VersionDrift
Product

ClickHouse 25.4.13.22 → 26.9.14.10

295 releases · 124 breaking changes · 22 security fixes · 0 advisories fixed

22security124breaking0deprecated272feature1809fix

Is 25.4.13.22 affected? · What changed up to 26.9.24.8

Breaking changes

  • breaking Backported in: Remove --icf=safe linker warnings about SHT_LLVM_ADDRSIG in the stripped Rust libraries. (Raúl Marín). in 26.9.8.3
  • breaking Backported in: Update the zxc library to v0.14.0, which changes the compressed block format of the experimental ZXC codec. Data written with CODEC(ZXC) by earlier versions cannot be read by the new version and fails with CANNOT_DECOMPRESS. If you used the experimental ZXC codec, re-encode the… in 26.9.6.6
  • breaking Backported in: A MySQL dictionary source created with a CREATE DICTIONARY query can no longer enable enable_local_infile, at the source or at one of its REPLICA entries; loading such a dictionary fails with BAD_ARGUMENTS, which with the default dictionaries_lazy_load is on first use rather than at… in 26.9.2.8
  • breaking The default compression method is changed from LZ4 to ZSTD(3). For client/server and server/server network communication it switches uniformly to ZSTD(3). For on-disk table data, MergeTree column data now uses a size-aware built-in default — LZ4 below 100 MB and ZSTD(3) at or above it, applied to… in 26.9.1.1629
  • breaking Removed the CatBoost integration. The catboostEvaluate function, the system.models table and the SYSTEM RELOAD MODEL(S) queries are no longer available. Queries, views and grants referring to them have to be migrated before the upgrade: in particular, revoke SYSTEM RELOAD MODEL from all users and… in 26.9.1.1629
  • breaking Fix setting temporary_files_buffer_size or format_avro_schema_registry_* to an out-of-range value making every subsequent query in the session fail, with no way to recover; the values are now bounded when they are set. (Pedro Ferreira). in 26.9.1.1629
  • breaking Fixed wrong results from runningConcurrency. Its value depends on the rows processed before it, but it declared itself deterministic within a query, so a predicate on it above a LEFT or ANY join let optimizer passes rewrite the join and change the row set it sees, and if, multiIf, and and or… in 26.9.1.1629
  • breaking The experimental WINDOW VIEW feature is removed, together with the WATCH statement and the windowID function. It has been non-functional since version 24.12 (inserts into the source table were silently not delivered to window views) and was never supported by the analyzer, which is enabled by… in 26.9.1.1629
  • breaking Removed the deprecated read_resource and write_resource disk options from storage_configuration. Attach a scheduler resource to a disk with CREATE RESOURCE name (READ DISK disk, WRITE DISK disk) instead. (Sergei Trifonov). in 26.9.1.1629
  • breaking Removed the WasmEdge engine for WebAssembly UDFs. wasmtime, which has always been the default, is now the only supported value of the webassembly_udf_engine server setting. A server configured with wasmedge will not start; remove that setting or set it to wasmtime. On binaries where wasmtime is… in 26.9.1.1629
  • breaking Removed the sharded GROUP BY aggregation (setting enable_sharding_aggregator, disabled by default) in favor of the adaptive aggregation (enable_adaptive_aggregator, enabled by default), which targets the same high cardinality workloads without the weaknesses on skewed or low-cardinality keys and… in 26.9.1.1629
  • breaking Backported in: Outbound TLS connections now verify that the server certificate names the host that was connected to. This affects clickhouse-client --secure, remoteSecure(), Distributed over the secure native protocol, secure Keeper connections, and HTTPS clients such as s3(), url(), HTTP… in 26.9.1.1629
  • breaking max_bytes_before_external_join and max_bytes_ratio_before_external_join are now the spill threshold for every hash-based join_algorithm, including grace_hash, which previously ignored them and spilled on max_rows_in_join / max_bytes_in_join instead. Those two are a hard cap again for every… in 26.9.1.1629
  • breaking Setting allow_experimental_codecs is obsolete. Use the per-codec settings enable__codec instead. (Raufs Dunamalijevs). in 26.9.1.1629
  • breaking Reading a File source with rename_files_after_processing set now requires the WRITE ON FILE grant on top of READ ON FILE, on the initiator for fileCluster: the setting renames the files a SELECT has read, which is a write to the source, and it used to happen for anyone who could read them. A query… in 26.9.1.1629
  • breaking The interface and http_method columns of system.query_log, system.query_thread_log and system.processes are now Enum8 instead of UInt8, over the value set system.session_log.interface already uses, plus Unknown for an unrecognized reported interface. Comparing to a number keeps working (WHERE… in 26.9.1.1629
  • breaking The analyzer can no longer be disabled: the enable_analyzer setting (and its old name allow_experimental_analyzer) is obsolete, an attempt to set it to 0 is rejected, and the compatibility setting no longer reverts it. The analyzer has been the default since 24.3, and the query analysis used… in 26.9.1.1629
  • breaking CREATE TABLE ... AS mergeTreeIndex(...) is no longer accepted, nor the same form over mergeTreeProjection, mergeTreeAnalyzeIndexes, mergeTreeAnalyzeIndexesUUID, mergeTreeTextIndex and mergeTreeCodecBlockCounts. The storage these functions return holds its source table's storage object, so once… in 26.9.1.1629
  • breaking Headers that Google Cloud Storage spells with an x-goog- prefix are now translated for every request, not only for server-side copies. Custom object metadata written to GCS over the S3 API without HMAC credentials — how ClickHouse Cloud on GCP accesses object storage — previously did not take… in 26.9.1.1629
  • breaking Nullable(Tuple(...)) is now generally available and enabled by default. Nullable(Tuple(...)) columns can be created without any setting, schema inference of nullable structs in the Parquet, Arrow, ORC, Avro and JSON formats returns Nullable(Tuple(...)), and a Tuple subcolumn extracted from a… in 26.9.1.1629
  • breaking Remove s3_disable_checksum, since checksum calculation for S3 does not read the source second time anymore (previously the problem was that sources has been read twice, once for sending data, second for checksum calculation). (Azat Khuzhin). in 26.9.1.1629
  • breaking CREATE TABLE ... AS timeSeriesSamples(...) is no longer accepted, nor over its alias timeSeriesData or over timeSeriesTags and timeSeriesMetrics. The persisted proxy renamed that live target table in memory on first read: DROP TABLE then dropped the user's table and destroyed its rows, and reads… in 26.9.1.1629
  • breaking New setting validate_group_by_all_key_types (default true) gates the key type validation that GROUP BY ALL applies to the grouping keys it expands the SELECT expressions into. Since 26.7 it rejects a Variant or Dynamic grouping key, for example an untyped JSON subpath, that earlier versions… in 26.9.1.1629
  • breaking Backported in: CREATE TABLE x AS src inherits the credentials embedded in the engine of src, which are masked in SHOW CREATE TABLE. It now requires the SELECT privilege on src when the inherited definition can carry credentials, instead of only SHOW COLUMNS. (Yarik Briukhovetskyi). in 26.8.32.14
  • breaking Backported in: Overriding a key that is stored in a named collection now requires SHOW NAMED COLLECTIONS SECRETS on that collection. This also applies to overrides through an alias (including flat kafka_* settings over nested kafka.* keys), through a SETTINGS clause of a table engine or table… in 26.8.29.10
  • breaking Outbound TLS connections no longer verify that the server certificate names the host by default (reverts https://github.com/ClickHouse/ClickHouse/pull/116724), because it broke clickhouse-client --tls-sni-override. Set openSSL.client.extendedVerification to true to enable the check. (Nikita… in 26.8.26.12
  • breaking Backported in: Remove --icf=safe linker warnings about SHT_LLVM_ADDRSIG in the stripped Rust libraries. (Raúl Marín). in 26.8.16.41
  • breaking Backported in: Update the zxc library to v0.14.0, which changes the compressed block format of the experimental ZXC codec. Data written with CODEC(ZXC) by earlier versions cannot be read by the new version and fails with CANNOT_DECOMPRESS. If you used the experimental ZXC codec, re-encode the… in 26.8.15.10
  • breaking Backported in: A MySQL dictionary source created with a CREATE DICTIONARY query can no longer enable enable_local_infile, at the source or at one of its REPLICA entries; loading such a dictionary fails with BAD_ARGUMENTS, which with the default dictionaries_lazy_load is on first use rather than at… in 26.8.12.53
  • breaking Backported in: Outbound TLS connections now verify that the server certificate names the host that was connected to. This affects clickhouse-client --secure, remoteSecure(), Distributed over the secure native protocol, secure Keeper connections, and HTTPS clients such as s3(), url(), HTTP… in 26.8.10.6
  • breaking Backported in: New setting validate_group_by_all_key_types (default true) gates the key type validation that GROUP BY ALL applies to the grouping keys it expands the SELECT expressions into. Since 26.7 it rejects a Variant or Dynamic grouping key, for example an untyped JSON subpath, that earlier… in 26.8.7.19
  • breaking Backported in: Reading a File source with rename_files_after_processing set now requires the WRITE ON FILE grant on top of READ ON FILE, on the initiator for fileCluster: the setting renames the files a SELECT has read, which is a write to the source, and it used to happen for anyone who could… in 26.8.3.105
  • breaking This patch changes how object storage disk transactions work. Now, native to the metadata storage transactions will be used by default instead of the fake ones used before. (Mikhail Artemenko). in 26.8.1.2041
  • breaking The server now refuses to start (and rejects SYSTEM RELOAD CONFIG) when the server config contains an unknown top-level element, instead of silently ignoring it. Audit your config before upgrading: stale sections left over from older versions, sections consumed by forks/third-party tooling, and… in 26.8.1.2041
  • breaking For views whose body is a plain SELECT over a single Distributed table, the whole outer query is now pushed to the shards (new setting optimize_trivial_view_pushdown_to_distributed, enabled by default). This changes observable behaviour for such views: FINAL and SAMPLE written on the view… in 26.8.1.2041
  • breaking Lightweight UPDATE patch parts now use a new v2 on-disk format sorted by (sorting_key..., _block_number, _block_offset) and applied with a new merging algorithm. Peak memory is bounded by the largest equal-sort-key run instead of the full patch, and updates that cross merge boundaries no longer… in 26.8.1.2041
  • breaking An unquoted JSON number for a DateTime64/DateTime column in JSONEachRow and similar formats is now interpreted as a Unix timestamp (seconds since the epoch) with optional sub-second precision, consistent with the Values format, CAST and toDateTime64. Previously a number with a fractional part… in 26.8.1.2041
  • breaking The default value of the max_insert_threads setting has been changed from 1 (no parallelism) to auto, which resolves to the number of CPU cores available to the server (reduced under memory pressure via max_insert_threads_min_free_memory_per_thread). This parallelizes INSERT SELECT by default and… in 26.8.1.2041
  • breaking Reading a CSV bare Tuple now takes one field per element in every position, so a \N in the field of a top-level element is that element and input_format_null_as_default applies to it. Previously a leading \N was taken for the whole column being null, so the row was replaced by the column default… in 26.8.1.2041
  • breaking Added the VALID FOR clause to CREATE USER and ALTER USER as a shorthand for VALID UNTIL. The expiration deadline is computed as the current time plus the given interval at query execution time and stored in the VALID UNTIL form. The valid_until column of the system.users table now has the type… in 26.8.1.2041
  • breaking Fixed SYSTEM STOP/START CLEANUP and SYSTEM STOP/START VIRTUAL PARTS UPDATE ON CLUSTER requiring SYSTEM PULLING REPLICATION LOG instead of SYSTEM CLEANUP / SYSTEM VIRTUAL PARTS UPDATE. (Groene AI). in 26.8.1.2041
  • breaking EXPLAIN SYNTAX now returns the reformatted query as a single String record (with embedded newlines) instead of one record per line, so its output is a recoverable single row that is directly usable (for example, SELECT count() FROM (EXPLAIN SYNTAX ...) returns 1). This is controlled by the new… in 26.8.1.2041
  • breaking The PostgreSQL and MaterializedPostgreSQL database engines now respect the server's remote_url_allow_hosts configuration, like the PostgreSQL table engine, the postgresql table function, and DDL-created dictionaries already do. The policy is enforced on CREATE DATABASE and on a user-issued ATTACH… in 26.8.1.2041
  • breaking Extended the supported range of Date32 from [1900-01-01, 2299-12-31] to [0000-01-01, 9999-12-31], matching DateTime64. Parsing and conversions now accept the extended range instead of silently clamping to the old boundaries. Backward compatibility notes: in the numeric conversion toDate32(N),… in 26.8.1.2041
  • breaking The experimental ALP codec now performs Float32 scaling arithmetic in Float64, which eliminates exceptions on decimal data and significantly improves compression ratios. (Raufs Dunamalijevs). in 26.8.1.2041
  • breaking Removed the library dictionary source. It was created for a single customer a very long time ago, it required writing a shared library against an undocumented C ABI, and it was already disabled in ClickHouse Cloud. SOURCE(LIBRARY(...)) now fails with UNKNOWN_ELEMENT_IN_CONFIG, like any other… in 26.8.1.2041
  • breaking Removed the Apache Arrow library-based reader and writer for the Arrow and ArrowStream formats. The native ClickHouse implementation, which has been the default since 26.7, is now the only one. The settings input_format_arrow_use_native_reader and output_format_arrow_use_native_writer are… in 26.8.1.2041
  • breaking The TLS credentials of a MySQL source (ssl_ca, ssl_cert, ssl_key) can no longer be specified as file paths from SQL — in a named collection created with CREATE NAMED COLLECTION, as a query argument, or in a CREATE DICTIONARY query — because the server opens those files with its own privileges.… in 26.8.1.2041
  • breaking Reject timespan setting (milliseconds/seconds) values that overflow Int64 microseconds. (Azat Khuzhin). in 26.8.1.2041
  • breaking arrayIntersect and arraySymmetricDifference no longer treat a value repeated inside a single argument as if it appeared in several arguments. Queries relying on the previous behavior can now return different results: arrayIntersect([1], [2], [1, 1]) returns [] instead of [1], arrayIntersect([1,… in 26.8.1.2041
  • breaking disable_insertion_and_mutation now prevents background consumption from Kafka, RabbitMQ, and NATS tables while still allowing direct writes to external storage. Gated Kafka2, NATS, and RabbitMQ tables do not initialize consumers for direct SELECT. The recently introduced… in 26.8.1.2041
  • breaking A window PARTITION BY or ORDER BY over an AggregateFunction column is now rejected with ILLEGAL_COLUMN, as top-level ORDER BY over such a column already was. Previously such a query was accepted by at least one analyzer, and window PARTITION BY partitioned differently depending on max_threads. The… in 26.8.1.2041
  • breaking Fix access checks for the SYSTEM ... CACHE ON CLUSTER commands. They required the SYSTEM DROP CACHE privilege group instead of the privilege of the individual command, which both denied holders of a single granular cache privilege and let a holder of the group run SYSTEM SYNC FILESYSTEM CACHE ON… in 26.8.1.2041
  • breaking The include_from setting no longer defaults to /etc/metrika.xml. Previously that file was used for configuration substitutions whenever it existed, even though nothing in the ClickHouse configuration referred to it. If you relied on that implicit substitutions file, add /etc/metrika.xml explicitly… in 26.8.1.2041
  • breaking The NATS table engine accepts credentials inline in the new nats_credentials setting (the same payload as a .creds file), and no longer accepts nats_credential_file from SQL: the path is a reference to a file on the server filesystem, which the server opens with its own privileges, so it can only… in 26.8.1.2041
  • breaking Asynchronous metrics can now have the Map data type, and the per-CPU-core and per-device metrics were converted to single key-value metrics: OSUserTimeCPU0, OSUserTimeCPU1, ... became a single OSUserTimeCPU metric with a map from the CPU core number to the value (and similarly for the other… in 26.8.1.2041
  • breaking Added a new join_algorithm value parallel_full_sorting_merge: for hash-compatible equality joins, it shards a full sorting merge join by the hash of the join keys into independent per-shard merge joins running on all threads. It keeps the low, streaming memory usage of a merge join while… in 26.8.1.2041
  • breaking Backported in: CREATE TABLE x AS src inherits the credentials embedded in the engine of src, which are masked in SHOW CREATE TABLE. It now requires the SELECT privilege on src when the inherited definition can carry credentials, instead of only SHOW COLUMNS. (Yarik Briukhovetskyi). in 26.7.35.11
  • breaking Backported in: Overriding a key that is stored in a named collection now requires SHOW NAMED COLLECTIONS SECRETS on that collection. This also applies to overrides through an alias (including flat kafka_* settings over nested kafka.* keys), through a SETTINGS clause of a table engine or table… in 26.7.32.7
  • breaking Backported in: Remove --icf=safe linker warnings about SHT_LLVM_ADDRSIG in the stripped Rust libraries. (Raúl Marín). in 26.7.19.5
  • breaking Backported in: A MySQL dictionary source created with a CREATE DICTIONARY query can no longer enable enable_local_infile, at the source or at one of its REPLICA entries; loading such a dictionary fails with BAD_ARGUMENTS, which with the default dictionaries_lazy_load is on first use rather than at… in 26.7.15.52
  • breaking Backported in: Outbound TLS connections now verify that the server certificate names the host that was connected to. This affects clickhouse-client --secure, remoteSecure(), Distributed over the secure native protocol, secure Keeper connections, and HTTPS clients such as s3(), url(), HTTP… in 26.7.14.3
  • breaking Backported in: Reading a File source with rename_files_after_processing set now requires the WRITE ON FILE grant on top of READ ON FILE, on the initiator for fileCluster: the setting renames the files a SELECT has read, which is a write to the source, and it used to happen for anyone who could… in 26.7.7.92
  • breaking Remove bad tests on 26.7. (Alexey Milovidov). in 26.7.4.58
  • breaking The / glob (any amount of directories) now also matches the same directory. Previously, / in glob patterns was not handled as a special case, so data/**/file.txt would not match data/file.txt (zero directory levels). (Alexey Milovidov). in 26.7.1.1315
  • breaking Reject the zip/zipx backup archive format for backups stored on object storage — direct S3(...)/AzureBlobStorage(...) destinations and Disk(...) destinations backed by S3 or Azure — for both BACKUP and RESTORE. Zip requires seeking to read its central directory, which is very slow over object… in 26.7.1.1315
  • breaking S3 access originating from user SQL no longer resolves the server's own cloud credentials (environment, IMDS/IRSA, instance profile, AWS config files, role_arn-based STS, GCP OAuth metadata) by default; such a request must use explicit credentials or NOSIGN. Named collections now default… in 26.7.1.1315
  • breaking Extended the supported range of DateTime64 from [1900-01-01, 2299-12-31] to [0000-01-01, 9999-12-31]. Values outside the former range are now computed correctly (via cctz) instead of being clamped to the boundary. With precision 8 or 9 the range remains narrower because the ticks are stored as… in 26.7.1.1315
  • breaking AggregatingMergeTree now rejects, at table creation time, schemas where a column is neither part of the sorting key nor an aggregate-state measure (AggregateFunction/SimpleAggregateFunction). Such columns are silently collapsed to an arbitrary value during background merges, producing wrong… in 26.7.1.1315
  • breaking Removed the config-based workload scheduling configuration (the resources and workload_classifiers server config sections). Use CREATE RESOURCE and CREATE WORKLOAD queries instead. The obsolete config sections are ignored with a warning. (Sergei Trifonov). in 26.7.1.1315
  • breaking ClickHouse now always uses the unified insert deduplication hash for both synchronous and asynchronous inserts; the legacy per-insert deduplication behaviours are removed. The server setting insert_deduplication_version is kept as a migration guard: the server refuses to start if it is set to a… in 26.7.1.1315
  • breaking Removed the long-deprecated functions snowflakeToDateTime, snowflakeToDateTime64, dateTimeToSnowflake and dateTime64ToSnowflake. They were deprecated back in v24.6 in favor of snowflakeIDToDateTime, snowflakeIDToDateTime64, dateTimeToSnowflakeID and dateTime64ToSnowflakeID, which should be used… in 26.7.1.1315
  • breaking The setting use_legacy_to_time is now 0 by default, so toTime converts values into the Time data type instead of converting a date with time to a fixed date. The legacy behavior is still available via the toTimeWithFixedDate function or by setting use_legacy_to_time = 1. (Alexey Milovidov). in 26.7.1.1315
  • breaking Naive Bayes models (used by naiveBayesClassifier) are now configured as a dictionary with the NAIVE_BAYES layout, built at load time from a table of pre-aggregated per-class n-gram counts, instead of the previous server-side configuration (an XML config file referencing serialized .bin model… in 26.7.1.1315
  • breaking The hasColumnInTable function no longer accepts the optional hostname, username, and password arguments for checking a column on an arbitrary remote server; only the hasColumnInTable(database, table, column) form remains. The removed remote mode was a security concern: it let any user trigger… in 26.7.1.1315
  • breaking Remove a single-threaded bottleneck in ShuffleSendStep of the distributed query plan: each upstream stream now scatters its rows by destination bucket independently instead of funneling the whole fragment through one ScatterByPartitionTransform. (Alexander Gololobov). in 26.7.1.1315
  • breaking Speed up serialization and merges of JSON columns whose shared data contains many sparse paths. When flattening shared data into per-path columns, flattenAndBucketSharedDataPaths no longer scans every accumulated path column on every row and no longer inserts a default one cell at a time; the… in 26.7.1.1315
  • breaking Backported in: Reading a File source with rename_files_after_processing set now requires the WRITE ON FILE grant on top of READ ON FILE, on the initiator for fileCluster: the setting renames the files a SELECT has read, which is a write to the source, and it used to happen for anyone who could… in 26.6.5.120
  • breaking The change removes allow_experimental_query_deduplication feature. The feature was experimental for a long time, has no tests and not going to be supported (initial tests were unstable and has been removed https://github.com/ClickHouse/ClickHouse/pull/49579). (Igor Nikonov). in 26.6.1.1193
  • breaking The XRay-based SYSTEM INSTRUMENT feature now uses arguments instead of parameters: the system.instrumentation.parameters column was renamed to arguments, and the SYSTEM INSTRUMENT ADD ... HANDLER PARAMETERS ... syntax was renamed to SYSTEM INSTRUMENT ADD ... HANDLER ARGUMENTS .... Queries or… in 26.6.1.1193
  • breaking The setting show_data_lake_catalogs_in_system_tables has been renamed to show_remote_databases_in_system_tables and broadened: when its value is 0 (the default), MySQL and PostgreSQL databases are also hidden from system.tables, system.columns, and system.completions, in addition to data lake… in 26.6.1.1193
  • breaking ALTER TABLE ... REPLACE PARTITION ... FROM ... no longer silently drops the destination partition's data when the source table has no parts in the requested partition. Previously such a request removed the destination partition and wrote nothing in its place, an unambiguous data-loss footgun… in 26.6.1.1193
  • breaking The default x86 build now targets x86-64-v3 (AVX2) instead of x86-64-v2 (SSE4.2). This requires a CPU with AVX2 support (Intel Haswell or later, AMD Excavator or later). If your CPU does not support AVX2, use the amd64compat build which targets plain x86-64. (Raúl Marín). in 26.6.1.1193
  • breaking Reject nested Dynamic/Variant in min/max aggregates and minmax indexes. Previously only top-level Dynamic/Variant were checked. Closes. (Pavel Kruglov). in 26.6.1.1193
  • breaking icebergHash and icebergBucket now reject Int128, UInt128, Int256, UInt256, and Decimal256 arguments with an explicit error. Previously they silently truncated wider values and produced colliding hashes. The Iceberg spec only defines hashing for 32/64-bit integers and decimals with precision up to… in 26.6.1.1193
  • breaking Added granular control over query echoing in the CLI. The --echo option now accepts an optional boolean value and works in both interactive and batch mode. New options --echo-formatted and --echo-query-id control whether echoed queries are formatted and whether the query_id is printed,… in 26.6.1.1193
  • breaking The default of the server setting insert_deduplication_version changes from compatible_double_hashes to new_unified_hash. Insert deduplication now works on the whole inserted block (per insert) rather than per part/partition: a retry of the same insert is still deduplicated, but two different… in 26.6.1.1193
  • breaking Removed the experimental KQL (Kusto) functions array_sort_asc and array_sort_desc, and their SQL backends kql_array_sort_asc and kql_array_sort_desc. These functions were experimental, implemented with low quality, and the source of correctness and parser bugs. Queries using these names now return… in 26.6.1.1193
  • breaking Backported in: The setting show_data_lake_catalogs_in_system_tables has been renamed to show_remote_databases_in_system_tables and broadened: when its value is 0 (the default), MySQL and PostgreSQL databases are also hidden from system.tables, system.columns, and system.completions, in addition to… in 26.5.2.39
  • breaking Changed defaults of date_time_input_format and cast_string_to_date_time_mode from basic to best_effort. Queries that previously failed to parse non-basic datetime strings (e.g. 2024 April 4, Apr 15, 2020 10:30:00) may now succeed by default. To keep the old strict parsing behavior, set these… in 26.5.1.882
  • breaking This change was reverted. (Raúl Marín). in 26.5.1.882
  • breaking Tuple element name null is now forbidden because it conflicts with the subcolumn name used for Nullable null maps, causing ambiguous subcolumn resolution. (Alexey Milovidov). in 26.5.1.882
  • breaking Add a setting dynamic_disk_allow_from_env, dynamic_disk_allow_from_zk, dynamic_disk_allow_include to disallow usage of from_env, from_zk, include in dynamic disks. Backward Incompatible Change because prohibits by default the behaviour which used to be allowed by default. (Kseniia Sumarokova). in 26.5.1.882
  • breaking You can no longer use the obsolete Arrow-based Parquet reader and writer. The native implementation will be used instead. (Alexey Milovidov). in 26.5.1.882
  • breaking SHOW CREATE TABLE t now prefers the temporary table when both a permanent and a temporary table named t exist and no database is specified, matching the existing behavior of DESCRIBE TABLE. Additionally, DESCRIBE TEMPORARY TABLE syntax is now supported. (Alexey Milovidov). in 26.5.1.882
  • breaking Reduced default http_max_fields from 1,000,000 to 1,000 and http_max_field_name_size from 128 KB to 4 KB to limit pre-authentication memory usage by HTTP connections. Added http_max_request_header_size and http_headers_read_timeout settings. Users who rely on the previous higher limits can restore… in 26.5.1.882
  • breaking Added a histograms nested column to system.metric_log that snapshots every registered histogram metric per row, with a new system_metric_log_show_zero_values_in_histograms setting to control zero-value emission. Deprecates the system.histogram_metric_log table. (Miсhael Stetsyuk). in 26.5.1.882
  • breaking The window functions RANK and DENSE_RANK now reject arguments and throw NUMBER_OF_ARGUMENTS_DOESNT_MATCH, in line with the SQL standard. Previously, queries such as RANK(x) OVER (ORDER BY id) were silently accepted with the argument ignored, which was a frequent source of user confusion. To… in 26.5.1.882
  • breaking CAST to DateTime or DateTime64 without an explicit time zone now preserves the time zone of its source argument (when the source is a DateTime/DateTime64 with an explicit time zone), matching the behavior of the toDateTime/toDateTime64 functions. Closes. (Alexey Milovidov). in 26.5.1.882
  • breaking Revert the default x86 build target back to x86-64-v2 (SSE4.2). The previous switch to x86-64-v3 (AVX2) is being rolled back. (Raúl Marín). in 26.5.1.882
  • breaking Removed the kql table function. Use SET dialect = 'kusto' to run queries in the KQL dialect. (Alexey Milovidov). in 26.5.1.882
  • breaking Remove vtable from setting field types, reducing Settings copy size by ~28x and improving cache locality via typed-array layout for all settings types. (Raúl Marín). in 26.5.1.882
  • breaking Backported in: The setting show_data_lake_catalogs_in_system_tables has been renamed to show_remote_databases_in_system_tables and broadened: when its value is 0 (the default), MySQL and PostgreSQL databases are also hidden from system.tables, system.columns, and system.completions, in addition to… in 26.4.4.38
  • breaking Backported in: Remove duplicate entries from SettingsChangesHistory. (Nikita Fomichev). in 26.4.3.37
  • breaking The IN operator now uses exact value semantics for Bool type: only 0 and 1 values in the set match Bool values. Previously, numeric values greater than 255 in the IN set were incorrectly clamped to true when compared against Bool, so SELECT CAST(1, 'Bool') IN (256) returned 1. Now it correctly… in 26.4.1.1141
  • breaking You can now stem all the words/tokens in columns String, FixedString, Array([Fixed]String), Nullable, LowCardinality and Const easily with the stem function. (Jimmy Aguilar Mena). in 26.4.1.1141
  • breaking The H3 library has been updated to v4, which improves the precision of length, area, and other metric calculations. This change is backward incompatible because the new results differ from previous ones. (Alexey Milovidov). in 26.4.1.1141
  • breaking Revert the skip_indexes column in system.query_log introduced in. (Alexey Milovidov). in 26.4.1.1141
  • breaking Disallows using SELECT as a bareword identifier in a WITH expression list element. (Aruj Bansal). in 26.4.1.1141
  • breaking Fix endianness of QBit binary serialization to use little-endian format. (Raufs Dunamalijevs). in 26.4.1.1141
  • breaking This patch changes how the merge table will handle virtuals. If the underlying table contains _table or _database, these columns will be read from storage; otherwise, they will be filled after the read step using the expression step. (Mikhail Artemenko). in 26.4.1.1141
  • breaking The IN operator now rejects lossy Decimal conversions inside composite types (Tuple, Array, Map) as well, making its behavior consistent with top-level scalar comparisons. Previously, precision checks were enforced only for top-level scalar values: for example, CAST('33.3', 'Decimal64(1)') IN… in 26.4.1.1141
  • breaking Backported in: Reduced default http_max_fields from 1,000,000 to 1,000 and http_max_field_name_size from 128 KB to 4 KB to limit pre-authentication memory usage by HTTP connections. Added http_max_request_header_size and http_headers_read_timeout settings. Users who rely on the previous higher… in 26.4.1.1141
  • breaking Backported in: CREATE TABLE x AS src inherits the credentials embedded in the engine of src, which are masked in SHOW CREATE TABLE. It now requires the SELECT privilege on src when the inherited definition can carry credentials, instead of only SHOW COLUMNS. (Yarik Briukhovetskyi). in 26.3.57.12
  • breaking Backported in: Overriding a key that is stored in a named collection now requires SHOW NAMED COLLECTIONS SECRETS on that collection. This also applies to overrides through an alias (including flat kafka_* settings over nested kafka.* keys), through a SETTINGS clause of a table engine or table… in 26.3.53.4
  • breaking Backported in: Outbound TLS connections now verify that the server certificate names the host that was connected to. This affects clickhouse-client --secure, remoteSecure(), Distributed over the secure native protocol, secure Keeper connections, and HTTPS clients such as s3(), url(), HTTP… in 26.3.34.136
  • breaking Backported in: A MySQL dictionary source created with a CREATE DICTIONARY query can no longer enable enable_local_infile, at the source or at one of its REPLICA entries; loading such a dictionary fails with BAD_ARGUMENTS, which with the default dictionaries_lazy_load is on first use rather than at… in 26.3.34.136
  • breaking Backported in: Reading a File source with rename_files_after_processing set now requires the WRITE ON FILE grant on top of READ ON FILE, on the initiator for fileCluster: the setting renames the files a SELECT has read, which is a write to the source, and it used to happen for anyone who could… in 26.3.33.24
  • breaking Backported in: Add a setting dynamic_disk_allow_from_env, dynamic_disk_allow_from_zk, dynamic_disk_allow_include to disallow usage of from_env, from_zk, include in dynamic disks. Backward Incompatible Change because prohibits by default the behaviour which used to be allowed by default. (Kseniia… in 26.3.17.110
  • breaking Backported in: The setting show_data_lake_catalogs_in_system_tables has been renamed to show_remote_databases_in_system_tables and broadened: when its value is 0 (the default), MySQL and PostgreSQL databases are also hidden from system.tables, system.columns, and system.completions, in addition to… in 26.3.13.31
  • breaking Backported in: Reduced default http_max_fields from 1,000,000 to 1,000 and http_max_field_name_size from 128 KB to 4 KB to limit pre-authentication memory usage by HTTP connections. Added http_max_request_header_size and http_headers_read_timeout settings. Users who rely on the previous higher… in 26.3.10.62
  • breaking Backported in: Reduced default http_max_fields from 1,000,000 to 1,000 and http_max_field_name_size from 128 KB to 4 KB to limit pre-authentication memory usage by HTTP connections. Added http_max_request_header_size and http_headers_read_timeout settings. Users who rely on the previous higher… in 26.3.10.60
  • breaking Backported in: Reduced default http_max_fields from 1,000,000 to 1,000 and http_max_field_name_size from 128 KB to 4 KB to limit pre-authentication memory usage by HTTP connections. Added http_max_request_header_size and http_headers_read_timeout settings. Users who rely on the previous higher… in 26.2.17.31
  • breaking Backported in: Reduced default http_max_fields from 1,000,000 to 1,000 and http_max_field_name_size from 128 KB to 4 KB to limit pre-authentication memory usage by HTTP connections. Added http_max_request_header_size and http_headers_read_timeout settings. Users who rely on the previous higher… in 26.1.12.23

Security changes

  • security Backported in: Update the vendored expat to 2.9.0, fixing a denial of service through a crafted backup manifest during RESTORE (CVE-2026-66046) and the other 2.8.3–2.9.0 security fixes. (Actuele AI). in 26.8.28.14
  • security Backported in: Update mongo-c-driver to 2.5.5, fixing an out-of-bounds write during MongoDB connection monitoring reconnects (CVE-2026-96746). (Actuele AI). in 26.8.25.14
  • security Backported in: Update the vendored expat to 2.9.0, fixing a denial of service through a crafted backup manifest during RESTORE (CVE-2026-66046) and the other 2.8.3–2.9.0 security fixes. (Actuele AI). in 26.7.31.12
  • security Backported in: Update mongo-c-driver to 2.5.5, fixing an out-of-bounds write during MongoDB connection monitoring reconnects (CVE-2026-96746). (Actuele AI). in 26.7.29.12
  • security Fix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze). in 26.7.1.1315
  • security NO CL ENTRY: 'Revert "Backport to 26.6: Fix an ALTER on a SQL SECURITY DEFINER view deleting its auto-created definer user"'. (pufit). in 26.6.7.18
  • security Backported in: Fix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze). in 26.6.2.160
  • security Backported in: Fix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze). in 26.6.2.158
  • security Backported in: Fix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze). in 26.6.2.81
  • security distroless: bump base pin to clear libssl3t64 CVE-2026-45447. (Rahul Nair). in 26.6.1.1193
  • security Backported in: Fix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze). in 26.5.6.113
  • security Backported in: Fix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze). in 26.5.6.64
  • security Backported in: Fix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze). in 26.4.5.143
  • security Bump cc-debian13 digests, clears libssl3t64 CVE-2026-45447. (Rahul Nair). in 26.4.5.143
  • security Backported in: Update the vendored expat to 2.9.0, fixing a denial of service through a crafted backup manifest during RESTORE (CVE-2026-66046) and the other 2.8.3–2.9.0 security fixes. (Actuele AI). in 26.3.54.6
  • security Backported in: Update mongo-c-driver to 2.5.5, fixing an out-of-bounds write during MongoDB connection monitoring reconnects (CVE-2026-96746). (Actuele AI). in 26.3.50.11
  • security Backported in: More security validations for biglake catalog. (Konstantin Vedernikov). in 26.3.34.136
  • security Backported in: Fix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze). in 26.3.17.110
  • security Backported in: Fix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze). in 26.3.17.56
  • security Bump cc-debian13 digests, clears libssl3t64 CVE-2026-45447. (Rahul Nair). in 26.3.16.16
  • security Backported in: Fix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze). in 25.8.29.51
  • security Bump cc-debian13 digests, clears libssl3t64 CVE-2026-45447. (Rahul Nair). in 25.8.25.37

Every release in between

26.9.14.10 Oct 9, 2026 Release notes ↗
otherBackported in: bloom_filter and text indexes are now used when a Nullable indexed column is cast to the non-Nullable type, such as CAST(x, 'String') or json.path::String. A query that would throw on a NULL value may not throw when the index skips the granules with NULL. (Anton Popov).
fixBackported in: Fix reading bucketed runtime Map values from JSON columns using advanced shared-data serialization. (Rory Shanks).
fixBackported in: Fix DeltaLake stats pruning with Date cast. (Arsen Muk).
fixBackported in: Fix EXPLAIN PLAN actions = 1 printing a secret function argument (for example the key of HMAC or encrypt) in cleartext when its value came from a subquery or from the other side of a JOIN. (Vladimir Cherkasov).
fixBackported in: Fix INSERT failing with ILLEGAL_FINAL or SAMPLING_NOT_SUPPORTED when a materialized view applies FINAL or SAMPLE to its own source table inside a subquery. Regression in. (Jimmy Aguilar Mena).
fixBackported in: Fix a rare server crash (SIGSEGV in mongoc_log) when a MongoDB dictionary source or MongoDB table was created while another thread created the first MongoDB connection in the process. Messages logged by the MongoDB driver now go to the server log. (Vladimir Cherkasov).
otherBackported in: CRoaring v5.2.3 exposes internal_validate() on the C++ RoaringBitmap wrappers, so RoaringBitmap data can be validated. (Elmi Ahmadov).
otherBackported in: Update cctz to 2026e. (Actuele AI).
fixBackported in: Fixed a LOGICAL_ERROR in arraySlice on a QBit column replicated by ARRAY JOIN or a JOIN. (Groene AI).
26.9.13.15 Oct 8, 2026 Release notes ↗
otherBackported in: A WHERE that no row passes is pushed to every JOIN input again, including the non-preserved side of an OUTER JOIN and a side with no column used above the join, so that input is no longer read and hash-built for nothing. For example, a UNION ALL branch whose constant column fails…
otherBackported in: Hash joins with many matches per key are faster when they output a LowCardinality column whose blocks have different dictionaries (several parts, FINAL, or a LowCardinality value computed per block): short ranges from another dictionary are now inserted key by key instead of through…
featureBackported in: Added the setting query_plan_filter_push_down_below_limit_by (default 1), controlling whether filters on LIMIT BY key columns are pushed below the LIMIT BY step. Setting it to 0 restores the plan shape used before 26.7, for queries where the pushed predicate makes index analysis…
fixBackported in: Mask secrets in the queries that a cluster-mode QueryRunner table writes to system.query_log as well as in queries executed as startup scripts. (Miсhael Stetsyuk).
fixBackported in: Tables in a database with lazy_load_tables were missing from system.parts, system.replicas and related system tables, and refused by replica commands, after a restart. (Nikolay Degterinsky).
fixBackported in: Fix a server abort when reading an Iceberg table whose sort order names a transform ClickHouse cannot parse (e.g. bucket[xyz]); ClickHouse now ignores that sort-order hint and keeps the table readable. (Ilias).
fixBackported in: Comparing an Enum column with a string literal that is not one of its elements no longer throws UNKNOWN_ELEMENT_OF_ENUM when validate_enum_literals_in_operators is disabled (the default) and the column is part of the primary key, the partition key, or a bloom_filter index. != with…
fixBackported in: Fix Found patch part ... that intersects mutation with version ... on lightweight updates in a table created with CREATE TABLE ... CLONE AS or ATTACH PARTITION ALL FROM a table with lightweight updates. (Nikolay Degterinsky).
fixBackported in: Fix UNKNOWN_IDENTIFIER in the analyzer when a table is referenced as database.table in FROM or JOIN and another table expression in the same query uses that database name as its alias, for example FROM db.t1 AS db INNER JOIN db.t2 AS t ON .... Closes. (Dmitry Novik).
fixBackported in: Fixed wrong results when a WHERE clause mixing AND and OR was evaluated with skip indexes (use_skip_indexes_for_disjunctions, enabled by default). If a minmax or set index could not evaluate one atom of the predicate for a granule, the per-atom verdicts recorded for that granule…
fixFix iceberg_tolerate_conflicting_manifest_schemas being reverted to false by compatibility settings of 26.8 or 26.9 on 26.9 servers, which made Iceberg reads fail with ICEBERG_SPECIFICATION_VIOLATION on tables whose manifest schemas conflict with metadata.json. (Asya Shneerson).
otherBackported in:. (Alexey Milovidov).
fixBackported in: Fix container existence check during RESTORE of a lightweight snapshot from Azure Blob Storage by parsing the saved namespace into container name and prefix. (Garrett Thomas).
otherBackported in: Reduced the setup of the 04510_distributed_final_many_partitions test from 150 to 65 partitions. (Groene AI).
26.9.12.8 Oct 6, 2026 Release notes ↗
otherBackported in: Filesystem cache: make reserve granularity dynamic. (Kseniia Sumarokova).
fixBackported in: Fixed a text index dropping matching rows when a FixedString is involved in the comparison: a term-preserving tokenizer over a String column lost the rows whose value carries literal trailing zero bytes when the search constant is a FixedString, and an index over a FixedString…
fixBackported in: Rewriting the body of a view with ALTER TABLE ... MODIFY QUERY now needs the same grants as creating it with its SQL security: SET DEFINER on the definer of a SQL SECURITY DEFINER view, or ALLOW SQL SECURITY NONE for a SQL SECURITY NONE view. An ON CLUSTER MODIFY QUERY fails with…
fixBackported in: Fix basic statistics of parts written by 26.6 or 26.7: after ALTER TABLE ... UPDATE or a lightweight DELETE, non-Nullable columns reported a default-value count of 0, which made selectivity estimates wrong. Query results were not affected. To repair parts that are already affected,…
fixBackported in: Fix a possible hang of a query under workload CPU scheduling with cpu_slot_preemption enabled: when all its threads were preempted, the query could keep CPU slots it had already used and wait forever for one of them. (Sergei Trifonov).
fixBackported in: Fixed a LEFT/RIGHT/FULL JOIN without an equality key that failed with INVALID_JOIN_ON_EXPRESSION (Cannot determine join keys) when its WHERE clause also contained an IN (subquery). The WHERE filter now converts such a join to INNER again, as it did in 26.6, which also restores that…
fixBackported in: Respect iceberg_metadata_staleness_ms in metadata parsing. (Konstantin Vedernikov).
26.9.11.2 Oct 5, 2026 Release notes ↗
fixBackported in: Fixed a segmentation fault or std::length_error when reading TSV formats with input_format_tsv_crlf_end_of_line = 1 if an escape sequence ended exactly at the end of a read buffer. (Groene AI).
26.9.10.4 Oct 4, 2026 Release notes ↗
otherBackported in: Enabled the text index posting lists cache by default (use_text_index_postings_cache). Previously each query used a private cache capped at 100 MiB, which on large tables caused posting lists and phrase search results to be recomputed several times within a single query; a 4-token…
otherBackported in: Skip indexes (bloom_filter, tokenbf_v1, ngrambf_v1, minmax) and the primary key are now used when the indexed column is wrapped into a conversion that does not change its value, such as toLowCardinality, toNullable or a CAST to Nullable or LowCardinality. (Anton Popov).
fixBackported in: Fix an out-of-bounds read when deserializing a uniqTheta state shorter than 24 bytes, for instance from CAST( AS AggregateFunction(uniqTheta, ...)). (Alexey Milovidov).
26.9.9.28 Oct 3, 2026 Release notes ↗
otherBackported in: Faster planning of queries to Iceberg tables with many manifest files: when a manifest file header has the schema-id key and that schema is already known from metadata.json, the schema copy stored in the manifest header is no longer parsed and compared with it. ClickHouse now also…
otherBackported in: Hide the HTTP headers in the definition of HTTP dictionary sources in SHOW CREATE DICTIONARY, system.tables and query logs, the same way as passwords. They can be shown with the existing display_secrets_in_show_and_select mechanism. (Matheus Nerone).
fixBackported in: Fixed SYSTEM SYNC TRANSACTION LOG (local, non-ON CLUSTER form) not checking the SYSTEM_SYNC_TRANSACTION_LOG privilege. The ON CLUSTER form already required it via getRequiredAccessForDDLOnCluster, but the local execution path skipped checkAccess, so a user without the grant could…
fixBackported in: Fixed asynchronous TLS connections occasionally failing with an unrelated OpenSSL error left by another connection on the same OS thread. This could terminate distributed queries with a misleading network exception. (Dmitriy Borisenko).
fixBackported in: Fixed an ssl_certificate authentication bypass where an embedded NUL byte in a certificate's Common Name (for example john\0.evil.com) was truncated server-side to john, letting a holder of such a certificate authenticate as a different user. (Konstantin Bogdanov).
fixBackported in: Prevent asynchronous inserts that only need to buffer data from being blocked by another insert waiting for a flush worker while holding their shared queue lock. Ensure a global forced flush waits for batches removed from the queue that are still waiting for a worker. (RJ).
fixBackported in: Skip indexes (text, tokenbf_v1, ngrambf_v1) are now used when the indexed column or the searched constant is wrapped into LowCardinality, Nullable or an equivalent CAST. For example, m['key'] = 'value' on a Map(String, LowCardinality(String)) column and hasToken(s,…
fixBackported in: EXPLAIN AST printed secret function arguments, such as the key of encrypt, in clear text, and with optimize = 1 it did so for the body of a view the user may only SELECT from. The dump now prints '[HIDDEN]' in their place, under the same gate as SHOW CREATE. (Harikrishnan Prabakaran).
fixBackported in: Column-level SELECT privileges are now enforced for columns used only inside indexHint and for ALIAS columns referenced in PREWHERE. As in WHERE, referencing an ALIAS column in PREWHERE requires the grant on the alias name; a grant on its source columns is no longer sufficient. A…
fixBackported in: Fix a server crash (SIGSEGV) when a CREATE TABLE ... PROJECTION / ALTER TABLE ... ADD PROJECTION statement is restored from a clickhouse_json AST whose projection query subtree contains a function node without an arguments list. The malformed payload is now rejected with…
fixBackported in: Fixed a row policy bypass: a direct JOIN with an EmbeddedRocksDB, KeeperMap or Redis table in the legacy analyzer (enable_analyzer = 0) ignored the row policy of the right table and returned hidden rows, and joinGet on a Join table ignored its row policy in both analyzers. Such a…
fixBackported in: Fix NO_COMMON_TYPE in case of use_variant_as_common_type=0 for jemalloc fragmentation dashboard. (Azat Khuzhin).
fixBackported in: Now statistics parts pruning will not work if table has row level policy. (alesapin).
fixBackported in: Fix filesystem cache accounting when the directory for a new cache key cannot be created, for example because the cache disk is out of space or inodes. The failed reservation stayed counted in the cache until the query released the file segment. (Sema Checherinda).
fixBackported in: CREATE OR REPLACE in a Replicated database or with ON CLUSTER now requires the drop privilege for the kind of the table it replaces, so a user without DROP DICTIONARY can no longer replace a dictionary. (Nikolay Degterinsky).
fixBackported in: Fix LOGICAL_ERROR Cannot capture column N because it has incompatible type when a materialized view with a lambda over an Array(Tuple(...)) column receives a block while the source table's column type is being changed by ALTER TABLE ... MODIFY COLUMN. (Jimmy Aguilar Mena).
fixBackported in: Fix a server crash caused by unbounded recursion when decoding a deeply nested value inside a binary encoded type, for example an AggregateFunction parameter in a Dynamic value read from RowBinary or Native. (Pavel Kruglov).
fixBackported in: Fixes a server crash on CREATE TABLE or ALTER TABLE ... MODIFY TTL with a TTL expression that uses the result of arrayMap with a constant lambda, such as toString(arrayMap(x -> CAST(1, 'Dynamic'), arr)). (Groene AI).
fixBackported in: Fixed secret settings of S3Queue and AzureQueue tables written with the legacy s3queue_ prefix, such as s3queue_after_processing_move_secret_access_key, being shown in cleartext in SHOW CREATE TABLE, system.tables, system.query_log and the server log. They are now hidden as they are…
fixBackported in: Add more path validations. (Konstantin Vedernikov).
fixBackported in: S3 client check initial url in backup client. (Konstantin Vedernikov).
fixBackported in: Fix missing rows in hasAllTokens and hasAnyTokens searches over a text index when an earlier query with the same predicate read a narrower key range of the same part and use_text_index_postings_cache was enabled. (Anton Popov).
fixBackported in: Fix a crash when reading an ORC file whose root type is not a struct (for example, a file written with a bigint or array root type). Such files are now rejected with an INCORRECT_DATA error. Closes. (Groene AI).
fixBackported in: Fixed a crash and wrong results with convert_query_to_cnf = 1 when WHERE or HAVING references the same SELECT alias more than once. (Groene AI).
otherNO CL ENTRY: 'Revert "Backport to 26.9: Skip the direct join when the right table has a row policy"'. (Vladimir Cherkasov).
otherBackported in: Hide a Backup locator named like a COLUMNS matcher in EXPLAIN AST instead of throwing. (Groene AI).
otherBackported in: Do not dereference a null logs_queue in OwnSplitChannel::log. (Groene AI).
26.9.8.3 Oct 1, 2026 Release notes ↗
fixBackported in: Fix the Kafka and NATS table engines ignoring remote_url_allow_hosts: broker addresses from kafka_broker_list, nats_url, and nats_server_list are now checked against the remote host filter. A forbidden address is rejected at CREATE TABLE with UNACCEPTABLE_URL, as the RabbitMQ engine…
breakingBackported in: Remove --icf=safe linker warnings about SHT_LLVM_ADDRSIG in the stripped Rust libraries. (Raúl Marín).
26.9.7.9 Sep 30, 2026 Release notes ↗
otherBackported in: Parse some (geo) parquet metadata lazily. (Konstantin Vedernikov).
fixBackported in: Fixed max_memory_usage and max_server_memory_usage not being respected when reading a JSON column with the FLATTENED serialization version from the Native format. (Pavel Kruglov).
fixBackported in: Fixed out-of-bounds reads when reading a JSON or Dynamic column from a malformed Native block or a corrupted data part. A truncated stream, a duplicate type in a flattened Dynamic column, a duplicate or typed-colliding path in a JSON column, and a serialization version that is only…
fixBackported in: Kafka producer and consumer trace logs now show the value of secret librdkafka properties, such as sasl.password, as [HIDDEN] instead of the cleartext value. (János Benjamin Antal).
fixBackported in: Now clickhouse masks credentials in system.query_log even for wrong URLs for external table engines. (alesapin).
fixBackported in: The value of 'role_session_name' as of now is hidden in query_log. (Alexey Bakharew).
fixBackported in: Fix Keeper silently giving a new session to a ZooKeeper client (for example the Java client or kazoo) that reconnects and asks to continue its session. Such a client now gets SessionExpired, ZooKeeper's answer for a session that cannot be continued, instead of losing its ephemeral…
fixBackported in: Fix validation of Iceberg manifest-list entries during writes. (Arsen Muk).
26.9.6.6 Sep 29, 2026 Release notes ↗
breakingBackported in: Update the zxc library to v0.14.0, which changes the compressed block format of the experimental ZXC codec. Data written with CODEC(ZXC) by earlier versions cannot be read by the new version and fails with CANNOT_DECOMPRESS. If you used the experimental ZXC codec, re-encode the…
otherBackported in: Build Iceberg min/max hyperrectangles only for columns the filter uses. (Konstantin Vedernikov).
featureBackported in: Added the http_x_clickhouse_format_overrides_output_format setting (default true). When disabled, the X-ClickHouse-Format HTTP header only sets default_format, as it did before version 26.8, instead of overriding the FORMAT clause of the query via output_format. (Alexey Milovidov).
fixBackported in: Fixed a crash in plus and minus of an array of dates and an array of tuples holding NULL, for example toString([toDateTime64(1, 3)] + [(2, NULL)]), and the exception ColumnTuple cannot have ColumnConst as its element when adding a constant interval to a non-constant interval of…
fixBackported in: Link with --icf=safe instead of --icf=all, so the linker keeps functions whose address is taken distinct. gRPC queries with transport compression (gzip, deflate) no longer crash the server, as they could in official builds since 26.4. Closes. (Groene AI).
26.9.5.2 Sep 28, 2026 Release notes ↗
fixBackported in: The command line client no longer shows the as-you-type hints on a query recalled from the history (or otherwise displayed at once, e.g. pasted), so pressing Up/Down continues to navigate the history instead of the hint list. The hints appear again as soon as the line is edited.…
26.9.4.3 Sep 27, 2026 Release notes ↗
otherBackported in: A single-level GROUP BY result smaller than max_block_size is now split into several blocks when it was aggregated by several threads, so the steps after it, such as the probe of a following join, run in parallel instead of on one thread. Previously such queries could be several…
fixBackported in: Fixed a heap-use-after-free when a correlated subquery reading a Merge table was planned inside EXPLAIN, a subquery in FROM, a view or an IN subquery. (Groene AI).
26.9.3.38 Sep 26, 2026 Release notes ↗
featureBackported in: You can now disable reading through the executable table function and from Executable/ExecutablePool tables with the new allow_executable_tables setting, for a deployment that must not run arbitrary server-side scripts. It defaults to true, so existing behavior is unchanged. (Hanzi…
otherBackported in: Speed up extracting a value from a Map with LowCardinality keys. The key is now resolved to its dictionary position once instead of being compared against every entry of a row, so the cost of m[key] no longer grows with the position of the key in the row. Also fix extracting a value…
otherBackported in: Chained ARRAY JOINs no longer materialize the whole block of a lazily replicated array column before expanding it, which cuts their peak memory by several times. (Yarik Briukhovetskyi).
featureBackported in: Iceberg tables whose manifest file headers carry a schema that conflicts with the schema registered for the same schema-id in metadata.json are now readable: the metadata.json schema is preferred and the divergent manifest header copy is ignored with a warning, no matter which of…
featureBackported in: Add column size statistics in Avro files. (Konstantin Vedernikov).
otherBackported in: The AI function per-query quotas are now disabled by default: ai_function_max_input_tokens_per_query (previously 1000000), ai_function_max_output_tokens_per_query (previously 500000) and ai_function_max_api_calls_per_query (previously 1000) default to 0, meaning no limit. To keep…
otherBackported in: Do not drop the ClickHouse Keeper session when the client's outgoing request queue stays full for longer than operation_timeout_ms. The enqueue wait is now three times session_timeout_ms, so a short burst of backpressure no longer terminates the session and invalidates all its…
featureBackported in: Added the setting analyzer_compatibility_allow_cte_redefinition. When enabled, a CTE name may be defined more than once in a single WITH clause; a later definition shadows the earlier one as the query analysis before 24.3 did (a redefinition can read the previous definition, the…
fixBackported in: Fixed dropping whole parts with TTL (ttl_only_drop_parts = 1) still reading all data from large, fully-expired parts. (Michael Jarrett).
fixBackported in: Fixes a server crash (double free) when finalizing an aggregate function with the -State combinator nested under a combinator that transfers several sub-states in one call (-Resample, -ForEach, -Map, -Tuple), for example groupArrayStateResample, if an exception such as a memory…
fixBackported in: Fixed Iceberg INSERT writing no lower_bounds/upper_bounds at all into the manifest entry when the table has a column whose type cannot be serialized into a statistics bound (for example Array(Int32)), or a column that is entirely NULL. Such a field is now omitted individually and…
fixBackported in: Fixed SQL injection through identifiers when inserting into a table with the SQLite engine. The remote table name and the column names were escaped with backslashes, which SQLite does not honour inside a quoted identifier, so a name containing a double quote could close its own…
fixBackported in: Fixed a Backup database engine printing the credentials of its destination in plaintext. SHOW CREATE DATABASE, system.databases.engine_full, system.query_log and the messages that reject a malformed locator showed an AzureBlobStorage account_key, a connection string or a presigned…
fixBackported in: KILL TRANSACTION ... ON CLUSTER, KILL PART_MOVE_TO_SHARD ... ON CLUSTER, SYSTEM STOP THREAD FUZZER ON CLUSTER, SYSTEM START THREAD FUZZER ON CLUSTER and SYSTEM RESET COVERAGE ON CLUSTER ran without checking any privilege, so a user holding only CLUSTER could roll back other users'…
fixBackported in: ALTER DATABASE ... MODIFY COMMENT on a database with ENGINE = Backup no longer writes a definition the server cannot read back, which made it refuse to start; metadata already written in that form now loads too. Backward incompatibility: a backup taken by an older server of a…
fixBackported in: Fix a patch part whose source_parts.dat lost its content to a zeroed block loading as an empty index, which silently unapplied an acknowledged lightweight UPDATE and then let background cleanup delete the only copy of it. Such a part is now detached as broken. (Alexey Milovidov).
fixBackported in: Fixed http_max_multipart_form_data_size silently truncating oversized multipart data instead of failing the query, and made it span a form's external-table parts instead of resetting per part. (Sema Checherinda).
fixBackported in: Fixed two ways a table with the Redis engine mishandled an MGET reply. Reading the whole table stopped at the first key without a string value and silently dropped every key scanned after it, so one key of another Redis type was enough to truncate the result. A reply carrying a…
fixBackported in: Bound the header column count in RowBinary formats to avoid excessive memory allocation from a crafted header. (George Larionov).
fixBackported in: Fixed settings constraints from a settings profile not being enforced against the other setting assignments in the same statement. SET profile = 'p', = could override a CONST, MIN/MAX or readonly constraint that profile p installs. The same escape existed through an in-query…
fixBackported in: Fixes a segmentation fault that happens when a refreshable materialized view is started up and shut down at the same time, for example when a failed ATTACH DATABASE rolls the database back, or when the server shuts down while tables are still loading asynchronously. (Groene AI).
fixBackported in: Fixed a performance regression where a query whose WHERE requires the same expression to equal two different constants stopped being recognized as always false when compatibility was set below 26.7, or when optimize_redundant_comparisons was disabled explicitly. Such a query…
fixBackported in: TRUNCATE ALL TABLES FROM and TRUNCATE TABLES FROM ... LIKE ... now skip Alias tables, which hold no data of their own. Previously such a statement could fail with LOGICAL_ERROR: RWLock is already locked in exclusive mode, truncate a target in another database, or fail when the alias…
fixBackported in: The text, tokenbf_v1, ngrambf_v1 and sparse_grams skip indexes are now used for IN when transform_null_in = 1 and the set contains no NULL. Previously such a query read every granule, and one using force_data_skipping_indices failed with INDEX_NOT_USED. (Jimmy Aguilar Mena).
fixBackported in: Fixed an out-of-bounds heap write in stem. The output buffer was sized from the input, but some stemmers lengthen a word (Turkish uag → uagı, Estonian keeb → keesi), so a block overran its allocation and returned uninitialized heap as result values. The buffer now grows when the…
fixBackported in: remote(, 'db', 'table', 'user', 'password'), and the same form of remoteSecure and of the Remote and RemoteSecure table engines, wrote the password into system.query_log, system.text_log and the server log in cleartext, while the remote('addresses_expr', ...) form hid it. The…
fixBackported in: Fix wrong values and a LOGICAL_ERROR when reading a partitioned Delta Lake table with allow_delta_kernel_rs = 0 and column types that differ from the ones in _delta_log. (Raúl Marín).
fixBackported in: Fixed a crash when deserializing an AST from JSON (formatQueryFromJSON, the clickhouse_json dialect): a deeply nested document exhausted the stack and killed the process with no log line. Such payloads now fail with TOO_DEEP_RECURSION. (Groene AI).
fixBackported in: Fixed a crash (stack exhaustion) in parseQueryToJSON when serializing a query nested deeper than the serializer could follow, reachable by raising max_parser_depth above its default. Such a query now fails with TOO_DEEP_RECURSION instead of terminating the server. (Groene AI).
fixBackported in: Fixed a server crash when the flameGraph aggregate function was constructed on a thread without a query context, for example while attaching a stored table whose column type names AggregateFunction(flameGraph, ...). (Groene AI).
fixBackported in: Fix a segmentation fault in Keeper when preallocating space for a changelog file fails because the disk is full. (Alexey Milovidov).
otherBackported in: Update cctz to 2026d. Time zone names with the file: prefix are now rejected. (Actuele AI).
otherBackported in: Reject a compressed block whose codec stores data verbatim (NONE, Quantized) when its declared uncompressed size does not match the body length. Previously the passthrough read path accepted such a block while every other decompression path rejected it. (Groene AI).
fixBackported in: Fix flaky 01780_column_sparse: order the arrayFilter result before limiting it. (Alexey Milovidov).
otherBackported in: Make test_multi_consumer_with_partition_affinity deterministic. (Aparajita Pandey).
fixFix 26.9 upgrade check. (Azat Khuzhin).
otherBackported in: Small performance optimisations of iceberg read path. (Konstantin Vedernikov).
