3.5.20

Release date: July 23, 2026

Behavior Changes

• CREATE DATABASE IF NOT EXISTS on Iceberg REST catalogs now succeeds silently when the database already exists, instead of raising an error. #75017
• Iceberg REST catalogs with vended credentials now cache Table objects and keep their credentials refreshed on access, instead of bypassing the cache and re-fetching from the REST catalog/Lake Formation on every getTable() call, which could trigger AWS Rate exceeded errors. #75431
• GIN inverted-index-accelerated NOT MATCH predicates no longer return rows with a NULL value, matching SQL three-valued-logic semantics. #75578

Improvements

• Added the FE metric txn_max_committed_pending_publish_ms, a per-database gauge reporting the longest time a committed transaction has been pending publish, to help diagnose stuck or lagging version publishing. #75025
• Enforced the query memory limit when a column is upgraded (widened) during window-function aggregation in Analytor, instead of letting it grow unbounded. #75821
• Removed useless per-rowid seeks in the array-column offsets-only read path used by array_length()/cardinality(). #75861

Bug fixes

The following issues have been fixed:

• Several wrong-result issues: EliminateSortColumnWithEqualityPredicateRule dropping the global LIMIT under concurrency; SplitJoinORToUnionRule producing duplicate rows for a null-safe-equal (<=>) JOIN ON p1 OR p2; JIT codegen truncating LARGEINT literals >= 2^64 to 64 bits; array_map/transform silently dropping NULL rows when all non-null input arrays were empty; nested dictionary expressions rebuilt inconsistently across exchange fragments causing dict-decode failures; and a LIKE pattern with the _ wildcard returning wrong rows on a GIN inverted index. #74983 #75038 #75137 #75141 #75246 #75551
• Join-reorder column pruning could drop a column still referenced by a predicate, causing a missing statistic of col planning error, and JoinTuningGuide could lose predicateCommonOperators when rebuilding a join, failing plan validation. #74791 #75773
• Sync materialized view/rollup rewrite could lose a rollup column when a query aggregated the same base column twice (e.g. min(c) and max(c)), and async materialized view rewrite could serve stale results after an Iceberg base table's rollback_to_snapshot. #75528 #75924
• PARTITION-TOP-N could rewrite its partition-by column to a dictionary slot that no longer existed, failing with a slot_id not found error. #75956
• An NPE collecting view tables when a SECURITY INVOKER view's stored definition contains a CTE. #74813
• Three FE metadata-lock correctness races around DROP PERSISTENT INDEX, RestoreJob post-restore handling, and related unlocked paths. #74968
• A race between FE EOS-cancel and BE stage-2 deploy could mark a fully successful query as canceled. #75009
• ApplyTuningGuideRule could throw UnsupportedOperationException when an earlier rewrite produced an OptExpression with an immutable input list. #70785
• BE/CN crashes: a null driver_executor when a cancel RPC arrives before pipeline start; a use-after-free in the spill partition-sort-sink cancel path; a heap-use-after-free in OrderedPartitionExchanger for a skew-hinted window function at DOP>1; an NLJoin crash from a build-side column nullability mismatch; a StructColumn field-count mismatch in UNNEST output; a crash loop reading a flat-JSON column that changed from NOT NULL to nullable during compaction; an uncaught memory-allocation exception in NLJoinProbeOperator; a crash in primary-key auto-increment partial-update apply; and a crash rewriting predicates inside an array_map lambda during scan-predicate pushdown. #75030 #75140 #75279 #75343 #75445 #75680 #75788 #76119 #76380
• histogram() crashed (or silently mis-bucketed values) on a non-positive bucket_num instead of raising a clear error, and bar() could grow an unbounded string for a negative or huge width argument, exhausting BE memory. #75041 #75143
• A query using unnest over array columns could exceed query_mem_limit and get the BE OOM-killed instead of failing just that query. #75179
• A second-order SQL injection in the information_schema.task_runs TASK_NAME/QUERY_ID predicate lookup. #75520
• SHOW CREATE ROUTINE LOAD could emit a spurious leading comma before the first load-desc clause, and an unescaped jsonpaths value, producing non-runnable DDL. #75522 #75755
• Shared-data (lake) SHOW PARTITIONS and information_schema.partitions_meta reported every physical partition's bucket count as the table-level default instead of its own bucket count. #75734
• Several dependency CVEs by upgrading jackson-databind and Netty. #75373 #76555
• Batched TabletInvertedIndex write-lock acquisition in markTabletsForceDelete, reducing lock churn when force-deleting many tablets at once. #75616
• Batched tablet inverted-index writes in the insert-overwrite path. #75923
• Skipped an unnecessary remote clear_parent_path call when a load spill never used remote storage. #76224
• A null-padding size mismatch for missing columns in ParquetScanner so padded rows match the actual per-batch chunk size instead of the whole Parquet/Arrow batch size. #75981
• Vulnerable, stale transitive dependencies (old BouncyCastle, OkHttp 2.x, Tomcat, and others) that previously shipped alongside their fixed counterparts. #76097

4.0.13

4.0.13

Release Date: July 16, 2026

Behavior Changes

• The escape handling of LIKE predicates with constant operands (folded on the FE) now matches MySQL 8: SELECT 'a\\b' LIKE 'a\\\\b' returns 1 and SELECT 'a\\b' LIKE 'a\\b' returns 0. Queries that relied on the previous non-MySQL escaping semantics will return different results. #74814
• SHOW [FULL] FUNCTIONS now always includes the isolation property (shared or isolated) in the Properties column of UDFs, so users can tell whether the property is set without recreating the function. #75255
• Iceberg REST catalogs with vended credentials use the table metadata cache again, reverting the earlier cache bypass that sent every getTable() to the REST catalog and caused AWS Lake Formation Rate exceeded failures. Cached tables now renew their credentials on every refresh cycle, and the table cache expiry for REST catalogs is additionally capped at 3000 seconds. #75431

Improvements

• Added checksum protection for shared-data tablet metadata and transaction logs. #74924
• Supported combined transaction log / file bundling for FRONTEND_STREAMING loads. #74460
• Scoped shared-data schema-change job locks to the table to reduce lock contention. #75087
• Batch tablet force-delete marking now acquires the TabletInvertedIndex write lock once per batch instead of once per tablet. #75616
• Added an FE metric for the maximum pending-publish time of committed transactions. #75025
• Added a memory limit check for column upgrades in window operator processing. #75821
• Removed unnecessary per-row seeks in the offsets-only read path of array columns. #75861
• Foreground row-count estimation of Iceberg tables is now computed from manifest metadata without enumerating every data file. #75280
• Addressed security vulnerabilities (CVE): excluded the vulnerable org.jline:jline (jline-remote-telnet) from Hadoop transitive dependencies, and upgraded jackson-databind to 2.21.4. #75066 #75373

