Apache Ranger 2.7.0 release notes
Apache Ranger 2.7.0 was released on July 30, 2025. The release splits the audit framework into one library per destination, modernizes the Python scripts for Python 3, and adds retry and service-configuration improvements. It contains a breaking change for plugin implementers; read the section below before you upgrade a custom plugin.
Highlights
- Audit module refactoring — each audit destination now lives in its own module (RANGER-5208); see the breaking changes below.
- Python 3 — installer and utility scripts modernized for Python 3 (RANGER-5147).
- REST client resilience —
RangerRESTClient retries GET requests on HTTP 5xx errors (RANGER-5201).
- Policy management — delete multiple policies with a wildcard through the API (RANGER-5113); the service configuration UI shows
additional settings such as
service.admin.users and service.admin.groups (RANGER-3643).
- UserSync —
ranger.usersync.ldap.referral=follow is the default (RANGER-5078).
- Docker — pre-built
ranger-base image pulled from Docker Hub (RANGER-5158, RANGER-5241), Ubuntu base update (RANGER-5138), all databases in one
compose file with exposed ports (RANGER-5166, RANGER-5167), support for the apache/ranger-tools repository (RANGER-5236).
- Quality — JaCoCo code-coverage report in CI (RANGER-5229), unit tests for the Atlas authorizer (RANGER-5216), Swagger UI 5.20.1 (RANGER-5164).
- Notable fixes — plugin classloader parent (RANGER-3636), tag allow/deny policy enforcement (RANGER-5162, RANGER-5202, RANGER-5225), HDFS audit write/append
modes (RANGER-5102), row-filter expression evaluation (RANGER-5174), master key migration to external key stores (RANGER-5169).
Breaking changes
- The library
ranger-plugins-audit is no longer available starting with 2.7.0 (the Maven artifact of that name is
now a parent POM without a jar). Its contents are split into one library per
audit destination, so a plugin only needs the destinations it uses. Replace references to ranger-plugins-audit with:
ranger-audit-dest-cloudwatchranger-audit-dest-esranger-audit-dest-hdfsranger-audit-dest-kafkaranger-audit-dest-log4jranger-audit-dest-solr
- Plugin packages in 2.7.0 bundle the dependent libraries for two audit destinations only: Solr and HDFS. Earlier versions
bundled libraries for every destination (AWS CloudWatch, Elasticsearch, Kafka, Log4j). If you need another destination,
rebuild the plugin package after adding the corresponding
ranger-audit-dest-* dependency to the plugin's pom.xml and
packaging descriptor. See Audit framework.
Component versions
The release was built and tested with the following component versions (as recorded in the release notes):
| Component |
Version |
| Java |
JDK 8 |
| Python |
3.10.12 |
| MariaDB |
10.7.3 |
| PostgreSQL |
12 |
| Oracle |
23.6 |
| Apache Solr |
8.11.3 |
Artifacts
Verify every download against its .asc signature and checksum file before you use it; see Download and verify.
Resolved issues
The tables below list the 56 JIRA issues recorded in the release notes for this version (17 improvements, 31 bugs fixed, 8 tasks). Each key links to the issue in the Apache JIRA.
