We’re introducing Stackable Data Platform 26.7 – a different release built entirely on what usually gets postponed: the flaky test everyone works around, the CI pipeline that should be more resilient, the code we always meant to clean up. There was always something more urgent to ship. So for 26.7, beyond what we’d already committed to customers, we started no new product features. Instead, the whole team was freed up to work on quality, stability, and the groundwork that makes the next releases easier to build on.
The platform didn’t stand still, though. Upstream upgrades land as always – Apache Druid 37.0.0, Apache NiFi 2.9.0, Trino 481, Apache Superset 6.1.0, OpenSearch 3.6.0, Open Policy Agent 1.16.2, and Apache Airflow 3.2.2 among them. Some of these bring new features worth calling out:
- Apache Airflow’s new experimental Multi-team Deployments let multiple isolated teams share a single deployment, each with its own DAGs, connections, variables, pools, and executors.
- OpenSearch ships vector search improvements – 1-bit Scalar Quantization for up to 32x compression, vector search prefetch for up to 50% lower latency, and FP16 throughput gains of up to 58%.
- Apache Superset’s MCP (Model Context Protocol) service expands, giving AI assistants a structured, authenticated way to preview chart updates, create virtual datasets on the fly, and discover database schemas and connections.
- Trino adds Iceberg v3 table support, including row lineage and column default values, alongside an experimental variant type. Details on all of these are in the product version table below.
Several improvements ship as well: SDP artifacts (including operator Helm Charts) now published directly to quay.io from our CI, dynamic image repositories for air-gapped and mirrored registries, a generic database connection mechanism across multiple operators, and config hot-reloading for selected products. On the supply chain security front, all Stackable container images now ship with SLSA build provenance and SPDX SBOMs – see below.
We’re also launching the Stackable Hub, a public, always-current reference for every SDP release, component, and CRD – for people and for tooling.
This release resolves 133 vulnerabilities across the platform and supports Kubernetes 1.31 to 1.36 as well as Red Hat OpenShift 4.18 to 4.22.
New Platform Features
General
- Artifacts on quay.io: SDP artifacts are now published to quay.io directly from our CI pipelines. Previously only the operator and product container images were available there, manually mirrored from oci.stackable.tech, with operators defaulting to pulling product images from oci.stackable.tech. Now the operator Helm Charts are published to quay.io as well – and installing them automatically instructs the operators to pull their product images from quay.io. The repository layout was adjusted accordingly (it mirrors the oci.stackable.tech layout) and applies to releases from 26.7 onwards; earlier releases are unaffected. See the artifact registries page for details.
- Dynamic Image Repositories: Operators can now be pointed at custom or mirrored image registries, rather than assuming a fixed source. This is a significant step for air-gapped and tightly controlled enterprise environments, where every image has to come from an approved internal registry.
⚠️ This is a breaking change – review your image configuration before upgrading. See the air-gapped operation guide. - Generic Database Connection Mechanism: A single, shared way to configure database connections, now used consistently across Apache Airflow, Apache Druid, Apache Hive, and Apache Superset. Less per-operator special-casing, one pattern to learn. See the database connection guide.
Trino
- PostgreSQL Connector, first-class: The Stackable operator for Trino now offers dedicated, first-class support for PostgreSQL catalogs, replacing the previous generic-connector workaround. See the usage guide.
Apache Superset
- Asynchronous queries via Celery: Apache Superset can now run queries asynchronously through Celery. Two new roles,
workerandbeat(limited to a single replica), have been added, and Redis is supported as the broker queue and results backend. See the async queries via Celery documentation page.
Stackable Secret Operator
- Configurable ca.crtname in the TrustStore and support for Domain Components (DCs) in the subject DN of generated TLS certificates – useful for organizations whose PKI conventions expect them. See secret operator.
OIDC
- OIDC
clientAuthenticationMethod: OIDC integrations can now specify the client authentication method, giving more control over how operators authenticate against identity providers.
Smaller, but user-visible
- Git-sync – First-class CA support for Apache Airflow and Apache NiFi via managed fields, eliminating the need for manual volume mounts and pod overrides when syncing against Git servers with self-signed or internal CAs.
- Apache Spark on Kubernetes – graceful shutdown on SIGTERM, allowing running Spark jobs to terminate cleanly.
stackablectlcan now uninstall Stacks and Demos, not just install them. See here for more information.- OPA –
configOverridesforconfig.json, allowing fine-grained control over the OPA configuration file.
Platform Improvements
Alongside a large amount of internal work on test reliability and CI resilience that does not surface directly to users, the following changes are implemented with the new release:
General
- RBAC hardening: A least-privilege cleanup across all operators, with the resulting RBAC now documented. No action required, but the security posture is tighter.
