Yes. Community Airflow providers are released and versioned separately from Airflow itself, each as its own package named apache-airflow-providers followed by a name. You can upgrade or downgrade one without touching core, which is useful for security fixes, as long as you pin core and verify the result.
What providers are
Core Airflow ships as the apache-airflow package. Providers add operators, hooks, sensors and extras such as connections, logging and secrets backends. The Airflow documentation says they follow semantic versioning, and that Airflow discovers installed providers automatically after a restart.
Each provider also has a matching extra, so installing Airflow with a given extra pulls compatible provider versions.
Why this matters for security
Providers are where much of the integration code lives: database drivers, cloud clients, SSH, Kafka and similar. Advisories land in providers independently of core. Our write up of provider advisories for SSH host keys, Kafka, Snowflake and Teradata shows the pattern. Separate versioning is a gift here, because a fix can ship without a core upgrade.
Steps to update one provider safely
- Inventory what is installed. List the provider packages and versions in your image.
- Read the provider release notes. The docs say breaking changes and required versions of other providers are documented there.
- Upgrade in a test image. Install the newer provider while pinning apache-airflow to your current version, so pip does not change core. The installation page shows this pattern.
- Run pip check. The docs recommend it to confirm there are no conflicting requirements.
- Test your Dags that use the provider, including connection types.
- Roll out and keep the old image tag so you can go back. The docs note you can downgrade a provider if a new version causes problems.
Watch the conflicts
The Airflow installation page warns that separately managed providers may not work with every Airflow version or with each other. Its example is a limit on protobuf that clashes with another library from the same vendor. A pinned install plus pip check turns that surprise into an error you see before deploy.
Constraint files interact with this. See what an Airflow constraints file is for why constraints apply only to the install command where you use them.
Quick check
Can I upgrade a provider without upgrading Airflow?
Yes. The docs say you can upgrade a single provider without upgrading core, and validate it independently.
How do I stop pip from changing my Airflow version?
Pin apache-airflow to the version you run in the same install command.
Safeguard dependency scanning can show which provider versions in your image have known advisories, and fix pull requests are available (off by default). Try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
