## Features * `rpk --print-tree`: emits the full rpk command tree as a single JSON document, suited for LLMs and automations. by @r-vasquez in [#30834](https://github.com/redpanda-data/redpanda/pull/30834) ## Bug Fixes * Fix consumer group lag metrics inflated after retention or trim-prefix. by @bartoszpiekny-redpanda in [#30870](https://github.com/redpanda-data/redpanda/pull/30870) * Fixed shadow link replication advancing the shadow partition start offset past the source partition's start offset when a replicator resumes after a shadow partition leadership change. by @Lazin in [#30819](https://github.com/redpanda-data/redpanda/pull/30819) * Fixes a bug in which hung requests to the schema registry or in shadow linking could cause a deadlock during shutdown. by @WillemKauf in [#30788](https://github.com/redpanda-data/redpanda/pull/30788) * Fixes a crash that could occur in the Cloud Topics metastore upon certain errors from during metastore database compaction. by @andrwng in [#30775](https://github.com/redpanda-data/redpanda/pull/30775) * Fixes a wedge in multi-output transforms where a produce failure on one output topic silently stalled the processor instead of restarting it. by @WillemKauf in [#30855](https://github.com/redpanda-data/redpanda/pull/30855) * Upgrade krb5 to 1.22.2 to address CVE-2026-40355 and CVE-2026-40356 (NegoEx parsing vulnerabilities). by @tyson-redpanda in [#30874](https://github.com/redpanda-data/redpanda/pull/30874) * [#30561](https://github.com/redpanda-data/redpanda/issues/30561) Fixed a bug in the schema registry where adding a new required field to a JSON schema was incorrectly allowed under `BACKWARD` compatibility mode. by @TheJohnMatti in [#30563](https://github.com/redpanda-data/redpanda/pull/30563) ## Improvements * Optimize compaction logic, especially for large batches. by @WillemKauf in [#30760](https://github.com/redpanda-data/redpanda/pull/30760) * `ct/l1`: check `is_linked()` on owner shard by @WillemKauf in [#30747](https://github.com/redpanda-data/redpanda/pull/30747) * build/deps: upgrade openssl to 3.5.7 by @tyson-redpanda in [#30813](https://github.com/redpanda-data/redpanda/pull/30813) * ct/scale: raise fetch concurrency for cloud_topics MPT variants by @oleiman in [#30867](https://github.com/redpanda-data/redpanda/pull/30867) * `cluster`: remove shard aggregation for `max_offset` and `under_replicated_partitions` by @WillemKauf in [#30877](https://github.com/redpanda-data/redpanda/pull/30877) **Full Changelog**: https://github.com/redpanda-data/redpanda/compare/v26.1.10...v26.1.11

## Bug Fixes * Changes to `cloud_storage_throughput_limit_percent` cluster config now take effect at runtime instead of being ignored until restart. by @nvartolomei in [#30233](https://github.com/redpanda-data/redpanda/pull/30233) * Fixes a potential deadlock arising from race between raft snapshots and transaction opertions. by @bharathv in [#30226](https://github.com/redpanda-data/redpanda/pull/30226) * Prevents a potential oversized allocation in kafka protocol parsing of tagged fields by @rockwotj in [#30166](https://github.com/redpanda-data/redpanda/pull/30166) * PR [#30209](https://github.com/redpanda-data/redpanda/pull/30209) [v26.1.x] utils: fix token bucket underflow after rate decrease by @nvartolomei ## Improvements * Better guard against malformed requests when parsing kafka messages by @rockwotj in [#30196](https://github.com/redpanda-data/redpanda/pull/30196) * Cloud topics long-term storage metadata will now be managed as a part of the cloud cache. by @andrwng in [#30201](https://github.com/redpanda-data/redpanda/pull/30201) * PR [#30180](https://github.com/redpanda-data/redpanda/pull/30180) [v26.1.x] c/rm_stm: downgrade log level of skipping cleanup by @bharathv * PR [#30212](https://github.com/redpanda-data/redpanda/pull/30212) [v26.1.x] cloud_io: release client lease before retry backoff sleep by @nvartolomei * PR [#30215](https://github.com/redpanda-data/redpanda/pull/30215) [v26.1.x] storage: Avoid oversized alloc in compaction reducers by @StephanDollberg * PR [#30221](https://github.com/redpanda-data/redpanda/pull/30221) [v26.1.x] lsm/io: skip delete_objects call when no keys to delete by @nvartolomei * PR [#30234](https://github.com/redpanda-data/redpanda/pull/30234) [v26.1.x] ct/l1: remove unnecessary std::to_underlying in error formatting by @nvartolomei **Full Changelog**: https://github.com/redpanda-data/redpanda/compare/v26.1.5...v26.1.6

