snazy commented on code in PR #10603:
URL: https://github.com/apache/iceberg/pull/10603#discussion_r1670212379
##########
open-api/rest-catalog-open-api.yaml:
##########
@@ -134,9 +134,17 @@ paths:
post:
tags:
- OAuth2 API
- summary: Get a token using an OAuth2 flow
+ summary: Get a token using an OAuth2 flow (DEPRECATED for REMOVAL)
+ deprecated: true
operationId: getToken
description:
+ The `oauth/tokens` endpoint is **DEPRECATED for REMOVAL**. It is _not_
recommended to
Review Comment:
I'm proposing to include it in 1.6.0 and not wait for 1.7.0 - added a note
that mentions "Iceberg (Java) **1.6.0**", because that's the next release this
change can realistically go into.
Sure, the improvement proposal document mentioned Iceberg 1.7.0, because at
the time of writing it (June), 1.7.0 was the next release the deprecation could
go in. 1.6.0 was considered to be released in June ([meeting
notes](https://docs.google.com/document/d/1YuGhUdukLP5gGiqCbk0A5_Wifqe2CZWgOd3TbhY3UQg/edit#heading=h.z3dncl7gr8m1)).
But now it's already July and 1.6.0 is still not ready to be released.
This change is part of an effort to address a potential security issue. I
think that fixes and mitigations for security are a good example for the
non-hard rules mentioned in the [Contributing
page](https://iceberg.apache.org/contribute/#contributing).
The improvement proposal document assumes 6 months migration period (aka two
non-patch Iceberg/Java releases), which is IMO okay considering that this
effort is about security.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