26.9.2.8 Sep 22, 2026 Release notes ↗
breakingBackported in: A MySQL dictionary source created with a CREATE DICTIONARY query can no longer enable enable_local_infile, at the source or at one of its REPLICA entries; loading such a dictionary fails with BAD_ARGUMENTS, which with the default dictionaries_lazy_load is on first use rather than at…
fixBackported in: Fixes a case where date_time_overflow_behavior was ignored on parsing Date and DateTime. Closes. (Yarik Briukhovetskyi).
fixBackported in: Fix ALTER TABLE ... MODIFY SETTING name = DEFAULT skipping the checks an engine makes on a setting reset: TimeSeries allowed an immutable setting to be dropped, leaving the table unwritable, Memory removed a setting from the table definition while the table kept enforcing the old…
fixBackported in: Fix wrong results when a GROUP BY, DISTINCT, LIMIT BY or window PARTITION BY key was plus or minus of a partition column with a non-integer constant, for example f + 1.0 on Float64 or d + INTERVAL 1 MONTH on Date. Such a key was assumed injective, so each table partition was…
fixBackported in: Fix a server crash (std::terminate with write failed) in the embedded SSH client when the client's terminal was closed before the line reader was destroyed. (Alexey Milovidov).
fixBackported in: Fix spurious NATS connection failures when the vendored nats-io client gets EINTR while waiting for a socket, and include the upstream JetStream pull-subscription deadlock fix in the vendored client. (Alexey Milovidov).
otherBackported in: . (Antonio Andelic).
26.9.1.1629 Sep 21, 2026 Release notes ↗
breakingThe default compression method is changed from LZ4 to ZSTD(3). For client/server and server/server network communication it switches uniformly to ZSTD(3). For on-disk table data, MergeTree column data now uses a size-aware built-in default — LZ4 below 100 MB and ZSTD(3) at or above it, applied to…
breakingRemoved the CatBoost integration. The catboostEvaluate function, the system.models table and the SYSTEM RELOAD MODEL(S) queries are no longer available. Queries, views and grants referring to them have to be migrated before the upgrade: in particular, revoke SYSTEM RELOAD MODEL from all users and…
breakingFix setting temporary_files_buffer_size or format_avro_schema_registry_* to an out-of-range value making every subsequent query in the session fail, with no way to recover; the values are now bounded when they are set. (Pedro Ferreira).
breakingFixed wrong results from runningConcurrency. Its value depends on the rows processed before it, but it declared itself deterministic within a query, so a predicate on it above a LEFT or ANY join let optimizer passes rewrite the join and change the row set it sees, and if, multiIf, and and or…
breakingThe experimental WINDOW VIEW feature is removed, together with the WATCH statement and the windowID function. It has been non-functional since version 24.12 (inserts into the source table were silently not delivered to window views) and was never supported by the analyzer, which is enabled by…
breakingRemoved the deprecated read_resource and write_resource disk options from storage_configuration. Attach a scheduler resource to a disk with CREATE RESOURCE name (READ DISK disk, WRITE DISK disk) instead. (Sergei Trifonov).
breakingRemoved the WasmEdge engine for WebAssembly UDFs. wasmtime, which has always been the default, is now the only supported value of the webassembly_udf_engine server setting. A server configured with wasmedge will not start; remove that setting or set it to wasmtime. On binaries where wasmtime is…
breakingRemoved the sharded GROUP BY aggregation (setting enable_sharding_aggregator, disabled by default) in favor of the adaptive aggregation (enable_adaptive_aggregator, enabled by default), which targets the same high cardinality workloads without the weaknesses on skewed or low-cardinality keys and…
breakingBackported in: Outbound TLS connections now verify that the server certificate names the host that was connected to. This affects clickhouse-client --secure, remoteSecure(), Distributed over the secure native protocol, secure Keeper connections, and HTTPS clients such as s3(), url(), HTTP…
breakingmax_bytes_before_external_join and max_bytes_ratio_before_external_join are now the spill threshold for every hash-based join_algorithm, including grace_hash, which previously ignored them and spilled on max_rows_in_join / max_bytes_in_join instead. Those two are a hard cap again for every…
breakingSetting allow_experimental_codecs is obsolete. Use the per-codec settings enable__codec instead. (Raufs Dunamalijevs).
breakingReading a File source with rename_files_after_processing set now requires the WRITE ON FILE grant on top of READ ON FILE, on the initiator for fileCluster: the setting renames the files a SELECT has read, which is a write to the source, and it used to happen for anyone who could read them. A query…
breakingThe interface and http_method columns of system.query_log, system.query_thread_log and system.processes are now Enum8 instead of UInt8, over the value set system.session_log.interface already uses, plus Unknown for an unrecognized reported interface. Comparing to a number keeps working (WHERE…
breakingThe analyzer can no longer be disabled: the enable_analyzer setting (and its old name allow_experimental_analyzer) is obsolete, an attempt to set it to 0 is rejected, and the compatibility setting no longer reverts it. The analyzer has been the default since 24.3, and the query analysis used…
breakingCREATE TABLE ... AS mergeTreeIndex(...) is no longer accepted, nor the same form over mergeTreeProjection, mergeTreeAnalyzeIndexes, mergeTreeAnalyzeIndexesUUID, mergeTreeTextIndex and mergeTreeCodecBlockCounts. The storage these functions return holds its source table's storage object, so once…
breakingHeaders that Google Cloud Storage spells with an x-goog- prefix are now translated for every request, not only for server-side copies. Custom object metadata written to GCS over the S3 API without HMAC credentials — how ClickHouse Cloud on GCP accesses object storage — previously did not take…
breakingNullable(Tuple(...)) is now generally available and enabled by default. Nullable(Tuple(...)) columns can be created without any setting, schema inference of nullable structs in the Parquet, Arrow, ORC, Avro and JSON formats returns Nullable(Tuple(...)), and a Tuple subcolumn extracted from a…
breakingRemove s3_disable_checksum, since checksum calculation for S3 does not read the source second time anymore (previously the problem was that sources has been read twice, once for sending data, second for checksum calculation). (Azat Khuzhin).
breakingCREATE TABLE ... AS timeSeriesSamples(...) is no longer accepted, nor over its alias timeSeriesData or over timeSeriesTags and timeSeriesMetrics. The persisted proxy renamed that live target table in memory on first read: DROP TABLE then dropped the user's table and destroyed its rows, and reads…
breakingNew setting validate_group_by_all_key_types (default true) gates the key type validation that GROUP BY ALL applies to the grouping keys it expands the SELECT expressions into. Since 26.7 it rejects a Variant or Dynamic grouping key, for example an untyped JSON subpath, that earlier versions…
featureOperations '+' and '-' between DateTime and Time data types. (Yarik Briukhovetskyi).
featureAdded the opt-in MergeTree setting skip_empty_columns_on_insert, which avoids storing columns containing only their type-default value. It requires serialization_info_version = 'with_missing_columns'; keep an older serialization version during rolling upgrades with servers that cannot read the new…
featureNew LIMIT forms that select rows by boundary conditions instead of by position, following the stream order (use ORDER BY to define it): LIMIT n AFTER cond returns up to n rows starting at the first row where cond is true (SELECT number FROM numbers(10) ORDER BY number LIMIT 3 AFTER number >= 5…
featureAdd type_json_skip_null_typed_paths setting for JSON type. When enabled, typed paths in JSON columns that have NULL values are treated as absent, matching the behavior of dynamic paths. Closes:. (Pavel Kruglov).
featureAdd support for accessing JSON subcolumns using bracket syntax, e.g. json['key1']['key2'], which the parser translates to nested arrayElement calls. (Pavel Kruglov).
featureSupport BACKUP/RESTORE for WORKLOAD and RESOURCE entities. SQL-defined CREATE WORKLOAD / CREATE RESOURCE definitions are now included when backing up system.workloads / system.resources and are recreated on restore, including ON CLUSTER. (Sergei Trifonov).
featureAuthentication methods in CREATE USER and ALTER USER ... ADD IDENTIFIED support a GRANTS (SELECT ON db.table, ...) clause which limits the access rights of sessions authenticated with that method to the intersection with the listed grants. This allows using additional credentials as tokens for…
featureAdded the system.session_query_ids system table, which contains the query ids of the queries executed in the current session, in execution order. It makes it easy to find "the queries I just ran" in system.query_log without assigning query_id client-side or tagging queries with log_comment, which…
featureAdds support for mode='exclusive' in S3Queue engine, for high-throughput and self-hosted scenarios. (Ivan Tkatchev).
featureDisks with the plain_rewritable metadata (s3_plain_rewritable, and azure/local object storages with metadata_type = plain_rewritable) support hard links if configured with the new enable_hard_links setting, which enables ALTER operations and mutations on MergeTree tables stored on them. Mutations…
featureNew function arrayFlattenedLength, returning the total number of elements of a multidimensional array, as if it was flattened with arrayFlatten. Unlike cardinality/length, which count only the elements of the outermost array, it counts elements at every nesting level, matching PostgreSQL's…
featureRefreshable materialized views can now refresh incrementally with REFRESH ... APPEND INCREMENTAL, appending only the rows committed to the source table since the previous refresh instead of re-reading the whole source. (Smita Kulkarni).
featureSupport exactly-once incremental refresh of refreshable materialized views into Iceberg targets by committing the refresh cursor atomically inside the Iceberg snapshot summary. (Smita Kulkarni).
featureAdd MergeTree settings max_table_size_rows, max_table_size_bytes_compressed, and max_table_size_bytes_uncompressed that limit the total size of a table. The limits are checked at the beginning of INSERT and when new data parts are committed (including the results of background merges and…
featureclickhouse-client accepts --ssh-key-file without a value: the key is looked up the same way as ssh does it - the identity files configured for the host in ~/.ssh/config, the default identity files, such as ~/.ssh/id_ed25519, and the keys held by the ssh-agent. Authentication with a key held by the…
featureAdd the max_tables database setting to limit the number of tables in Atomic and Ordinary databases. Every table-like object counts toward the limit: tables, views and dictionaries. (Alexey Milovidov).
featureJemalloc Fragmentation Profiler. (Azat Khuzhin).
featureNew text index tokenizer keyValuePairs, which indexes a Map(String, String) column directly and answers map['key'] = 'value' from the index without reading the map column. (Jimmy Aguilar Mena).
featureIceberg v3 has two new fields in manifest file - first_row_id and last_seq_num. This PR allows to read them as virtual columns. (Konstantin Vedernikov).
featureAdded nats_ca_file, nats_client_cert_file and nats_client_key_file settings to the NATS engine, for verifying a broker certificate signed by a private CA and for client-certificate authentication. The feature was first proposed in by sidhmads. (Nikolay Degterinsky).
+1346 more items in the release notes
26.8.33.10 Oct 21, 2026 Release notes ↗
otherBackported in: An equality with a Bool value that no statistics can estimate, such as WHERE j.f = false on a JSON path, a Bool column without statistics, or IN with a Bool set, is now estimated to match half of the rows per value instead of 1%, so a join on such a filtered table builds its hash…
otherBackported in: A JOIN whose ON condition has a constant-false conjunct now works with the experimental parallel_replicas_plan_based setting when the join uses grace_hash, spills to disk, or runs with join_use_nulls = 1, instead of terminating the server or failing with NOT_FOUND_COLUMN_IN_BLOCK.…
fixBackported in: Mask credentials embedded in HTTP URIs. (Han Fei).
fixBackported in: Creating a FileLog tables now require READ and WRITE privileges, analogous to File tables. (Robert Schulze).
fixBackported in: Fixed a heap-use-after-free in the view dependency graph after renaming a materialized view whose query selects from itself. CREATE MATERIALIZED VIEW and ALTER TABLE ... MODIFY QUERY now reject a query that makes a materialized view select from itself. (Groene AI).
fixBackported in: Fix use-after-free in complex key ssd_cache dictionaries when the cache file wraps around its partitions. Fix CANNOT_READ_ALL_DATA when reading long values of ssd_cache dictionaries from the cache file. (Alexey Milovidov).
fixBackported in: Fixed count() with WHERE d = toDate32('1900-01-01') (or !=) over a MergeTree Date32 column returning the number of 1970-01-01 rows when optimize_trivial_count_with_sparsity_filter is enabled (the default since 26.8). Closes. (Groene AI).
fixBackported in: Fix polygonConvexHullCartesian returning garbage for a polygon with an empty exterior ring and a non-empty interior ring. (Alexey Milovidov).
otherBackported in: Make 03673_columns_description_cache and 04257_102926_columns_descriptions_cache_nested_eviction robust to asynchronous part removal, applying the fix already made to their sibling 04510_shared_part_schema_metadata_eviction. (Groene AI).
26.8.32.14 Oct 20, 2026 Release notes ↗
breakingBackported in: CREATE TABLE x AS src inherits the credentials embedded in the engine of src, which are masked in SHOW CREATE TABLE. It now requires the SELECT privilege on src when the inherited definition can carry credentials, instead of only SHOW COLUMNS. (Yarik Briukhovetskyi).
otherBackported in: Reduce repeated IN evaluation when many adjacent singleton row-mask updates are applied to one part. (Sergey Kuznetsov).
featureBackported in: Estimating subcolumn sizes for PREWHERE (for example m['key'] of a Map(LowCardinality(String), String) column) no longer reads the LowCardinality dictionary or the Variant discriminators header of every data part, which made planning slow on object storage, especially for each new…
otherBackported in: BACKUP uses less memory per file it backs up: an entry of the backup no longer keeps a copy of the description of the disk the file is on. A backup of a table with millions of files saves a few gigabytes. (Julia Kartseva).
fixBackported in: Fixed a server crash and an out-of-bounds write when inserting into a column with a long chain of compression codecs, for example CODEC(FPC, FPC, ..., FPC). CompressionCodecMultiple compounded each stage's reserved size in a UInt32 without checking for overflow, so a long enough…
fixBackported in: Fixed a read of uninitialized memory when a Variant, Dynamic or JSON column holding only NULL values is compressed, for example on insert into a Memory table created with compress = 1, or when a block is compressed for a JOIN or for the query result cache. The reported size of such…
fixBackported in: BACKUP and RESTORE to S3 retry requests that fail with ExpiredToken after refreshing credentials. The retry time limit is 120 seconds by default and can be changed with backup_s3_expired_token_retry_timeout_ms. (Nikolai Ovchinnikov).
fixBackported in: Fixed a server crash (or missing rows in the view, with a Null source table) on INSERT into the source table of a materialized view when a row policy or additional_table_filters of a table read by the view references the source table, e.g. USING x IN src. (Groene AI).
fixBackported in: Fix a segmentation fault in GROUP BY with the adaptive aggregator and external aggregation when a memory limit was hit while draining staged records. (Alexey Milovidov).
fixBackported in: Fix segfault when reading a MySQLDump file whose CREATE TABLE query has an ENUM column without a list of values or with non-string values. (Alexey Milovidov).
fixBackported in: Fix a stack overflow when a Redis server replies with deeply nested arrays. (Alexey Milovidov).
fixBackported in: Fix a stack overflow on a Protobuf schema with a very long chain of nested messages. (Alexey Milovidov).
otherBackported in: Not required. (Groene AI).
26.8.31.2 Oct 19, 2026 Release notes ↗
fixBackported in: Fixed crashes of the interactive line editor of clickhouse-client and clickhouse-local, which also crashed the server when used through the web terminal or an SSH session: after a history search that found nothing on an edited recalled query, when the prompt or the line given to an…
26.8.30.8 Oct 17, 2026 Release notes ↗
otherBackported in: Reduced the memory usage of incremental BACKUP: the base backup keeps only the sizes and checksums of its files instead of the full information about each file. For a base backup of millions of files this saves gigabytes. (Julia Kartseva).
otherBackported in: Compare TOTP codes and plaintext_password passwords in constant time, so that the response time does not depend on how many leading characters are correct or on which time window matched. (Vladimir Cherkasov).
fixBackported in: Fix reading dropped column with existing column in data file. Closes. (Konstantin Vedernikov).
fixBackported in: Requesting SSH-key authentication over the native protocol no longer reveals whether the named user exists, or how it authenticates, before its signature is checked. (Shaohua Wang).
fixBackported in: Reject CR and LF characters in values sent as HTTP headers or in the request line of outgoing HTTP requests (BigQuery, YTsaurus, url, DataLake catalogs, GCP OAuth, AI functions, S3 storage class), which could be used to inject headers or additional requests. (Raúl Marín).
fixBackported in: The setting http_zlib_compression_level now applies only to the gzip and deflate HTTP response compression. The level of other methods (zstd, lz4, br, xz, bz2) is controlled by output_format_compression_level. Previously, a level suitable for zlib was passed to every method, which…
fixFixes distributed queries incorrectly disabling the analyzer on shards when a native application reports its own version. Compatibility decisions use the connecting ClickHouse server's version and preserve explicit analyzer choices, including on the first query of a connection. (Ye Yuan).
26.8.29.10 Oct 16, 2026 Release notes ↗
breakingBackported in: Overriding a key that is stored in a named collection now requires SHOW NAMED COLLECTIONS SECRETS on that collection. This also applies to overrides through an alias (including flat kafka_* settings over nested kafka.* keys), through a SETTINGS clause of a table engine or table…
otherBackported in: A packet that cannot appear at the current point of the native protocol is now rejected without deserializing its payload. Previously the server deserialized the body of an unexpected Data packet — including arbitrary data types and aggregate function states — only to throw…
fixBackported in: Fixed a crash caused by a stack overflow when a deeply nested JSON document was parsed into a JSON column or passed to the JSONExtract family of functions. Such documents are now rejected with the TOO_DEEP_RECURSION error. (Pavel Kruglov).
fixBackported in: Fix a server crash when a RIGHT JOIN/FULL JOIN is planned for parallel replicas (parallel_replicas_plan_based=1) and the join output header declares a column by type only — e.g. the residual column of a constant NULL conjunct in the ON clause. Type-only header columns are now…
fixBackported in: Fixed CANNOT_READ_ALL_DATA (while reading prefix of column ...) during query planning when a MergeTree table has an active empty Wide part, left by a TTL drop or by a mutation that deleted all rows of a part, and the query filters on a subcolumn, such as a key of a…
fixBackported in: Fixed ORDER BY ... LIMIT over a column of an Interval type (or Nullable, LowCardinality, Tuple or Array of one) failing with TYPE_MISMATCH when use_top_k_dynamic_filtering is enabled, which is the default. Closes. (Groene AI).
fixBackported in: Allow to do vertical merge if result part storage type is not Full. (alesapin).
fixBackported in: Fixed a crash (stack overflow) on a CapnProto schema with a long chain of type expression suffixes (Int32.a.a..., Int32()()...) or of declarations that refer to each other (constants, aliases, struct fields, annotations, imports). Such a schema is now rejected with The CapnProto…
fixBackported in: Fixed Reading in parallel from replicas is enabled but cluster to execute query is not provided (CLUSTER_DOESNT_EXIST) when selecting from a Distributed table whose cluster is not declared in remote_servers - the cluster of a Replicated database, or one found by cluster discovery -…
26.8.28.14 Oct 15, 2026 Release notes ↗
otherBackported in: A filter on the PARTITION BY columns of a window function is no longer pushed below the window (this reverts). The push-down made queries up to 8 times slower when the window reads a JOIN and the filter removes every row, for example IN over an empty subquery, because the join built…
featureBackported in: Add S3 bucket to remote_url_allow_hosts. (Konstantin Vedernikov).
otherBackported in: Reduced the peak memory usage of RESTORE and of incremental BACKUP: the metadata file of a backup is now parsed while it is read, instead of being read into memory whole first. For backups of millions of files this saves gigabytes. (Julia Kartseva).
securityBackported in: Update the vendored expat to 2.9.0, fixing a denial of service through a crafted backup manifest during RESTORE (CVE-2026-66046) and the other 2.8.3–2.9.0 security fixes. (Actuele AI).
fixBackported in: Fixed loading, short ATTACH, and UNDROP TABLE for existing SQL-defined S3 disks whose endpoints are absent from remote_url_allow_hosts; new full-definition CREATE and ATTACH still reject disallowed endpoints. (Alexey Bakharew).
fixBackported in: Fixed a stack overflow crash on a deeply nested CapnProto schema that the nesting depth check missed: a comment or a byte order mark between import and its path, an escape sequence in the import path, or a backtick text line. A backtick text line with many brackets is no longer…
fixBackported in: Fixed a possible segmentation fault when reading an Avro map into a Map column (for example Map(DateTime, String)) with the AvroConfluent format, including Kafka tables. Closes. (Groene AI).
fixBackported in: Fixed an issue where pressing Ctrl-R and then Ctrl-Z in the web terminal or the SSH interface suspended the whole server process. (Alexey Milovidov).
fixBackported in: Fix a wrong result, or an exception in debug builds, when optimize_aggregators_of_group_by_keys eliminated any, min or max of a GROUPING SETS key with group_by_use_nulls. (Alexey Milovidov).
fixBackported in: Fixed a server crash when a RabbitMQ table with the headers exchange type had a routing key without =, or when rabbitmq_routing_key_list was empty. Routing keys without = for the headers exchange type are now rejected with an exception. The problem was found and reported by @dstesk…
otherBackported in: Update mariadb-connector-c to v3.4.10. (Actuele AI).
otherBackported in: Update vectorscan to 5.4.13. (Actuele AI).
otherBackported in: Observed as a bottleneck in the ci-logs cluster. (Mikhail Artemenko).
26.8.27.9 Oct 14, 2026 Release notes ↗
featureBackported in: Add ability to select jemalloc 4K/16K page size on aarch64 (default 64K). (Azat Khuzhin).
otherBackported in: DROP TABLE, DETACH TABLE, server shutdown and ALTER TABLE ... MODIFY SETTING refresh_statistics_interval no longer wait until a running background refresh of the statistics cache of a MergeTree table has read the statistics of every part. On object storage with thousands of parts…
fixBackported in: Fix ALTER TABLE ... MATERIALIZE STATISTICS / DROP STATISTICS failing forever and wedging the table's mutation queue when a server profile sets allow_statistics = 0 and the statement enables it per-session, the same opt-in ADD STATISTICS honours. Also close a hole where MATERIALIZE…
fixBackported in: Fixed the LOGICAL_ERROR Reading from materialized CTE '...' before its materialization completed - DelayedPortsProcessor gate is missing in the query plan raised when an IN or other set subquery defines a MATERIALIZED CTE that two other MATERIALIZED CTEs of that subquery read (for…
fixBackported in: Fix a credential written in cleartext to system.query_log and the server log when a key = value argument precedes the positional arguments of the mongodb, redis, remote, arrowFlight and ytsaurus table functions or the MongoDB, Redis, Remote, ArrowFlight, ExternalDistributed and…
fixBackported in: Free prefetched messages when StorageKafka2 partitions move between consumers, preventing per-partition memory growth until restart. (Aparajita Pandey).
fixBackported in: The web terminal and the SSH interface no longer reset the settings of the user (from settings profiles, roles, and CREATE USER ... SETTINGS) to default values. Previously, restrictions such as readonly, resource limits, and additional_table_filters were not applied in these…
otherBackported in: Not required. (Groene AI).
26.8.26.12 Oct 13, 2026 Release notes ↗
breakingOutbound TLS connections no longer verify that the server certificate names the host by default (reverts https://github.com/ClickHouse/ClickHouse/pull/116724), because it broke clickhouse-client --tls-sni-override. Set openSSL.client.extendedVerification to true to enable the check. (Nikita…
featureBackported in: optimize_and_compare_chain again derives transitive conditions through a DateTime or lower-scale DateTime64 constant compared with a DateTime64 expression, as it did before 26.8. For example, t1.ts = t2.ts adds t2.ts < toDateTime('2026-09-16 00:00:00'), so the other side of a join…
featureBackported in: Added a server setting access_control_improvements.readonly_restricts_set_role, false by default. When enabled, SET ROLE is refused with error code READONLY in a session or query whose readonly setting is not zero. Previously SET ROLE was the only identity-changing statement that…
featureBackported in: Added the setting use_aggregation_memory_tracker to choose how GROUP BY measures its memory when deciding on two-level aggregation. compatibility below 26.9 restores the measurement from before 26.7. (Hechem Selmi).
fixBackported in: Fix wrong results for uniq*, GROUP BY, LIMIT n BY, ORDER BY after GROUP BY, and window PARTITION BY over toString of a DateTime/DateTime64 in a time zone with a daylight-saving transition, and over toFixedString of a String. Both functions claimed to be injective while mapping…
fixBackported in: Fixed use_skip_indexes = 0 also disabling part pruning by the partition-key min-max index (since 26.5), which made such queries read every part of the table. (Ashish Kumar Choubey).
fixBackported in: Fixed queries that go through another server (remote, Distributed, parallel replicas, GLOBAL IN) failing with SYNTAX_ERROR, UNKNOWN_CODEC or CORRUPTED_DATA when output_format_native_encode_types_in_binary_format or input_format_native_decode_types_in_binary_format is enabled. The…
fixBackported in: Reject malformed serialized groupBitmap states with INCORRECT_DATA instead of failing later during bitmap operations. (Elmi Ahmadov).
fixBackported in: Fixed a WHERE condition or a row policy on a Hive partition column (use_hive_partitioning = 1) returning too few rows when the Parquet data file also has a column with that name and other values: Parquet row-group, page and dictionary pruning used the file's values instead of the…
fixBackported in: Fixed a heap use-after-free in the s3, azureBlobStorage, hdfs and other object storage table functions and engines when an exception (for example MEMORY_LIMIT_EXCEEDED) was thrown while creating the reader of a file in a row input format such as CSV. (Groene AI).
fixBackported in: Fixed a server crash, wrong results or a rejected query in ORDER BY ... WITH FILL ... INTERPOLATE when one INTERPOLATE expression has to be converted to its target's type and another item reads the same column or literal, for example INTERPOLATE (a AS b, b AS a) with targets of…
26.8.25.14 Oct 12, 2026 Release notes ↗
featureBackported in: Restore min/max pruning of Iceberg data files for a Decimal(38, 38) column. A manifest bound of magnitude above roughly 0.7 cannot be widened inside Int128 and was dropped, which left the column without a min/max condition; it is now saturated at the largest magnitude the precision…
fixBackported in: Fixed wrong results and a server abort when a JOIN ON condition evaluated during an ie_join join contains arrayJoin. Such a condition is now rejected with INVALID_JOIN_ON_EXPRESSION. Previously SEMI/ANTI/LEFT/RIGHT/FULL joins using the ie_join algorithm could return duplicated or…
fixBackported in: The collections of the Native protocol — the settings and the query parameters of a query, the client information, the granted roles and the table-status lists — are now bounded, so a small packet can no longer make the server allocate memory for data that has not arrived. (Alexey…
fixBackported in: Fix the default-enabled query_plan_merge_expression_into_join returning rows that violate the query's own JOIN ON condition when a subquery computes a non-deterministic expression that is then used as a join key. The merged expression was computed twice from the raw inputs, drawing…
fixBackported in: Fix a vector search returning fewer rows than its LIMIT, and missing true nearest neighbours, after a lightweight DELETE (or with a delete mutation applied on the fly): the vector index is no longer used for a part while it still holds deleted rows. (Alexey Milovidov).
fixBackported in: Fixed a crash on a query with a deeply nested Dynamic or JSON constant. (Pavel Kruglov).
fixBackported in: Fixed excessive memory usage when loading a data part with a corrupted columns_substreams.txt; such a part is now detached as broken. (Murphy).
fixBackported in: Fix NOT_IMPLEMENTED for an outer JOIN with join_algorithm = 'full_sorting_merge' when optimize_and_compare_chain derived a condition on the preserved side of the join from the ON clause. (Yarik Briukhovetskyi).
securityBackported in: Update mongo-c-driver to 2.5.5, fixing an out-of-bounds write during MongoDB connection monitoring reconnects (CVE-2026-96746). (Actuele AI).
fixBackported in: Fixed wrong results when a WHERE clause mixing AND and OR was evaluated with skip indexes (use_skip_indexes_for_disjunctions, enabled by default). If a minmax or set index could not evaluate one atom of the predicate for a granule, the per-atom verdicts recorded for that granule…
otherBackported in: Update thrift to v0.25.0. (Actuele AI).
otherBackported in: Integration-test harness: tolerate non-UTF-8 bytes when decoding captured container output, so a single bad byte no longer aborts cluster teardown and the sanitizer scan, and honor shutdown(ignore_sanitizer=True) in the docker.log fallback scan. (Groene AI).
fixBackported in: Fixed a crash on INSERT into a MergeTree table when a materialized view over it reads the same table from a correlated subquery, IN or a non-leftmost table of an IN subquery. (Groene AI).
26.8.24.9 Oct 11, 2026 Release notes ↗
fixBackported in: Fixed wrong results for a comma or CROSS join whose WHERE compares columns of two tables through a non-deterministic expression such as rand. Such a query could return rows that contradict its own WHERE clause, because rewriting the join into an INNER join moved the expression into…
fixBackported in: Fixed TRUNCATE TABLE of an Alias table whose target is a MergeTree failing with DEADLOCK_AVOIDED when the alias is being read concurrently, while the same statement against the target table succeeds immediately. The lock for TRUNCATE is now chosen and taken on the table that…
fixBackported in: Fixed wrong results, or an ILLEGAL_COLUMN error, of a JOIN whose condition equates both a column and an expression of that column (for example ON t1.k = t2.k AND intDiv(t1.k, 2) = intDiv(t2.k, 2)) when a filter on that expression is pushed down to the other side of the join: the…
fixBackported in: Fixed parallel replicas not being used when reading a Distributed table whose underlying table is another Distributed table and every shard of the outer cluster has a single replica. (Igor Nikonov).
fixBackported in: Fixed duplicated rows returned by ANY RIGHT JOIN with any_join_distinct_right_table_keys = 1 when parallel replicas are enabled. (Groene AI).
fixBackported in: Fixed slow planning of queries with skip indexes on tables with many parts and pending patch parts of lightweight updates. (Anton Popov).
fixBackported in: Fixed a crash (stack overflow) when reading an Avro file with an explicit structure that does not read a field nested through a long chain of named types, or a field of a recursive type holding deeply nested data such as a long linked list. Such a file now fails with…
otherBackported in: Do not use parallel replicas for clusterAllReplicas. (Igor Nikonov).
26.8.23.6 Oct 10, 2026 Release notes ↗
otherBackported in: Faster sorted-stream processing on a multi-column key whose leading column has long runs, in LIMIT BY, negative LIMIT BY, DISTINCT in order, window functions (peer groups and PARTITION BY boundaries), full_sorting_merge and partial_merge JOIN, and ReplacingMergeTree FINAL without…
fixBackported in: Comparing an Enum column with a string literal that is not one of its elements no longer throws UNKNOWN_ELEMENT_OF_ENUM when validate_enum_literals_in_operators is disabled (the default) and the column is part of the primary key, the partition key, or a bloom_filter index. != with…
fixBackported in: Fix corrupted shared data of nested JSON objects after a failed attempt to parse a value during insert. It could lead to errors like Unexpected version of JSON type binary encoding or Unknown type code when reading the data after merges or when serializing it in binary formats.…
fixBackported in: Fixed a query failing with an exception like Cannot parse UInt64 from String on a table with a text index on mapKeys or JSONAllPaths, when the predicate cannot be evaluated on the value of a missing map key or JSON path. (Anton Popov).
otherBackported in: Use castStorage for the Join row policy check in the legacy analyzer. (Vladimir Cherkasov).
26.8.22.13 Oct 9, 2026 Release notes ↗
otherBackported in: ArrayElement and arraySlice now read lazily replicated arrays (produced by ARRAY JOIN and JOIN when enable_lazy_columns_replication is enabled) directly, without materializing them. This greatly reduces memory usage and improves performance of queries that index or slice a large…
otherBackported in: bloom_filter and text indexes are now used when a Nullable indexed column is cast to the non-Nullable type, such as CAST(x, 'String') or json.path::String. A query that would throw on a NULL value may not throw when the index skips the granules with NULL. (Anton Popov).
fixBackported in: Fix reading bucketed runtime Map values from JSON columns using advanced shared-data serialization. (Rory Shanks).
fixBackported in: Fix a possible heap buffer overflow on malformed responses from blob storage. (Arsen Muk).
fixBackported in: Fix DeltaLake stats pruning with Date cast. (Arsen Muk).
fixBackported in: Fix EXPLAIN PLAN actions = 1 printing a secret function argument (for example the key of HMAC or encrypt) in cleartext when its value came from a subquery or from the other side of a JOIN. (Vladimir Cherkasov).
fixBackported in: Fix INSERT failing with ILLEGAL_FINAL or SAMPLING_NOT_SUPPORTED when a materialized view applies FINAL or SAMPLE to its own source table inside a subquery. Regression in. (Jimmy Aguilar Mena).
fixBackported in: Fix a rare server crash (SIGSEGV in mongoc_log) when a MongoDB dictionary source or MongoDB table was created while another thread created the first MongoDB connection in the process. Messages logged by the MongoDB driver now go to the server log. (Vladimir Cherkasov).
otherBackported in: CRoaring v5.2.3 exposes internal_validate() on the C++ RoaringBitmap wrappers, so RoaringBitmap data can be validated. (Elmi Ahmadov).
otherBackported in: Update cctz to 2026e. (Actuele AI).
featureBackported in: Add test coverage for arrayElement compute-on-nested branches and simplify its type dispatch. (Diego Gomes Tomé).
fixBackported in: Fixed a LOGICAL_ERROR in arraySlice on a QBit column replicated by ARRAY JOIN or a JOIN. (Groene AI).
26.8.21.10 Oct 8, 2026 Release notes ↗
otherBackported in: A WHERE that no row passes is pushed to every JOIN input again, including the non-preserved side of an OUTER JOIN and a side with no column used above the join, so that input is no longer read and hash-built for nothing. For example, a UNION ALL branch whose constant column fails…
otherBackported in: Hash joins with many matches per key are faster when they output a LowCardinality column whose blocks have different dictionaries (several parts, FINAL, or a LowCardinality value computed per block): short ranges from another dictionary are now inserted key by key instead of through…
featureBackported in: Added the setting query_plan_filter_push_down_below_limit_by (default 1), controlling whether filters on LIMIT BY key columns are pushed below the LIMIT BY step. Setting it to 0 restores the plan shape used before 26.7, for queries where the pushed predicate makes index analysis…
fixBackported in: Mask secrets in the queries that a cluster-mode QueryRunner table writes to system.query_log as well as in queries executed as startup scripts. (Miсhael Stetsyuk).
fixBackported in: Fixed a standalone UPDATE ... SET reading the wrong table when a mutation expression names a table that a same-named WITH element hides, but which the subquery does not see because its own SETTINGS clause disables enable_global_with_statement. Such a name is a table name, and it is…
fixBackported in: Tables in a database with lazy_load_tables were missing from system.parts, system.replicas and related system tables, and refused by replica commands, after a restart. (Nikolay Degterinsky).
fixBackported in: Fix a server abort when reading an Iceberg table whose sort order names a transform ClickHouse cannot parse (e.g. bucket[xyz]); ClickHouse now ignores that sort-order hint and keeps the table readable. (Ilias).
fixFix excessive memory usage of SELECT DISTINCT when its result is buffered by the next step, for example on the left side of a JOIN or in INSERT ... SELECT DISTINCT: each output block kept the memory of its whole input block, so memory grew with the input instead of with the number of distinct…
otherBackported in:. (Alexey Milovidov).
26.8.20.9 Oct 7, 2026 Release notes ↗
fixBackported in: ALTER TABLE ... MODIFY SETTING disk = disk(...) could register a disk defined in SQL whose local path is outside custom_local_disks_base_directory, and create its directory, bypassing the check that CREATE TABLE applies. Now it is rejected the same way, and a statement rejected this…
fixBackported in: Rewriting the body of a view with ALTER TABLE ... MODIFY QUERY now needs the same grants as creating it with its SQL security: SET DEFINER on the definer of a SQL SECURITY DEFINER view, or ALLOW SQL SECURITY NONE for a SQL SECURITY NONE view. An ON CLUSTER MODIFY QUERY fails with…
fixBackported in: Put "WRITE" operation in delta lake catalog. (Konstantin Vedernikov).
fixBackported in: Fix Found patch part ... that intersects mutation with version ... on lightweight updates in a table created with CREATE TABLE ... CLONE AS or ATTACH PARTITION ALL FROM a table with lightweight updates. (Nikolay Degterinsky).
fixBackported in: Fix UNKNOWN_IDENTIFIER in the analyzer when a table is referenced as database.table in FROM or JOIN and another table expression in the same query uses that database name as its alias, for example FROM db.t1 AS db INNER JOIN db.t2 AS t ON .... Closes. (Dmitry Novik).
fixFix iceberg_tolerate_conflicting_manifest_schemas being reverted to false by compatibility settings of 26.8 or 26.9 on 26.8 servers, which made Iceberg reads fail with ICEBERG_SPECIFICATION_VIOLATION on tables whose manifest schemas conflict with metadata.json. (Asya Shneerson).
fixBackported in: Fix container existence check during RESTORE of a lightweight snapshot from Azure Blob Storage by parsing the saved namespace into container name and prefix. (Garrett Thomas).
otherBackported in: Reduced the setup of the 04510_distributed_final_many_partitions test from 150 to 65 partitions. (Groene AI).
26.8.19.9 Oct 6, 2026 Release notes ↗
otherBackported in: Filesystem cache: make reserve granularity dynamic. (Kseniia Sumarokova).
fixBackported in: Fixed a text index dropping matching rows when a FixedString is involved in the comparison: a term-preserving tokenizer over a String column lost the rows whose value carries literal trailing zero bytes when the search constant is a FixedString, and an index over a FixedString…
fixBackported in: Fix basic statistics of parts written by 26.6 or 26.7: after ALTER TABLE ... UPDATE or a lightweight DELETE, non-Nullable columns reported a default-value count of 0, which made selectivity estimates wrong. Query results were not affected. To repair parts that are already affected,…
fixBackported in: Fix a possible hang of a query under workload CPU scheduling with cpu_slot_preemption enabled: when all its threads were preempted, the query could keep CPU slots it had already used and wait forever for one of them. (Sergei Trifonov).
fixBackported in: Fixed a LEFT/RIGHT/FULL JOIN without an equality key that failed with INVALID_JOIN_ON_EXPRESSION (Cannot determine join keys) when its WHERE clause also contained an IN (subquery). The WHERE filter now converts such a join to INNER again, as it did in 26.6, which also restores that…
fixBackported in: Fixed a segmentation fault or std::length_error when reading TSV formats with input_format_tsv_crlf_end_of_line = 1 if an escape sequence ended exactly at the end of a read buffer. (Groene AI).
fixBackported in: Respect iceberg_metadata_staleness_ms in metadata parsing. (Konstantin Vedernikov).
otherRevert backport of to 26.8: Check for timeouts and KILL QUERY while covering a polygon with H3 cells. (Nikita Fomichev).
26.8.18.2 Oct 5, 2026 Release notes ↗
otherBackported in: Warn when CLEAR COLUMN leaves an EPHEMERAL-derived MATERIALIZED column stale, and cover it with a test. (Shaohua Wang).
26.8.17.4 Oct 4, 2026 Release notes ↗
otherBackported in: Skip indexes (bloom_filter, tokenbf_v1, ngrambf_v1, minmax) and the primary key are now used when the indexed column is wrapped into a conversion that does not change its value, such as toLowCardinality, toNullable or a CAST to Nullable or LowCardinality. (Anton Popov).
fixBackported in: Fix an out-of-bounds read when deserializing a uniqTheta state shorter than 24 bytes, for instance from CAST( AS AggregateFunction(uniqTheta, ...)). (Alexey Milovidov).
fixBackported in: Fix a buffer over-read on the sequential read path from Azure Blob Storage: an endpoint that answers a ranged request with more data than was requested could deliver bytes from outside the requested range to the caller. The end of a read is now decided by the locally set right…
26.8.16.41 Oct 3, 2026 Release notes ↗
otherBackported in: Faster planning of queries to Iceberg tables with many manifest files: when a manifest file header has the schema-id key and that schema is already known from metadata.json, the schema copy stored in the manifest header is no longer parsed and compared with it. ClickHouse now also…
otherBackported in: Build Iceberg min/max hyperrectangles only for columns the filter uses. (Konstantin Vedernikov).
otherBackported in: Hide the HTTP headers in the definition of HTTP dictionary sources in SHOW CREATE DICTIONARY, system.tables and query logs, the same way as passwords. They can be shown with the existing display_secrets_in_show_and_select mechanism. (Matheus Nerone).
otherBackported in: Parse some (geo) parquet metadata lazily. (Konstantin Vedernikov).
fixBackported in: Preserve execution limits and resource lifetimes when deriving QueryPlan instances for internal query execution. (Groene AI).
fixBackported in: Fixed SYSTEM SYNC TRANSACTION LOG (local, non-ON CLUSTER form) not checking the SYSTEM_SYNC_TRANSACTION_LOG privilege. The ON CLUSTER form already required it via getRequiredAccessForDDLOnCluster, but the local execution path skipped checkAccess, so a user without the grant could…
fixBackported in: Fix a text or ngrambf_v1 index silently dropping matching rows when the indexed column is compared for equality against a FixedString value, or searched with hasAny or hasAll over FixedString needles. Happens at default settings, since use_skip_indexes and enable_full_text_index are…
fixBackported in: Fixed an ssl_certificate authentication bypass where an embedded NUL byte in a certificate's Common Name (for example john\0.evil.com) was truncated server-side to john, letting a holder of such a certificate authenticate as a different user. (Konstantin Bogdanov).
fixBackported in: Fixed max_memory_usage and max_server_memory_usage not being respected when reading a JSON column with the FLATTENED serialization version from the Native format. (Pavel Kruglov).
fixBackported in: Fixed out-of-bounds reads when reading a JSON or Dynamic column from a malformed Native block or a corrupted data part. A truncated stream, a duplicate type in a flattened Dynamic column, a duplicate or typed-colliding path in a JSON column, and a serialization version that is only…
fixBackported in: Prevent asynchronous inserts that only need to buffer data from being blocked by another insert waiting for a flush worker while holding their shared queue lock. Ensure a global forced flush waits for batches removed from the queue that are still waiting for a worker. (RJ).
fixBackported in: Kafka producer and consumer trace logs now show the value of secret librdkafka properties, such as sasl.password, as [HIDDEN] instead of the cleartext value. (János Benjamin Antal).
fixBackported in: Skip indexes (text, tokenbf_v1, ngrambf_v1) are now used when the indexed column or the searched constant is wrapped into LowCardinality, Nullable or an equivalent CAST. For example, m['key'] = 'value' on a Map(String, LowCardinality(String)) column and hasToken(s,…
fixBackported in: EXPLAIN AST printed secret function arguments, such as the key of encrypt, in clear text, and with optimize = 1 it did so for the body of a view the user may only SELECT from. The dump now prints '[HIDDEN]' in their place, under the same gate as SHOW CREATE. (Harikrishnan Prabakaran).
fixBackported in: Column-level SELECT privileges are now enforced for columns used only inside indexHint and for ALIAS columns referenced in PREWHERE. As in WHERE, referencing an ALIAS column in PREWHERE requires the grant on the alias name; a grant on its source columns is no longer sufficient. A…
fixBackported in: Fix a server crash (SIGSEGV) when a CREATE TABLE ... PROJECTION / ALTER TABLE ... ADD PROJECTION statement is restored from a clickhouse_json AST whose projection query subtree contains a function node without an arguments list. The malformed payload is now rejected with…
fixBackported in: Fixed a row policy bypass: a direct JOIN with an EmbeddedRocksDB, KeeperMap or Redis table in the legacy analyzer (enable_analyzer = 0) ignored the row policy of the right table and returned hidden rows, and joinGet on a Join table ignored its row policy in both analyzers. Such a…
fixBackported in: Fix NO_COMMON_TYPE in case of use_variant_as_common_type=0 for jemalloc fragmentation dashboard. (Azat Khuzhin).
fixBackported in: Fix the Kafka and NATS table engines ignoring remote_url_allow_hosts: broker addresses from kafka_broker_list, nats_url, and nats_server_list are now checked against the remote host filter. A forbidden address is rejected at CREATE TABLE with UNACCEPTABLE_URL, as the RabbitMQ engine…
fixBackported in: Now statistics parts pruning will not work if table has row level policy. (alesapin).
fixBackported in: Now clickhouse masks credentials in system.query_log even for wrong URLs for external table engines. (alesapin).
fixBackported in: Fix filesystem cache accounting when the directory for a new cache key cannot be created, for example because the cache disk is out of space or inodes. The failed reservation stayed counted in the cache until the query released the file segment. (Sema Checherinda).
fixBackported in: CREATE OR REPLACE in a Replicated database or with ON CLUSTER now requires the drop privilege for the kind of the table it replaces, so a user without DROP DICTIONARY can no longer replace a dictionary. (Nikolay Degterinsky).
fixBackported in: Fix LOGICAL_ERROR Cannot capture column N because it has incompatible type when a materialized view with a lambda over an Array(Tuple(...)) column receives a block while the source table's column type is being changed by ALTER TABLE ... MODIFY COLUMN. (Jimmy Aguilar Mena).
fixBackported in: The value of 'role_session_name' as of now is hidden in query_log. (Alexey Bakharew).
fixBackported in: Fix a server crash caused by unbounded recursion when decoding a deeply nested value inside a binary encoded type, for example an AggregateFunction parameter in a Dynamic value read from RowBinary or Native. (Pavel Kruglov).
fixBackported in: Fix Keeper silently giving a new session to a ZooKeeper client (for example the Java client or kazoo) that reconnects and asks to continue its session. Such a client now gets SessionExpired, ZooKeeper's answer for a session that cannot be continued, instead of losing its ephemeral…
fixBackported in: Fix validation of Iceberg manifest-list entries during writes. (Arsen Muk).
fixBackported in: Fixes a server crash on CREATE TABLE or ALTER TABLE ... MODIFY TTL with a TTL expression that uses the result of arrayMap with a constant lambda, such as toString(arrayMap(x -> CAST(1, 'Dynamic'), arr)). (Groene AI).
fixBackported in: Fixed secret settings of S3Queue and AzureQueue tables written with the legacy s3queue_ prefix, such as s3queue_after_processing_move_secret_access_key, being shown in cleartext in SHOW CREATE TABLE, system.tables, system.query_log and the server log. They are now hidden as they are…
fixBackported in: Add more path validations. (Konstantin Vedernikov).
fixBackported in: S3 client check initial url in backup client. (Konstantin Vedernikov).
fixBackported in: Fix missing rows in hasAllTokens and hasAnyTokens searches over a text index when an earlier query with the same predicate read a narrower key range of the same part and use_text_index_postings_cache was enabled. (Anton Popov).
fixBackported in: Fix a crash when reading an ORC file whose root type is not a struct (for example, a file written with a bigint or array root type). Such files are now rejected with an INCORRECT_DATA error. Closes. (Groene AI).
fixBackported in: Fixed a crash and wrong results with convert_query_to_cnf = 1 when WHERE or HAVING references the same SELECT alias more than once. (Groene AI).
fixFix a possible crash when querying the view over Distributed with enable_analyzer=0. (Mikhail Koviazin).
fixFix a bug where using aliases and row policies with enable_analyzer=0 could error out. (Mikhail Koviazin).
breakingBackported in: Remove --icf=safe linker warnings about SHT_LLVM_ADDRSIG in the stripped Rust libraries. (Raúl Marín).
otherBackported in: Hide a Backup locator named like a COLUMNS matcher in EXPLAIN AST instead of throwing. (Groene AI).
otherBackported in: Do not dereference a null logs_queue in OwnSplitChannel::log. (Groene AI).
26.8.15.10 Sep 29, 2026 Release notes ↗
breakingBackported in: Update the zxc library to v0.14.0, which changes the compressed block format of the experimental ZXC codec. Data written with CODEC(ZXC) by earlier versions cannot be read by the new version and fails with CANNOT_DECOMPRESS. If you used the experimental ZXC codec, re-encode the…
otherBackported in: Chained ARRAY JOINs no longer materialize the whole block of a lazily replicated array column before expanding it, which cuts their peak memory by several times. (Yarik Briukhovetskyi).
fixBackported in: The command line client no longer shows the as-you-type hints on a query recalled from the history (or otherwise displayed at once, e.g. pasted), so pressing Up/Down continues to navigate the history instead of the hint list. The hints appear again as soon as the line is edited.…
featureBackported in: Added the http_x_clickhouse_format_overrides_output_format setting (default true). When disabled, the X-ClickHouse-Format HTTP header only sets default_format, as it did before version 26.8, instead of overriding the FORMAT clause of the query via output_format. (Alexey Milovidov).
fixBackported in: Fix LOGICAL_ERROR when filtering an Iceberg column that ALTER TABLE ... MODIFY COLUMN made Nullable. Closes. (Groene AI).
fixBackported in: Fixed dpsub join-order optimization (query_plan_optimize_join_order_algorithm = 'dpsub') silently dropping single-table filter conditions from a JOIN ... ON clause, which could return extra rows. (Fisnik Kastrati).
fixBackported in: Fixed wrong results from JIT-compiled conversions of a floating point value to an integer or Decimal type when the value does not fit the destination: a comparison against the converted value could be evaluated against the pre-conversion value, so the same query could flip between…
fixBackported in: Fixed a crash in plus and minus of an array of dates and an array of tuples holding NULL, for example toString([toDateTime64(1, 3)] + [(2, NULL)]), and the exception ColumnTuple cannot have ColumnConst as its element when adding a constant interval to a non-constant interval of…
fixBackported in: Link with --icf=safe instead of --icf=all, so the linker keeps functions whose address is taken distinct. gRPC queries with transport compression (gzip, deflate) no longer crash the server, as they could in official builds since 26.4. Closes. (Groene AI).
26.8.14.3 Sep 28, 2026 Release notes ↗
otherBackported in: TLS CA certificates configured with openSSL.server.caConfig / openSSL.client.caConfig (and caConfig of composable protocols) are now reloaded without a restart when the file changes or on SYSTEM RELOAD CONFIG, in the same way as certificateFile and privateKeyFile. This makes it…
fixBackported in: Fix a segmentation fault in Keeper when preallocating space for a changelog file fails because the disk is full. (Alexey Milovidov).
26.8.13.2 Sep 27, 2026 Release notes ↗
otherBackported in: A single-level GROUP BY result smaller than max_block_size is now split into several blocks when it was aggregated by several threads, so the steps after it, such as the probe of a following join, run in parallel instead of on one thread. Previously such queries could be several…
26.8.12.53 Sep 26, 2026 Release notes ↗
breakingBackported in: A MySQL dictionary source created with a CREATE DICTIONARY query can no longer enable enable_local_infile, at the source or at one of its REPLICA entries; loading such a dictionary fails with BAD_ARGUMENTS, which with the default dictionaries_lazy_load is on first use rather than at…
featureBackported in: You can now disable reading through the executable table function and from Executable/ExecutablePool tables with the new allow_executable_tables setting, for a deployment that must not run arbitrary server-side scripts. It defaults to true, so existing behavior is unchanged. (Hanzi…
featureBackported in: Iceberg tables whose manifest file headers carry a schema that conflicts with the schema registered for the same schema-id in metadata.json are now readable: the metadata.json schema is preferred and the divergent manifest header copy is ignored with a warning, no matter which of…
featureBackported in: Add column size statistics in Avro files. (Konstantin Vedernikov).
featureBackported in: Added the setting analyzer_compatibility_allow_cte_redefinition. When enabled, a CTE name may be defined more than once in a single WITH clause; a later definition shadows the earlier one as the query analysis before 24.3 did (a redefinition can read the previous definition, the…
fixBackported in: Fixed dropping whole parts with TTL (ttl_only_drop_parts = 1) still reading all data from large, fully-expired parts. (Michael Jarrett).
fixBackported in: Fixes a server crash (double free) when finalizing an aggregate function with the -State combinator nested under a combinator that transfers several sub-states in one call (-Resample, -ForEach, -Map, -Tuple), for example groupArrayStateResample, if an exception such as a memory…
fixBackported in: Fixed Iceberg INSERT writing no lower_bounds/upper_bounds at all into the manifest entry when the table has a column whose type cannot be serialized into a statistics bound (for example Array(Int32)), or a column that is entirely NULL. Such a field is now omitted individually and…
fixBackported in: Fixes a case where date_time_overflow_behavior was ignored on parsing Date and DateTime. Closes. (Yarik Briukhovetskyi).
fixBackported in: Functions h3PolygonToCells and h3PolygonToCellsWithContainment now check for query timeouts and KILL QUERY while covering a polygon, and reject vertices whose longitude is outside -180..180 or latitude outside -90..90 degrees. Previously a polygon with such a vertex could keep a…
fixBackported in: Fixed a logical error (... to have 0 rows, but it has 1: while executing function materialize) when a dictionary with LAYOUT(DIRECT()) was read through the merge table function. Closes. (Groene AI).
fixBackported in: Fixed asynchronous TLS connections occasionally failing with an unrelated OpenSSL error left by another connection on the same OS thread. This could terminate distributed queries with a misleading network exception. (Dmitriy Borisenko).
fixBackported in: Fixed SQL injection through identifiers when inserting into a table with the SQLite engine. The remote table name and the column names were escaped with backslashes, which SQLite does not honour inside a quoted identifier, so a name containing a double quote could close its own…
fixBackported in: Fixed a Backup database engine printing the credentials of its destination in plaintext. SHOW CREATE DATABASE, system.databases.engine_full, system.query_log and the messages that reject a malformed locator showed an AzureBlobStorage account_key, a connection string or a presigned…
fixBackported in: KILL TRANSACTION ... ON CLUSTER, KILL PART_MOVE_TO_SHARD ... ON CLUSTER, SYSTEM STOP THREAD FUZZER ON CLUSTER, SYSTEM START THREAD FUZZER ON CLUSTER and SYSTEM RESET COVERAGE ON CLUSTER ran without checking any privilege, so a user holding only CLUSTER could roll back other users'…
fixBackported in: Fixed a SELECT from a table with paimon_incremental_read = 1 failing with REPLICA_IS_ALREADY_ACTIVE ("Failed to activate Paimon replica after Keeper reconnection") on the first read after the server's Keeper session was lost and re-established. Reclaiming the replica's own stale…
fixBackported in: ALTER DATABASE ... MODIFY COMMENT on a database with ENGINE = Backup no longer writes a definition the server cannot read back, which made it refuse to start; metadata already written in that form now loads too. Backward incompatibility: a backup taken by an older server of a…
fixBackported in: Fix a patch part whose source_parts.dat lost its content to a zeroed block loading as an empty index, which silently unapplied an acknowledged lightweight UPDATE and then let background cleanup delete the only copy of it. Such a part is now detached as broken. (Alexey Milovidov).
fixBackported in: Fixed http_max_multipart_form_data_size silently truncating oversized multipart data instead of failing the query, and made it span a form's external-table parts instead of resetting per part. (Sema Checherinda).
fixBackported in: Fix wrong results when a GROUP BY, DISTINCT, LIMIT BY or window PARTITION BY key was plus or minus of a partition column with a non-integer constant, for example f + 1.0 on Float64 or d + INTERVAL 1 MONTH on Date. Such a key was assumed injective, so each table partition was…
fixBackported in: Fixed two ways a table with the Redis engine mishandled an MGET reply. Reading the whole table stopped at the first key without a string value and silently dropped every key scanned after it, so one key of another Redis type was enough to truncate the result. A reply carrying a…
fixBackported in: Bound the header column count in RowBinary formats to avoid excessive memory allocation from a crafted header. (George Larionov).
fixBackported in: Fixed settings constraints from a settings profile not being enforced against the other setting assignments in the same statement. SET profile = 'p', = could override a CONST, MIN/MAX or readonly constraint that profile p installs. The same escape existed through an in-query…
fixBackported in: Fix INSERT INTO SELECT ... FROM url(...) (and s3, azureBlobStorage, ... ) with parallel replicas enabled inserting the data once per replica: the query forwarded to the replicas now names the *Cluster table function, so every replica reads only its share of the files. Closes.…
fixBackported in: Fix a server crash (std::terminate with write failed) in the embedded SSH client when the client's terminal was closed before the line reader was destroyed. (Alexey Milovidov).
fixBackported in: Fixes a segmentation fault that happens when a refreshable materialized view is started up and shut down at the same time, for example when a failed ATTACH DATABASE rolls the database back, or when the server shuts down while tables are still loading asynchronously. (Groene AI).
fixBackported in: Fixed a performance regression where a query whose WHERE requires the same expression to equal two different constants stopped being recognized as always false when compatibility was set below 26.7, or when optimize_redundant_comparisons was disabled explicitly. Such a query…
fixBackported in: TRUNCATE ALL TABLES FROM and TRUNCATE TABLES FROM ... LIKE ... now skip Alias tables, which hold no data of their own. Previously such a statement could fail with LOGICAL_ERROR: RWLock is already locked in exclusive mode, truncate a target in another database, or fail when the alias…
fixBackported in: The text, tokenbf_v1, ngrambf_v1 and sparse_grams skip indexes are now used for IN when transform_null_in = 1 and the set contains no NULL. Previously such a query read every granule, and one using force_data_skipping_indices failed with INDEX_NOT_USED. (Jimmy Aguilar Mena).
fixBackported in: Fixed an out-of-bounds heap write in stem. The output buffer was sized from the input, but some stemmers lengthen a word (Turkish uag → uagı, Estonian keeb → keesi), so a block overran its allocation and returned uninitialized heap as result values. The buffer now grows when the…
fixBackported in: remote(, 'db', 'table', 'user', 'password'), and the same form of remoteSecure and of the Remote and RemoteSecure table engines, wrote the password into system.query_log, system.text_log and the server log in cleartext, while the remote('addresses_expr', ...) form hid it. The…
fixBackported in: Fix wrong values and a LOGICAL_ERROR when reading a partitioned Delta Lake table with allow_delta_kernel_rs = 0 and column types that differ from the ones in _delta_log. (Raúl Marín).
fixFix ACCESS_DENIED on remote nodes of Distributed and parallel-replicas queries over an interserver-secret cluster for users whose grants come from roles, when the remote node recalculates access rights in a copied query context (for example, when reading a view with SETTINGS). The regression…
fixBackported in: Fixed a crash when deserializing an AST from JSON (formatQueryFromJSON, the clickhouse_json dialect): a deeply nested document exhausted the stack and killed the process with no log line. Such payloads now fail with TOO_DEEP_RECURSION. (Groene AI).
fixBackported in: Fixed a crash (stack exhaustion) in parseQueryToJSON when serializing a query nested deeper than the serializer could follow, reachable by raising max_parser_depth above its default. Such a query now fails with TOO_DEEP_RECURSION instead of terminating the server. (Groene AI).
fixBackported in: Fixed a server crash when the flameGraph aggregate function was constructed on a thread without a query context, for example while attaching a stored table whose column type names AggregateFunction(flameGraph, ...). (Groene AI).
fixFixes a problem that MySQL/Postgres queries may run in an expired session. (Robert Schulze).
fixBackported in: Fix spurious NATS connection failures when the vendored nats-io client gets EINTR while waiting for a socket, and include the upstream JetStream pull-subscription deadlock fix in the vendored client. (Alexey Milovidov).
fixBackported in: Fix logical error !raw_type->isNullable() in AND-compare chain optimization. (Groene AI).
fixBackported in: Fix flaky 01780_column_sparse: order the arrayFilter result before limiting it. (Alexey Milovidov).
+12 more items in the release notes
26.8.11.7 Sep 22, 2026 Release notes ↗
fixBackported in: Fixed an out-of-bounds read when finalizing a crafted analysisOfVariance aggregate state whose internal arrays have mismatched lengths. (uwezkhan).
fixBackported in: Fixed ATTACH TABLE ... AS REPLICATED and the convert_to_replicated flag file accepting a conversion whose ZooKeeper path is not a safe path. On a server whose default_replica_path substitutes {database} or {table}, a name containing / used to resolve to a path inside another table's…
fixBackported in: Fix a crash when a client sends a block over the Native TCP protocol that selects the internal Detached serialization kind for a column. (Pavel Kruglov).
fixBackported in: Fix count() returning the number of default values instead of the number of NULLs when optimize_trivial_count_with_sparsity_filter is used on a column widened to Nullable by a metadata-only ALTER TABLE ... MODIFY COLUMN. (Raúl Marín).
fixBackported in: Fixed repeated reading of text index posting lists in multi-threaded queries when the global text index caches are disabled. (Anton Popov).
otherBackported in: Update mongo-c-driver to 2.5.4 and mongo-cxx-driver to r4.6.0. (Actuele AI).
26.8.10.6 Sep 21, 2026 Release notes ↗
breakingBackported in: Outbound TLS connections now verify that the server certificate names the host that was connected to. This affects clickhouse-client --secure, remoteSecure(), Distributed over the secure native protocol, secure Keeper connections, and HTTPS clients such as s3(), url(), HTTP…
fixBackported in: Fix a MergeTree table with a rows TTL and a text index never dropping its expired parts: the TTLDrop merge failed with Text index transform for index ... not found and retried forever. (Groene AI).
fixBackported in: Fix wrong aggregate values with optimize_aggregation_in_order_limit when the ORDER BY is a strict prefix of the GROUP BY key and a group's rows span multiple parts. In-order aggregation streams now stop early only at a boundary of the ORDER BY prefix. Closes. (Konstantin Bogdanov).
fixBackported in: Fix a regression in 26.8 where columns of a parameterized view could not be qualified by the view name (SELECT pv.col FROM pv(p = 1) failed with UNKNOWN_IDENTIFIER) and a parameterized view used as a JOIN operand required an explicit alias. Closes. (Dmitry Novik).
fixBackported in: Fix TYPE_MISMATCH ("CAST AS Array can only be performed between same-dimensional array types") when casting an Array(Map(...)) to an array whose element type contains the Map inside a Variant, or to Array(Dynamic), Array(JSON) or Array(String). (Alexey Milovidov).
26.8.9.10 Sep 20, 2026 Release notes ↗
otherBackported in: Decode Iceberg data manifest files concurrently while the list of data files for a query is produced. The setting iceberg_manifest_decode_concurrency (default 4) bounds how many manifests — delete and data alike — are decoded at a time; it replaces…
fixBackported in: Fixes a performance regression where filter push-down over ANY INNER JOIN was disabled, which prevented primary key pruning and made such queries read far more data than necessary. Note that SELECT ... ANY INNER JOIN ... WHERE may therefore return a different result than applying…
fixBackported in: Fix O(n^2) decompression of gzip/zlib/deflate streams whose single DEFLATE block spans the whole stream, the shape zlib-ng produces at compression level 1 (the default of the official .NET SDK): a 24 MiB gzip HTTP body that took 11 s to ingest in 26.7 now takes 0.12 s, identical to…
fixBackported in: Messages of the PostgreSQL wire protocol are now parsed within their declared size, so a malformed message can no longer make the server allocate memory for a payload that never arrives. (Alexey Milovidov).
fixBackported in: Fix a server abort when an Azure Blob Storage endpoint reports an asynchronous blob copy as completed without the optional x-ms-copy-source or x-ms-copy-status-description header. (Alexey Milovidov).
fixBackported in: Fixed parsing of a column named from inside parentheses, such as WHERE (from IN ('a')), which since 26.8 was read as a subquery starting with the FROM clause and failed with Unknown table function IN, Unknown table expression identifier or a syntax error. (Alexey Milovidov).
fixBackported in: Fixed 01076_parallel_alter_replicated_zookeeper silently testing nothing when its ALTER thread and its DETACH thread picked the same replica. (Groene AI).
otherBackported in: Pin 05182_limit_shrinks_block_size_with_array_join's two per-node oracles to a single local reader, and pin the remote prefetched-pool eligibility its plan-shape oracle needs on object-storage runs. (Groene AI).
otherBackported in: Shrink the t_aj_limit fixture in 05182_limit_shrinks_block_size_with_array_join from 200000 to 20000 rows. (Groene AI).
26.8.8.8 Sep 19, 2026 Release notes ↗
fixBackported in: A small LIMIT on a query with arrayJoin shrinks the read block size again, so such queries no longer read whole blocks on every thread for a few output rows (a regression from 26.6, Closes). (Yarik Briukhovetskyi).
fixBackported in: Do not terminate the server when a transient error (such as MEMORY_LIMIT_EXCEEDED, a network error, or SYSTEM RESTART REPLICA running at the same time) happens while outdated data parts are being loaded in the background. Such errors are not a sign of an inconsistent set of parts on…
fixBackported in: Fixed a query with a hasToken-family predicate on a text index silently returning no rows when the query also read a column modified by a pending lightweight update. (Shaohua Wang).
fixBackported in: Fixed a HDFS database serving a table from its internal cache without the READ ON HDFS grant. The grant and the remote_url_allow_hosts filter were checked only while a table name was resolved for the first time, so once any user holding the grant had read a name, every user with…
fixBackported in: Fixed filesystem containment checks accepting a path with an embedded NUL byte. A DeltaLakeLocal or IcebergLocal table could be pointed outside of user_files this way. (Alexey Milovidov).
fixBackported in: Fixed ClickHouse Keeper terminating when a client sent a multi request with no subrequests. Such a request was written to the changelog before it failed, so the termination repeated on every restart. (Alexey Milovidov).
otherBackported in: Use cctz tzdata 2026c. (Konstantin Bogdanov).
26.8.7.19 Sep 18, 2026 Release notes ↗
breakingBackported in: New setting validate_group_by_all_key_types (default true) gates the key type validation that GROUP BY ALL applies to the grouping keys it expands the SELECT expressions into. Since 26.7 it rejects a Variant or Dynamic grouping key, for example an untyped JSON subpath, that earlier…
otherBackported in: LEFT and FULL JOIN with join_use_nulls = 1 use less memory when the right join key is selected in the query: the key is no longer stored twice on the build side. (Vladimir Cherkasov).
otherBackported in: Tightened the access check of the mergeTreeCodecBlockCounts table function: resolving its structure, for example by DESCRIBE, did not require the SELECT privilege on the source table, while reading it did, and a user without any privilege on the source table could tell an existing…
featureBackported in: Added a flat_namespaces setting for the DataLakeCatalog database engine. Set it for Iceberg REST catalogs that have only single-level namespaces and reject the parent query parameter of the list-namespaces endpoint, such as Apache Polaris federated to AWS Glue: only top-level…
featureBackported in: Allow to change fs cache boundary alignment per query via filesystem_cache_boundary_alignment - pre-existing setting which was previously used only for non-disk read. The difference now is that for disk read value 0 means use default cache configuration setting boundary_alignment…
featureBackported in: Added output_format_arrow_record_batch_size and output_format_arrow_record_batch_size_bytes, which make the Arrow and ArrowStream output formats combine consecutive blocks that are individually smaller than the target into a single record batch. A selective SELECT produced one small…
fixBackported in: Fix reading a column that has two streams whose names differ only by escaping, for example a Tuple element named size0 inside an Array, or a JSON typed path named like a substream of a sibling path. Such columns returned wrong values, failed with CANNOT_READ_ALL_DATA or a logical…
fixBackported in: Fix LOGICAL_ERROR: GroupingAggregatedTransform pushed bucket N twice when make_distributed_plan picks the Shuffle aggregation strategy while the aggregation must produce results in bucket order (for example with distributed_aggregation_memory_efficient). It is now planned as a…
fixBackported in: Make mergeTreeTextIndex stricter with row policies: reading the text index is now denied whenever a row policy applies to the table, regardless of which columns the policy uses. (Elmi Ahmadov).
fixBackported in: Fix UNKNOWN_IDENTIFIER errors in INSERT ... SELECT from a parameterized view when parallel_distributed_insert_select is enabled. the view was analyzed with the legacy interpreter even though the analyzer was enabled. (Yarik Briukhovetskyi).
fixBackported in: Fixed PARALLEL WITH, EXECUTE AS and the QueryRunner table engine skipping the access checks of the CREATE statements they execute, which allowed creating tables and databases without the corresponding privileges, and defeated the readonly and allow_ddl settings. (Alexey Milovidov).
fixBackported in: Iceberg tables recovered from stored metadata no longer enable background compaction or old-file cleanup unless those settings are explicitly stored in the table definition. (János Benjamin Antal).
fixBackported in: Fixed a NATS table whose settings all come from a named collection (ENGINE = NATS(collection) with no SETTINGS clause) being written to its metadata file with a dangling SETTINGS keyword. The stored definition could not be parsed again, so the table failed to load and aborted the…
fixBackported in: Fixed a URL database engine printing the password of its base URL in cleartext in SHOW CREATE DATABASE, system.databases.engine_full and the query log, regardless of format_display_secrets_in_show_and_select. The userinfo password is now replaced by [HIDDEN], as it already was for…
fixBackported in: Fixed an out-of-bounds read when reading a Variant column from a truncated Native stream using compact discriminators serialization. (Raufs Dunamalijevs).
fixBackported in: Now ClickHouse reject relative paths in checksums.txt. (alesapin).
fixBackported in: Fix S3 client refresh overwriting static authentication settings and breaking subsequent queries. (alesapin).
otherBackported in: Not required (CI only). (Groene AI).
26.8.6.5 Sep 16, 2026 Release notes ↗
fixBackported in: Fix a slowdown of query analysis for large parameterized views: the substituted view query was re-hashed on every comparison of the query tree. Closes. (Alexey Milovidov).
fixBackported in: Fixed the logical error Can't determine table for parallel replicas for a RIGHT JOIN whose right side has no table eligible for parallel replicas, and made a RIGHT JOIN materialize a left side that is not a MergeTree instead of letting every replica read it independently. (Groene AI).
fixBackported in: Fix a LOGICAL_ERROR: Next task callback is not set for query with id exception when parallel_replicas_plan_based is enabled and the query reads a system log table. (Groene AI).
otherBackported in: Split the ASan integration test jobs into eight batches. (Alexey Milovidov).
26.8.5.13 Sep 15, 2026 Release notes ↗
otherBackported in: Bump the internal libssh from 0.12.0 to 0.12.2. (Robert Schulze).
fixBackported in: Fix a logical error Invalid cast from Nothing to native type (an abort in debug/sanitizer builds) when compile_expressions = 1 compiled an expression with a Nullable(Nothing) operand, e.g. and(Nullable(Nothing), ). (Groene AI).
fixBackported in: Fixes a case where date_time_overflow_behavior = 'saturate', an out-of-range value is clamped to the whole second and the sub-second component is discarded. Closes. (Yarik Briukhovetskyi).
fixBackported in: Fix a segmentation fault when reading in order from a Merge table over MergeTree tables whose sorting key is shorter than the key prefix chosen for the query: the prefix was forwarded to the underlying reader unchecked, which grew its cloned sorting-key expression list to that…
fixBackported in: Each code for Time-based one-time password is now accepted at most once, as required by RFC 6238: reusing an already used code, or a code for an earlier time step, is rejected. A user with time_based_one_time_password can successfully authenticate at most once per period. (Vladimir…
fixBackported in: Fixed the byte width of the Iceberg manifest lower_bounds and upper_bounds written for int and date columns: they were 8 bytes wide where the Iceberg specification requires 4. Spec-conformant readers such as pyiceberg failed with unpack requires a buffer of 4 bytes while planning…
fixBackported in: Fix rows silently dropped by an ngrambf_v1 index for a LIKE pattern with a run of escaped backslashes before a wildcard. (Alexey Milovidov).
fixBackported in: Fix TYPE_MISMATCH in selectivity estimator. (Han Fei).
fixBackported in: Fixed an ALTER on a view or materialized view with SQL SECURITY DEFINER deleting the auto-created :definer account when the ALTER did not change the definer. Every later SELECT from the view, and every INSERT into a materialized view's source table, then failed permanently with…
fixBackported in: Fixed cleartext credentials in system.asynchronous_insert_log.query. Secrets of table functions such as s3, url or mysql are now masked as [HIDDEN], the same way system.query_log masks them. (Sema Checherinda).
fixBackported in: Fixed the server not validating the schema of the second and subsequent data blocks that a client sends for an external table over the native protocol. Such a block could make the data be interpreted as a type other than the one it was sent as. (Alexey Milovidov).
fixBackported in: Fixed a crash of the server caused by a table with ENGINE = NATS whose credentials the broker started to reject, for example after a password rotation or on an expired token. Such a table now recreates its connection and resumes consuming once the credentials are accepted again,…
26.8.4.11 Sep 14, 2026 Release notes ↗
otherBackported in: Write partition field summaries into the Iceberg manifest list. (Konstantin Vedernikov).
fixBackported in: Fixed a crash when reading a subcolumn of a Variant, Dynamic or JSON column whose own type is Nullable or LowCardinality(Nullable) from a MergeTree table, for example SELECT value.Tuple(a Nullable(UInt32), b String).a over a Dynamic column. Previously such a read hit a LOGICAL_ERROR…
fixBackported in: format_display_secrets_in_show_and_select works as expected in EXPLAIN. (Kirill Kopnev).
fixBackported in: Fixed optimize_or_like_chain returning extra rows for OR chains of LIKE/ILIKE patterns that do not end in %: a value followed by a trailing newline wrongly matched the filter. (Jimmy Aguilar Mena).
fixBackported in: Don't use backoffs on concurrent inserts conflicts (when we use Iceberg + catalog, for example). (Konstantin Vedernikov).
fixBackported in: Fixed a crash and a LOGICAL_ERROR for statements that write trim(BOTH '' FROM x) (or the LEADING/TRAILING spelling) where a function is expected: a column's STATISTICS(...) or CODEC(...) list, INDEX ... TYPE, ALTER TABLE ... ADD STATISTICS, auto_statistics_types, a table function, a…
fixBackported in: Fix graceful shutdown of clickhouse-keeper hanging for up to 300 seconds when a client connection on keeper_server.tcp_port_secure is stalled in a TLS read. (Groene AI).
fixBackported in: Fix a crash when reading a table with active lightweight updates whose sorting key contains a column that is missing in the data part and has a DEFAULT expression. (Groene AI).
fixBackported in: Fixed Keeper replaying its local changelog tail one entry at a time after a restart when the changelog is stored on object storage. The commit read-ahead used to discard its own prefetched entries whenever it missed the serve deadline, so on storage slower than that deadline it…
otherBackported in: Do not leave a Filesystem database pointing at a removed directory, which makes the server refuse to start. (Alexey Milovidov).
26.8.3.105 Sep 13, 2026 Release notes ↗
breakingBackported in: Reading a File source with rename_files_after_processing set now requires the WRITE ON FILE grant on top of READ ON FILE, on the initiator for fileCluster: the setting renames the files a SELECT has read, which is a write to the source, and it used to happen for anyone who could…
featureBackported in: Jemalloc Fragmentation Profiler. (Azat Khuzhin).
fixBackported in: Fix performance regression introduced in 26.4 when writing JSON and Dynamic columns in text formats. (Pavel Kruglov).
featureBackported in: Added the asynchronous_metrics_key_values_mode server setting to control in which form the key-value asynchronous metrics (those broken down per CPU core, block device, network interface, disk, ...) are published to system.asynchronous_metrics, system.asynchronous_metric_log, the…
fixBackported in: Fixes silent data loss for TTL expressions that apply large intervals directly to Date / DateTime source columns by widening the arithmetic away from 16/32-bit overflow. (BoloniniD).
fixBackported in: Fixed SQL injection in the PostgreSQL wire protocol emulation. Prepared-statement parameters — the Parse/Bind/Execute extended-query path used by psycopg2, JDBC, node-postgres, Npgsql and others, and the simple-query EXECUTE path — were substituted into the executed SQL by raw…
fixBackported in: Fixed a privilege-escalation gap where the executable table function did not enforce the TABLE ENGINE ON Executable grant. With table_engines_require_grant enabled, a user denied CREATE TABLE ... ENGINE = Executable could still run the same server-side script via SELECT ... FROM…
fixBackported in: Fixed potential data loss when an INSERT into ReplicatedMergeTree was cancelled or timed out while ClickHouse was recovering an uncertain Keeper commit. (kakao-tars-case).
fixBackported in: Fixed a SQL injection in the PostgreSQL metadata queries. The schema of the PostgreSQL database engine, the requested column names and the publication name were formatted into SQL literals without escaping, so a value containing a quote could execute arbitrary SQL on the connected…
fixBackported in: Fixed Iceberg INSERT writing manifest-wide aggregate column statistics into every data_file entry when a partition produced more than one data file. Each entry's null_value_counts, column_sizes, lower_bounds and upper_bounds now describe only the data file it points at. Previously…
fixBackported in: Fix allow_feature_tier rejecting merge_tree_-prefixed settings in settings profiles as unknown, and rejecting CREATE TABLE because of MergeTree settings set by the server through compatibility or the merge_tree config section. Also fix constraints on a merge_tree_-prefixed setting…
fixBackported in: Fixed a data race and a use-after-free on the metadata of a DeltaLake or Iceberg table. Two concurrent queries that read total_rows or total_bytes from system.tables for the same table could have one query replace the table's metadata while the other was still reading it, which…
fixBackported in: Fixes memory leaks of abandoned nested aggregate states. (Groene AI).
fixBackported in: Apply remote_url_allow_hosts before SQL-supplied S3 and Azure endpoints send schema, metadata, or container requests. (Rory Shanks).
fixBackported in: Fix wrong results when a filter on a combined literal+sub-object JSON subcolumn (json.@a) was analyzed against a JSONAllPaths skip index: the subcolumn was treated as a path literally named @a `, so all granules were skipped and the query returned fewer rows than it should. (Pavel…
fixBackported in: Fixed incremental backups to Azure Blob Storage storing the beginning of each file instead of its tail. Restoring such a backup silently dropped all the data written after the base backup. (Smita Kulkarni).
fixBackported in: Fix a case where expensive ZooKeeper exception logging could delay session finalization and leave pending requests unresolved. (Antonio Andelic).
fixBackported in: Fix an integer overflow in the deserialization of String values in the binary formats, and bound the recursion of the binary deserialization of Dynamic and JSON values. (Alexey Milovidov).
fixBackported in: Fix a use-after-free in the gRPC server when a query with a streaming input finishes while a read of the next message is still in flight. (Alexey Milovidov).
fixBackported in: Fixed ILLEGAL_COLUMN ("Cannot convert column ... because it is non constant in source stream but must be constant in result") for a query combining ARRAY JOIN with a filter on an empty IN set, whether the set is an empty list such as SELECT count() FROM t ARRAY JOIN [b] AS x WHERE a…
fixBackported in: Fixed a server startup failure after creating an Alias table whose target did not exist yet and later became an Alias table itself. Such a table was accepted by CREATE but rejected while loading metadata, which aborted startup with BAD_ARGUMENTS. The Alias target restrictions are…
fixBackported in: Fix RESTORE of an incremental S3 backup chain whose locator authenticates by assuming a role (extra_credentials(role_arn = ...)). The role identifiers are not secrets and are now kept in the locator of the backup metadata, so each backup in the chain can reopen its base; previously…
fixBackported in: A setting that a client does not know about is sent over the native protocol as a custom setting. The server now reads such a setting into the setting it names, instead of keeping it as a custom setting of the same name. Previously, it was reported as unchanged, at its default…
fixBackported in: Fix partition pruning and primary key filtering being silently disabled when parallel_replicas_min_number_of_rows_per_replica is set inside a subquery or CTE instead of at top query level. (Yarik Briukhovetskyi).
fixBackported in: Fixed the Unexpected return type from materialize logical error when reading a column that has a text index through the index after a metadata-only or not-yet-materialized ALTER MODIFY COLUMN (including lazy JSON type hints) that requires a read-time type conversion. (Pavel Kruglov).
fixBackported in: Fixed h3Line returning uninitialized memory in the tail of the result array when a line between two valid H3 indices cannot be drawn because it crosses pentagon distortion. Such a call now throws INCORRECT_DATA. (Groene AI).
fixBackported in: Fixed moduloOrNull, intDivOrNull, divideOrNull and positiveModuloOrNull returning the raw division result instead of NULL when dividing by a constant zero inside a subquery whose result an outer query consumes, such as a passthrough SELECT * FROM (...) or a view. INSERT ... SELECT…
fixBackported in: Fixed a query over an Iceberg table returning fewer rows than the table holds when a manifest declares a lower bound above the upper bound for a filtered column. Such a pair describes an empty range, so min/max pruning dropped the data file holding the matching rows; those bounds…
fixBackported in: Fixed the row numbers shown in the Web UI for a page other than the first one: they restarted at 1 on every page instead of counting from the page's position in the whole result. (Alexey Milovidov).
fixBackported in: Fixed wrong results from sumKahan when the aggregated batch does not start at the first row of the block. sumKahanIf, and sumKahan over a Nullable argument, tested each row against the wrong element of the condition or null map, returning silently incorrect sums inside window frames…
fixBackported in: Fixed reading uninitialized memory as literal data when decompressing a malformed LZ4-compressed block. (Alexey Milovidov).
fixBackported in: Fixed a stack overflow when reading hadoop-snappy data containing many blocks that decode to nothing. (Alexey Milovidov).
fixBackported in: The handshake response of the MySQL wire protocol is now bounded, so a client can no longer make the server grow memory during the handshake. The mysql_require_secure_transport server setting is now enforced from the actual state of the connection instead of a capability bit…
fixBackported in: Fix background Distributed inserts that deleted unsent spool files after a split batch got a transient error. ClickHouse now keeps the files and retries the batch. (Rory Shanks).
fixBackported in: Fixed an external GROUP BY exceeding max_memory_usage when enable_adaptive_aggregator is on. Intermediate data the adaptive aggregator held and could not release kept a thread on the baseline algorithm flushing its own hash table on every block, so each block wrote a temporary file…
fixBackported in: Check the overflow when allocating a block of aggregate function states on deserialization: a malformed Native block could make the server write out of bounds. (Raúl Marín).
fixBackported in: Fix a path traversal on RESTORE. A backup metadata entry whose was not already in normal form, for example one containing // or fewer .. than the depth of its own directory prefix, was validated in normalized form but stored verbatim, so restoring the part wrote the entry outside…
fixBackported in: Fix out of bound in timeSeriesGroupArray(). (Vitaly Baranov).
featureBackported in: Ignore only well known and minor jemalloc errors and add entry about disabled per-cpu arena into system.warnings. (Azat Khuzhin).
featureBackported in: Internal follow-up correcting an implementation detail from an unreleased change; no user-visible behavior change beyond restoring the intended performance characteristics of https://github.com/ClickHouse/ClickHouse/pull/115852 for Dynamic(JSON) text output. (Nikita Fomichev).
+64 more items in the release notes
26.8.2.7 Sep 1, 2026 Release notes ↗
otherBackported in: Speed up GROUP BY without aggregates by inlining some functions. (Nikita Taranov).
otherBackported in: Sped up SQL function formatDateTime with non-const timezone arguments. (Robert Schulze).
otherBackported in: The adaptive aggregation GROUP BY (enable_adaptive_aggregator) now works together with max_rows_to_group_by in the default throw overflow mode, instead of silently falling back to the regular aggregation. In throw mode the limit is now also enforced against the merged total of the…
fixBackported in: Fixed a settings-constraint bypass: a SETTINGS clause inside a subquery, a CTE or a view's inner query was applied without checking the settings constraints, so it could be used to leave readonly mode or to override a CONST, MIN or MAX constraint (for example…
fixBackported in: Fix a bloom_filter skip index returning fewer rows for IN on an Array column when the set contains an empty array, for example WHERE x IN ([]). (Groene AI).
fixBackported in: Fixed a 404 (S3_ERROR) when reading an Iceberg table through a path that is a parent of the table directory, with the metadata document named by the iceberg_metadata_file_path setting: every data and manifest key was resolved against the queried path, so the directories between it…
26.8.1.2041 Aug 30, 2026 Release notes ↗
breakingThis patch changes how object storage disk transactions work. Now, native to the metadata storage transactions will be used by default instead of the fake ones used before. (Mikhail Artemenko).
breakingThe server now refuses to start (and rejects SYSTEM RELOAD CONFIG) when the server config contains an unknown top-level element, instead of silently ignoring it. Audit your config before upgrading: stale sections left over from older versions, sections consumed by forks/third-party tooling, and…
breakingFor views whose body is a plain SELECT over a single Distributed table, the whole outer query is now pushed to the shards (new setting optimize_trivial_view_pushdown_to_distributed, enabled by default). This changes observable behaviour for such views: FINAL and SAMPLE written on the view…
breakingLightweight UPDATE patch parts now use a new v2 on-disk format sorted by (sorting_key..., _block_number, _block_offset) and applied with a new merging algorithm. Peak memory is bounded by the largest equal-sort-key run instead of the full patch, and updates that cross merge boundaries no longer…
breakingAn unquoted JSON number for a DateTime64/DateTime column in JSONEachRow and similar formats is now interpreted as a Unix timestamp (seconds since the epoch) with optional sub-second precision, consistent with the Values format, CAST and toDateTime64. Previously a number with a fractional part…
breakingThe default value of the max_insert_threads setting has been changed from 1 (no parallelism) to auto, which resolves to the number of CPU cores available to the server (reduced under memory pressure via max_insert_threads_min_free_memory_per_thread). This parallelizes INSERT SELECT by default and…
breakingReading a CSV bare Tuple now takes one field per element in every position, so a \N in the field of a top-level element is that element and input_format_null_as_default applies to it. Previously a leading \N was taken for the whole column being null, so the row was replaced by the column default…
breakingAdded the VALID FOR clause to CREATE USER and ALTER USER as a shorthand for VALID UNTIL. The expiration deadline is computed as the current time plus the given interval at query execution time and stored in the VALID UNTIL form. The valid_until column of the system.users table now has the type…
breakingFixed SYSTEM STOP/START CLEANUP and SYSTEM STOP/START VIRTUAL PARTS UPDATE ON CLUSTER requiring SYSTEM PULLING REPLICATION LOG instead of SYSTEM CLEANUP / SYSTEM VIRTUAL PARTS UPDATE. (Groene AI).
breakingEXPLAIN SYNTAX now returns the reformatted query as a single String record (with embedded newlines) instead of one record per line, so its output is a recoverable single row that is directly usable (for example, SELECT count() FROM (EXPLAIN SYNTAX ...) returns 1). This is controlled by the new…
breakingThe PostgreSQL and MaterializedPostgreSQL database engines now respect the server's remote_url_allow_hosts configuration, like the PostgreSQL table engine, the postgresql table function, and DDL-created dictionaries already do. The policy is enforced on CREATE DATABASE and on a user-issued ATTACH…
breakingExtended the supported range of Date32 from [1900-01-01, 2299-12-31] to [0000-01-01, 9999-12-31], matching DateTime64. Parsing and conversions now accept the extended range instead of silently clamping to the old boundaries. Backward compatibility notes: in the numeric conversion toDate32(N),…
breakingThe experimental ALP codec now performs Float32 scaling arithmetic in Float64, which eliminates exceptions on decimal data and significantly improves compression ratios. (Raufs Dunamalijevs).
breakingRemoved the library dictionary source. It was created for a single customer a very long time ago, it required writing a shared library against an undocumented C ABI, and it was already disabled in ClickHouse Cloud. SOURCE(LIBRARY(...)) now fails with UNKNOWN_ELEMENT_IN_CONFIG, like any other…
breakingRemoved the Apache Arrow library-based reader and writer for the Arrow and ArrowStream formats. The native ClickHouse implementation, which has been the default since 26.7, is now the only one. The settings input_format_arrow_use_native_reader and output_format_arrow_use_native_writer are…
breakingThe TLS credentials of a MySQL source (ssl_ca, ssl_cert, ssl_key) can no longer be specified as file paths from SQL — in a named collection created with CREATE NAMED COLLECTION, as a query argument, or in a CREATE DICTIONARY query — because the server opens those files with its own privileges.…
breakingReject timespan setting (milliseconds/seconds) values that overflow Int64 microseconds. (Azat Khuzhin).
breakingarrayIntersect and arraySymmetricDifference no longer treat a value repeated inside a single argument as if it appeared in several arguments. Queries relying on the previous behavior can now return different results: arrayIntersect([1], [2], [1, 1]) returns [] instead of [1], arrayIntersect([1,…
breakingdisable_insertion_and_mutation now prevents background consumption from Kafka, RabbitMQ, and NATS tables while still allowing direct writes to external storage. Gated Kafka2, NATS, and RabbitMQ tables do not initialize consumers for direct SELECT. The recently introduced…
breakingA window PARTITION BY or ORDER BY over an AggregateFunction column is now rejected with ILLEGAL_COLUMN, as top-level ORDER BY over such a column already was. Previously such a query was accepted by at least one analyzer, and window PARTITION BY partitioned differently depending on max_threads. The…
breakingFix access checks for the SYSTEM ... CACHE ON CLUSTER commands. They required the SYSTEM DROP CACHE privilege group instead of the privilege of the individual command, which both denied holders of a single granular cache privilege and let a holder of the group run SYSTEM SYNC FILESYSTEM CACHE ON…
breakingThe include_from setting no longer defaults to /etc/metrika.xml. Previously that file was used for configuration substitutions whenever it existed, even though nothing in the ClickHouse configuration referred to it. If you relied on that implicit substitutions file, add /etc/metrika.xml explicitly…
breakingThe NATS table engine accepts credentials inline in the new nats_credentials setting (the same payload as a .creds file), and no longer accepts nats_credential_file from SQL: the path is a reference to a file on the server filesystem, which the server opens with its own privileges, so it can only…
breakingAsynchronous metrics can now have the Map data type, and the per-CPU-core and per-device metrics were converted to single key-value metrics: OSUserTimeCPU0, OSUserTimeCPU1, ... became a single OSUserTimeCPU metric with a map from the CPU core number to the value (and similarly for the other…
featureAdded a chinese tokenizer for the tokens function and MergeTree text indexes. It segments Chinese text into words using a dictionary and a Hidden Markov Model (the algorithm follows jieba), with coarse_grained (default) and fine_grained granularities. Continues. (Amos Bird).
featureAdd new functions to serialize and deserialize AST as JSON. (Alexey Milovidov).
featureAdd restore_table_data, restore_access_entities, and restore_functions restore settings for granular control over what gets restored. These can override structure_only for individual categories — e.g. structure_only=true, restore_access_entities=true restores table definitions and access entities…
featureAdded support for Puffin file format (https://iceberg.apache.org/puffin-spec/). Now this format can be used in table functions like file, url, s3 and so on.. (Konstantin Vedernikov).
featureAdded a way to access tables and databases via URL paths in the HTTP interface (e.g. \/database/table.format.gz?filter=a>0), plus new settings (\http_allow_database_as_path\, \http_allow_table_as_file\, \http_allow_filters_as_path\, \http_allow_filters_as_unrecognized_url_parameters\, \select\,…
featureAdded CREATE HANDLER, ALTER HANDLER and DROP HANDLER statements to define custom HTTP handlers from SQL, persisted in a local or Keeper storage. Added the currentHandler and currentRequestURL functions, the system.handlers table, and the http_handler_name / http_request_url columns in…
featureAdded the HiveText output format that writes data in Apache Hive LazySimpleSerDe text form. Fields are separated by \x01, rows by the new format_hive_text_rows_delimiter setting (default \n), and nested Array, Map, and Tuple values use Hive's separator list. The output targets Hive's default…
featureAdded "packed" data part storage for MergeTree tables, which stores all of a part's files in a single archive (data.packed) instead of a file per stream. It is controlled by the min_bytes_for_full_part_storage, min_rows_for_full_part_storage and min_level_for_full_part_storage settings and is…
featureImplement aggregate function mergedJSONPatch for RFC 7396-style merge-patch aggregation over JSON values, including state merge support and AggregatingMergeTree usage. Users can aggregate a JSON column using a timestamp or another ordering column as the sort key to compute the latest state.…
featureThe array subscript operator supports an array of integers as the index: arr[indexes] returns the elements at all of the given positions, equivalently to arrayMap(i -> arr[i], indexes). (folly).
featureSupport the GROUPS frame mode for window functions (SQL:2011), e.g. any(price) OVER (PARTITION BY symbol ORDER BY ts GROUPS BETWEEN CURRENT ROW AND 1 FOLLOWING). In a GROUPS frame the boundaries count whole peer groups — sets of rows that are equal on the ORDER BY key — so N PRECEDING/N FOLLOWING…
featurePlain CREATE MATERIALIZED VIEW ... POPULATE is now locally atomic: the view is subscribed to new inserts of the source table and the existing data is snapshotted together under a brief exclusive lock on the source, so rows inserted through the same server concurrently with the population are no…
featureAdded the mergeTreeCodecBlockCounts(database, table) table function that reports, per (part, column, substream) of a MergeTree table, how many compressed blocks use each codec. (Raufs Dunamalijevs).
featureAdded the sort-based IEJoin algorithm for joins whose ON section has two inequality comparisons (, >=) between the joined tables, enabled by adding ie_join to the join_algorithm setting. Supported kinds are ALL INNER/LEFT/RIGHT/FULL JOIN and SEMI/ANTI LEFT/RIGHT JOIN. Previously such queries were…
featureAdd function notHas, the negation of has for arrays, maps, and JSON. When the haystack is a constant array, notHas(constant_array, x) is rewritten to x NOT IN constant_array by optimize_rewrite_has_to_in (enabled by default), so it executes via a set lookup and can prune by the primary key index…
breakingAdded a new join_algorithm value parallel_full_sorting_merge: for hash-compatible equality joins, it shards a full sorting merge join by the hash of the join keys into independent per-shard merge joins running on all threads. It keeps the low, streaming memory usage of a merge join while…
+1678 more items in the release notes
26.7.36.9 Oct 21, 2026 Release notes ↗
fixBackported in: Combine I/O cost with selectivity in PREWHERE condition ordering. It fixes performance regression in PREWHERE execution in some cases introduced after https://github.com/ClickHouse/ClickHouse/pull/101275. Part of. (Pavel Kruglov).
fixBackported in: Mask credentials embedded in HTTP URIs. (Han Fei).
fixBackported in: Reject CR and LF characters in values sent as HTTP headers or in the request line of outgoing HTTP requests (BigQuery, YTsaurus, url, DataLake catalogs, GCP OAuth, AI functions, S3 storage class), which could be used to inject headers or additional requests. (Raúl Marín).
fixBackported in: Fixed a heap-use-after-free in the view dependency graph after renaming a materialized view whose query selects from itself. CREATE MATERIALIZED VIEW and ALTER TABLE ... MODIFY QUERY now reject a query that makes a materialized view select from itself. (Groene AI).
fixBackported in: Fix use-after-free in complex key ssd_cache dictionaries when the cache file wraps around its partitions. Fix CANNOT_READ_ALL_DATA when reading long values of ssd_cache dictionaries from the cache file. (Alexey Milovidov).
fixBackported in: Fixed count() with WHERE d = toDate32('1900-01-01') (or !=) over a MergeTree Date32 column returning the number of 1970-01-01 rows when optimize_trivial_count_with_sparsity_filter is enabled (the default since 26.8). Closes. (Groene AI).
otherBackported in: Not for changelog. (Alexey Milovidov).
otherBackported in: Make 03673_columns_description_cache and 04257_102926_columns_descriptions_cache_nested_eviction robust to asynchronous part removal, applying the fix already made to their sibling 04510_shared_part_schema_metadata_eviction. (Groene AI).
26.7.35.11 Oct 20, 2026 Release notes ↗
breakingBackported in: CREATE TABLE x AS src inherits the credentials embedded in the engine of src, which are masked in SHOW CREATE TABLE. It now requires the SELECT privilege on src when the inherited definition can carry credentials, instead of only SHOW COLUMNS. (Yarik Briukhovetskyi).
featureBackported in: Estimating subcolumn sizes for PREWHERE (for example m['key'] of a Map(LowCardinality(String), String) column) no longer reads the LowCardinality dictionary or the Variant discriminators header of every data part, which made planning slow on object storage, especially for each new…
otherBackported in: BACKUP uses less memory per file it backs up: an entry of the backup no longer keeps a copy of the description of the disk the file is on. A backup of a table with millions of files saves a few gigabytes. (Julia Kartseva).
otherBackported in: A packet that cannot appear at the current point of the native protocol is now rejected without deserializing its payload. Previously the server deserialized the body of an unexpected Data packet — including arbitrary data types and aggregate function states — only to throw…
otherBackported in: Compare TOTP codes and plaintext_password passwords in constant time, so that the response time does not depend on how many leading characters are correct or on which time window matched. (Vladimir Cherkasov).
fixBackported in: Fixed a server crash and an out-of-bounds write when inserting into a column with a long chain of compression codecs, for example CODEC(FPC, FPC, ..., FPC). CompressionCodecMultiple compounded each stage's reserved size in a UInt32 without checking for overflow, so a long enough…
fixBackported in: Fixed a read of uninitialized memory when a Variant, Dynamic or JSON column holding only NULL values is compressed, for example on insert into a Memory table created with compress = 1, or when a block is compressed for a JOIN or for the query result cache. The reported size of such…
fixBackported in: Fixed crashes of the interactive line editor of clickhouse-client and clickhouse-local, which also crashed the server when used through the web terminal or an SSH session: after a history search that found nothing on an edited recalled query, when the prompt or the line given to an…
fixBackported in: Fix segfault when reading a MySQLDump file whose CREATE TABLE query has an ENUM column without a list of values or with non-string values. (Alexey Milovidov).
fixBackported in: Fix a stack overflow when a Redis server replies with deeply nested arrays. (Alexey Milovidov).
26.7.34.3 Oct 18, 2026 Release notes ↗
fixBackported in: Fixed ORDER BY ... LIMIT over a column of an Interval type (or Nullable, LowCardinality, Tuple or Array of one) failing with TYPE_MISMATCH when use_top_k_dynamic_filtering is enabled, which is the default. Closes. (Groene AI).
fixBackported in: The setting http_zlib_compression_level now applies only to the gzip and deflate HTTP response compression. The level of other methods (zstd, lz4, br, xz, bz2) is controlled by output_format_compression_level. Previously, a level suitable for zlib was passed to every method, which…
26.7.33.3 Oct 17, 2026 Release notes ↗
fixBackported in: Requesting SSH-key authentication over the native protocol no longer reveals whether the named user exists, or how it authenticates, before its signature is checked. (Shaohua Wang).
otherBackported in: Update mariadb-connector-c to v3.4.10. (Actuele AI).
26.7.32.7 Oct 16, 2026 Release notes ↗
breakingBackported in: Overriding a key that is stored in a named collection now requires SHOW NAMED COLLECTIONS SECRETS on that collection. This also applies to overrides through an alias (including flat kafka_* settings over nested kafka.* keys), through a SETTINGS clause of a table engine or table…
fixBackported in: Do not remove columns when it's referenced in both PREWHERE and WHERE filter conditions even if it's rewritten into a text index virtual column. (Elmi Ahmadov).
fixBackported in: Fixed a stack overflow crash on a deeply nested CapnProto schema that the nesting depth check missed: a comment or a byte order mark between import and its path, an escape sequence in the import path, or a backtick text line. A backtick text line with many brackets is no longer…
fixBackported in: Fixed a possible segmentation fault when reading an Avro map into a Map column (for example Map(DateTime, String)) with the AvroConfluent format, including Kafka tables. Closes. (Groene AI).
fixBackported in: Fixed an issue where pressing Ctrl-R and then Ctrl-Z in the web terminal or the SSH interface suspended the whole server process. (Alexey Milovidov).
fixBackported in: Fixed a crash (stack overflow) on a CapnProto schema with a long chain of type expression suffixes (Int32.a.a..., Int32()()...) or of declarations that refer to each other (constants, aliases, struct fields, annotations, imports). Such a schema is now rejected with The CapnProto…
26.7.31.12 Oct 15, 2026 Release notes ↗
featureBackported in: Add S3 bucket to remote_url_allow_hosts. (Konstantin Vedernikov).
fixBackported in: Fixed a server startup failure after creating an Alias table whose target did not exist yet and later became an Alias table itself. Such a table was accepted by CREATE but rejected while loading metadata, which aborted startup with BAD_ARGUMENTS. The Alias target restrictions are…
fixBackported in: Fix ALTER TABLE ... MATERIALIZE STATISTICS / DROP STATISTICS failing forever and wedging the table's mutation queue when a server profile sets allow_statistics = 0 and the statement enables it per-session, the same opt-in ADD STATISTICS honours. Also close a hole where MATERIALIZE…
securityBackported in: Update the vendored expat to 2.9.0, fixing a denial of service through a crafted backup manifest during RESTORE (CVE-2026-66046) and the other 2.8.3–2.9.0 security fixes. (Actuele AI).
fixBackported in: Fixed loading, short ATTACH, and UNDROP TABLE for existing SQL-defined S3 disks whose endpoints are absent from remote_url_allow_hosts; new full-definition CREATE and ATTACH still reject disallowed endpoints. (Alexey Bakharew).
fixBackported in: Free prefetched messages when StorageKafka2 partitions move between consumers, preventing per-partition memory growth until restart. (Aparajita Pandey).
fixBackported in: The web terminal and the SSH interface no longer reset the settings of the user (from settings profiles, roles, and CREATE USER ... SETTINGS) to default values. Previously, restrictions such as readonly, resource limits, and additional_table_filters were not applied in these…
fixBackported in: Fix a wrong result, or an exception in debug builds, when optimize_aggregators_of_group_by_keys eliminated any, min or max of a GROUPING SETS key with group_by_use_nulls. (Alexey Milovidov).
fixBackported in: Fixed a server crash when a RabbitMQ table with the headers exchange type had a routing key without =, or when rabbitmq_routing_key_list was empty. Routing keys without = for the headers exchange type are now rejected with an exception. The problem was found and reported by @dstesk…
otherBackported in: Update vectorscan to 5.4.13. (Actuele AI).
otherBackported in: Observed as a bottleneck in the ci-logs cluster. (Mikhail Artemenko).
26.7.30.7 Oct 14, 2026 Release notes ↗
featureBackported in: Add ability to select jemalloc 4K/16K page size on aarch64 (default 64K). (Azat Khuzhin).
featureBackported in: Added a server setting access_control_improvements.readonly_restricts_set_role, false by default. When enabled, SET ROLE is refused with error code READONLY in a session or query whose readonly setting is not zero. Previously SET ROLE was the only identity-changing statement that…
fixBackported in: Fix a credential written in cleartext to system.query_log and the server log when a key = value argument precedes the positional arguments of the mongodb, redis, remote, arrowFlight and ytsaurus table functions or the MongoDB, Redis, Remote, ArrowFlight, ExternalDistributed and…
fixBackported in: Fixed a heap use-after-free in the s3, azureBlobStorage, hdfs and other object storage table functions and engines when an exception (for example MEMORY_LIMIT_EXCEEDED) was thrown while creating the reader of a file in a row input format such as CSV. (Groene AI).
fixBackported in: Fixed a server crash, wrong results or a rejected query in ORDER BY ... WITH FILL ... INTERPOLATE when one INTERPOLATE expression has to be converted to its target's type and another item reads the same column or literal, for example INTERPOLATE (a AS b, b AS a) with targets of…
otherBackported in: Not required. (Groene AI).
26.7.29.12 Oct 13, 2026 Release notes ↗
fixBackported in: The collections of the Native protocol — the settings and the query parameters of a query, the client information, the granted roles and the table-status lists — are now bounded, so a small packet can no longer make the server allocate memory for data that has not arrived. (Alexey…
fixBackported in: Fix reading bucketed runtime Map values from JSON columns using advanced shared-data serialization. (Rory Shanks).
fixBackported in: Mask secrets in the queries that a cluster-mode QueryRunner table writes to system.query_log as well as in queries executed as startup scripts. (Miсhael Stetsyuk).
fixBackported in: Fixed TRUNCATE TABLE of an Alias table whose target is a MergeTree failing with DEADLOCK_AVOIDED when the alias is being read concurrently, while the same statement against the target table succeeds immediately. The lock for TRUNCATE is now chosen and taken on the table that…
fixBackported in: Fixed a crash on a query with a deeply nested Dynamic or JSON constant. (Pavel Kruglov).
fixBackported in: Fixed use_skip_indexes = 0 also disabling part pruning by the partition-key min-max index (since 26.5), which made such queries read every part of the table. (Ashish Kumar Choubey).
fixBackported in: Reject malformed serialized groupBitmap states with INCORRECT_DATA instead of failing later during bitmap operations. (Elmi Ahmadov).
fixBackported in: Fixed excessive memory usage when loading a data part with a corrupted columns_substreams.txt; such a part is now detached as broken. (Murphy).
securityBackported in: Update mongo-c-driver to 2.5.5, fixing an out-of-bounds write during MongoDB connection monitoring reconnects (CVE-2026-96746). (Actuele AI).
otherBackported in: Update thrift to v0.25.0. (Actuele AI).
otherBackported in: Integration-test harness: tolerate non-UTF-8 bytes when decoding captured container output, so a single bad byte no longer aborts cluster teardown and the sanitizer scan, and honor shutdown(ignore_sanitizer=True) in the docker.log fallback scan. (Groene AI).
26.7.28.6 Oct 12, 2026 Release notes ↗
fixBackported in: Fix a possible heap buffer overflow on malformed responses from blob storage. (Arsen Muk).
fixBackported in: Fixed a query failing with an exception like Cannot parse UInt64 from String on a table with a text index on mapKeys or JSONAllPaths, when the predicate cannot be evaluated on the value of a missing map key or JSON path. (Anton Popov).
fixBackported in: Fixed slow planning of queries with skip indexes on tables with many parts and pending patch parts of lightweight updates. (Anton Popov).
otherBackported in: CRoaring v5.2.3 exposes internal_validate() on the C++ RoaringBitmap wrappers, so RoaringBitmap data can be validated. (Elmi Ahmadov).
otherBackported in: Update cctz to 2026e. (Actuele AI).
26.7.27.3 Oct 11, 2026 Release notes ↗
fixBackported in: Fixed a crash (stack overflow) when reading an Avro file with an explicit structure that does not read a field nested through a long chain of named types, or a field of a recursive type holding deeply nested data such as a long linked list. Such a file now fails with…
otherBackported in: Use castStorage for the Join row policy check in the legacy analyzer. (Vladimir Cherkasov).
26.7.26.8 Oct 10, 2026 Release notes ↗
otherBackported in: bloom_filter and text indexes are now used when a Nullable indexed column is cast to the non-Nullable type, such as CAST(x, 'String') or json.path::String. A query that would throw on a NULL value may not throw when the index skips the granules with NULL. (Anton Popov).
fixBackported in: Fixed Expected UInt64 column for __grouping_set, got BLOB and ColumnBLOB should be converted to a regular column before usage logical errors on a distributed query executed on a shard with enable_parallel_blocks_marshalling (enabled by default), for example with GROUP BY GROUPING…
fixBackported in: Fixes DeltaLake tables returning too few rows when the WHERE predicate contains a sub-expression the delta-kernel predicate translator cannot handle, positioned under a NOT. Such a sub-expression is now reported to delta-kernel as an explicit unknown predicate instead of as the end…
fixBackported in: Fix EXPLAIN PLAN actions = 1 printing a secret function argument (for example the key of HMAC or encrypt) in cleartext when its value came from a subquery or from the other side of a JOIN. (Vladimir Cherkasov).
fixBackported in: Comparing an Enum column with a string literal that is not one of its elements no longer throws UNKNOWN_ELEMENT_OF_ENUM when validate_enum_literals_in_operators is disabled (the default) and the column is part of the primary key, the partition key, or a bloom_filter index. != with…
fixBackported in: Fix a rare server crash (SIGSEGV in mongoc_log) when a MongoDB dictionary source or MongoDB table was created while another thread created the first MongoDB connection in the process. Messages logged by the MongoDB driver now go to the server log. (Vladimir Cherkasov).
fixFix 05243_enum_unknown_literal_key_condition. (Vladimir Cherkasov).
26.7.25.6 Oct 8, 2026 Release notes ↗
fixBackported in: Tables in a database with lazy_load_tables were missing from system.parts, system.replicas and related system tables, and refused by replica commands, after a restart. (Nikolay Degterinsky).
fixBackported in: Fix a server abort when reading an Iceberg table whose sort order names a transform ClickHouse cannot parse (e.g. bucket[xyz]); ClickHouse now ignores that sort-order hint and keeps the table readable. (Ilias).
fixBackported in: Fix UNKNOWN_IDENTIFIER in the analyzer when a table is referenced as database.table in FROM or JOIN and another table expression in the same query uses that database name as its alias, for example FROM db.t1 AS db INNER JOIN db.t2 AS t ON .... Closes. (Dmitry Novik).
fixBackported in: Fixed wrong results when a WHERE clause mixing AND and OR was evaluated with skip indexes (use_skip_indexes_for_disjunctions, enabled by default). If a minmax or set index could not evaluate one atom of the predicate for a granule, the per-atom verdicts recorded for that granule…
otherBackported in:. (Alexey Milovidov).
26.7.24.8 Oct 7, 2026 Release notes ↗
fixBackported in: ALTER TABLE ... MODIFY SETTING disk = disk(...) could register a disk defined in SQL whose local path is outside custom_local_disks_base_directory, and create its directory, bypassing the check that CREATE TABLE applies. Now it is rejected the same way, and a statement rejected this…
fixBackported in: Rewriting the body of a view with ALTER TABLE ... MODIFY QUERY now needs the same grants as creating it with its SQL security: SET DEFINER on the definer of a SQL SECURITY DEFINER view, or ALLOW SQL SECURITY NONE for a SQL SECURITY NONE view. An ON CLUSTER MODIFY QUERY fails with…
fixBackported in: Put "WRITE" operation in delta lake catalog. (Konstantin Vedernikov).
fixBackported in: Fix Found patch part ... that intersects mutation with version ... on lightweight updates in a table created with CREATE TABLE ... CLONE AS or ATTACH PARTITION ALL FROM a table with lightweight updates. (Nikolay Degterinsky).
fixBackported in: Fix a possible hang of a query under workload CPU scheduling with cpu_slot_preemption enabled: when all its threads were preempted, the query could keep CPU slots it had already used and wait forever for one of them. (Sergei Trifonov).
fixBackported in: Respect iceberg_metadata_staleness_ms in metadata parsing. (Konstantin Vedernikov).
fixBackported in: Fix container existence check during RESTORE of a lightweight snapshot from Azure Blob Storage by parsing the saved namespace into container name and prefix. (Garrett Thomas).