## Bug Fixes * Fix an issue where slow replication could cause audit log produce RPCs to pile up effectively unbounded, eventually exhausting memory on the server shard. by @oleiman in [#30049](https://github.com/redpanda-data/redpanda/pull/30049) * Fixed a reactor stall in the producer state cache when many producers are unevictable due to inflight requests or open transactions. by @travisdowns in [#30014](https://github.com/redpanda-data/redpanda/pull/30014) ## Improvements * Add `Group:` principal support to `rpk security role assign/unassign` and remove the explicit `--group` flag to prevent confusion by @graham-rp in [#29996](https://github.com/redpanda-data/redpanda/pull/29996) * Don't error on potentially unknown cluster properties when attempting to issue removal requests through the admin API. by @WillemKauf in [#30060](https://github.com/redpanda-data/redpanda/pull/30060) ## Misc * PR [#29908](https://github.com/redpanda-data/redpanda/pull/29908) cluster: Add greedy topic aware balancer by @StephanDollberg * PR [#29942](https://github.com/redpanda-data/redpanda/pull/29942) tests: Don't forward Azurite port to host by @StephanDollberg * PR [#29957](https://github.com/redpanda-data/redpanda/pull/29957) [v26.1.x] rptest/datalake/verifier: skip assertions in stop() on wait() failure by @nvartolomei * PR [#29967](https://github.com/redpanda-data/redpanda/pull/29967) [v26.1.x] ct/l1: reduce noise from topic purger retries by @andrwng * PR [#29974](https://github.com/redpanda-data/redpanda/pull/29974) [v26.1.x] cloud_storage_clients: remove TLS builder from client config by @nvartolomei * PR [#29976](https://github.com/redpanda-data/redpanda/pull/29976) [v26.1.x] Remove `rpk security group` commands by @graham-rp * PR [#29990](https://github.com/redpanda-data/redpanda/pull/29990) [v26.1.x] rptest: fix cross-region read replica test for AWS/CDT by @nvartolomei * PR [#29993](https://github.com/redpanda-data/redpanda/pull/29993) [v26.1.x] ct: add metastore validation by @andrwng * PR [#30000](https://github.com/redpanda-data/redpanda/pull/30000) [v26.1.x] Cloud Topics: Deflake L0 GC integration tests and also consolidate them significantly by @oleiman * PR [#30001](https://github.com/redpanda-data/redpanda/pull/30001) [v26.1.x] ct/l1: add num_extents to debug rows by @andrwng * PR [#30031](https://github.com/redpanda-data/redpanda/pull/30031) [v26.1.x] `ct/l0`: hold gate in `list_delete_worker::next_page()` by @WillemKauf * PR [#30032](https://github.com/redpanda-data/redpanda/pull/30032) [v26.1.x] rptest: avoid large alloc in abs cloud validation tests by @nvartolomei * PR [#30033](https://github.com/redpanda-data/redpanda/pull/30033) [v26.1.x] rptest/datalake/verifier: fix consumer close race with poll thread by @nvartolomei * PR [#30038](https://github.com/redpanda-data/redpanda/pull/30038) [v26.1.x] `cluster`: reduce `parallel_for_each()` batch size to 512 by @WillemKauf * PR [#30055](https://github.com/redpanda-data/redpanda/pull/30055) [v26.1.x] Cloud Topics: Improve backoff algorithm in L0 GC by @oleiman * PR [#30065](https://github.com/redpanda-data/redpanda/pull/30065) [v26.1.x] [CORE-15431] `rptest`: wait longer for valid offsets file to appear by @WillemKauf **Full Changelog**: https://github.com/redpanda-data/redpanda/compare/v26.1.1...v26.1.2

