DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
The release is compatible with these versions of the various components:
- Java: JDK 8
- Python3: 3.10+ (Ranger server and tools); apache-ranger PyPI client 0.0.13 requires Python 3.13+; Ranger Performance Analyser supports Python 3.11
- Databases [Ranger and Ranger KMS]:
- MariaDB: 10.7.3
- Postgres: 13.16
- Oracle: 23.6
- Apache Hadoop: 3.4.2
- Apache Kafka: 3.9.1
- Apache Ozone: 2.1.1
- Apache Solr: 8.11.3
- Apache Tomcat (embedded): 9.0.115
IMPROVEMENT
| Issue | Summary |
|---|---|
| RANGER-3899 | Policy creation takes more time when there are more users,groups,roles |
| RANGER-4910 | Develop Apache Ranger Plugin for Polaris to Enhance Access Control for Apache Iceberg |
| RANGER-5371 | module: Ranger PDP server |
| RANGER-5493 | Update tomcat to 9.0.115 |
| RANGER-5499 | Support header based authentication |
| RANGER-5505 | update RangerEmbeddedAuthorizer to support caller provided audit handler |
| RANGER-5515 | remove javax.servlet-api depedency in agents-common module |
| RANGER-5516 | update commons-configuration2 library version from 2.8.0 to 2.13.0 |
| RANGER-5517 | remove unnecessary dependency on ranger-plugins-common |
| RANGER-5519 | introduce ranger-common-utils module |
| RANGER-5522 | update tagsync to process Atlas notifications for Trino entities |
| RANGER-5523 | replace jersey-bundle dependency with jersey-client and jersey-core |
| RANGER-5529 | update RangerAuthorizer methods to be REST friendly |
| RANGER-5532 | Ranger Performance Analyser: Python 3.11 Support and Enhancements |
| RANGER-5539 | Add Authorisation Check for doAsUser Parameter |
| RANGER-5546 | Polaris service-def update to rename resource root to realm-identifier |
| RANGER-5549 | replace use of com.kstruct.gethostname4j library |
| RANGER-5550 | introduce authz-remote library to support thin client integration for plugins |
| RANGER-5564 | update RangerAuthzConfig to support properties from plugin configuration files |
| RANGER-5600 | Bump org.apache.avro:avro from 1.11.4 to 1.11.5 |
| RANGER-5601 | Bump urllib3 to 2.7.0 and requests from 2.32.5 to 2.33.0 |
| RANGER-5604 | Bump org.glassfish.jersey.core:jersey-client from 2.22.1 to 2.47 in /plugin-schema-registry |
| RANGER-5614 | Role creation/updation takes more time when there are more users,groups,roles |
| RANGER-5617 | Set PDP header authn cfg values to null |
| RANGER-5627 | support configuration-based super users and super groups in Ranger Admin |
| RANGER-5628 | Support for actions in Ozone Service Definition: Ozone STS action-based policy evaluation (RangerActionMatcher, RangerActionListMatcher), action-matches policy condition, Admin UI support on permission rows, DB patch PatchForOzoneServiceDefPolicyConditionUpdate_J10065, and Ozone dependency bump to 2.1.1 |
| RANGER-5639 | Upgrade bouncycastle to 1.84 |
| RANGER-5653 | Release apache-ranger Python client 0.0.13 with Python 3.13+ support |
| RANGER-5667 | Follow-on for RANGER-5628: deny requests missing s3Action when policy has action-matches restrictions, treat whitespace-only action lists as unrestricted, avoid unnecessary allocation in RangerActionMatcher, and fix Ozone policy UI crash when adding Allow/Deny conditions |
| Enhance Ranger lookup API input validation |
BUG
| Issue | Summary |
|---|---|
| RANGER-5407 | In Atlas Service for some of the default policies wrong permissions seen |
| RANGER-5463 | UserStore version not updated when group-user mappings are modified via UserSync |
| RANGER-5501 | missing accessType in audit logs generated by RangerEmbeddedAuthorizer |
| RANGER-5502 | Upgrade Netty to 4.1.130.Final to address CVEs |
| RANGER-5508 | fix Runtime.exec parameters |
| RANGER-5526 | Security Zone creation fails with tag service due to NonUniqueResultException |
| RANGER-5530 | [KMS]: dev_kms TestConnection from keyAdmin UI is failing after Kerberos implementation |
| RANGER-5538 | username set incorrectly |
| RANGER-5552 | Remove mvn repo for Apache Ozone in pom.xml |
| RANGER-5567 | allow validateConfig API available only for users with Ranger admin role |
| RANGER-5579 | add validation to DefaultSchemaRegistryClient createUrlSelector method |
| RANGER-5623 | UI Inconsistency: Groups tab userlist fails to reflect updated user-group mapping after successful PUT /xusers/groupusers request |
| RANGER-5624 | Inconsistent masking of updatedBy field in /xusers/groups/groupName/{group_name} API compared to /xusers/groups/{id} |
| RANGER-5629 | Harden GraalJS engine configuration used for policy condition (_expression) evaluation |
| RANGER-5634 | CTAS & Temporary-Table queries from Hive bypass UDF Select authorization |
| RANGER-5635 | ranger.admin.allow.unauthenticated.download.access is honored only when Kerberos is enabled |
| RANGER-5647 | Tag policy test fixtures, path matcher fix, and ISO EXPIRES_ON tag test dates to ranger-2.9 |
| RANGER-5648 | Solr authorization fails with NPE |
| Standardize TLS hostname verification across Ranger HTTP clients using a uniform verifier | |
| UnixAuth service lacks rate limiting on authentication attempts | |
| RangerJwtAuthHandler logs full JWT bearer token on validation failure | |
| Add feature flag for work in RANGER-5628 |
TASK
| Issue | Summary |
|---|---|
| RANGER-5490 | Update webpack version from 5.94.0 to 5.105.1 |
| RANGER-5491 | Update axios version from 1.12.2 to 1.13.5 |
| RANGER-5518 | Upgrade underscore.js from 1.13.6 to 1.13.8 |
| RANGER-5569 | Updating library dependencies in Ranger Admin React package-lock.json |
| RANGER-5605 | Fix Ranger build failure when triggered through Docker |
| RANGER-5638 | Upgrade handlebars to 4.7.9 |
| RANGER-5657 | Limit getAllModuleNames() to sys-admin sessions in SessionMgr |
| RANGER-5658 | Tag Sync: remove atlas.kafka.zookeeper.connect and fix Atlas Kafka consumer for Kafka 3.9 |
| Refactor policy condition rendering component to ensure layout stability | |
| KMS secure download APIs: align Tags and Userstore with Policy/Roles — use getServiceByNameForDP() instead of getServiceByName() | |
| Default access audit store to Solr | |
| RANGER-5637 | Ranger CI: fix plugins-docker-build (Ozone smoke-test failures) |
| RANGER-5640 | Align Ranger Ozone Docker with Ozone 2.1 |
| Fix Trino/Ozone plugin auth in ranger-docker (Kerberos keytabs,policy download auth, Solr audit JAAS for Ozone) | |
| RANGER-5716 | Fix swapped client IP and resource in KMS Ranger audits |
| PDP server logs NoClassDefFoundError for GsonBuilder — gson JAR missing from pdp tarball lib/ |