):
+        """The partition key of each consumed asset event is returned in the run context."""
+        ti = create_task_instance(
+            task_id="test_consumed_event_partition_key",
+            state=State.QUEUED,
+            session=session,
+        )
+        asset = AssetModel(name="upstream", uri="s3://bucket/upstream", group="asset", extra={})
+        session.add_all([asset, AssetActive.for_asset(asset)])
+        session.flush()
+        ti.dag_run.consumed_asset_events.append(
+            AssetEvent(asset_id=asset.id, source_dag_id="src", source_run_id="r1", partition_key="2024-01-15")
+        )
+        session.commit()
+
+        response = client.patch(
+            f"/execution/task-instances/{ti.id}/run",
+            json={
+                "state": "running",
+                "hostname": "h",
+                "unixname": "u",
+                "pid": 1,
+                "start_date": "2024-09-30T12:00:00Z",
+            },
+        )
+
+        assert response.status_code == 200
+        events = response.json()["dag_run"]["consumed_asset_events"]
+        assert [e["partition_key"] for e in events] == ["2024-01-15"]
 
     @pytest.mark.parametrize(
         ("max_tries", "should_retry"),
diff --git a/airflow-core/tests/unit/api_fastapi/execution_api/versions/v2026_04_06/test_task_instances.py b/airflow-core/tests/unit/api_fastapi/execution_api/versions/v2026_04_06/test_task_instances.py
index d855291727756..4a8b59c362e21 100644
--- a/airflow-core/tests/unit/api_fastapi/execution_api/versions/v2026_04_06/test_task_instances.py
+++ b/airflow-core/tests/unit/api_fastapi/execution_api/versions/v2026_04_06/test_task_instances.py
@@ -20,10 +20,11 @@
 import pytest
 
 from airflow._shared.timezones import timezone
+from airflow.models.asset import AssetActive, AssetEvent, AssetModel
 from airflow.serialization.serialized_objects import BaseSerialization
 from airflow.utils.state import DagRunState, State
 
-from tests_common.test_utils.db import clear_db_runs
+from tests_common.test_utils.db import clear_db_assets, clear_db_runs
 from tests_common.test_utils.format_datetime import from_datetime_to_zulu_without_ms
 
 pytestmark = pytest.mark.db_test
@@ -253,3 +254,54 @@ def test_head_version_returns_raw_serde_format(self, client, session, create_tas
         assert response.status_code == 200
         # Head version gets the plain dict directly -- no BaseSerialization wrapping
         assert response.json()["next_kwargs"] == {"cheesecake": True, "event": "payload"}
+
+
+class TestConsumedEventPartitionKeyBackwardCompat:
+    """The partition_key on consumed asset events is stripped for pre-2026-04-06 clients."""
+
+    @pytest.fixture(autouse=True)
+    def _freeze_time(self, time_machine):
+        time_machine.move_to(TIMESTAMP_STR, tick=False)
+
+    def setup_method(self):
+        clear_db_runs()
+        clear_db_assets()
+
+    def teardown_method(self):
+        clear_db_runs()
+        clear_db_assets()
+
+    def _create_ti_with_consumed_event(self, session, create_task_instance):
+        ti = create_task_instance(
+            task_id="test_consumed_event_partition_key_compat",
+            state=State.QUEUED,
+            session=session,
+            start_date=TIMESTAMP,
+        )
+        asset = AssetModel(name="upstream", uri="s3://bucket/upstream", group="asset", extra={})
+        session.add_all([asset, AssetActive.for_asset(asset)])
+        session.flush()
+        ti.dag_run.consumed_asset_events.append(
+            AssetEvent(asset_id=asset.id, source_dag_id="src", source_run_id="r1", partition_key="2024-01-15")
+        )
+        session.commit()
+        return ti
+
+    def test_old_version_strips_partition_key(self, old_ver_client, session, create_task_instance):
+        ti = self._create_ti_with_consumed_event(session, create_task_instance)
+
+        response = old_ver_client.patch(f"/execution/task-instances/{ti.id}/run", json=RUN_PATCH_BODY)
+
+        assert response.status_code == 200
+        events = response.json()["dag_run"]["consumed_asset_events"]
+        assert events
+        assert all("partition_key" not in event for event in events)
+
+    def test_head_version_keeps_partition_key(self, client, session, create_task_instance):
+        ti = self._create_ti_with_consumed_event(session, create_task_instance)
+
+        response = client.patch(f"/execution/task-instances/{ti.id}/run", json=RUN_PATCH_BODY)
+
+        assert response.status_code == 200
+        events = response.json()["dag_run"]["consumed_asset_events"]
+        assert [event["partition_key"] for event in events] == ["2024-01-15"]
diff --git a/task-sdk/src/airflow/sdk/api/datamodels/_generated.py b/task-sdk/src/airflow/sdk/api/datamodels/_generated.py
index bc03569386d14..80cee82cb1eaa 100644
--- a/task-sdk/src/airflow/sdk/api/datamodels/_generated.py
+++ b/task-sdk/src/airflow/sdk/api/datamodels/_generated.py
@@ -725,6 +725,7 @@ class AssetEventDagRunReference(BaseModel):
     source_map_index: Annotated[int | None, Field(title="Source Map Index")] = None
     source_aliases: Annotated[list[AssetAliasReferenceAssetEventDagRun], Field(title="Source Aliases")]
     timestamp: Annotated[AwareDatetime, Field(title="Timestamp")]
+    partition_key: Annotated[str | None, Field(title="Partition Key")] = None
 
