Apache Polaris 1.7.0

Release Artifacts

This release includes:

• Source and binary distributions
• Helm chart package
• Docker images published to Docker Hub
• Maven artifacts published to Maven Central

Verification

All artifacts have been signed with GPG and include SHA-512 checksums for verification.

Docker Images

• apache/polaris:1.7.0 - Polaris Server
• apache/polaris-admin:1.7.0 - Polaris Admin Tool

What's Changed

• Fix ManifestReader resource leak in ManifestFileCleanupTaskHandler by @vigneshio in #4828
• Update amazon/aws-cli Docker tag to v2.35.11 by @renovate-bot in #4847
• Update apache/ozone Docker tag to v2.1.1 by @renovate-bot in #4853
• Update dependency com.adobe.testing:s3mock-testcontainers to v5.1.0 by @renovate-bot in #4845
• Update docker.io/adobe/s3mock Docker tag to v5.1.0 by @renovate-bot in #4846
• Remove TestEnvironmentExtension by @adutra in #4841
• Helm: Add maintenance suport in helm by @MonkeyCanCode in #4755
• Fix Renovate grouping and Quarkus platform updates by @snazy in #4867
• Update dependency ch.qos.logback:logback-classic to v1.5.35 by @renovate-bot in #4868
• Fix duplicate setId() in TableCleanupTaskHandler wasting entity IDs by @vigneshio in #4871
• Update actions/cache action to v6 by @renovate-bot in #4872
• Update actions/setup-python digest to ece7cb0 by @renovate-bot in #4878
• Migrate Ranger integration tests to server runner by @snazy in #4857
• CI: Use "full" semver for action references by @snazy in #4881
• Update registry.access.redhat.com/ubi9/openjdk-21-runtime Docker tag to v1.24-2.1782104518 by @renovate-bot in #4882
• Optimize privilege set BitSet byte-to-long conversion by @iting0321 in #4869
• Add GCS principal attribution to vended credentials via Workload Identity Federation by @obelix74 in #4707
• Migrate OPA integration tests to server runner by @snazy in #4856
• Migrate Spark integration tests to server runner by @snazy in #4858
• Site: Update community Slack invite by @flyrain in #4889
• Update apache/flink Docker tag to v2.3.0 by @renovate-bot in #4890
• Build: Give quarkus-build more heap by @snazy in #4888
• Migrate JDBC metrics serialization to Jackson 3 by @snazy in #4861
• Remove createTableDirectWithWriteDelegation method by @nandorKollar in #4725
• Support bulk deletion in batch file cleanup task by @nandorKollar in #4850
• Follow-up to #4795: use transaction connection for SELECT in inheritable policy check by @vigneshio in #4810
• Update actions/setup-java action to v5.4.0 by @renovate-bot in #4893
• Update docker.io/openpolicyagent/opa Docker tag to v1.18.0 - autoclosed by @renovate-bot in #4894
• Add guide for Trino by @findinpath in #4849
• Update trinodb/trino Docker tag to v482 by @renovate-bot in #4897
• Update dependency ch.qos.logback:logback-classic to v1.5.36 by @renovate-bot in #4895
• Update registry.access.redhat.com/ubi9/openjdk-21-runtime Docker tag to v1.24-2.1782293370 by @renovate-bot in #4896
• Update dependency com.gradleup.shadow:shadow-gradle-plugin to v9.4.3 - autoclosed by @renovate-bot in #4898
• Move Ranger integration tests into Ranger extension by @snazy in #4880
• Move Spark integration tests into Spark projects by @snazy in #4886
• Bump Quarkus to 3.37.0 by @snazy in #4885
• Remove unused field in JdbcBasePersistenceImpl by @adutra in #4892
• Remove unused fields in NoSqlMetaStore by @adutra in #4904
• Move OPA tests into OPA extension by @snazy in #4887
• Update rustfs docker version by @MonkeyCanCode in #4903
• Move Ranger source up by @snazy in #4899
• Update dependency ch.qos.logback:logback-classic to v1.5.37 by @renovate-bot in #4909
• Migrate non-critical Jackson tests to Jackson 3 by @snazy in #4862