26.7.23.7 Oct 6, 2026 Release notes ↗
fixBackported in: Fix SYSTEM REFRESH on a stopped RabbitMQ table sometimes failing to consume the queued backlog. A REFRESH grants exactly one out-of-order streaming cycle, but that cycle could return immediately with zero rows because the AMQP delivery loop had only just been started asynchronously,…
fixBackported in: Fixed a transient Azure Blob Storage error on the read or merge path — an RBAC permission-propagation 403 Forbidden, a credential authentication failure, or a connect timeout surfaced as 408 — being misclassified as non-retryable and reported as POTENTIALLY_BROKEN_DATA_PART (Code…
fixBackported in: Fixed asynchronous TLS connections occasionally failing with an unrelated OpenSSL error left by another connection on the same OS thread. This could terminate distributed queries with a misleading network exception. (Dmitriy Borisenko).
fixBackported in: Add more path validations. (Konstantin Vedernikov).
fixBackported in: Fixed a segmentation fault or std::length_error when reading TSV formats with input_format_tsv_crlf_end_of_line = 1 if an escape sequence ended exactly at the end of a read buffer. (Groene AI).
otherRevert backport of to 26.7: Check for timeouts and KILL QUERY while covering a polygon with H3 cells. (Nikita Fomichev).
26.7.22.4 Oct 5, 2026 Release notes ↗
fixBackported in: Fix a text or ngrambf_v1 index silently dropping matching rows when the indexed column is compared for equality against a FixedString value, or searched with hasAny or hasAll over FixedString needles. Happens at default settings, since use_skip_indexes and enable_full_text_index are…
fixBackported in: Fix an out-of-bounds read when deserializing a uniqTheta state shorter than 24 bytes, for instance from CAST( AS AggregateFunction(uniqTheta, ...)). (Alexey Milovidov).
fixBackported in: Fix a buffer over-read on the sequential read path from Azure Blob Storage: an endpoint that answers a ranged request with more data than was requested could deliver bytes from outside the requested range to the caller. The end of a read is now decided by the locally set right…
26.7.21.2 Oct 4, 2026 Release notes ↗
otherBackported in: Skip indexes (bloom_filter, tokenbf_v1, ngrambf_v1, minmax) and the primary key are now used when the indexed column is wrapped into a conversion that does not change its value, such as toLowCardinality, toNullable or a CAST to Nullable or LowCardinality. (Anton Popov).
26.7.20.28 Oct 3, 2026 Release notes ↗
otherBackported in: Faster planning of queries to Iceberg tables with many manifest files: when a manifest file header has the schema-id key and that schema is already known from metadata.json, the schema copy stored in the manifest header is no longer parsed and compared with it. ClickHouse now also…
otherBackported in: Build Iceberg min/max hyperrectangles only for columns the filter uses. (Konstantin Vedernikov).
otherBackported in: Hide the HTTP headers in the definition of HTTP dictionary sources in SHOW CREATE DICTIONARY, system.tables and query logs, the same way as passwords. They can be shown with the existing display_secrets_in_show_and_select mechanism. (Matheus Nerone).
fixBackported in: Fixed SYSTEM SYNC TRANSACTION LOG (local, non-ON CLUSTER form) not checking the SYSTEM_SYNC_TRANSACTION_LOG privilege. The ON CLUSTER form already required it via getRequiredAccessForDDLOnCluster, but the local execution path skipped checkAccess, so a user without the grant could…
fixBackported in: Fixed an ssl_certificate authentication bypass where an embedded NUL byte in a certificate's Common Name (for example john\0.evil.com) was truncated server-side to john, letting a holder of such a certificate authenticate as a different user. (Konstantin Bogdanov).
fixBackported in: Fixed max_memory_usage and max_server_memory_usage not being respected when reading a JSON column with the FLATTENED serialization version from the Native format. (Pavel Kruglov).
fixBackported in: Fixed out-of-bounds reads when reading a JSON or Dynamic column from a malformed Native block or a corrupted data part. A truncated stream, a duplicate type in a flattened Dynamic column, a duplicate or typed-colliding path in a JSON column, and a serialization version that is only…
fixBackported in: Skip indexes (text, tokenbf_v1, ngrambf_v1) are now used when the indexed column or the searched constant is wrapped into LowCardinality, Nullable or an equivalent CAST. For example, m['key'] = 'value' on a Map(String, LowCardinality(String)) column and hasToken(s,…
fixBackported in: EXPLAIN AST printed secret function arguments, such as the key of encrypt, in clear text, and with optimize = 1 it did so for the body of a view the user may only SELECT from. The dump now prints '[HIDDEN]' in their place, under the same gate as SHOW CREATE. (Harikrishnan Prabakaran).
fixBackported in: Column-level SELECT privileges are now enforced for columns used only inside indexHint and for ALIAS columns referenced in PREWHERE. As in WHERE, referencing an ALIAS column in PREWHERE requires the grant on the alias name; a grant on its source columns is no longer sufficient. A…
fixBackported in: Fixed a row policy bypass: a direct JOIN with an EmbeddedRocksDB, KeeperMap or Redis table in the legacy analyzer (enable_analyzer = 0) ignored the row policy of the right table and returned hidden rows, and joinGet on a Join table ignored its row policy in both analyzers. Such a…
fixBackported in: Fix NO_COMMON_TYPE in case of use_variant_as_common_type=0 for jemalloc fragmentation dashboard. (Azat Khuzhin).
fixBackported in: Fix the Kafka and NATS table engines ignoring remote_url_allow_hosts: broker addresses from kafka_broker_list, nats_url, and nats_server_list are now checked against the remote host filter. A forbidden address is rejected at CREATE TABLE with UNACCEPTABLE_URL, as the RabbitMQ engine…
fixBackported in: Now statistics parts pruning will not work if table has row level policy. (alesapin).
fixBackported in: Now clickhouse masks credentials in system.query_log even for wrong URLs for external table engines. (alesapin).
fixBackported in: Fix filesystem cache accounting when the directory for a new cache key cannot be created, for example because the cache disk is out of space or inodes. The failed reservation stayed counted in the cache until the query released the file segment. (Sema Checherinda).
fixBackported in: CREATE OR REPLACE in a Replicated database or with ON CLUSTER now requires the drop privilege for the kind of the table it replaces, so a user without DROP DICTIONARY can no longer replace a dictionary. (Nikolay Degterinsky).
fixBackported in: Fix LOGICAL_ERROR Cannot capture column N because it has incompatible type when a materialized view with a lambda over an Array(Tuple(...)) column receives a block while the source table's column type is being changed by ALTER TABLE ... MODIFY COLUMN. (Jimmy Aguilar Mena).
fixBackported in: The value of 'role_session_name' as of now is hidden in query_log. (Alexey Bakharew).
fixBackported in: Fix a server crash caused by unbounded recursion when decoding a deeply nested value inside a binary encoded type, for example an AggregateFunction parameter in a Dynamic value read from RowBinary or Native. (Pavel Kruglov).
fixBackported in: Fix validation of Iceberg manifest-list entries during writes. (Arsen Muk).
fixBackported in: Fixed secret settings of S3Queue and AzureQueue tables written with the legacy s3queue_ prefix, such as s3queue_after_processing_move_secret_access_key, being shown in cleartext in SHOW CREATE TABLE, system.tables, system.query_log and the server log. They are now hidden as they are…
fixBackported in: Fix missing rows in hasAllTokens and hasAnyTokens searches over a text index when an earlier query with the same predicate read a narrower key range of the same part and use_text_index_postings_cache was enabled. (Anton Popov).
fixBackported in: Fix a crash when reading an ORC file whose root type is not a struct (for example, a file written with a bigint or array root type). Such files are now rejected with an INCORRECT_DATA error. Closes. (Groene AI).
fixBackported in: Fixed a crash and wrong results with convert_query_to_cnf = 1 when WHERE or HAVING references the same SELECT alias more than once. (Groene AI).
otherBackported in: Hide a Backup locator named like a COLUMNS matcher in EXPLAIN AST instead of throwing. (Groene AI).
otherBackported in: Do not dereference a null logs_queue in OwnSplitChannel::log. (Groene AI).
26.7.19.5 Oct 1, 2026 Release notes ↗
fixBackported in: Fixed a LOGICAL_ERROR ("Unexpected number of kept output positions after removing unused columns from ReadFromMergeTree") raised by a SELECT ... FINAL whose PREWHERE uses a column that FINAL needs for merging (ver, is_deleted, sign) and which does not select that column. (Groene AI).
fixBackported in: Kafka producer and consumer trace logs now show the value of secret librdkafka properties, such as sasl.password, as [HIDDEN] instead of the cleartext value. (János Benjamin Antal).
fixBackported in: S3 client check initial url in backup client. (Konstantin Vedernikov).
breakingBackported in: Remove --icf=safe linker warnings about SHT_LLVM_ADDRSIG in the stripped Rust libraries. (Raúl Marín).
26.7.18.2 Sep 30, 2026 Release notes ↗
fixBackported in: Fixed a Backup database engine printing the credentials of its destination in plaintext. SHOW CREATE DATABASE, system.databases.engine_full, system.query_log and the messages that reject a malformed locator showed an AzureBlobStorage account_key, a connection string or a presigned…
26.7.17.7 Sep 29, 2026 Release notes ↗
otherBackported in: Chained ARRAY JOINs no longer materialize the whole block of a lazily replicated array column before expanding it, which cuts their peak memory by several times. (Yarik Briukhovetskyi).
fixBackported in: Fixed silently empty tables when more than one ENGINE = Backup database is created from the same backup, or when such a database is recreated under a different name. The storage policy that backs a Backup database is now identified by a name that also covers the local database name,…
fixBackported in: ALTER DATABASE ... MODIFY COMMENT on a database with ENGINE = Backup no longer writes a definition the server cannot read back, which made it refuse to start; metadata already written in that form now loads too. Backward incompatibility: a backup taken by an older server of a…
fixBackported in: Fixed settings constraints from a settings profile not being enforced against the other setting assignments in the same statement. SET profile = 'p', = could override a CONST, MIN/MAX or readonly constraint that profile p installs. The same escape existed through an in-query…
fixBackported in: Fix a segmentation fault in Keeper when preallocating space for a changelog file fails because the disk is full. (Alexey Milovidov).
fixBackported in: Link with --icf=safe instead of --icf=all, so the linker keeps functions whose address is taken distinct. gRPC queries with transport compression (gzip, deflate) no longer crash the server, as they could in official builds since 26.4. Closes. (Groene AI).
26.7.16.2 Sep 28, 2026 Release notes ↗
otherBackported in: TLS CA certificates configured with openSSL.server.caConfig / openSSL.client.caConfig (and caConfig of composable protocols) are now reloaded without a restart when the file changes or on SYSTEM RELOAD CONFIG, in the same way as certificateFile and privateKeyFile. This makes it…
26.7.15.52 Sep 26, 2026 Release notes ↗
breakingBackported in: A MySQL dictionary source created with a CREATE DICTIONARY query can no longer enable enable_local_infile, at the source or at one of its REPLICA entries; loading such a dictionary fails with BAD_ARGUMENTS, which with the default dictionaries_lazy_load is on first use rather than at…
featureBackported in: You can now disable reading through the executable table function and from Executable/ExecutablePool tables with the new allow_executable_tables setting, for a deployment that must not run arbitrary server-side scripts. It defaults to true, so existing behavior is unchanged. (Hanzi…
featureBackported in: Added a flat_namespaces setting for the DataLakeCatalog database engine. Set it for Iceberg REST catalogs that have only single-level namespaces and reject the parent query parameter of the list-namespaces endpoint, such as Apache Polaris federated to AWS Glue: only top-level…
otherBackported in: Iceberg partition pruning now uses the partition value of a day, month, year or hour transform for a filter that wraps the partition source column in a monotonic function, such as WHERE toDate(ts) = '2024-01-20', including for partition values from before 1970. (Alexey Milovidov).
featureBackported in: Add column size statistics in Avro files. (Konstantin Vedernikov).
fixBackported in: Fixed an out-of-bounds read when finalizing a crafted analysisOfVariance aggregate state whose internal arrays have mismatched lengths. (uwezkhan).
fixBackported in: Fixed dropping whole parts with TTL (ttl_only_drop_parts = 1) still reading all data from large, fully-expired parts. (Michael Jarrett).
fixBackported in: Fix an accounting leak in memory tracking: when an allocation was rejected by a parent memory tracker (for example, the server-wide memory limit), the thread, query, and user level trackers kept the rejected amount. The error accumulated over time, inflating MemoryTracking and…
fixBackported in: Fixes a server crash (double free) when finalizing an aggregate function with the -State combinator nested under a combinator that transfers several sub-states in one call (-Resample, -ForEach, -Map, -Tuple), for example groupArrayStateResample, if an exception such as a memory…
fixBackported in: Fix Bad cast from type DB::ColumnNullable to DB::ColumnString when a mutation that rewrites the whole part runs on a part whose column type is older than the one in the table metadata, for example after ALTER TABLE ... MODIFY COLUMN followed by ALTER TABLE ... MATERIALIZE…
fixBackported in: Fixed Iceberg INSERT writing no lower_bounds/upper_bounds at all into the manifest entry when the table has a column whose type cannot be serialized into a statistics bound (for example Array(Int32)), or a column that is entirely NULL. Such a field is now omitted individually and…
fixBackported in: A table or database whose name is substituted into a ReplicatedMergeTree ZooKeeper path through the {database} or {table} macro is now rejected if the name would not be a single safe path component. Previously a name containing / was spliced in unescaped, so the table registered its…
fixBackported in: Fixed ATTACH TABLE ... AS REPLICATED and the convert_to_replicated flag file accepting a conversion whose ZooKeeper path is not a safe path. On a server whose default_replica_path substitutes {database} or {table}, a name containing / used to resolve to a path inside another table's…
fixBackported in: Fixes a case where date_time_overflow_behavior was ignored on parsing Date and DateTime. Closes. (Yarik Briukhovetskyi).
fixBackported in: Functions h3PolygonToCells and h3PolygonToCellsWithContainment now check for query timeouts and KILL QUERY while covering a polygon, and reject vertices whose longitude is outside -180..180 or latitude outside -90..90 degrees. Previously a polygon with such a vertex could keep a…
fixBackported in: Fix out of bound in timeSeriesGroupArray(). (Vitaly Baranov).
fixBackported in: Fixed SQL injection through identifiers when inserting into a table with the SQLite engine. The remote table name and the column names were escaped with backslashes, which SQLite does not honour inside a quoted identifier, so a name containing a double quote could close its own…
fixBackported in: Fix a crash when a client sends a block over the Native TCP protocol that selects the internal Detached serialization kind for a column. (Pavel Kruglov).
fixBackported in: KILL TRANSACTION ... ON CLUSTER, KILL PART_MOVE_TO_SHARD ... ON CLUSTER, SYSTEM STOP THREAD FUZZER ON CLUSTER, SYSTEM START THREAD FUZZER ON CLUSTER and SYSTEM RESET COVERAGE ON CLUSTER ran without checking any privilege, so a user holding only CLUSTER could roll back other users'…
fixBackported in: Fixed a SELECT from a table with paimon_incremental_read = 1 failing with REPLICA_IS_ALREADY_ACTIVE ("Failed to activate Paimon replica after Keeper reconnection") on the first read after the server's Keeper session was lost and re-established. Reclaiming the replica's own stale…
fixBackported in: Fix a patch part whose source_parts.dat lost its content to a zeroed block loading as an empty index, which silently unapplied an acknowledged lightweight UPDATE and then let background cleanup delete the only copy of it. Such a part is now detached as broken. (Alexey Milovidov).
fixBackported in: Fixed http_max_multipart_form_data_size silently truncating oversized multipart data instead of failing the query, and made it span a form's external-table parts instead of resetting per part. (Sema Checherinda).
fixBackported in: Fixed two ways a table with the Redis engine mishandled an MGET reply. Reading the whole table stopped at the first key without a string value and silently dropped every key scanned after it, so one key of another Redis type was enough to truncate the result. A reply carrying a…
fixBackported in: Fix count() returning the number of default values instead of the number of NULLs when optimize_trivial_count_with_sparsity_filter is used on a column widened to Nullable by a metadata-only ALTER TABLE ... MODIFY COLUMN. (Raúl Marín).
fixBackported in: Bound the header column count in RowBinary formats to avoid excessive memory allocation from a crafted header. (George Larionov).
fixBackported in: Fix INSERT INTO SELECT ... FROM url(...) (and s3, azureBlobStorage, ... ) with parallel replicas enabled inserting the data once per replica: the query forwarded to the replicas now names the *Cluster table function, so every replica reads only its share of the files. Closes.…
fixBackported in: Fix a server crash (std::terminate with write failed) in the embedded SSH client when the client's terminal was closed before the line reader was destroyed. (Alexey Milovidov).
fixBackported in: Fixed repeated reading of text index posting lists in multi-threaded queries when the global text index caches are disabled. (Anton Popov).
fixBackported in: Fixes a segmentation fault that happens when a refreshable materialized view is started up and shut down at the same time, for example when a failed ATTACH DATABASE rolls the database back, or when the server shuts down while tables are still loading asynchronously. (Groene AI).
fixBackported in: TRUNCATE ALL TABLES FROM and TRUNCATE TABLES FROM ... LIKE ... now skip Alias tables, which hold no data of their own. Previously such a statement could fail with LOGICAL_ERROR: RWLock is already locked in exclusive mode, truncate a target in another database, or fail when the alias…
fixBackported in: The text, tokenbf_v1, ngrambf_v1 and sparse_grams skip indexes are now used for IN when transform_null_in = 1 and the set contains no NULL. Previously such a query read every granule, and one using force_data_skipping_indices failed with INDEX_NOT_USED. (Jimmy Aguilar Mena).
fixBackported in: Fixed an out-of-bounds heap write in stem. The output buffer was sized from the input, but some stemmers lengthen a word (Turkish uag → uagı, Estonian keeb → keesi), so a block overran its allocation and returned uninitialized heap as result values. The buffer now grows when the…
fixBackported in: remote(, 'db', 'table', 'user', 'password'), and the same form of remoteSecure and of the Remote and RemoteSecure table engines, wrote the password into system.query_log, system.text_log and the server log in cleartext, while the remote('addresses_expr', ...) form hid it. The…
fixBackported in: Fix wrong values and a LOGICAL_ERROR when reading a partitioned Delta Lake table with allow_delta_kernel_rs = 0 and column types that differ from the ones in _delta_log. (Raúl Marín).
fixBackported in: Fixed a server crash when the flameGraph aggregate function was constructed on a thread without a query context, for example while attaching a stored table whose column type names AggregateFunction(flameGraph, ...). (Groene AI).
fixFixes a problem that MySQL/Postgres queries may run in an expired session. (Robert Schulze).
fixBackported in: Fix spurious NATS connection failures when the vendored nats-io client gets EINTR while waiting for a socket, and include the upstream JetStream pull-subscription deadlock fix in the vendored client. (Alexey Milovidov).
fixBackported in: Fix the flaky pre-PAUSE checkpoint in test_pause_stops_after_current_batch. (Groene AI).
fixBackported in: Fix flaky 01780_column_sparse: order the arrayFilter result before limiting it. (Alexey Milovidov).
fixFix 05237_delta_lake_legacy_partition_column_type in 26.7. (Raúl Marín).
+11 more items in the release notes
26.7.14.3 Sep 21, 2026 Release notes ↗
breakingBackported in: Outbound TLS connections now verify that the server certificate names the host that was connected to. This affects clickhouse-client --secure, remoteSecure(), Distributed over the secure native protocol, secure Keeper connections, and HTTPS clients such as s3(), url(), HTTP…
fixBackported in: Fixed an out-of-bounds read when reading a Variant column from a truncated Native stream using compact discriminators serialization. (Raufs Dunamalijevs).
26.7.13.12 Sep 20, 2026 Release notes ↗
fixBackported in: Fixed wrong results (the WHERE clause was ignored) and a logical error Cannot serialize FutureSetFromSubquery with no query plan for queries over Merge tables and the merge table function when plan-based parallel replicas were enabled. (Alexey Milovidov).
fixBackported in: Fix Logical error: Duplicate announcement received for replica number N when automatic parallel replicas (automatic_parallel_replicas_mode) adopts a plan whose single-node variant was sharded by query_plan_join_shard_by_pk_ranges. (Alexey Milovidov).
fixBackported in: Fix O(n^2) decompression of gzip/zlib/deflate streams whose single DEFLATE block spans the whole stream, the shape zlib-ng produces at compression level 1 (the default of the official .NET SDK): a 24 MiB gzip HTTP body that took 11 s to ingest in 26.7 now takes 0.12 s, identical to…
fixBackported in: Messages of the PostgreSQL wire protocol are now parsed within their declared size, so a malformed message can no longer make the server allocate memory for a payload that never arrives. (Alexey Milovidov).
fixBackported in: Fixed filesystem containment checks accepting a path with an embedded NUL byte. A DeltaLakeLocal or IcebergLocal table could be pointed outside of user_files this way. (Alexey Milovidov).
fixBackported in: Fix a server abort when an Azure Blob Storage endpoint reports an asynchronous blob copy as completed without the optional x-ms-copy-source or x-ms-copy-status-description header. (Alexey Milovidov).
otherBackported in: Use cctz tzdata 2026c. (Konstantin Bogdanov).
featureBackported in: The comments of 04367_lambda_arg_backquoted_dot_no_logical_error (added contain the literal wording of the assertion-failure log message the test guards against. The test's expected TYPE_MISMATCH errors echo the full query text — comments included — into the server log, and the CI…
fixBackported in: Fixed 01076_parallel_alter_replicated_zookeeper silently testing nothing when its ALTER thread and its DETACH thread picked the same replica. (Groene AI).
otherBackported in: Pin 05182_limit_shrinks_block_size_with_array_join's two per-node oracles to a single local reader, and pin the remote prefetched-pool eligibility its plan-shape oracle needs on object-storage runs. (Groene AI).
otherBackported in: Shrink the t_aj_limit fixture in 05182_limit_shrinks_block_size_with_array_join from 200000 to 20000 rows. (Groene AI).
26.7.12.6 Sep 19, 2026 Release notes ↗
fixBackported in: A small LIMIT on a query with arrayJoin shrinks the read block size again, so such queries no longer read whole blocks on every thread for a few output rows (a regression from 26.6, Closes). (Yarik Briukhovetskyi).
fixBackported in: Do not terminate the server when a transient error (such as MEMORY_LIMIT_EXCEEDED, a network error, or SYSTEM RESTART REPLICA running at the same time) happens while outdated data parts are being loaded in the background. Such errors are not a sign of an inconsistent set of parts on…
fixBackported in: Fix UNKNOWN_IDENTIFIER errors in INSERT ... SELECT from a parameterized view when parallel_distributed_insert_select is enabled. the view was analyzed with the legacy interpreter even though the analyzer was enabled. (Yarik Briukhovetskyi).
fixBackported in: Fixed a HDFS database serving a table from its internal cache without the READ ON HDFS grant. The grant and the remote_url_allow_hosts filter were checked only while a table name was resolved for the first time, so once any user holding the grant had read a name, every user with…
otherBackported in: Wait for DETACH DATABASE to release tables in three integration tests. (Groene AI).
26.7.11.16 Sep 18, 2026 Release notes ↗
otherBackported in: Parsing an HTTP request that carries many query parameters or headers with the same name (for example thousands of repeated role= parameters) no longer takes quadratic time. (James).
otherBackported in: LEFT and FULL JOIN with join_use_nulls = 1 use less memory when the right join key is selected in the query: the key is no longer stored twice on the build side. (Vladimir Cherkasov).
featureBackported in: Added output_format_arrow_record_batch_size and output_format_arrow_record_batch_size_bytes, which make the Arrow and ArrowStream output formats combine consecutive blocks that are individually smaller than the target into a single record batch. A selective SELECT produced one small…
fixBackported in: Fix a race between a ReplicatedMergeTree mutation and the removal of old temporary directories that could publish a mutated part with some of its files missing, making reads of that part and all its later mutations fail. (Alexey Milovidov).
fixBackported in: Fix reading a column that has two streams whose names differ only by escaping, for example a Tuple element named size0 inside an Array, or a JSON typed path named like a substream of a sibling path. Such columns returned wrong values, failed with CANNOT_READ_ALL_DATA or a logical…
fixBackported in: Fix LOGICAL_ERROR: GroupingAggregatedTransform pushed bucket N twice when make_distributed_plan picks the Shuffle aggregation strategy while the aggregation must produce results in bucket order (for example with distributed_aggregation_memory_efficient). It is now planned as a…
fixBackported in: Make mergeTreeTextIndex stricter with row policies: reading the text index is now denied whenever a row policy applies to the table, regardless of which columns the policy uses. (Elmi Ahmadov).
fixBackported in: Fixed ClickHouse Keeper terminating when a client sent a multi request with no subrequests. Such a request was written to the changelog before it failed, so the termination repeated on every restart. (Alexey Milovidov).
fixBackported in: Fixed PARALLEL WITH, EXECUTE AS and the QueryRunner table engine skipping the access checks of the CREATE statements they execute, which allowed creating tables and databases without the corresponding privileges, and defeated the readonly and allow_ddl settings. (Alexey Milovidov).
fixBackported in: Iceberg tables recovered from stored metadata no longer enable background compaction or old-file cleanup unless those settings are explicitly stored in the table definition. (János Benjamin Antal).
fixBackported in: Fixed a NATS table whose settings all come from a named collection (ENGINE = NATS(collection) with no SETTINGS clause) being written to its metadata file with a dangling SETTINGS keyword. The stored definition could not be parsed again, so the table failed to load and aborted the…
fixBackported in: Now ClickHouse reject relative paths in checksums.txt. (alesapin).
fixBackported in: Fix S3 client refresh overwriting static authentication settings and breaking subsequent queries. (alesapin).
otherBackported in: Wait for replication before asserting a row count in test_rename_distributed. (Groene AI).
otherBackported in: Not required (CI only). (Groene AI).
26.7.10.6 Sep 16, 2026 Release notes ↗
fixBackported in: Fix the MULTIPLE_EXPRESSIONS_FOR_ALIAS error in queries where a column alias coincides with the alias of a table expression in the FROM section (an analyzer regression in version 25.2). (Alexey Milovidov).
fixBackported in: Fix partition pruning and primary key filtering being silently disabled when parallel_replicas_min_number_of_rows_per_replica is set inside a subquery or CTE instead of at top query level. (Yarik Briukhovetskyi).
fixBackported in: Each code for Time-based one-time password is now accepted at most once, as required by RFC 6238: reusing an already used code, or a code for an earlier time step, is rejected. A user with time_based_one_time_password can successfully authenticate at most once per period. (Vladimir…
fixBackported in: Fixed the byte width of the Iceberg manifest lower_bounds and upper_bounds written for int and date columns: they were 8 bytes wide where the Iceberg specification requires 4. Spec-conformant readers such as pyiceberg failed with unpack requires a buffer of 4 bytes while planning…
otherBackported in: Split the ASan integration test jobs into eight batches. (Alexey Milovidov).
26.7.9.12 Sep 15, 2026 Release notes ↗
otherBackported in: Bump the internal libssh from 0.12.0 to 0.12.2. (Robert Schulze).
fixBackported in: Fix a logical error Invalid cast from Nothing to native type (an abort in debug/sanitizer builds) when compile_expressions = 1 compiled an expression with a Nullable(Nothing) operand, e.g. and(Nullable(Nothing), ). (Groene AI).
fixBackported in: Fixes a case where date_time_overflow_behavior = 'saturate', an out-of-range value is clamped to the whole second and the sub-second component is discarded. Closes. (Yarik Briukhovetskyi).
fixBackported in: Fix a segmentation fault when reading in order from a Merge table over MergeTree tables whose sorting key is shorter than the key prefix chosen for the query: the prefix was forwarded to the underlying reader unchecked, which grew its cloned sorting-key expression list to that…
fixBackported in: Fix rows silently dropped by an ngrambf_v1 index for a LIKE pattern with a run of escaped backslashes before a wildcard. (Alexey Milovidov).
fixBackported in: Fixed optimize_or_like_chain returning extra rows for OR chains of LIKE/ILIKE patterns that do not end in %: a value followed by a trailing newline wrongly matched the filter. (Jimmy Aguilar Mena).
fixBackported in: Fixed an ALTER on a view or materialized view with SQL SECURITY DEFINER deleting the auto-created :definer account when the ALTER did not change the definer. Every later SELECT from the view, and every INSERT into a materialized view's source table, then failed permanently with…
fixBackported in: Fixed cleartext credentials in system.asynchronous_insert_log.query. Secrets of table functions such as s3, url or mysql are now masked as [HIDDEN], the same way system.query_log masks them. (Sema Checherinda).
fixBackported in: Fixed the server not validating the schema of the second and subsequent data blocks that a client sends for an external table over the native protocol. Such a block could make the data be interpreted as a type other than the one it was sent as. (Alexey Milovidov).
fixBackported in: Fixed a crash of the server caused by a table with ENGINE = NATS whose credentials the broker started to reject, for example after a password rotation or on an expired token. Such a table now recreates its connection and resumes consuming once the credentials are accepted again,…
fixBackported in: Fix flaky test_filesystem_split_cache::test_split_cache_system_files_no_eviction. The baseline System-segment count was sampled straight after wait_for_cache_initialized, which only reports that the cache became usable while background loading keeps adding segments, so the baseline…
26.7.8.15 Sep 14, 2026 Release notes ↗
featureBackported in: Fix duplicated GROUP BY keys in the partial aggregation strategy of make_distributed_plan, and allow this strategy for aggregations over a distributed read. (Alexander Gololobov).
otherBackported in: Write partition field summaries into the Iceberg manifest list. (Konstantin Vedernikov).
otherBackported in: Support parallel replicas for object storage writes. (Konstantin Vedernikov).
fixBackported in: Fixed a LOGICAL_ERROR (Type mismatch when building statistics for column) during a MergeTree mutation of a table whose column type was changed by a metadata-only ALTER MODIFY COLUMN (for example Enum8 to Int8 or DateTime to UInt32) while the column carries statistics. The mutation…
fixBackported in: Fixed a crash when reading a subcolumn of a Variant, Dynamic or JSON column whose own type is Nullable or LowCardinality(Nullable) from a MergeTree table, for example SELECT value.Tuple(a Nullable(UInt32), b String).a over a Dynamic column. Previously such a read hit a LOGICAL_ERROR…
fixBackported in: Fixed Iceberg INSERT writing manifest-wide aggregate column statistics into every data_file entry when a partition produced more than one data file. Each entry's null_value_counts, column_sizes, lower_bounds and upper_bounds now describe only the data file it points at. Previously…
fixBackported in: Fixes a server abort in debug and sanitizer builds when inserting into a materialized view whose TO target is another materialized view. Such an insert already failed on released versions, with an uninformative Code: 1001 STD_EXCEPTION; it now reports NOT_IMPLEMENTED naming the…
fixBackported in: Fixed a server that refused to start after the directory backing a Filesystem database had been removed. Such a database is now loaded without tables and can be inspected and dropped, while a CREATE DATABASE or ATTACH DATABASE issued by a user is still rejected when the path does…
fixBackported in: Don't use backoffs on concurrent inserts conflicts (when we use Iceberg + catalog, for example). (Konstantin Vedernikov).
fixBackported in: Fixed a crash and a LOGICAL_ERROR for statements that write trim(BOTH '' FROM x) (or the LEADING/TRAILING spelling) where a function is expected: a column's STATISTICS(...) or CODEC(...) list, INDEX ... TYPE, ALTER TABLE ... ADD STATISTICS, auto_statistics_types, a table function, a…
fixBackported in: Fixed a stack buffer overflow when reading a BIT column from MySQL, reachable through the mysql table function, the MySQL table and database engines, and MySQL dictionaries. The length of the value sent by the server was copied without being validated. (Alexey Milovidov).
fixBackported in: Fix flaky 04408_array_fold_cancellation under sanitizers. (Groene AI).
otherBackported in: Make the 04780 index-analysis allocation oracle the minimum of several runs. (Alexey Milovidov).
otherBackported in: Do not leave a Filesystem database pointing at a removed directory, which makes the server refuse to start. (Alexey Milovidov).
26.7.7.92 Sep 13, 2026 Release notes ↗
breakingBackported in: Reading a File source with rename_files_after_processing set now requires the WRITE ON FILE grant on top of READ ON FILE, on the initiator for fileCluster: the setting renames the files a SELECT has read, which is a write to the source, and it used to happen for anyone who could…
featureBackported in: Jemalloc Fragmentation Profiler. (Azat Khuzhin).
fixBackported in: Fix performance regression introduced in 26.4 when writing JSON and Dynamic columns in text formats. (Pavel Kruglov).
fixBackported in: Fixed a CPU regression for queries that issue many independent small reads against the same MergeTree part when the table has LowCardinality columns. The check deciding whether a part has a single shared dictionary scanned every mark of the whole part on each read task; it now finds…
fixBackported in: Fixes silent data loss for TTL expressions that apply large intervals directly to Date / DateTime source columns by widening the arithmetic away from 16/32-bit overflow. (BoloniniD).
fixBackported in: Fixed incorrect SQL literal escaping in StorageSQLite and sqlite() table function when pushing WHERE predicates to SQLite: single quotes and control characters (\n, \r, \t, ) were escaped with backslashes, which SQLite does not interpret, causing syntax errors or wrong query…
fixBackported in: Fixed SQL injection in the PostgreSQL wire protocol emulation. Prepared-statement parameters — the Parse/Bind/Execute extended-query path used by psycopg2, JDBC, node-postgres, Npgsql and others, and the simple-query EXECUTE path — were substituted into the executed SQL by raw…
fixBackported in: Rejects non-monotonic Array offsets on every read path that decodes them as absolute values, instead of only in the Native format. A corrupt set skip index granule previously passed unchecked and was then read out of bounds. (Groene AI).
fixBackported in: Fixed a privilege-escalation gap where the executable table function did not enforce the TABLE ENGINE ON Executable grant. With table_engines_require_grant enabled, a user denied CREATE TABLE ... ENGINE = Executable could still run the same server-side script via SELECT ... FROM…
fixBackported in: Fixed potential data loss when an INSERT into ReplicatedMergeTree was cancelled or timed out while ClickHouse was recovering an uncertain Keeper commit. (kakao-tars-case).
fixBackported in: Fixed a SQL injection in the PostgreSQL metadata queries. The schema of the PostgreSQL database engine, the requested column names and the publication name were formatted into SQL literals without escaping, so a value containing a quote could execute arbitrary SQL on the connected…
fixBackported in: Fix count() on Iceberg tables whose snapshot summary is inaccurate or corrupted: the trivial count optimization now derives exact row counts from the manifest files, and falls back to a real scan when row-level deletes make metadata counts inexact. Also fix Iceberg OPTIMIZE TABLE…
fixBackported in: Fix Iceberg tables written by ClickHouse being unreadable by external readers (PyIceberg, Spark). The Avro schemas embedded in the manifest-list and manifest files omitted the Iceberg field-id properties, so scan planning failed with Cannot convert field, missing field-id. (Groene…
fixBackported in: Fix allow_feature_tier rejecting merge_tree_-prefixed settings in settings profiles as unknown, and rejecting CREATE TABLE because of MergeTree settings set by the server through compatibility or the merge_tree config section. Also fix constraints on a merge_tree_-prefixed setting…
fixBackported in: Fixed LOGICAL_ERROR when reading a table with a set skip index defined on an expression and the query repeats that expression with a Nullable operand, for example WHERE intDiv(id, (SELECT 1000)) = 3 over INDEX b_set intDiv(id, 1000) TYPE set(100). A scalar subquery is enough to…
fixBackported in: Fixed a data race and a use-after-free on the metadata of a DeltaLake or Iceberg table. Two concurrent queries that read total_rows or total_bytes from system.tables for the same table could have one query replace the table's metadata while the other was still reading it, which…
fixBackported in: Fix wrong statistics part pruning for negated float predicates with NaN. (Han Fei).
fixBackported in: Fixes memory leaks of abandoned nested aggregate states. (Groene AI).
fixBackported in: Apply remote_url_allow_hosts before SQL-supplied S3 and Azure endpoints send schema, metadata, or container requests. (Rory Shanks).
fixBackported in: Fixed a LOGICAL_ERROR: Context has expired exception when a stored expression containing accurateCastOrDefault or a toOrDefault function is evaluated after the query that created it has finished, for example a MATERIALIZED column default on INSERT or a mutation expression. (Groene…
fixBackported in: Fix wrong results when a filter on a combined literal+sub-object JSON subcolumn (json.@a) was analyzed against a JSONAllPaths skip index: the subcolumn was treated as a path literally named @a `, so all granules were skipped and the query returned fewer rows than it should. (Pavel…
fixBackported in: Fixed incremental backups to Azure Blob Storage storing the beginning of each file instead of its tail. Restoring such a backup silently dropped all the data written after the base backup. (Smita Kulkarni).
fixBackported in: Fixed an exception (Block structure mismatch in Expression for FilterSortedStreamByRange) for some SELECT ... FINAL queries with PREWHERE over a table whose sorting key is an expression. (Shaohua Wang).
fixBackported in: Fixed silently incorrect results and undefined behavior when reading a malformed AggregateFunction(uniq, ...) state. The skip_degree field of the serialized state was used as a shift exponent without validation, so an out-of-range value produced an arbitrary cardinality instead of…
fixBackported in: Fixed wrong results from if, multiIf and CASE when one branch is a Date or Date32 and the result type is DateTime or DateTime64. With compile_expressions = 1 (the default) the compiled expression copied the date's day count into the timestamp column without converting days to…
fixBackported in: Fix a case where expensive ZooKeeper exception logging could delay session finalization and leave pending requests unresolved. (Antonio Andelic).
fixBackported in: Fix GroupingAggregatedTransform producing duplicate chunks for the same bucket. (Nikita Taranov).
fixBackported in: Reject a bare carriage return (\r), in addition to a line feed (\n), in HTTP header names and values that pass through the HTTP header filter. This closes an HTTP header injection (request/response splitting) gap for features that pass user-provided headers, such as the url table…
fixBackported in: Fix an integer overflow in the deserialization of String values in the binary formats, and bound the recursion of the binary deserialization of Dynamic and JSON values. (Alexey Milovidov).
fixBackported in: Fix a use-after-free in the gRPC server when a query with a streaming input finishes while a read of the next message is still in flight. (Alexey Milovidov).
fixBackported in: Fix LOGICAL_ERROR: No available columns when a query reads no columns from a table expression that has no columns at all, for example SELECT count() FROM loop(db, tbl) where tbl is an Alias table whose target was dropped, or a parameterized view. Such a query now fails with…
fixBackported in: Fixed ILLEGAL_COLUMN ("Cannot convert column ... because it is non constant in source stream but must be constant in result") for a query combining ARRAY JOIN with a filter on an empty IN set, whether the set is an empty list such as SELECT count() FROM t ARRAY JOIN [b] AS x WHERE a…
fixBackported in: Fixed the Unexpected return type from materialize logical error when reading a column that has a text index through the index after a metadata-only or not-yet-materialized ALTER MODIFY COLUMN (including lazy JSON type hints) that requires a read-time type conversion. (Pavel Kruglov).
fixBackported in: Fixed h3Line returning uninitialized memory in the tail of the result array when a line between two valid H3 indices cannot be drawn because it crosses pentagon distortion. Such a call now throws INCORRECT_DATA. (Groene AI).
fixBackported in: Fixed wrong results from sumKahan when the aggregated batch does not start at the first row of the block. sumKahanIf, and sumKahan over a Nullable argument, tested each row against the wrong element of the condition or null map, returning silently incorrect sums inside window frames…
fixBackported in: Fixed reading uninitialized memory as literal data when decompressing a malformed LZ4-compressed block. (Alexey Milovidov).
fixBackported in: Fixed a stack overflow when reading hadoop-snappy data containing many blocks that decode to nothing. (Alexey Milovidov).
fixBackported in: The handshake response of the MySQL wire protocol is now bounded, so a client can no longer make the server grow memory during the handshake. The mysql_require_secure_transport server setting is now enforced from the actual state of the connection instead of a capability bit…
fixBackported in: Sizes declared by a server in the Native protocol no longer make the client allocate memory for data that has not arrived: exception strings are read as they arrive, the decompressed size of a block is bounded, and the maximum number of rows in a Native block is now a billion.…
featureBackported in: Internal follow-up correcting an implementation detail from an unreleased change; no user-visible behavior change beyond restoring the intended performance characteristics of https://github.com/ClickHouse/ClickHouse/pull/115852 for Dynamic(JSON) text output. (Nikita Fomichev).
+51 more items in the release notes
26.7.6.57 Sep 1, 2026 Release notes ↗
featureBackported in: Bounded the cost of estimating the selectivity of col IN (...) from column statistics, which could add hundreds of milliseconds to the planning of a single query. The estimator no longer runs the subquery behind col IN (subquery) to fill a set it only needs one selectivity number…
fixBackported in: Fixed a performance regression where a query combining a text index filter with ORDER BY ... LIMIT stopped answering the filter from the index and read the whole text column instead. (Jimmy Aguilar Mena).
fixBackported in: Fixed a performance regression since 26.6: a query filtering a Nullable column with IN (subquery) read the whole table instead of skipping the read when the subquery returned no rows. Closes. (Yarik Briukhovetskyi).
featureBackported in: Added a new MergeTree setting text_index_version that controls the on-disk format version of text indexes: v0_initial, v1_with_codec, or v2_with_positions. During a rolling upgrade or before a downgrade, set it to an older version so that newer servers keep writing text index parts…
featureBackported in: Added fs cache download wait timeout configured by filesystem_cache_wait_for_concurrent_download_timeout_milliseconds. This timeout defined only the wait for a single chunk (buffer bytes of ~1mb) of data, not the whole file segment. (Kseniia Sumarokova).
fixBackported in: Fixed Kafka tables using kafka_sasl_mechanism = 'AWS_MSK_IAM' failing authentication once an hour with SASL authentication error: Access denied. The OAUTHBEARER token lifetime advertised to librdkafka is now capped by the remaining validity of the AWS credentials that signed the…
fixBackported in: Constant folding during query planning no longer executes a function whose argument type differs from the type the function was resolved for during analysis. Such a mismatch used to raise a LOGICAL_ERROR while the output header was being computed, which is an assertion failure in…
fixBackported in: Fix a data race (and rare crash) when a parsing/analysis error is reported while reading a file/object storage table. A parse error raised during lazy KeyCondition initialization was shared as a single exception object across reader threads, and two threads could concurrently append…
fixBackported in: Fix CREATE OR REPLACE leaving the replaced object behind under an internal name when the caller lacks the drop privilege on it. (Nikolay Degterinsky).
fixBackported in: Fixes a bloom_filter skip index dropping granules that contain matching rows when a String or FixedString column is compared for equality against a constant that is wider than the indexed type, so that queries such as SELECT count() FROM t WHERE s = toFixedString('abc', 5) no longer…
fixBackported in: Fixes two cases where an AWS Glue DataLakeCatalog database reported a table as absent instead of reporting an error. SHOW TABLES and system.tables no longer fail with DATALAKE_DATABASE_ERROR ("Exception calling GetTables ... not found") when a Glue database is absent while its…
fixBackported in: Fixed Logical error: 'Files metadata is empty' when reading from, altering, or flushing an S3Queue/AzureQueue table whose metadata handle is gone: concurrently with a DROP/DETACH, after a failed startup, or after a failed DROP. Such a table now reports TABLE_IS_DROPPED instead.…
fixBackported in: Fix a crash for ORDER BY ALL in a WINDOW VIEW, and UNKNOWN_IDENTIFIER errors for INTERPOLATE, WINDOW and LIMIT BY in a query over a Merge or Distributed table with a join, with the old analyzer. (Alexey Milovidov).
fixBackported in: Fixes ORDER BY ... LIMIT queries on Tuple() columns raising a NOT_IMPLEMENTED exception when top-K dynamic filtering is enabled. Direct empty tuples now skip the optimization, while supported nested composite types continue to use top-K filtering. (Langning Zhang).
fixBackported in: Fix std::out_of_range: map::at: key not found when a MergeTree key expression contains a mortonEncode or hilbertEncode call that is not itself a key column, for example ORDER BY mortonEncode(hilbertEncode(x, y), x, y) or PARTITION BY mortonEncode(x, y) % 4. (Groene AI).
fixBackported in: Register Iceberg namespace in the catalog before writing table files (needed for SeaweedFS). (Azat Khuzhin).
fixBackported in: Fixes a server abort (Logical error: Part patch-... doesn't exist) when a DROP TABLE runs concurrently with a lightweight UPDATE on a ReplicatedMergeTree table. The update now holds the table's shared lock until its patch part is committed, so the DROP waits instead of removing it.…
fixBackported in: The AI-function quota settings (ai_function_max_api_calls_per_query, ai_function_max_input_tokens_per_query, ai_function_max_output_tokens_per_query) were enforced per block rather than per query, letting a query exceed the configured limit in proportion to the number of blocks and…
fixBackported in: Fixed a hang when dropping a TimeSeries table whose name sorts lexicographically below its inner tables' names, for example DROP TABLE -ts or dropping a materialized view declared with ENGINE = TimeSeries. The drop self-deadlocked on the DDL guard and could not be cancelled with…
fixBackported in: Fixed an out-of-bounds read while deserializing corrupted posting lists of a text index. (Anton Popov).
fixBackported in: Fixed a row policy bypass where the mergeTreeIndex table function exposed primary key and minmax index values of the rows hidden by a SELECT row policy on the source table; reading mergeTreeIndex for a table with a row policy is now denied. (Yarik Briukhovetskyi).
fixBackported in: Fixes asynchronous inserts into JSON columns ignoring the max_dynamic_subcolumns_in_json_type_parsing setting. Previously, an asynchronous insert (async_insert = 1) could store more dynamic paths than the setting allows, giving a different column layout than a synchronous insert…
fixBackported in: Fixed a bypass of settings constraints: SET = DEFAULT reset a setting without checking the constraints from the user's profile, so a MIN/MAX/CONST constraint could be escaped by resetting the setting instead of assigning to it, and a session could leave readonly mode with SET…
fixBackported in: Fixed a settings-constraint bypass: a SETTINGS clause inside a subquery, a CTE or a view's inner query was applied without checking the settings constraints, so it could be used to leave readonly mode or to override a CONST, MIN or MAX constraint (for example…
fixBackported in: Validate Variant discriminator in ColumnVariant arena deserialization. (Azat Khuzhin).
fixBackported in: Fix read_rows, read_bytes, written_rows and written_bytes in system.query_thread_log reporting a thread lifetime running total instead of the values for the logged query. Rows of long-lived pooled threads, in particular the query's initiating HTTPHandler thread, were affected.…
fixBackported in: Allow KeeperMap readers to accept shared metadata when equivalent primary keys differ only by redundant outer parentheses. (Sergey Kuznetsov).
fixBackported in: Fixed a bug in the function formatRowNoNewline that could produce incorrect results or a logical error when a row is formatted to an empty result. (Alexey Milovidov).
fixBackported in: Fix server crashes on deeply nested input in readWKB, JSONMergePatch, the address parser of the url/remote/cluster/mysql/postgresql table functions, the CURSOR clause parser and the CapnProto schema parser. Fix a crash in the parser of the EXECUTE statement when an argument is not a…
fixBackported in: Validate the states of the stochasticLinearRegression, stochasticLogisticRegression, groupUniqArray, groupArrayIntersect and topK aggregate functions and of the Resample combinator on deserialization: a malformed state could be read out of bounds. (Alexey Milovidov).
fixBackported in: Fix crashes of the Parquet, ORC and Iceberg readers on malformed input: a DELTA_BYTE_ARRAY page with an empty length stream, a DELTA_BYTE_ARRAY page of a Decimal column read under a filter, an out-of-range enum in an Iceberg manifest file and an oversized allocation in the ORC…
fixBackported in: Do not return uninitialized memory in the result of a binary string literal whose length is not a multiple of eight, and from the LZ4 decompressor when a compressed block has no body. (Alexey Milovidov).
fixBackported in: Fix a crash of a window function over a Tuple with a sparse element, for example groupConcat(t) OVER (). (Alexey Milovidov).
fixBackported in: Bound the size of the startup message of the PostgreSQL wire protocol, which is read before authentication. (Alexey Milovidov).
fixBackported in: Reject unsupported and mixed read/write operations in ZooKeeper multi requests. (Antonio Andelic).
fixBackported in: Mask the aws_external_id setting of the DataLakeCatalog database engine in SHOW CREATE DATABASE and system.databases.engine_full. It was previously printed in plaintext, unlike the other AWS credential settings. Closes:. (Groene AI).
fixBackported in: Reject invalid names of projections and indexes. (Alexander Tokmakov).
fixBackported in: Add Objects' paths to deduplication hashing, preventing incorrect deduplication. (Mikhail f. Shiryaev).
fixFixed a TABLE ENGINE privilege bypass in the URL table engine. A user granted only TABLE ENGINE ON URL could ATTACH TABLE ... ENGINE = URL('file://...') (or s3://, az://, hdfs://) and read through it, because the privilege re-check on the backend the scheme dispatches to ran only for CREATE. It…
featureBackported in: This patch: 1. Removes the global error screen (blue screen) and replaces it with a note above the dashboards. In this approach, on any error, already fetched graphs will not be hidden. 2. Dashboard now opens the graphs view immediately. 3. Reload button and any other button can be…
+16 more items in the release notes
26.7.5.10 Aug 21, 2026 Release notes ↗
fixBackported in: Serialize a Nullable(Tuple(...)) column as a single CSV field instead of flattening it into separate columns. Previously a non-null value was written as several CSV fields while a NULL was a single \N, giving a row-dependent column count that broke CSVWithNames/CSVWithNamesAndTypes…
fixBackported in: Fix a theoretical data race in profile events when using the trace_profile_events_list setting to write stack traces of certain profile events to system.trace_log. (Miсhael Stetsyuk).
fixBackported in: Fix Logical error: No set is registered for key ... when reading through a Merge table whose child declares an ALIAS column containing IN, and the children disagree about that column's default. (Groene AI).
fixBackported in: Reject corrupted/malicious dictionary where lcp exceeds the previous token or lcp + data_size overflows, before the buffer write. (Elmi Ahmadov).
fixBackported in: Fixes a bug where an access entity carrying a Map-valued setting, such as a settings profile with http_response_headers or additional_table_filters, is stored in a form that ClickHouse cannot read back, leaving the entity permanently unloadable after a restart. (Groene AI).
fixBackported in: Fixes has, indexOf, countEqual, mapContainsKey, mapContainsValue and Map subscript returning "not found" for a constant LowCardinality needle equal to the element type's default value, such as an empty String or a zero number. (Groene AI).
fixBackported in: Fix propagation of query settings and NULL handling in accurateCastOrDefault. (Alexey Milovidov).
fixBackported in: Fixed wrong results for SELECT count(arrayJoin(arr)) with the default optimize_trivial_count_query = 1. The stored row count was returned instead of the number of array elements, and on file() and url() the query returned 0. Closes. (Groene AI).
fixBackported in: Fixed uniq, uniqExact, uniqHLL12 and uniqTheta returning a wrong result for an argument wrapped in an injective function that hides nullability, such as uniqExact(tuple(x)) over a Nullable column. The optimize_injective_functions_inside_uniq optimization removed the wrapping…
26.7.4.58 Aug 19, 2026 Release notes ↗
fixBackported in: Fix a ~1.5x performance regression introduced in 26.5 in GROUP BY over Dynamic keys and over JSON path subcolumns. (Utkal Singh).
fixBackported in: Added the setting analyzer_compatibility_multiple_joins_qualify_column_names (default false). When enabled and the FROM clause of a query contains two or more JOINs, result column names produced by the analyzer mimic the old analyzer's multiple-joins rewrite: columns expanded from…
fixBackported in: Reject unsupported uses of AggregateFunction columns in TTL expressions at CREATE TABLE time (e.g. TTL toDateTime(state)) instead of failing later during TTL execution with ILLEGAL_TYPE_OF_ARGUMENT. This also covers states carried inside Variant alternatives and Dynamic values.…
fixBackported in: Fix possible logical error "Unexpected substream ... for column ..." during bump of compatibility setting. (Pavel Kruglov).
fixBackported in: Fix propagation of settings in accurateCastOrDefault. Closes. (Pavel Kruglov).
fixBackported in: Fixed a LOGICAL_ERROR ("Bad cast from ColumnString to ColumnLowCardinality") during primary-key index analysis when a LowCardinality key column is wrapped in a nested CAST chain that re-introduces LowCardinality, e.g. WHERE CAST(CAST(s, 'LowCardinality(String)'), 'String') < '5'. In…
fixBackported in: RESTORE now fsyncs the restored part files when the destination table has fsync_after_insert enabled, so a restored part is as durable against power loss as an inserted one. Previously restored files were only written and closed (never fsynced), so a power loss right after RESTORE…
fixBackported in: Fixed made_current_at in system.iceberg_history becoming 1970-01-01 for a retained snapshot after ALTER TABLE ... EXECUTE expire_snapshots on an Iceberg table. Also fixed system.iceberg_history returning no rows for a table whose metadata has no snapshot-log. (Groene AI).
fixBackported in: Fix a logical error Block structure mismatch in IntersectOrExceptStep stream: different number of columns that could happen when the filter split optimization (query_plan_split_filter) ran on a WHERE whose filter column name is also an input column name. The optimization left an…
fixBackported in: Fixed a stack frame being displayed as ? instead of its function name in fatal log messages and in the trace_full column of system.crash_log. It affected frames of ordinary functions that have code attributed to a libc++ __functional header, which is common in release builds.…
fixBackported in: Fixed a server abort (SIGABRT) when a BUFFERED_V1 WebAssembly UDF returns an empty result buffer; the query now fails with a catchable WASM_ERROR and the server stays up. (Nikolai Ovchinnikov).
fixBackported in: Fixed a use-after-free when a JOIN with join_algorithm = 'direct' onto a dictionary was given a join key that is stored with sparse serialization. getColumnVectorData returned a reference to a temporary column, so the dictionary lookup read freed memory: release builds could return…
fixBackported in: Fixes cases where row policy was not used for MergeTree Projections during query execution. (Yarik Briukhovetskyi).
fixBackported in: Fix out-of-bounds read in SerializationReplicated on the native protocol on corrupted indexes data. (Pavel Kruglov).
fixBackported in: Fix data races in profile events and memory tracker. (Miсhael Stetsyuk).
fixBackported in: Security related bugfix. (Kseniia Sumarokova).
fixBackported in: Fixed a crash when reading a Parquet file with inconsistent bloom filter metadata. Such files could also silently return fewer rows than they should. (Shaohua Wang).
fixBackported in: Fix AsynchronousBoundedReadBuffer's readBigAt data race. Closes. (Kseniia Sumarokova).
fixBackported in: Fixed the logical error SortingAggregatedTransform already got bucket with number N that could occur in multi-layer distributed GROUP BY queries using two-level aggregation. (Nikita Taranov).
fixBackported in: Fixes wrong results for a JOIN whose ON clause carries a mixed condition, that is a cross-side non-equi residual such as ON (t1.key = t2.key) AND (t1.a * 10 < t2.a). Only the hash family evaluates such a condition, but full_sorting_merge, partial_merge and the direct key-value join…
fixBackported in: Fix DROP TABLE and SYSTEM STOP VIEW hanging when a Refreshable Materialized View is blocked while planning its refresh query. (Nikolay Degterinsky).
fixBackported in: Fixed a case where CREATE TABLE ... ENGINE = Distributed(...) without a column list could reveal the structure of a local table the creating user is not allowed to see. For a CREATE the local server executes itself, the structure is now inferred under the user's own context, so SHOW…
fixBackported in: Fixed reading the internal _temporary_and_external_tables database through the merge table function and the Merge table engine, which allowed one session to read the temporary tables of other sessions and other users, and caused an exception on the old analyzer path. A database…
fixBackported in: Fixed wrong results when a hash join has a single LowCardinality key of a type wider than 8 bytes (UInt128, Int128, UInt256, Int256, and their Nullable variants). Such a join silently returned rows whose key values are not equal. (Groene AI).
fixBackported in: Fixed a query plan optimization stall when a WHERE clause contains a large string constant with many dots and the table carries a bloom_filter, tokenbf_v1, ngrambf_v1 or text skip index. Matching a filter column name against JSONAllPaths(...) index columns enumerated every dot split…
fixBackported in:. (Vladimir Cherkasov).
fixBackported in: Fixed a case where CREATE TABLE ... ENGINE = Buffer(...) without a column list could reveal the structure of a destination table the creating user is not allowed to see. For a CREATE the local server executes itself, the structure is now inferred under the user's own context, so…
fixBackported in: Fixed ATTACH of a Kafka table when kafka_num_consumers exceeds the limit derived from the number of CPU cores. (Nikolay Degterinsky).
fixBackported in: Fixed reading Paimon tables that contain a nullable ARRAY or MAP column. Such a table could not be read at all, because the schema mapper wrapped the composite type in Nullable, which ClickHouse forbids, so both DESC and SELECT failed with Nested type Array(Nullable(Int32)) cannot…
fixBackported in: Fix part and granule pruning for a JOIN ON condition involving constant columns of the other side. (Vladimir Cherkasov).
fixBackported in: Fix wrong results and, in a build with assertions enabled, an aborted assertion for a JOIN onto a dictionary whose ON clause has a non-equi condition over both tables, such as ON (t.key = d.key) AND (t.a * 10 < d.a), when join_use_nulls is enabled. The condition was evaluated over a…
fixBackported in: Fixed a row policy containing a scalar subquery being evaluated only once and then reused forever after the table had been read through a Merge table. The parsed policy condition is cached and shared by all queries, and reading it through Merge rewrote the cached expression in…
fixBackported in: Fixed made_current_at in system.iceberg_history reporting the earliest time a snapshot became current instead of the latest one, when the same snapshot-id appears more than once in the Iceberg snapshot-log (as a rollback leaves it). (Groene AI).
fixBackported in: Fix a wrong value returned for a virtual column such as _table or _database selected from the right side of a JOIN served by DirectKeyValueJoin (a key-value storage such as EmbeddedRocksDB, KeeperMap, Redis, or a dictionary). The query returned the contents of a data column instead,…
fixBackported in: Fix CANNOT_CONVERT_TYPE and an exception in GroupingAggregatedTransform when reading a Merge table with one child being a Distributed table under custom-key parallel replicas (parallel_replicas_mode = 'custom_key_sampling' or 'custom_key_range'). Closes. (Alexey Milovidov).
fixBackported in: Fixed OPTIMIZE TABLE on an Iceberg table failing with Unsupported snapshot's operation type OVERWRITE when the table's history contained a row delete that removed more than one row per position delete file. Closes. (Groene AI).
fixBackported in: Fixed ORDER BY ... LIMIT returning fewer rows than requested, possibly none, when a row policy was the only filter of the query and the sort column had a minmax skip index. The top-K optimization narrowed the read before the row policy was applied. (Alexey Milovidov).
featureBackported in: Add a dedicated thread pool for lightweight snapshot creation. (Han Fei).
featureBackported in: Add clickhouse/utils container image with macOS binary signing tools. (Konstantin Bogdanov).
breakingRemove bad tests on 26.7. (Alexey Milovidov).
