Releasesby GlyphConfluent Gateway processes fencing filter before auth swap
Gateway now processes fencing filter requests before the authentication swap filter, so fenced clients receive BROKER_NOT_AVAILABLE immediately.
Also shipped Jul 10, 2026Confluent in July 2026 →
Online Feature Store (Public Preview)
Online Feature Store is now available in public preview. Serve the latest feature values with low-latency online retrieval backed by Snowflake Postgres for real-time ML applications such as fraud detection, recommendations, and personalization.
Databricks-provided MCP Services will GA soon
Databricks-provided MCP Services for SaaS applications such as Slack, GitHub, Atlassian, and Google Drive will soon be generally available, with both read and write operations enabled by default. Admins and users can disable MCP Services and individual tools in Unity Gateway . See Connect agents to tools with MCP Services .
Secrets in Unity Catalog (Public Preview)
You can now store, govern, and access secrets as securable objects in Unity Catalog. A Unity Catalog secret uses the three-level namespace ( catalog.schema.secret ) and is governed by Unity Catalog privileges, so you can apply the same access controls and auditing that you use for other data assets. See Secrets in Unity Catalog .
Dreams research preview adds Claude Fable 5 and Claude Sonnet 5
Dreams, in research preview, now supports Claude Fable 5 and Claude Sonnet 5.
Agentic autofix for code scanning alerts in public preview
Agentic autofix is now in public preview for all code scanning alerts. It remediates alerts generated by CodeQL and third-party scanning tools by working across your codebase the way a developer would, it explores relevant files, proposes a fix, and reruns the original analysis to confirm the fix closes the alert before opening a pull request for your...
supabase-js will require TypeScript 5.0+ from January 31, 2027
@supabase/supabase-js will require TypeScript 5.0 starting January 31, 2027, dropping support for TypeScript 4.7 to 4.9.
More from Confluent CloudEvery Confluent Cloud release →
Confluent Gateway 1.3.0 adds centralized governance enforcement (Early Access)
Gateway validates messages and enforces data governance with Schema Registry, with four policy types (schema ID, deep validation, field-level and full-payload encryption) and per-topic overrides. Docker only during EA.
Confluent Gateway supports OAuth-to-OAuth authentication swapping
Gateway supports SASL/OAUTHBEARER as a client authentication mechanism for authentication swapping between two different identity providers.
Confluent Gateway supports CyberArk Conjur secret store
Confluent Cloud Gateway 1.3.0 supports CyberArk Conjur as a secret store provider.
Kafka cluster deletion protection
Opt-in safeguard that blocks deletion of a Kafka cluster until an authorized user disables it. Available via Console, CLI, REST API, or Terraform.
Auto pool mapping for OAuth identity pools across Kafka, REST, Schema Registry, ksqlDB
Auto pool mapping makes the identity pool ID optional for Kafka clients 2.15+, Kafka REST API, Schema Registry clients and REST API, and ksqlDB REST API.
mTLS CRL size limit cut to 1.5 MB; public CAs no longer issue client certs
The mTLS certificate revocation list size limit drops from 10 MB to 1.5 MB per CRL, and public CAs no longer support issuing client certificates.
Google Cloud Spanner CDC Source (Debezium) connector available
The fully managed connector streams row-level inserts, updates, and deletes from Spanner change streams to Kafka topics in near-real time.
Snowflake Sink connector version 3.4.0
Version 3.4.0 of the fully managed Snowflake Sink connector exposes snowflake.streaming.max.client.lag to adjust flush frequency in streaming mode.