This is an automated email from the ASF dual-hosted git repository.
collado pushed a commit to branch mcollado-catalog-admin-revoke
in repository https://gitbox.apache.org/repos/asf/polaris.git
The following commit(s) were added to refs/heads/mcollado-catalog-admin-revoke
by this push:
new eb5d8e0e72 Add CHANGELOG entry for
REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE authorization change
eb5d8e0e72 is described below
commit eb5d8e0e722718502f5451f248b5c1d9ce76f4bf
Author: Michael Collado <[email protected]>
AuthorDate: Tue Mar 3 17:01:54 2026 -0800
Add CHANGELOG entry for REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE
authorization change
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---
CHANGELOG.md | 1 +
1 file changed, 1 insertion(+)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 646b11a07d..7e61517ba7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -43,6 +43,7 @@ request adding CHANGELOG notes for breaking (!) changes and
possibly other secti
- The `PolarisMetricsReporter.reportMetric()` method signature has been
extended to include a `receivedTimestamp` parameter of type `java.time.Instant`.
- The `ExternalCatalogFactory.createCatalog()` and `createGenericCatalog()`
method signatures have been extended to include a `catalogProperties` parameter
of type `Map<String, String>` for passing through proxy and timeout settings to
federated catalog HTTP clients.
- Metrics reporting now requires the `TABLE_READ_DATA` privilege on the target
table for read (scan) metrics and `TABLE_WRITE_DATA` for write (commit) metrics.
+- The `REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE` operation no longer requires
the `PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE` privilege. Only
`CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE` on the catalog role is now required,
making revoke symmetric with assign. This allows catalog administrators to
fully manage catalog role assignments without requiring elevated privileges on
principal roles.
### New Features