Bug Fixes

The following issues have been fixed:

• Incremental scan-range scheduling could recompute a different per-driver layout when reusing a deployed fragment instance, leaving part of the scan ranges unconsumed and losing rows (for example, INSERT from Hive). #74674
• INT96 timestamps nested inside ARRAY/MAP/STRUCT in Parquet files read via FILES() or Broker Load missed the session-timezone conversion and were returned shifted by the timezone offset (top-level INT96 columns were correct). #74868
• The audit log did not record the exported row count of SELECT INTO OUTFILE. #74467
• A strict cast could raise an overflow error from the underlying data of NULL rows, which should be ignored. #74903
• parse_json did not respect the ALLOW_THROW_EXCEPTION setting when handling invalid input. #74976
• First-load statistics collection could not be enabled per table while disabled globally: an explicitly set table property now takes precedence over the global configuration enable_statistic_collect_on_first_load. #74794
• Partial column updates on shared-data tables could crash the BE or silently corrupt data when the tablet schema drifted from the transaction schema. #74005
• Unexpected BE process restarts. #74424
• A BE crash (SIGFPE) in Iceberg truncate/bucket partition transforms when the width or bucket count is zero. #74998
• A BE crash caused by a null driver_executor in FragmentContext::set_final_status. #75030
• A race between transaction begin and autovacuum could delete a still-needed transaction log, permanently wedging the partition's publish ("Both txn_log and corresponding tablet_meta missing"). #74906
• avg(DISTINCT x) was incorrectly rewritten to use a sum/count materialized view, returning wrong results. #75071
• A boundary bug in TopN RANK sorting could produce incorrect results. #75045
• split / split_part / str_to_map with an empty delimiter could read out of bounds on invalid UTF-8 input. #75068
• ALTER TABLE ... MODIFY COLUMN ... AFTER a nonexistent column now returns a clear error message. #75073
• A BE crash (SIGFPE) in mod() / pmod() when computing the type's minimum value modulo -1. #74980
• bar() grew memory without bound on a negative or huge width (potential DoS); such inputs are now rejected with an error. #75143
• The transaction-state callback was not unregistered when a multi-statement stream load task was removed. #75188
• A crash when a query was cancelled during spill partition sorting. #75140
• The query memory limit was not enforced during table function execution. #75179
• Selecting a column named floor or ceil failed at parse time with a ClassCastException. #75241
• A heap-use-after-free in OrderedPartitionExchanger when the previous chunk was mutated downstream. #75279
• Three FE metadata-lock correctness races. #74968
• Load spilling could dereference a missing query context when recording spill metrics. #75236
• ADLS2 ListPaths on storage accounts without hierarchical namespace caused CN crashes and vacuum failures. #75166
• BE/CN JVM metrics emitted invalid Prometheus # TYPE lines. #75240
• JIT code generation truncated LARGEINT literals to 64 bits, producing wrong results. #75137
• A combined ALTER TABLE on an external Iceberg table re-executed already-queued actions. #74036
• A nested-loop join crash caused by a build-side column nullability mismatch. #75343
• Iceberg manifest column statistics are now cached selectively to avoid excessive FE memory usage. #75395
• addPhysicalPartition could create only one physical partition per call, making physical-partition backfill of random-distribution tables extremely slow. #75430
• A SQL injection vulnerability in the information_schema.task_runs predicate lookup. #75520
• A BE crash (SIGSEGV) when multiple UNNEST calls in one query referenced the same array column. #75012
• Incorrect translation of nested dictionary-encoded expressions across exchange nodes. #75246
• The join skew hint was lost when the optimizer duplicated expressions. #68964
• Collecting the tables referenced by a view did not skip CTE references. #74813
• A BE abort on CAST(json AS STRUCT<...>) when a struct field name is not a valid JSON path. #75355
• Temporary Parquet dictionary-code columns could leak to upper layers of the execution plan. #74452
• Incorrect results caused by the sort-column elimination optimization. #74983
• The UNNEST result struct type was not narrowed consistently with its input array element type. #75445
• A race between the FE EOS-cancel and the BE stage-2 deployment could mark a successfully finished query as cancelled. #75009
• Join reorder pruning could drop columns that predicates still referenced. #74791
• The global metadata lock was not released when a metadata image dump failed to acquire some database locks, blocking subsequent metadata operations. #75488
• StringSearch::_pattern was left uninitialized, and the split_debug_symbol l...

3.5.19

Release date: June 26, 2026

Behavior Changes

• parse_json now respects ALLOW_THROW_EXCEPTION: malformed JSON fails the query instead of silently producing NULL, mirroring the earlier get_json_string change. #74976
• FILES() and Broker Load now honor the Parquet isAdjustedToUTC=false flag for INT64 timestamps, so such timestamps are no longer shifted by the session time zone. #73674
• SHOW FUNCTIONS now surfaces the isolation property (shared or isolated) for Java UDFs and UDAFs. #75255
• The non-reserved keywords FLOOR and CEIL are now allowed as column names. #75241

Improvements

• Supports loading Arrow LARGE_LIST and FIXED_SIZE_LIST columns into JSON columns via FILES() and Broker Load. #73714 #73718
• Added an opt-in statistics_large_string_column_merge_threshold to isolate wide CHAR/VARCHAR columns into dedicated statistics collection. #73258
• Optimized base64_to_bitmap for constant inputs and hardened it against invalid base64-encoded bitmaps. #74684
• Added new metrics for lake vacuum batch size and retry counts, and gauges for CatalogRecycleBin size. #74112 #74440
• Supports auditing a statement twice. #73896

Bug fixes

The following issues have been fixed:

• Several wrong-result and planning issues: low-cardinality dictionary translation for expressions where f(NULL) is not NULL; a Multiple entries with same key error from common-subexpression elimination of commutative AND/OR; an AGGREGATE has mismatch types error; a compound predicate with an always-false nested branch under UNION returning no rows; and an off-by-one that dropped a row in RANK TopN at a chunk boundary. #69376 #72823 #74159 #74218 #75045
• Materialized view rewrite issues that could return incorrect results: aggregate MVs with a HAVING clause rewriting queries without (or with weaker) HAVING, and avg(DISTINCT x) being rewritten through a sum/count MV. #73610 #75071
• Incorrect window-function results when enable_push_down_pre_agg_with_rank split a window count into local pre-aggregation and global analytic merge, and an empty window operator generated after pushing down distinct aggregation. #74453 #74810
• Partition TopN losing a child operator's output column, and silently swallowing sort or pre-aggregation errors and returning wrong or partial results. #72848 #74693
• Iceberg equality-delete rows with NULL identity-column values were not applied. #67321
• A spurious strict-mode cast overflow error raised from undefined data in NULL rows. #74903
• Decimal scale could be lost when a column is entirely NULL. #73789
• BE crashes in to_base64 (stack overflow), JSON load of nested types via partial append, local partition TopN with a non-nullable aggregate result, partitioned join (out-of-bounds from inaccurate memory accounting), runtime profile serialization (counter min/max race), JIT compilation failure (use-after-free of LLVMContext), invalid JIT IR for CASE WHEN with mixed float/integer types, and partial column updates under schema drift. #70623 #73715 #69752 #74315 #72904 #74396 #74382 #74005
• An out-of-bounds read and potential oversized allocation in split, split_part, and str_to_map when the input ends with a truncated UTF-8 byte. #75068
• A memory leak from the UDAF context cache and inflated query-pool memory accounting in OlapTableSink. #74025 #73807
• Unexpected backend process restarts. #74424
• Materialized view issues: a slot-nullability crash for MVs defined with FULL OUTER JOIN under late materialization, an NPE refreshing nested MVs, a duplicated warehouse property in SHOW CREATE MATERIALIZED VIEW, and a vector ANN query polluting a shared table schema and breaking unrelated statements. #72621 #73644 #69418 #74785
• Querying Paimon tables whose DATE partition column contains NULL values. #73950
• Reading Hudi MOR tables with char/varchar columns when hudi_mor_force_jni_reader is enabled. #58521
• Nested INT96 timestamps (inside ARRAY, MAP, or STRUCT) were shifted by the session time zone during FILES()/Broker Load. #74868
• Incorrect bytes-read statistics in the audit log for connector scans, and incremental connector scan ranges being assigned to driver sequences absent from the deployed fragment, which could drop part of the scan. #73799 #74674
• Meta scan could fail after schema changes such as ADD COLUMN, which could fail background statistics collection. #72901
• Slow broker RPCs held the per-job Routine Load write lock and blocked admin RPCs and SHOW ROUTINE LOAD. #73591
• ALTER ROUTINE LOAD persisted an invalid statement for reserved-keyword table names, which could drop the load clause on FE restart. #74188
• GRANT/REVOKE on the public role did not invalidate cached merged privileges, leaving stale authorization. #73717
• A race allowing concurrent operations to observe torn state during table and materialized-view RENAME and SWAP, and a data race on MaterializedIndexMeta schema-update tracking. #74100 #74412
• Database-level UDFs were missing on FE followers after RESTORE ... AS <new_db>. #74313
• Queries could become unkillable when a coordinator held its lock during external resource cleanup. #72830
• A permanent version hole on non-primary-key replicas could cause queries to fail with version not found. #74408
• Force-killed SUBMIT TASK runs disappeared from task-run history (and session-prefixed task-run timeouts are now honored), and an illegal running-to-running edit log could wedge subsequent task runs. #74146 #73882
• ADMIN SHOW REPLICA STATUS emitted a misaligned row for missing replicas, which could hang or disconnect the client. #74393
• CatalogRecycleBin halted all deletions in shared-data mode when cluster snapshots kept failing, causing unbounded FE memory growth. #74379
• An NPE in statistics calculation when a partition is dropped concurrently, and zero row counts written into partition statistics after INSERT OVERWRITE corrupting cardinality estimates. #73711 #74801
• Colocate tablets with all replicas on dead BEs were reported as healthy when tablet_sched_disable_colocate_balance is enabled. #73550
• An IllegalMonitorStateException from a lock mismatch in the tablet checker could abort a checker round. #74596
• Reduced lock contention by narrowing several full-database WRITE locks to table-scoped locks in shared-nothing mode, and skipped unnecessary locking in TabletInvertedIndex.deleteTablets for empty input. #74523 [#73955](https://github...

4.0.12

4.0.12

Release Date: June 25, 2026

Behavior Changes

• When reading INT64 timestamps from Parquet files written with isAdjustedToUTC=false (timezone-naive), SELECT FROM FILES() and broker/stream LOAD no longer shift the values by the session timezone offset. Such timestamps are now read as wall-clock values, consistent with Trino, Spark, and Impala. Previously the values drifted whenever the session timezone was not UTC. #73674
• CTAS (CREATE TABLE AS SELECT) now preserves the declared VARCHAR(N) length when the source carries an explicit user length (a catalog column reference, CAST AS VARCHAR(N), or a string literal), instead of widening it to VARCHAR(1048576). This keeps the length constraint enforceable and aligns DDL with dbt schema contracts. Materialized view materialization still widens columns as before. #73498
• The Paimon connector now respects the session variable connector_max_split_size when calculating scan splits, instead of always using the default value, so tuning it now affects Paimon scan parallelism. #71756

Improvements

• Optimized base64_to_bitmap by folding the conversion at constant-evaluation time for constant inputs. #74684
• ngram_search now supports a non-constant needle (the search term can be a column expression rather than only a constant). #74675
• The Arrow-to-JSON converter now supports LARGE_LIST and FIXED_SIZE_LIST types. #73714
• Added an opt-in option to isolate wide-string columns during statistics collection to reduce memory pressure. #73258
• information_schema.COLUMNS now populates the DATETIME_PRECISION field. #74623
• Relaxed database read locks to table-scoped intensive locks in InformationSchemaDataSource and FrontendServiceImpl to improve concurrency. #73936 #73913
• Narrowed database write locks to table-scoped intensive write locks for shared-nothing clusters, and scoped replica row-count updates to the table lock. #74523 #74521
• Moved the routine-load broker RPC out of the per-job write lock to reduce contention. #73591
• Deferred JDBC REMARKS fetching out of the getTable() hot path to speed up metadata access for JDBC catalogs. #73488
• Pushed down the table_name predicate for information_schema.tables_config queries. #73210
• Skipped per-replica scans on single-medium BEs in BackendLoadStatistic. #73555
• Added a write timeout to the MySQL channel result send path to prevent stuck connections. #73646
• Added catalog recycle bin size gauge metrics. #74440
• Added vacuum batch-size and retry-count metrics, and added decorrelated jitter to the lake vacuum retry backoff to reduce retry storms. #74112 #74108
• Upgraded third-party dependencies to address security vulnerabilities (CVE): Netty to 4.1.135.Final, Tomcat to 9.0.118, and Thrift to 0.23.0. #74668 #73797 #73625

Bug Fixes

The following issues have been fixed:

• Successfully committed multi-statement transaction stream loads were shown as PREPARING forever in information_schema.loads and SHOW STREAM LOAD. #74386
• Rows were silently dropped from information_schema.loads on clusters whose session timezone differs from Asia/Shanghai, because load times were exchanged as naive wall-clock strings across the BE/FE thrift boundary. #73365
• The COMMIT of an explicit transaction waited only query_timeout milliseconds (instead of seconds) for the database write lock due to a unit mismatch. #73549
• current_timestamp / now() column defaults were displayed as a frozen literal after ALTER TABLE ... ADD COLUMN and could be lost across FE restarts or edit-log replay. #73455
• Querying sys.fe_memory_usage / sys.fe_locks without the OPERATE ON SYSTEM privilege returned a misleading RPC-failure message instead of a clear access-denied error. #73567
• Automatic per-key Hive partition stats refresh could overload the Hive Metastore for tables with many partitions. #73563
• A null-pointer issue when reading the GTID during a schema change. #74855
• An empty analytic operator was not pruned after pushing down a distinct aggregation. #74810
• Zero row counts could corrupt partition statistics. #74801
• Vector index rewrite could pollute the shared table schema. #74785
• An IllegalStateException during parallel profile collection, fixed by making Tracers fork-aware. #74746
• BE vacuum tasks were not aborted once the FE caller's timeout elapsed. #74694
• Partition consumer errors in ChunksPartitioner were lost instead of being propagated. #74693
• A lock mismatch in blockingAddTabletCtxToScheduler. #74596
• A typo in the azure_adls2_oauth2_client_endpoint configuration field name. #74581
• Pipeline observers were not notified on missed operator state transitions. #74557
• The reported vacuum watermark was incorrect when retain-boundary metadata was gone. #74429
• A data race on MaterializedIndexMeta during updateSchemaBackendId. #74412
• A non-primary-key replica could get stuck with a permanent version hole; it now self-heals. #74408
• A use-after-free of LLVMContext when JIT compilation fails. #74396
• A column mismatch in the missing-replica row of ADMIN SHOW REPLICA STATUS. #74393
• Invalid JIT IR generated for CASE WHEN with mixed float/int WHEN and result types. #74382
• The CatalogRecycleBin was frozen when a cluster snapshot kept failing. #74379
• A partial update targeting a table modified earlier in the same explicit transaction is now rejected with a clear error. #74344
• Immutable-partition updates did not use the transaction's compute resource. #74316
• A potential out-of-bounds error caused by partitioned join. #74315
• Database-level UDFs were not restored to the renamed target database for FE followers. #74313
• Non-root compound predicates yielded EOF instead of NotPushDown. #74218
• Table names were not backquoted when persisting the routine load origStmt. #74188
• An assertion name lookup error in assert-num-rows. #74178
• Aggregation used type-mismatched aggregate functions. #74159
• Force-killed task runs were not archived, and session-prefixed task-run timeouts were not honored. #74146
• RENAME and SWAP (for tables and materialized views) now take the database write lock to avoid concurrent-modification issues. #74100
• Composite-rowset stats were not summed when batching op_writes in primary-key multi-statement transactions. #74059
• The sink was not notified when a distinct aggregate source finished. #74055
• pipe_file_list was not recreated when _statistics_ was dropped. #73970
• A crash in TabletInvertedIndex.deleteTablets, fixed by fast-path skipping empty input. #73955
• The task manager could write an illegal edit log for a task run. [#73882](#73882...

3.5.18

Release date: June 5, 2026

Behavior Changes

• SHOW statements are now allowed inside explicit transactions. #72954
• get_json_string now respects ALLOW_THROW_EXCEPTION when handling JSON parsing errors. #73199
• IGNORE NULLS is now preserved in view definitions when the window function argument is an expression. #69971
• Ranger row filter and masking policies are now correctly applied to Hive views and to base tables expanded from Hive view definitions. #73265
• Hive partition statistics are no longer automatically refreshed per partition. Existing cached stats are preserved while a table-level asynchronous refresh updates the cache in batches. #73563

Improvements

• Supports caching Java UDAF class-level initialization so shared UDAFs can reuse loaded classes and generated stubs across aggregator and window-function instances. #72038
• Supports Paimon time types and improves Paimon materialized view handling. #58292
• Added an Avro schema cache for shadowed PartitionData during partition load. #72215
• Added a configurable FE write timeout mysql_send_packet_timeout_ms for the MySQL result send path to prevent indefinitely blocked result sending to slow clients. #73646
• Optimized CatalogRecycleBin adjusted recycle timestamp lookup. #72128
• Reduced metadata and lock overhead in load balancing, compaction scheduling, consistency checks, and StarMgr metadata synchronization paths. #73555 #72218 #72178 #72108
• Improved diagnostics for filesystem copy failures and Parquet broker load errors by surfacing the underlying cause and file/column/row context. #73414 #73236
• Reduced external catalog and information schema metadata overhead by deferring JDBC REMARKS fetching, avoiding redundant Paimon snapshot lookups, and pushing down table_name predicates for information_schema.tables_config. #73488 #72892 #73210
• Simplified the scalar-function merge implementation by using merge() directly. #69575

Bug fixes

The following issues have been fixed:

• Empty ALTER TABLE statements could be parsed as OPTIMIZE clauses, and replaying malformed OPTIMIZE jobs could clear a table's default distribution. #73352
• Decimal-valued unit counters in runtime profiles could cause query progress parsing failures and noisy FE warnings. #73683
• Concurrent SegmentFlushTask race in DeltaWriter::commit() and loss of merge_condition during normal rowset commit. #73371 #72542
• Crashes, hangs, or unsafe cleanup in SinkBuffer graceful exit, PipelineTimerTask, runtime filter workers, spillable hash join probe, information_schema.warehouse_queries, lake vacuum, HTTP connection unregister paths, and query queue timeout handling. #73202 #73082 #72058 #72626 #72397 #72019 #73088 #72006 #65802
• Materialized view issues involving JDBC SQL Server tables, lost index properties, cached plan context memory leaks, Paimon tables, and incorrect shuffle distribution after MV rewrite. #72962 #69187 #72300 #58292 #71075
• Query planning and rewrite issues in Spark connector external scans, INSERT OVERWRITE re-planning, aggregation spill with small LIMIT, and generated columns produced by UNNEST. #73225 #72832 #72705 #72027
• Paimon Primary Key columns could be incorrectly marked as non-nullable when querying external catalogs. #71660
• Primary Key and tablet metadata issues including partial tablet schema short-key mismatch, rowset metadata cache warmup deadlock, disk data cache expansion failure, Azure filesystem client cache issues in Starlet, and colocate-heavy cluster-balance performance issues in StarOS. #70586 #71459 #58206 #73145 #72391
• Locker rollback and unlock-order issues during partial intensive-lock acquisition. #72789 #72423
• Dependency CVEs and broker dependency regressions. #72905 #72797 #72184 #72191
• JNI local-reference leaks in JDBC scanner initialization. #72913
• Arrow dictionary values in Parquet scanner and Apache Parquet namespace ambiguity during scanner builds. #71855 #72284
• NPE in Iceberg getPartitionLastUpdatedTime when the snapshot is expired. #68925

