apache/airflow: technical due diligence, read from its repository

The median source file here is 86 lines. 129 files exceed 1,000 lines, the largest being 4,627. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

The suite is configured to retry failing tests (airflow-core/src/airflow/ui/src/components/FlexibleForm/FieldMultiType.test.tsx); 8 tests are individually marked to retry. A retry turns a flaky test green without saying why it failed, so a green build means the tests passed eventually. Ask how many retries a typical run needs, and which tests need them.

The newest release, 3.3.2, is not on the branch this survey read; the newest release on it is 2.0.0. The shipped product may differ from what this report describes. Survey the release branch too.

20 HTTP calls use a client with no timeout (Python `requests` without `timeout=`, or Go's default client). When a dependency slows down, each one holds a worker until the connection gives up, and enough of them take the service down with the dependency.

1 places in product code build SQL by formatting or joining strings rather than passing parameters. In each, what the code shows going in is a table or column name, a constant, or something the line does not show, not a request's value. Ask whether any value reaches these strings, rather than a parameter.

2 places run a command through a shell (`shell=True`, `os.system`, `exec` with a template) rather than passing arguments. Where any part comes from outside, it is command injection. Ask where each one's input comes from.

4 places read data with a deserialiser that executes what it reads (pickle, `yaml.load` without a safe loader, Python `marshal`). That is safe on data the system wrote itself and remote code execution on anything else. Ask where each one's input comes from.

7 places set HTML from a value that is neither a literal nor passed through a sanitiser. Where the value can come from a user, that is stored cross-site scripting, and it is the first thing a buyer's security review looks for in a frontend.

The newest was published on 2026-10-20. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. Whether 6 of them are fixed in the code you ship could not be told from this history: its version is only known to be at least 2.0.0. Answer lives in: the release you run, set against each fixed version. PYSEC-2026-3988 (moderate), PYSEC-2026-3989 (moderate), GHSA-5247-m8w9-2v4m (moderate) and 35 more are fixed in the surveyed commit; which release carries them cannot be told from this history, which does not place the release users run. Answer lives in: the version you run. The record is incomplete: NVD: 3 records name airflow with nothing tying them to this repository (CVE-2024-28423, CVE-2025-54415, CVE-2026-5667).

3 images in the deployment configuration are named without a version or as `latest`. A redeploy can change the software without a commit, a rollback has nothing to roll back to, and nobody can say from the repository what is running.