Apache Airflow & Magpie Meetup 2026 – Taipei

Airflow's security team logged about 30 vulnerability reports in 2025. In 2026 it passed 250, and well over 100 of those turned out to be real CVEs. Jarek Potiuk is coming to Taipei to explain how the team kept up, and why the fix was more AI with a human signing off on every step.

$ wc -l reports/2025
  ~30
$ wc -l reports/2026
  250+   # ~8x
$ grep -c CVE reports/2026
  100+   # ~6x

That's the main talk. After it comes a deep dive into Airflow 3.3 internals, then time to hang out with Taiwan's Airflow users, contributors and open-source folks. Talks are in Taiwanese Mandarin and English.

Tonight's talks

Eight Times the Reports: Surviving the AI Vulnerability Flood at Apache Airflow. Most of these reports look serious: confident, detailed, often with a CVSS score attached. Some are real and some are made up. You can't ignore them, and you can't read them all by hand either. So the team built Apache Magpie, which:

• pulls reports from the mailing list into a tracker

• suggests a classification

• catches duplicates and helps assign CVEs

• keeps each tracker in sync with its email thread and fix PRs

• drafts replies to reporters

A person on the security team approves every step. Jarek will cover what got automated, what never will be, the mistakes along the way, and how your project can set up the same defenses before the wave reaches you.

From N Consumers to One: How Airflow's Triggerer Shares a Kafka Consumer. Po-An walks through SharedStreamProducer, new in Airflow 3.3. It lets triggers share one Kafka consumer, so you open fewer connections to the same topic.

Tuesday, November 24 · 18:30–20:30

Getting there

12F, No. 206, Sec. 2, Dunhua S. Rd., Da'an District, Taipei. Thanks to TAIONE Open Source Foundation for providing the venue and supporting Taiwan's open-source community.