Skip to main content

Airbyte 2.5

Quick, release a new patch for Airbyte before anyone notices! No, not that button, that's the full release button! Oh well. Airbyte version 2.5 was released on November 6, 2026.

note

This version fixes several publicly disclosed vulnerabilities in Airbyte's dependencies, including the compromised eMudhra root certificate. Airbyte strongly recommends that you upgrade as soon as possible. For details, see Security improvements.

Before you upgrade​

  • Temporal moves to temporalio/server: The chart's default temporal.image changes from the deprecated temporalio/auto-setup:1.27.2 to temporalio/server:1.30.8. A new init container and sidecar that use temporalio/admin-tools run schema migration and create the default namespace. The admin-tools tag follows temporal.image.tag unless you set temporal.adminTools.image.tag. A normal helm upgrade migrates the schema, and running syncs continue. While the Temporal pod restarts, worker and cron logs may briefly show UNAVAILABLE or connection errors. Check your setup before you upgrade:

    • If you pin temporal.image to an auto-setup tag, remove the override. temporalio/admin-tools has no matching 1.27.2 tag, so the pod can't pull its image.
    • Don't upgrade with helm upgrade --reuse-values. The chart can't render without the new temporal.adminTools values, so pass your values file with -f instead.
    • If you use a private registry or an air-gapped environment, mirror temporalio/server:1.30.8 and temporalio/admin-tools:1.30.8.
    • The two admin-tools containers each request 50m CPU and 64Mi memory. If your namespace has a ResourceQuota, adjust temporal.adminTools.resources as needed.
    • If your external Postgres user can't create databases, set SKIP_DB_CREATE=true in temporal.env_vars.
    • If you use MySQL for Temporal or manage the Temporal schema yourself, set temporal.autoSetup: false. The built-in setup supports Postgres only.
    • Deployments that use Temporal Cloud (global.temporal.cloud.enabled) aren't affected.

  • Fewer sync retries by default: The default maximum number of failed attempts drops from 10 to 5 for attempts that sync no data, and from 20 to 10 for attempts that sync some data. Airbyte doesn't expect this change to reduce reliability, because nearly all syncs that succeed do so within the new limits. However, this change will accelerate failure signals and reduce workload duration for connections that are almost certain to fail anyway. If you sync from APIs that fail often, you may want to restore the previous limits. The Helm chart has no dedicated value for these limits, so to restore them, set SYNC_JOB_RETRIES_COMPLETE_FAILURES_MAX_TOTAL to 10 and SYNC_JOB_RETRIES_PARTIAL_FAILURES_MAX_TOTAL to 20 with worker.extraEnv in your values file:

    values.yaml
    worker:
      extraEnv:
        - name: SYNC_JOB_RETRIES_COMPLETE_FAILURES_MAX_TOTAL
          value: "10"
        - name: SYNC_JOB_RETRIES_PARTIAL_FAILURES_MAX_TOTAL
          value: "20"

  • Stricter request authorization: On deployments with authentication enabled, Airbyte now checks every protected Config API and API route against the caller type, its permissions, its token scope, and the resource's saved owner before it does any work. Requests for resources the caller has no permission for now return a 403. Requests that name a workspace different from the saved resource's workspace, or that mix resources from different workspaces, now return a 400. Endpoints that only workers call, such as writing discovered catalogs, attempt statistics, and stream metadata, now reject user tokens and API application tokens, including those of instance administrators. The web app and Airbyte's own services aren't affected. If you have scripts or integrations that call these endpoints directly, confirm they use the correct credentials and resources.

  • Unused database tables removed: The upgrade's database migrations drop the unused oauth_state and workspace_service_account tables from the configuration database. As with any upgrade, back up your database first.

Helm chart improvements​

  • Azure Key Vault credentials reach job pods: With secretsManager.type: AZURE_KEY_VAULT, the chart now passes the Key Vault client ID and client secret to connector job pods. Previously the chart set environment variables that the workload launcher doesn't read, so job pods failed with clientSecret is null or empty. The chart now sets AB_AZURE_KEY_VAULT_CLIENT_ID_REF_NAME, AB_AZURE_KEY_VAULT_CLIENT_ID_REF_REF_KEY, AB_AZURE_KEY_VAULT_CLIENT_SECRET_REF_REF_NAME, and AB_AZURE_KEY_VAULT_CLIENT_SECRET_REF_REF_KEY. If you worked around this with workloadLauncher.extraEnv, your values still take precedence and no duplicate entries appear.
  • Larger API requests: The server, workers, and workload API server now accept request bodies up to 50 MB, up from 10 MB. Discovering a source with thousands of tables no longer fails with a 413 error. To change the limit, set MICRONAUT_SERVER_MAX_REQUEST_SIZE and MICRONAUT_SERVER_MAX_REQUEST_BUFFER_SIZE. If a proxy or ingress sits in front of Airbyte, make sure its body size limit is large enough too.