 
 class AssetEventResponse(BaseModel):
diff --git a/task-sdk/src/airflow/sdk/execution_time/schema/schema.json b/task-sdk/src/airflow/sdk/execution_time/schema/schema.json
index 087d149d1af03..08383b1422204 100644
--- a/task-sdk/src/airflow/sdk/execution_time/schema/schema.json
+++ b/task-sdk/src/airflow/sdk/execution_time/schema/schema.json
@@ -4502,6 +4502,18 @@
           "format": "date-time",
           "title": "Timestamp",
           "type": "string"
+        },
+        "partition_key": {
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "default": null,
+          "title": "Partition Key"
         }
       },
       "required": [
diff --git a/task-sdk/tests/task_sdk/execution_time/test_context.py b/task-sdk/tests/task_sdk/execution_time/test_context.py
index f82f4924fbafc..eb1ffa0013e22 100644
--- a/task-sdk/tests/task_sdk/execution_time/test_context.py
+++ b/task-sdk/tests/task_sdk/execution_time/test_context.py
@@ -660,6 +660,24 @@ def test_getitem_uri_ref(
         assert mock_supervisor_comms.send.mock_calls == [mock.call(GetAssetByUri(uri=uri))]
         assert _AssetRefResolutionMixin._asset_ref_cache
 
+    def test_partition_key_exposed(self):
+        """A consumed asset event's partition key is reachable via triggering_asset_events."""
+        event = {
+            "asset": {"name": "1", "uri": "1", "extra": {}},
+            "extra": {},
+            "source_task_id": "t1",
+            "source_dag_id": "d1",
+            "source_run_id": "r1",
+            "source_map_index": -1,
+            "source_aliases": [],
+            "timestamp": "2025-01-01T00:00:12Z",
+            "partition_key": "2024-01-15",
+        }
+        accessor = TriggeringAssetEventsAccessor.build(
+            [AssetEventDagRunReferenceResult.model_validate(event)]
+        )
+        assert [e.partition_key for e in accessor[Asset("1")]] == ["2024-01-15"]
+
     def test_source_task_instance_xcom_pull(self, mock_supervisor_comms, accessor):
         events = accessor[Asset("2")]
         assert len(events) == 1

From 3cf17233771222ad446ba1ff03341f025cce84d1 Mon Sep 17 00:00:00 2001
From: Amogh Desai <amoghrajesh1999@gmail.com>
Date: Tue, 30 Jun 2026 10:37:59 +0530
Subject: [PATCH 28/29] Fix missed rename of BaseStateBackend to
 BaseStoreBackend (#69160) (#69162)

