`airflow config update` (dry-run, the default) prints unmasked secrets to stdout

Under which category would you file this issue?

Airflow Core

Apache Airflow version

main

What happened and how to reproduce it?

airflow config update with no flags, i.e. dry-run mode, which is the default, prints the full contents of airflow.cfg to stdout unmasked, including sensitive values like sql_alchemy_conn (often has an embedded DB password), fernet_key, secret_key, and SMTP credentials.

airflow config update is documented/intended as a preview tool for deprecated/renamed config options ahead of an Airflow 3 upgrade, not as a config-dumping command, so this is a surprising and easy-to-trigger credential leak, especially when run in CI logs or pasted into a bug report or support channel.

Repro:

$ airflow config update
[blue]Dry-run mode enabled. No changes will be written to airflow.cfg.[/blue]
[core]
...
sql_alchemy_conn = postgresql+psycopg2://airflow:S3cr3tPassword@db:5432/airflow
...
fernet_key = <real fernet key>

What you think should happen instead?

airflow config update should mask sensitive values by default, consistent with config list:

• Give update_config the same --show-values/--hide-sensitive handling as show_config, masking sensitive options unless the user explicitly opts in to seeing real values.
• write_custom_config() should support hiding sensitive values (or update_config should build its preview output from the already-masked config_dict instead of re-reading raw self._sections).

Operating System

No response

Deployment

None

Apache Airflow Provider(s)

No response

Versions of Apache Airflow Providers

No response

Official Helm Chart version

Not Applicable

Kubernetes Version

No response

Helm Chart configuration

No response

Docker Image customizations

No response

Anything else?

No response

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct