Skip to main content

Airbyte 2.3

Don't worry everyone, we found MinIO. Airbyte version 2.3 was released on September 15, 2026.

Self-Managed Enterprise

If you still use Self-Managed Enterprise, do not upgrade. Speak to your Airbyte representative about switching to one of Airbyte's Cloud plans, which always have the latest capabilities and security improvements. Private Link is available if you require it.

Action required before upgrading​

This release fixes a deployment failure caused by the removal of MinIO's DockerHub image. The bundled MinIO deployment now pulls its image from airbyte/minio instead of minio/minio. The tag, RELEASE.2023-11-20T22-40-07Z, is unchanged. If you mirror bundled images into a private registry or pin image repositories in your Helm values, make airbyte/minio:RELEASE.2023-11-20T22-40-07Z available before upgrading. The upstream minio/minio repository on Docker Hub is no longer publicly pullable, so fresh installs of earlier versions that use the bundled MinIO fail with an image pull error.

Existing installs that use the bundled MinIO (global.storage.type: minio) need a manual step. If you use S3, GCS, or Azure storage, skip this. Airbyte deploys the bundled MinIO with a Helm pre-install hook, which Helm applies only at install time. helm upgrade doesn't update MinIO, so upgrading to 2.3 alone doesn't move it to airbyte/minio. Your MinIO pod keeps running on the old image until it next restarts, and then fails to start. Check whether you're affected:

kubectl -n <namespace> get statefulset airbyte-minio \
  -o jsonpath='{.spec.template.spec.containers[0].image}'

If that prints minio/minio:..., run these before upgrading:

kubectl -n <namespace> set image statefulset/airbyte-minio \
  airbyte-minio=airbyte/minio:RELEASE.2023-11-20T22-40-07Z

kubectl -n <namespace> delete pod airbyte-minio-0

The second command is required. A StatefulSet rolling update doesn't replace a pod that isn't Ready, so the image change alone can leave the old pod in place. Your MinIO data volume is retained. MinIO is unavailable for a few seconds while the pod restarts. Sync state is stored in Airbyte's database and is unaffected, but job logs written during the restart aren't retained, and a sync running at that moment may fail and be retried automatically. Prefer a period of low sync activity.

If you mirror or pin bundled images, also make sure the manifest server tag 7.28.2 and Keycloak 26.7.3 are available before upgrading.

Helm chart improvements​

  • MinIO image pulled from Airbyte's registry: The default minio.image.repository is now airbyte/minio, a copy of the same image mirrored under Airbyte's Docker Hub organization. See Action required before upgrading if you use a private registry.

  • Bundled manifest server image updated: The default manifest server image tag is now 7.28.2 instead of 7.23.7, bringing the current Connector Development Kit to the Connector Builder and declarative connectors. If you mirror or pin bundled images, mirror the new tag.

  • Explicit defaults for tuning values: The chart now renders explicit defaults for server.httpIdleTimeout (5m), server.publicApiExecutor.numThreads (5), server.ioExecutor.numThreads (100), server.scheduler.numThreads (25), worker.activityMaxAttempt (5), worker.activityInitialDelayBetweenAttemptsSeconds (30), worker.activityMaxDelayBetweenAttemptsSeconds (600), worker.workflowFailureRestartDelaySeconds (600), and worker.discoverRefreshWindowMinutes (1440) instead of empty strings. The defaults match what the applications already used, so behavior doesn't change if you left these unset. The same worker defaults apply to the data plane chart.

Connector & sync management​

  • Large schema discovery fails visibly instead of hanging: The connector sidecar again allows its JVM to use up to 75 percent of the container's memory, so large discovered catalogs fit while Airbyte sends them to the server. If the sidecar does hit a fatal error such as running out of memory during a check or discover, it now records the failure and exits with an error instead of exiting successfully and leaving the connection wizard waiting until it times out.

  • Schema change backfills run again: Syncs that run through the command-based path now receive the applied catalog diff, so backfills for incremental streams affected by a propagated schema change happen as configured. Connections that use global state, such as CDC sources, or legacy state keep their existing state when a backfill can't apply to it, instead of starting the sync with no state and re-snapshotting every stream.

  • Duplicate attempt conflicts fail fast: When creating an attempt returns a 409 Conflict because the job already has one, the workflow fails the attempt immediately instead of waiting for the ten-minute mandatory-activity restart delay.

  • Breaking change pins use stable versions: When Airbyte removes a version pin that would cross a connector breaking change, it pins the affected sources and destinations to the latest stable version before the breaking change. Release candidate and preview tags such as -rc.1 are no longer eligible.

  • Manual OAuth setup hidden when Airbyte provides credentials: The "Set up manually" toggle on OAuth connector forms only appears when your instance has no global OAuth application for that connector. When a global application exists, Airbyte injects its own client credentials at run time, so manually entered values had no effect and caused authentication failures.

  • Declarative OAuth code challenges follow RFC 7636: The codechallengeS256 filter used by declarative OAuth flows now emits an unpadded base64url code challenge instead of padded standard Base64, so providers such as Salesforce accept PKCE requests.

  • Connector setup guide renders correctly: In the connector documentation side panel, long unbroken strings such as OAuth URLs wrap instead of overflowing, links whose text is inline code render as links inside tables, and large documents such as the Stripe source guide no longer freeze the browser tab.

Security improvements​

  • Stricter validation of connector secrets: Airbyte now validates secret values more strictly when you create or update sources and destinations. Existing configurations continue to work.

  • Keycloak updated to 26.7.3: The bundled Keycloak image moves from 26.2 to 26.7.3, which includes a number of CVE fixes and resolves an admin API slowdown on instances with many realms. The Keycloak database schema doesn't change.

Was this page helpful?