• Update Gradle to v9.6.1 by @renovate-bot in #4911
• When a vote failed, the vote email subject should not RESULT, it should be CANCEL by @jbonofre in #4907
• Doc: Simplify trino guide by @MonkeyCanCode in #4902
• Inject MetricsPersistence directly into PersistingMetricsReporter by @dimas-b in #4866
• Fix broken CLI doc reference link in iceberg-rest-federation.md by @nandorKollar in #4906
• Fix Gradle 9.6 deprecation warnings in build scripts by @snazy in #4908
• Fix GCS downscoped credential prefix boundary for locations without trailing slash by @vigneshio in #4884
• Fix native catalog credential vending skipping allowedLocations re-validation by @vigneshio in #4860
• Fix working of PURGE_VIEW_METADATA_ON_DROP by @ayushtkn in #4730
• Add OpenTelemetry event listener by @hkwi in #4836
• Update quay.io/keycloak/keycloak Docker tag to v26.6.4 by @renovate-bot in #4915
• Update actions/cache action to v6.1.0 by @renovate-bot in #4916
• Update dependency org.junit:junit-bom to v6.1.1 by @renovate-bot in #4918
• Update dependency com.puppycrawl.tools:checkstyle to v13.7.0 by @renovate-bot in #4919
• Add readiness check for reflection-free serializers by @flyrain in #4913
• Update dependency jupyterlab to v4.6.1 by @renovate-bot in #4924
• Update docker.io/openpolicyagent/opa Docker tag to v1.18.1 by @renovate-bot in #4925
• Update plugin com.gradle.common-custom-user-data-gradle-plugin to v2.7.0 by @renovate-bot in #4933
• Update dependency com.diffplug.spotless:spotless-plugin-gradle to v8.8.0 - autoclosed by @renovate-bot in #4932
• Update dependency org.postgresql:postgresql to v42.7.12 - autoclosed by @renovate-bot in #4931
• Update dependency org.apache.httpcomponents.client5:httpclient5 to v5.6.2 by @renovate-bot in #4930
• Fix correctness gap in NoSQL hasOverlappingSiblings for parent locations by @vigneshio in #4873
• Avoid metrics persistence setup for in-memory event buffering by @mj006648 in #4877
• Add missing logback-test.xml to authz modules by @adutra in #4940
• fix(release): correct LICENSE and NOTICE metadata by @flyingImer in #4901
• Prepare NoSQL pagination tokens for Jackson 3 by @snazy in #4917
• Migrate runtime-spark-tests to server runner by @snazy in #4900
• Exclude JBoss Log Manager from test classpaths in non-Quarkus modules by @adutra in #4942
• Update plugin com.gradle.develocity to v4.5.0 by @renovate-bot in #4938
• Update dependency org.keycloak:keycloak-admin-client to v26.0.10 - autoclosed by @renovate-bot in #4937
• Fix debug log credential exposure in Python CLI by @venkateshwaracholan in #4772
• [Python CLI] Secure profile secret handling and config storage by @venkateshwaracholan in #4770
• perf: remove redundant exists check before deleteFile (saves cloud API calls) by @vigneshio in #4928
• Build/nit: Fix minor build script warning by @snazy in #4946
• Spark tests: add logback-test.xml and remove spurious log managers by @adutra in #4948
• Rat plugin: exclude .agents and .claude folders by @adutra in #4947
• Feat: Add OSI semantic-model API scaffolding by @flyrain in #4816
• Update docker.io/prom/prometheus Docker tag to v3.13.0 by @renovate-bot in #4949
• Add support for http histogram buckets by @MonkeyCanCode in #4921
• Update cockroachdb/cockroach Docker tag to v26.2.3 by @renovate-bot in #4951
• Update dependency io.quarkus.platform:quarkus-bom to v3.37.1 by @renovate-bot in #4950
• Fix async task retry when handlers return false by @vigneshio in #4914
• Update github/codeql-action action to v4.36.3 by @renovate-bot in #4955
• Update log4j2 monorepo to v2.26.1 by @renovate-bot in #4957
• fix: PolarisEventMetadata eventId() returns different UUID on each call. by @markmckeown in #4956