4.0.11

Release Date: June 5, 2026

Behavior Changes

• get_json_string and the other get_json_* functions now return the JSON parse error instead of NULL when implicit VARCHAR-to-JSON parsing fails under ALLOW_THROW_EXCEPTION. The default behavior (returning NULL when the mode is disabled) is unchanged. #73199
• pipeline_enable_large_column_checker is now enabled by default. #72798

Improvements

• Lake write-path load spill files now use a flat, single-level directory layout with the transaction ID baked into each filename, and are reclaimed by a txn-id-based vacuum pass. This moves bulk deletes off the write hot path and lets vacuum clean up spill files leaked by BE crashes. #73064
• SHOW statements (such as SHOW GRANTS and SHOW WAREHOUSES) are now allowed inside an explicit transaction, so BI/JDBC clients that automatically issue SHOW no longer break the transaction flow. #72954
• Java UDAF and UDTF now support STRUCT arguments and return types. #72911
• Scalar Java UDF now supports STRUCT arguments. #72620
• Java UDF now supports DATE and DATETIME types. #72337
• Java UDF now supports nested ARRAY/MAP types. #72283
• Added the FE configuration deploy_serialization_min_thread_pool_size. #72274
• Skipped redundant partition key expression building when an add_partition_value deduplication hit occurs. #73156
• Avoided a redundant latestSnapshot() call in PaimonMetadata#getTableVersionRange. #72892
• Deduplicated commutative AND/OR expressions in scalar operator common subexpression elimination. #72823

Bug Fixes

The following issues have been fixed:

• A memory leak introduced by the UDAF cache. #74025
• An incorrect implementation in aggregate combined functions. #74169
• An issue in shared-data combined txn log mode where the per-partition coordinator claim was not re-recorded on every sender's open, which could drop txn logs. #73962
• A read failure on Iceberg tables that use a custom LocationProvider, fixed by lazily initializing the LocationProvider in SerializableTable. #73482
• A serialization failure caused by the de.javakaffee UnmodifiableCollectionsSerializer, now replaced with a Java 17-compatible version. #73458
• HdfsFsManager copy error messages now include the underlying cause. #73414
• A concurrent SegmentFlushTask race in DeltaWriter::commit(). #73371
• Sort merge provider errors are now propagated to the fragment context instead of being lost. #73337
• An issue where Ranger row-filter/masking policies on Hive views were skipped, so policies on the view or its base tables were not applied. #73265
• Upgraded libthrift to 0.23.0 to address a security vulnerability (CVE). #73243
• An FE file-descriptor leak, fixed by reusing HttpClient instances. #73239
• Parquet broker load errors now include file/column/row context. #73236
• A slot lookup failure for output slots with an empty col_name in the Spark connector external scan. #73225
• A crash in SinkBuffer during graceful exit. #73202
• Query cache conflicts with local shuffle aggregation. #73194
• A use-after-free of the Hive partition descriptor across fragment teardown. #73176
• A thread-safety issue in lake vacuum, fixed by using localtime_r. #73088
• A race condition between PipelineTimerTask doRun and unscheduling during query context destruction. #73082
• Lock contention on read-only query-engine paths, reduced by relaxing DB locks. #73067
• An materialized view refresh failure with SQL Server tables in a JDBC catalog. #72962
• A JNI local-reference leak in JDBCScanner::_init_jdbc_scanner. #72913
• An issue where partition TopN could lose a child's output column. #72848
• An incorrect plan caused by not clearing LambdaArgument.transformedOp before INSERT OVERWRITE re-planning. #72832
• The coordinator lock was held during external resource cleanup. #72830
• Locker rollback is now exception-safe and the unlock order is fixed. #72789
• An incorrect byte order in ColumnDict.merge, now using unsigned byte order. #72778
• A stack-buffer-overflow when formatting into a temporary std::string. #72728
• The HAVING clause is now checked when disabling aggregation spill on a small LIMIT. #72705
• A hang caused by joining forwarded RPCs when draining the runtime_filter worker. #72626
• Incorrect lazy-materialization slot nullability for a materialized view over an outer join. #72621
• merge_condition was not preserved when applying a normal rowset commit. #72542
• Lock contention in TabletScheduler / TabletSchedCtx hot paths during clone, reduced by relaxing DB locks. #72475
• Locker did not roll back a partial intensive-lock acquisition. #72423
• A spillable hash join probe crash. #72397
• COALESCE children are now cast to a common type in the JOIN USING transformer. #72338
• DB READ lock was held too broadly for single-table proc directories, now relaxed to per-table. #72334
• A memory leak when caching the materialized view plan context. #72300
• FSE-v2 did not set the schema for shared-data sorted schema change. #72235
• ConsistencyChecker held a DB READ lock too broadly in periodic scans, now relaxed to per-table READ. #72218
• A BE crash when querying information_schema.warehouse_queries. #72019
• A trailing \r was not stripped before the closing enclose in CRLF CSV inputs. #71866
• Paimon primary key columns were incorrectly marked as non-nullable when querying an external catalog. #71660
• A redundant double slash was created when constructing the JDBC URL if the URI already ended with a trailing slash, breaking strict drivers such as ClickHouse. #70992

4.1.1

4.1.1

Release Date: May 29, 2026

Container Image Issue (v4.1.0): Due to an unstable load order issue in the v4.1.0 container image, BE processes may fail to start reliably in container environments. Container environment users should NOT upgrade to v4.1.0; use v4.1.1, which includes the fix (#71825).

Downgrade Notes: After upgrading StarRocks to v4.1, DO NOT downgrade to any v4.0 version below v4.0.6. Due to internal data-layout changes in v4.1 (tablet splitting and distribution), downgrade from v4.1 is only supported to v4.0.6 or later.