Improvements
| JIRA |
Summary |
| RANGER-3643 |
Service config UI to include additional configurations like service.admin.users, service.admin.groups |
| RANGER-5078 |
Set ranger.usersync.ldap.referral=follow as default config |
| RANGER-5113 |
DELETE multiple policies with a wildcard via API call |
| RANGER-5138 |
Docker setup: update Ubuntu version |
| RANGER-5147 |
Modernize Python scripts for Python 3 |
| RANGER-5158 |
Pre-build ranger-base image |
| RANGER-5166 |
Expose database ports for all databases in docker compose |
| RANGER-5167 |
Merge all database compose files into a single file |
| RANGER-5198 |
Prevent selected long string values from getting truncated in the react-select control |
| RANGER-5201 |
Retry GET requests on HTTP 5xx errors in RangerRESTClient |
| RANGER-5207 |
Update jquery file naming to prevent version disclosure |
| RANGER-5208 |
refactor audit module to move each destination implementation to a separate module |
| RANGER-5216 |
add unit tests for RangerAtlasAuthorizer |
| RANGER-5229 |
CI: Generate Code Coverage Report with JaCoCo |
| RANGER-5241 |
Update all docker images to pull ranger-base from DockerHub |
| RANGER-5247 |
RangerOzoneAuthorizer: replace unused instance member with a local variable |
| RANGER-5258 |
Documentation : add reference to CI, source-repo and jira as menu items under resource |
Bugs fixed
| JIRA |
Summary |
| RANGER-3636 |
Plugin classloader should use classloader of shim class as parent |
| RANGER-4721 |
Ranger Admin server is not sending DataMasklabel for masking policy audit logs |
| RANGER-4993 |
Ranger KMS - Missing HSTS Headers for 404 Not found requests port 9494 |
| RANGER-5003 |
Fix the bug that deleting a service fails with gtid enabled mysql server |
| RANGER-5074 |
keyadmin user is able to get admin user logs |
| RANGER-5102 |
Add config parameter to allow audits to HDFS in both WRITE and APPEND modes in case of errors/exceptions |
| RANGER-5123 |
Handle Transaction Log Migration for Fresh Install |
| RANGER-5134 |
Fix processing of tasks scheduled to run after current transaction is complete |
| RANGER-5146 |
500 API Error When Deleting TagDef with a Linked Tag |
| RANGER-5151 |
Audit to HDFS fails with error: Stream encountered errors while writing audits to HDFS! |
| RANGER-5153 |
Intermittent test failure in RangerJSONAuditWriterTest |
| RANGER-5154 |
Functionality to delete records from x_auth_sess table via api is not working |
| RANGER-5155 |
Service Definition with empty configs causes Ranger UI rendering issues |
| RANGER-5162 |
Tag Allowed policy is not being enforced |
| RANGER-5164 |
Ranger: Upgrade Swagger-UI to the latest V5.20.1 |
| RANGER-5165 |
Update notification settings in .asf.yaml |
| RANGER-5169 |
Error while migrating Masterkey from older format to external key store |
| RANGER-5174 |
failure in evaluating expressions in row-filter |
| RANGER-5177 |
For tagresourcemaps api, resourceId search filter does not work |
| RANGER-5182 |
Ranger: Upgrade axios version 1.7.4 to latest 1.8.4 |
| RANGER-5183 |
Federated User getting created with wrong user source |
| RANGER-5185 |
Fix potential NPE in RangerBasePlugin |
| RANGER-5189 |
doc site format is incorrect .... |
| RANGER-5191 |
Typo in the log message in RangerRESTClient |
| RANGER-5197 |
build_ranger_using_docker.sh - fails due to centos docker image is not supported. |
| RANGER-5202 |
Tag deny policy is not getting enforced on scan table command for hbase |
| RANGER-5224 |
dedupTags removes the valid tags while deduplicating tags |
| RANGER-5225 |
Override allow policy not taking precedence over normal deny tag policy |
| RANGER-5251 |
dedupTags() doesn’t remove duplicate tag IDs within a single resource’s resourceToTagIds list |
| RANGER-5261 |
Disable Log4J Audit Destination for Ozone in OM container |
| RANGER-5264 |
Update commands in release-build.xml |
Tasks
| JIRA |
Summary |
| RANGER-4587 |
Blog: Apache Ranger - dynamic expressions |
| RANGER-4846 |
Update Apache Ranger website with 2.5.0 |
| RANGER-5100 |
Update Apache Ranger website with 2.6.0 |
| RANGER-5124 |
The policy and tag active time are not in sync with the last update and policy download |
| RANGER-5149 |
update ranger-2.7 branch pom.xml version to 2.7.0-SNAPSHOT |
| RANGER-5228 |
Bump jacoco to 0.8.13 |
| RANGER-5236 |
Setup apache/ranger-tools |
| RANGER-5244 |
Move Dockerfile.ranger-base-ubi to apache/ranger-tools |
Further reading