• Add session policy parameter to SigV4 connections by @ayushtkn in #4954
• Update docker.io/openpolicyagent/opa Docker tag to v1.18.2 by @renovate-bot in #4959
• Update azure/setup-helm action to v5.0.1 by @renovate-bot in #4875
• Update dependency org.agrona:agrona to v2.5.0 by @renovate-bot in #4964
• feat(cli): support custom IRC base URIs via --catalog-url by @vigneshio in #4936
• chore: apply ruff formatting (follow-up to #4936) by @vigneshio in #4960
• Update alpine/curl Docker tag to v8.21.0 by @renovate-bot in #4967
• fix(build): restore task dependency for Spark bundle jar Maven publication by @adnanhemani in #4876
• Update dependency io.smallrye.config:smallrye-config-core to v3.18.0 by @renovate-bot in #4968
• Update amazon/aws-cli Docker tag to v2.35.15 by @renovate-bot in #4976
• Migrate core serialization helpers to Jackson 3 by @snazy in #4910
• Update zizmorcore/zizmor-action action to v0.5.7 by @renovate-bot in #4848
• Update dependency com.gradleup.shadow:shadow-gradle-plugin to v9.5.0 by @renovate-bot in #4977
• Update dependency com.gradleup.shadow:shadow-gradle-plugin to v9.5.1 by @renovate-bot in #4980
• Moved site-guides.yml into ci.yml by @MonkeyCanCode in #4971
• Fix no-op assertion in ContentIdentifier index-key round-trip test by @anxkhn in #4979
• Cleanup metadata files on transaction failure by @ayushtkn in #4934
• Update dependency org.postgresql:postgresql to v42.7.13 by @renovate-bot in #4985
• fix(build): make semantic models OpenAPI generation cacheable by @adam-christian-software in #4982
• Update to correct URL for ProductionReadinessChecks.java by @MonkeyCanCode in #4988
• Mark OSI semantic-model API as beta by @flyrain in #4983
• fix: render diagnostic extra info in PolarisDiagnostics.fail messages by @anxkhn in #4990
• Update dependency org.mongodb:mongodb-driver-sync to v5.9.0 by @renovate-bot in #4994
• Removed pinned version for org.graalvm.shadowed:icu4j by @MonkeyCanCode in #4989
• fix(regtests): make sed in-place edit in setup.sh portable to BSD/macOS by @anxkhn in #4969
• CLI: Exclude .keep from package by @MonkeyCanCode in #4986
• Core: Validate default-base-location against storage config on catalog update by @visit2rahul in #4422
• Update dependency com.google.cloud:google-cloud-storage-bom to v2.70.0 by @renovate-bot in #4999
• Update dependency com.google.cloud:google-cloud-iamcredentials to v2.94.0 - autoclosed by @renovate-bot in #4998
• Update ranger.graalvm to v25.1.3 by @renovate-bot in #4943
• Remove outdated workaround from AbstractLocalIcebergCatalogViewTest by @nandorKollar in #4965
• Update actions/setup-java action to v5.5.0 by @renovate-bot in #4997
• Migrate NoSQL serialization to Jackson 3 by @snazy in #4854
• runtime: Auth Refactor - Update CatalogHandlers and PolarisAdminService to use resolveAuthorizationInputs by @sungwy in #4356
• Update dependency org.projectnessie.cel:cel-bom to v0.6.2 by @renovate-bot in #5006
• Update github/codeql-action action to v4.37.0 by @renovate-bot in #5008
• Fix infinite loop from non-positive TABLE_METADATA_CLEANUP_BATCH_SIZE by @vigneshio in #4970
• Update dependency io.quarkus.platform:quarkus-bom to v3.37.2 by @renovate-bot in #5009
• Fix data corruption via premature metadata deletion in commitTransaction by @vigneshio in #4920
• Fix default location prefix config docs by @flyrain in #5010
• Add catalog config endpoint registry by @adam-christian-software in #4926
• Update jackson monorepo by @renovate-bot in #5001
• Update dependency mypy to >=2.2, <=2.2.0 by @renovate-bot in #5000
• Fix typo in the release 4 step by @jbonofre in #5002
• Make spotless-config nicer to Gradle config-cache by @snazy in #5007