Behavior Changes

• The Hive connector now uses a native C++ Avro scanner instead of the JNI Avro scanner by default. #73237 #73569
• Query rewrite over INCREMENTAL/AUTO materialized views is now disabled, and FORCE refresh and partition refresh are rejected for INCREMENTAL/AUTO materialized views. #72890 #72336 #71355

Improvements

• Java UDF/UDAF/UDTF now support more types: STRUCT arguments and return values for UDAF/UDTF, nested ARRAY/MAP types, DATE/DATETIME, DECIMAL, and varargs. #72911 #72283 #72337 #72208 #68596
• Scalar UDFs now support STRUCT arguments. #72620
• Python UDFs now support nested ARRAY/MAP types. #72210
• UDAFs are now loaded and initialized once and reused across queries, reducing per-query overhead. #72038
• Replaced the JNI Avro scanner with a native C++ scanner for the Hive connector, with direct binary decoding and support for avro.schema.literal and avro.schema.url. #73237 #73283 #73257 #73569
• Supports the Trino WITH clause in CTAS statements. #71960
• Completed Iceberg timestamptz partition transform support on the sink path. #73397
• Enabled TopN runtime filter pushdown for Iceberg table aggregation. #72332
• Supports Iceberg datetime min/max optimization. #71870
• Allows HDFS HA configuration passthrough in Catalog and BE to support accessing multiple HDFS clusters. #71521
• Added a partition scan number limit for external table queries. #68480
• Fails fast for unsupported Iceberg V3 features. #70242
• Supports csv.enclose and csv.escape for CSV exports via INSERT INTO FILES. #71589
• Added the enable_push_down_schema INSERT property for full schema push-down to files(). #70978
• Routine Load jobs are now paused on non-retryable errors (for example, primary key size exceeded). #71161
• Supports join reorder for complex expressions from two children. #71615
• Improved CBO statistics estimation, including MCV/null-fraction propagation for date_trunc, array_map, CASE WHEN, IS NULL, UNION, and constants. #72233 #70372 #70221 #70865 #70989 #71000
• Improved skew join detection: skew is only detected when all join keys are skewed, and a force_group_by_skew_eliminate_when_skewed switch was added to force the skew rule. #72753 #71382
• Supports constant folding for regexp_replace in the FE. #70804
• Optimized MIN/MAX on date partition columns with constant partition values. #69880
• Introduced the SCHEDULE keyword as a synonym for ASYNC in materialized view refresh. #72329
• Supports tablet creation retry for Lake tables in shared-data mode. #71068
• Supports conditional update for Lake column-mode partial update. #71961
• Parallelized partial-update publish, persistent index initialization, and SSTable opening to improve ingestion throughput. #71652 #71217 #72112 #71145 #72986
• Supports DCG file synchronization during shared-nothing to shared-data replication. #69339
• Supports schema evolution for widening VARCHAR length on both key and non-key columns. #70747
• Added the snapshot_meta.json marker for cluster snapshot integrity checks. #71209
• Supports LDAP direct bind authentication via a DN pattern. #71559
• Added the get_query_dump_from_query_id meta function for easier query troubleshooting. #72875
• Supports auditing queried relations in the audit log. #71596
• Added session variables for MySQL binary result encoding. #71415
• Added metrics for better observability, including tablet_num for shared-data clusters, MemtableIOSpeed, staros_shard_count, and Iceberg metadata-table query metrics. #71444 #69842 #73096 #70825
• Added the FE configuration deploy_serialization_min_thread_pool_size. #72274
• Added the tablet_reshard_enable_tablet_merge configuration to disable MergeTabletJob creation. #70906
• Eliminated HTTP-server accept thundering-herd via SO_REUSEPORT. #72956

Security

• [CVE] Upgraded Netty to 4.1.133.Final. #72905
• [CVE-2026-42198] [CVE-2026-5598] Bumped pgjdbc to 42.7.11 (client-side DoS via unbounded SCRAM PBKDF2 iteration count) and BouncyCastle to 1.84 (FrodoKEM private-key leakage). #72797
• [CVE-2026-32280] [CVE-2026-32282] Built pprof with go1.25.9 to eliminate Golang CVEs. #71944 #73545
• Upgraded jetty-http to 9.4.58.v20250814. #71762
• Cleaned up Broker dependency CVEs and removed wildfly-openssl. #72184 #71908
• Redacted credentials in INSERT INTO FILES error messages. #71245

Bug Fixes

The following issues have been fixed:

• CN segfault on startup caused by hash_util static initialization order. #71825
• CN crash when scanning an empty tablet with physical split enabled. #70281
• BE crash when querying information_schema.warehouse_queries. #72019
• SIGFPE in Lake compaction when rowset num_rows is zero. #71742
• Division-by-zero in ExecutionDAG fragment connection. #67918
• Graceful-exit crash in SinkBuffer. #73202
• Spillable hash join probe crash. #72397
• Stack-buffer-overflow when formatting into a temporary std::string. #72728
• Crash in reverse(DecimalV3). #71834
• Use-after-free in LoadChannel::get_load_replica_status caused by temporary shared_ptr destruction. #71843
• Use-after-free in ThreadPool::do_submit when thread creation fails. #71276
• Hive partition descriptor use-after-free across fragment teardown. #73176
• An information schema sink use-after-free. #71513
• An FE file descriptor leak by reusing HttpClient instances. #73239
• JNI local-reference leak in JDBCScanner::_init_jdbc_scanner. #72913
• Memory leak when caching the MV plan context. #72300
• Unexpected memory overuse in local exchange. #72262
• Race on response->tablet_metas in Lake publish_version. https://github.com/StarRocks/star...

4.0.10

4.0.10

Release Date: May 9, 2026

Behavior Changes

• Cloud storage credentials are now redacted in error messages produced by INSERT INTO FILES, preventing accidental exposure of secrets in error logs and SHOW LOAD output. #71245
• StarRocks no longer permits queries against insert-only ACID Hive tables in Hive catalog. Previously such queries could silently return more rows than actually visible because INSERT OVERWRITE operations were not recognized. Affected tables now return an explicit error instead of incorrect results. #71460

Improvements

• Added an Avro schema cache in Iceberg PartitionData construction to remove redundant Jackson ObjectMapper allocations during partition load on tables with many partitions. #72215
• Optimized CatalogRecycleBin.getAdjustedRecycleTimestamp to avoid rebuilding the table-id map on every call, reducing recycle-bin cleanup and tablet scheduling overhead. #72128
• OlapTableSink.createLocation now batches tablet-location lookups in shared-data mode, removing per-tablet StarOS RPCs that previously stalled the planner critical section. #72041
• Java UDAF instances are now loaded and initialized once per query and reused across pipeline driver instances, removing the linear driver-preparation overhead at high pipeline_dop. #72038
• Added BE metrics starrocks_be_staros_shard_info_fallback_total and starrocks_be_staros_shard_info_fallback_failed_total to track when the StarOS worker falls back to fetching shard info from starmgr because the local cache missed. #71620
• File-bundle writes now prefer a tablet-local aggregator so the bundled tablet metadata path does not require cross-node shard-info lookups. #71613
• Audit log entries now include the queried tables and views referenced by each query. #71596
• INSERT INTO FILES CSV export now supports csv.enclose and csv.escape properties for controlling field quoting and escaping. #71589
• Added LDAP direct bind authentication via DN pattern, removing the requirement for an admin search account in single-tenant LDAP setups. #71559
• Added the starrocks_fe_tablet_num metric for shared-data clusters to match the shared-nothing metric set. #71444
• star_mgr_meta_sync_interval_sec is now runtime-mutable via ADMIN SET FRONTEND CONFIG; the new interval takes effect on the next sync cycle without an FE restart. #71675