## Bug Fixes * Fixed admin API service restart to handle pandaproxy and schema_registry on the correct shard. by @pgellert in [#29523](https://github.com/redpanda-data/redpanda/pull/29523) * Fixes a bug where truncation does not propagate to sink if source start offset has moved ahead of sink high watermark. by @bharathv in [#29446](https://github.com/redpanda-data/redpanda/pull/29446) * firm up start offset update logic by @joe-redpanda in [#29467](https://github.com/redpanda-data/redpanda/pull/29467) * PR [#29393](https://github.com/redpanda-data/redpanda/pull/29393) [v25.3.x] cloud_io: handle key_not_found when listing bucket objects by @nvartolomei * PR [#29477](https://github.com/redpanda-data/redpanda/pull/29477) [v25.3.x] iobuf: fix operator<=> and operator== for string_view comparisons by @travisdowns * PR [#29497](https://github.com/redpanda-data/redpanda/pull/29497) [v25.3.x] kafka: Clamp consume deadline to 5s by @Lazin ## Improvements * Adds native support for buf's [protovalidate](https://github.com/bufbuild/protovalidate/blob/main/proto/protovalidate/buf/validate/validate.proto) to Schema Registry by @michael-redpanda in [#29417](https://github.com/redpanda-data/redpanda/pull/29417) * Improve performance of Shadow Link when scaling to thousands of topics but making internal data structures copy on write by @michael-redpanda in [#29231](https://github.com/redpanda-data/redpanda/pull/29231) * Upgrade libxml2 to latest minor version by @tyson-redpanda in [#29433](https://github.com/redpanda-data/redpanda/pull/29433) * PR [#29503](https://github.com/redpanda-data/redpanda/pull/29503) [v25.3.x] bazel: Update OpenSSL to 3.0.19 by @michael-redpanda * PR [#29531](https://github.com/redpanda-data/redpanda/pull/29531) [v25.3.x] cluster_link: improve comment for prefix truncation delay logic by @michael-redpanda * PR [#29537](https://github.com/redpanda-data/redpanda/pull/29537) [v25.3.x] kafka/client: fix race condition in direct_consumer_test by @ballard26 **Full Changelog**: https://github.com/redpanda-data/redpanda/compare/v25.3.6...v25.3.7

## Features * Enable compaction of transactional control batches per delete.retention.ms. This feature cannot be enabled at the same time as any tiered storage topic properties (i.e this feature is only accessible for local topics). by @bashtanov in [#29109](https://github.com/redpanda-data/redpanda/pull/29109) ## Bug Fixes * Fix a cache collision in in-memory spillover manifest cache which could lead to new topic reading data from the old topic for a short period of time. by @nvartolomei in [#29086](https://github.com/redpanda-data/redpanda/pull/29086) * Iceberg: Allow bucket names with dots. Also, reject URIs returned by catalog that look like `s3://bucket.s3.amazonaws.com/path/to/object`. by @nvartolomei in [#29096](https://github.com/redpanda-data/redpanda/pull/29096) **Full Changelog**: https://github.com/redpanda-data/redpanda/compare/v25.3.3...v25.3.4

## Bug Fixes * Fix an issue where an unhandled exception in archival could lead to an input_stream asserting in its destructor. by @oleiman in [#28923](https://github.com/redpanda-data/redpanda/pull/28923) * Fixed a rare bug that causes timequeries against partitions using tiered storage to incorrectly return no result when the partition's local log is empty but retains an active segment. by @wdberkeley in [#28898](https://github.com/redpanda-data/redpanda/pull/28898) * PR [#28868](https://github.com/redpanda-data/redpanda/pull/28868) [v25.2.x] archival: treat purge key_not_found error as success by @andrwng **Full Changelog**: https://github.com/redpanda-data/redpanda/compare/v25.2.12...v25.2.13

