Update dependency apache-airflow-providers-google to v22 [SECURITY]

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
apache-airflow-providers-google (changelog)	==21.3.0 → ==22.2.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Apache Airflow Google provider allows path traversal through GCS object names

CVE-2026-49297 / GHSA-v3mh-27qj-w836

More information

Details

Apache Airflow's Google provider operators GCSToSFTPOperator and GCSTimeSpanFileTransformOperator joined GCS object names returned by the bucket listing API directly to a destination filesystem path without normalisation or containment check. A user with write access to the source GCS bucket (typically a different trust principal than the DAG author — partner uploads, ingest-only service accounts, public-data buckets) could create an object whose name contains .. segments and cause the DAG run to write the downloaded blob outside the configured destination (the SFTP destination_path for GCSToSFTPOperator; the worker-local temp directory for GCSTimeSpanFileTransformOperator), enabling overwrite of arbitrary files on the SFTP server or the worker host. Affects deployments that ingest from buckets writable by less-trusted principals. Users are advised to upgrade to apache-airflow-providers-google 22.2.1 or later.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-49297
• https://github.com/apache/airflow/pull/67667
• https://lists.apache.org/thread/cb5nvoxsj1q7rv878cyqgtg150w0zglq?users@airflow.apache.org
• http://www.openwall.com/lists/oss-security/2026/07/04/8
• https://github.com/apache/airflow/commit/0385bae70553223677753047b3e779d8b86b15c4
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-google/PYSEC-2026-2084.yaml
• https://github.com/advisories/GHSA-v3mh-27qj-w836

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[gemini-code-assist]

Code Review

This pull request updates the apache-airflow-providers-google dependency version in requirements.txt from 21.3.0 to 22.2.1. The reviewer noted that the corresponding constraints.txt file should also be updated to match this new version to prevent potential installation conflicts.

[gemini-code-assist]

The constraints.txt file in the same directory still specifies apache-airflow-providers-google==10.2.0 (line 119). To prevent installation conflicts and maintain consistency as instructed by the comment on line 1, update constraints.txt to match the new version 22.2.1.