Connector & sync management​

  • Redesigned connector setup form: The source and destination setup form now shows in a single card with a header for the connector and a footer that stays visible while you scroll. Required fields show an asterisk, and the Optional fields section is now called Advanced. Required fields that already have a default value move into Advanced. Options with two to four choices show as a segmented control, and a choice control with only one option no longer shows. Save & Test stays unavailable until you fill in every required field, and you can still save an incomplete configuration as a draft. The OAuth authentication block has a new layout with a clearer success state, and Copy JSON moves to an icon in the header. While the connector specification loads, the form shows the Airbyte logo animation instead of a spinner, and a support message appears if loading takes more than 10 seconds.
  • Initial sync warning: When you create a connection, the setup page no longer shows the warning about the data volume of the initial sync.
  • Sync status in the connections list: The Connections page now has a column that shows each connection's latest sync status.
  • Schema change notifications for new connections: If a request to create a connection doesn't set notifySchemaChanges, Airbyte now uses the workspace's connection update notification setting.
  • Faster test and discovery feedback: The setup form checks connection test and schema discovery status every 500 milliseconds instead of every 2 seconds, so results appear sooner.
  • Accurate failed sync status: If a sync can't produce its output, Airbyte now uses the workload's final status to record the attempt. Previously, a failed sync could be recorded as successful.
  • Syncs with repeated connector errors: Airbyte now keeps only the first 10 errors a connector reports in a sync, plus a note that it dropped the rest. Previously, a connector that reported the same error hundreds of times could create a failure record too large for Temporal, leaving the job stuck in a running state.
  • Schema discovery during syncs: Schema discovery that runs as part of a sync now uses its intended 30-minute timeout instead of ending after 9 minutes. Timeout errors now report the limit that applied.
  • Clearer sync result errors: When the platform API rejects the result of a check, discover, or spec operation, the error now includes the response status.
  • Connector Builder error details: The Connector Builder now shows the explanation that the manifest server returns for invalid requests, instead of a generic error.
  • No connections to deleted connectors: Airbyte now rejects creating a connection that uses a deleted source or destination.
  • Google Secret Manager recovery: If a secret already exists in Google Secret Manager without a readable version, Airbyte adds a new version instead of failing.

Security improvements​

  • Safer declarative OAuth templates: Airbyte now renders the OAuth URL, header, and parameter templates in declarative connectors in a restricted mode, and no longer includes testing secrets in the Connector Builder's consent URL.
  • Service account permissions: Tokens for service accounts now carry the correct type, so Airbyte applies the service account's permissions instead of treating the token as an ordinary user token.
  • Patched base images: Platform images now build on updated base images that fix these vulnerabilities:
    • Java base image: Airbyte no longer trusts the compromised eMudhra emSign ECC Root CA - G3 root certificate (CVE-2026-91403, CVE-2026-111943). The Keycloak image also removes this certificate from its Java trust store. The Java base image also picks up Amazon Linux 2023 security updates, including Amazon Corretto 21.0.13, OpenSSL, curl, Brotli, PCRE2, and Python 3.
    • nginx base image: The update to nginx 1.31.8 on Alpine 3.24 fixes CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205.
    • Temporal: The move to temporalio/server:1.30.8 removes the Brotli vulnerability CVE-2026-111497, which has no fix in the temporalio/auto-setup image.
  • Web app dependency updates: The web app upgrades React Router to 7.18.5, which fixes an open redirect through links and navigation (GHSA-wrjc-x8rr-h8h6). It also upgrades Zod to version 4 and limits the size of arrays in form validation, which fixes GHSA-mrhx-c7xc-m3w5. Updates to sanitize-html, the LaunchDarkly SDK, and query-string resolve other known dependency advisories.

Bug fixes​

  • Sign-in errors: When a refresh token is invalid or revoked, Airbyte now returns a clear error that asks you to sign in again.
  • Pending invitations: The pending invitations list no longer briefly shows invitations from the organization or workspace you previously viewed.
  • Daylight saving time: On the Connections page, the event list under the sync graph now shows its time-range label correctly on days when daylight saving time changes.
  • Schema table headers: The stream schema table now shows the Primary key and Cursor column headers.
  • Unsaved changes warning: After you save a connector draft, leaving the page no longer warns about unsaved changes.
  • Connector setup guide: The setup guide now displays titled and indented notes and images from the documentation site correctly.
Was this page helpful?