## Features * Shadow Linking, for built-in Disaster Recovery, by @michael-redpanda in [#27349](https://github.com/redpanda-data/redpanda/pull/27349) and others * Support for GCP BigLake Metastore as an Iceberg REST Catalog for Iceberg Topics, by @nvartolomei in [#27251](https://github.com/redpanda-data/redpanda/pull/27251) * Schema Registry now supports IMPORT mode for schema migration, by @pgellert in [#27010](https://github.com/redpanda-data/redpanda/pull/27010) * Connected Client Monitoring * Added a `cluster connections list` command by @graham-rp in [#28157](https://github.com/redpanda-data/redpanda/pull/28157) * Implement cluster-wide API endpoints for monitoring client connections by @pgellert in [#28137](https://github.com/redpanda-data/redpanda/pull/28137), and others * KIP-937 (improved message timestamp validation) * Support `message.timestamp.{before/after}.max.ms`, by @WillemKauf in [#27419](https://github.com/redpanda-data/redpanda/pull/27419) * Adds a new cluster config `kafka_produce_batch_validation` which controls the level of timestamp validation performed on batches in the `redpanda` produce path, by @WillemKauf in [#27529](https://github.com/redpanda-data/redpanda/pull/27529) * KIP-516 (topic identifiers) by @BenPope in [#26968](https://github.com/redpanda-data/redpanda/pull/26968) * KIP-709 (fetch the offsets of multiple consumer groups in a single request) by @BenPope in [#27794](https://github.com/redpanda-data/redpanda/pull/27794) * Iceberg: Redpanda now supports protobuf Struct fields in Iceberg tables. A Struct field will be translated into a string column, and its value with be the JSON serialization of the Struct value. by @wdberkeley in [#26930](https://github.com/redpanda-data/redpanda/pull/26930) * Iceberg: Adds a configurable DLQ table suffix to support Iceberg catalogs/query engines that don't allow tilde characters and hence the default `<topic name>~dlq` format for DLQs. by @nvartolomei in [#28242](https://github.com/redpanda-data/redpanda/pull/28242) * Iceberg: support schema merging, gracefully retaining information about historical columns. by @nvartolomei in [#27202](https://github.com/redpanda-data/redpanda/pull/27202) * Introduces a 'security report' API GET /v1/security/report (Admin API) for monitoring the status of enabled security features by @IoannisRP in [#27173](https://github.com/redpanda-data/redpanda/pull/27173) * Ability to repair clusters that have lost controller quorum through a controller 'force reconfigure' API by @joe-redpanda in [#27995](https://github.com/redpanda-data/redpanda/pull/27995) * Export of consumer group information via `rpk group describe ... --formatted json` as json or yaml using the `--formatted` flag. by @alextreichler in [#27647](https://github.com/redpanda-data/redpanda/pull/27647) * Control the global upper bound on message size via `kafka_max_message_size_upper_limit` cluster property. This property can be used to limit the max value of the `max.message.bytes` topic property. by @ballard26 in [#27997](https://github.com/redpanda-data/redpanda/pull/27997) * Introduce a new "sasl_mechanisms_override" configuration that allows per-listener configuration of available sasl mechanisms. by @IoannisRP in [#27458](https://github.com/redpanda-data/redpanda/pull/27458) * Enterprise features "core_balancing_continuous" and "partition_autobalancing_mode" will be turned on by default on a new cluster or when any Enterprise license is applied. by @IoannisRP in [#27824](https://github.com/redpanda-data/redpanda/pull/27824)

## Features * rpk now prompts the user when creating a profile and the cluster has both private and public networking enabled. by @chapmanc in [#28239](https://github.com/redpanda-data/redpanda/pull/28239) * rpk: Added serverless private networking support to `rpk cloud cluster select` and `rpk profile create`. by @chapmanc in [#28239](https://github.com/redpanda-data/redpanda/pull/28239) ## Bug Fixes * Do not wait for EOF from OIDC server on TLS connection shutdown. by @pgellert in [#28452](https://github.com/redpanda-data/redpanda/pull/28452) * Fix double-counting in tiered storage cache operations metrics. by @nvartolomei in [#28441](https://github.com/redpanda-data/redpanda/pull/28441) * Fixes a race in http client during shutdown by @rockwotj in [#28443](https://github.com/redpanda-data/redpanda/pull/28443) * Prevent a very narrow race condition in the `partition_balancer_backend`. by @WillemKauf in [#28475](https://github.com/redpanda-data/redpanda/pull/28475) * rpk: Fix host selection when using `--host <index in address config>`. Previously it would always choose the first address. by @nvartolomei in [#28194](https://github.com/redpanda-data/redpanda/pull/28194) ## Improvements * kafka/server: Fix a memory leak when the keytab cannot be found. by @BenPope in [#28453](https://github.com/redpanda-data/redpanda/pull/28453) * kafka/server: Fix a memory leak when the keytab cannot be found. by @BenPope in [#28474](https://github.com/redpanda-data/redpanda/pull/28474) * kafka/server: Fix rare uncaught exceptional future on connection shutdown by @BenPope in [#28456](https://github.com/redpanda-data/redpanda/pull/28456) **Full Changelog**: https://github.com/redpanda-data/redpanda/compare/v25.2.10...v25.2.11