I'd suggest not merging when there are comments needed to be resolved, here is an open comment: https://github.com/apache/polaris/pull/5246/changes#r4383768595 Yufei
On Wed, Nov 4, 2026 at 3:45 PM Dmitri Bourlatchkov via dev <[email protected]> wrote: > > Hi All, > > Given an extensive review period, I propose merging [5246] on Nov 6. > > Note: this PR does _not_ introduce any behaviour changes. It only prepares > options for stricter authZ in the future. > > Please reply to this thread or comment in GH if you have any concerns. > > Thanks, > Dmitri. > > [5246] https://github.com/apache/polaris/pull/5246 > > On Mon, Nov 2, 2026 at 10:16 AM Dmitri Bourlatchkov <[email protected]> > wrote: > > > Hi Vignesh, > > > > Thanks for promptly addressing the feedback! > > > > I think PR [5246] approaches a mergeable state. > > > > Given that it introduces a migration action for users, which is optional > > in the current code, I think it makes sense to include the PR into the > > upcoming 1.9.0 release. This will enanle working on flipping the flag In > > the following release. > > > > Yufei, Dennis: Please take a look at the latest PR state. > > > > [5246] https://github.com/apache/polaris/pull/5246 > > > > Thanks, > > Dmitri. > > > > > > On Sat, Oct 31, 2026 at 12:11 PM vignesh a <[email protected]> wrote: > > > >> Hi all, > >> > >> Thanks Yufei, Dmitri and JB. I've restacked #5246 [1] > >> > >> Dropped GET_CATALOG_CONFIG_PROPERTIES. That takes out the second > >> authorizer op and the partial-result case Yufei called out, where a > >> client can't tell absent settings from withheld ones. > >> > >> Kept GET_CATALOG_CONFIG behind ENFORCE_CATALOG_CONFIG_AUTHORIZATION > >> (default false), as Dmitri asked. That covers the /config AuthZ gap as > >> of 1.8.0, and existing deployments keep today's behaviour. > >> > >> Once that check passes, the response still returns catalog properties > >> as it does today. > >> > >> CHANGELOG says the default is not flipping until the client-facing > >> config follow-up is settled, as JB asked. Client-facing vs server-only > >> properties can stay in its own thread. > >> > >> PR is updated now. PTAL > >> > >> Thanks, > >> *Vignesh* > >> > >> [1] https://github.com/apache/polaris/pull/5246 > >> > >