• Update download links for 1.6.0 release by @jbonofre in #5015
• Update quay.io/keycloak/keycloak Docker tag to v26.7.0 by @renovate-bot in #5016
• Update dependency ch.qos.logback:logback-classic to v1.5.38 by @renovate-bot in #5017
• Update dependency com.github.dasniko:testcontainers-keycloak to v4.3.0 by @renovate-bot in #5018
• Eliminate double existence checks in batch file cleanup by @ayushtkn in #5005
• Make OPA file-based bearer token timing configurable by @iting0321 in #4972
• Fix catalog create secret cleanup by @iting0321 in #4974
• Fix ALLOW_EXTERNAL_METADATA_FILE_LOCATION is not overridable at catalog level by @ayushtkn in #4966
• CLI: Update apache polairs cli version in uv.lock by @MonkeyCanCode in #4987
• test: wait for async refresh events in testEventsAreEmitted by @vigneshio in #5022
• Fix ManifestFileCleanupTaskHandler to handle delete manifests by @yassbibi in #4941
• Add bare ADLS vended credential keys for PyIceberg compat by @iprithv in #4991
• Bump version to 1.7.0-SNAPSHOT following the 1.6.0 release by @dimas-b in #5021
• Make admin tool bootstrap idempotent for already-bootstrapped realms by @sepandr in #4996
• Update actions/stale action to v10.4.0 by @renovate-bot in #5026
• Update docker.io/prom/prometheus Docker tag to v3.13.1 by @renovate-bot in #5028
• Implement entity-property idempotency for createTable by @huaxingao in #4912
• Core: include missing privilege and target entity in PolarisAuthorizer 403 messages by @iprithv in #4406
• Update dependency com.puppycrawl.tools:checkstyle to v13.8.0 by @renovate-bot in #5046
• Update dependency org.junit:junit-bom to v6.1.2 by @renovate-bot in #5047
• Update amazon/aws-cli Docker tag to v2.35.21 - autoclosed by @renovate-bot in #5048
• Update dependency com.auth0:java-jwt to v4.6.0 by @renovate-bot in #5049
• Remove schema version option from admin bootstrap command by @flyrain in #5044
• Update dependency mypy to >=2.3, <=2.3.0 by @renovate-bot in #5051
• Update changelog.md by @MonkeyCanCode in #5042
• Update actions/setup-node action to v7 by @renovate-bot in #5056
• Consolidate PolarisStorageConfigurationInfo retrieval by @XN137 in #5030
• fix(authz): include realm identifier in OPA authorization input for tenant isolation by @vigneshio in #4992
• Service: Make default table/view locations unique by @flyrain in #4606
• Fix SPDX expression for python license by @MonkeyCanCode in #5059
• Propagate storage HTTP client settings to S3FileIO for table operations by @iprithv in #5004
• Update mcr.microsoft.com/azure-storage/azurite Docker tag to v3.36.0 by @renovate-bot in #5062
• Eliminate redundant metastore lookups when resolving principal roles by @ayushtkn in #5020
• Avoid fetching full entity rows in lookupEntityVersions by @ayushtkn in #5038
• [opa] Correlate OPA server log with Polaris requestId; add observability for non-200 errors from OPA server by @gracechen09 in #5011
• Support opt-in idempotency for updateTable in the Iceberg REST catalog by @huaxingao in #5037
• Update dependency io.smallrye.config:smallrye-config-core to v3.18.1 by @renovate-bot in #5067
• Update dependency io.quarkus.platform:quarkus-bom to v3.37.3 - autoclosed by @renovate-bot in #5065
• Update dependency org.keycloak:keycloak-admin-client to v26.0.11 - autoclosed by @renovate-bot in #5064
• Add missing idempotency generated docs by @adutra in #5069
• Update dependency org.apache.spark:spark-sql_2.12 to v3.5.9 by @renovate-bot in #5071
• Update apache/ozone Docker tag to v2.2.0 by @renovate-bot in #5072
• Update dependency com.gradleup.shadow:shadow-gradle-plugin to v9.6.0 by @renovate-bot in #5073
