lakeFS Enterprise v1.103.0¶

Changelog¶

Important note: - RBAC: stageObject on addresses outside the repository's storage namespace, and linkPhysicalAddress on any address lakeFS did not sign for the entry, now also require fs:ImportFromStorage. Callers with only fs:WriteObject, including the default Developers group and lakectl fs stage, get 401 until granted import on those locations - Iceberg REST Catalog: registering a table with metadata outside the catalog's storage also requires fs:ImportFromStorage

What's new:¶

WebUI: improved design consistency across the interface
Object Lifecycle Management: emit metrics for rule run start, finish, and per-repository results
Audit log: every audit event now records tenant

Bugs Fixed:¶

Logging: fix log entries missing fields inherited from a parent context
S3 gateway now rejects SigV4 requests with unsigned x-amz-* headers. This fixes a security issue where a presigned PUT URL could be extended with unsigned headers such as x-amz-copy-source, potentially allowing access to data available to the signing identity.
Security: a user with only write permission can no longer stage or link an object to a storage location outside the repository and read it back through lakeFS
RBAC: built-in service user policies (IcebergFSAccess, MDSFSReadAccess, AuditFSAccess) are kept in sync with lakeFS on every server start; manual edits are reverted

Assets¶

`checksums.txt`		1.8 kB	2026-09-25
`lakefs-enterprise_1.103.0_Darwin_arm64.tar.gz`	`sha256:6a5aae0d4e4080cc7f53d27d4f1b590b4fc210511431a45f0e827e2f0fac859c`	74.8 MB	2026-09-25
`lakefs-enterprise_1.103.0_Darwin_x86_64.tar.gz`	`sha256:e216ce9eaf1bc1b4235079a4e6a6e61088d66245c2e9977aa94ee0c891f131f4`	80.3 MB	2026-09-25
`lakefs-enterprise_1.103.0_Linux_arm64.tar.gz`	`sha256:4e755cacbd9a1454c45eb01dc4b8dfc85fa4f027157a813cef752a9e928bfecc`	71.2 MB	2026-09-25
`lakefs-enterprise_1.103.0_Linux_x86_64.tar.gz`	`sha256:ef3b6d025bfdbfff3b8675957cce3e0a8bfbabd0fb1b4f8c06101d64ea130ff3`	78.7 MB	2026-09-25
`lakefs-enterprise_1.103.0_Windows_arm64.zip`	`sha256:05de2f3fe7c0cfaff96ee73ce6b74a0cde101b8367da49ee43a416aaeb27cd16`	71.5 MB	2026-09-25
`lakefs-enterprise_1.103.0_Windows_x86_64.zip`	`sha256:d79de85b1573d2394235f4ea6580e7225dda4b72223c0cd190d07df084483bff`	80.3 MB	2026-09-25

Docker¶

docker pull treeverse/lakefs-enterprise:1.103.0

Verify the signature (optional)¶

Requires Cosign:

cosign verify treeverse/lakefs-enterprise:1.103.0 \
    --certificate-identity-regexp='^https://github\.com/treeverse/lakeFS\-Enterprise/\.github/workflows/' \
    --certificate-oidc-issuer='https://token.actions.githubusercontent.com'

Expected output

Verification for index.docker.io/treeverse/lakefs-enterprise:1.103.0 --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - The code-signing certificate was verified using trusted certificate authority certificates