+18 more items in the release notes
26.7.3.19 Aug 6, 2026 Release notes ↗
fixBackported in: Fixed a performance regression where a single lightweight DELETE disabled the query condition cache for the whole table. Repeated selective queries over a table that had ever been touched by a lightweight delete stopped pruning granules and fell back to reading every mark. (Nikita…
fixBackported in: Fix server crashes and wrong NOT_FOUND_COLUMN_IN_BLOCK / LOGICAL_ERROR failures in a direct JOIN over a MergeTree right table. The plan is cloned and re-optimized per lookup across threads, but the clone shared two mutable objects with the original: the PrewhereInfo/row_level_filter…
fixBackported in: With analyzer_compatibility_join_using_top_level_identifier = 1, an identifier in JOIN ... USING can now be resolved from an alias defined on a subexpression inside the SELECT list (for example, SELECT uniqExact(lower(x) AS id) FROM t1 JOIN t2 USING (id)), matching the old analyzer…
fixBackported in: Fixed a logical error Block structure mismatch (in debug and sanitizer builds) and an Illegal types of arguments error for set operations over compatible aggregate-state columns (e.g. quantileState and quantilesState(0.9)) nested inside container columns such as Tuple, Array, Map,…
fixBackported in: Now RestCatalog throw proper exception instead of silence or "UNKNOWN_TABLE" in case of stale credentials. (alesapin).
fixBackported in: Fix an out-of-bounds read (a crash in release builds) in insert deduplication when an INSERT flows through a materialized view whose inner query changes the number of rows and the deduplicating target table is partitioned. DeduplicationInfo::filterToPartition attributed each…
fixBackported in: Fixed server startup and ATTACH failing with WITH RECURSIVE is not supported with the old analyzer for a view with a recursive CTE when enable_analyzer = 0 is the server default. (Nikolay Degterinsky).
fixBackported in: Fixed an out-of-bounds write when reading a Parquet DECIMAL column whose physical type is wider than the type its declared precision maps to, for example DECIMAL(9, 2) stored as physical INT64. Such files are valid Parquet and other writers produce them, but the reader sized the…
fixBackported in: Fix a rare use-after-free bug that is triggered in a rare event of the async insert queue having different entries with identical deadlines. Now it's handled gracefully. (Miсhael Stetsyuk).
otherBackported in: This PR bumps aws-c-http v0.11.0. (Govind R Nair).
otherBackported in: Update the vendored libexpat to 2.8.2. (Konstantin Bogdanov).
otherBackported in: Update simdjson to v4.6.5. (Konstantin Bogdanov).
otherBackported in: Update jwt-cpp to v0.7.2. (Konstantin Bogdanov).
otherBackported in: Update libcotp to v4.2.1. (Konstantin Bogdanov).
otherBackported in: Update Apache Arrow to 25.0.0 and Apache ORC to 2.3.1. (Konstantin Bogdanov).
otherBackported in: Update Protocol Buffers to v35.1 and gRPC to v1.83.0. (Konstantin Bogdanov).
fixBackported in: Fix Field::operator<= comparing a Float64 with itself. (Alexey Milovidov).
otherBackported in: I created several PRs to backport the groene-ai's fix: https://github.com/ClickHouse/ClickHouse/pull/109616 However, I need to create dummy PR to create another version patch. (Konstantin Vedernikov).
26.7.2.59 Aug 3, 2026 Release notes ↗
featureBackported in: Tag OpenAI-format HTTP requests with the SQL name of the calling AI function for upstream endpoint identification. (George Larionov).
fixBackported in: Fixed O(P×N) deduplication hash recomputation in async insert flushes that split across P partitions. DeduplicationInfo::prewarmDataHashes is now called once before the partition loop in MergeTreeSink and ReplicatedMergeTreeSink, so all per-partition clones inherit pre-computed…
fixBackported in: This patch fixes the remaining problems needed for part-level min-max index for _block_number and _block_offset columns. (Mikhail Artemenko).
featureBackported in: Added the jemalloc_merge_tree_arenas server setting controlling the dedicated jemalloc arena(s) used for MergeTree part and table metadata: 0 disables it, 1 uses a single arena (default), and N creates a per-CPU pool. On many-core servers a pool reduces memory-allocator lock…
fixBackported in: Web UI: fix the "+" (new tab) button rendering taller than the tabs in Firefox. (Alexey Milovidov).
featureBackported in: Added the setting use_query_condition_cache_for_top_k (default disabled) which gates the query condition cache for ORDER BY ... LIMIT n (TopK) queries. This turns the feature off by default as a precaution until the soundness of its cache entries is fully established, while keeping…
featureBackported in: Added setting analyzer_compatibility_apply_final_to_all_joined_tables that restores the old behavior, where the FINAL modifier on the left-most table of a JOIN was also applied to the other joined tables. The setting is registered in the settings changes history, so compatibility…
featureBackported in: Iceberg v2 spec requires sequence_number in manifest files. However, other engines such as BigQuery could write those files without this field. This PR allow to read those non-spec tables. (Konstantin Vedernikov).
fixBackported in: Fix a LOGICAL_ERROR (Invalid number of rows in Chunk) in JoiningTransform for a LEFT JOIN with unique right keys, a mixed ON condition, and a small max_joined_block_size_rows. (Groene AI).
fixBackported in: Fix server crash (SIGSEGV) when reading Protobuf data with input_format_allow_errors_num > 0 and a valid message precedes a bad (skippable) message in the same block. (Andrey Tsarevskiy | Андрей Царевский ).
fixBackported in: Fix NOT_FOUND_COLUMN_IN_BLOCK error for queries that use the _part_starting_offset/_part_offset virtual columns in WHERE together with lazy materialization. (Vladimir Cherkasov).
fixBackported in: Fix a server crash (out-of-bounds access) in S3Queue/AzureQueue with enable_hash_ring_filtering = 1 when a batch contained a non-processable file and the Keeper request to set the batch as processing failed at the same time. (Groene AI).
fixBackported in: Preserve original key order in bucketed Map serialization to fix comparison operations that depend on it. (Pavel Kruglov).
fixBackported in: Fix data loss of a column with no default expression when a merge runs concurrently with ALTER TABLE ... RENAME COLUMN, or when the column's only values come from a lightweight UPDATE. The column could be dropped from the merged part, so all of its values read back as NULL. (Groene…
fixBackported in: Fixed a false ICEBERG_SPECIFICATION_VIOLATION error when reading an Iceberg table whose decimal (or other parameterized primitive) type is serialized with different whitespace across metadata files, e.g. decimal(20,0) in the table metadata and decimal(20, 0) in the manifest. Such…
fixBackported in: Fix credential leaks in SHOW CREATE, system.query_log, server logs and EXPLAIN output. Every S3 locator form now masks session_token and Google ADC secrets, extra_credentials/headers values at any argument position, duplicated or expression secret keys, invalid positional forms…
fixBackported in: Fixed wrong results for functions has, mapContainsKey and mapContainsValue with an empty needle when a text index is present. (Robert Schulze).
fixBackported in: Fix S3Queue/AzureQueue ordered mode with persistent processing nodes: bucket locks are now refreshed during streaming, so that the TTL cleanup (persistent_processing_node_ttl_seconds) does not remove locks of a live processor. If lock ownership is nevertheless lost, it is detected…
fixBackported in: Fix 411 Length Required errors from Azure services: the Poco-based Azure HTTP transport now sets Content-Length from the request body for SDK clients that do not set the header themselves (e.g. Azure Key Vault). (Konstantin Bogdanov).
fixBackported in: Fixed a read-only object-storage replica (a disk configured with read_only = true) not discovering new parts via refresh_parts_interval, and table_disk = true being rejected on such a disk with "table_disk is not supported for non-ObjectStorage disks". (Julia Kartseva).
fixBackported in: Fix wrong IS NULL / IS NOT NULL / count() results with optimize_functions_to_subcolumns on a column that was made Nullable by a metadata-only ALTER MODIFY COLUMN T to Nullable(T). For parts written before the conversion, the .null subcolumn was filled from the storage-type default…
fixBackported in: Fix incorrect pruning from primary key index analysis on tables with a reverse (descending) sorting key (ORDER BY (g, r DESC)). A granule spanning a change of a leading key column followed by a descending key column could be pruned incorrectly, dropping matching rows. (Nihal Z.…
fixBackported in: Fix a logical error block.rows() == getRows() (an out-of-bounds read and broken insert deduplication in release builds) when an INSERT flows through a dependent materialized view whose target is an Alias and whose inner query changes the number of rows, with a deduplicating table…
fixBackported in: Fix CREATE OR REPLACE of a dictionary with an object of another kind: it failed with CANNOT_DETACH_DICTIONARY_AS_TABLE after the replace was already committed, leaving an orphan tmp_replace* table. (Nikolay Degterinsky).
fixBackported in: A {_partition_id} placeholder in the path of a file-like engine (S3, AzureBlobStorage, URL, etc.) with no explicit partition_strategy implies the wildcard strategy again, regardless of file_like_engine_default_partition_strategy. This restores backward compatibility for pre-26.6 DDL…
fixBackported in: Fixed INCOMPATIBLE_TYPE_OF_JOIN error for an ANY join on a Join engine table when a WHERE filter on a right-side column allowed the query planner to rewrite the join to SEMI or ANTI. A Join engine table has a fixed declared strictness that cannot be changed, so the conversion is now…
fixBackported in: Fix OPTIMIZE TABLE ... MANIFEST for Iceberg tables when manifest partition tuples do not match their partition spec. (Smita Kulkarni).
fixBackported in: Fix UNKNOWN_IDENTIFIER error for columns qualified by CTE name (cte_name.column) in queries stored in views when the analyzer is enabled. (Dmitry Novik).
fixBackported in: Fix a memory leak of the peer certificate on every TLS handshake with certificate verification enabled: SecureSocketImpl::verifyPeerCertificateImpl did not free the certificate returned by SSL_get1_peer_certificate. (Konstantin Bogdanov).
fixBackported in: Fix checking paths against user_files. (Alexander Tokmakov).
fixBackported in: Restrict local object access only for user files path. Continuation of https://github.com/ClickHouse/ClickHouse/pull/99405. (Konstantin Vedernikov).
fixBackported in: Fix typo in complex schema evolution. (Konstantin Vedernikov).
fixBackported in: Fix mutations with a query parameter as the partition (ALTER TABLE ... UPDATE/DELETE ... IN PARTITION {param:Type}): the substituted partition value was serialized into the mutation entry in a form that could not be parsed back, which broke loading of the table (for replicated…
fixBackported in: Fix a segfault due to out-of-bounds memory access when deserializing a malformed aggregate function state containing a String value. Such states are now validated and rejected instead of leading to segfaults. (Miсhael Stetsyuk).
fixBackported in: Fix overflow while parsing in system.zookeeper_info. (Kseniia Sumarokova).
fixBackported in: Fixed a server crash on macOS (aarch64) when a stack trace was captured (for example by the memory profiler) while running on a coroutine/fiber stack. (Raúl Marín).
fixBackported in: Fixes NOT_FOUND_COLUMN_IN_BLOCK when a FINAL query filters on a sorting-key column that is not in the SELECT list and the filter is moved to PREWHERE (for example SELECT s FROM t FINAL WHERE k GROUP BY s with optimize_move_to_prewhere_if_final = 1). (Groene AI).
fixBackported in: ... (Han Fei).
fixBackported in: Fix TYPE_MISMATCH ("Key type for complex key ... does not match") when a JOIN onto a dictionary uses a Nullable, LowCardinality, or LowCardinality(Nullable) join key while the dictionary key is not wrapped. The direct-join dictionary lookup now normalizes the key to the dictionary's…
fixBackported in: Fixes AMBIGUOUS_COLUMN_NAME (Block structure mismatch in (columns with identical name must have identical structure)) for a query that repeats a JOIN ON condition in WHERE with join_use_nulls = 1. Such a query now returns its result instead of failing. (Groene AI).
+19 more items in the release notes
26.7.1.1315 Jul 22, 2026 Release notes ↗
breakingThe / glob (any amount of directories) now also matches the same directory. Previously, / in glob patterns was not handled as a special case, so data/**/file.txt would not match data/file.txt (zero directory levels). (Alexey Milovidov).
breakingReject the zip/zipx backup archive format for backups stored on object storage — direct S3(...)/AzureBlobStorage(...) destinations and Disk(...) destinations backed by S3 or Azure — for both BACKUP and RESTORE. Zip requires seeking to read its central directory, which is very slow over object…
breakingS3 access originating from user SQL no longer resolves the server's own cloud credentials (environment, IMDS/IRSA, instance profile, AWS config files, role_arn-based STS, GCP OAuth metadata) by default; such a request must use explicit credentials or NOSIGN. Named collections now default…
breakingExtended the supported range of DateTime64 from [1900-01-01, 2299-12-31] to [0000-01-01, 9999-12-31]. Values outside the former range are now computed correctly (via cctz) instead of being clamped to the boundary. With precision 8 or 9 the range remains narrower because the ticks are stored as…
breakingAggregatingMergeTree now rejects, at table creation time, schemas where a column is neither part of the sorting key nor an aggregate-state measure (AggregateFunction/SimpleAggregateFunction). Such columns are silently collapsed to an arbitrary value during background merges, producing wrong…
breakingRemoved the config-based workload scheduling configuration (the resources and workload_classifiers server config sections). Use CREATE RESOURCE and CREATE WORKLOAD queries instead. The obsolete config sections are ignored with a warning. (Sergei Trifonov).
breakingClickHouse now always uses the unified insert deduplication hash for both synchronous and asynchronous inserts; the legacy per-insert deduplication behaviours are removed. The server setting insert_deduplication_version is kept as a migration guard: the server refuses to start if it is set to a…
breakingRemoved the long-deprecated functions snowflakeToDateTime, snowflakeToDateTime64, dateTimeToSnowflake and dateTime64ToSnowflake. They were deprecated back in v24.6 in favor of snowflakeIDToDateTime, snowflakeIDToDateTime64, dateTimeToSnowflakeID and dateTime64ToSnowflakeID, which should be used…
breakingThe setting use_legacy_to_time is now 0 by default, so toTime converts values into the Time data type instead of converting a date with time to a fixed date. The legacy behavior is still available via the toTimeWithFixedDate function or by setting use_legacy_to_time = 1. (Alexey Milovidov).
breakingNaive Bayes models (used by naiveBayesClassifier) are now configured as a dictionary with the NAIVE_BAYES layout, built at load time from a table of pre-aggregated per-class n-gram counts, instead of the previous server-side configuration (an XML config file referencing serialized .bin model…
breakingThe hasColumnInTable function no longer accepts the optional hostname, username, and password arguments for checking a column on an arbitrary remote server; only the hasColumnInTable(database, table, column) form remains. The removed remote mode was a security concern: it let any user trigger…
featureAdded the skip_unavailable_shards_mode setting (also available as a Distributed engine setting) to control which exceptions from a remote shard are silently ignored when skip_unavailable_shards is enabled. This provides finer control over query behavior in distributed environments. (cjw).
featureIntroduce a memory reservation feature for workloads. More details https://clickhouse.com/docs/operations/workload-scheduling. (Sergei Trifonov).
featureAdd groupFormat aggregate function that formats rows in each group using a specified output format and returns the result as a string. (Yang Hu).
featureEnable wildcard expansion for url() and the URL engine by listing HTTP index pages (HTML or plaintext directory listings) and extracting matching URLs. Wildcards are matched against the URL path component, with limits on the index page size and on the number of directories read. (Yue Ni).
featureAdded AWS_MSK_IAM as a supported value for kafka_sasl_mechanism, enabling ClickHouse to authenticate with Amazon MSK using IAM roles without managing SASL/SCRAM credentials. (kalavt).
featureAdd aggregate function combinator -Tuple, which applies the underlying aggregate function to each element of a Tuple column independently and returns a Tuple of the results, preserving element names: sumTuple(t) for t = (a, b) returns (sum(a), sum(b)). Aggregate functions with several arguments…
featureAdded a postprocessor to the text index which transforms the tokens after tokenization. (Jimmy Aguilar Mena).
featureAdded system table system.stemmers which shows all available stemmers languages that can be specified for the stem function. (Jimmy Aguilar Mena).
featureAdd support for WITH TIES for negative LIMIT. (Nihal Z. Miaji).
featureAdded support for WHERE clauses in projection definitions. Projections with WHERE only materialize rows matching the predicate, and the optimizer can use them (cost-based) when the query's WHERE implies the projection's WHERE. (S Bala Vignesh).
featureAdd new positions argument support to text indexes to store token positions and enable exact direct reads for hasPhrase. The allow_experimental_text_index_positions needs to be enabled to store positional information. (Elmi Ahmadov).
featureAdded support for the standard SQL AT TIME ZONE and AT LOCAL postfix operators as syntactic sugar for toTimeZone. The expression expr AT TIME ZONE zone is now equivalent to toTimeZone(expr, zone), and expr AT LOCAL is equivalent to toTimeZone(expr, timeZone()). (lizepeng).
featureThe URL table engine and url table function now dispatch to the appropriate backend based on the URL scheme: file:// is served by the File engine, s3:///gs:///gcs:///oss:// by S3, az:///azure:///abfss:///abfs:// by AzureBlobStorage, hdfs:// by HDFS, and http(s):// by the URL engine as before. The…
featureAdded the Remote and RemoteSecure table engines, the persistent counterparts of the remote and remoteSecure table functions. CREATE TABLE ... ENGINE = Remote('addresses', db, table, ...) now works in addition to CREATE TABLE ... AS remote(...). (Alexey Milovidov).
featureAdding EXPLAIN ANALYZE v1 for examination of query performance using metrics rendered in the familiar query plan format. ... (Kirill Kopnev).
featureAdded engine-agnostic SYSTEM STOP, SYSTEM START, SYSTEM PAUSE, SYSTEM CANCEL, and SYSTEM REFRESH commands, and their ... ALL BACKGROUND server-wide forms, to control the background activity of Kafka, RabbitMQ, NATS, S3Queue/AzureQueue tables and refreshable materialized views through one unified…
featureAdded support for the mysql, postgresql, and sqlite table functions and table engines to accept a user's query (instead of a table name) and pass it to the external database as is, written either as a subquery (SELECT ...) or as query('SELECT ...'). The structure of the resulting table is inferred…
featureAdded tabs to the ClickHouse Web UI (Play) for working with multiple queries at once. Tabs, their titles, parameters, active state, and small result snapshots are persisted across reloads (large and image results are not restored), integrate with browser history and the URL, and can be switched…
featureIntroduce the QueryRunner table engine. Records inserted into a QueryRunner table represent queries that the engine executes. The engine can be used for asynchronous query execution, batch execution of generated queries, directing queries to remote clusters, benchmarks, fuzzing, and testing with…
featureAdded an interactive help command to clickhouse-client and clickhouse-local. Typing help (also /help, man, /man) shows the documentation of a function, table engine, data type, format, setting, and other components, rendered from Markdown in the terminal with syntax-highlighted SQL. When the word…
featureAdd the GeoJSON output format for writing GeoJSON FeatureCollection documents, producing one feature per row. The single geo-typed column (Point, LineString, MultiLineString, Polygon, MultiPolygon, Ring, or Geometry) becomes each feature's geometry; a column named id becomes the feature id; and…
featureAdded the dotProductTransposed function (alias scalarProductTransposed) that computes the approximate inner product between a QBit column and a reference vector, complementing the existing L2DistanceTransposed and cosineDistanceTransposed functions. (Alexey Milovidov).
featureAdded an optional stride parameter to the QBit data type (QBit(T, dimension, stride)) that stores groups of dimensions in separate streams, so a vector search can read only the first dimensions efficiently (e.g. for Matryoshka embeddings). The transposed distance functions accept an optional…
featureAdded support for the Int8 element type in the QBit data type, enabling storage and transposed-distance vector search (L2DistanceTransposed, cosineDistanceTransposed) over quantized 8-bit integer vectors. (Alexey Milovidov).
featureNew function randomHadamardTransform(vector[, seed[, output_dims]]): a deterministic randomized Hadamard transform of a float vector — an orthogonal, norm-preserving rotation useful for preprocessing embeddings before quantization, and (when truncated) as a Johnson–Lindenstrauss /…
featureAdd support for configuring dictionary lazy load on a per-dictionary basis. Required for the cloud as auxiliary dictionaries used for metrics collection should be loaded lazily (to avoid the server getting stuck in startup scripts), while customer dictionaries should continue to be loaded eagerly.…
breakingRemove a single-threaded bottleneck in ShuffleSendStep of the distributed query plan: each upstream stream now scatters its rows by destination bucket independently instead of funneling the whole fragment through one ScatterByPartitionTransform. (Alexander Gololobov).
breakingSpeed up serialization and merges of JSON columns whose shared data contains many sparse paths. When flattening shared data into per-path columns, flattenAndBucketSharedDataPaths no longer scans every accumulated path column on every row and no longer inserts a default one cell at a time; the…
securityFix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze).
+1109 more items in the release notes
26.6.8.7 Sep 16, 2026 Release notes ↗
otherBackported in: Write partition field summaries into the Iceberg manifest list. (Konstantin Vedernikov).
fixBackported in: Fixed SQL injection in the MySQL wire protocol: the SHOW TABLE STATUS LIKE argument and the SET value sent over the MySQL interface (port 9004) are now parsed and re-quoted instead of being concatenated verbatim into the rewritten query. Also fixed KILL QUERY over the MySQL…
fixBackported in: Fixed an error when using a qualified asterisk like b.* in a query where b is a table (or subquery/CTE) alias that shares its name with a non-compound column of another table. Such queries no longer fail and correctly select all columns of b. (Vladimir Cherkasov).
fixBackported in: Each code for Time-based one-time password is now accepted at most once, as required by RFC 6238: reusing an already used code, or a code for an earlier time step, is rejected. A user with time_based_one_time_password can successfully authenticate at most once per period. (Vladimir…
fixBackported in: Fixed the byte width of the Iceberg manifest lower_bounds and upper_bounds written for int and date columns: they were 8 bytes wide where the Iceberg specification requires 4. Spec-conformant readers such as pyiceberg failed with unpack requires a buffer of 4 bytes while planning…
otherBackported in: Split the ASan integration test jobs into eight batches. (Alexey Milovidov).
26.6.7.18 Sep 15, 2026 Release notes ↗
otherBackported in: Bump the internal libssh from 0.12.0 to 0.12.2. (Robert Schulze).
fixBackported in: Fix a logical error Invalid cast from Nothing to native type (an abort in debug/sanitizer builds) when compile_expressions = 1 compiled an expression with a Nullable(Nothing) operand, e.g. and(Nullable(Nothing), ). (Groene AI).
fixBackported in: Fixed Iceberg INSERT writing manifest-wide aggregate column statistics into every data_file entry when a partition produced more than one data file. Each entry's null_value_counts, column_sizes, lower_bounds and upper_bounds now describe only the data file it points at. Previously…
fixBackported in: Apply remote_url_allow_hosts before SQL-supplied S3 and Azure endpoints send schema, metadata, or container requests. (Rory Shanks).
fixBackported in: Fix a segmentation fault when reading in order from a Merge table over MergeTree tables whose sorting key is shorter than the key prefix chosen for the query: the prefix was forwarded to the underlying reader unchecked, which grew its cloned sorting-key expression list to that…
fixBackported in: format_display_secrets_in_show_and_select works as expected in EXPLAIN. (Kirill Kopnev).
fixBackported in: Fix rows silently dropped by an ngrambf_v1 index for a LIKE pattern with a run of escaped backslashes before a wildcard. (Alexey Milovidov).
fixBackported in: Fixed a crash and a LOGICAL_ERROR for statements that write trim(BOTH '' FROM x) (or the LEADING/TRAILING spelling) where a function is expected: a column's STATISTICS(...) or CODEC(...) list, INDEX ... TYPE, ALTER TABLE ... ADD STATISTICS, auto_statistics_types, a table function, a…
fixBackported in: Fixed an ALTER on a view or materialized view with SQL SECURITY DEFINER deleting the auto-created :definer account when the ALTER did not change the definer. Every later SELECT from the view, and every INSERT into a materialized view's source table, then failed permanently with…
fixBackported in: Fixed cleartext credentials in system.asynchronous_insert_log.query. Secrets of table functions such as s3, url or mysql are now masked as [HIDDEN], the same way system.query_log masks them. (Sema Checherinda).
fixBackported in: Fixed the server not validating the schema of the second and subsequent data blocks that a client sends for an external table over the native protocol. Such a block could make the data be interpreted as a type other than the one it was sent as. (Alexey Milovidov).
fixBackported in: Fixed a crash of the server caused by a table with ENGINE = NATS whose credentials the broker started to reject, for example after a password rotation or on an expired token. Such a table now recreates its connection and resumes consuming once the credentials are accepted again,…
securityNO CL ENTRY: 'Revert "Backport to 26.6: Fix an ALTER on a SQL SECURITY DEFINER view deleting its auto-created definer user"'. (pufit).
otherBackported in: Not required. (Groene AI).
fixBackported in: Fix flaky test_filesystem_split_cache::test_split_cache_system_files_no_eviction. The baseline System-segment count was sampled straight after wait_for_cache_initialized, which only reports that the cache became usable while background loading keeps adding segments, so the baseline…
otherDelete a trash file from 26.6 accidentially commited in the backport. (Pavel Kruglov).
fixBackport to 26.6: Fix flaky test_database_delta::test_snapshot_version (Spark DESCRIBE HISTORY timeout). (Alexey Milovidov).
26.6.6.15 Sep 14, 2026 Release notes ↗
featureBackported in: Fix duplicated GROUP BY keys in the partial aggregation strategy of make_distributed_plan, and allow this strategy for aggregations over a distributed read. (Alexander Gololobov).
otherBackported in: Support parallel replicas for object storage writes. (Konstantin Vedernikov).
fixBackported in: Fixes silent data loss for TTL expressions that apply large intervals directly to Date / DateTime source columns by widening the arithmetic away from 16/32-bit overflow. (BoloniniD).
fixBackported in: Restrict local object access only for user files path. Continuation of https://github.com/ClickHouse/ClickHouse/pull/99405. (Konstantin Vedernikov).
fixBackported in: Fixed a crash when reading a subcolumn of a Variant, Dynamic or JSON column whose own type is Nullable or LowCardinality(Nullable) from a MergeTree table, for example SELECT value.Tuple(a Nullable(UInt32), b String).a over a Dynamic column. Previously such a read hit a LOGICAL_ERROR…
fixBackported in: Fixed LOGICAL_ERROR: Unexpected return type from tuple. Expected Tuple(..., UInt8). Got Tuple(..., LowCardinality(UInt8)) when a LowCardinality column compared with IN (subquery) is read through tuple(...) across a subquery boundary and enable_analyzer = 0. With the old analyzer, x…
fixBackported in: Fixes a server abort that happens when the global thread pool is momentarily saturated while tables are still loading. AsyncLoader now keeps running if it cannot spawn an extra loader worker and some worker will still drain the queued jobs, instead of calling std::terminate. (Groene…
fixBackported in: Fixes a server abort in debug and sanitizer builds when inserting into a materialized view whose TO target is another materialized view. Such an insert already failed on released versions, with an uninformative Code: 1001 STD_EXCEPTION; it now reports NOT_IMPLEMENTED naming the…
fixBackported in: Fix partition pruning and primary key filtering being silently disabled when parallel_replicas_min_number_of_rows_per_replica is set inside a subquery or CTE instead of at top query level. (Yarik Briukhovetskyi).
fixBackported in: Fixed a server that refused to start after the directory backing a Filesystem database had been removed. Such a database is now loaded without tables and can be inspected and dropped, while a CREATE DATABASE or ATTACH DATABASE issued by a user is still rejected when the path does…
fixBackported in: Don't use backoffs on concurrent inserts conflicts (when we use Iceberg + catalog, for example). (Konstantin Vedernikov).
fixBackported in: Fixed a stack buffer overflow when reading a BIT column from MySQL, reachable through the mysql table function, the MySQL table and database engines, and MySQL dictionaries. The length of the value sent by the server was copied without being validated. (Alexey Milovidov).
otherBackported in: Make the 04780 index-analysis allocation oracle the minimum of several runs. (Alexey Milovidov).
otherBackported in: Do not leave a Filesystem database pointing at a removed directory, which makes the server refuse to start. (Alexey Milovidov).
26.6.5.120 Sep 13, 2026 Release notes ↗
breakingBackported in: Reading a File source with rename_files_after_processing set now requires the WRITE ON FILE grant on top of READ ON FILE, on the initiator for fileCluster: the setting renames the files a SELECT has read, which is a write to the source, and it used to happen for anyone who could…
featureBackported in: Jemalloc Fragmentation Profiler. (Azat Khuzhin).
fixBackported in: Fixed a performance regression where a query combining a text index filter with ORDER BY ... LIMIT stopped answering the filter from the index and read the whole text column instead. (Jimmy Aguilar Mena).
fixBackported in: Fix performance regression introduced in 26.4 when writing JSON and Dynamic columns in text formats. (Pavel Kruglov).
fixBackported in: Fix a server crash in predicate pushdown (enable_optimize_predicate_expression, legacy analyzer) when a UNION subquery appears inside a JOIN ... ON condition. (Groene AI).
fixBackported in: Fixed a server crash (LOGICAL_ERROR: 'Unexpected exception in refresh scheduling') that could happen on startup when a coordinated refreshable materialized view in a Replicated database was attached on a Keeper that does not support the MULTI_READ feature flag (for example after a…
fixBackported in: Fixed SQL injection in the PostgreSQL wire protocol emulation. Prepared-statement parameters — the Parse/Bind/Execute extended-query path used by psycopg2, JDBC, node-postgres, Npgsql and others, and the simple-query EXECUTE path — were substituted into the executed SQL by raw…
fixBackported in: Fixed a credential leak where the legacy storage_aws_access_key_id, storage_aws_secret_access_key, storage_catalog_credential, and storage_auth_header settings of the DataLakeCatalog database engine were shown in plaintext in system.databases.engine_full and SHOW CREATE DATABASE.…
fixBackported in: Enforce the http_forbid_headers configuration during schema inference for the url() table function and URL storage engine. Previously a forbidden header was still sent over the network while inferring the schema (for example with the Regexp format or DESCRIBE), and its response body…
fixBackported in: Fixed RabbitMQ table engine hanging indefinitely on DROP TABLE or server shutdown when the broker closes the AMQP connection due to missed heartbeats without sending a TCP RST. All blocking event loop calls now have a 30-second timeout so shutdown always completes. (Aly Ayman).
fixBackported in: The ArrowFlight table engine and the arrowFlight table function now honor the allow-list. Previously the connection host and port were not validated, so a query could reach hosts not present in the allow-list. (Groene AI).
fixBackported in: Fixes a null-pointer dereference segfault in StreamingStorageRegistry that occurs when StreamingStorageRegistry::shutdown and StorageObjectStorageQueue::shutdown are called concurrently. (Miсhael Stetsyuk).
fixBackported in: Fixed a server crash when the aggregate functions cramersV, cramersVBiasCorrected, contingency or theilsU states from a window context (OVER ()) and from a plain aggregation are combined through chained set operations (EXCEPT, INTERSECT) or nested UNION ALL and then read, for…
fixBackported in: Rejects non-monotonic Array offsets on every read path that decodes them as absolute values, instead of only in the Native format. A corrupt set skip index granule previously passed unchecked and was then read out of bounds. (Groene AI).
fixBackported in: Fixed a privilege-escalation gap where the executable table function did not enforce the TABLE ENGINE ON Executable grant. With table_engines_require_grant enabled, a user denied CREATE TABLE ... ENGINE = Executable could still run the same server-side script via SELECT ... FROM…
fixBackported in: Fix ObjectStorageQueue/AzureQueue (and the azureBlobStorage table function) silently skipping objects when the object storage returns an empty listing page together with a continuation token. Azure Blob Storage does this (e.g. when a listing crosses an internal partition boundary),…
fixBackported in: Fix a data race (and rare crash) when a parsing/analysis error is reported while reading a file/object storage table. A parse error raised during lazy KeyCondition initialization was shared as a single exception object across reader threads, and two threads could concurrently append…
fixBackported in: Fix server crashes and wrong NOT_FOUND_COLUMN_IN_BLOCK / LOGICAL_ERROR failures in a direct JOIN over a MergeTree right table. The plan is cloned and re-optimized per lookup across threads, but the clone shared two mutable objects with the original: the PrewhereInfo/row_level_filter…
fixBackported in: Fix silently wrong query results when a projection part written before the projection's column set changed (for example, after upgrading across versions that materialize an ALIAS column's source differently, or after ALTER TABLE ... MODIFY COLUMN re-points an ALIAS column used by a…
fixBackported in: Fixed reading a corrupted Native-format stream whose Dynamic type count or JSON/Object path count is close to SIZE_MAX: such malformed input is now rejected with a clear INCORRECT_DATA error instead of an uncaught std::length_error. (Alexey Milovidov).
fixBackported in: Fix PREWHERE (and row-level policies) on an Iceberg column that was renamed by schema evolution silently returning 0 rows for old data files. Such queries now return the correct rows, matching WHERE. (Groene AI).
fixBackported in: Fixed potential data loss when an INSERT into ReplicatedMergeTree was cancelled or timed out while ClickHouse was recovering an uncertain Keeper commit. (kakao-tars-case).
fixBackported in: Fix CREATE OR REPLACE leaving the replaced object behind under an internal name when the caller lacks the drop privilege on it. (Nikolay Degterinsky).
fixBackported in: Fixed a SQL injection in the PostgreSQL metadata queries. The schema of the PostgreSQL database engine, the requested column names and the publication name were formatted into SQL literals without escaping, so a value containing a quote could execute arbitrary SQL on the connected…
fixBackported in: Fix count() on Iceberg tables whose snapshot summary is inaccurate or corrupted: the trivial count optimization now derives exact row counts from the manifest files, and falls back to a real scan when row-level deletes make metadata counts inexact. Also fix Iceberg OPTIMIZE TABLE…
fixBackported in: Fix Iceberg tables written by ClickHouse being unreadable by external readers (PyIceberg, Spark). The Avro schemas embedded in the manifest-list and manifest files omitted the Iceberg field-id properties, so scan planning failed with Cannot convert field, missing field-id. (Groene…
fixBackported in: Fixed a server abort (SIGABRT) when a BUFFERED_V1 WebAssembly UDF returns an empty result buffer; the query now fails with a catchable WASM_ERROR and the server stays up. (Nikolai Ovchinnikov).
fixBackported in: Fixes a bloom_filter skip index dropping granules that contain matching rows when a String or FixedString column is compared for equality against a constant that is wider than the indexed type, so that queries such as SELECT count() FROM t WHERE s = toFixedString('abc', 5) no longer…
fixBackported in: Fixed the logical error SortingAggregatedTransform already got bucket with number N that could occur in multi-layer distributed GROUP BY queries using two-level aggregation. (Nikita Taranov).
fixBackported in: Fix allow_feature_tier rejecting merge_tree_-prefixed settings in settings profiles as unknown, and rejecting CREATE TABLE because of MergeTree settings set by the server through compatibility or the merge_tree config section. Also fix constraints on a merge_tree_-prefixed setting…
fixBackported in: Fixed LOGICAL_ERROR when reading a table with a set skip index defined on an expression and the query repeats that expression with a Nullable operand, for example WHERE intDiv(id, (SELECT 1000)) = 3 over INDEX b_set intDiv(id, 1000) TYPE set(100). A scalar subquery is enough to…
fixBackported in: Fixed a data race and a use-after-free on the metadata of a DeltaLake or Iceberg table. Two concurrent queries that read total_rows or total_bytes from system.tables for the same table could have one query replace the table's metadata while the other was still reading it, which…
fixBackported in: Fix wrong statistics part pruning for negated float predicates with NaN. (Han Fei).
fixBackported in: Fix a crash for ORDER BY ALL in a WINDOW VIEW, and UNKNOWN_IDENTIFIER errors for INTERPOLATE, WINDOW and LIMIT BY in a query over a Merge or Distributed table with a join, with the old analyzer. (Alexey Milovidov).
fixBackported in: Fixes memory leaks of abandoned nested aggregate states. (Groene AI).
fixBackported in: Fix std::out_of_range: map::at: key not found when a MergeTree key expression contains a mortonEncode or hilbertEncode call that is not itself a key column, for example ORDER BY mortonEncode(hilbertEncode(x, y), x, y) or PARTITION BY mortonEncode(x, y) % 4. (Groene AI).
fixBackported in: Fixes a server crash that happens when aggregate states of the -OrNull or -OrDefault combinators are merged with group_by_overflow_mode = 'any' and a non-zero max_rows_to_group_by, for example when a query reads through an aggregate projection. (Groene AI).
fixBackported in: Fixed a LOGICAL_ERROR: Context has expired exception when a stored expression containing accurateCastOrDefault or a toOrDefault function is evaluated after the query that created it has finished, for example a MATERIALIZED column default on INSERT or a mutation expression. (Groene…
fixBackported in: Fix wrong results when a filter on a combined literal+sub-object JSON subcolumn (json.@a) was analyzed against a JSONAllPaths skip index: the subcolumn was treated as a path literally named @a `, so all granules were skipped and the query returned fewer rows than it should. (Pavel…
featureBackported in: Internal follow-up correcting an implementation detail from an unreleased change; no user-visible behavior change beyond restoring the intended performance characteristics of https://github.com/ClickHouse/ClickHouse/pull/115852 for Dynamic(JSON) text output. (Nikita Fomichev).
+79 more items in the release notes
26.6.4.55 Sep 1, 2026 Release notes ↗
featureBackported in: Bounded the cost of estimating the selectivity of col IN (...) from column statistics, which could add hundreds of milliseconds to the planning of a single query. The estimator no longer runs the subquery behind col IN (subquery) to fill a set it only needs one selectivity number…
fixBackported in: Fixed a CPU regression for queries that issue many independent small reads against the same MergeTree part when the table has LowCardinality columns. The check deciding whether a part has a single shared dictionary scanned every mark of the whole part on each read task; it now finds…
fixBackported in: Fixed a performance regression since 26.6: a query filtering a Nullable column with IN (subquery) read the whole table instead of skipping the read when the subquery returned no rows. Closes. (Yarik Briukhovetskyi).
featureBackported in: Added a new MergeTree setting text_index_version that controls the on-disk format version of text indexes: v0_initial, v1_with_codec, or v2_with_positions. During a rolling upgrade or before a downgrade, set it to an older version so that newer servers keep writing text index parts…
featureBackported in: Added fs cache download wait timeout configured by filesystem_cache_wait_for_concurrent_download_timeout_milliseconds. This timeout defined only the wait for a single chunk (buffer bytes of ~1mb) of data, not the whole file segment. (Kseniia Sumarokova).
fixBackported in: Fix a LOGICAL_ERROR ("Different order of columns in UNION subquery") when the old analyzer (enable_analyzer = 0) reads a subset of columns from a subquery whose UNION children are INTERSECT/EXCEPT set operations. (Groene AI).
fixBackported in: Fix an out-of-bounds write when reading a Variant column from a malformed Native block whose discriminators reference a variant index that does not exist. (uwezkhan).
fixBackported in: Fix a LOGICAL_ERROR (Different list of shards in child plans) when running a query with make_distributed_plan = 1 over a MergeTree table that has a normal/aggregate projection. (Groene AI).
fixBackported in: Fixed CREATE OR REPLACE MATERIALIZED VIEW ... POPULATE leaving the new view unsubscribed from its source table, which silently dropped every row inserted after the replace. (Alexey Milovidov).
fixBackported in: Fixed parallel_view_processing setting being ignored when inserting into a table with materialized views — since 25.10, views always ran in parallel regardless of the setting. (Antonio Andelic).
fixBackported in: Constant folding during query planning no longer executes a function whose argument type differs from the type the function was resolved for during analysis. Such a mismatch used to raise a LOGICAL_ERROR while the output header was being computed, which is an assertion failure in…
fixBackported in: Fixed partition pruning returning no rows for Iceberg tables partitioned by a timestamp (DateTime64) column. (Den Kalantaevskii).
fixBackported in: Fixed a use-after-free when a JOIN with join_algorithm = 'direct' onto a dictionary was given a join key that is stored with sparse serialization. getColumnVectorData returned a reference to a temporary column, so the dictionary lookup read freed memory: release builds could return…
fixBackported in: Fixed Logical error: 'Files metadata is empty' when reading from, altering, or flushing an S3Queue/AzureQueue table whose metadata handle is gone: concurrently with a DROP/DETACH, after a failed startup, or after a failed DROP. Such a table now reports TABLE_IS_DROPPED instead.…
fixBackported in: Fix Logical error: No set is registered for key ... when reading through a Merge table whose child declares an ALIAS column containing IN, and the children disagree about that column's default. (Groene AI).
fixBackported in: Reject corrupted/malicious dictionary where lcp exceeds the previous token or lcp + data_size overflows, before the buffer write. (Elmi Ahmadov).
fixBackported in: Fixes ORDER BY ... LIMIT queries on Tuple() columns raising a NOT_IMPLEMENTED exception when top-K dynamic filtering is enabled. Direct empty tuples now skip the optimization, while supported nested composite types continue to use top-K filtering. (Langning Zhang).
fixBackported in: Register Iceberg namespace in the catalog before writing table files (needed for SeaweedFS). (Azat Khuzhin).
fixBackported in: Fixes a bug where an access entity carrying a Map-valued setting, such as a settings profile with http_response_headers or additional_table_filters, is stored in a form that ClickHouse cannot read back, leaving the entity permanently unloadable after a restart. (Groene AI).
fixBackported in: Fixes has, indexOf, countEqual, mapContainsKey, mapContainsValue and Map subscript returning "not found" for a constant LowCardinality needle equal to the element type's default value, such as an empty String or a zero number. (Groene AI).
fixBackported in: Fixes a server abort (Logical error: Part patch-... doesn't exist) when a DROP TABLE runs concurrently with a lightweight UPDATE on a ReplicatedMergeTree table. The update now holds the table's shared lock until its patch part is committed, so the DROP waits instead of removing it.…
fixBackported in: The AI-function quota settings (ai_function_max_api_calls_per_query, ai_function_max_input_tokens_per_query, ai_function_max_output_tokens_per_query) were enforced per block rather than per query, letting a query exceed the configured limit in proportion to the number of blocks and…
fixBackported in: Fix propagation of query settings and NULL handling in accurateCastOrDefault. (Alexey Milovidov).
fixBackported in: Fixed a hang when dropping a TimeSeries table whose name sorts lexicographically below its inner tables' names, for example DROP TABLE -ts or dropping a materialized view declared with ENGINE = TimeSeries. The drop self-deadlocked on the DDL guard and could not be cancelled with…
fixBackported in: Disable distributed index analysis with projections (wrong results). (Azat Khuzhin).
fixBackported in: Fixed an out-of-bounds read while deserializing corrupted posting lists of a text index. (Anton Popov).
fixBackported in: Fixed wrong results for SELECT count(arrayJoin(arr)) with the default optimize_trivial_count_query = 1. The stored row count was returned instead of the number of array elements, and on file() and url() the query returned 0. Closes. (Groene AI).
fixBackported in: Fixed a row policy bypass where the mergeTreeIndex table function exposed primary key and minmax index values of the rows hidden by a SELECT row policy on the source table; reading mergeTreeIndex for a table with a row policy is now denied. (Yarik Briukhovetskyi).
fixBackported in: Fixed a bypass of settings constraints: SET = DEFAULT reset a setting without checking the constraints from the user's profile, so a MIN/MAX/CONST constraint could be escaped by resetting the setting instead of assigning to it, and a session could leave readonly mode with SET…
fixBackported in: Fixed a settings-constraint bypass: a SETTINGS clause inside a subquery, a CTE or a view's inner query was applied without checking the settings constraints, so it could be used to leave readonly mode or to override a CONST, MIN or MAX constraint (for example…
fixBackported in: Validate Variant discriminator in ColumnVariant arena deserialization. (Azat Khuzhin).
fixBackported in: Fixed uniq, uniqExact, uniqHLL12 and uniqTheta returning a wrong result for an argument wrapped in an injective function that hides nullability, such as uniqExact(tuple(x)) over a Nullable column. The optimize_injective_functions_inside_uniq optimization removed the wrapping…
fixBackported in: Fix read_rows, read_bytes, written_rows and written_bytes in system.query_thread_log reporting a thread lifetime running total instead of the values for the logged query. Rows of long-lived pooled threads, in particular the query's initiating HTTPHandler thread, were affected.…
fixBackported in: Allow KeeperMap readers to accept shared metadata when equivalent primary keys differ only by redundant outer parentheses. (Sergey Kuznetsov).
fixBackported in: Fixed a bug in the function formatRowNoNewline that could produce incorrect results or a logical error when a row is formatted to an empty result. (Alexey Milovidov).
fixBackported in: Fix server crashes on deeply nested input in readWKB, JSONMergePatch, the address parser of the url/remote/cluster/mysql/postgresql table functions, the CURSOR clause parser and the CapnProto schema parser. Fix a crash in the parser of the EXECUTE statement when an argument is not a…
fixBackported in: Validate the states of the stochasticLinearRegression, stochasticLogisticRegression, groupUniqArray, groupArrayIntersect and topK aggregate functions and of the Resample combinator on deserialization: a malformed state could be read out of bounds. (Alexey Milovidov).
fixBackported in: Do not return uninitialized memory in the result of a binary string literal whose length is not a multiple of eight, and from the LZ4 decompressor when a compressed block has no body. (Alexey Milovidov).
fixBackported in: Bound the size of the startup message of the PostgreSQL wire protocol, which is read before authentication. (Alexey Milovidov).
fixBackported in: Reject unsupported and mixed read/write operations in ZooKeeper multi requests. (Antonio Andelic).
+14 more items in the release notes
26.6.3.62 Aug 19, 2026 Release notes ↗
fixBackported in: Fix a ~1.5x performance regression introduced in 26.5 in GROUP BY over Dynamic keys and over JSON path subcolumns. (Utkal Singh).
fixBackported in: Fixed a performance regression where a single lightweight DELETE disabled the query condition cache for the whole table. Repeated selective queries over a table that had ever been touched by a lightweight delete stopped pruning granules and fell back to reading every mark. (Nikita…
fixBackported in: Added the setting analyzer_compatibility_multiple_joins_qualify_column_names (default false). When enabled and the FROM clause of a query contains two or more JOINs, result column names produced by the analyzer mimic the old analyzer's multiple-joins rewrite: columns expanded from…
fixBackported in: Fix LOGICAL_ERROR exceptions when reading Iceberg or DeltaLake data lake tables through paths that can reach the read pipeline without a pinned datalake_table_state, such as concurrent Iceberg metadata updates or merge reads over DeltaLake tables. (Groene AI).
fixBackported in: Fix a rare LOGICAL_ERROR "Attempt to release query context that does not exist" and the accompanying server crash when reading MergeTree tables through a filesystem cache disk created with enable_filesystem_query_cache_limit = 1. (Groene AI).
fixBackported in: Reject unsupported uses of AggregateFunction columns in TTL expressions at CREATE TABLE time (e.g. TTL toDateTime(state)) instead of failing later during TTL execution with ILLEGAL_TYPE_OF_ARGUMENT. This also covers states carried inside Variant alternatives and Dynamic values.…
fixBackported in: Fixed reading Iceberg v3 tables whose Parquet data files contain reserved row-lineage columns (such as _row_id); the native Parquet reader no longer raises ICEBERG_SPECIFICATION_VIOLATION for reserved field ids that are not part of the table schema. (Greg Maher).
fixBackported in: Fix type_json_allow_duplicated_key_with_literal_and_nested_object not working with typed paths in JSON. (Pavel Kruglov).
fixBackported in: Fix possible logical error "Unexpected substream ... for column ..." during bump of compatibility setting. (Pavel Kruglov).
fixBackported in: With analyzer_compatibility_join_using_top_level_identifier = 1, an identifier in JOIN ... USING can now be resolved from an alias defined on a subexpression inside the SELECT list (for example, SELECT uniqExact(lower(x) AS id) FROM t1 JOIN t2 USING (id)), matching the old analyzer…
fixBackported in: Fixed a LOGICAL_ERROR ("Bad cast from ColumnString to ColumnLowCardinality") during primary-key index analysis when a LowCardinality key column is wrapped in a nested CAST chain that re-introduces LowCardinality, e.g. WHERE CAST(CAST(s, 'LowCardinality(String)'), 'String') < '5'. In…
fixBackported in: Fixed a logical error Block structure mismatch (in debug and sanitizer builds) and an Illegal types of arguments error for set operations over compatible aggregate-state columns (e.g. quantileState and quantilesState(0.9)) nested inside container columns such as Tuple, Array, Map,…
fixBackported in: RESTORE now fsyncs the restored part files when the destination table has fsync_after_insert enabled, so a restored part is as durable against power loss as an inserted one. Previously restored files were only written and closed (never fsynced), so a power loss right after RESTORE…
fixBackported in: Now RestCatalog throw proper exception instead of silence or "UNKNOWN_TABLE" in case of stale credentials. (alesapin).
fixBackported in: Fix a logical error Block structure mismatch in IntersectOrExceptStep stream: different number of columns that could happen when the filter split optimization (query_plan_split_filter) ran on a WHERE whose filter column name is also an input column name. The optimization left an…
fixBackported in: Fixed a stack frame being displayed as ? instead of its function name in fatal log messages and in the trace_full column of system.crash_log. It affected frames of ordinary functions that have code attributed to a libc++ __functional header, which is common in release builds.…
fixBackported in: Fixes cases where row policy was not used for MergeTree Projections during query execution. (Yarik Briukhovetskyi).
fixBackported in: Fix out-of-bounds read in SerializationReplicated on the native protocol on corrupted indexes data. (Pavel Kruglov).
fixBackported in: Security related bugfix. (Kseniia Sumarokova).
fixBackported in: Fixed a crash when reading a Parquet file with inconsistent bloom filter metadata. Such files could also silently return fewer rows than they should. (Shaohua Wang).
fixBackported in: Fix AsynchronousBoundedReadBuffer's readBigAt data race. Closes. (Kseniia Sumarokova).
fixBackported in: Fix an out-of-bounds read (a crash in release builds) in insert deduplication when an INSERT flows through a materialized view whose inner query changes the number of rows and the deduplicating target table is partitioned. DeduplicationInfo::filterToPartition attributed each…
fixBackported in: Fix DROP TABLE and SYSTEM STOP VIEW hanging when a Refreshable Materialized View is blocked while planning its refresh query. (Nikolay Degterinsky).
fixBackported in: Fixed a case where CREATE TABLE ... ENGINE = Distributed(...) without a column list could reveal the structure of a local table the creating user is not allowed to see. For a CREATE the local server executes itself, the structure is now inferred under the user's own context, so SHOW…
fixBackported in: Fixed reading the internal _temporary_and_external_tables database through the merge table function and the Merge table engine, which allowed one session to read the temporary tables of other sessions and other users, and caused an exception on the old analyzer path. A database…
fixBackported in: Fixed wrong results when a hash join has a single LowCardinality key of a type wider than 8 bytes (UInt128, Int128, UInt256, Int256, and their Nullable variants). Such a join silently returned rows whose key values are not equal. (Groene AI).
fixBackported in: Fixed a query plan optimization stall when a WHERE clause contains a large string constant with many dots and the table carries a bloom_filter, tokenbf_v1, ngrambf_v1 or text skip index. Matching a filter column name against JSONAllPaths(...) index columns enumerated every dot split…
fixBackported in:. (Vladimir Cherkasov).
fixBackported in: Fix a rare use-after-free bug that is triggered in a rare event of the async insert queue having different entries with identical deadlines. Now it's handled gracefully. (Miсhael Stetsyuk).
fixBackported in: Fixed a case where CREATE TABLE ... ENGINE = Buffer(...) without a column list could reveal the structure of a destination table the creating user is not allowed to see. For a CREATE the local server executes itself, the structure is now inferred under the user's own context, so…
fixBackported in: Fixed ATTACH of a Kafka table when kafka_num_consumers exceeds the limit derived from the number of CPU cores. (Nikolay Degterinsky).
fixBackported in: Fixed reading Paimon tables that contain a nullable ARRAY or MAP column. Such a table could not be read at all, because the schema mapper wrapped the composite type in Nullable, which ClickHouse forbids, so both DESC and SELECT failed with Nested type Array(Nullable(Int32)) cannot…
fixBackported in: Fix part and granule pruning for a JOIN ON condition involving constant columns of the other side. (Vladimir Cherkasov).
fixBackported in: Fixed a row policy containing a scalar subquery being evaluated only once and then reused forever after the table had been read through a Merge table. The parsed policy condition is cached and shared by all queries, and reading it through Merge rewrote the cached expression in…
fixBackported in: Fix a wrong value returned for a virtual column such as _table or _database selected from the right side of a JOIN served by DirectKeyValueJoin (a key-value storage such as EmbeddedRocksDB, KeeperMap, Redis, or a dictionary). The query returned the contents of a data column instead,…
fixBackported in: Fix CANNOT_CONVERT_TYPE and an exception in GroupingAggregatedTransform when reading a Merge table with one child being a Distributed table under custom-key parallel replicas (parallel_replicas_mode = 'custom_key_sampling' or 'custom_key_range'). Closes. (Alexey Milovidov).
fixBackported in: Fixed ORDER BY ... LIMIT returning fewer rows than requested, possibly none, when a row policy was the only filter of the query and the sort column had a minmax skip index. The top-K optimization narrowed the read before the row policy was applied. (Alexey Milovidov).
fixBackported in: Fixed an exception when reading a MergeTree table by primary-key range layers when a layer produces an empty pipe. (Alexey Milovidov).
featureBackported in: Add a dedicated thread pool for lightweight snapshot creation. (Han Fei).
featureBackported in: This patch: 1. Removes the global error screen (blue screen) and replaces it with a note above the dashboards. In this approach, on any error, already fetched graphs will not be hidden. 2. Dashboard now opens the graphs view immediately. 3. Reload button and any other button can be…
+21 more items in the release notes
26.6.2.160 Aug 5, 2026 Release notes ↗
featureBackported in: Introduce a memory reservation feature for workloads. More details https://clickhouse.com/docs/operations/workload-scheduling. (Sergei Trifonov).
featureBackported in: Added a postprocessor to the text index which transforms the tokens after tokenization. (Jimmy Aguilar Mena).
featureBackported in: AI functions no longer take the named collection as the first positional argument. Credentials come from the ai_function_text_default_credentials / ai_function_embedding_default_credentials settings or from a credentials key in an optional trailing Map(String, String) argument,…
featureBackported in: Tag OpenAI-format HTTP requests with the SQL name of the calling AI function for upstream endpoint identification. (George Larionov).
fixBackported in: Fixed a performance regression (introduced in) where reading many small files from object storage via the s3() and other table functions stopped prefetching and fell back to synchronous reads, significantly slowing single-threaded / low-concurrency reads of lots of tiny files.…
fixBackported in: Account for Map subcolumn on-disk size in prewhere optimization. This fixes the regression in PREWHERE introduced Part of. (Pavel Kruglov).
fixBackported in: Fixed O(P×N) deduplication hash recomputation in async insert flushes that split across P partitions. DeduplicationInfo::prewarmDataHashes is now called once before the partition loop in MergeTreeSink and ReplicatedMergeTreeSink, so all per-partition clones inherit pre-computed…
featureBackported in: Restore show_data_lake_catalogs_in_system_tables as the setting that controls only DataLakeCatalog visibility in system.tables, system.columns, and system.completions. Added show_remote_databases_in_system_tables, enabled by default, to let users hide MySQL and PostgreSQL databases…
featureBackported in: I always find it difficult to add multiple metrics to the dashboard during debugging sessions. This patch adds a simpler way to add them directly from the source code or documentation. (Mikhail Artemenko).
featureBackported in: Added the jemalloc_merge_tree_arenas server setting controlling the dedicated jemalloc arena(s) used for MergeTree part and table metadata: 0 disables it, 1 uses a single arena (default), and N creates a per-CPU pool. On many-core servers a pool reduces memory-allocator lock…
featureBackported in: Added setting analyzer_compatibility_apply_final_to_all_joined_tables that restores the old behavior, where the FINAL modifier on the left-most table of a JOIN was also applied to the other joined tables. The setting is registered in the settings changes history, so compatibility…
fixBackported in: Fix a server abort during RESTORE of backups containing tables with cyclic dependencies. (Konstantin Bogdanov).
fixBackported in: Fixed a race between ALTER TABLE ... RENAME COLUMN and a concurrent OPTIMIZE TABLE ... FINAL (or any background merge) in MergeTree that could silently replace the renamed column's data with default values. The race window between publishing the new in-memory metadata and…
fixBackported in: Fixes LOGICAL_ERROR about duplicate column names in row policy actions. (János Benjamin Antal).
fixBackported in: Fixed wrong results when querying a ReplacingMergeTree table with FINAL and a filter on a text index while query_plan_optimize_lazy_final was enabled. The lazy FINAL optimization built reading steps that did not reproduce the direct read from the text index, so the filter dropped…
fixBackported in: Fix a LOGICAL_ERROR (Invalid number of rows in Chunk) in JoiningTransform for a LEFT JOIN with unique right keys, a mixed ON condition, and a small max_joined_block_size_rows. (Groene AI).
fixBackported in: Closes. (Pedro Ferreira).
fixBackported in: Fix a server crash when moving an empty part to a plain_rewritable disk (for example with ALTER TABLE ... MOVE PARTITION ... TO DISK for an empty part kept by remove_empty_parts = 0). (Groene AI).
fixBackported in: Fix incorrect row order in ORDER BY queries over UNION ALL with optimize_read_in_order and read_in_order_use_virtual_row enabled, close. (Vladimir Cherkasov).
fixBackported in: Incremental backups no longer store S3 credentials in the locator of the .backup metadata file. Backups created with use_same_s3_credentials_for_base_backup = 1, or with explicit base backup credentials matching this backup locator, store a non-secret marker and are restored without…
fixBackported in: Fixed a regression where setting compatibility = '26.6' (which implicitly enables hive partition strategy) silently accepted {_partition_id} in S3/object storage table paths instead of raising BAD_ARGUMENTS. (Lefteris).
fixBackported in: Fix NULL values being silently converted to empty strings when inserting Arrow/ORC data into a LowCardinality(Nullable(...)) column. This was a regression introduced in 26.5. (Jimmy Aguilar Mena).
fixBackported in: Fix a Logical error: Stream ... variant_discr ... is not found that could occur when merging or reading a MergeTree part produced by a mutation of a table with a Dynamic column. (Alexey Milovidov).
fixBackported in: Fixed RESTORE for ReplicatedMergeTree tables so duplicate-content parts from a backup are preserved instead of being silently deduplicated. (Pablo Marcos).
fixBackported in: Fix runtime join filter producing wrong results for JSON columns. Closes. (Pavel Kruglov).
fixBackported in: Fixed incorrect results from distributed queries selecting ALIAS columns that share a common subexpression: columns could be misaligned and values returned under the wrong column. (Vladimir Cherkasov).
fixBackported in: Fixed a Block structure mismatch in UnionStep stream logical error (server abort on debug/sanitizer builds, Code: 49 on release builds) that occurred when sibling branches of a UNION/INTERSECT/EXCEPT differed only in their WHERE predicate and one branch's predicate constant-folded…
fixBackported in: Fix server crash (SIGSEGV) when reading Protobuf data with input_format_allow_errors_num > 0 and a valid message precedes a bad (skippable) message in the same block. (Andrey Tsarevskiy | Андрей Царевский ).
fixBackported in: A transient error while refreshing data parts of a read-only table no longer permanently stops the background refresh task. (Alexey Milovidov).
fixBackported in: Fix a Bad cast from type DB::ColumnNullable to DB::ColumnVector crash (logical error) when a qualified asterisk (t.*) selects a JOIN USING key and that join is nested below a PASTE/CROSS/comma join or an outer ON join, with join_use_nulls = 0. (Groene AI).
fixBackported in: Hide sensitive info in system.query_views_log.view_query. (Valerii Mordovskii).
fixBackported in: Fix NOT_FOUND_COLUMN_IN_BLOCK error for queries that use the _part_starting_offset/_part_offset virtual columns in WHERE together with lazy materialization. (Vladimir Cherkasov).
fixBackported in: index_granularity_bytes is now honored for AggregateFunction state columns. Previously the granule byte cap was ignored for such columns (for example uniqExact states in AggregatingMergeTree tables and aggregating projections), producing granules far larger than the configured limit…
fixBackported in: Fix CREATE OR REPLACE of a Refreshable MV with a TO target. (Nikolay Degterinsky).
fixBackported in: Vector search queries that SELECT from the _distance column now return a proper error instead of failing with a LOGICAL_ERROR. (Robert Schulze).
fixBackported in: SYSTEM RESET DDL WORKER now requires the new SYSTEM RESET DDL WORKER privilege. Previously any authenticated user (including readonly ones) could run it and repeatedly reset the DDL worker state, blocking ON CLUSTER DDL. (Groene AI).
fixBackported in: Restrict the model path of catboostEvaluate to the user_files directory, like file() and the dictionary sources. Previously the function accepted an arbitrary filesystem path with no containment check, which allowed probing the existence of and triggering reads of files outside…
fixBackported in: Fixed ssl_certificate user identification so a single wildcard matches exactly one name component (RFC 6125 6.4.3). Previously a wildcard in a CN or DNS: SAN subject (for example .corp.example.com) also matched multi-label names such as evil.deep.corp.example.com, letting a holder…
fixBackported in: Fixed wrong results when using SELECT [...] SAMPLE [...] together with the query condition cache (setting use_query_condition_cache = 1 which is also the default). (Groene AI).
securityBackported in: Fix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze).
