v26.1.10
Added 2
- New live-reloadable cluster configs oidc_http_proxy_username and oidc_http_proxy_password add HTTP Basic authentication to the OIDC forward proxy
- New cluster property iceberg_default_schema_case_insensitive to determine whether the Iceberg subsystem compares field names case-insensitively, with auto-detection support for AWS Glue catalogs
Changed 7
- The day partition transform now produces a date-typed partition column instead of int
- Report Iceberg-disabled topics as DISABLED in translation_state response
- Avoid recompression of unchanged batches in the local storage and cloud topics compaction implementation
- Optimize the segment_meta_cstore insert_entries path for the generic append case
- Prevent oversized allocations in the kafka layer when utilizing large consumer groups
- Purging an Iceberg table managed by the filesystem catalog will now delete all the table's files, not just the metadata files
- The iceberg translation state REST endpoint now returns a partition state entry for every partition of the topic and reports the topic's partition_count
Fixed 5
- Fix schema evolution incorrectly rejecting new optional Iceberg columns whose nested types contain structurally-required fields
- Fixed Avro schema lookup false negatives when equivalent nested primitive schemas used simple form and object form
- Fixed a leak in the Iceberg translation subsystem where per-partition metrics were not released after a partition was removed from a broker
- Fixed a bug in the feature_table where decommissioned nodes holding back the cluster-wide cluster_version prevented cluster_version from being updated
- Fixed a bug where fetches against tiered storage could fail when retention advances past all segments and new segments are added
Security 1
- Patched krb5 against CVE-2026-40355 (null pointer dereference) and CVE-2026-40356 (integer underflow) in NegoEx message parsing, exploitable by unauthenticated remote attackers to crash the process
Features
- New live-reloadable cluster configs
oidc_http_proxy_username/oidc_http_proxy_passwordadd HTTP Basic authentication to the OIDC forward proxy (oidc_http_proxy_url); set both to authenticate, leave unset for an anonymous proxy. The password is secret. by @nguyen-andrew in #30767
Bug Fixes
- Fix schema evolution incorrectly rejecting new optional Iceberg columns whose nested types contain structurally-required fields (e.g. maps, whose keys are always required). by @nvartolomei in #30590
- Fixed Avro schema lookup false negatives when equivalent nested primitive schemas used simple form, such as
"string", and object form, such as{"type":"string"}. by @pgellert in #30641 - Fixed a leak in the Iceberg translation subsystem where per-partition metrics were not released after a partition was removed from a broker. by @nvartolomei in #30706
- Fixes a bug in the
feature_tablein which nodes which are holding back the cluster-widecluster_version, when decommissioned, result in thecluster_versionnever being updated until a restart/controller leadership move is forced. by @WillemKauf in #30636 - Fixes a bug where fetches against tiered storage could fail when retention advances past all segments and new segments are added. by @wdberkeley in #30637
- Patched krb5 against CVE-2026-40355 (null pointer dereference) and CVE-2026-40356 (integer underflow) in NegoEx message parsing, both exploitable by an unauthenticated remote attacker to crash the process (CVSS 8.7). by @tyson-redpanda in #30572
- The
daypartition transform now produces adate-typed partition column (matching the Iceberg spec) instead ofint. by @mmaslankaprv in #30534 - report Iceberg-disabled topics as DISABLED in translation_state response. by @bharathv in #30770
Improvements
- Added a new cluster property
iceberg_default_schema_case_insensitivewith possible values of yes, no, or auto, default is auto. This property determines whether the Iceberg subsystem compares field names case-insensitively or not. The auto value means the system will attempt to detect if it should use case insensitive comparison. This will happen if the detected REST catalog is AWS Glue, which addresses a sporadic issue with AWS Glue where it would return field names lower-cased instead of verbatim. by @wdberkeley in #30577 - Avoid recompression of unchanged batches in the local storage and cloud topics compaction implementation. by @WillemKauf in #30672
- Optimize the
segment_meta_cstore::insert_entries()path for the generic append case. by @WillemKauf in #30610 - Prevent oversized allocations in the
kafkalayer when utilizing large consumer groups by @WillemKauf in #30753 - Purging an Iceberg table managed by the filesystem catalog will now delete all the table's files, not just the metadata files. by @wdberkeley in #30698
- The iceberg translation state REST endpoint now returns a partition
state entry for every partition of the topic and reports the topic's
partition_count. by @mmaslankaprv in #30657
Full Changelog: https://github.com/redpanda-data/redpanda/compare/v26.1.9...v26.1.10