(cherry picked from commit 83c93f13440ed76296d056fe8c95757d8c9dc964)
---
 airflow-core/src/airflow/config_templates/config.yml | 4 ++--
 airflow-core/tests/unit/state/test_metastore.py      | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/airflow-core/src/airflow/config_templates/config.yml b/airflow-core/src/airflow/config_templates/config.yml
index 39423755a6841..975e6ba11213b 100644
--- a/airflow-core/src/airflow/config_templates/config.yml
+++ b/airflow-core/src/airflow/config_templates/config.yml
@@ -3281,11 +3281,11 @@ state_store:
     backend:
       description: |
         Full dotted path to the class that implements state storage for tasks and assets.
-        The class must be a subclass of ``BaseStateBackend``.
+        The class must be a subclass of ``BaseStoreBackend``.
         The default implementation persists state in the Airflow metadata database.
       version_added: 3.3.0
       type: string
-      example: "mypackage.state.CustomStateBackend"
+      example: "mypackage.state.CustomStoreBackend"
       default: "airflow.state.metastore.MetastoreBackend"
     clear_on_success:
       description: |
diff --git a/airflow-core/tests/unit/state/test_metastore.py b/airflow-core/tests/unit/state/test_metastore.py
index a2d2d103dd018..732cece14583c 100644
--- a/airflow-core/tests/unit/state/test_metastore.py
+++ b/airflow-core/tests/unit/state/test_metastore.py
@@ -704,6 +704,6 @@ def test_empty_backend_raises_value_error(self):
 
     @conf_vars({("state_store", "backend"): "airflow.models.dagrun.DagRun"})
     def test_invalid_backend_raises_type_error(self):
-        """resolve_state_backend() raises TypeError when the configured class is not a BaseStateBackend subclass."""
+        """resolve_state_backend() raises TypeError when the configured class is not a BaseStoreBackend subclass."""
         with pytest.raises(TypeError, match="not a subclass of `BaseStoreBackend`"):
             resolve_state_backend()

From fc7faf2bfd70e843176c1467f0e0ec91fca77ac2 Mon Sep 17 00:00:00 2001
From: Rahul Vats <rah.sharma11@gmail.com>
Date: Mon, 29 Jun 2026 17:33:53 +0530
Subject: [PATCH 29/29] update release notes for 3.3.0rc1

---
 RELEASE_NOTES.rst          | 135 +++++++++++++++++++------------------
 docs/spelling_wordlist.txt |   1 +
 reproducible_build.yaml    |   4 +-
 3 files changed, 74 insertions(+), 66 deletions(-)

diff --git a/RELEASE_NOTES.rst b/RELEASE_NOTES.rst
index 345ddc1ce3b77..b50a38cc44dc7 100644
--- a/RELEASE_NOTES.rst
+++ b/RELEASE_NOTES.rst
@@ -24,28 +24,29 @@
 
 .. towncrier release notes start
 
-Airflow 3.3.0b2 (2026-07-06)
-----------------------------
+Airflow 3.3.0 (2026-07-06)
+--------------------------
 
 Significant Changes
 ^^^^^^^^^^^^^^^^^^^
 
-Asset Partitioning
-""""""""""""""""""
+Asset Partitioning (#64571, #65447, #66030, #66848, #67184, #67475, #67716, #68978)
+"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
 
 Building on the asset partitioning introduced in 3.2.0, Airflow 3.3.0 substantially expands how a
 single upstream asset event fans out to partitioned downstream Dag runs. New partition mappers —
-``FanOutMapper`` (one-to-many), and ``FixedKeyMapper`` + ``SegmentWindow`` (categorical rollup) — join
-the existing ``RollupMapper``, and compose with time windows (day/week/month/quarter/year) and a
+``RollupMapper`` (many-to-one), ``FanOutMapper`` (one-to-many), and ``FixedKeyMapper`` +
+``SegmentWindow`` (categorical rollup) — compose with time windows (day/week/month/quarter/year) and a
 ``wait_policy`` (``WaitForAll`` or ``MinimumCount(n)``) to control when partitioned runs fire. Windows
 can fan out forward or backward in time, and total fan-out per upstream event is bounded by the new
-``[scheduler] partition_mapper_max_downstream_keys`` config (configurable per mapper).
-(#66030, #66848, #67184, #67475, #67716)
+``[scheduler] partition_mapper_max_downstream_keys`` config (configurable per mapper). Airflow 3.3.0
+also adds the ``PartitionedAtRuntime`` timetable, which lets a Dag declare that its partition key(s)
+are assigned when the run starts rather than mapped from an upstream event.
 
