November 2026

Week of November 2

New

• Lance datasets — read, search (lance_vector_search, lance_fts, lance_hybrid_search) and export (FORMAT lance) Lance datasets in your S3, R2, GCS or Azure catalogs, on the managed cloud and on BYOC installs. Details

Improved

• Table and column access — a role can now be limited to named tables, and can hide columns such as ssn from everyone who holds it. Hiding wins across roles, a table with a hidden column is read-only for that user, and a query that names a hidden column is refused rather than quietly returning fewer columns. Details
• Catalog refresh on a schedule — every catalog re-collects daily by default (Off, 1, 3, 6 or 12 hours also available in Settings → Preferences), and a catalog whose last collection failed shows as offline with the reason while its tables stay queryable. Details
• Hive-style export paths — COPY (…) TO accepts {year}, {month}, {day} and {hour} in the path, so a scheduled export can land in the year=2026/month=10/day=22/hour=06 folders that Spark, Trino, Athena and BigQuery external tables read as partitions. {now,"yyyyMMddHH"} lays the timestamp out any way you like. All values are UTC, and a scheduled run uses the job's scheduled time. Details
• LakeOps on BYOC — bring-your-own-cloud installs now have a working LakeOps page: it lists your Nessie Iceberg tables with their health, and an admin can run a compaction on one and watch it finish. The run uses a dedicated identity that can write only to the warehouse bucket, and is protected from node consolidation mid-compaction. Upgrading an existing install: create the td-lake Google service account, grant it roles/storage.objectAdmin on the warehouse bucket only, bind it for Workload Identity to <namespace>/td-lake, and set global.workloadIdentity.lake in your values. The "Upgrading to this release" section of the BYOC install guide has the commands.
• Automatic LakeOps maintenance — every Iceberg table now compacts daily in a 02:00–05:00 UTC window, then expires snapshots 90 minutes later where the catalog supports it. A table is skipped when its cached snapshot id shows no data change since the last compaction. The defaults are 512 MiB target files and seven-day snapshot retention, and both can be changed per table (or the schedule paused) in the table panel on LakeOps. Nessie catalogs get compaction only, because Nessie manages snapshot history itself.
• Clearer refusals for catalogs you can't read — a query whose path names a catalog your role doesn't grant now says which catalog and where to ask, instead of reporting an arbitrary URL/path. A name that isn't a catalog at all says so, and points at the Catalogs page.
• Reserved environment variable names — company environment variables whose names start with AWS_, GOOGLE_ or AZURE_ are now refused, because they could redirect cloud credentials; existing ones are ignored at run time.
• Query attribution in source logs — every statement Thunderduck pushes into BigQuery, PostgreSQL, MySQL, Oracle or SQL Server starts with -- Thunderduck Query. query_id: …, user_id: …, so a DBA can trace a slow or unexpected statement back to the Thunderduck run and user that sent it. Catalog refreshes and credential checks are tagged source: catalog probe instead, because they are not user queries. Details

Fixed

• Files in dbt models — a model can read an S3, GCS, Azure or R2 catalog by name, as in Studio: read_parquet('marketing/customers.parquet'). Pipeline and dbt runs used to fail with "No files found that match the pattern". Details
• Model names in pipeline runs — a run's model list on the Pipelines page (and get_pipeline_run over MCP) shows each model's name, such as daily_sales, instead of the start of its compiled SQL. Query History rows from dbt now open with a -- dbt: model.<project>.<name> line too. Runs from before this release keep their old labels.