- Allowed deserialization classes flag now uses glob patterns (with a new regex list), requiring updates to custom configurations.
- Audit log access is restricted to admins only, enhancing security but breaking access for non‑admin users.
- AirflowTimeoutError now inherits BaseException, preventing it from being caught by generic Exception handlers.