 For detailed usage instructions, see :doc:`/authoring-and-scheduling/assets`.
 
-Task and Asset State Store
-""""""""""""""""""""""""""
+Task and Asset State Store (#65759, #66073, #66160, #66463, #66586, #66859, #67041, #67292, #67319)
+"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
 
 Airflow 3.3.0 introduces a first-class state store for tasks and assets (AIP-103). Tasks can persist
 arbitrary key-value state that survives across retries and runs via a new ``task_state_store`` accessor, and
@@ -53,60 +54,54 @@ assets can carry their own state via ``asset_state_store`` — both available fr
 in the metadata database by default, or in a custom worker-side backend (``[workers]
 state_store_backend``), supports per-key retention with periodic garbage collection and an optional
 ``clear_on_success``, and is fully manageable through the Core API and Execution API.
-(#65759, #66073, #66160, #66463, #66586, #66859, #67041, #67319)
-
-.. warning::
 
-  Task and asset state storage is experimental in 3.3.0 and may change in future versions based on
-  user feedback.
+For detailed usage instructions, see :doc:`/core-concepts/task-and-asset-state-store`.
 
-Pluggable Retry Policies
-""""""""""""""""""""""""
+Pluggable Retry Policies (#65474)
+"""""""""""""""""""""""""""""""""
 
 Task retry behaviour is now pluggable (AIP-105). In addition to a fixed ``retries`` count, you can
 attach a custom retry policy that decides whether and when a task is retried, enabling strategies such
-as retrying only on specific exceptions or backing off based on custom logic. (#65474)
+as retrying only on specific exceptions or backing off based on custom logic.
 
-Language Task SDK (Java and Go)
-"""""""""""""""""""""""""""""""
+For detailed usage instructions, see :ref:`concepts:retry-policies`.
+
+Language Task SDK (Java and Go) (#65958, #67161, #67635, #67699)
+""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
 
 Airflow 3.3.0 adds a Coordinator layer (AIP-108) that lets individual task implementations be written
 in non-Python languages while the Dag and its scheduling stay in Python. A task is declared in the Dag
 with ``@task.stub(queue=...)``; the worker routes it to a configured coordinator
 (``JavaCoordinator`` for JVM languages, ``ExecutableCoordinator`` for self-contained native binaries
 such as Go) that runs the task in a language runtime and proxies Variables, Connections, and XComs back
-through the Execution API. (#65958, #67118, #67161, #67635, #67699)
-
-.. warning::
+through the Execution API.
 
-  The Coordinator layer and the Java/Go SDKs are experimental in 3.3.0 and may change in future
-  versions based on user feedback.
+For detailed usage instructions, see :doc:`/authoring-and-scheduling/language-sdks/index`.
 
-DAG bundle version on clear, rerun, and backfill
-""""""""""""""""""""""""""""""""""""""""""""""""
+Dag bundle version on clear, rerun, and backfill (#63884)
+"""""""""""""""""""""""""""""""""""""""""""""""""""""""""
 
 The new ``rerun_with_latest_version`` setting controls whether a cleared, rerun, or backfilled Dag run
 uses the latest bundle version or the original version from the initial run. The default is resolved
-by precedence: an explicit request parameter/CLI flag, then the DAG-level ``rerun_with_latest_version``,
+by precedence: an explicit request parameter/CLI flag, then the Dag-level ``rerun_with_latest_version``,
 then ``[core] rerun_with_latest_version``, and finally ``False`` for clear/rerun and ``True`` for
 backfills (preserving historical behaviour). Airflow 2.x always reran with the latest code; 3.x
 introduced bundle versioning defaulting to the original version, and this setting gives users control.
-(#63884)
 
 See :doc:`/administration-and-deployment/dag-bundles` for full details.
 