- ⚠️ Graduating experimental features (breaking config rename): As several experimental features become permanent, their configuration keys lose the EXPERIMENTAL_ prefix. EXPERIMENTAL_FILE_HEADER / EXPERIMENTAL_FILE_FOOTER are renamed in the Apache Airflow and Apache Superset configuration, and the EXPERIMENTAL_ prefix is dropped in the operator framework. Update your configuration before upgrading.
- ⚠️ Apache Airflow – Celery config moved: For deployments using Celery executors, the broker and results backend have moved into
clusterConfig:spec.celeryExecutors.resultBackendis nowspec.clusterConfig.celeryResultsBackend, andspec.celeryExecutors.brokeris nowspec.clusterConfig.celeryBroker. Update your CRDs before upgrading.
Config Hot-Reloading
- Selected configuration can now be reloaded without restarting the affected Pods – currently the OpenSearch security configuration and Trino password files. In addition, the OPA daemonset now uses maxSurge so that configuration changes no longer cause downtime.
Supply Chain Security
SLSA Build Provenance for all container images. SLSA (Supply-chain Levels for Software Artifacts) is a security framework: a checklist of standards and controls to prevent tampering, improve integrity, and secure the packages and infrastructure in a project or organization.
Every Stackable container image – both product images and operator images – is now published with SLSA build provenance attestations. The provenance is generated with the slsa-github-generator trusted builder, meeting the requirements of SLSA Level 3, and is signed keylessly and attached to the images in our OCI registry.
In practice, this means the build isn’t just something Stackable asserts: the provenance is produced by an independent, trusted builder rather than by us, so you can cryptographically verify that an image was genuinely built by Stackable’s CI from the published source code. A concrete addition to our fully traceable software supply chain, and directly relevant for regulated environments.
In addition, every image now also ships with an SBOM in the SPDX format, attested to the image, alongside the existing CycloneDX SBOMs. See the SBOM guide in our docs for how to verify and extract them.
See the new provenance verification guide in our docs for the step-by-step process. This complements the existing guides for verifying SBOMs and verifying image signatures.
New Product Versions
The following product versions are new or updated in SDP 26.7 (full list here). Only products whose shipped version changed are listed.
| Product | New version/s | What’s new? |
|---|---|---|
| Airflow | 3.2.2- | – Asset Partitioning – schedule downstream processing on specific data partitions, so only affected partitions trigger downstream work (AIP-76). – Multi-team Deployments (experimental) – multiple isolated teams in one deployment, each with its own DAGs, connections, variables, pools, and executors (AIP-67). – Deadline Alerts with synchronous callbacks (experimental) – new SyncCallback executed by the executor. – Async PythonOperator callables (#60268)– structured JSON logging for the API server – triggerer hang detection with a new watchdog. ⚠️ SMTP certificate validation enforced by default – send_email now validates the server certificate during STARTTLS; self-signed setups must set email.ssl_context = "none".⚠️ Search changed to prefix matching in REST API/UI – use the “Match anywhere” toggle to restore substring search. ⚠️ Deserialization patterns now full-match – prefix-based allowed_deserialization_classes_regexp patterns must add .* .⚠️ /dags endpoint authorization tightened – now also requires read access to DAG Runs, Task Instances and HITL Details; update custom roles. ⚠️ uses Python 3.14 |
| Druid | 37.0.0 | – Query Blocklist – dynamically block queries by datasource, type, or context via the Broker API without a restart. – Multi-supervisor ingestion (GA) and Kubernetes-based task management (GA). – ReadOnly authorizer – global restriction on all non-READ operations. – Cost-based autoscaling for streaming ingestion; cgroup v2 support. ⚠️ Hadoop-based ingestion removed (deprecated in 34). ⚠️ Streaming parser / ParseSpec removed – use inputSource/inputFormat.⚠️ Auto-compaction requires the incremental segment metadata cache ( druid.manager.segments.useIncrementalCache set to ifSynced/always).⚠️ AWS SDK upgraded to v2. |