+119 more items in the release notes
26.6.2.158 Aug 4, 2026 Release notes ↗
featureBackported in: Introduce a memory reservation feature for workloads. More details https://clickhouse.com/docs/operations/workload-scheduling. (Sergei Trifonov).
featureBackported in: Added a postprocessor to the text index which transforms the tokens after tokenization. (Jimmy Aguilar Mena).
featureBackported in: AI functions no longer take the named collection as the first positional argument. Credentials come from the ai_function_text_default_credentials / ai_function_embedding_default_credentials settings or from a credentials key in an optional trailing Map(String, String) argument,…
featureBackported in: Tag OpenAI-format HTTP requests with the SQL name of the calling AI function for upstream endpoint identification. (George Larionov).
fixBackported in: Fixed a performance regression (introduced in) where reading many small files from object storage via the s3() and other table functions stopped prefetching and fell back to synchronous reads, significantly slowing single-threaded / low-concurrency reads of lots of tiny files.…
fixBackported in: Account for Map subcolumn on-disk size in prewhere optimization. This fixes the regression in PREWHERE introduced Part of. (Pavel Kruglov).
fixBackported in: Fixed O(P×N) deduplication hash recomputation in async insert flushes that split across P partitions. DeduplicationInfo::prewarmDataHashes is now called once before the partition loop in MergeTreeSink and ReplicatedMergeTreeSink, so all per-partition clones inherit pre-computed…
featureBackported in: Restore show_data_lake_catalogs_in_system_tables as the setting that controls only DataLakeCatalog visibility in system.tables, system.columns, and system.completions. Added show_remote_databases_in_system_tables, enabled by default, to let users hide MySQL and PostgreSQL databases…
featureBackported in: I always find it difficult to add multiple metrics to the dashboard during debugging sessions. This patch adds a simpler way to add them directly from the source code or documentation. (Mikhail Artemenko).
featureBackported in: Added the jemalloc_merge_tree_arenas server setting controlling the dedicated jemalloc arena(s) used for MergeTree part and table metadata: 0 disables it, 1 uses a single arena (default), and N creates a per-CPU pool. On many-core servers a pool reduces memory-allocator lock…
featureBackported in: Added setting analyzer_compatibility_apply_final_to_all_joined_tables that restores the old behavior, where the FINAL modifier on the left-most table of a JOIN was also applied to the other joined tables. The setting is registered in the settings changes history, so compatibility…
fixBackported in: Fix a server abort during RESTORE of backups containing tables with cyclic dependencies. (Konstantin Bogdanov).
fixBackported in: Fixed a race between ALTER TABLE ... RENAME COLUMN and a concurrent OPTIMIZE TABLE ... FINAL (or any background merge) in MergeTree that could silently replace the renamed column's data with default values. The race window between publishing the new in-memory metadata and…
fixBackported in: Fixes LOGICAL_ERROR about duplicate column names in row policy actions. (János Benjamin Antal).
fixBackported in: Fixed wrong results when querying a ReplacingMergeTree table with FINAL and a filter on a text index while query_plan_optimize_lazy_final was enabled. The lazy FINAL optimization built reading steps that did not reproduce the direct read from the text index, so the filter dropped…
fixBackported in: Fix a LOGICAL_ERROR (Invalid number of rows in Chunk) in JoiningTransform for a LEFT JOIN with unique right keys, a mixed ON condition, and a small max_joined_block_size_rows. (Groene AI).
fixBackported in: Closes. (Pedro Ferreira).
fixBackported in: Fix a server crash when moving an empty part to a plain_rewritable disk (for example with ALTER TABLE ... MOVE PARTITION ... TO DISK for an empty part kept by remove_empty_parts = 0). (Groene AI).
fixBackported in: Fix incorrect row order in ORDER BY queries over UNION ALL with optimize_read_in_order and read_in_order_use_virtual_row enabled, close. (Vladimir Cherkasov).
fixBackported in: Incremental backups no longer store S3 credentials in the locator of the .backup metadata file. Backups created with use_same_s3_credentials_for_base_backup = 1, or with explicit base backup credentials matching this backup locator, store a non-secret marker and are restored without…
fixBackported in: Fixed a regression where setting compatibility = '26.6' (which implicitly enables hive partition strategy) silently accepted {_partition_id} in S3/object storage table paths instead of raising BAD_ARGUMENTS. (Lefteris).
fixBackported in: Fix NULL values being silently converted to empty strings when inserting Arrow/ORC data into a LowCardinality(Nullable(...)) column. This was a regression introduced in 26.5. (Jimmy Aguilar Mena).
fixBackported in: Fix a Logical error: Stream ... variant_discr ... is not found that could occur when merging or reading a MergeTree part produced by a mutation of a table with a Dynamic column. (Alexey Milovidov).
fixBackported in: Fixed RESTORE for ReplicatedMergeTree tables so duplicate-content parts from a backup are preserved instead of being silently deduplicated. (Pablo Marcos).
fixBackported in: Fix runtime join filter producing wrong results for JSON columns. Closes. (Pavel Kruglov).
fixBackported in: Fixed incorrect results from distributed queries selecting ALIAS columns that share a common subexpression: columns could be misaligned and values returned under the wrong column. (Vladimir Cherkasov).
fixBackported in: Fixed a Block structure mismatch in UnionStep stream logical error (server abort on debug/sanitizer builds, Code: 49 on release builds) that occurred when sibling branches of a UNION/INTERSECT/EXCEPT differed only in their WHERE predicate and one branch's predicate constant-folded…
fixBackported in: Fix server crash (SIGSEGV) when reading Protobuf data with input_format_allow_errors_num > 0 and a valid message precedes a bad (skippable) message in the same block. (Andrey Tsarevskiy | Андрей Царевский ).
fixBackported in: A transient error while refreshing data parts of a read-only table no longer permanently stops the background refresh task. (Alexey Milovidov).
fixBackported in: Fix a Bad cast from type DB::ColumnNullable to DB::ColumnVector crash (logical error) when a qualified asterisk (t.*) selects a JOIN USING key and that join is nested below a PASTE/CROSS/comma join or an outer ON join, with join_use_nulls = 0. (Groene AI).
fixBackported in: Hide sensitive info in system.query_views_log.view_query. (Valerii Mordovskii).
fixBackported in: Fix NOT_FOUND_COLUMN_IN_BLOCK error for queries that use the _part_starting_offset/_part_offset virtual columns in WHERE together with lazy materialization. (Vladimir Cherkasov).
fixBackported in: index_granularity_bytes is now honored for AggregateFunction state columns. Previously the granule byte cap was ignored for such columns (for example uniqExact states in AggregatingMergeTree tables and aggregating projections), producing granules far larger than the configured limit…
fixBackported in: Fix CREATE OR REPLACE of a Refreshable MV with a TO target. (Nikolay Degterinsky).
fixBackported in: Vector search queries that SELECT from the _distance column now return a proper error instead of failing with a LOGICAL_ERROR. (Robert Schulze).
fixBackported in: SYSTEM RESET DDL WORKER now requires the new SYSTEM RESET DDL WORKER privilege. Previously any authenticated user (including readonly ones) could run it and repeatedly reset the DDL worker state, blocking ON CLUSTER DDL. (Groene AI).
fixBackported in: Restrict the model path of catboostEvaluate to the user_files directory, like file() and the dictionary sources. Previously the function accepted an arbitrary filesystem path with no containment check, which allowed probing the existence of and triggering reads of files outside…
fixBackported in: Fixed ssl_certificate user identification so a single wildcard matches exactly one name component (RFC 6125 6.4.3). Previously a wildcard in a CN or DNS: SAN subject (for example .corp.example.com) also matched multi-label names such as evil.deep.corp.example.com, letting a holder…
fixBackported in: Fixed wrong results when using SELECT [...] SAMPLE [...] together with the query condition cache (setting use_query_condition_cache = 1 which is also the default). (Groene AI).
securityBackported in: Fix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze).
+117 more items in the release notes
26.6.2.81 Jul 21, 2026 Release notes ↗
featureBackported in: Introduce a memory reservation feature for workloads. More details https://clickhouse.com/docs/operations/workload-scheduling. (Sergei Trifonov).
featureBackported in: Added a postprocessor to the text index which transforms the tokens after tokenization. (Jimmy Aguilar Mena).
fixBackported in: Fixed a performance regression (introduced in) where reading many small files from object storage via the s3() and other table functions stopped prefetching and fell back to synchronous reads, significantly slowing single-threaded / low-concurrency reads of lots of tiny files.…
featureBackported in: Restore show_data_lake_catalogs_in_system_tables as the setting that controls only DataLakeCatalog visibility in system.tables, system.columns, and system.completions. Added show_remote_databases_in_system_tables, enabled by default, to let users hide MySQL and PostgreSQL databases…
featureBackported in: I always find it difficult to add multiple metrics to the dashboard during debugging sessions. This patch adds a simpler way to add them directly from the source code or documentation. (Mikhail Artemenko).
fixBackported in: Fix a server abort during RESTORE of backups containing tables with cyclic dependencies. (Konstantin Bogdanov).
fixBackported in: Fixed a race between ALTER TABLE ... RENAME COLUMN and a concurrent OPTIMIZE TABLE ... FINAL (or any background merge) in MergeTree that could silently replace the renamed column's data with default values. The race window between publishing the new in-memory metadata and…
fixBackported in: Fixes LOGICAL_ERROR about duplicate column names in row policy actions. (János Benjamin Antal).
fixBackported in: Fixed wrong results when querying a ReplacingMergeTree table with FINAL and a filter on a text index while query_plan_optimize_lazy_final was enabled. The lazy FINAL optimization built reading steps that did not reproduce the direct read from the text index, so the filter dropped…
fixBackported in: Closes. (Pedro Ferreira).
fixBackported in: Fix a server crash when moving an empty part to a plain_rewritable disk (for example with ALTER TABLE ... MOVE PARTITION ... TO DISK for an empty part kept by remove_empty_parts = 0). (Groene AI).
fixBackported in: Incremental backups no longer store S3 credentials in the locator of the .backup metadata file. Backups created with use_same_s3_credentials_for_base_backup = 1, or with explicit base backup credentials matching this backup locator, store a non-secret marker and are restored without…
fixBackported in: Fix NULL values being silently converted to empty strings when inserting Arrow/ORC data into a LowCardinality(Nullable(...)) column. This was a regression introduced in 26.5. (Jimmy Aguilar Mena).
fixBackported in: Fixed RESTORE for ReplicatedMergeTree tables so duplicate-content parts from a backup are preserved instead of being silently deduplicated. (Pablo Marcos).
fixBackported in: Fix runtime join filter producing wrong results for JSON columns. Closes. (Pavel Kruglov).
fixBackported in: Fixed incorrect results from distributed queries selecting ALIAS columns that share a common subexpression: columns could be misaligned and values returned under the wrong column. (Vladimir Cherkasov).
fixBackported in: A transient error while refreshing data parts of a read-only table no longer permanently stops the background refresh task. (Alexey Milovidov).
fixBackported in: Hide sensitive info in system.query_views_log.view_query. (Valerii Mordovskii).
fixBackported in: index_granularity_bytes is now honored for AggregateFunction state columns. Previously the granule byte cap was ignored for such columns (for example uniqExact states in AggregatingMergeTree tables and aggregating projections), producing granules far larger than the configured limit…
fixBackported in: Fix CREATE OR REPLACE of a Refreshable MV with a TO target. (Nikolay Degterinsky).
fixBackported in: Vector search queries that SELECT from the _distance column now return a proper error instead of failing with a LOGICAL_ERROR. (Robert Schulze).
fixBackported in: SYSTEM RESET DDL WORKER now requires the new SYSTEM RESET DDL WORKER privilege. Previously any authenticated user (including readonly ones) could run it and repeatedly reset the DDL worker state, blocking ON CLUSTER DDL. (Groene AI).
fixBackported in: Restrict the model path of catboostEvaluate to the user_files directory, like file() and the dictionary sources. Previously the function accepted an arbitrary filesystem path with no containment check, which allowed probing the existence of and triggering reads of files outside…
fixBackported in: Fixed ssl_certificate user identification so a single wildcard matches exactly one name component (RFC 6125 6.4.3). Previously a wildcard in a CN or DNS: SAN subject (for example .corp.example.com) also matched multi-label names such as evil.deep.corp.example.com, letting a holder…
fixBackported in: Fixed wrong results when using SELECT [...] SAMPLE [...] together with the query condition cache (setting use_query_condition_cache = 1 which is also the default). (Groene AI).
fixBackported in: Fixed a server crash (stack overflow) caused by deeply nested expressions such as [[[ ... ]]] or array(array( ... )) when max_parser_depth is set to a large value. (Raúl Marín).
fixBackported in: The MySQL wire protocol commands COM_FIELD_LIST (mysql_list_fields) and COM_INIT_DB (USE database) now enforce the same access control as their SQL equivalents (SHOW COLUMNS/DESCRIBE and USE). Previously they could disclose column names of tables the user only had partial column…
fixBackported in: Match http_forbid_headers case-insensitively. HTTP header names are case-insensitive, so forbidding Authorization now also blocks authorization, AUTHORIZATION and other case variants. Configured header_regexp patterns are now matched case-insensitively without needing an explicit…
fixBackported in: Fix NOT_FOUND_COLUMN_IN_BLOCK when a compound predicate is aliased in GROUP BY and referenced again, with enable_identifier_resolve_cache enabled (the default). The optimize_and_compare_chain optimization was not idempotent and a shared resolved node accumulated a duplicate…
fixBackported in: Fix a SELECT * projection returning a column's type default (e.g. 0) instead of its DEFAULT value (e.g. -1) when reading a column added with ALTER TABLE ... ADD COLUMN ... DEFAULT after the projection was created. Reads from the base table were already correct; only reads answered…
fixBackported in: Fixed direct read from multiple partially materialized text indexes. (Anton Popov).
fixBackported in: Fix a metadata-disclosure where DESCRIBE loop('db', 'table') and DESCRIBE loop() bypassed the SHOW COLUMNS / source access check, letting an unprivileged user read a table's column schema. (Groene AI).
fixBackported in: Fixed a startup failure where a DataLakeCatalog database created by an older version (25.12 or earlier) with a malformed auth_header could not be attached after upgrading to 26.2 or later, preventing the server from starting. The auth_header is now validated only on CREATE, and on…
fixBackported in: Fix NUMBER_OF_COLUMNS_DOESNT_MATCH error when a subquery on a Distributed table reads two or more ALIAS columns that expand to the same expression (for example a1 String ALIAS toString(x), a2 String ALIAS toString(x)) and the subquery feeds an outer query, e.g. SELECT count() FROM…
fixBackported in: Fixed partition and primary key pruning being silently disabled when a LowCardinality(FixedString) (or LowCardinality(Nullable(FixedString))) key column is wrapped in a function in the key, for example PARTITION BY sipHash64(k) % N with WHERE k = 'literal'. Such queries scanned all…
fixBackported in: Fixed insert_quorum = 'auto' not rejecting inserts up front when fewer than a majority of replicas were alive. Such inserts now fail immediately with TOO_FEW_LIVE_REPLICAS instead of writing a local part and later timing out with UNKNOWN_STATUS_OF_INSERT. (Gagan Dhakrey).
fixBackported in: Fix a segmentation fault when merging uniqExact aggregate states with GROUPING SETS, ROLLUP or CUBE and max_threads > 1. (Raúl Marín).
fixBackported in: Fixed a bug in the new analyzer where FINAL on one table of a JOIN (e.g. FROM t1 FINAL JOIN t2) was incorrectly applied to the other joined tables as well, what could made such queries slower. (Vladimir Cherkasov).
fixBackported in: Fix schema inference for the Arrow, ArrowStream, Avro formats and the legacy ORC and Parquet readers returning Nullable(Tuple) for nullable struct columns while the Nullable(Tuple) type is not allowed (allow_experimental_nullable_tuple_type is disabled). DESCRIBE returned a type…
securityBackported in: Fix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze).
+40 more items in the release notes
26.6.1.1193 Jun 25, 2026 Release notes ↗
breakingThe change removes allow_experimental_query_deduplication feature. The feature was experimental for a long time, has no tests and not going to be supported (initial tests were unstable and has been removed https://github.com/ClickHouse/ClickHouse/pull/49579). (Igor Nikonov).
breakingThe XRay-based SYSTEM INSTRUMENT feature now uses arguments instead of parameters: the system.instrumentation.parameters column was renamed to arguments, and the SYSTEM INSTRUMENT ADD ... HANDLER PARAMETERS ... syntax was renamed to SYSTEM INSTRUMENT ADD ... HANDLER ARGUMENTS .... Queries or…
breakingThe setting show_data_lake_catalogs_in_system_tables has been renamed to show_remote_databases_in_system_tables and broadened: when its value is 0 (the default), MySQL and PostgreSQL databases are also hidden from system.tables, system.columns, and system.completions, in addition to data lake…
breakingALTER TABLE ... REPLACE PARTITION ... FROM ... no longer silently drops the destination partition's data when the source table has no parts in the requested partition. Previously such a request removed the destination partition and wrote nothing in its place, an unambiguous data-loss footgun…
breakingThe default x86 build now targets x86-64-v3 (AVX2) instead of x86-64-v2 (SSE4.2). This requires a CPU with AVX2 support (Intel Haswell or later, AMD Excavator or later). If your CPU does not support AVX2, use the amd64compat build which targets plain x86-64. (Raúl Marín).
breakingReject nested Dynamic/Variant in min/max aggregates and minmax indexes. Previously only top-level Dynamic/Variant were checked. Closes. (Pavel Kruglov).
breakingicebergHash and icebergBucket now reject Int128, UInt128, Int256, UInt256, and Decimal256 arguments with an explicit error. Previously they silently truncated wider values and produced colliding hashes. The Iceberg spec only defines hashing for 32/64-bit integers and decimals with precision up to…
breakingAdded granular control over query echoing in the CLI. The --echo option now accepts an optional boolean value and works in both interactive and batch mode. New options --echo-formatted and --echo-query-id control whether echoed queries are formatted and whether the query_id is printed,…
breakingThe default of the server setting insert_deduplication_version changes from compatible_double_hashes to new_unified_hash. Insert deduplication now works on the whole inserted block (per insert) rather than per part/partition: a retry of the same insert is still deduplicated, but two different…
breakingRemoved the experimental KQL (Kusto) functions array_sort_asc and array_sort_desc, and their SQL backends kql_array_sort_asc and kql_array_sort_desc. These functions were experimental, implemented with low quality, and the source of correctness and parser bugs. Queries using these names now return…
featureAdded a setting output_format_always_write_decimal_point_in_float_and_decimal to always print a decimal point for floating-point and Decimal numbers in text formats, even when the value is a whole number. For example, output 1. instead of 1. Disabled by default. (Ilya Yatsishin).
featureformatReadableTimeDelta now accepts an INTERVAL expression of type other than Month and Year as input. (Francisco J. Jurado Moreno).
featureAdded the PNG output format support, allowing query output results to be directly rendered as PNG images. (Maksim Dergousov).
featureAdds IPV4_PREFIX_BITS and IPV6_PREFIX_BITS flags when Keying done by IP_ADDRESS or FORWARDED_IP_ADDRESS. (Aditya Chopra).
featureImplement ADD ENUM VALUES in ALTER TABLE queries to simplify appending new values to an existing Enum type without the need to specify all current Enum values again. (Ilya Golshtein).
featureAdd a new immutable MergeTree setting allow_tuple_element_aggregation, disabled by default. When enabled, SummingMergeTree, AggregatingMergeTree and CoalescingMergeTree recursively flatten Tuple columns and aggregate each leaf element independently during merges, exactly as if it were a top-level…
featureAdd the GeoJSON input format for reading GeoJSON FeatureCollection documents, producing one row per feature with id (String), geometry (Geometry), and properties (Nullable(JSON)) columns. Point, LineString, MultiLineString, Polygon, and MultiPolygon geometries are read into ClickHouse's native…
featureBackported in: Added a postprocessor to the text index which transforms the tokens after tokenization. (Jimmy Aguilar Mena).
featureAdd output_format_float_precision setting to control the number of decimal digits in floating-point text output. (phulv94).
featureAdded ESCAPE syntax that defines a custom escape character in a LIKE pattern, allowing you to treat % and _ as literal characters instead of wildcards. (Ilya Yatsishin).
featureSupport TTL nodes in ClickHouse Keeper. ClickHouse-specific notes: - Opt-in via the create_ttl feature flag; requires write_snapshot_version >= 8 on every replica (snapshot V8 persists ttl, digest bumped to V5). - Unlike ZooKeeper, a TTL node cannot have children — ttl reuses the seq_num slot in…
featureAdd materialize_projections_on_insert and materialize_projections_on_merge MergeTree table settings. When materialize_projections_on_insert = 0, INSERTs skip building projection parts, which improves insert throughput for tables with many projections. When materialize_projections_on_merge = 1, a…
featureclickhouse-local now supports SYSTEM START LISTEN and SYSTEM STOP LISTEN queries, allowing it to be transformed into a server accepting TCP and HTTP connections. (Alexey Milovidov).
featureBackported in: Add new positions argument support to text indexes to store token positions and enable exact direct reads for hasPhrase. The allow_experimental_text_index_positions needs to be enabled to store positional information. (Elmi Ahmadov).
featureAdded support for the PromQL histogram_quantile function in prometheusQuery and prometheusQueryRange table functions. This enables computing quantiles over classic Prometheus histogram buckets identified by the le label. (Joe Smith).
featureAdded a new system table system.iceberg_files exposing per-file metadata for Iceberg tables, with one row per data or delete file in each table's current snapshot. This closes. (Asya Shneerson).
featureYou can now use h3PolygonToCellsWithContainment function from h3 to use their new algorithm which supports center-based, fully-contained, and overlapping containment modes. ... (Youssef Kadry).
featureAdd functions arrayTopK and arrayBottomK: - arrayTopK(k, array) returns the K largest elements in descending order - arrayBottomK(k, array) returns the K smallest elements in ascending order. (Vitaly Baranov).
featureAdd support for selecting columns by name pattern with * LIKE '' and * ILIKE '', including qualified forms such as table.* LIKE '' and table.* ILIKE ''. LIKE matches column names case-sensitively, ILIKE case-insensitively. (Yue Ni).
featureAdded hypothetical (what-if) skip indexes. Use CREATE HYPOTHETICAL INDEX ... ON t (expr) TYPE ... to define a session-scoped virtual skip index, then EXPLAIN WHATIF SELECT ... to estimate its skip ratio and cost without materializing it. Defined indexes are visible in the new…
featureUser can now specify an optional precision argument to the formatReadableSize, formatReadableDecimalSize and formatReadableQuantity functions, controlling the number of digits after the decimal point. Default is 2, preserving the prior behavior. (Antonio Filipovic).
featureAdd message_queue_disable_insertion server setting to disable insertion from message queue engines (Kafka, RabbitMQ, NATS) into attached materialized views. Useful for read-only replica scenarios. (JIaQi Tang).
featureThis patch adds support for continuous query for merge tree tables implemented via a series of snapshot reads. This is a first step toward general support for streaming queries. (Mikhail Artemenko).
featureAdd an embedded /schema web UI to clickhouse-server that visualizes the dependency graph between tables, materialized views, refreshable materialized views, dictionaries, distributed tables and views. (Nikita Mikhaylov).
featureAdded system.constraints table that provides information about all CHECK and ASSUME constraints across all tables, including constraint name, type, and expression. (Pedro Ferreira).
featureAdded a new S3Queue setting after_processing_move_preserve_path. When enabled together with after_processing='move' and after_processing_move_prefix, processed objects are moved while preserving their full source path under the destination prefix instead of being flattened to just the file name.…
featureSupport writing into such storage https://learn.microsoft.com/en-us/training/modules/introduction-to-azure-data-lake-storage/2-azure-data-lake-gen2. (Konstantin Vedernikov).
featureAdded min_by and max_by aggregate aliases for argMin and argMax. (Joey Yu).
featureAdding RowBinaryWithNamesAndTypesAndDefaults format to get better support for schema evolution. (Mark Zitnik).
securitydistroless: bump base pin to clear libssl3t64 CVE-2026-45447. (Rahul Nair).
+1079 more items in the release notes
26.5.7.64 Aug 19, 2026 Release notes ↗
featureBackported in: Added fs cache download wait timeout configured by filesystem_cache_wait_for_concurrent_download_timeout_milliseconds. This timeout defined only the wait for a single chunk (buffer bytes of ~1mb) of data, not the whole file segment. (Kseniia Sumarokova).
fixBackported in: Fix LOGICAL_ERROR exceptions when reading Iceberg or DeltaLake data lake tables through paths that can reach the read pipeline without a pinned datalake_table_state, such as concurrent Iceberg metadata updates or merge reads over DeltaLake tables. (Groene AI).
fixBackported in: Fix a LOGICAL_ERROR (Invalid number of rows in Chunk) in JoiningTransform for a LEFT JOIN with unique right keys, a mixed ON condition, and a small max_joined_block_size_rows. (Groene AI).
fixBackported in: Fix a rare LOGICAL_ERROR "Attempt to release query context that does not exist" and the accompanying server crash when reading MergeTree tables through a filesystem cache disk created with enable_filesystem_query_cache_limit = 1. (Groene AI).
fixBackported in: Fix incorrect row order in ORDER BY queries over UNION ALL with optimize_read_in_order and read_in_order_use_virtual_row enabled, close. (Vladimir Cherkasov).
fixBackported in: Reject unsupported uses of AggregateFunction columns in TTL expressions at CREATE TABLE time (e.g. TTL toDateTime(state)) instead of failing later during TTL execution with ILLEGAL_TYPE_OF_ARGUMENT. This also covers states carried inside Variant alternatives and Dynamic values.…
fixBackported in: Fixed reading Iceberg v3 tables whose Parquet data files contain reserved row-lineage columns (such as _row_id); the native Parquet reader no longer raises ICEBERG_SPECIFICATION_VIOLATION for reserved field ids that are not part of the table schema. (Greg Maher).
fixBackported in: Fix type_json_allow_duplicated_key_with_literal_and_nested_object not working with typed paths in JSON. (Pavel Kruglov).
fixBackported in: Fixes a null-pointer dereference segfault in StreamingStorageRegistry that occurs when StreamingStorageRegistry::shutdown and StorageObjectStorageQueue::shutdown are called concurrently. (Miсhael Stetsyuk).
fixBackported in: Preserve original key order in bucketed Map serialization to fix comparison operations that depend on it. (Pavel Kruglov).
fixBackported in: Fix segfault in largestTriangleThreeBuckets aggregate function by rejecting broken aggregate function state at the deserialization level. (Miсhael Stetsyuk).
fixBackported in: Fix possible logical error "Unexpected substream ... for column ..." during bump of compatibility setting. (Pavel Kruglov).
fixBackported in: Fix a segfault when a query arrives while the server is shutting down after an error during startup that happens in a narrow window between servers' startup and creating an exit scope for stopping and reaping of servers. (Miсhael Stetsyuk).
fixBackported in: Fix wrong IS NULL / IS NOT NULL / count() results with optimize_functions_to_subcolumns on a column that was made Nullable by a metadata-only ALTER MODIFY COLUMN T to Nullable(T). For parts written before the conversion, the .null subcolumn was filled from the storage-type default…
fixBackported in: With analyzer_compatibility_join_using_top_level_identifier = 1, an identifier in JOIN ... USING can now be resolved from an alias defined on a subexpression inside the SELECT list (for example, SELECT uniqExact(lower(x) AS id) FROM t1 JOIN t2 USING (id)), matching the old analyzer…
fixBackported in: Fixed a logical error Block structure mismatch (in debug and sanitizer builds) and an Illegal types of arguments error for set operations over compatible aggregate-state columns (e.g. quantileState and quantilesState(0.9)) nested inside container columns such as Tuple, Array, Map,…
fixBackported in: RESTORE now fsyncs the restored part files when the destination table has fsync_after_insert enabled, so a restored part is as durable against power loss as an inserted one. Previously restored files were only written and closed (never fsynced), so a power loss right after RESTORE…
fixBackported in: Now RestCatalog throw proper exception instead of silence or "UNKNOWN_TABLE" in case of stale credentials. (alesapin).
fixBackported in: Restrict local object access only for user files path. Continuation of https://github.com/ClickHouse/ClickHouse/pull/99405. (Konstantin Vedernikov).
fixBackported in: Fix a logical error Block structure mismatch in IntersectOrExceptStep stream: different number of columns that could happen when the filter split optimization (query_plan_split_filter) ran on a WHERE whose filter column name is also an input column name. The optimization left an…
fixBackported in: Fixed a stack frame being displayed as ? instead of its function name in fatal log messages and in the trace_full column of system.crash_log. It affected frames of ordinary functions that have code attributed to a libc++ __functional header, which is common in release builds.…
fixBackported in: Fix out-of-bounds read in SerializationReplicated on the native protocol on corrupted indexes data. (Pavel Kruglov).
fixBackported in: Fixed a crash when reading a Parquet file with inconsistent bloom filter metadata. Such files could also silently return fewer rows than they should. (Shaohua Wang).
fixBackported in: Fix an out-of-bounds read (a crash in release builds) in insert deduplication when an INSERT flows through a materialized view whose inner query changes the number of rows and the deduplicating target table is partitioned. DeduplicationInfo::filterToPartition attributed each…
fixBackported in: Fixed server startup and ATTACH failing with WITH RECURSIVE is not supported with the old analyzer for a view with a recursive CTE when enable_analyzer = 0 is the server default. (Nikolay Degterinsky).
fixBackported in: Fixed an out-of-bounds write when reading a Parquet DECIMAL column whose physical type is wider than the type its declared precision maps to, for example DECIMAL(9, 2) stored as physical INT64. Such files are valid Parquet and other writers produce them, but the reader sized the…
fixBackported in: Fix DROP TABLE and SYSTEM STOP VIEW hanging when a Refreshable Materialized View is blocked while planning its refresh query. (Nikolay Degterinsky).
fixBackported in: Fixed a case where CREATE TABLE ... ENGINE = Distributed(...) without a column list could reveal the structure of a local table the creating user is not allowed to see. For a CREATE the local server executes itself, the structure is now inferred under the user's own context, so SHOW…
fixBackported in: Fixed reading the internal _temporary_and_external_tables database through the merge table function and the Merge table engine, which allowed one session to read the temporary tables of other sessions and other users, and caused an exception on the old analyzer path. A database…
fixBackported in: Fixed a query plan optimization stall when a WHERE clause contains a large string constant with many dots and the table carries a bloom_filter, tokenbf_v1, ngrambf_v1 or text skip index. Matching a filter column name against JSONAllPaths(...) index columns enumerated every dot split…
fixBackported in:. (Vladimir Cherkasov).
fixBackported in: Fix a rare use-after-free bug that is triggered in a rare event of the async insert queue having different entries with identical deadlines. Now it's handled gracefully. (Miсhael Stetsyuk).
fixBackported in: Fixed a case where CREATE TABLE ... ENGINE = Buffer(...) without a column list could reveal the structure of a destination table the creating user is not allowed to see. For a CREATE the local server executes itself, the structure is now inferred under the user's own context, so…
fixBackported in: Fixed ATTACH of a Kafka table when kafka_num_consumers exceeds the limit derived from the number of CPU cores. (Nikolay Degterinsky).
fixBackported in: Fixed reading Paimon tables that contain a nullable ARRAY or MAP column. Such a table could not be read at all, because the schema mapper wrapped the composite type in Nullable, which ClickHouse forbids, so both DESC and SELECT failed with Nested type Array(Nullable(Int32)) cannot…
fixBackported in: Fixed a row policy containing a scalar subquery being evaluated only once and then reused forever after the table had been read through a Merge table. The parsed policy condition is cached and shared by all queries, and reading it through Merge rewrote the cached expression in…
fixBackported in: Fix a wrong value returned for a virtual column such as _table or _database selected from the right side of a JOIN served by DirectKeyValueJoin (a key-value storage such as EmbeddedRocksDB, KeeperMap, Redis, or a dictionary). The query returned the contents of a data column instead,…
fixBackported in: Fix CANNOT_CONVERT_TYPE and an exception in GroupingAggregatedTransform when reading a Merge table with one child being a Distributed table under custom-key parallel replicas (parallel_replicas_mode = 'custom_key_sampling' or 'custom_key_range'). Closes. (Alexey Milovidov).
fixBackported in: Fixed ORDER BY ... LIMIT returning fewer rows than requested, possibly none, when a row policy was the only filter of the query and the sort column had a minmax skip index. The top-K optimization narrowed the read before the row policy was applied. (Alexey Milovidov).
featureBackported in: Add a dedicated thread pool for lightweight snapshot creation. (Han Fei).
+23 more items in the release notes
26.5.6.113 Aug 4, 2026 Release notes ↗
featureBackported in: Add aiEmbed function for using LLM APIs to generate embeddings from within ClickHouse. (George Larionov).
featureBackported in: Removing requirement for api key in AI credential named collections. (George Larionov).
featureBackported in: AI functions no longer take the named collection as the first positional argument. Credentials come from the ai_function_text_default_credentials / ai_function_embedding_default_credentials settings or from a credentials key in an optional trailing Map(String, String) argument,…
featureBackported in: Tag OpenAI-format HTTP requests with the SQL name of the calling AI function for upstream endpoint identification. (George Larionov).
fixBackported in: Fixed a performance regression (introduced in) where reading many small files from object storage via the s3() and other table functions stopped prefetching and fell back to synchronous reads, significantly slowing single-threaded / low-concurrency reads of lots of tiny files.…
fixBackported in: Account for Map subcolumn on-disk size in prewhere optimization. This fixes the regression in PREWHERE introduced Part of. (Pavel Kruglov).
fixBackported in: Fixed O(P×N) deduplication hash recomputation in async insert flushes that split across P partitions. DeduplicationInfo::prewarmDataHashes is now called once before the partition loop in MergeTreeSink and ReplicatedMergeTreeSink, so all per-partition clones inherit pre-computed…
fixBackported in: Fix DataLakeCatalog databases with catalog_type = 'onelake' reading table data by using the OneLake Blob endpoint (.blob.fabric.microsoft.com) by default. Set onelake_use_blob_endpoint = false to keep the previous DFS endpoint (.dfs.fabric.microsoft.com) behavior. (Konstantin…
fixBackported in: Fixed reading of the auth_response length in the MySQL handshake, where a length byte >= 128 was interpreted as a multi-gigabyte value because it was read as a signed char. (uwezkhan).
featureBackported in: Restore show_data_lake_catalogs_in_system_tables as the setting that controls only DataLakeCatalog visibility in system.tables, system.columns, and system.completions. Added show_remote_databases_in_system_tables, enabled by default, to let users hide MySQL and PostgreSQL databases…
featureBackported in: I always find it difficult to add multiple metrics to the dashboard during debugging sessions. This patch adds a simpler way to add them directly from the source code or documentation. (Mikhail Artemenko).
featureBackported in: Added the jemalloc_merge_tree_arenas server setting controlling the dedicated jemalloc arena(s) used for MergeTree part and table metadata: 0 disables it, 1 uses a single arena (default), and N creates a per-CPU pool. On many-core servers a pool reduces memory-allocator lock…
fixBackported in: Fix logical error exception when reading Iceberg tables whose format version was upgraded by an external tool (e.g. Spark). (Alexey Milovidov).
fixBackported in: Fixed a race between ALTER TABLE ... RENAME COLUMN and a concurrent OPTIMIZE TABLE ... FINAL (or any background merge) in MergeTree that could silently replace the renamed column's data with default values. The race window between publishing the new in-memory metadata and…
fixBackported in: Add a new compatibility setting analyzer_compatibility_prefer_alias_over_subcolumn (disabled by default). When enabled, the new analyzer prefers the alias-prefix interpretation over Tuple-subcolumn / dotted-column matches for multi-part identifiers, restoring the previous…
fixBackported in: Added data validation on insertions https://github.com/ClickHouse/ClickHouse/pull/98284#issuecomment-4592701308. (Yarik Briukhovetskyi).
fixBackported in: Fix optimize_skip_unused_shards did not apply (and force_optimize_skip_unused_shards falsely failing) when a Distributed table is queried through a Merge table or the merge table function, with the predicate applied above it. (Nikolai Kochetov).
fixBackported in: Fix RestCatalog::empty returning the wrong result when an Iceberg REST catalog contains tables. (Lefteris).
fixBackported in: Fix memory usage growth in filesystem cache. (Kseniia Sumarokova).
fixBackported in: Fixed a bug where the used_privileges and missing_privileges columns of system.query_log could contain privilege strings leaked from unrelated earlier queries of a different user, database, or session. (Alexey Milovidov).
fixBackported in: Fix a server crash when moving an empty part to a plain_rewritable disk (for example with ALTER TABLE ... MOVE PARTITION ... TO DISK for an empty part kept by remove_empty_parts = 0). (Groene AI).
fixBackported in: Fixed a Block structure mismatch in UnionStep stream logical error (server abort on debug/sanitizer builds, Code: 49 on release builds) that occurred when one branch of a UNION/INTERSECT/EXCEPT read a Sparse-serialized column while the sibling branch read the same column as a full…
fixBackported in: Fixed wrong query results caused by the query condition cache when on-fly mutations (apply_mutations_on_fly) or patch parts filtered rows before PREWHERE. A query reading with apply_mutations_on_fly = 1 could poison the cache so that a later query with apply_mutations_on_fly = 0 and…
fixBackported in: Incremental backups no longer store S3 credentials in the locator of the .backup metadata file. Backups created with use_same_s3_credentials_for_base_backup = 1, or with explicit base backup credentials matching this backup locator, store a non-secret marker and are restored without…
fixBackported in: Fixed SELECT ... FINAL and OPTIMIZE TABLE ... FINAL returning duplicate rows after CREATE TABLE ... CLONE AS, ATTACH PARTITION ... FROM or MOVE PARTITION ... TO TABLE adopted parts from a plain MergeTree into a ReplacingMergeTree, SummingMergeTree or AggregatingMergeTree. The…
fixBackported in: Fix a Logical error: Stream ... variant_discr ... is not found that could occur when merging or reading a MergeTree part produced by a mutation of a table with a Dynamic column. (Alexey Milovidov).
fixBackported in: Fix runtime join filter producing wrong results for JSON columns. Closes. (Pavel Kruglov).
fixBackported in: Fixed incorrect results from distributed queries selecting ALIAS columns that share a common subexpression: columns could be misaligned and values returned under the wrong column. (Vladimir Cherkasov).
fixBackported in: Fix server crash (SIGSEGV) when reading Protobuf data with input_format_allow_errors_num > 0 and a valid message precedes a bad (skippable) message in the same block. (Andrey Tsarevskiy | Андрей Царевский ).
fixBackported in: A transient error while refreshing data parts of a read-only table no longer permanently stops the background refresh task. (Alexey Milovidov).
fixBackported in: Fix a logical error when casting a Dynamic or Variant column nested inside a Tuple to a non-Nullable element type with accurateCastOrNull or accurateCastOrDefault. (Alexey Milovidov).
fixBackported in: Hide sensitive info in system.query_views_log.view_query. (Valerii Mordovskii).
fixBackported in: Fix NOT_FOUND_COLUMN_IN_BLOCK error for queries that use the _part_starting_offset/_part_offset virtual columns in WHERE together with lazy materialization. (Vladimir Cherkasov).
fixBackported in: SYSTEM RESET DDL WORKER now requires the new SYSTEM RESET DDL WORKER privilege. Previously any authenticated user (including readonly ones) could run it and repeatedly reset the DDL worker state, blocking ON CLUSTER DDL. (Groene AI).
fixBackported in: Restrict the model path of catboostEvaluate to the user_files directory, like file() and the dictionary sources. Previously the function accepted an arbitrary filesystem path with no containment check, which allowed probing the existence of and triggering reads of files outside…
fixBackported in: Fixed wrong results when using SELECT [...] SAMPLE [...] together with the query condition cache (setting use_query_condition_cache = 1 which is also the default). (Groene AI).
fixBackported in: Fixed a server crash (stack overflow) caused by deeply nested expressions such as [[[ ... ]]] or array(array( ... )) when max_parser_depth is set to a large value. (Raúl Marín).
fixBackported in: The MySQL wire protocol commands COM_FIELD_LIST (mysql_list_fields) and COM_INIT_DB (USE database) now enforce the same access control as their SQL equivalents (SHOW COLUMNS/DESCRIBE and USE). Previously they could disclose column names of tables the user only had partial column…
fixBackported in: Match http_forbid_headers case-insensitively. HTTP header names are case-insensitive, so forbidding Authorization now also blocks authorization, AUTHORIZATION and other case variants. Configured header_regexp patterns are now matched case-insensitively without needing an explicit…
securityBackported in: Fix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze).
+72 more items in the release notes
26.5.6.64 Jul 23, 2026 Release notes ↗
featureBackported in: Add aiEmbed function for using LLM APIs to generate embeddings from within ClickHouse. (George Larionov).
fixBackported in: Fixed a performance regression (introduced in) where reading many small files from object storage via the s3() and other table functions stopped prefetching and fell back to synchronous reads, significantly slowing single-threaded / low-concurrency reads of lots of tiny files.…
fixBackported in: Account for Map subcolumn on-disk size in prewhere optimization. This fixes the regression in PREWHERE introduced Part of. (Pavel Kruglov).
fixBackported in: Fix DataLakeCatalog databases with catalog_type = 'onelake' reading table data by using the OneLake Blob endpoint (.blob.fabric.microsoft.com) by default. Set onelake_use_blob_endpoint = false to keep the previous DFS endpoint (.dfs.fabric.microsoft.com) behavior. (Konstantin…
fixBackported in: Fixed reading of the auth_response length in the MySQL handshake, where a length byte >= 128 was interpreted as a multi-gigabyte value because it was read as a signed char. (uwezkhan).
featureBackported in: Restore show_data_lake_catalogs_in_system_tables as the setting that controls only DataLakeCatalog visibility in system.tables, system.columns, and system.completions. Added show_remote_databases_in_system_tables, enabled by default, to let users hide MySQL and PostgreSQL databases…
featureBackported in: I always find it difficult to add multiple metrics to the dashboard during debugging sessions. This patch adds a simpler way to add them directly from the source code or documentation. (Mikhail Artemenko).
fixBackported in: Fixed a race between ALTER TABLE ... RENAME COLUMN and a concurrent OPTIMIZE TABLE ... FINAL (or any background merge) in MergeTree that could silently replace the renamed column's data with default values. The race window between publishing the new in-memory metadata and…
fixBackported in: Add a new compatibility setting analyzer_compatibility_prefer_alias_over_subcolumn (disabled by default). When enabled, the new analyzer prefers the alias-prefix interpretation over Tuple-subcolumn / dotted-column matches for multi-part identifiers, restoring the previous…
fixBackported in: Added data validation on insertions https://github.com/ClickHouse/ClickHouse/pull/98284#issuecomment-4592701308. (Yarik Briukhovetskyi).
fixBackported in: Fix optimize_skip_unused_shards did not apply (and force_optimize_skip_unused_shards falsely failing) when a Distributed table is queried through a Merge table or the merge table function, with the predicate applied above it. (Nikolai Kochetov).
fixBackported in: Fix RestCatalog::empty returning the wrong result when an Iceberg REST catalog contains tables. (Lefteris).
fixBackported in: Fixed a bug where the used_privileges and missing_privileges columns of system.query_log could contain privilege strings leaked from unrelated earlier queries of a different user, database, or session. (Alexey Milovidov).
fixBackported in: Fix a server crash when moving an empty part to a plain_rewritable disk (for example with ALTER TABLE ... MOVE PARTITION ... TO DISK for an empty part kept by remove_empty_parts = 0). (Groene AI).
fixBackported in: Fixed a Block structure mismatch in UnionStep stream logical error (server abort on debug/sanitizer builds, Code: 49 on release builds) that occurred when one branch of a UNION/INTERSECT/EXCEPT read a Sparse-serialized column while the sibling branch read the same column as a full…
fixBackported in: Fixed wrong query results caused by the query condition cache when on-fly mutations (apply_mutations_on_fly) or patch parts filtered rows before PREWHERE. A query reading with apply_mutations_on_fly = 1 could poison the cache so that a later query with apply_mutations_on_fly = 0 and…
fixBackported in: Incremental backups no longer store S3 credentials in the locator of the .backup metadata file. Backups created with use_same_s3_credentials_for_base_backup = 1, or with explicit base backup credentials matching this backup locator, store a non-secret marker and are restored without…
fixBackported in: Fixed SELECT ... FINAL and OPTIMIZE TABLE ... FINAL returning duplicate rows after CREATE TABLE ... CLONE AS, ATTACH PARTITION ... FROM or MOVE PARTITION ... TO TABLE adopted parts from a plain MergeTree into a ReplacingMergeTree, SummingMergeTree or AggregatingMergeTree. The…
fixBackported in: Fix runtime join filter producing wrong results for JSON columns. Closes. (Pavel Kruglov).
fixBackported in: Fixed incorrect results from distributed queries selecting ALIAS columns that share a common subexpression: columns could be misaligned and values returned under the wrong column. (Vladimir Cherkasov).
fixBackported in: A transient error while refreshing data parts of a read-only table no longer permanently stops the background refresh task. (Alexey Milovidov).
fixBackported in: Fix a logical error when casting a Dynamic or Variant column nested inside a Tuple to a non-Nullable element type with accurateCastOrNull or accurateCastOrDefault. (Alexey Milovidov).
fixBackported in: Hide sensitive info in system.query_views_log.view_query. (Valerii Mordovskii).
fixBackported in: SYSTEM RESET DDL WORKER now requires the new SYSTEM RESET DDL WORKER privilege. Previously any authenticated user (including readonly ones) could run it and repeatedly reset the DDL worker state, blocking ON CLUSTER DDL. (Groene AI).
fixBackported in: Restrict the model path of catboostEvaluate to the user_files directory, like file() and the dictionary sources. Previously the function accepted an arbitrary filesystem path with no containment check, which allowed probing the existence of and triggering reads of files outside…
fixBackported in: Fixed wrong results when using SELECT [...] SAMPLE [...] together with the query condition cache (setting use_query_condition_cache = 1 which is also the default). (Groene AI).
fixBackported in: Fixed a server crash (stack overflow) caused by deeply nested expressions such as [[[ ... ]]] or array(array( ... )) when max_parser_depth is set to a large value. (Raúl Marín).
fixBackported in: The MySQL wire protocol commands COM_FIELD_LIST (mysql_list_fields) and COM_INIT_DB (USE database) now enforce the same access control as their SQL equivalents (SHOW COLUMNS/DESCRIBE and USE). Previously they could disclose column names of tables the user only had partial column…
fixBackported in: Match http_forbid_headers case-insensitively. HTTP header names are case-insensitive, so forbidding Authorization now also blocks authorization, AUTHORIZATION and other case variants. Configured header_regexp patterns are now matched case-insensitively without needing an explicit…
fixBackported in: Fix a SELECT * projection returning a column's type default (e.g. 0) instead of its DEFAULT value (e.g. -1) when reading a column added with ALTER TABLE ... ADD COLUMN ... DEFAULT after the projection was created. Reads from the base table were already correct; only reads answered…
fixBackported in: Fixed a startup failure where a DataLakeCatalog database created by an older version (25.12 or earlier) with a malformed auth_header could not be attached after upgrading to 26.2 or later, preventing the server from starting. The auth_header is now validated only on CREATE, and on…
fixBackported in: Fix a segmentation fault when merging uniqExact aggregate states with GROUPING SETS, ROLLUP or CUBE and max_threads > 1. (Raúl Marín).
fixBackported in: Fix schema inference for the Arrow, ArrowStream, Avro formats and the legacy ORC and Parquet readers returning Nullable(Tuple) for nullable struct columns while the Nullable(Tuple) type is not allowed (allow_experimental_nullable_tuple_type is disabled). DESCRIBE returned a type…
fixBackported in: Fixed a server crash on asynchronous insert with deduplication when optimize_on_insert makes the inserted block empty (for example, rows summing to zero in SummingMergeTree). (Den Kalantaevskii).
fixBackported in: Fix S3 settings priority so a URL-scoped endpoint block takes precedence over the top-level defaults. (Bharat Nallan).
fixBackported in: Fix a data race (and resulting rare crash) in the parallel merge of uniqExact aggregate states with two-level sets, which could occur with GROUPING SETS, ROLLUP and CUBE. (Groene AI).
fixBackported in: This patch fixes an infinite rescheduling of the rollup merge. (Mikhail Artemenko).
fixBackported in: Fix a segfault in groupArrayLastMerge. Deserialization of aggregated function state is now validated. So a broken state does not lead to OOB. (Miсhael Stetsyuk).
fixBackported in: This patch fixes the group by mutations for tables with materialized and virtual columns. If the table has materialized columns or enabled persistent virtual columns, these columns will be aggregated using any aggregate. (Mikhail Artemenko).
securityBackported in: Fix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze).
+23 more items in the release notes
26.5.5.8 Jul 1, 2026 Release notes ↗
fixBackported in: Fix a server abort during RESTORE of backups containing tables with cyclic dependencies. (Konstantin Bogdanov).
fixBackported in: Fix a logical error (Unexpected return type from equals. Expected Nullable(UInt8). Got UInt8) when the disjunction (partial predicate) push-down optimization pushes a condition over a USING key whose type is widened by the JOIN. Also fix a server crash (segmentation fault) in the…
fixBackported in: Fixed RESTORE for ReplicatedMergeTree tables so duplicate-content parts from a backup are preserved instead of being silently deduplicated. (Pablo Marcos).
fixBackported in: Vector search queries that SELECT from the _distance column now return a proper error instead of failing with a LOGICAL_ERROR. (Robert Schulze).
fixBackported in: Fixed direct read from multiple partially materialized text indexes. (Anton Popov).
fixBackported in: Fixed partition and primary key pruning being silently disabled when a LowCardinality(FixedString) (or LowCardinality(Nullable(FixedString))) key column is wrapped in a function in the key, for example PARTITION BY sipHash64(k) % N with WHERE k = 'literal'. Such queries scanned all…
fixBackported in: Fixed insert_quorum = 'auto' not rejecting inserts up front when fewer than a majority of replicas were alive. Such inserts now fail immediately with TOO_FEW_LIVE_REPLICAS instead of writing a local part and later timing out with UNKNOWN_STATUS_OF_INSERT. (Gagan Dhakrey).