Bug Fixes

The following issues have been fixed:

• A race in shared-data combined txn log mode where INSERT into per-partition coordinator dispatch could classify legitimate txn logs as orphan and drop them, leaving the transaction stuck in non-VISIBLE state. #72237
• An issue where _incremental_open_node_channel channels in shared-data combined txn log mode silently dropped txn logs because the legacy "sender_id == 0 collects all logs" rule did not apply to incremental channels. #71992
• An issue where RuntimeProfile::to_thrift() could crash BE with std::bad_optional_access when another thread reset counter min/max values during profile serialization. #72904
• An inconsistency in flat JSON merge results when one side contributed empty values. #72973
• An issue where CREATE TABLE for an Iceberg table failed with "Multiple entries with same key: format-version" when the user explicitly specified format-version in PROPERTIES. #72828
• A CompactionScheduler.startCompaction lock scope that held a DB-wide READ lock across single-table critical work, blocking concurrent DDL on other tables in the same database. Switched to IS on DB plus READ on the target table. #72178
• An issue where StarMgrMetaSyncer.syncTableMetaInternal and syncTableColocationInfo held DB READ/WRITE locks across external StarOS RPCs, freezing CREATE/DROP/ALTER/RENAME on every table in the database for the duration of each RPC. #72108
• An issue where StarMgrMetaSyncer.getAllPartitionShardGroupId held the DB READ lock for full iteration over all cloud-native tables and physical partitions, stalling FE threads waiting for the DB write lock on large catalogs. #71614
• A redundant DB READ lock in getTableNamesViewWithLock. The underlying nameToTable is a ConcurrentHashMap, so the enclosing lock added contention without correctness benefit. #72042
• A DB WRITE lock in the read-only /api/{db}/{table}/_count REST endpoint that was unnecessary for computing proximateRowCount(). #72053
• A batch publish deadlock caused by partition version gaps that operations like tablet split, schema change, and alter jobs reserved by advancing nextVersion without a matching publish. #71483
• A deadlock in shared-nothing mode when warming up the LRU cache for rowset metadata while the cache was full. #71459
• A PipelineTimerTask that could remain stuck in waitUtilFinished due to incorrect ordering between consumer registration and finished signaling. #72058
• A condition race in ConnectorSinkPassthroughExchanger::accept that crashed BE with SIGSEGV via out-of-bounds vector access on _writer_count. #71848
• A use-after-free in LoadChannel::get_load_replica_status caused by destruction of a temporary shared_ptr. #71843
• A use-after-free in the information schema sink due to a missing reference count increment in async RPC closure handling. #71513
• A BE crash in reverse(DecimalV3) caused by improper handling of decimal value width. #71834
• A BE crash when UNNEST produced columns whose define-expression carried an ARRAY type, which was incompatible with global dictionary generation downstream. #72027
• An NPE in FE when creating an Iceberg external table with invalid transform argument order such as bucket(4, region); FE now returns a normal analyzer error. #71917
• An issue where Iceberg manifest data file cache entries were missing column statistics when the first query against a table did not request stats (for example SELECT *). #71913
• An issue where the Iceberg min/max optimization was silently skipped when the table was partitioned by bucket(col, N) because PruneHDFSScanColumnRule injected a placeholder materialized column. #71863
• An issue where AggregateJoinPushDownRule failed to rewrite materialized views over Iceberg base tables because Table.getId() was compared instead of identity, and connector-table ids can shift across plan rebuilds. #71856
• An issue where INSERT OVERWRITE into Hive dynamic partitions failed when the metastore listed a partition whose location no longer existed on the file system; the missing partition directory is now created before commit. #71810
• A Parquet scanner failure (Illegal converting from arrow type(dictionary) ...) when Arrow returned dictionary-typed columns, including dictionaries nested inside arrays, structs, and maps. #71855
• An issue where stale scan ranges from earlier batches persisted across ColocatedBackendSelector.Assignment incremental batches, causing files to be re-deployed and re-scanned. #71789
• An issue where PruneShuffleColumnRule did not update the Join outputProperty after pruning Exchange shuffle columns, leading to incorrect downstream distribution. #72003
• Incorrect shuffle distribution caused by a missing project node when PushDownJoinOnExpressionToChildProject was disabled during the first stage of multi-stage MV rewrite. #71075
• Duplicate Apply attachments in ReplaceSubqueryRewriteRule when predicate normalization made the same scalar-subquery placeholder appear multiple times. #71155
• A short-circuit issue in EventScheduler where a finished join probe could prevent the pipeline from transitioning to the finished state. #71740
• An issue where AWS assume-role configured via aws.s3.iam_role_arn was not applied to JNI scanners (RCFile / A...

3.5.17

Release date: May 13, 2026

Behavior Changes

• SHOW CREATE TABLE and DESC now show Primary Keys for Paimon tables. #70535
• Disallowed INSERT into insert-only ACID Hive tables in Hive catalogs. #71460
• START_TIME and END_TIME in Profile are now displayed using the session time zone. #71429

Improvements

• Supports csv.enclose and csv.escape in INSERT INTO FILES CSV export. #71589
• Added query relation information (directly queried tables and viewa) to audit logs. #71596
• Made the FE configuration star_mgr_meta_sync_interval_sec runtime mutable. #71675
• Reduced metadata and lock overhead in table metadata and row-count paths. #72053 #72042 #71672
• Improved build and dependency hygiene by merging the broker builder into the FE build and removing WildFly OpenSSL. #71823 #71908

Bug fixes

The following issues have been fixed:

• Wrong results for local-shuffle aggregate queries with OFFSET. #71997
• Incorrect Join output properties after Exchange shuffle columns are pruned. #72003
• Several dependency CVE issues. #71762 #71914
• Oracle JDBC NLS format handling issue. #71412
• Missing Iceberg column statistics in manifest data file cache. #71913
• Missing Hive partition directory before INSERT OVERWRITE commit. #71810
• Aggregate-join-pushdown materialized view rewrite and min/max optimization issues on Iceberg base tables. #71856 #71863
• Race conditions in ConnectorSinkPassthroughExchanger and LoadChannel::get_load_replica_status. #71848 #71843
• Credential redaction issue in INSERT FILES operations. #71245
• Incorrect reverse(DecimalV3) results. #71834
• Missing JNI exception handling checks in Java UDF code. #71734
• Incorrect short-circuit checks in EventScheduler. #71740
• Incorrect Arrow Flight column name for empty result sets. #71534
• Batch publish deadlock caused by partition version gaps. #71483
• Repeated Apply attachments in scalar-subquery plans. #71155

4.0.9

4.0.9

Release Date: April 16, 2026

Behavior Changes

• When VARBINARY columns appear inside nested types (ARRAY, MAP, or STRUCT), StarRocks now correctly encodes the values in binary format in MySQL result sets. Previously, raw bytes were emitted directly, which could break text-protocol parsing for null bytes or non-printable characters. This change may affect downstream clients or tools that process VARBINARY data inside nested types. #71346
• Routine Load jobs now automatically pause when a non-retryable error is encountered, such as a row causing the Primary Key size limit to be exceeded. Previously, the job would retry indefinitely because such errors were not recognized as non-retryable by the FE transaction status handler. #71161
• SHOW CREATE TABLE and DESC statements now display the Primary Key columns for Paimon external tables. #70535
• Cloud-native tablet metadata fetch operations (such as get_tablet_stats and get_tablet_metadatas) now use a dedicated thread pool instead of the shared UPDATE_TABLET_META_INFO pool. This prevents metadata fetch contention from impacting repair and other tasks. The new thread pool size is configurable via a new BE parameter. #70492

Improvements

• Added session variables to control the encoding behavior of VARBINARY values in MySQL protocol responses, providing fine-grained control over binary result encoding in client connections. #71415
• Added a snapshot_meta.json marker file to cluster snapshots to support integrity validation before snapshot restoration. #71209
• Added warning logs for silently swallowed exceptions in WarehouseManager to improve observability of silent failures. #71215
• Added metrics for Iceberg metadata table queries to support performance monitoring and diagnosis. #70825
• The regexp_replace() function now supports constant folding during FE query planning, reducing planning overhead for queries with constant string arguments. #70804
• Added categorized metrics for Iceberg time travel queries to improve monitoring and performance analysis. #70788
• Added log output when update compaction is suspended, improving visibility into compaction lifecycle. #70538
• SHOW COLUMNS now returns column comments for PostgreSQL external tables. #70520
• Added support for dumping query execution plans when a query encounters an exception, improving diagnosability of runtime failures. #70387
• Tablet deletion during DDL operations is now batched, reducing write lock contention on tablet metadata. #70052
• Added a Force Drop recovery mechanism for synchronous materialized views that are stuck in an error state and cannot be dropped through normal means. #70029

Bug Fixes

The following issues have been fixed:

• An issue where the profile START_TIME and END_TIME were not displayed in the session timezone. #71429
• A shared-object mutation bug in PushDownAggregateRewriter when processing CASE-WHEN/IF expressions, which could cause incorrect query results. #71309
• A use-after-free bug in ThreadPool::do_submit triggered when thread creation fails. #71276
• An issue where information_schema.tables did not properly escape special characters in equality predicates, causing incorrect results. #71273
• An issue where the materialized view scheduler continued to run after the materialized view became inactive. #71265
• Fixed a task signature collision in UpdateTabletSchemaTask across concurrent ALTER jobs that could cause schema update tasks to be skipped. #71242
• An issue where row count estimation produced NaN values for histograms that contained only MCV (Most Common Values) entries. #71241
• A missing dependency on the AWS S3 Transfer Manager in the AWS SDK integration. #71230
• An issue where TaskManager scheduler callbacks did not verify whether the current node is the leader, potentially causing duplicate task execution on follower nodes. #71156
• A thread-local context pollution issue where ConnectContext information was not cleared after a leader-forwarded request completed. #71141
• An issue where the partition predicate was missing in short-circuit point lookups, causing incorrect query results. #71124
• A NullPointerException when analyzing generated columns during Stream Load or Broker Load if a column referenced by the generated column expression was absent from the load schema. #71116
• A use-after-free bug in the error handling path of parallel segment and rowset loading. #71083
• An issue where delvec orphan entries were left behind when a write operation preceded compaction in the same publish batch. #71049
• An issue where queries appeared in the current_queries result via HTTP loopback when checking query progress internally. #71032
• CVE-2026-33870 and CVE-2026-33871. #71017
• A read lock leak in SharedDataStorageVolumeMgr. #70987
• An issue where the input and result columns of the locate() function shared the same NullColumn reference inside BinaryColumns, causing incorrect results. #70957
• An issue where safe tablet deletion checks were incorrectly applied during ALTER operations in share-nothing mode. #70934
• A race condition in _all_global_rf_ready_or_timeout that could prevent global runtime filters from being applied correctly. #70920
• An int32 overflow in the ACCUMULATED metric macro that caused metric values to silently overflow. #70889
• Incorrect aggregation results in dictionary-encoded merge GROUP BY queries. #70866
• CVE-2025-54920. #70862
• A potential data loss issue in aggregation spill caused by incorrect hash table state handling during set_finishing. #70851
• An issue where the content-length header was not reset when proxy_pass_request_body is disabled. #70821
• An issue where the spill directory for load operations was cleaned up in the object destructor rather than during DeltaWriter::close(), potentially causing premature deletion of spill data. #70778
• An issue where INSERT INTO ... BY NAME from FILES() did not correctly push down the schema for partial column sets. #70774
• An issue where connector scan nodes did not reset the scan range source on query retry, causing incorrect results upon retry. #70762
• A potential rowset metadata loss for Primary Key model tablets caused by a GC race during disk re-migration of the form A→B→A. #70727
• An issue where a query-scoped warehouse hint leaked the ComputeResource object in ConnectContext, potentially affecting subsequent queries on the same connection. #70706
• An issue where redundant conjuncts in MySqlScanNode and JDBCScanNode caused BE errors related to VectorizedInPredicate type mismatches. #70694
• A missing libssl-dev dependency in the Ubuntu runtime environment. #70688
• An issue where Iceberg manifest cache completeness was not validated on read, leading to incorrect scan results when the cache was partially populated. #70675
• A duplicate closure reference in _tablet_multi_get_rpc that could cause use-after-free. #70657
• Partial manifest cache writes in the Iceberg ManifestReader that could result in incomplete cache entries and incorrect scan behavior. #70652
• A crash in array_map() when processing arrays that contain null literal elements. #70629
• A ...