v26.1.8

[tyson-redpanda]

Features

• New configuration: iceberg_rest_catalog_credentials_host: The hostname to connect to for retrieving role-based credentials for the Iceberg REST catalog. May be required when the REST catalog uses a different credentials source than cloud storage — for example, if cloud storage is configured to use STS with a custom credentials host, but the REST catalog uses aws_instance_metadata, this should be set to 169.254.169.254 to prevent the cloud storage host override from applying to catalog credential requests. by @wdberkeley in #30446

Bug Fixes

• Avoid OOM under memory fragmentation when there are many ACLs. by @pgellert in #30401
• Fix Iceberg map columns being unreadable from strict Parquet readers
  (e.g. Apache Spark) due to a missing LogicalType.MAP annotation in
  the written Parquet schema. by @nvartolomei in #30457
• Fix an issue with Clout Topics garbage collection where deleting all cloud topics could leave stale objects in the bucket, forever. by @oleiman in #30283
• Iceberg REST catalog credential refresh requests were sent to the wrong host when cloud_storage_credentials_host was set. The host override intended for cloud storage was applied globally, causing catalog credential fetches to fail if the catalog used a different credentials source with a different expected endpoint. by @wdberkeley in #30446
• Upgraded libxml2 to v2.15.3 to fix CVE-2026-6732 type confusion vulnerability in XSD validation. by @tyson-redpanda in #30393
• #30437 Schema Registry: fixed protobuf compatibility checks incorrectly failing
  with MESSAGE_REMOVED when a map field is removed. by @QueLLL in #30438
• rpk/debug/bundle: dedup admin addresses across host forms by @hidalgopl in #30411
• PR #30313 kafka/server: cap fetch memory allocation at max message size limit by @ballard26

Full Changelog: v26.1.7...v26.1.8

---

This discussion was created from the release v26.1.8.