Hi All, Given an extensive review period, I propose merging [5246] on Nov 6.
Note: this PR does _not_ introduce any behaviour changes. It only prepares options for stricter authZ in the future. Please reply to this thread or comment in GH if you have any concerns. Thanks, Dmitri. [5246] https://github.com/apache/polaris/pull/5246 On Mon, Nov 2, 2026 at 10:16 AM Dmitri Bourlatchkov <[email protected]> wrote: > Hi Vignesh, > > Thanks for promptly addressing the feedback! > > I think PR [5246] approaches a mergeable state. > > Given that it introduces a migration action for users, which is optional > in the current code, I think it makes sense to include the PR into the > upcoming 1.9.0 release. This will enanle working on flipping the flag In > the following release. > > Yufei, Dennis: Please take a look at the latest PR state. > > [5246] https://github.com/apache/polaris/pull/5246 > > Thanks, > Dmitri. > > > On Sat, Oct 31, 2026 at 12:11 PM vignesh a <[email protected]> wrote: > >> Hi all, >> >> Thanks Yufei, Dmitri and JB. I've restacked #5246 [1] >> >> Dropped GET_CATALOG_CONFIG_PROPERTIES. That takes out the second >> authorizer op and the partial-result case Yufei called out, where a >> client can't tell absent settings from withheld ones. >> >> Kept GET_CATALOG_CONFIG behind ENFORCE_CATALOG_CONFIG_AUTHORIZATION >> (default false), as Dmitri asked. That covers the /config AuthZ gap as >> of 1.8.0, and existing deployments keep today's behaviour. >> >> Once that check passes, the response still returns catalog properties >> as it does today. >> >> CHANGELOG says the default is not flipping until the client-facing >> config follow-up is settled, as JB asked. Client-facing vs server-only >> properties can stay in its own thread. >> >> PR is updated now. PTAL >> >> Thanks, >> *Vignesh* >> >> [1] https://github.com/apache/polaris/pull/5246 >> >