| HBase | 2.6.6 | Patch releases – mostly bug and security fixes. – Security: lz4-java fixed to 1.10.1, addressing CVE-2025-12183 and CVE-2025-66566. – New per-column-family storeFileSize JMX gauge – CacheAwareLoadBalancer placement improvements.⚠️ Default RPC callqueue length changed (HBASE-29141) – now ~10× the number of RPC handlers (was handlers²); re-check queue sizing if previously tuned. No config action strictly required. |
| Phoenix | 5.3.1 | – Eventually Consistent Global Secondary Indexes (PHOENIX-7794). – REGEXP_LIKE built-in function. – Multi-row constructors in a single UPSERT. – PhoenixSyncTable data-validation tool to validate table data between clusters. |
| Hadoop (HDFS) | 3.4.3, 3.5.0 | 3.4.3 – no new HDFS features – bug/dependency/security patch (LZ4 switched to at.yawk.lz4 for CVE-2025-12183).3.5.0 (new minor line) – NameNode fine-grained locking, Phase I (HDFS-17384) – RBF asynchronous router RPC (HDFS-17531) – RBF leader-follower mount table mode – Google Cloud Storage connector via gs://.⚠️ Java 17 required server-side (client supports 17 and 21) – primary migration item. ⚠️ Rolling-upgrade caveat from Hadoop 2.10.x clients requires a two-step upgrade. ⚠️ OpenSSL 3 native libs require GLIBC 2.34+ (not RHEL 8 compatible) – fall back to JVM SSL there. ⚠️ protobuf-2.5.jar no longer bundled; Guava bumped; cloud connectors relocated. Multiple dependency CVE fixes (Jetty, Avro, LZ4). |
| Hive | 4.2.0 | New LTS version. |
| Kafka | 3.9.2, 4.2.1 (experimental) | 3.9.2 – bug-fix/security patch – opt-in alter.config.policy.kraft.compatibility.enable (KIP-1252) to align AlterConfigPolicy between ZooKeeper and KRaft. 4.2.1 (experimental in SDP) – Kafka Queues (Share Groups) production-ready (KIP-932) – Kafka Streams server-side rebalance protocol (GA, limited) – Streams dead-letter-queue support – standardized CLI arguments across tools – Java 25 support. Dependency CVE fixes (Jetty, Jackson, native-image). ⚠️ Behaviour change: controller quorum voters fall back to advertised listeners if not explicitly defined (KAFKA-20380) – review before upgrading. Deprecations: ConsumerGroupMetadata constructors, MX4j, BrokerNotFoundException. |
| NiFi | 2.9.0 | – Initial Connectors support – first release introducing the new Connectors capability. Iceberg on Google Cloud Storage. – ConsumeKinesiswithout KCL – Kinesis Client Library dependency removed. – AWS Secrets Manager Parameter Tags – Record Gauge support + UpdateGauge processor – ForkRecord schema inheritance.⚠️ NiFi Registry deprecated – use the git-based Flow Registry Clients (GitHub/GitLab); removal planned for 3.0. ⚠️ Jolt library migration – JoltTransformJSON/JoltTransformRecord moved to jolt-community; custom transformation JARs must be recompiled.⚠️ Asana components removed. |
| OpenSearch | 3.6.0 | – 1-bit Scalar Quantization – up to 32× vector compression across Faiss and Lucene, with better recall and lower latency. – Vector search prefetch – up to 50% lower latency. – FP16 vector performance – up to 58% throughput improvement. HTTP/3 support. – Six new PPL commands ( mvcombine, mvzip, mvfind, mvmap, addtotals, streamstats) plus PPL result highlighting and query cancellation. – Agentic features: conversation memory, agentic search improvements, token usage tracking. – Query Insights: per-query access control, export to remote S3. – Multiple dependency CVE fixes. ⚠️ Node.js 20 deprecated for 22, and Dashboards React 18 upgrades may affect custom plugins. |
| Spark | 4.1.2 | Maintenance release – security and correctness fixes, no new user-facing features. – Security: Jackson-core upgraded (SPARK-56318,GHSA-72hv-8253-57qq). – Data-correctness fixes worth noting: dynamic partition overwrite wrongly treated as append on HDFS (SPARK-56588); partial clustering in joins corrupting dedup/windowing (SPARK-55848); subqueries on collated tables returning wrong results (SPARK-54852). |
| Superset | 6.1.0 | – New database engine support – MongoDB, Google Cloud Datastore, Apache Phoenix, and Apache IoTDB. – MCP (Model Context Protocol) expansion – chart update preview, create_virtual_dataset, schema discovery, DB connection tools.– Dataset folders editor and automatic datetime-format detection. – SQL execution API and SQL Lab treeview table selection. – OAuth2: single-use refresh tokens, PKCE for DB OAuth2, AWS cross-account IAM for Aurora. – Security: built-in Public role for anonymous dashboards, table blocklist, default hash MD5 → SHA-256. ⚠️ Default hash algorithm MD5 → SHA-256 – invalidates existing cached thumbnails/digests/filter names on upgrade; opt out with HASH_ALGORITHM = "md5".⚠️ ClickHouse: minimum clickhouse-connect >= 0.13.0 – upgrade the driver.⚠️ APP_NAME no longer controls tab title/branding (use theme brandAppName); CUSTOM_FONT_URLS removed (use theme fontUrls). |
