Features
- New configuration:
iceberg_rest_catalog_credentials_host: The hostname to connect to for retrieving role-based credentials for the Iceberg REST catalog. May be required when the REST catalog uses a different credentials source than cloud storage — for example, if cloud storage is configured to use STS with a custom credentials host, but the REST catalog uses aws_instance_metadata, this should be set to 169.254.169.254 to prevent the cloud storage host override from applying to catalog credential requests. by @wdberkeley in #30446
Bug Fixes
- Avoid OOM under memory fragmentation when there are many ACLs. by @pgellert in #30401
- Fix Iceberg map columns being unreadable from strict Parquet readers
(e.g. Apache Spark) due to a missingLogicalType.MAPannotation in
the written Parquet schema. by @nvartolomei in #30457 - Fix an issue with Clout Topics garbage collection where deleting all cloud topics could leave stale objects in the bucket, forever. by @oleiman in #30283
- Iceberg REST catalog credential refresh requests were sent to the wrong host when cloud_storage_credentials_host was set. The host override intended for cloud storage was applied globally, causing catalog credential fetches to fail if the catalog used a different credentials source with a different expected endpoint. by @wdberkeley in #30446
- Upgraded libxml2 to v2.15.3 to fix CVE-2026-6732 type confusion vulnerability in XSD validation. by @tyson-redpanda in #30393
- #30437 Schema Registry: fixed protobuf compatibility checks incorrectly failing
withMESSAGE_REMOVEDwhen a map field is removed. by @QueLLL in #30438 - rpk/debug/bundle: dedup admin addresses across host forms by @hidalgopl in #30411
- PR #30313 kafka/server: cap fetch memory allocation at max message size limit by @ballard26
Full Changelog: v26.1.7...v26.1.8