Pinned Apache Airflow version

[Kehindecodes]

🛠️ Repo maintenance

PR Description

Pinned apache-airflow version to 2.11.0. Here are the changes made in the uv.lock file :
Added Packages

• flask-session
• google-re2
• gunicorn
• marshmallow-oneofschema
• mdit-py-plugins
• python-nvd3
• rfc3339-validator

Removed Packages

• a2wsgi
• aiosqlite
• annotated-doc
• annotated-types
• apache-airflow-core
• apache-airflow-providers-standard
• apache-airflow-task-sdk
• cadwyn
• fastapi
• fastapi-cli
• greenback
• httptools
• libcst
• msgspec
• natsort
• outcome
• pydantic
• pydantic-core
• pydantic-extra-types
• pydantic-settings
• pygtrie
• python-dotenv
• python-multipart
• pyyaml-ft
• retryhttp
• rich-toolkit
• shellingham
• starlette
• structlog
• svcs
• typer
• types-requests
• typing-inspection
• uuid6
• uvicorn
• uvloop
• watchfiles
• websockets

Related Issues or other material

Related #1275

[AndrewThien]

Hi @Kehindecodes ,
Thanks for the PR!
Would you mind looking at the failed Dependency review workflow? I think we should try pinning the version of apache-airflow=2.10.5. Cheers!

[Kehindecodes]

Hi @AndrewThien ,
Thanks for the reply. I would do that.

[AndyRae]

Thanks so much for the contribution @Kehindecodes - the dependency-review workflow is exactly why this has become an issue! So, it won't approve anything for still vulnerable versions of Airflow, so try increasing it to the latest on 2.11.
If it still fails - we'll have to accept anyway or migrate to 3.0, but this PR would be nice to resolve the reality of the dependency on 2.X

[Kehindecodes]

@AndyRae, I think it will still fail if we upgrade to the latest on 2.11 because the vulnerability bugs were not resolved until 3.1.6, according to: https://pkgseer.dev/vulnerabilities/GHSA-7c2f-r6gc-h92h, https://pkgseer.dev/vulnerabilities/GHSA-5g2w-9f8g-g5q7. So what is the next step? Should we still upgrade to the latest on 2.11 or just upgrade to 3.1.6 or later

[AndyRae]

@AndyRae, I think it will still fail if we upgrade to the latest on 2.11 because the vulnerability bugs were not resolved until 3.1.6, according to: https://pkgseer.dev/vulnerabilities/GHSA-7c2f-r6gc-h92h, https://pkgseer.dev/vulnerabilities/GHSA-5g2w-9f8g-g5q7. So what is the next step? Should we still upgrade to the latest on 2.11 or just upgrade to 3.1.6 or later

Yep in that case pin at 2.11, I believe 3.x is wider changes that we would need to change the code for.

[Kehindecodes]

@AndyRae Version 2.11.0 is the latest and final stable release of the 2.x series, which is was its currently pinned at. So no need for changes.