[yuseok89]

Editing a Variable or a Connection's extra in the UI sends secrets back as ***, and merge() restored them by list position. Removing, inserting or reordering list items gave one item another item's secret, or saved *** as the value.

merge() now matches each list item to the stored item it was shown for, so every secret stays with its own item. When a masked value could belong to more than one stored item, or to none, the save is rejected with a 400 instead of guessing. The form shows the message in its existing error alert and keeps the user's edits.

Follow-up to #76012, which kept this as a known limitation.

closes: #76512

Before / After

Stored {"users": [alice:A, bob:B, carol:C]} as a Variable value or a Connection extra, edited in the form where every password shows as ***.

Edit	Before	After
Remove alice	bob gets A, carol gets B	bob:B, carol:C
Insert dave first	alice gets B, bob gets C, carol gets ***	each keeps its own
Swap alice and bob	swapped secrets	each keeps its own
Swap alice and bob, then rename both	swapped secrets	still swapped, indistinguishable from renaming both in place
Rename bob in place, or give bob a new password	correct	correct
Remove alice and rename bob	bob2 gets A	400, nothing saved
Remove one of [{"token": "***"}, {"token": "***"}]	the first token is kept, whichever was removed	400, nothing saved

A rejected save in the UI. The message names the list whose masked values could not be placed, and the form stays open with the edits.

Items are grouped by their shown form, so matching stays linear in the list length, and saving 10,000 records takes about a second.

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)
  • Claude Code (Opus 5.5)

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

[github-actions]

Fork CI: running. CI for the latest commit is running in your fork.

Pull requests from contributors run their CI in the contributor's own fork. GitHub Actions is free and has no minute limit on public forks, while the CI capacity of the Apache Software Foundation is shared by every ASF project and is finite.

Latest run: https://github.com/yuseok89/airflow/actions/runs/42484795752

How this works: fork CI for external contributors.

---

This comment was posted automatically by the fork CI monitor from templates drafted with an AI-assisted tool, so it may contain mistakes. An Apache Airflow maintainer, a real person, will review the pull request once its fork CI is green. Why the first pass is automated.