The Apache Hop community has released Apache Hop 2.19, and by its own numbers it is the biggest release in the project’s history. Twenty-two contributors, six of them first-timers, closed 337 issues over roughly three months. The release was announced on 16 August 2026 and the binaries have been available for download since 17 August.
For readers less familiar with the project: Apache Hop is the open-source data integration platform maintained in part by the original creators of Kettle and Pentaho Data Integration. We covered it in detail in an earlier article, What is Apache Hop. It runs on Java 21 and is available as a binary download, a Docker image and a Helm chart.
Here is what stands out in 2.19.
The Marketplace
The headline feature is the new Hop Marketplace. Plugins can now be installed, updated and managed directly from the Hop GUI, which removes the old routine of downloading archives and copying JAR files into plugin directories. The Marketplace supports GitHub, Forgejo and Gitea as plugin registries, and the catalog is expected to grow as third-party plugin authors publish to it.
A native Spark engine
Hop 2.19 introduces a dedicated Spark pipeline execution engine and a native Spark SQL transform. Both are built specifically for Spark and are independent of the Beam-based execution path that Hop has used for Spark workloads until now. Teams already running Spark clusters can point Hop pipelines at them natively, and the documentation includes walkthroughs for cluster mapping and lakehouse tables (Delta and Iceberg), including running native Spark on Databricks.
Databricks and cloud storage improvements
Databricks Unity Catalog Volumes (the Files API) is now a supported virtual file system, so Hop can read from and write to Unity Catalog Volumes through the standard file-based transforms. Append operations are now supported consistently across the major cloud storage providers, GCS, Azure and S3, closing a long-standing gap for pipelines that write incrementally to cloud storage.
SFTP metadata, Redis and vCard
SFTP is now a first-class metadata type, meaning connections are configured once and reused across pipelines and transforms instead of being re-entered per transform. Redis support has landed as well, with Redis Input, Redis Output and a Redis connection metadata type. On the quirkier side, there are new vCard Input and Output transforms for reading and writing contact data.
Editor improvements
The Hop GUI can now open and edit YAML, shell, cmd, bat and Markdown files with syntax highlighting, so more of a project’s assets live in one IDE. The pipeline editor gained a split view that shows two areas of a pipeline side by side, which helps when navigating large, complex pipelines.
Notable fixes
Among the 337 closed issues are fixes for memory leaks and resource export problems in Hop Server, faster unzipping of archives with many small files, correct restoration of shell states after restart, fewer unexpected file closures after project and variable reloads, better database identifier quoting across several databases, and detection and mitigation of pipeline buffer deadlocks.
Coming next: authentication with RBAC and SSO
The more strategic news is what landed in the main development branch right after the 2.19 code freeze, in time for the next release. Apache Hop is getting a full authentication and authorization layer for Hop Web, the browser-based version of the Hop GUI, which until now relied on hand-configured Tomcat authentication.
Four authentication modes are being introduced:
- NONE: open access, matching current behavior.
- BASIC: Hop-managed login against a local
users.jsonfile with PBKDF2-hashed passwords, with optional HTTP Basic for API clients. - EXTERNAL: trust the servlet container or a reverse proxy principal, with container or LDAP groups mapped to Hop roles.
- OAUTH2: single sign-on against any OIDC-compliant third-party identity provider using the authorization code flow with PKCE.
The SSO support is the part most enterprise teams will care about. Hop Web will work out of the box with Keycloak, Microsoft Entra ID, Google and Okta. Groups and roles from the identity provider’s claims (for example realm_access.roles for Keycloak) are mapped to Hop roles, and providers without group claims, such as personal Google accounts, can be handled through username or email mappings. Log off supports RP-initiated logout when the provider advertises it.
On the authorization side, Hop gets role-based access control (RBAC) with four built-in roles: Admin, User (developer), Operator and Read-only. Permissions are fine-grained, think file.edit, file.save, run.execute, metadata.write, security.manage and plugin.manage, and the UI enforces them throughout: menus, toolbars, context actions and keyboard shortcuts are gated by permission, dialogs open read-only when a user lacks edit rights, and the pipeline and workflow canvas blocks drag, delete and reconnect operations without it. Projects get their own access rules, so specific users, roles or LDAP groups can be granted or denied per project.
There are thoughtful touches here. A session privilege control lets an admin temporarily step down to Operator or Read-only without logging out, and there is no privilege escalation, you can only drop to a subset of your own rights. Installing plugins from the new Marketplace requires the plugin.manage permission held by Admins, which makes sense given that installs affect the shared server.
All of this is configurable through a new Security section in the Configuration perspective, through files under HOP_CONFIG_FOLDER/security/, or through environment variables for containerized deployments. Based on the project’s typical cadence of a release every two to three months, the expectation is that this ships in Hop 2.20.
Wrap-up
Hop 2.19 is a substantial release on its own, the Marketplace alone changes how the ecosystem installs and updates plugins, and the native Spark engine gives Spark shops a first-class path into Hop. But the security work coming next is arguably the bigger story for anyone evaluating Hop as a team platform rather than a desktop tool. Multi-user deployments of Hop Web have been the weakest spot for enterprise adoption, and RBAC plus standards-based SSO addresses exactly that.
This article covers the highlights, but there is more to explore. To read the full and complete set of changes in this release, read the official Apache Hop 2.19 release post.
Apache Hop 2.19 requires Java 21 and can be downloaded from the project website, with Docker images available under apache/hop and apache/hop-web. Want to see the code, open issues or contribute? Try and download Apache Hop from the official repository.