Releasesby GlyphksqlDB validates property overrides against an allowlist
Server property overrides supplied through queries, such as SET statements, are now validated against an allowlist of approved properties by default, replacing the previous denylist. Overrides outside the allowlist are rejected.
Also shipped Sep 9, 2026Confluent in September 2026 →
Configurable retention for system tables is in Beta
Account admins can now set an account-wide retention period from 30 to 3,650 days for supported system tables. See Configure system table data retention .
External secrets in Unity Catalog (Beta)
External secrets connect a Unity Catalog schema to AWS Secrets Manager. The secrets appear in Unity Catalog as read-only securable objects that you govern with Unity Catalog privileges. Databricks reads their values from AWS Secrets Manager on demand. See External secrets in Unity Catalog .
Celigo connector (Beta)
The Celigo connector is now available in Lakeflow Connect in Beta . Workspace admins can control access to this feature from the Previews page. The connector ingests audit log events, such as create, update, and delete operations on resources, from Celigo (integrator.io) into Databricks. Authentication uses a Celigo integrator.io API token.
Anysphere Organization connector (Beta)
The Anysphere Organization connector is now available in Lakeflow Connect in Beta . Workspace admins can control access to this feature from the Previews page. The connector uses the Anysphere (Cursor) Organization Admin API to ingest organization members, groups, and group members into Databricks as daily snapshots.
Anaplan connector (Beta)
The Anaplan connector is now available in Lakeflow Connect in Beta . Workspace admins can control access to this feature from the Previews page. The connector ingests audit trail events and user account records from your Anaplan tenant into Databricks. Authentication uses an Anaplan CA certificate and its paired private key. See Anaplan connector .
Openflow gen 1 deployment creation retired
You can no longer create new first generation (gen 1) Openflow deployments (BYOC or Snowflake). All new deployments are second generation (gen 2), created with CREATE OPENFLOW DEPLOYMENT or the Openflow UI. Existing gen 1 deployments continue to work unchanged, and you can still create new gen 1 runtimes on an existing gen 1 deployment.
More from Confluent CloudEvery Confluent Cloud release →
Oracle XStream CDC Source no longer requires SELECT_CATALOG_ROLE
The connector no longer requires granting SELECT_CATALOG_ROLE to the connect user; you can instead grant SELECT on an explicit list of catalog views.
Oracle XStream CDC Source supports Active Data Guard standby as source
For cascading downstream capture, the source connection can point at the Active Data Guard standby instead of the primary, offloading the initial snapshot and schema reads.
ksqlDB v8.1.0-41 bounds pull-query concurrency per cluster
Coordinator and router thread pools each accept up to 100 pending requests; requests beyond that are rejected with HTTP 429. Queries are cancelled server-side if the client disconnects.
Logical cluster ID OAuth extension no longer required for Kafka clients
The logicalCluster OAuth extension is no longer required for clients connecting to Dedicated, Freight, and Enterprise clusters with an lkc-based bootstrap URL, on any cloud or networking type.
Flink Table API 2.3-6 adds AI functions, changelog functions, artifact creation
Java plugin 2.3-6 and Python package 2.3.3 on Flink 2.3.0 add AI_SENTIMENT, AI_DETECT_PII, AI_FORECAST and AI_DETECT_ANOMALIES, FROM_CHANGELOG/TO_CHANGELOG support, and ConfluentTools.createArtifact(). Python Table API remains in Open Preview.
Advanced Security add-on in Limited Availability
Organization-level add-on bundling SCIM, self-managed encryption keys (BYOK), and higher limits for security resources such as identity pools and RBAC role bindings. Billed as a percentage uplift on eligible infrastructure charges.
SCIM user provisioning generally available
SCIM user provisioning is GA with the Advanced Security add-on. Your IdP becomes the single source of truth for SSO user accounts, automating provisioning and de-provisioning.
Flink materialized tables can adopt an existing Kafka topic
A CREATE OR ALTER MATERIALIZED TABLE statement can point at an existing table, and Flink adopts it in place, keeping the topic, its data, and its consumers. Previously a materialized table always created a new topic.