-Provider example DAGs as dedicated bundles
-""""""""""""""""""""""""""""""""""""""""""
+Provider example Dags as dedicated bundles (#66161)
+"""""""""""""""""""""""""""""""""""""""""""""""""""
 
-Example DAGs shipped by provider distributions are now discovered via ``ProvidersManager`` and
+Example Dags shipped by provider distributions are now discovered via ``ProvidersManager`` and
 registered as their own Dag bundles — one per provider, named
 ``apache-airflow-providers-<distribution>-example-dags`` (or ``<distribution>-example-dags`` for
 third-party providers). The ``[core] load_examples`` option still gates whether they are registered.
-REST API clients that filtered ``bundle_name`` by ``"dags-folder"`` for provider-shipped example DAGs
-must update to the new per-provider bundle names; DAG identifiers are unchanged. (#66161)
+REST API clients that filtered ``bundle_name`` by ``"dags-folder"`` for provider-shipped example Dags
+must update to the new per-provider bundle names; Dag identifiers are unchanged.
 
-Remote logging resolution decoupled from ``airflow.logging_config``
-"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+Remote logging resolution decoupled from ``airflow.logging_config`` (#67056)
+""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
 
 Remote task log handler resolution is now owned by the shared ``airflow_shared.logging.factory``
 module and applies a single, well-defined precedence:
@@ -124,27 +119,27 @@ not implement ``from_config`` are skipped with a warning and fall through to the
 
 Migration: replace direct calls to ``airflow.logging_config.load_logging_config()`` with the new
 helpers, and have provider remote-log handler classes implement a no-argument ``from_config``
-classmethod that reads ``airflow.providers.common.compat.sdk.conf``. (#67056)
+classmethod that reads ``airflow.providers.common.compat.sdk.conf``.
 
-OpenTelemetry timer metrics now use Histogram
-"""""""""""""""""""""""""""""""""""""""""""""
+OpenTelemetry timer metrics now use Histogram (#64207)
+""""""""""""""""""""""""""""""""""""""""""""""""""""""
 
 OpenTelemetry timer and timing metrics are now recorded as Histograms instead of Gauges, preserving
-count, sum, and bucket distribution across recordings. (#64207)
+count, sum, and bucket distribution across recordings.
 
-DAG-processing "seconds ago" metric is now tagged
-"""""""""""""""""""""""""""""""""""""""""""""""""
+Dag-processing "seconds ago" metric is now tagged (#62487)
+""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
 
 ``dag_processing.last_run.seconds_ago.{dag_file}`` is now a legacy metric. The new
 ``dag_processing.last_run.seconds_ago`` is emitted with ``file_path``, ``bundle_name`` and
 ``file_name`` tags (``file_path`` + ``bundle_name`` uniquely identify the Dag file). The legacy metric
-is still emitted by default and can be disabled via ``[metrics] legacy_names_on``. (#62487)
+is still emitted by default and can be disabled via ``[metrics] legacy_names_on``.
 
-New Deadlines page under Browse
-"""""""""""""""""""""""""""""""
+New Deadlines page under Browse (#67586)
+""""""""""""""""""""""""""""""""""""""""
 
 A new **Deadlines** page is available under the Browse menu, accessible to any role that already has
-``can_read`` and ``menu_access`` on **DAG Runs**. (#67586)
+``can_read`` and ``menu_access`` on **Dag Runs**.
 