26.5.4.21 Jun 29, 2026 Release notes ↗
otherBackported in: Filesystem cache improvement: stop invalidated priority entries from pinning KeyMetadata. Follow up to https://github.com/ClickHouse/ClickHouse/pull/106387. (Kseniia Sumarokova).
fixBackported in: Fix wrong row count from arrayJoin() used inside JOIN ON: the result was multiplied by the array length an extra time. (Shaohua Wang).
fixBackported in: Fix "Too many marks" for text index on an empty merged part. (Azat Khuzhin).
fixBackported in: Fix a crash (Source column is not Map / SIGSEGV) when merging sorted blocks that contain a Variant column with a Map variant whose local storage order differs from its global order. (Groene AI).
fixBackported in: Fixed possible server stack overflow (crash) when reading a deeply nested schema or value in the MsgPack, BSON, ORC, Parquet, JSON, DeltaLake, Iceberg and Paimon formats. Such deeply nested input is now rejected with an exception. (Raúl Marín).
fixBackported in: Fixed a heap buffer overflow (server crash) in windowFunnel when finalizing a crafted aggregate-function state with an out-of-range event type, reachable by any user with a single SELECT. (uwezkhan).
fixBackported in: The fresh snapshot rebuilt inside update() already captures the C++ S3 client's current creds via createBuilder keep it instead of discarding it when the version matches, so the next kernel op runs on a freshly-credentialed engine and doesn't outlive the STS TTL. (Elmi Ahmadov).
fixBackported in: Added missing bounds checks in Elf and DWARF parsing. (Michael Kolupaev).
fixBackported in: Reading Arrow/ArrowStream data with empty String/Binary columns produced by Apache Arrow Java < 19.0.0 (including Apache Spark) no longer throws INCORRECT_DATA. (Raúl Marín).
fixBackported in: Fix set skip index not pruning granules over LowCardinality columns. (Konstantin Bogdanov).
fixBackported in: Fix a crash (SIGSEGV in release builds, type-mismatch assertion in debug builds) in has over a Map with a Dynamic key when the lookup argument is LowCardinality, e.g. has(map('a'::Dynamic, ...), toLowCardinality('b')). (Groene AI).
fixBackported in: Fix performance regression for Map subcolumns with PREWHERE. Closes. Caused by: https://github.com/ClickHouse/ClickHouse/pull/99200. (Pavel Kruglov).
fixBackported in: Fix performance regression when reading Dynamic columns with multiple threads. Caused by https://github.com/ClickHouse/ClickHouse/pull/100730. Closes. (Pavel Kruglov).
fixBackported in: Always run access cache batch-finished handlers, even on empty batch. (Azat Khuzhin).
fixBackported in: Fixed refreshable materialized view getting stuck if zookeeper connection is lost at the wrong moment. (Michael Kolupaev).
fixBackported in: Hide secret arguments of functions such as encrypt, decrypt, and HMAC in EXPLAIN actions, EXPLAIN header, and EXPLAIN PIPELINE output when format_display_secrets_in_show_and_select is disabled (the default). (Raúl Marín).
fixBackported in: Fixed ssl_certificate user identification so a single wildcard matches exactly one name component (RFC 6125 6.4.3). Previously a wildcard in a CN or DNS: SAN subject (for example .corp.example.com) also matched multi-label names such as evil.deep.corp.example.com, letting a holder…
fixBackported in: Fix a metadata-disclosure where DESCRIBE loop('db', 'table') and DESCRIBE loop() bypassed the SHOW COLUMNS / source access check, letting an unprivileged user read a table's column schema. (Groene AI).
otherBackported in: Looks like it may happen without real shutdown in a very rare cases. (alesapin).
otherBackported in: Move metric. (Kseniia Sumarokova).
26.5.3.52 Jun 22, 2026 Release notes ↗
26.5.2.39 Jun 8, 2026 Release notes ↗
breakingBackported in: The setting show_data_lake_catalogs_in_system_tables has been renamed to show_remote_databases_in_system_tables and broadened: when its value is 0 (the default), MySQL and PostgreSQL databases are also hidden from system.tables, system.columns, and system.completions, in addition to…
otherBackported in: Various changes to Keeper that make it around 2x faster overall (better batching, pipelining messages to leader, pipelining log appends). (Michael Kolupaev).
fixBackported in: Fixed PREWHERE with IN subquery on primary key columns not using primary key index for granule pruning, causing full table scans instead of reading only relevant granules. (Nikita Mikhaylov).
otherBackported in: Reduce peak memory usage when applying received snapshots in ClickHouse Keeper with KeeperMemoryStorage. (Antonio Andelic).
featureBackported in: Added Keeper coordination_settings for NuRaft uncommitted log entry admission limiting and append-entries backward-probe throttling. (Antonio Andelic).
fixBackported in: Fix data corruption when writing Parquet (and other trailer-bearing formats such as ORC and Arrow) to HDFS via INSERT INTO FUNCTION hdfs(...). Since 26.1, WriteBufferFromHDFS did not flush its working buffer on finalize(), so the last up to DBMS_DEFAULT_BUFFER_SIZE bytes of every…
fixBackported in: LEFT ANTI JOIN now correctly returns the right-side join key column with default values for unmatched rows, instead of duplicating the left key value. Previously, SELECT a.x AS l, b.x AS r FROM a LEFT ANTI JOIN b ON a.x = b.x could return r = a.x for the unmatched rows when it…
fixBackported in: Long-running INSERT ... SELECT and other reads from a DataLakeCatalog database with catalog_type = 'glue' fail with Code: 117. DB::Exception: IOError: Code: 499. DB::Exception: Unable to parse ExceptionName: ExpiredToken Message: The provided token has expired. (S3_ERROR) ... While…
fixBackported in: Fix logical error in negative LIMIT BY in some cases when used with ARRAY JOIN. (Nihal Z. Miaji).
fixBackported in: Fixed a heap-buffer-overflow when reading Arrow or ArrowStream files with corrupted intermediate offsets in a binary or string column, and a null-pointer dereference when reading geo-tagged Arrow columns. (Raúl Marín).
fixBackported in: Fix dictGetOrDefault throwing CANNOT_INSERT_NULL_IN_ORDINARY_COLUMN when the default argument is a Nullable expression and short_circuit_function_evaluation is enabled with a mix of found and not-found dictionary keys. (Raúl Marín).
fixBackported in: Fix SIGSEGV when reading Dynamic subcolumns from compressed Memory table after ALTER. Closes. (Pavel Kruglov).
fixBackported in: Fix a server segfault in uniqStateOrNull / uniqStateOrDefault / uniqOrNullState (and similar combinator chains over uniq) when used with GROUP BY ... WITH ROLLUP, WITH CUBE, or WITH TOTALS and a Nullable argument. (Groene AI).
fixBackported in: Fix SEGFAULT in singleValueOrNull deserialization for JSON type. Closes. (Pavel Kruglov).
fixBackported in: Fix crash in replxx due to hitting FD_SETSIZE limitation of select() (replace with poll()). Note with enabled SSH/web terminal it may crash the server. (Azat Khuzhin).
fixBackported in: Fix a client crash on CREATE TABLE ... TO INNER UUID '...' ... when the statement has no ENGINE clause. The parser now reports a proper BAD_ARGUMENTS error instead of dereferencing a null pointer. (Groene AI).
fixBackported in: Hive partition value extraction now honors the cast_string_to_date_time_mode setting and accepts ISO 8601 timestamps with timezone suffixes (e.g. +0000, +00:00, Z) in partition keys by default. (Alexey Milovidov).
fixBackported in: Fixed a silent under-count in SELECT queries when use_query_condition_cache = 1 (default). A query of the shape PREWHERE pk_prefix = X WHERE non_pk IN (...) against a column with a bloom-filter skip index poisoned the QueryConditionCache for the pk_prefix = X predicate, so a…
fixBackported in: Fix a crash in the mongodb table function, MongoDB storage and MongoDB dictionary source when the collection name is empty or contains NUL bytes. (Raúl Marín).
fixBackported in: Fix Keeper snapshot cleanup after failed writes so partial snapshots are cleaned up safely and failed writes can be retried without advancing latest_snapshot_meta. (Antonio Andelic).
fixBackported in: Fix Cannot find column error for distributed queries with IN Array(...) filter for the new analyzer. (Nikolai Kochetov).
fixBackported in: Fixed a server crash that could occur when a query reading from PostgreSQL — via the postgresql table function, the PostgreSQL table engine, or a dictionary with a PostgreSQL source — was cancelled (for example with KILL QUERY) and cancelling the remote PostgreSQL query failed.…
fixBackported in: Fixed a possible crash due to a too-large string literal sent within the query. (Nikita Taranov).
fixBackported in: Fix Keeper failures during follower catch-up when the new request dispatcher response queue could fill before the response thread started. (Antonio Andelic).
fixBackported in: Fix system.dictionaries returning 0 rows with partial SHOW DICTIONARIES revoke. (Pavel Kruglov).
fixBackported in: Fixed a server crash when querying DeltaLake tables with allow_experimental_delta_kernel_rs enabled and a credential or option that contained invalid bytes (the Rust FFI panicked across the extern "C" boundary). (Raúl Marín).
fixBackported in: Continuation of https://github.com/ClickHouse/ClickHouse/pull/96754 but for delta lake. (Konstantin Vedernikov).
fixBackported in: Fixed Keeper sometimes getting stuck on startup when setting nuraft_max_log_gap_in_stream is set to non-default value (default is 0, i.e. disable pipelining of append_entries requests). (Michael Kolupaev).
fixBackported in: Fix sporadic incorrect results for ORDER BY ... DESC queries when reading wide parts in reverse order with read_in_order_use_virtual_row_per_block = 1 and a small max_block_size. (Vladimir Cherkasov).
fixBackported in: When deserializing Avro enum data, we don't validate the values, and if those are corrupted, it leads to OOB and abort. (Miсhael Stetsyuk).
otherBackported in: Updated libxml2 from 2.15.1 to 2.15.3. (Konstantin Bogdanov).
otherBackported in: Use postgres REL_18_4. (Konstantin Bogdanov).
otherBackported in: Upgrade krb5 to 1.22.2. (Konstantin Bogdanov).
otherBackported in: Bumped mariadb-connector-c to 3.1.29. All the ClickHouse-relevant patches preserved. (Nikita Mikhaylov).
fixBackported in: Fix azure init params. (Konstantin Vedernikov).
otherBackported in: Skip test_numbers_check on release branches. (Nikita Fomichev).
fixBackported in: Fix test_mysql_dotnet_client by anchoring to /testapp. (Raúl Marín).
otherBackported in: This PR modifies the settings history so that compatibility='X.Y' will never revert apply_row_policy_after_final to false. Previously, compatibility levels before 26.2 would revert the setting to false (the buggy pre-fix behavior). After this change, the setting remains true…
26.5.1.882 May 21, 2026 Release notes ↗
breakingChanged defaults of date_time_input_format and cast_string_to_date_time_mode from basic to best_effort. Queries that previously failed to parse non-basic datetime strings (e.g. 2024 April 4, Apr 15, 2020 10:30:00) may now succeed by default. To keep the old strict parsing behavior, set these…
breakingThis change was reverted. (Raúl Marín).
breakingTuple element name null is now forbidden because it conflicts with the subcolumn name used for Nullable null maps, causing ambiguous subcolumn resolution. (Alexey Milovidov).
breakingAdd a setting dynamic_disk_allow_from_env, dynamic_disk_allow_from_zk, dynamic_disk_allow_include to disallow usage of from_env, from_zk, include in dynamic disks. Backward Incompatible Change because prohibits by default the behaviour which used to be allowed by default. (Kseniia Sumarokova).
breakingYou can no longer use the obsolete Arrow-based Parquet reader and writer. The native implementation will be used instead. (Alexey Milovidov).
breakingSHOW CREATE TABLE t now prefers the temporary table when both a permanent and a temporary table named t exist and no database is specified, matching the existing behavior of DESCRIBE TABLE. Additionally, DESCRIBE TEMPORARY TABLE syntax is now supported. (Alexey Milovidov).
breakingReduced default http_max_fields from 1,000,000 to 1,000 and http_max_field_name_size from 128 KB to 4 KB to limit pre-authentication memory usage by HTTP connections. Added http_max_request_header_size and http_headers_read_timeout settings. Users who rely on the previous higher limits can restore…
breakingAdded a histograms nested column to system.metric_log that snapshots every registered histogram metric per row, with a new system_metric_log_show_zero_values_in_histograms setting to control zero-value emission. Deprecates the system.histogram_metric_log table. (Miсhael Stetsyuk).
breakingThe window functions RANK and DENSE_RANK now reject arguments and throw NUMBER_OF_ARGUMENTS_DOESNT_MATCH, in line with the SQL standard. Previously, queries such as RANK(x) OVER (ORDER BY id) were silently accepted with the argument ignored, which was a frequent source of user confusion. To…
breakingCAST to DateTime or DateTime64 without an explicit time zone now preserves the time zone of its source argument (when the source is a DateTime/DateTime64 with an explicit time zone), matching the behavior of the toDateTime/toDateTime64 functions. Closes. (Alexey Milovidov).
breakingRevert the default x86 build target back to x86-64-v2 (SSE4.2). The previous switch to x86-64-v3 (AVX2) is being rolled back. (Raúl Marín).
breakingRemoved the kql table function. Use SET dialect = 'kusto' to run queries in the KQL dialect. (Alexey Milovidov).
featureAdd table function filesystem. It allows to represent directory structure as a table, to query files' metadata and contents with SQL. Originally https://github.com/ClickHouse/ClickHouse/pull/42039 by @perst20. See. See. (Alexey Milovidov).
featureParameter kafka_autodetect_client_rack is introduced. If set, discover Availability Zone by cloud facilities and promoted as client.rack librdkafka parameter to avoid cross-zone communications. (Ilya Golshtein).
featureAdd Read event type to system.blob_storage_log for tracking object storage read operations, controlled by new setting enable_blob_storage_log_for_read_operations. (Alexey Milovidov).
featureAdded optional encoding variant parameter to bech32Encode ('bech32' / 'bech32m') and raw decode mode to bech32Decode for non-SegWit address encoding (e.g. Cosmos SDK, Injective, Osmosis). (Yash ).
featureUsers can now see zookeeper's watches issued by clickhouse-server using the new system.zookeeper_watches table. (Den Kalantaevskii).
featureAdded Shards profile event that counts the number of shards involved in distributed queries, summed across all tables. (Alexey Milovidov).
featureAdded support for SQL truth-value predicates IS TRUE, IS FALSE, IS UNKNOWN, IS NOT TRUE, IS NOT FALSE, and IS NOT UNKNOWN for nullable boolean expressions. (ibrahim karimeddin).
featureWASM UDF can be declared DETERMINISTIC and be a subject of constant folding. (Vasily Chekalkin).
featureAdd parallel_replicas_prefer_local_replica setting: when disabled, parallel replicas are selected purely by the load balancing algorithm, allowing even max_parallel_replicas = 1 queries to be directed to another host. (Alexey Milovidov).
featureAdd {disk,storage,http}_connections_rcvbuf and {disk,storage,http}_connections_sndbuf server settings to control TCP socket buffer sizes on outgoing HTTP connections, allowing operators to override kernel autotuning and cap per-connection memory usage. (Sema Checherinda).
featureSupport CREATE OR REPLACE MATERIALIZED VIEW with the same atomic swap semantics as CREATE OR REPLACE TABLE. Works with inner tables, TO tables, POPULATE, REFRESH, and ON CLUSTER. (DQ).
featureAllow passing bare function names to higher-order functions like arrayMap, arrayFilter, etc. For example, arrayMap(negate, [1, 2, 3]) is now equivalent to arrayMap(x -> negate(x), [1, 2, 3]). (Alexey Milovidov).
featureAdd setting send_table_structure_on_insert_with_inline_data and --inline-insert-data client option to allow the server to parse inline INSERT data itself over the native protocol, avoiding the round-trip to receive table structure and improving performance for many small inserts. (Alexey Milovidov).
featureAdd tokenizeQuery and highlightQuery functions for SQL query tokenization and syntax highlighting. tokenizeQuery returns lexer tokens with byte offsets and token types; highlightQuery returns parser-based syntax highlighting ranges with highlight categories (keyword, identifier, function, number,…
featureAdd url_base setting to resolve relative URLs in the url table function and URL table engine, following RFC 3986 semantics. (Alexey Milovidov).
featureAdd s3_read_request_duration_microseconds and s3_read_request_bytes histogram metrics to observe S3 GET request connection lifetime and bytes consumed, visible in system.histogram_metrics and the Prometheus endpoint. (Sema Checherinda).
featureQuery condition cache for iceberg tables. (Konstantin Vedernikov).
featureAdd Paimon, PaimonS3, PaimonAzure, PaimonHDFS, and PaimonLocal table engines with incremental read support backed by Keeper snapshot progress tracking. Incremental mode returns only new rows since the last committed snapshot. Targeted snapshot delta reads are available via…
featureAdded NullCount statistics type for accurate NULL value counting in Nullable columns. This enables improved PREWHERE optimization and better part pruning. (zoomxi).
featureYou can now format a string into human-readable JSON with prettyPrintJSON function. Useful for dashboards or reports where before JSON prettifying needed an extra step on the client side. Closes. (Dmitry Prokofyev).
featureSupport negative values in the LIMIT BY clause to select rows from the end of each group instead of the beginning. For example, LIMIT -2 BY id returns the last two rows per id. Negative offsets (LIMIT -1 OFFSET -1 BY id) and mixed signs (LIMIT -2 OFFSET 1 BY id) are supported as well. (Nihal Z.…
featureAdded a new Kafka table setting kafka_map_virtual_columns_on_write. When enabled, columns named _key, _timestamp, _headers.name and _headers.value in the Kafka table schema are produced as the corresponding Kafka message key, timestamp and headers on INSERT, and are excluded from the message…
featureAdded SYSTEM PAUSE VIEW [db.]name and SYSTEM PAUSE VIEWS queries for refreshable materialized views. Unlike SYSTEM STOP VIEW, SYSTEM PAUSE VIEW does not interrupt the currently running refresh — the in-flight refresh is allowed to complete and only subsequent refreshes are prevented. Undone by…
featureAdded a new setting \max_bytes_ratio_before_external_join\, mirroring \max_bytes_ratio_before_external_group_by\ and \max_bytes_ratio_before_external_sort. It expresses the spill-to-disk threshold for hash joins as a fraction of available memory; combined with the absolute…
featureAdded function regexpPosition (with PostgreSQL-compatible aliases regexpInstr and regexp_instr) that returns the byte position of the N-th regex match in a string. Supports start offset, return-after-match mode, regex flags, and capture-group selection. (Abhinav Agarwal).
featureNullCount column statistics can now be used for part pruning. Queries with IS NULL or IS NOT NULL predicates on Nullable columns that have NullCount statistics can skip entire data parts where the statistics prove no matching rows exist. (zoomxi).
featureNew functions isPrime and isProbablePrime for primality checks. isPrime returns an exact result for unsigned integers up to UInt64. isProbablePrime also supports UInt128 and UInt256; for those wider types, 0 means definitely composite and 1 means probably prime. The optional second argument of…
breakingRemove vtable from setting field types, reducing Settings copy size by ~28x and improving cache locality via typed-array layout for all settings types. (Raúl Marín).
+720 more items in the release notes
26.4.5.143 Jul 22, 2026 Release notes ↗
featureBackported in: Add aiEmbed function for using LLM APIs to generate embeddings from within ClickHouse. (George Larionov).
fixBackported in: Fixed long login and query-startup stalls with replicated access storage when many access entities (row policies, roles, quotas, settings profiles) change at once. Each per-entity cache now recomputes once per notification batch instead of once per changed entity, removing quadratic…
fixBackported in: Fixed a performance regression (introduced in) where reading many small files from object storage via the s3() and other table functions stopped prefetching and fell back to synchronous reads, significantly slowing single-threaded / low-concurrency reads of lots of tiny files.…
fixBackported in: Fixed CREATE TABLE ... CLONE AS (and REPLACE / ATTACH PARTITION ... FROM) on encrypted disks copying data instead of hardlinking it. (Nikita Mikhaylov).
fixBackported in: Fix DataLakeCatalog databases with catalog_type = 'onelake' reading table data by using the OneLake Blob endpoint (.blob.fabric.microsoft.com) by default. Set onelake_use_blob_endpoint = false to keep the previous DFS endpoint (.dfs.fabric.microsoft.com) behavior. (Konstantin…
fixBackported in: Fixed reading of the auth_response length in the MySQL handshake, where a length byte >= 128 was interpreted as a multi-gigabyte value because it was read as a signed char. (uwezkhan).
featureBackported in: Restore show_data_lake_catalogs_in_system_tables as the setting that controls only DataLakeCatalog visibility in system.tables, system.columns, and system.completions. Added show_remote_databases_in_system_tables, enabled by default, to let users hide MySQL and PostgreSQL databases…
featureBackported in: I always find it difficult to add multiple metrics to the dashboard during debugging sessions. This patch adds a simpler way to add them directly from the source code or documentation. (Mikhail Artemenko).
fixBackported in: Fix credential leak in query_log for paimonCluster, paimonS3Cluster, paimonAzureCluster, and deltaLakeS3 table functions. ### Documentation entry for user-facing changes. (JIaQi Tang).
fixBackported in: ... (Callum Cooper).
fixBackported in: Fix crash (LOGICAL_ERROR: 'PREWHERE passed to format that doesn't support it') when reading Iceberg tables containing ORC data files with PREWHERE optimization enabled. (Groene AI).
fixBackported in: Fix NOT_FOUND_COLUMN_IN_BLOCK error when selecting from a VIEW over a table with a normal projection. (Amos Bird).
fixBackported in: Skip applying lazy materialization for plans with arrayJoin, which could lead to limit not being respected. Close. (Vladimir Cherkasov).
fixBackported in: Fixed an exception Unsupported DeltaLake type: varchar(n) when reading Delta Lake tables whose schema contains varchar(n) or char(n) column types. These types are now mapped to String, consistent with how the Delta Lake protocol stores them as plain byte arrays in Parquet. (Flavio…
fixBackported in: Fixed a crash (LOGICAL_ERROR: Unknown virtual column) when selecting subcolumns (like .null for Nullable, .size0 for Array, tuple elements, or map keys/values) from a Buffer table engine. (Groene AI).
fixBackported in: Fix Logical error: 'Port is already connected' exception during pipeline expansion in the lazy FINAL path for ReplacingMergeTree. The bug affected queries with query_plan_optimize_lazy_final = 1 when ReadFromMergeTree::initializePipeline inserted internal transforms (e.g. a Resize)…
fixBackported in: Fix a server abort during RESTORE of backups containing tables with cyclic dependencies. (Konstantin Bogdanov).
fixBackported in: Fix LOGICAL_ERROR in StreamingStorageRegistry::renameTable when batch-renaming streaming tables (S3Queue, Kafka, RabbitMQ) by using UUID-based identity tracking instead of name-based. (Nikita Taranov).
fixBackported in: Fix a LOGICAL_ERROR exception (Metadata is not initialized) raised by OPTIMIZE TABLE, ALTER TABLE ... DELETE, ALTER TABLE ... ADD COLUMN and other ALTER variants on a lazily-attached Iceberg / IcebergLocal / DeltaLake / Hudi table whose metadata had not been loaded yet (typical…
fixBackported in: Fix wrong row count from arrayJoin() used inside JOIN ON: the result was multiplied by the array length an extra time. (Shaohua Wang).
fixBackported in: Fixed a race between ALTER TABLE ... RENAME COLUMN and a concurrent OPTIMIZE TABLE ... FINAL (or any background merge) in MergeTree that could silently replace the renamed column's data with default values. The race window between publishing the new in-memory metadata and…
fixBackported in: Fix Logical error: 'Metadata is not initialized' raised by DELETE FROM on a freshly-attached Iceberg, DeltaLake, or Hudi table whose metadata file is corrupted or unloadable. A regular user-facing exception is reported instead, and the server keeps running. Closes. (Groene AI).
fixBackported in: Fix filesystem cache dynamic resize with partially downloaded segments, including restore accounting after failed eviction. (Antonio Andelic).
fixBackported in: Add an explicit null-guard for shared->clusters_config before dereferencing it to avoid race condition. (Mikhail f. Shiryaev).
fixBackported in: Fix incorrect results of toStartOfWeek, toLastDayOfWeek, toMonday, toStartOfMonth, toLastDayOfMonth, toStartOfQuarter and toStartOfYear for Date32 and DateTime64 arguments whose result falls outside the Date range: instead of overflowing into arbitrary dates, results before…
fixBackported in: Fix OSIOWaitMicroseconds reporting thread lifetime I/O wait instead of query I/O wait. (Mikhail f. Shiryaev).
fixBackported in: Fix SIGSEGV when reading Dynamic subcolumns from compressed Memory table after ALTER. Closes. (Pavel Kruglov).
fixBackported in: Fix ignoring input_format_try_infer_datetimes during insertion into shared data in JSON. Closes. (Pavel Kruglov).
fixBackported in: Materialize subcolumns in executePartitionByExpression before executing expression. Closes. (Pavel Kruglov).
fixBackported in: Fix crash when inserting tuples of different sizes in the same VALUES clause into a String column. Closes. (Pavel Kruglov).
fixBackported in: Fix OOB read in flattened Dynamic column Native deserialization. (Pavel Kruglov).
fixBackported in: Fix Expected ColumnLowCardinality, got String / Bad cast from type DB::ColumnString to DB::ColumnLowCardinality errors when apply_mutations_on_fly = 1 is used on a table with pending on-fly UPDATE/DELETE mutations queued before an ALTER MODIFY COLUMN ... LowCardinality(...)…
fixBackported in: Added data validation on insertions https://github.com/ClickHouse/ClickHouse/pull/98284#issuecomment-4592701308. (Yarik Briukhovetskyi).
fixBackported in: Fix optimize_skip_unused_shards did not apply (and force_optimize_skip_unused_shards falsely failing) when a Distributed table is queried through a Merge table or the merge table function, with the predicate applied above it. (Nikolai Kochetov).
fixBackported in: Fix RestCatalog::empty returning the wrong result when an Iceberg REST catalog contains tables. (Lefteris).
fixBackported in: Fix a crash and a possible NOT_FOUND_COLUMN_IN_BLOCK error when constraint-based optimization (optimize_using_constraints) is used with correlated subqueries. (Raúl Marín).
fixBackported in: Fixed SYSTEM RELOAD CONFIG discarding per-endpoint Azure Blob Storage settings (such as use_native_copy), which caused a disk's configured settings to be ignored for BACKUP/RESTORE until the server was restarted. (Julia Kartseva).
fixBackported in: Fix LOGICAL_ERROR exception during cache predownload when a remote S3 object is overwritten with shorter content between listing and reading. (Nikita Fomichev).
securityBackported in: Fix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze).
securityBump cc-debian13 digests, clears libssl3t64 CVE-2026-45447. (Rahul Nair).
+101 more items in the release notes
26.4.4.38 Jun 8, 2026 Release notes ↗
breakingBackported in: The setting show_data_lake_catalogs_in_system_tables has been renamed to show_remote_databases_in_system_tables and broadened: when its value is 0 (the default), MySQL and PostgreSQL databases are also hidden from system.tables, system.columns, and system.completions, in addition to…
fixBackported in: Fixed PREWHERE with IN subquery on primary key columns not using primary key index for granule pruning, causing full table scans instead of reading only relevant granules. (Nikita Mikhaylov).
otherBackported in: Replace the HTTPConnectionPool*TCP{Rcv,Snd}BufBytes_{p50,p75,p90,p95} async metrics with a bucket-based histogram http_pool_tcp_buf_bytes (labels group, direction) in system.histogram_metrics. Per-group total async metrics are preserved. (Sema Checherinda).
fixBackported in: Fix incorrect results for RIGHT ANY JOIN when the right table has multiple rows per key and the output block is split due to size limits. Close. (Vladimir Cherkasov).
fixBackported in: Check for stack overflow in Avro reader during nested types deserialization. (Pavel Kruglov).
fixBackported in: Throw INCORRECT_DATA instead of LOGICAL_ERROR when client-supplied data in the Native format is truncated or malformed. (János Benjamin Antal).
fixBackported in: Fix StorageObjectStorageQueue (S3Queue, AzureQueue) blocking shutdown until partially-processed files were fully read from object storage. The source now aborts the read immediately on shutdown; deduplication ensures rows already streamed into the destination table before shutdown…
fixBackported in: Fix data corruption when writing Parquet (and other trailer-bearing formats such as ORC and Arrow) to HDFS via INSERT INTO FUNCTION hdfs(...). Since 26.1, WriteBufferFromHDFS did not flush its working buffer on finalize(), so the last up to DBMS_DEFAULT_BUFFER_SIZE bytes of every…
fixBackported in: Fix processing of url encoded path in deltaLakeAzure resolves. (Smita Kulkarni).
fixBackported in: Disable additional_table_filters with parallel replicas and analyzer and w/o query plan serialization. Previously it may lead to incorrect results. (Azat Khuzhin).
fixBackported in: Fix a broken patch part after ALTER TABLE ... DROP PARTITION ID 'patch-...' followed by DETACH/ATTACH TABLE. Previously the empty covering part was written without partition.dat and source_parts.dat, leading to a broken-on-start_patch-... entry in system.detached_parts after the…
fixBackported in: LEFT ANTI JOIN now correctly returns the right-side join key column with default values for unmatched rows, instead of duplicating the left key value. Previously, SELECT a.x AS l, b.x AS r FROM a LEFT ANTI JOIN b ON a.x = b.x could return r = a.x for the unmatched rows when it…
fixBackported in: Long-running INSERT ... SELECT and other reads from a DataLakeCatalog database with catalog_type = 'glue' fail with Code: 117. DB::Exception: IOError: Code: 499. DB::Exception: Unable to parse ExceptionName: ExpiredToken Message: The provided token has expired. (S3_ERROR) ... While…
fixBackported in: Fix BAD_ARGUMENTS exception "It's a bug! Only integer types are supported by __bitWrapperFunc" thrown when a SELECT with a TYPE set(N) skip index has a WHERE atom whose result type is Float, BFloat16, or any other non-integer type (for example WHERE c0 + 0.1 or WHERE log(c0)). The…
fixBackported in: Fixed a heap-buffer-overflow when reading Arrow or ArrowStream files with corrupted intermediate offsets in a binary or string column, and a null-pointer dereference when reading geo-tagged Arrow columns. (Raúl Marín).
fixBackported in: Fix dictGetOrDefault throwing CANNOT_INSERT_NULL_IN_ORDINARY_COLUMN when the default argument is a Nullable expression and short_circuit_function_evaluation is enabled with a mix of found and not-found dictionary keys. (Raúl Marín).
fixBackported in: Fix a server segfault in uniqStateOrNull / uniqStateOrDefault / uniqOrNullState (and similar combinator chains over uniq) when used with GROUP BY ... WITH ROLLUP, WITH CUBE, or WITH TOTALS and a Nullable argument. (Groene AI).
fixBackported in: Fix SEGFAULT in singleValueOrNull deserialization for JSON type. Closes. (Pavel Kruglov).
fixBackported in: Fix crash in replxx due to hitting FD_SETSIZE limitation of select() (replace with poll()). Note with enabled SSH/web terminal it may crash the server. (Azat Khuzhin).
fixBackported in: Fix a client crash on CREATE TABLE ... TO INNER UUID '...' ... when the statement has no ENGINE clause. The parser now reports a proper BAD_ARGUMENTS error instead of dereferencing a null pointer. (Groene AI).
fixBackported in: Hive partition value extraction now honors the cast_string_to_date_time_mode setting and accepts ISO 8601 timestamps with timezone suffixes (e.g. +0000, +00:00, Z) in partition keys by default. (Alexey Milovidov).
fixBackported in: Fixed a silent under-count in SELECT queries when use_query_condition_cache = 1 (default). A query of the shape PREWHERE pk_prefix = X WHERE non_pk IN (...) against a column with a bloom-filter skip index poisoned the QueryConditionCache for the pk_prefix = X predicate, so a…
fixBackported in: Fix a crash in the mongodb table function, MongoDB storage and MongoDB dictionary source when the collection name is empty or contains NUL bytes. (Raúl Marín).
fixBackported in: Fix Cannot find column error for distributed queries with IN Array(...) filter for the new analyzer. (Nikolai Kochetov).
fixBackported in: Fixed a server crash that could occur when a query reading from PostgreSQL — via the postgresql table function, the PostgreSQL table engine, or a dictionary with a PostgreSQL source — was cancelled (for example with KILL QUERY) and cancelling the remote PostgreSQL query failed.…
fixBackported in: Fixed a possible crash due to a too-large string literal sent within the query. (Nikita Taranov).
fixBackported in: Fix system.dictionaries returning 0 rows with partial SHOW DICTIONARIES revoke. (Pavel Kruglov).
fixBackported in: Fixed a server crash when querying DeltaLake tables with allow_experimental_delta_kernel_rs enabled and a credential or option that contained invalid bytes (the Rust FFI panicked across the extern "C" boundary). (Raúl Marín).
fixBackported in: Continuation of https://github.com/ClickHouse/ClickHouse/pull/96754 but for delta lake. (Konstantin Vedernikov).
fixBackported in: Fix sporadic incorrect results for ORDER BY ... DESC queries when reading wide parts in reverse order with read_in_order_use_virtual_row_per_block = 1 and a small max_block_size. (Vladimir Cherkasov).
otherBackported in: Update mongo-c-driver to 2.3.0. (Raúl Marín).
otherBackported in: Use an explicit flag in Context for secondary DDL/ON CLUSTER queries instead of SECONDARY_QUERY. (Alexander Tokmakov).
fixBackported in: Fix azure init params. (Konstantin Vedernikov).
otherBackported in: Skip test_numbers_check on release branches. (Nikita Fomichev).
fixBackported in: Fix test_mysql_dotnet_client by anchoring to /testapp. (Raúl Marín).
otherBackported in: This PR modifies the settings history so that compatibility='X.Y' will never revert apply_row_policy_after_final to false. Previously, compatibility levels before 26.2 would revert the setting to false (the buggy pre-fix behavior). After this change, the setting remains true…
otherOn release branches cast_string_to_date_time_mode defaults to basic (master defaults to best_effort), so the timezone-suffix partition queries must pin best_effort explicitly. Mirrors the adaptation already applied for 25.12 and 26.2. (Jimmy Aguilar Mena).
26.4.3.37 May 20, 2026 Release notes ↗
featureBackported in: Added SYSTEM PAUSE VIEW [db.]name and SYSTEM PAUSE VIEWS queries for refreshable materialized views. Unlike SYSTEM STOP VIEW, SYSTEM PAUSE VIEW does not interrupt the currently running refresh — the in-flight refresh is allowed to complete and only subsequent refreshes are…
otherBackported in: Reduced lock contention on the asynchronous remote-FS read path by making the per-query AsyncReadCounters lockless. (Nikita Mikhaylov).
otherBackported in: Skip deferring the row policy after FINAL when it depends only on sorting-key columns and is deterministic, and skip the corresponding PREWHERE deferral that the row policy was forcing in that case. (Yarik Briukhovetskyi).
otherBackported in: Improve the resilience of backups when Refreshable Materialized Views are constantly refreshed by making decisions based on the snapshotted tables' state rather than a global one. (Nikita Mikhaylov).
otherBackported in: Replicated refreshable materialized view in APPEND mode will no longer refresh twice if connection to zookeeper was briefly lost during refresh. (Michael Kolupaev).
fixBackported in: Fix \lowerUTF8\ / \upperUTF8\ exception when processing large non-ASCII data sets (e.g. during text-index builds) where the accumulated output buffer would exceed 2 GiB; reject excessively long single rows with a clear error. (Shaohua Wang).
featureBackported in: New setting defer_partition_pruning_after_final (default 1) makes the 26.3-introduced behavior of skipping partition pruning under FINAL opt-out. Set it to 0 to restore pre-26.3 partition pruning — substantially faster on event-log workloads where same-PK rows cannot span…
fixBackported in: Fix "Not-ready Set" exception when a filter with IN (subquery) is moved to PREWHERE by the query optimizer. (Alexey Milovidov).
fixBackported in: Bug fix: FunctionVariantAdaptor now throws ILLEGAL_TYPE_OF_ARGUMENT when all Variant alternatives are incompatible with a function, instead of silently returning Nullable(Nothing). Previously, a WHERE function(variant_col) predicate where no alternative type was compatible would…
fixBackported in: Fix incorrect query results caused by join reordering pushing an INNER JOIN filter (referencing only the preserved side of an outer join) into the outer join’s ON clause. (Vladimir Cherkasov).
fixBackported in: Fix possible crash when an ALTER query executed on tables from in-memory database (e.g. temporary tables). (Den Kalantaevskii).
fixBackported in: Fixes a case found by CI where a not-ready set was passed when the filter depends on the left-side column. Closes. (Yarik Briukhovetskyi).
fixBackported in: Fix backward compatibility break where old clients fail with UNEXPECTED_PACKET_FROM_SERVER when inserting into a newer server via remote() or distributed tables, caused by unconditional sendProgress at the end of processInsertQuery. (Sema Checherinda).
fixBackported in: Fix a data race for ClickHouse, MySQL, PostgreSQL and XDBC dictionary sources where clone() const reads from and isModified() const writes to the same invalidate_query_response string. (Miсhael Stetsyuk).
fixBackported in: Fix heap-use-after-free in multiplying an AggregateFunction state by an integer (e.g. quantilesExactState(...) * N). The exponentiation-by-squaring loop merged the state with itself, which is undefined when the aggregate function's merge reallocates its internal storage. Closes STID…
fixBackported in: Fix JSONExtract into a Variant type silently truncating fractional JSON numbers. Previously, JSONExtract('{"x": 3.14}', 'x', 'Variant(Int64, Float64)') returned Int64=3 and JSONExtract('{"x": 3.14}', 'x', 'Variant(String, Int64)') returned Int64=3, dropping the fractional part. The…
fixBackported in: Fixed an issue where text and bloom_filter skip indices on ALIAS columns whose expression contained a lambda with captured constants (e.g. arrayMap((k, v) -> concat(k, '=', v), mapKeys(m), mapValues(m))) were silently ignored. (Anton Popov).
fixBackported in: Fix a use-after-free in StorageKafka2 that could crash the server when a Keeper session is replaced while the consumer is holding ephemeral topic-partition locks. (Groene AI).
fixBackported in: Fixed SQL injection vulnerability in PostgreSQL, Cassandra and XDBC dictionary sources: string keys containing single quotes were escaped with \' (backslash), which these backends treat as a literal backslash rather than an escape sequence, allowing arbitrary SQL to be injected into…
fixBackported in: Fix several edge case correctness issues in setting optimize_inverse_dictionary_lookup where the optimization could silently drop rows or suppress exceptions. Closes. Close. (Nihal Z. Miaji).
fixBackported in: Fix parsing of parenthesized subscript expressions on columns named values, for example (values['a']), so they are no longer interpreted as SQL-standard VALUES table expressions. (Desel72).
fixBackported in: Fix a server abort/LOGICAL_ERROR in the filesystem cache background eviction thread (SLRUFileCachePriority::collectEvictionInfo) that could fire when keep_free_space_size_ratio or keep_free_space_elements_ratio was high enough to trigger eviction while all cache entries had already…
fixBackported in: Fix exceptions (NOT_FOUND_COLUMN_IN_BLOCK, LOGICAL_ERROR, AMBIGUOUS_COLUMN_NAME) when using projections with UNION ALL views, window functions, or alias-column name collisions. Regression from. (Amos Bird).
fixBackported in: Fixes a possible underflow in parsing postgres arrays. (Grant Holly).
fixBackported in: Fix Code: 36. BAD_ARGUMENTS Expected literal, got {name:Type} thrown when a query parameter is used inside the base_backup setting of a BACKUP or RESTORE statement (e.g. BACKUP ... SETTINGS base_backup = S3({backup_name:String}, ...)). The regression was introduced in 26.1.5 by PR.…
fixBackported in: Fix SHOW TABLES and system.tables silently truncating the listing for DataLakeCatalog databases backed by Iceberg REST catalogs (iceberg-rest, onelake, biglake). When the catalog server paginates the list-tables or list-namespaces response (e.g. Microsoft Fabric / OneLake beyond ~50…
fixBackported in: Fixed RESTORE of replicated MergeTree tables so restored part attachment uses backup_restore_keeper_max_retries instead of the regular insert Keeper retry budget. (Pablo Marcos).
fixBackported in: Fix Keeper termination and restart loop when get /keeper/availability_zone is sent with quorum_reads=true to a Keeper without configured. (myeongjun).
fixBackported in: Fix a TOCTOU data race in FutureSetFromTuple::buildOrderedSetInplace that results in a logical error. (Miсhael Stetsyuk).
fixBackported in: Fix segfault due to a use-after-free bug in AvroConfluentRowInputFormat. (Miсhael Stetsyuk).
fixBackported in: Fix Bad cast from type DB::ColumnConst to DB::ColumnNullable server abort during partition pruning for MergeTree tables when the partition expression contains a function chain that collapses to a single constant value (such as floor(NULL, toRelativeYearNum(...))). (Groene AI).
fixBackported in: Fix data part consistency checks for types with dynamic structure and detect corrupted columns_substreams.txt. Resubmit of https://github.com/ClickHouse/ClickHouse/pull/103858 with additional changes. (Pavel Kruglov).
fixBackported in: Fix CANNOT_COMPILE_CODE Could not find symbol __fixunsdfti when JIT-compiling expressions that convert a Float to UInt128, such as toUInt128(). The unsigned 128-bit float-to-int compiler-rt builtins were missing from the JIT symbol resolver. Closes. (Raúl Marín).
otherBackported in:. (Pavel Kruglov).
breakingBackported in: Remove duplicate entries from SettingsChangesHistory. (Nikita Fomichev).
otherBackported in: Refreshable MV: relax sanity checks in SECONDARY_CREATE. (Michael Kolupaev).
26.4.2.10 May 7, 2026 Release notes ↗
otherBackported in: Avoid index uncompressed cache overhead when the cache is disabled (server setting index_uncompressed_cache_size = 0, which is the default). (Michael Kolupaev).
featureBackported in: Added SQL functions obfuscateQuery and obfuscateQueryWithSeed that obfuscate a SQL query string by replacing identifiers and literals with randomized placeholders while preserving the query structure. Fixed edge cases in query obfuscation for short identifiers and oversized integer…
fixBackported in: Fix a memory leak when running queries with MATERIALIZED CTEs. (Alexey Milovidov).
fixBackported in: Fix undefined behavior in MergeTreeDataPartWriterCompact::cancel when a stream allocation fails. (Alexey Milovidov).
fixBackported in: Disable trivial LIMIT optimization with row policies/additional_table_filters (to allow parallel index analysis). (Azat Khuzhin).
fixBackported in: Fixed a data-correctness regression in 26.x where JIT-compiled if and multiIf with a Decimal result type and a non-Decimal (integer or float) literal in one branch silently returned a value 10^scale too small. The slow (non-JIT) path was unaffected. Workaround on affected versions:…
fixBackported in: Fix SIZES_OF_ARRAYS_DONT_MATCH when reading AggregateFunction(topK(N), String) columns whose persisted alpha_size was grown by a pre-25.12 deserialize+serialize cycle. (Raúl Marín).
fixBackported in: Fix write out of bounds while deserializing quantileTiming state. (Alexey Milovidov).
otherBackported in: obfuscateQuery and obfuscateQueryWithSeed now preserve names of built-in functions, aggregate functions, table functions, formats, data types, storages, codecs and settings, matching the behaviour of clickhouse-format --obfuscate. (Alexey Milovidov).
26.4.1.1141 May 5, 2026 Release notes ↗
breakingThe IN operator now uses exact value semantics for Bool type: only 0 and 1 values in the set match Bool values. Previously, numeric values greater than 255 in the IN set were incorrectly clamped to true when compared against Bool, so SELECT CAST(1, 'Bool') IN (256) returned 1. Now it correctly…
breakingYou can now stem all the words/tokens in columns String, FixedString, Array([Fixed]String), Nullable, LowCardinality and Const easily with the stem function. (Jimmy Aguilar Mena).
breakingThe H3 library has been updated to v4, which improves the precision of length, area, and other metric calculations. This change is backward incompatible because the new results differ from previous ones. (Alexey Milovidov).
breakingRevert the skip_indexes column in system.query_log introduced in. (Alexey Milovidov).
breakingDisallows using SELECT as a bareword identifier in a WITH expression list element. (Aruj Bansal).
breakingFix endianness of QBit binary serialization to use little-endian format. (Raufs Dunamalijevs).
breakingThis patch changes how the merge table will handle virtuals. If the underlying table contains _table or _database, these columns will be read from storage; otherwise, they will be filled after the read step using the expression step. (Mikhail Artemenko).
breakingThe IN operator now rejects lossy Decimal conversions inside composite types (Tuple, Array, Map) as well, making its behavior consistent with top-level scalar comparisons. Previously, precision checks were enforced only for top-level scalar values: for example, CAST('33.3', 'Decimal64(1)') IN…
breakingBackported in: Reduced default http_max_fields from 1,000,000 to 1,000 and http_max_field_name_size from 128 KB to 4 KB to limit pre-authentication memory usage by HTTP connections. Added http_max_request_header_size and http_headers_read_timeout settings. Users who rely on the previous higher…
featureAdd Arrow Flight SQL support. (Yakov Olkhovskiy).
featureAdd incremental read support for Paimon table engines with Keeper-backed snapshot progress tracking, including targeted snapshot delta reads via paimon_target_snapshot_id, and extend test coverage for type mapping, partition pruning, and incremental read scenarios. (XiaoBinMu).
featureClickHouse is now able to prune entire data parts in SELECT queries based on min/max statistics. (zoomxi).
featureImplement new behavior of max_insert_block_size_rows, max_insert_block_size_bytes, min_insert_block_size_rows, min_insert_block_size_bytes in squashing under compatibility setting use_strict_insert_block_limits. (Kirill Kopnev).
featureAdd function arrayAutocorrelation(arr [, max_lag]) that computes the normalized autocorrelation of a numeric array for each lag. Supports integer, float, and decimal array types. (Wenyu Chen).
featureA SQL function obfuscateQuery. Closes. (Xuewei Wang).
featureAdded two new MergeTree settings — replicated_fetches_min_part_level and replicated_fetches_min_part_level_timeout_seconds — that allow replicas to skip fetching freshly-inserted (unmerged) parts from peers, reducing replication overhead during heavy ingestion. (tanner-bruce).
featureAdd MergeTree skip index support for JSON columns using JSONAllPaths with bloom_filter, tokenbf_v1, ngrambf_v1, and text (inverted) index types, enabling granule skipping based on the set of JSON paths present in each granule. (Pavel Kruglov).
featureThe printf function now supports non-constant format strings, allowing different format patterns per row based on column values. (Yash ).
featureThis patch adds a new projection index(commit_order), that reorganizes data in insertion order. (Mikhail Artemenko).
featureAdd highlight() function that wraps occurrences of search terms in a text string with HTML tags (default /). Supports ASCII case-insensitive matching, automatic merging of overlapping matches, and custom open/close tags. (Peng).
featureAdded bucketed serialization for Map columns in MergeTree (map_serialization_version = 'with_buckets'). Keys are split into hash-based buckets so that reading a single key (m['key']) only reads one bucket instead of the entire column, providing 2-49x speedup for single-key lookups depending on map…
featureImplement quotas by normalized query hash to protect public ClickHouse services from abuse. 1. Support NORMALIZED_QUERY_HASH as a quota key type - separate quota buckets per unique normalized query, so CREATE QUOTA q KEYED BY normalized_query_hash tracks each distinct query independently. 2.…
featureUsers can now write join queries using the NATURAL JOIN syntax, which automatically matches on all columns sharing the same name and deduplicates those columns in the result. (Peter Nguyen).
featureSupport SET TIME ZONE 'tz' as alias for SET session_timezone. (phulv94).
featureAdded support for parameterized queries in the Web UI (play.html): query parameters like {name:Type} are detected and input fields are shown for filling in their values. (Alexey Milovidov).
featureSupport SQL standard VALUES clause as a table expression in FROM, e.g. SELECT * FROM (VALUES (1, 'a'), (2, 'b')) AS t(id, val). (Desel72).
featureAdd PostgreSQL-compatible units to the EXTRACT operator: EPOCH, DOW, DOY, ISODOW, ISOYEAR, WEEK, CENTURY, DECADE, MILLENNIUM. Also fix EXTRACT(WEEK FROM date) which previously threw an error. (Alexey Milovidov).
featureAdded support for SQL-standard compound interval literals with TO range qualifiers, e.g. INTERVAL '1:30' HOUR TO MINUTE. Internally decomposed into sums of intervals. (Desel72).
featureAdd asynchronous metrics for kernel TCP receive and transmit buffer memory (sk_rmem_alloc, sk_wmem_alloc) of HTTP connection pool sockets, reported as p50/p75/p90/p95 percentiles and totals per connection group. (Sema Checherinda).
featureAdded a jemalloc profiling web UI for ClickHouse Keeper, available at /jemalloc on the HTTP control port. (murphy-4o).
featureImplement command SYSTEM FLUSH OBJECT STORAGE QUEUE db.table PATH 'x' for ordered and unordered modes. (Bharat Nallan).
featureAdded function JSONAllValues that returns all values from a JSON column as Array(String), with values serialized in text representation and ordered by their path names. Added support of text index for JSONAllValues expression on JSON columns. When a text index is created on…
featureAdd watch command to clickhouse-keeper-client with watch support in get, exists, and ls commands. (Den Kalantaevskii).
featureAdded getChildrenRecursive (ListRecursive) request to ClickHouse Keeper and lsr command to clickhouse-keeper-client. This closes. (Konstantin Vedernikov).
featureAdd new function arrayTranspose taking a two-dimensional array (matrix) and transposing it: ` SELECT arrayTranspose([[1, 2, 3], [4, 5, 6]]). (Vitaly Baranov).
featureAuto_statistics_types mergetree setting defaults to "minmax, uniq" — minmax and uniq statistics are created automatically for all suitable columns in new tables - materialize_statistics_on_insert defaults to false — statistics are now built during merges rather than at insert time, reducing insert…
featureAdd prefer_dependency_replica refresh setting for materialized view dependency chains to reduce missing data from cross-replica replication lag. (Seva Potapov).
featureAdds a hasPhrase (alias matchPhrase) function for phrase search (continuous sequences of tokens). Search is brute-force, i.e. not supported by the text index yet. (Elmi Ahmadov).
featureBackported in: Add s3_read_request_duration_microseconds and s3_read_request_bytes histogram metrics to observe S3 GET request connection lifetime and bytes consumed, visible in system.histogram_metrics and the Prometheus endpoint. (Sema Checherinda).
featureThe stem function is now non-experimental (previously, setting allow_experimental_nlp_functions had to be enabled). (Jimmy Aguilar Mena).
+899 more items in the release notes
26.3.58.5 Oct 21, 2026 Release notes ↗
fixBackported in: Mask credentials embedded in HTTP URIs. (Han Fei).
fixBackported in: Fixed a heap-use-after-free in the view dependency graph after renaming a materialized view whose query selects from itself. CREATE MATERIALIZED VIEW and ALTER TABLE ... MODIFY QUERY now reject a query that makes a materialized view select from itself. (Groene AI).
fixBackported in: Fix use-after-free in complex key ssd_cache dictionaries when the cache file wraps around its partitions. Fix CANNOT_READ_ALL_DATA when reading long values of ssd_cache dictionaries from the cache file. (Alexey Milovidov).
fixBackported in: Fix flaky test_parallel_quorum_actually_parallel integration test on sanitizer builds. (Groene AI).
26.3.57.12 Oct 20, 2026 Release notes ↗
breakingBackported in: CREATE TABLE x AS src inherits the credentials embedded in the engine of src, which are masked in SHOW CREATE TABLE. It now requires the SELECT privilege on src when the inherited definition can carry credentials, instead of only SHOW COLUMNS. (Yarik Briukhovetskyi).
otherBackported in: Compare TOTP codes and plaintext_password passwords in constant time, so that the response time does not depend on how many leading characters are correct or on which time window matched. (Vladimir Cherkasov).
fixBackported in: Fixed a server crash and an out-of-bounds write when inserting into a column with a long chain of compression codecs, for example CODEC(FPC, FPC, ..., FPC). CompressionCodecMultiple compounded each stage's reserved size in a UInt32 without checking for overflow, so a long enough…
fixBackported in: Fixed a read of uninitialized memory when a Variant, Dynamic or JSON column holding only NULL values is compressed, for example on insert into a Memory table created with compress = 1, or when a block is compressed for a JOIN or for the query result cache. The reported size of such…
fixBackported in: Fixed ORDER BY ... LIMIT over a column of an Interval type (or Nullable, LowCardinality, Tuple or Array of one) failing with TYPE_MISMATCH when use_top_k_dynamic_filtering is enabled, which is the default. Closes. (Groene AI).
fixBackported in: Fixed a server crash (or missing rows in the view, with a Null source table) on INSERT into the source table of a materialized view when a row policy or additional_table_filters of a table read by the view references the source table, e.g. USING x IN src. (Groene AI).
fixBackported in: Fixed crashes of the interactive line editor of clickhouse-client and clickhouse-local, which also crashed the server when used through the web terminal or an SSH session: after a history search that found nothing on an edited recalled query, when the prompt or the line given to an…
fixBackported in: Fix segfault when reading a MySQLDump file whose CREATE TABLE query has an ENUM column without a list of values or with non-string values. (Alexey Milovidov).
fixBackported in: Fix a stack overflow when a Redis server replies with deeply nested arrays. (Alexey Milovidov).
fixBackported in: Fix a stack overflow on a Protobuf schema with a very long chain of nested messages. (Alexey Milovidov).
otherBackported in: Not required. (Groene AI).
26.3.56.2 Oct 19, 2026 Release notes ↗
fixBackported in: Requesting SSH-key authentication over the native protocol no longer reveals whether the named user exists, or how it authenticates, before its signature is checked. (Shaohua Wang).
26.3.55.2 Oct 18, 2026 Release notes ↗
fixBackported in: Reject CR and LF characters in values sent as HTTP headers or in the request line of outgoing HTTP requests (BigQuery, YTsaurus, url, DataLake catalogs, GCP OAuth, AI functions, S3 storage class), which could be used to inject headers or additional requests. (Raúl Marín).
26.3.54.6 Oct 17, 2026 Release notes ↗
otherBackported in: A packet that cannot appear at the current point of the native protocol is now rejected without deserializing its payload. Previously the server deserialized the body of an unexpected Data packet — including arbitrary data types and aggregate function states — only to throw…
securityBackported in: Update the vendored expat to 2.9.0, fixing a denial of service through a crafted backup manifest during RESTORE (CVE-2026-66046) and the other 2.8.3–2.9.0 security fixes. (Actuele AI).
fixBackported in: Fixed an issue where pressing Ctrl-R and then Ctrl-Z in the web terminal or the SSH interface suspended the whole server process. (Alexey Milovidov).
fixBackported in: The setting http_zlib_compression_level now applies only to the gzip and deflate HTTP response compression. The level of other methods (zstd, lz4, br, xz, bz2) is controlled by output_format_compression_level. Previously, a level suitable for zlib was passed to every method, which…
fixBackported in: Fixed a crash (stack overflow) on a CapnProto schema with a long chain of type expression suffixes (Int32.a.a..., Int32()()...) or of declarations that refer to each other (constants, aliases, struct fields, annotations, imports). Such a schema is now rejected with The CapnProto…
26.3.53.4 Oct 16, 2026 Release notes ↗
breakingBackported in: Overriding a key that is stored in a named collection now requires SHOW NAMED COLLECTIONS SECRETS on that collection. This also applies to overrides through an alias (including flat kafka_* settings over nested kafka.* keys), through a SETTINGS clause of a table engine or table…
fixBackported in: Fixed loading, short ATTACH, and UNDROP TABLE for existing SQL-defined S3 disks whose endpoints are absent from remote_url_allow_hosts; new full-definition CREATE and ATTACH still reject disallowed endpoints. (Alexey Bakharew).
fixBackported in: Fixed a possible segmentation fault when reading an Avro map into a Map column (for example Map(DateTime, String)) with the AvroConfluent format, including Kafka tables. Closes. (Groene AI).
26.3.52.9 Oct 15, 2026 Release notes ↗
featureBackported in: Add S3 bucket to remote_url_allow_hosts. (Konstantin Vedernikov).
fixBackported in: Fixed a stack overflow crash on a deeply nested CapnProto schema that the nesting depth check missed: a comment or a byte order mark between import and its path, an escape sequence in the import path, or a backtick text line. A backtick text line with many brackets is no longer…
fixBackported in: The web terminal and the SSH interface no longer reset the settings of the user (from settings profiles, roles, and CREATE USER ... SETTINGS) to default values. Previously, restrictions such as readonly, resource limits, and additional_table_filters were not applied in these…
fixBackported in: Fix a wrong result, or an exception in debug builds, when optimize_aggregators_of_group_by_keys eliminated any, min or max of a GROUPING SETS key with group_by_use_nulls. (Alexey Milovidov).
fixBackported in: Fixed a server crash when a RabbitMQ table with the headers exchange type had a routing key without =, or when rabbitmq_routing_key_list was empty. Routing keys without = for the headers exchange type are now rejected with an exception. The problem was found and reported by @dstesk…
otherBackported in: Update mariadb-connector-c to v3.4.10. (Actuele AI).
otherBackported in: Update vectorscan to 5.4.13. (Actuele AI).
otherBackported in: Use castStorage for the Join row policy check in the legacy analyzer. (Vladimir Cherkasov).
