PT-2026-75926

Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. GET /api/v2/dagSources/dag id — and the equivalent Dag-source view in the UI — returned the entire source file without redacting Dags the caller was not...