 
 New Features
@@ -179,7 +174,7 @@ New Features
 - Add ``awaiting_input`` task state for Human-in-the-Loop, running off the triggerer (#68028)
 - Add bulk API to mark Dag runs as success or failed (#67948)
 - Record writer info for every asset store write for better cross-linkage (#67902)
-- Register XCom ``output_type`` classes from a worker-side DAG walk (#67875)
+- Register XCom ``output_type`` classes from a worker-side Dag walk (#67875)
 - Add ``FixedKeyMapper`` and ``SegmentWindow`` for categorical asset-partition rollup (#67716)
 - Add a bulk ``POST /dags/{dag_id}/clearDagRuns`` API endpoint (#67709)
 - Return Pydantic model instances through XCom for structured output (#67644)
@@ -231,22 +226,21 @@ New Features
 - UI: Show expected duration based on historical average in Dag Run details (#65722)
 - Add team name to the task context (#65617)
 - Add an ``on_kill()`` hook to ``BaseTrigger`` to handle user actions on triggers (#65590)
-- Allow accessing a DAG's members via ``[]`` (#65586)
+- Allow accessing a Dag's members via ``[]`` (#65586)
 - Add pluggable retry policies for Airflow tasks (AIP-105) (#65474)
 - Add support for ``format="Duration"`` in params (#65469)
-- Add the ``PartitionAtRuntime`` authoring API to the Task SDK (AIP-76) (#65447)
 - UI: Add pagination to the grid view (#65388)
 - Add ``partition_key`` to the task context (#65359)
 - Make the blocked-thread warning threshold configurable (#65009)
 - Add name fields to SDK deadline alerts (#64926)
 - Add dynamic interval resolution support via Variables for deadline alerts (#64751)
-- Add an ``is_backfillable`` property to DAG API responses (#64644)
+- Add an ``is_backfillable`` property to Dag API responses (#64644)
 - Return dag-specified results in the dag run wait API (#64577)
 - Hold a Dag run until all upstream partitions arrive (AIP-76) (#64571)
 - Add a way to mark a return-value XCom as the dag result (#64522)
 - Allow accessing a TaskGroup's members via ``[]`` (#64430)
 - UI: Redo the Gantt chart (#64335)
-- UI: Add task-level filters to the DAG graph tab (#64271)
+- UI: Add task-level filters to the Dag graph tab (#64271)
 - UI: Add bulk Clear, Mark Success/Fail, and delete for multiple task instances (#64141)
 - Check that multi-team is enabled when a team name is provided to the API (#63994)
 - Add a ``DagRunType`` for operators (#63733)
@@ -259,6 +253,9 @@ New Features
 - Re-enable the ``start_from_trigger`` feature with template-field rendering (#55068)
 - Backfill partitioned Dags by partition-date range (#67537)
 - Add a producer-side acknowledgement channel to shared-stream triggers (#67523)
+- UI: Add ``partition_date`` to the Dag run detail page (#68977)
+- Expose the upstream ``partition_key`` on ``triggering_asset_events`` and ``dag_run.consumed_asset_events`` (AIP-76) (#69120)
+- Allow ``get``/``set``/``delete``/``clear`` of ``AssetStateStoreAccessor`` to run on the triggerer (#68966)
 