• Fix Verify configuration reference CI step by @adutra in #5074
• Update actions/setup-java action to v5.6.0 by @renovate-bot in #5075
• Update the DOAP file by @ayushtkn in #5076
• Change TaskHandler.handleTask to void for clearer success/failure contract [follow-up to #4914] by @vigneshio in #4962
• Clean up orphan metadata files on failed table/view commits by @ayushtkn in #5057
• perf(persistence): bound JDBC hasChildren existence check with LIMIT by @anxkhn in #4973
• Deprecate external table location flag by @flyrain in #5012
• Fix ManifestFileCleanupTaskHandlerTest by @dimas-b in #5080
• fix(catalog): encode default table locations with UTF-8 by @anxkhn in #4975
• Ensure TreeMapMetaStore range reads return copies by @iting0321 in #5027
• CLI add supports for non-http scheme by @MonkeyCanCode in #5043
• Add Floci testcontainers for AWS/GCP/Azure by @snazy in #5061
• Update github/codeql-action action to v4.37.1 by @renovate-bot in #5077
• Fix JDBC hasChildren fetching all rows and columns by @ayushtkn in #5066
• Move CatalogConfigEndpointContributor to runtime/service by @dimas-b in #5052
• Remove unused IdempotencyStore and idempotency_records table by @huaxingao in #5086
• Remove unused gcs and azurite testcontainer modules by @snazy in #5083
• Migrate AwsCloudWatchEventListenerTest from localstack to floci by @snazy in #5081
• Update dependency io.smallrye.common:smallrye-common-annotation to v2.20.0 by @renovate-bot in #5103
• Update docker.io/jaegertracing/jaeger Docker tag to v2.20.0 by @renovate-bot in #5104
• Update trinodb/trino Docker tag to v483 - autoclosed by @renovate-bot in #5106
• Update dependency com.github.dasniko:testcontainers-keycloak to v4.3.1 - autoclosed by @renovate-bot in #5102
• Update actions/setup-python action to v7 - autoclosed by @renovate-bot in #5105
• Update cockroachdb/cockroach Docker tag to v26.2.4 by @renovate-bot in #5079
• Update zizmorcore/zizmor-action action to v0.6.0 - autoclosed by @renovate-bot in #5063
• Move testcontainer modules to tools/testcontainers/ by @snazy in #5100
• Update quay.io/ceph/ceph Docker tag to v21 by @renovate-bot in #5108
• Add Polaris Community Meeting 2026-07-09 by @jbonofre in #5025
• feat(persistence): replace EventEntity.REALM_SCOPED sentinel with nullable catalog_id by @sririshindra in #4981
• Update actions/checkout action to v7.0.1 by @renovate-bot in #5109
• Move Keycloak testcontainers to new module and remove admin client by @adutra in #5107
• Improve register-table test coverage by @snazy in #5111
• Clarify principal role selection semantics by @snazy in #5112
• Align token exchange scope handling by @snazy in #5113
• Validate locations when registering tables and views by @snazy in #5114
• Fix purgeRealms in LocalPolarisMetaStoreManagerFactory does not clear entityCacheMap by @ayushtkn in #4803
• Fix Python CLI table command exit codes by @mattfaltyn in #5091
• Minor update to management service spec by @snazy in #5110
• Validate Iceberg metadata locations during table updates by @snazy in #5115
• Refactor PolarisPrincipal to contain generic attributes by @adutra in #5085
• Update github/codeql-action action to v4.37.2 by @renovate-bot in #5121
• Update dependency jupyterlab to v4.6.2 by @renovate-bot in #5120
• Relocate commitTransaction metadata cleanup tests out of CommitTransactionEventTest by @sririshindra in #5041
• Advertise idempotency-key-lifetime in GET /v1/config by @huaxingao in #5118
• refactor(metrics): relocate Iceberg metrics write path to extensions with enveloped core SPI (PR0 of 3) by @obelix74 in #5068
• Add Floci S3 runtime-service integration tests by @snazy in #5101
• Update dependency pre-commit to v4.6.1 by @renovate-bot in #5124