| Trino | 481 | – Iceberg v3 table support – create/write/delete, row lineage, column default values (#27786); experimental variant type and timestamp(9). – New NEAREST join clause for approximate matches (#21759). – New number data type. DESCRIBE OUTPUT on inline queries without PREPARE. – DataSketches functions. – wider numeric type support in PostgreSQL / MySQL / MariaDB / Oracle. – JDBC driver transparent OAuth2 token refresh. ⚠️ Legacy object storage support removed for Azure, GCS, IBM Cloud, and S3 / S3-compatible – migrate to native file system support (#24878). ⚠️ Spatial: Esri geometry library replaced with JTS – WKT input must be OGC-compliant. ⚠️ Vertica connector removed. ⚠️ Renamed fs.cache.preferred-hosts-count → node-scheduler.cache-preferred-hosts-count. |
| ZooKeeper | 3.9.5 | Bug-fix/security patch – no user-facing features. Security: – CVE-2026-24308 (config values in ZKConfig could expose sensitive client configuration) and CVE-2026-24281 (ZKTrustManager hostname verification fell back to reverse DNS – reverse-DNS lookup in TLS now disabled) both fixed. – Bundled-dependency CVEs fixed (Netty, Jetty 9.4.58). ssl.clientHostnameVerification now honored with ssl.authProvider=x509– zkpython compatible with Python 3.12. No breaking changes. |
| Open Policy Agent | 1.16.2 | – New built-ins uri.parse and uri.is_valid for RFC 3986 URI parsing/validation; array.flatten. – Logger plugin interface (Go log/slog) with a built-in file logger (rotation, structured JSON)– decision logs routable through logger plugins. – Data API request/response metadata – Prometheus metrics via OTLP/OpenTelemetry – Decision Logger immediateupload trigger mode. – AWS signing Web Identity credentials for Assume Role. ⚠️ CustomHTTPAuthPlugin: NewClient()now called once per Client (cached) – move per-request logic to Prepare().⚠️ TLS inheritance: all TLS configs inherit the server’s minimum TLS version and ciphersuites. Rebuilt with Go 1.26.3 for Go stdlib vulnerabilities. |
Apache Druid support is deprecated
⚠️ Stackable’s support for Apache Druid is deprecated as of SDP 26.7 and planned for removal in SDP 27.11, as we’ve seen little customer demand for it. SDP 26.7 ships Druid 37.0.0 as the final LTS, and 27.7 is planned as the last release to include it. There’s no direct replacement in the SDP – but if you’re willing to fund its continued development, we’re open to reconsidering.
The Stackable Hub
Alongside this release we’re introducing the Stackable Hub – a single, always-current source of truth for what ships in the Stackable Data Platform.
The distinction is simple: docs.stackable.tech tells you how to use SDP; hub.stackable.tech tells you what shipped, when, and in which combination. When you need a quick, authoritative answer – which Apache Kafka version shipped in 25.11? What does the .spec of a TrinoCluster look like in 26.3? – the Hub is where you look.
For humans, it has three browsable surfaces:
- Releases: every SDP release we’ve shipped, with release and end-of-support dates.
- Components: the open-source products in the platform, and the exact version of each bundled in every release.
- CRDs: every custom resource the operators install, with its full
.specschema, browsable per SDP release.
For tooling and machines, everything is also available programmatically:
- A public JSON API: CORS-enabled, no authentication – built for CI pipelines, scripts, and MCP servers. So yes, your CI pipeline can query it directly.
- An llms.txt endpoint: a plain-text summary of the Hub for LLM tooling, so an assistant can pull current SDP facts into context instead of guessing version numbers. To try it out just drop something like this into your llm of choice: “Read https://hub.stackable.tech/llms.txt and tell me which new trino versions are supported in stackable 26.7″
For customers, that means less digging: a reliable place to check compatibility and end-of-support dates before an upgrade, to inspect a CRD schema without deploying anything, and to feed current, accurate SDP facts straight into your own tooling.
stackablectl
Alongside SDP 26.7, stackablectl version number 1.5.0 is available. As noted above, it can now uninstall Stacks and Demos, not just install them. See the release notes.
More Info
Further details on this release and upgrade instructions can be found in the release notes and the changelogs of the individual operators:
Airflow, Druid, HBase, HDFS, Hive, Kafka, NiFi, OpenPolicyAgent, OpenSearch, Spark, Superset, Trino, ZooKeeper