 Bug Fixes
 ^^^^^^^^^
@@ -320,7 +317,7 @@ Bug Fixes
 - Reject negative ``default_retention_days`` in the Task SDK and core API routes (#67890)
 - Fix ``none_failed_min_one_success`` trigger rule checks (#67873)
 - Remove trigger kwargs from the REST API response (#67868)
-- UI: Fix long parameter names overflowing the Trigger DAG modal (#67859)
+- UI: Fix long parameter names overflowing the Trigger Dag modal (#67859)
 - Fix misleading log message in the task runner clear-on-success block (#67836)
 - Fix scheduler crash when logging orphaned task resets (#67822)
 - UI: Fix dashboard pool summary showing incorrect deferred slot usage (#67818)
@@ -333,14 +330,14 @@ Bug Fixes
 - Apply per-file authorization to the dag-source endpoint (#67662)
 - Fix ``airflow dags next-execution --table`` crash when no next run exists (#67642)
 - UI: Fix the time picker omitting seconds (#67636)
-- Filter scheduling-dependencies graph edges by readable-DAG access (#67627)
+- Filter scheduling-dependencies graph edges by readable-Dag access (#67627)
 - Mask per-key secrets-backend-kwarg overrides on the Config API (#67622)
 - Fix ``GET /auth/login`` missing a 400 response in the OpenAPI spec (#67571)
 - Fix ``GET /pools`` incorrectly documenting a 404 response in the OpenAPI spec (#67570)
 - Add a compatibility layer for import errors caused by ``AirflowSecretsBackendAccessDenied`` (#67560)
 - UI: Fix rendering of None child state (#67552)
 - Fix sort order for mapped task instances (#67551)
-- Fix import errors total-entries count with multiple DAGs per file (#67550)
+- Fix import errors total-entries count with multiple Dags per file (#67550)
 - UI: Prefer active over queued state for collapsed groups (#67543)
 - Fix callback state not updating from executor events due to a UUID type mismatch (#67542)
 - Reject wildcard origin in CORS config instead of toggling credentials (#67502)
@@ -357,7 +354,7 @@ Bug Fixes
 - UI: Restore the Monaco find widget in the Dag Code view (#67391)
 - UI: Fix an HTTPException import that turned a 400 into a 500 in the dags endpoint (#67363)
 - Restore ``fail_fast`` handling when reschedule exceeds the MySQL ``TIMESTAMP`` limit (#67353)
-- Fix the Triggered DAG button not being visible during queued/running state (#67327)
+- Fix the Triggered Dag button not being visible during queued/running state (#67327)
 - Fix variables import with structured falsy values (#67060)
 - Avoid logging Execution API bearer credentials (#67059)
 - Sanitize Dag processor metric file names (#67029)
@@ -365,9 +362,9 @@ Bug Fixes
 - Prevent ``AlreadyRunningBackfill`` error caused by an invalid date range request (#66874)
 - Restrict owner-link and extra-link ``href`` values to safe schemes (http, https, mailto, relative) (#66741)
 - Add a session parameter to the ``BaseStateBackend`` interface to fix custom backends (#66708)
-- Allow deadline callbacks within the same DAG module (#66702)
+- Allow deadline callbacks within the same Dag module (#66702)
 - UI: Fix relative React plugin bundle URLs in dev mode (#66618)
-- Validate DAG trigger conf as a JSON object or null (#66617)
+- Validate Dag trigger conf as a JSON object or null (#66617)
 - Require a trust sentinel for ``state.user`` injection in ``get_user()`` (#66562)
 - Use ``hmac.compare_digest`` for ``SimpleAuthManager`` password comparison (CWE-208) (#66556)
 - Set ``SameSite=Lax`` on the ``SimpleAuthManager`` all-admins login cookie (#66502)
@@ -382,7 +379,7 @@ Bug Fixes
 - Fix ``resolve_xcom_backend`` to rely on the config schema default (#65938)
 - Fix a missing import cast error in the dag_run API route (#65748)
 - Mask Dag processor connection and variable responses (#65704)
-- UI: Show import error for deactivated DAGs (#65687)
+- UI: Show import error for deactivated Dags (#65687)
 - Forward MySQL SSL params from ``sql_alchemy_conn`` to ``airflow db shell`` (#65575)
 - Disable SQLite FK checks in the 0111 migration downgrade (#65545)
 - Handle Variable values that cannot be decrypted gracefully in the stable REST API (#65452)
@@ -393,7 +390,7 @@ Bug Fixes
 - Fix ``task_defer`` with non-JSON ``next_kwargs`` in ``TaskInstance`` (#64714)
 - Add the error as ``context["exception"]`` in ``InProcessTestSupervisor`` (#64568)
 - Fix NPM security alerts in the simple auth manager (#64309)
-- Fix DAG run trigger to surface errors instead of swallowing them (#64130)
+- Fix Dag run trigger to surface errors instead of swallowing them (#64130)
 - Fix Task SDK Connection extras built from a URI constructor (#64120)
 - Add insert/update-on-conflict for rendered task instance fields (#63874)
 - Fix ``timeout_with_traceback`` crashes on Windows and non-main threads (#63664)
@@ -425,6 +422,11 @@ Bug Fixes
 - Fix ``dag.test()`` not re-syncing sibling Dags across repeated calls (#66205)
 - UI: Invalidate per-attempt task instance caches after actions so logs and details are not stale (#67212)
 - Fix task runner failure on a duplicate task instance success-state update (#63355)
+- Fix a race condition on the ``order_by`` parameter when listing Dag runs via the REST API (#68948)
+- Exclude non-successful Dag runs from the ``DeadlineReference.AVERAGE_RUNTIME`` deadline calculation so failed runs no longer skew the computed deadline (#68949)
+- Allow ``InProcessExecutionAPI`` to start without ``api_auth.jwt_secret`` configured (#68982)
+- Make ``airflow dags test`` wait for Human-in-the-loop input instead of looping indefinitely on parked HITL tasks (#69104)
+- Fix the Java coordinator rejecting macOS dual-stack loopback connections (#68973)
 
