Can you manage Airflow dependencies with Poetry or pip-tools?

You can use them, but the Airflow project does not support them for installing Airflow itself. Its installation docs state that only pip and uv are officially supported and that installing via Poetry or pip-tools is not currently supported. If you use them anyway, you take on the job of reproducing the project's tested set.

What the docs say

The Airflow guide to installing from PyPI explains why the situation exists. Airflow is both a library and an application, so its dependencies are kept open in the package metadata, "as open as possible". The project then publishes constraint files, one per release and per Python version, that pin a tested set of versions. You pass that file to pip when installing.

Plain installation without constraints can, in the docs' words, "not work or will produce an unusable Airflow installation" at times. The constraint file exists to prevent that.

Then comes the support statement: only pip and uv are officially supported, and Poetry and pip-tools are not.

Why this is a security topic

A pinned, tested set is also a reviewable set. When a resolver picks versions on its own, three things can differ from what the project tested:

• Transitive packages can resolve to newer releases than the constraint file lists.
• Security fixes you wanted may be held back by a resolver conflict, so you stay on an older version without noticing.
• The set you review in a pull request may not be the set the tested path would have produced.

None of this means a Poetry lock file is unsafe. It means the lock file is your own artifact, and nobody upstream has tested it as a whole.

Three workable patterns

1. Follow the documented path. Install with pip or uv and the constraint file for your Airflow and Python versions, then record the result. The docs describe creating your own constraint file: install with constraints, apply your changes, run pip freeze into a file, and reuse it.
2. Use Poetry or pip-tools for your own code only. Keep Airflow's installation in the image build with the documented method, and use your tool for the packages your DAGs need, inside an isolated environment.
3. Export from your tool, then install with pip. Generate a fully pinned list, and install it with the project's constraint file on top so conflicts fail loudly.

Whichever you choose, run pip check afterward. The docs say exit code 0 means no conflicts were found.

What to write down

• The Airflow version and Python version.
• The constraint file URL or your own constraint file, checked in.
• Which tool resolved your extra packages, and the lock file.
• Who owns updating them, and how often.

Where a scanner fits

A scanner reads whichever lock file or frozen list you have. It cannot tell you whether the combination was tested by the project. That gap is closed by process, not by a tool.

Safeguard's SBOM and dependency scanning reads lock files and frozen requirement lists, so the resulting set is inventoried whichever tool produced it. The free scan at https://gold.safeguard.sh/scan is a quick way to try it.

Try it yourself

Click through it at your own pace, or open it full screen. See how different manifest types roll up into one inventory.

Quick check

Sources

• Installing Airflow from PyPI

Last reviewed: 19 October 2026.