Jelyfishhhhhh

The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as write-only. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.

The Keycloak auth manager fails to terminate the session during logout. While the logout route revokes the provided token, the `KeycloakJWTMiddleware` issues a new, unrevoked token within the same response, allowing the user to remain authenticated. This could allow an individual with subsequent access to the same browser, such as on a shared workstation, to continue acting as the previous user.