 Miscellaneous
 ^^^^^^^^^^^^^
@@ -484,11 +486,11 @@ Miscellaneous
 - Pass user teams to the ``create_asset_event`` endpoint (#66367)
 - Load ``USFederalHolidayCalendar`` lazily to reduce memory usage when loading examples (#66303)
 - Propagate task OpenTelemetry trace context through IPC into Execution API requests (#66151)
-- Surface worker DAG parse duration in the task log (#66138)
-- Skip deserializing ``trigger_kwargs`` when loading serialized DAGs (#66002)
+- Surface worker Dag parse duration in the task log (#66138)
+- Skip deserializing ``trigger_kwargs`` when loading serialized Dags (#66002)
 - Honor ``AUTH_ROLE_PUBLIC`` in the FastAPI API server (#65685)
 - Add extended sysinfo for the Edge worker (#65472)
-- Clarify logs when a DAG is being processed in the Dag processor (#65196)
+- Clarify logs when a Dag is being processed in the Dag processor (#65196)
 - Add indexes on ``task_instance.dag_version_id`` and ``dag_run.created_dag_version_id`` (#64818)
 - Improve creation of ``RuntimeTaskInstance`` in ``TriggerRunner`` for ``start_for_trigger`` functionality (#64298)
 - Mark the Triggerer supervisor as a server context so it can read metastore connections (#64022)
@@ -504,6 +506,7 @@ Miscellaneous
 - Allow synchronous deadline callbacks (``SyncCallback``) to access Connections and Variables (#65269)
 - Add a ``team_name`` tag to deadline metrics for multi-team deployments (#68589)
 - Add a ``team_name`` tag to scheduler metrics for multi-team deployments (#68594)
+- Defer the Cadwyn import so FastAPI/Starlette stay off the Task SDK worker path, reducing per-worker memory (#69029)
 
 Doc Only Changes
 ^^^^^^^^^^^^^^^^
@@ -535,13 +538,17 @@ Doc Only Changes
 - Document ``on_kill()``/``cleanup()`` for triggers (#65671)
 - Explain ``xcom_pull`` behaviour without ``task_ids`` in the docs (#65406)
 - Improve standalone authentication documentation for Airflow 3.x (#65330)
-- Clarify manual DAG run data interval semantics in Airflow 3 (#64740)
-- Document and test ``xcom_pull`` ``run_id`` usage for triggered DAG runs (#63030)
+- Clarify manual Dag run data interval semantics in Airflow 3 (#64740)
+- Document and test ``xcom_pull`` ``run_id`` usage for triggered Dag runs (#63030)
 - Update params in the backfill documentation (#61821)
 - Document the ``apache-airflow-mypy`` package in the core docs (#68561)
 - Fix typos and formatting in the Fundamentals documentation (#68524)
 - Complete the Hindi (``hi``) UI translation (#68574)
 - Fill the Taiwanese Mandarin (``zh-TW``) UI translation gap (#68563)
+- Document that Dag bundle ``kwargs`` should reference a Connection rather than inline credentials (#69105)
+- Add example plugins and expand the asset-partitions documentation (#69017)
+- Java SDK docs: ``JUL`` setup, pinning ``java_executable``, and a config-reload note (#69020)
+- Correct the example config for the coordinators (#68940)
 
 Airflow 3.2.2 (2026-05-29)
 --------------------------
diff --git a/docs/spelling_wordlist.txt b/docs/spelling_wordlist.txt
index 6a9616c7c0dcd..40eff22af35a6 100644
--- a/docs/spelling_wordlist.txt
+++ b/docs/spelling_wordlist.txt
@@ -1010,6 +1010,7 @@ Logstash
 logstash
 longblob
 lookups
+loopback
 lshift
 lxml
 machineTypes
diff --git a/reproducible_build.yaml b/reproducible_build.yaml
index 35e49dbd28262..8f93c62057de1 100644
--- a/reproducible_build.yaml
+++ b/reproducible_build.yaml
@@ -1,2 +1,2 @@
-release-notes-hash: c9325d92cf48780c3f712a724138502a
-source-date-epoch: 1782287760
+release-notes-hash: 4ccf748c0003a2870cf1b735f2950322
+source-date-epoch: 1782802478