• Update dependency com.gradleup.shadow:shadow-gradle-plugin to v9.6.1 by @renovate-bot in #5125
• Update github/codeql-action action to v4.37.3 by @renovate-bot in #5126
• Return HTTP 503 on concurrent rename instead of 500 by @vigneshio in #4646
• Update dependency ch.qos.logback:logback-classic to v1.6.0 by @renovate-bot in #5133
• Avoid fetching full entity rows in lookupEntityGrantRecordsVersion by @flyingImer in #5078
• fix(catalog): preserve metadata location when using snapshots=refs by @flyingImer in #5116
• Update docker.io/mongo Docker tag to v8.3.7 by @renovate-bot in #5132
• Clean up and document vended credential properties by @adutra in #5070
• Fix view grants on federated catalogs by @ayushtkn in #5096
• Update dependency com.azure:azure-sdk-bom to v1.3.8 by @renovate-bot in #5136
• Update dependency io.quarkus.platform:quarkus-bom to v3.37.4 by @renovate-bot in #5130
• Update dependency org.mongodb:mongodb-driver-sync to v5.9.1 by @renovate-bot in #5131
• Let NoSqlCatalogIT use Floci by @snazy in #5117
• Update dependency org.projectnessie.cel:cel-bom to v0.8.0 by @renovate-bot in #5142
• fix(admin) - centralize drop-failure error mapping and fix misleading messages by @vigneshio in #4793
• Set 'Retry-After' header when table rename fails with a concurrent modification error by @nandorKollar in #5144
• Fix setup apply failure exit status by @mattfaltyn in #5098
• Update zizmorcore/zizmor-action action to v0.6.1 by @renovate-bot in #5137
• Extension for publishings events to Kafka by @markmckeown in #4923
• Update dependency io.floci:testcontainers-floci to v2.12.0 by @renovate-bot in #5148
• Update apache/spark Docker tag to v3.5.9 by @renovate-bot in #5149
• Update docker.io/apache/spark Docker tag to v4.0.4 - autoclosed by @renovate-bot in #5150
• Fix JDBC writeEntities issuing a wasteful full-row lookup per entity by @ayushtkn in #5134
• CLI: Fix typo in tests by @MonkeyCanCode in #5159
• CLI: Remove print statements in tests by @MonkeyCanCode in #5158
• CLI: Fix dead code by @MonkeyCanCode in #5157
• CLI: Consistent error message during value error by @MonkeyCanCode in #5156
• CLi: handle null/blank catalog type by @MonkeyCanCode in #5153
• Update dependency com.puppycrawl.tools:checkstyle to v13.9.0 by @renovate-bot in #5164
• Update amazon/aws-cli Docker tag to v2.36.8 - autoclosed by @renovate-bot in #5163
• Introduce AttributeMap interface by @adutra in #5139
• CLI: Update pre-commit hooks version by @MonkeyCanCode in #5151
• Follow-up polish to the createTable/updateTable idempotency work. by @huaxingao in #5122
• Site: Add Google Calendar link to community meetings page by @jbonofre in #5165
• fix: return full commit log when a commit tail is shorter than the fetch page by @anxkhn in #5040
• CLI: Improve client cleanup in Makefile by @MonkeyCanCode in #5160
• Update dependency io.floci:testcontainers-floci to v2.13.0 by @renovate-bot in #5169
• Update dependency com.diffplug.spotless:spotless-plugin-gradle to v8.9.0 - autoclosed by @renovate-bot in #5168
• Update actions/stale action to v11 by @renovate-bot in #5173
• Add Floci GCS+ADLS smoke tests to polaris-runtime-service by @snazy in #5143

New Contributors

• @findinpath made their first contribution in #4849
• @hkwi made their first contribution in #4836
• @markmckeown made their first contribution in #4956
• @anxkhn made their first contribution in #4979
• @yassbibi made their first contribution in #4941
• @iprithv made their first contribution in #4991
• @sepandr made their first contribution in #4996
• @gracechen09 made their first contribution in #5011

Full Changelog: apache-polaris-1.6.0...apache-polaris-1.7.0