26.3.51.7 Oct 14, 2026 Release notes ↗
featureBackported in: Added a server setting access_control_improvements.readonly_restricts_set_role, false by default. When enabled, SET ROLE is refused with error code READONLY in a session or query whose readonly setting is not zero. Previously SET ROLE was the only identity-changing statement that…
fixBackported in: Fix a credential written in cleartext to system.query_log and the server log when a key = value argument precedes the positional arguments of the mongodb, redis, remote, arrowFlight and ytsaurus table functions or the MongoDB, Redis, Remote, ArrowFlight, ExternalDistributed and…
fixFix a security issue where an unauthenticated TCP client could probe table existence and replication status via the interserver protocol. Such a request now gets a response that does not depend on the state of the tables. The new server setting interserver_tables_status_allow_unauthenticated…
fixBackported in: Free prefetched messages when StorageKafka2 partitions move between consumers, preventing per-partition memory growth until restart. (Aparajita Pandey).
fixFixed escaping of string literals when a predicate is pushed down to PostgreSQL. (Shaohua Wang).
otherBackported in: Use shared lock for throttler getters in Context. (Antonio Andelic).
26.3.50.11 Oct 13, 2026 Release notes ↗
fixBackported in: The collections of the Native protocol — the settings and the query parameters of a query, the client information, the granted roles and the table-status lists — are now bounded, so a small packet can no longer make the server allocate memory for data that has not arrived. (Alexey…
fixBackported in: Fix reading bucketed runtime Map values from JSON columns using advanced shared-data serialization. (Rory Shanks).
fixBackported in: Mask secrets in the queries that a cluster-mode QueryRunner table writes to system.query_log as well as in queries executed as startup scripts. (Miсhael Stetsyuk).
fixBackported in: Fixed a crash on a query with a deeply nested Dynamic or JSON constant. (Pavel Kruglov).
fixBackported in: Reject malformed serialized groupBitmap states with INCORRECT_DATA instead of failing later during bitmap operations. (Elmi Ahmadov).
fixBackported in: Fixed excessive memory usage when loading a data part with a corrupted columns_substreams.txt; such a part is now detached as broken. (Murphy).
securityBackported in: Update mongo-c-driver to 2.5.5, fixing an out-of-bounds write during MongoDB connection monitoring reconnects (CVE-2026-96746). (Actuele AI).
fixBackported in: Fixed a heap use-after-free in the s3, azureBlobStorage, hdfs and other object storage table functions and engines when an exception (for example MEMORY_LIMIT_EXCEEDED) was thrown while creating the reader of a file in a row input format such as CSV. (Groene AI).
fixBackported in: Fixed a server crash, wrong results or a rejected query in ORDER BY ... WITH FILL ... INTERPOLATE when one INTERPOLATE expression has to be converted to its target's type and another item reads the same column or literal, for example INTERPOLATE (a AS b, b AS a) with targets of…
otherBackported in: Update thrift to v0.25.0. (Actuele AI).
26.3.49.3 Oct 12, 2026 Release notes ↗
fixBackported in: Fixes a case found by CI where a not-ready set was passed when the filter depends on the left-side column. Closes. (Yarik Briukhovetskyi).
fixBackported in: Tables in a database with lazy_load_tables were missing from system.parts, system.replicas and related system tables, and refused by replica commands, after a restart. (Nikolay Degterinsky).
26.3.48.2 Oct 11, 2026 Release notes ↗
fixBackported in: Fixed a crash (stack overflow) when reading an Avro file with an explicit structure that does not read a field nested through a long chain of named types, or a field of a recursive type holding deeply nested data such as a long linked list. Such a file now fails with…
26.3.47.6 Oct 10, 2026 Release notes ↗
fixBackported in: Fixed Expected UInt64 column for __grouping_set, got BLOB and ColumnBLOB should be converted to a regular column before usage logical errors on a distributed query executed on a shard with enable_parallel_blocks_marshalling (enabled by default), for example with GROUP BY GROUPING…
fixBackported in: Fixes DeltaLake tables returning too few rows when the WHERE predicate contains a sub-expression the delta-kernel predicate translator cannot handle, positioned under a NOT. Such a sub-expression is now reported to delta-kernel as an explicit unknown predicate instead of as the end…
fixBackported in: Fix a possible heap buffer overflow on malformed responses from blob storage. (Arsen Muk).
otherBackported in: CRoaring v5.2.3 exposes internal_validate() on the C++ RoaringBitmap wrappers, so RoaringBitmap data can be validated. (Elmi Ahmadov).
otherBackported in: Update cctz to 2026e. (Actuele AI).
26.3.46.2 Oct 9, 2026 Release notes ↗
fixBackported in: Fix a rare server crash (SIGSEGV in mongoc_log) when a MongoDB dictionary source or MongoDB table was created while another thread created the first MongoDB connection in the process. Messages logged by the MongoDB driver now go to the server log. (Vladimir Cherkasov).
26.3.45.3 Oct 8, 2026 Release notes ↗
fixBackported in: Fix a server abort when reading an Iceberg table whose sort order names a transform ClickHouse cannot parse (e.g. bucket[xyz]); ClickHouse now ignores that sort-order hint and keeps the table readable. (Ilias).
otherBackported in:. (Alexey Milovidov).
26.3.44.2 Oct 7, 2026 Release notes ↗
fixBackported in: Fix Found patch part ... that intersects mutation with version ... on lightweight updates in a table created with CREATE TABLE ... CLONE AS or ATTACH PARTITION ALL FROM a table with lightweight updates. (Nikolay Degterinsky).
26.3.43.4 Oct 6, 2026 Release notes ↗
fixBackported in: Fixed BACKUP to AzureBlobStorage: copying a data file inside a backup wrote the destination object outside the backup directory. Backup object existence checks on S3 destinations now use exact HeadObject requests instead of prefix listing, preventing false matches of…
fixBackported in: Add more path validations. (Konstantin Vedernikov).
fixBackported in: Fixed a segmentation fault or std::length_error when reading TSV formats with input_format_tsv_crlf_end_of_line = 1 if an escape sequence ended exactly at the end of a read buffer. (Groene AI).
26.3.42.3 Oct 5, 2026 Release notes ↗
fixBackported in: Fix an out-of-bounds read when deserializing a uniqTheta state shorter than 24 bytes, for instance from CAST( AS AggregateFunction(uniqTheta, ...)). (Alexey Milovidov).
fixBackported in: Fix a buffer over-read on the sequential read path from Azure Blob Storage: an endpoint that answers a ranged request with more data than was requested could deliver bytes from outside the requested range to the caller. The end of a read is now decided by the locally set right…
26.3.41.4 Oct 4, 2026 Release notes ↗
fixBackported in: Fixed SYSTEM SYNC TRANSACTION LOG (local, non-ON CLUSTER form) not checking the SYSTEM_SYNC_TRANSACTION_LOG privilege. The ON CLUSTER form already required it via getRequiredAccessForDDLOnCluster, but the local execution path skipped checkAccess, so a user without the grant could…
fixBackported in: Fix LOGICAL_ERROR Cannot capture column N because it has incompatible type when a materialized view with a lambda over an Array(Tuple(...)) column receives a block while the source table's column type is being changed by ALTER TABLE ... MODIFY COLUMN. (Jimmy Aguilar Mena).
otherBackported in: Hide a Backup locator named like a COLUMNS matcher in EXPLAIN AST instead of throwing. (Groene AI).
26.3.40.16 Oct 3, 2026 Release notes ↗
otherBackported in: Faster planning of queries to Iceberg tables with many manifest files: when a manifest file header has the schema-id key and that schema is already known from metadata.json, the schema copy stored in the manifest header is no longer parsed and compared with it. ClickHouse now also…
otherBackported in: Hide the HTTP headers in the definition of HTTP dictionary sources in SHOW CREATE DICTIONARY, system.tables and query logs, the same way as passwords. They can be shown with the existing display_secrets_in_show_and_select mechanism. (Matheus Nerone).
fixBackported in: Fixed a transient Code: 499 ... InvalidPart (S3_ERROR) failure on S3 multipart uploads (for example INSERT INTO ... hits_s3). MinIO can briefly report a just-uploaded part as missing on CompleteMultipartUpload; this error is now retried like the already-handled NoSuchKey, bounded by…
fixBackported in: Fixed max_memory_usage and max_server_memory_usage not being respected when reading a JSON column with the FLATTENED serialization version from the Native format. (Pavel Kruglov).
fixBackported in: Fixed out-of-bounds reads when reading a JSON or Dynamic column from a malformed Native block or a corrupted data part. A truncated stream, a duplicate type in a flattened Dynamic column, a duplicate or typed-colliding path in a JSON column, and a serialization version that is only…
fixBackported in: EXPLAIN AST printed secret function arguments, such as the key of encrypt, in clear text, and with optimize = 1 it did so for the body of a view the user may only SELECT from. The dump now prints '[HIDDEN]' in their place, under the same gate as SHOW CREATE. (Harikrishnan Prabakaran).
fixBackported in: Column-level SELECT privileges are now enforced for columns used only inside indexHint and for ALIAS columns referenced in PREWHERE. As in WHERE, referencing an ALIAS column in PREWHERE requires the grant on the alias name; a grant on its source columns is no longer sufficient. A…
fixBackported in: Fixed a row policy bypass: a direct JOIN with an EmbeddedRocksDB, KeeperMap or Redis table in the legacy analyzer (enable_analyzer = 0) ignored the row policy of the right table and returned hidden rows, and joinGet on a Join table ignored its row policy in both analyzers. Such a…
fixBackported in: Fix the Kafka and NATS table engines ignoring remote_url_allow_hosts: broker addresses from kafka_broker_list, nats_url, and nats_server_list are now checked against the remote host filter. A forbidden address is rejected at CREATE TABLE with UNACCEPTABLE_URL, as the RabbitMQ engine…
fixBackported in: Fix filesystem cache accounting when the directory for a new cache key cannot be created, for example because the cache disk is out of space or inodes. The failed reservation stayed counted in the cache until the query released the file segment. (Sema Checherinda).
fixBackported in: CREATE OR REPLACE in a Replicated database or with ON CLUSTER now requires the drop privilege for the kind of the table it replaces, so a user without DROP DICTIONARY can no longer replace a dictionary. (Nikolay Degterinsky).
fixBackported in: Fix a server crash caused by unbounded recursion when decoding a deeply nested value inside a binary encoded type, for example an AggregateFunction parameter in a Dynamic value read from RowBinary or Native. (Pavel Kruglov).
fixBackported in: Fix validation of Iceberg manifest-list entries during writes. (Arsen Muk).
fixBackported in: S3 client check initial url in backup client. (Konstantin Vedernikov).
otherBackported in: Do not dereference a null logs_queue in OwnSplitChannel::log. (Groene AI).
26.3.39.7 Oct 2, 2026 Release notes ↗
otherBackported in: Build Iceberg min/max hyperrectangles only for columns the filter uses. (Konstantin Vedernikov).
fixBackported in: Fix an out-of-bounds read (a crash in release builds) in insert deduplication when an INSERT flows through a materialized view whose inner query changes the number of rows and the deduplicating target table is partitioned. DeduplicationInfo::filterToPartition attributed each…
fixBackported in: Fixed an ssl_certificate authentication bypass where an embedded NUL byte in a certificate's Common Name (for example john\0.evil.com) was truncated server-side to john, letting a holder of such a certificate authenticate as a different user. (Konstantin Bogdanov).
fixBackported in: Now clickhouse masks credentials in system.query_log even for wrong URLs for external table engines. (alesapin).
fixBackported in: Fixed secret settings of S3Queue and AzureQueue tables written with the legacy s3queue_ prefix, such as s3queue_after_processing_move_secret_access_key, being shown in cleartext in SHOW CREATE TABLE, system.tables, system.query_log and the server log. They are now hidden as they are…
fixFixed a server crash on CREATE TABLE or ALTER TABLE ... ADD CONSTRAINT when a constraint contains a less or lessOrEquals comparison with the wrong number of arguments, for example CHECK less(a). (Antonio Filipovic).
26.3.38.2 Oct 1, 2026 Release notes ↗
fixBackported in: Kafka producer and consumer trace logs now show the value of secret librdkafka properties, such as sasl.password, as [HIDDEN] instead of the cleartext value. (János Benjamin Antal).
26.3.37.3 Sep 30, 2026 Release notes ↗
fixBackported in: Fixed a Backup database engine printing the credentials of its destination in plaintext. SHOW CREATE DATABASE, system.databases.engine_full, system.query_log and the messages that reject a malformed locator showed an AzureBlobStorage account_key, a connection string or a presigned…
otherBackported in: Use llvm-project 22.1.1. (Konstantin Bogdanov).
26.3.36.6 Sep 29, 2026 Release notes ↗
otherBackported in: Chained ARRAY JOINs no longer materialize the whole block of a lazily replicated array column before expanding it, which cuts their peak memory by several times. (Yarik Briukhovetskyi).
fixBackported in: Fixed silently empty tables when more than one ENGINE = Backup database is created from the same backup, or when such a database is recreated under a different name. The storage policy that backs a Backup database is now identified by a name that also covers the local database name,…
fixBackported in: ALTER DATABASE ... MODIFY COMMENT on a database with ENGINE = Backup no longer writes a definition the server cannot read back, which made it refuse to start; metadata already written in that form now loads too. Backward incompatibility: a backup taken by an older server of a…
fixBackported in: Fixed settings constraints from a settings profile not being enforced against the other setting assignments in the same statement. SET profile = 'p', = could override a CONST, MIN/MAX or readonly constraint that profile p installs. The same escape existed through an in-query…
fixBackported in: Unreleased regression from, not present in any release, no changelog entry required. (Groene AI).
26.3.35.3 Sep 28, 2026 Release notes ↗
fixBackported in: Fix a segmentation fault in Keeper when preallocating space for a changelog file fails because the disk is full. (Alexey Milovidov).
fixFPC() codecs with big levels are now handled more gracefully. (Robert Schulze).
26.3.34.136 Sep 26, 2026 Release notes ↗
breakingBackported in: Outbound TLS connections now verify that the server certificate names the host that was connected to. This affects clickhouse-client --secure, remoteSecure(), Distributed over the secure native protocol, secure Keeper connections, and HTTPS clients such as s3(), url(), HTTP…
breakingBackported in: A MySQL dictionary source created with a CREATE DICTIONARY query can no longer enable enable_local_infile, at the source or at one of its REPLICA entries; loading such a dictionary fails with BAD_ARGUMENTS, which with the default dictionaries_lazy_load is on first use rather than at…
featureBackported in: You can now disable reading through the executable table function and from Executable/ExecutablePool tables with the new allow_executable_tables setting, for a deployment that must not run arbitrary server-side scripts. It defaults to true, so existing behavior is unchanged. (Hanzi…
securityBackported in: More security validations for biglake catalog. (Konstantin Vedernikov).
fixBackported in: Fix LOGICAL_ERROR crash "Current component is empty" when querying system.part_moves_between_shards with enforce_keeper_component_tracking enabled. (Groene AI).
fixBackported in: Fixes silent data loss for TTL expressions that apply large intervals directly to Date / DateTime source columns by widening the arithmetic away from 16/32-bit overflow. (BoloniniD).
fixBackported in: Fixed the max_memory_usage_soft_limit was not updated on-the-fly when the configuration changed. The soft memory limit was calculated once at startup and cached, so subsequent config reloads had no effect. After this fix, the limit is recalculated and applied immediately on every…
fixBackported in: Fixed a rare issue in new Kafka table engine where messages could be incorrectly handled during topic partition reassignment, potentially leading to skipped messages after offset rollback. (János Benjamin Antal).
fixBackported in: Reject out-of-range IntervalKind bytes during RowBinaryWithNamesAndTypes type decoding (input_format_binary_decode_types_in_binary_format = 1) with a clear INCORRECT_DATA error instead of constructing a DataTypeInterval with an invalid kind that could subsequently trip undefined…
fixBackported in: Fix a compound ALTER TABLE ... RENAME COLUMN a TO b, RENAME COLUMN c TO a that reuses a freed column name (a "swap") between columns of different types. The materialized part recorded the wrong column type, so a later SELECT failed with Conversion between numeric types and IPv6 is…
fixBackported in: Fix a LOGICAL_ERROR (Expected the argument N to have X rows, but it has Y) when executing a function over a Dynamic column built by a JOIN over Dynamic (for example the non-joined rows of a RIGHT/FULL JOIN, or a correlated EXISTS subquery decorrelated into a join). (Groene AI).
fixBackported in: Fixed an out-of-bounds read when finalizing a crafted analysisOfVariance aggregate state whose internal arrays have mismatched lengths. (uwezkhan).
fixBackported in: Fixed a server crash (LOGICAL_ERROR: 'Unexpected exception in refresh scheduling') that could happen on startup when a coordinated refreshable materialized view in a Replicated database was attached on a Keeper that does not support the MULTI_READ feature flag (for example after a…
fixBackported in: The hasColumnInTable function now requires the SHOW COLUMNS privilege on the target table, the same grant required by DESCRIBE and SHOW CREATE TABLE. Previously any user could call hasColumnInTable to probe column names and test table and database existence without any access check.…
fixBackported in: Validate the redirect target of an S3 301 Moved Permanently response against remote_url_allow_hosts (RemoteHostFilter). Previously the AWS-SDK 301 handling followed the attacker-supplied endpoint from the response (Location header or element) without the host check, so a malicious…
fixBackported in: Fixed SQL injection in the MySQL wire protocol: the SHOW TABLE STATUS LIKE argument and the SET value sent over the MySQL interface (port 9004) are now parsed and re-quoted instead of being concatenated verbatim into the rewritten query. Also fixed KILL QUERY over the MySQL…
fixBackported in: Fixed RabbitMQ table engine hanging indefinitely on DROP TABLE or server shutdown when the broker closes the AMQP connection due to missed heartbeats without sending a TCP RST. All blocking event loop calls now have a 30-second timeout so shutdown always completes. (Aly Ayman).
fixBackported in: The ArrowFlight table engine and the arrowFlight table function now honor the allow-list. Previously the connection host and port were not validated, so a query could reach hosts not present in the allow-list. (Groene AI).
fixBackported in: Fixed dropping whole parts with TTL (ttl_only_drop_parts = 1) still reading all data from large, fully-expired parts. (Michael Jarrett).
fixBackported in: Rejects non-monotonic Array offsets on every read path that decodes them as absolute values, instead of only in the Native format. A corrupt set skip index granule previously passed unchecked and was then read out of bounds. (Groene AI).
fixBackported in: Fix a crash when reading Iceberg tables with equality delete files. If a column is nullable in the equality delete file but non-nullable in the table schema (or vice versa), the values read from the delete file were inserted into a column of a different type through an unchecked…
fixBackported in: Fix an accounting leak in memory tracking: when an allocation was rejected by a parent memory tracker (for example, the server-wide memory limit), the thread, query, and user level trackers kept the rejected amount. The error accumulated over time, inflating MemoryTracking and…
fixBackported in: Fix PREWHERE (and row-level policies) on an Iceberg column that was renamed by schema evolution silently returning 0 rows for old data files. Such queries now return the correct rows, matching WHERE. (Groene AI).
fixBackported in: Fixed potential data loss when an INSERT into ReplicatedMergeTree was cancelled or timed out while ClickHouse was recovering an uncertain Keeper commit. (kakao-tars-case).
fixBackported in: Fixes a server crash (double free) when finalizing an aggregate function with the -State combinator nested under a combinator that transfers several sub-states in one call (-Resample, -ForEach, -Map, -Tuple), for example groupArrayStateResample, if an exception such as a memory…
fixBackported in: Fix CREATE OR REPLACE leaving the replaced object behind under an internal name when the caller lacks the drop privilege on it. (Nikolay Degterinsky).
fixBackported in: Restrict local object access only for user files path. Continuation of https://github.com/ClickHouse/ClickHouse/pull/99405. (Konstantin Vedernikov).
fixBackported in: Fixed a SQL injection in the PostgreSQL metadata queries. The schema of the PostgreSQL database engine, the requested column names and the publication name were formatted into SQL literals without escaping, so a value containing a quote could execute arbitrary SQL on the connected…
fixBackported in: Fix a race between a ReplicatedMergeTree mutation and the removal of old temporary directories that could publish a mutated part with some of its files missing, making reads of that part and all its later mutations fail. (Alexey Milovidov).
fixBackported in: Fixed a crash when reading a subcolumn of a Variant, Dynamic or JSON column whose own type is Nullable or LowCardinality(Nullable) from a MergeTree table, for example SELECT value.Tuple(a Nullable(UInt32), b String).a over a Dynamic column. Previously such a read hit a LOGICAL_ERROR…
fixBackported in: Fixed Iceberg INSERT writing no lower_bounds/upper_bounds at all into the manifest entry when the table has a column whose type cannot be serialized into a statistics bound (for example Array(Int32)), or a column that is entirely NULL. Such a field is now omitted individually and…
fixBackported in: Fixed a data race and a use-after-free on the metadata of a DeltaLake or Iceberg table. Two concurrent queries that read total_rows or total_bytes from system.tables for the same table could have one query replace the table's metadata while the other was still reading it, which…
fixBackported in: Fix Logical error: Duplicate announcement received for replica number N when automatic parallel replicas (automatic_parallel_replicas_mode) adopts a plan whose single-node variant was sharded by query_plan_join_shard_by_pk_ranges. (Alexey Milovidov).
fixBackported in: A table or database whose name is substituted into a ReplicatedMergeTree ZooKeeper path through the {database} or {table} macro is now rejected if the name would not be a single safe path component. Previously a name containing / was spliced in unescaped, so the table registered its…
fixBackported in: Apply remote_url_allow_hosts before SQL-supplied S3 and Azure endpoints send schema, metadata, or container requests. (Rory Shanks).
fixBackported in: Fixes a server abort (Logical error: Part patch-... doesn't exist) when a DROP TABLE runs concurrently with a lightweight UPDATE on a ReplicatedMergeTree table. The update now holds the table's shared lock until its patch part is committed, so the DROP waits instead of removing it.…
fixBackported in: Fixed wrong results from if, multiIf and CASE when one branch is a Date or Date32 and the result type is DateTime or DateTime64. With compile_expressions = 1 (the default) the compiled expression copied the date's day count into the timestamp column without converting days to…
fixBackported in: Fix reading a column that has two streams whose names differ only by escaping, for example a Tuple element named size0 inside an Array, or a JSON typed path named like a substream of a sibling path. Such columns returned wrong values, failed with CANNOT_READ_ALL_DATA or a logical…
fixBackported in: Fix LOGICAL_ERROR: No available columns when a query reads no columns from a table expression that has no columns at all, for example SELECT count() FROM loop(db, tbl) where tbl is an Alias table whose target was dropped, or a parameterized view. Such a query now fails with…
fixBackported in: Fixes a server abort in debug and sanitizer builds when inserting into a materialized view whose TO target is another materialized view. Such an insert already failed on released versions, with an uninformative Code: 1001 STD_EXCEPTION; it now reports NOT_IMPLEMENTED naming the…
+95 more items in the release notes
26.3.33.24 Sep 9, 2026 Release notes ↗
breakingBackported in: Reading a File source with rename_files_after_processing set now requires the WRITE ON FILE grant on top of READ ON FILE, on the initiator for fileCluster: the setting renames the files a SELECT has read, which is a write to the source, and it used to happen for anyone who could…
fixBackported in: Fix Block structure mismatch in stream error caused by unnecessary columns returned from Lazy materialization. Fixes. (Nikolai Kochetov).
fixBackported in: Fix out-of-bounds access in lazy materialization optimization that could cause an exception in debug builds. (Alexey Milovidov).
fixBackported in: Fix an out-of-bounds write when reading a Variant column from a malformed Native block whose discriminators reference a variant index that does not exist. (uwezkhan).
fixBackported in: Fixed SQL injection in the PostgreSQL wire protocol emulation. Prepared-statement parameters — the Parse/Bind/Execute extended-query path used by psycopg2, JDBC, node-postgres, Npgsql and others, and the simple-query EXECUTE path — were substituted into the executed SQL by raw…
fixBackported in: Fix ObjectStorageQueue/AzureQueue (and the azureBlobStorage table function) silently skipping objects when the object storage returns an empty listing page together with a continuation token. Azure Blob Storage does this (e.g. when a listing crosses an internal partition boundary),…
fixBackported in: Fix a data race (and rare crash) when a parsing/analysis error is reported while reading a file/object storage table. A parse error raised during lazy KeyCondition initialization was shared as a single exception object across reader threads, and two threads could concurrently append…
fixBackported in: RabbitMQ Security related bugfix. (Kseniia Sumarokova).
fixBackported in: Fixed LOGICAL_ERROR when reading a table with a set skip index defined on an expression and the query repeats that expression with a Nullable operand, for example WHERE intDiv(id, (SELECT 1000)) = 3 over INDEX b_set intDiv(id, 1000) TYPE set(100). A scalar subquery is enough to…
fixBackported in: Fix std::out_of_range: map::at: key not found when a MergeTree key expression contains a mortonEncode or hilbertEncode call that is not itself a key column, for example ORDER BY mortonEncode(hilbertEncode(x, y), x, y) or PARTITION BY mortonEncode(x, y) % 4. (Groene AI).
fixBackported in: Fixes asynchronous inserts into JSON columns ignoring the max_dynamic_subcolumns_in_json_type_parsing setting. Previously, an asynchronous insert (async_insert = 1) could store more dynamic paths than the setting allows, giving a different column layout than a synchronous insert…
fixBackported in: Reject a bare carriage return (\r), in addition to a line feed (\n), in HTTP header names and values that pass through the HTTP header filter. This closes an HTTP header injection (request/response splitting) gap for features that pass user-provided headers, such as the url table…
fixBackported in: Fix a use-after-free in the gRPC server when a query with a streaming input finishes while a read of the next message is still in flight. (Alexey Milovidov).
fixBackported in: Fixed h3Line returning uninitialized memory in the tail of the result array when a line between two valid H3 indices cannot be drawn because it crosses pentagon distortion. Such a call now throws INCORRECT_DATA. (Groene AI).
fixBackported in: The handshake response of the MySQL wire protocol is now bounded, so a client can no longer make the server grow memory during the handshake. The mysql_require_secure_transport server setting is now enforced from the actual state of the connection instead of a capability bit…
fixBackported in: Hide the credentials that a setting value can carry, such as the password in format_avro_schema_registry_url or url_base, everywhere a setting value is displayed or logged. system.query_log, system.processes, system.settings, system.settings_profile_elements, system.session_log,…
fixBackported in: Several aggregate function deserializers allocated memory from a size declared in the serialized state before reading the payload, so a state of a few bytes could request gigabytes. They now read only what the buffer already holds. (Groene AI).
fixBackported in: Fixes a potential out-of-bounds write of function formatDateTimeInJodaSyntax when called with a time zone name longer than 32 characters. (Robert Schulze).
fixBackported in: CREATE USER OR REPLACE and the OR REPLACE form of CREATE ROLE, CREATE QUOTA, CREATE SETTINGS PROFILE and CREATE ROW POLICY now require the corresponding DROP privilege in addition to CREATE, because they overwrite an existing entity. Previously CREATE USER alone was enough to reset…
fixBackported in: A simple Query in the PostgreSQL wire protocol now destroys the unnamed prepared statement and the unnamed portal, as PostgreSQL does, so a later Bind or Execute on them is rejected instead of silently reusing stale extended-query state. A Flush or unimplemented message sent outside…
fixBackported in: Fixed object storage listing silently skipping objects when S3 returns an empty page together with a continuation token. This could make a plain_rewritable disk appear empty and hide table parts, and could make data lake tables read a stale snapshot. (Sema Checherinda).
otherBackported in: Make 05054_embedded_rocksdb_explicit_dir_file_grant stress-restart safe. (Groene AI).
otherFor 04238_alter_rename_column_merge_race, apply 1 code line change suggested by AI. For 04408_lazy_materialization_part_offset_prewhere, disable parallel replicas. (Pedro Ferreira).
26.3.32.14 Sep 6, 2026 Release notes ↗
fixBackported in: Fix runtime join filter producing wrong results for JSON columns. Closes. (Pavel Kruglov).
fixBackported in: Enforce the http_forbid_headers configuration during schema inference for the url() table function and URL storage engine. Previously a forbidden header was still sent over the network while inferring the schema (for example with the Regexp format or DESCRIBE), and its response body…
fixBackported in: Fixed incremental backups to Azure Blob Storage storing the beginning of each file instead of its tail. Restoring such a backup silently dropped all the data written after the base backup. (Smita Kulkarni).
fixBackported in: Validate Variant discriminator in ColumnVariant arena deserialization. (Azat Khuzhin).
fixBackported in: Fix an integer overflow in the deserialization of String values in the binary formats, and bound the recursion of the binary deserialization of Dynamic and JSON values. (Alexey Milovidov).
fixBackported in: Reject invalid names of projections and indexes. (Alexander Tokmakov).
fixBackported in: Fixed reading uninitialized memory as literal data when decompressing a malformed LZ4-compressed block. (Alexey Milovidov).
fixBackported in: Fixed a stack overflow when reading hadoop-snappy data containing many blocks that decode to nothing. (Alexey Milovidov).
fixBackported in: Fix background Distributed inserts that deleted unsent spool files after a split batch got a transient error. ClickHouse now keeps the files and retries the batch. (Rory Shanks).
fixBackported in: ENGINE = EmbeddedRocksDB(ttl, rocksdb_dir, read_only) with an explicit rocksdb_dir now requires the FILE source grant that file requires for the same directory: READ ON FILE to create such a table, plus WRITE ON FILE when read_only = 0. Previously it required no source grant, so a…
fixBackported in: Fixed format_schema_source='query' running the schema query with full privileges when used from a background task, such as a streaming engine consumer (Kafka, NATS, RabbitMQ, ObjectStorageQueue) or a Buffer background flush. The schema query is now rejected there; use…
fixBackported in: Fix EXPLAIN QUERY TREE and EXPLAIN SYNTAX exposing column names and types of tables the user has no privileges for: the analyzer now checks that the user may see at least one column of the table at the moment a table identifier is resolved. The check also makes the error kind…
fixBackported in: Fixed a privilege escalation in implicit access-rights computation: holding any single child privilege of the ALTER TABLE group (for example ALTER MODIFY COMMENT) on a view implicitly conferred the entire ALTER VIEW group, so such a user could run ALTER TABLE MODIFY QUERY and…
26.3.31.5 Sep 5, 2026 Release notes ↗
fixBackported in: Fix a Bad cast from type DB::ColumnSparse to DB::ColumnString logical error (server abort in debug and sanitizer builds) when groupConcat is applied to a Tuple whose String element is stored sparse. (Groene AI).
fixBackported in: Fixed a privilege-escalation gap where the executable table function did not enforce the TABLE ENGINE ON Executable grant. With table_engines_require_grant enabled, a user denied CREATE TABLE ... ENGINE = Executable could still run the same server-side script via SELECT ... FROM…
fixBackported in: Fixed wrong results when a hash join has a single LowCardinality key of a type wider than 8 bytes (UInt128, Int128, UInt256, Int256, and their Nullable variants). Such a join silently returned rows whose key values are not equal. (Groene AI).
fixBackported in: Fix a path traversal on RESTORE. A backup metadata entry whose was not already in normal form, for example one containing // or fewer .. than the depth of its own directory prefix, was validated in normalized form but stored verbatim, so restoring the part wrote the entry outside…
26.3.30.9 Sep 4, 2026 Release notes ↗
fixBackported in: Fix a server crash in predicate pushdown (enable_optimize_predicate_expression, legacy analyzer) when a UNION subquery appears inside a JOIN ... ON condition. (Groene AI).
fixBackported in: Fixed parallel_view_processing setting being ignored when inserting into a table with materialized views — since 25.10, views always ran in parallel regardless of the setting. (Antonio Andelic).
fixBackported in: Fixed reading a corrupted Native-format stream whose Dynamic type count or JSON/Object path count is close to SIZE_MAX: such malformed input is now rejected with a clear INCORRECT_DATA error instead of an uncaught std::length_error. (Alexey Milovidov).
fixBackported in: Fixes memory leaks of abandoned nested aggregate states. (Groene AI).
fixBackported in: Fixed silently incorrect results and undefined behavior when reading a malformed AggregateFunction(uniq, ...) state. The skip_degree field of the serialized state was used as a shift exponent without validation, so an out-of-range value produced an arbitrary cardinality instead of…
fixBackported in: Fix read_rows, read_bytes, written_rows and written_bytes in system.query_thread_log reporting a thread lifetime running total instead of the values for the logged query. Rows of long-lived pooled threads, in particular the query's initiating HTTPHandler thread, were affected.…
fixBackported in: Fixed wrong results from sumKahan when the aggregated batch does not start at the first row of the block. sumKahanIf, and sumKahan over a Nullable argument, tested each row against the wrong element of the condition or null map, returning silently incorrect sums inside window frames…
fixBackported in: Check the overflow when allocating a block of aggregate function states on deserialization: a malformed Native block could make the server write out of bounds. (Raúl Marín).
26.3.29.7 Sep 2, 2026 Release notes ↗
fixBackported in: Fixed a credential leak where the legacy storage_aws_access_key_id, storage_aws_secret_access_key, storage_catalog_credential, and storage_auth_header settings of the DataLakeCatalog database engine were shown in plaintext in system.databases.engine_full and SHOW CREATE DATABASE.…
fixBackported in: Fix allow_feature_tier rejecting merge_tree_-prefixed settings in settings profiles as unknown, and rejecting CREATE TABLE because of MergeTree settings set by the server through compatibility or the merge_tree config section. Also fix constraints on a merge_tree_-prefixed setting…
fixBackported in: Fix a case where expensive ZooKeeper exception logging could delay session finalization and leave pending requests unresolved. (Antonio Andelic).
fixBackported in: Fix crashes of the Parquet, ORC and Iceberg readers on malformed input: a DELTA_BYTE_ARRAY page with an empty length stream, a DELTA_BYTE_ARRAY page of a Decimal column read under a filter, an out-of-range enum in an Iceberg manifest file and an oversized allocation in the ORC…
fixBackported in: Fix a crash of a window function over a Tuple with a sparse element, for example groupConcat(t) OVER (). (Alexey Milovidov).
fixBackported in: Fix wrong window function results for PARTITION BY over a floating-point key (also JSON, Dynamic, and these types nested in Nullable/LowCardinality/Array/Tuple/Map/Variant) with max_threads > 1: values that compare as equal, such as -0. and 0., could hash into different threads, and…
26.3.28.5 Sep 1, 2026 Release notes ↗
otherBackported in: Sped up SQL function formatDateTime with non-const timezone arguments. (Robert Schulze).
featureBackported in: Added fs cache download wait timeout configured by filesystem_cache_wait_for_concurrent_download_timeout_milliseconds. This timeout defined only the wait for a single chunk (buffer bytes of ~1mb) of data, not the whole file segment. (Kseniia Sumarokova).
fixBackported in: Fixed a settings-constraint bypass: a SETTINGS clause inside a subquery, a CTE or a view's inner query was applied without checking the settings constraints, so it could be used to leave readonly mode or to override a CONST, MIN or MAX constraint (for example…
otherBackported in: This patch fixes removePartAndCoveredParts when it is being called for a part that is actually present in the active data part set. The problem was that part itself will always be in parts_covered_by, so the subsequent remove in the loop will not be able to remove it twice. (Mikhail…
26.3.27.3 Aug 31, 2026 Release notes ↗
fixBackported in: Fix a crash for ORDER BY ALL in a WINDOW VIEW, and UNKNOWN_IDENTIFIER errors for INTERPOLATE, WINDOW and LIMIT BY in a query over a Merge or Distributed table with a join, with the old analyzer. (Alexey Milovidov).
fixBackported in: Sizes declared by a server in the Native protocol no longer make the client allocate memory for data that has not arrived: exception strings are read as they arrive, the decompressed size of a block is bounded, and the maximum number of rows in a Native block is now a billion.…
26.3.26.3 Aug 30, 2026 Release notes ↗
fixBackported in: Fix server crashes on deeply nested input in readWKB, JSONMergePatch, the address parser of the url/remote/cluster/mysql/postgresql table functions, the CURSOR clause parser and the CapnProto schema parser. Fix a crash in the parser of the EXECUTE statement when an argument is not a…
fixBackported in: Mask the aws_external_id setting of the DataLakeCatalog database engine in SHOW CREATE DATABASE and system.databases.engine_full. It was previously printed in plaintext, unlike the other AWS credential settings. Closes:. (Groene AI).
26.3.25.2 Aug 28, 2026 Release notes ↗
fixBackported in: Reject unsupported and mixed read/write operations in ZooKeeper multi requests. (Antonio Andelic).
26.3.24.4 Aug 27, 2026 Release notes ↗
fixBackported in: Fixed an out-of-bounds read while deserializing corrupted posting lists of a text index. (Anton Popov).
fixBackported in: Bound the size of the startup message of the PostgreSQL wire protocol, which is read before authentication. (Alexey Milovidov).
fixBackported in: Fix a crash of the showCertificate function on a server that obtains its TLS certificate with ACME (Let's Encrypt). The function now reports the certificate that is actually served, also after a certificate reload. (Alexey Milovidov).
26.3.23.7 Aug 26, 2026 Release notes ↗
fixBackported in: Fixes has, indexOf, countEqual, mapContainsKey, mapContainsValue and Map subscript returning "not found" for a constant LowCardinality needle equal to the element type's default value, such as an empty String or a zero number. (Groene AI).
fixBackported in: Fix propagation of query settings and NULL handling in accurateCastOrDefault. (Alexey Milovidov).
fixBackported in: Fixed a hang when dropping a TimeSeries table whose name sorts lexicographically below its inner tables' names, for example DROP TABLE -ts or dropping a materialized view declared with ENGINE = TimeSeries. The drop self-deadlocked on the DDL guard and could not be cancelled with…
fixBackported in: Fixed a bypass of settings constraints: SET = DEFAULT reset a setting without checking the constraints from the user's profile, so a MIN/MAX/CONST constraint could be escaped by resetting the setting instead of assigning to it, and a session could leave readonly mode with SET…
fixBackported in: Validate the states of the stochasticLinearRegression, stochasticLogisticRegression, groupUniqArray, groupArrayIntersect and topK aggregate functions and of the Resample combinator on deserialization: a malformed state could be read out of bounds. (Alexey Milovidov).
fixBackported in: Do not return uninitialized memory in the result of a binary string literal whose length is not a multiple of eight, and from the LZ4 decompressor when a compressed block has no body. (Alexey Milovidov).
26.3.22.7 Aug 25, 2026 Release notes ↗
fixBackported in: Fixed a use-after-free when a JOIN with join_algorithm = 'direct' onto a dictionary was given a join key that is stored with sparse serialization. getColumnVectorData returned a reference to a temporary column, so the dictionary lookup read freed memory: release builds could return…
fixBackported in: Reject corrupted/malicious dictionary where lcp exceeds the previous token or lcp + data_size overflows, before the buffer write. (Elmi Ahmadov).
fixBackported in: Fixed a row policy bypass where the mergeTreeIndex table function exposed primary key and minmax index values of the rows hidden by a SELECT row policy on the source table; reading mergeTreeIndex for a table with a row policy is now denied. (Yarik Briukhovetskyi).
fixBackported in: Fixed a bug in the function formatRowNoNewline that could produce incorrect results or a logical error when a row is formatted to an empty result. (Alexey Milovidov).
fixBackported in: Add Objects' paths to deduplication hashing, preventing incorrect deduplication. (Mikhail f. Shiryaev).
featureBackported in: This patch: 1. Removes the global error screen (blue screen) and replaces it with a note above the dashboards. In this approach, on any error, already fetched graphs will not be hidden. 2. Dashboard now opens the graphs view immediately. 3. Reload button and any other button can be…
26.3.21.7 Aug 22, 2026 Release notes ↗
fixBackported in: Fix exception when Iceberg metadata file path setting contains a null byte. (Alexey Milovidov).
fixBackported in: Fix a server crash (SIGSEGV) reachable by any user with CREATE TABLE rights when sending CREATE TABLE ... TO INNER UUID '...' without an ENGINE clause over HTTP or the native protocol. The same bug also crashed the client. The parser now reports a proper BAD_ARGUMENTS error instead…
fixBackported in: Fixed CREATE OR REPLACE MATERIALIZED VIEW ... POPULATE leaving the new view unsubscribed from its source table, which silently dropped every row inserted after the replace. (Alexey Milovidov).
fixBackported in: Fixes a bug where an access entity carrying a Map-valued setting, such as a settings profile with http_response_headers or additional_table_filters, is stored in a form that ClickHouse cannot read back, leaving the entity permanently unloadable after a restart. (Groene AI).
fixBackported in: Fixed wrong results for SELECT count(arrayJoin(arr)) with the default optimize_trivial_count_query = 1. The stored row count was returned instead of the number of array elements, and on file() and url() the query returned 0. Closes. (Groene AI).
fixBackported in: Fixed uniq, uniqExact, uniqHLL12 and uniqTheta returning a wrong result for an argument wrapped in an injective function that hides nullability, such as uniqExact(tuple(x)) over a Nullable column. The optimize_injective_functions_inside_uniq optimization removed the wrapping…
26.3.20.7 Aug 20, 2026 Release notes ↗
otherBackported in: The hive partitioning sample path for object storage tables (e.g. S3) is resolved on the first use of the table instead of CREATE/ATTACH, so an unreachable endpoint no longer blocks table creation and server startup. (Nikolay Degterinsky).
fixBackported in: Fixed singleValueOrNullMerge returning a concrete value instead of NULL when merging a state that had already observed multiple distinct values. (Minh Vu).
fixBackported in: Fixes cases where row policy was not used for MergeTree Projections during query execution. (Yarik Briukhovetskyi).
fixBackported in: Fix DROP TABLE and SYSTEM STOP VIEW hanging when a Refreshable Materialized View is blocked while planning its refresh query. (Nikolay Degterinsky).
fixBackported in: Disable distributed index analysis with projections (wrong results). (Azat Khuzhin).
otherBackported in: Update libssh to 0.12.0. (Konstantin Bogdanov).
26.3.19.3 Aug 18, 2026 Release notes ↗
fixBackported in: RESTORE now fsyncs the restored part files when the destination table has fsync_after_insert enabled, so a restored part is as durable against power loss as an inserted one. Previously restored files were only written and closed (never fsynced), so a power loss right after RESTORE…
otherUse curl 8.21.0. (Konstantin Bogdanov).
26.3.18.32 Aug 17, 2026 Release notes ↗
otherBackported in: Skip unnecessary mark file loads for JSON advanced shared data. (Pavel Kruglov).
fixBackported in: Fix LOGICAL_ERROR exceptions when reading Iceberg or DeltaLake data lake tables through paths that can reach the read pipeline without a pinned datalake_table_state, such as concurrent Iceberg metadata updates or merge reads over DeltaLake tables. (Groene AI).
fixBackported in: Fix dynamic cache resize race in 26.1+. (Kseniia Sumarokova).
fixBackported in: Fix a rare LOGICAL_ERROR "Attempt to release query context that does not exist" and the accompanying server crash when reading MergeTree tables through a filesystem cache disk created with enable_filesystem_query_cache_limit = 1. (Groene AI).
fixBackported in: Fixed reading Iceberg v3 tables whose Parquet data files contain reserved row-lineage columns (such as _row_id); the native Parquet reader no longer raises ICEBERG_SPECIFICATION_VIOLATION for reserved field ids that are not part of the table schema. (Greg Maher).
fixBackported in: Fix type_json_allow_duplicated_key_with_literal_and_nested_object not working with typed paths in JSON. (Pavel Kruglov).
fixBackported in: Fixes a null-pointer dereference segfault in StreamingStorageRegistry that occurs when StreamingStorageRegistry::shutdown and StorageObjectStorageQueue::shutdown are called concurrently. (Miсhael Stetsyuk).
fixBackported in: Fix possible logical error "Unexpected substream ... for column ..." during bump of compatibility setting. (Pavel Kruglov).
fixBackported in: Fix a segfault when a query arrives while the server is shutting down after an error during startup that happens in a narrow window between servers' startup and creating an exit scope for stopping and reaping of servers. (Miсhael Stetsyuk).
fixBackported in: Fix out-of-bounds read in SerializationReplicated on the native protocol on corrupted indexes data. (Pavel Kruglov).
fixBackported in: Fixed a crash when reading a Parquet file with inconsistent bloom filter metadata. Such files could also silently return fewer rows than they should. (Shaohua Wang).
fixBackported in: Fixed server startup and ATTACH failing with WITH RECURSIVE is not supported with the old analyzer for a view with a recursive CTE when enable_analyzer = 0 is the server default. (Nikolay Degterinsky).
fixBackported in: Fixed a case where CREATE TABLE ... ENGINE = Distributed(...) without a column list could reveal the structure of a local table the creating user is not allowed to see. For a CREATE the local server executes itself, the structure is now inferred under the user's own context, so SHOW…
fixBackported in: Fixed reading the internal _temporary_and_external_tables database through the merge table function and the Merge table engine, which allowed one session to read the temporary tables of other sessions and other users, and caused an exception on the old analyzer path. A database…
fixBackported in: Fix a rare use-after-free bug that is triggered in a rare event of the async insert queue having different entries with identical deadlines. Now it's handled gracefully. (Miсhael Stetsyuk).
fixBackported in: Fixed a case where CREATE TABLE ... ENGINE = Buffer(...) without a column list could reveal the structure of a destination table the creating user is not allowed to see. For a CREATE the local server executes itself, the structure is now inferred under the user's own context, so…
fixBackported in: Fixed ATTACH of a Kafka table when kafka_num_consumers exceeds the limit derived from the number of CPU cores. (Nikolay Degterinsky).
fixBackported in: Fixed a row policy containing a scalar subquery being evaluated only once and then reused forever after the table had been read through a Merge table. The parsed policy condition is cached and shared by all queries, and reading it through Merge rewrote the cached expression in…
fixBackported in: Fix CANNOT_CONVERT_TYPE and an exception in GroupingAggregatedTransform when reading a Merge table with one child being a Distributed table under custom-key parallel replicas (parallel_replicas_mode = 'custom_key_sampling' or 'custom_key_range'). Closes. (Alexey Milovidov).
fixBackported in: Fixed ORDER BY ... LIMIT returning fewer rows than requested, possibly none, when a row policy was the only filter of the query and the sort column had a minmax skip index. The top-K optimization narrowed the read before the row policy was applied. (Alexey Milovidov).
fixBackported in: Fixed heap memory corruption when reading Parquet through an input format that owns its read buffer, for example a dictionary with SOURCE(FILE(... format 'Parquet')). Background prefetch and decode tasks could still read and write through the buffer after the pipeline released it,…
otherBackported in: Update the vendored libexpat to 2.8.2. (Konstantin Bogdanov).
otherBackported in: Update simdjson to v4.6.5. (Konstantin Bogdanov).
otherBackported in: Update Apache Arrow to 25.0.0 and Apache ORC to 2.3.1. (Konstantin Bogdanov).
otherBackported in: Update Protocol Buffers to v35.1 and gRPC to v1.83.0. (Konstantin Bogdanov).
fixBackported in: Fix flaky test_insert_select_from_cluster_with_partition_pruning. (Groene AI).
otherBackported in: Unflaky test_kafka_engine_put_errors_to_stream. (János Benjamin Antal).
otherBackported in: Iterate ColumnObject subcolumns in sorted path order. (Pavel Kruglov).
otherBackported in: Keep the Map bucket_indexes stream in sync when rows are skipped. (Alexey Milovidov).
otherBackported in: Make the boolean case of 04308_arrow_oob_reads_value corrupt only the declared row count, so it reaches the per-element bit-packed buffer guard it is meant to cover. (Groene AI).
otherMap arrow OutOfMemory status to MEMORY_LIMIT_EXCEEDED when reading Parquet record batches (26.3). (Alexey Milovidov).
26.3.17.110 Aug 5, 2026 Release notes ↗
breakingBackported in: Add a setting dynamic_disk_allow_from_env, dynamic_disk_allow_from_zk, dynamic_disk_allow_include to disallow usage of from_env, from_zk, include in dynamic disks. Backward Incompatible Change because prohibits by default the behaviour which used to be allowed by default. (Kseniia…
fixBackported in: Fixed a performance regression (introduced in) where reading many small files from object storage via the s3() and other table functions stopped prefetching and fell back to synchronous reads, significantly slowing single-threaded / low-concurrency reads of lots of tiny files.…
fixBackported in: Fixed O(P×N) deduplication hash recomputation in async insert flushes that split across P partitions. DeduplicationInfo::prewarmDataHashes is now called once before the partition loop in MergeTreeSink and ReplicatedMergeTreeSink, so all per-partition clones inherit pre-computed…
fixBackported in: Fix DataLakeCatalog databases with catalog_type = 'onelake' reading table data by using the OneLake Blob endpoint (.blob.fabric.microsoft.com) by default. Set onelake_use_blob_endpoint = false to keep the previous DFS endpoint (.dfs.fabric.microsoft.com) behavior. (Konstantin…
fixBackported in: Fixed reading of the auth_response length in the MySQL handshake, where a length byte >= 128 was interpreted as a multi-gigabyte value because it was read as a signed char. (uwezkhan).
featureBackported in: Restore show_data_lake_catalogs_in_system_tables as the setting that controls only DataLakeCatalog visibility in system.tables, system.columns, and system.completions. Added show_remote_databases_in_system_tables, enabled by default, to let users hide MySQL and PostgreSQL databases…
featureBackported in: I always find it difficult to add multiple metrics to the dashboard during debugging sessions. This patch adds a simpler way to add them directly from the source code or documentation. (Mikhail Artemenko).
fixBackported in: Validate column structure before applying patches. (Seva Potapov).
fixBackported in: Fix dangling reference in injectRequiredColumns causing crash during merge. (Tuan Pham Anh).
fixBackported in: Fix logical error exception when reading Iceberg tables whose format version was upgraded by an external tool (e.g. Spark). (Alexey Milovidov).
fixBackported in: Fix credential leak in query_log for paimonCluster, paimonS3Cluster, paimonAzureCluster, and deltaLakeS3 table functions. ### Documentation entry for user-facing changes. (JIaQi Tang).
fixBackported in: Fixes bug in arrayLevenshteinDistanceWeighted and arraySilimarity functions. Closes. (Mikhail f. Shiryaev).
fixBackported in: Fixes a LOGICAL ERROR (Unexpected size of index type) that could occur in RIGHT JOIN and FULL JOIN queries when the max_bytes_in_join setting was configured. (Jimmy Aguilar Mena).
fixBackported in: Fix exception "Cannot fold actions for projection" in join reorder optimization when a LEFT/RIGHT JOIN with join_use_nulls is combined with other joins involving more than two tables. (Alexey Milovidov).
fixBackported in: Fix LOGICAL_ERROR crash "Unexpected number of rows in column subchunk" in native Parquet V3 reader when reading nullable columns with a WHERE filter. (Groene AI).
fixBackported in: Fix a server abort during RESTORE of backups containing tables with cyclic dependencies. (Konstantin Bogdanov).
fixBackported in: Fixed a race between ALTER TABLE ... RENAME COLUMN and a concurrent OPTIMIZE TABLE ... FINAL (or any background merge) in MergeTree that could silently replace the renamed column's data with default values. The race window between publishing the new in-memory metadata and…
fixBackported in: Fixed a server crash that could occur when a query reading from PostgreSQL — via the postgresql table function, the PostgreSQL table engine, or a dictionary with a PostgreSQL source — was cancelled (for example with KILL QUERY) and cancelling the remote PostgreSQL query failed.…
fixBackported in: Continuation of https://github.com/ClickHouse/ClickHouse/pull/96754 but for delta lake. (Konstantin Vedernikov).
fixBackported in: Fix optimize_skip_unused_shards did not apply (and force_optimize_skip_unused_shards falsely failing) when a Distributed table is queried through a Merge table or the merge table function, with the predicate applied above it. (Nikolai Kochetov).
fixBackported in: When deserializing Avro enum data, we don't validate the values, and if those are corrupted, it leads to OOB and abort. (Miсhael Stetsyuk).
fixBackported in: Fix a LOGICAL_ERROR (Invalid number of rows in Chunk) in JoiningTransform for a LEFT JOIN with unique right keys, a mixed ON condition, and a small max_joined_block_size_rows. (Groene AI).
fixBackported in: Fix a server crash when moving an empty part to a plain_rewritable disk (for example with ALTER TABLE ... MOVE PARTITION ... TO DISK for an empty part kept by remove_empty_parts = 0). (Groene AI).
fixBackported in: Fixed wrong query results caused by the query condition cache when on-fly mutations (apply_mutations_on_fly) or patch parts filtered rows before PREWHERE. A query reading with apply_mutations_on_fly = 1 could poison the cache so that a later query with apply_mutations_on_fly = 0 and…
fixBackported in: Incremental backups no longer store S3 credentials in the locator of the .backup metadata file. Backups created with use_same_s3_credentials_for_base_backup = 1, or with explicit base backup credentials matching this backup locator, store a non-secret marker and are restored without…
fixBackported in: Fixed SELECT ... FINAL and OPTIMIZE TABLE ... FINAL returning duplicate rows after CREATE TABLE ... CLONE AS, ATTACH PARTITION ... FROM or MOVE PARTITION ... TO TABLE adopted parts from a plain MergeTree into a ReplacingMergeTree, SummingMergeTree or AggregatingMergeTree. The…
fixBackported in: Fix a Logical error: Stream ... variant_discr ... is not found that could occur when merging or reading a MergeTree part produced by a mutation of a table with a Dynamic column. (Alexey Milovidov).
fixBackported in: Fixed incorrect results from distributed queries selecting ALIAS columns that share a common subexpression: columns could be misaligned and values returned under the wrong column. (Vladimir Cherkasov).
fixBackported in: Fixed the MySQL interface being unusable with MySQL Connector/J 8.2.0 and newer (including 9.x). The info field of the OK packet is now length-encoded, matching the MySQL server, so the JDBC driver can connect. (Alexey Milovidov).
fixBackported in: Fix server crash (SIGSEGV) when reading Protobuf data with input_format_allow_errors_num > 0 and a valid message precedes a bad (skippable) message in the same block. (Andrey Tsarevskiy | Андрей Царевский ).
fixBackported in: Fix performance regression for Map subcolumns with PREWHERE. Closes. Caused by: https://github.com/ClickHouse/ClickHouse/pull/99200. (Pavel Kruglov).
fixBackported in: A transient error while refreshing data parts of a read-only table no longer permanently stops the background refresh task. (Alexey Milovidov).
fixBackported in: Hide sensitive info in system.query_views_log.view_query. (Valerii Mordovskii).
fixBackported in: Fix NOT_FOUND_COLUMN_IN_BLOCK error for queries that use the _part_starting_offset/_part_offset virtual columns in WHERE together with lazy materialization. (Vladimir Cherkasov).
fixBackported in: SYSTEM RESET DDL WORKER now requires the new SYSTEM RESET DDL WORKER privilege. Previously any authenticated user (including readonly ones) could run it and repeatedly reset the DDL worker state, blocking ON CLUSTER DDL. (Groene AI).
fixBackported in: Restrict the model path of catboostEvaluate to the user_files directory, like file() and the dictionary sources. Previously the function accepted an arbitrary filesystem path with no containment check, which allowed probing the existence of and triggering reads of files outside…
fixBackported in: Fixed ssl_certificate user identification so a single wildcard matches exactly one name component (RFC 6125 6.4.3). Previously a wildcard in a CN or DNS: SAN subject (for example .corp.example.com) also matched multi-label names such as evil.deep.corp.example.com, letting a holder…
fixBackported in: Fixed wrong results when using SELECT [...] SAMPLE [...] together with the query condition cache (setting use_query_condition_cache = 1 which is also the default). (Groene AI).
fixBackported in: Fixed a server crash (stack overflow) caused by deeply nested expressions such as [[[ ... ]]] or array(array( ... )) when max_parser_depth is set to a large value. (Raúl Marín).
securityBackported in: Fix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze).
+69 more items in the release notes
26.3.17.56 Jul 20, 2026 Release notes ↗
fixBackported in: Fixed a performance regression (introduced in) where reading many small files from object storage via the s3() and other table functions stopped prefetching and fell back to synchronous reads, significantly slowing single-threaded / low-concurrency reads of lots of tiny files.…
fixBackported in: Fix DataLakeCatalog databases with catalog_type = 'onelake' reading table data by using the OneLake Blob endpoint (.blob.fabric.microsoft.com) by default. Set onelake_use_blob_endpoint = false to keep the previous DFS endpoint (.dfs.fabric.microsoft.com) behavior. (Konstantin…
fixBackported in: Fixed reading of the auth_response length in the MySQL handshake, where a length byte >= 128 was interpreted as a multi-gigabyte value because it was read as a signed char. (uwezkhan).
featureBackported in: Restore show_data_lake_catalogs_in_system_tables as the setting that controls only DataLakeCatalog visibility in system.tables, system.columns, and system.completions. Added show_remote_databases_in_system_tables, enabled by default, to let users hide MySQL and PostgreSQL databases…
featureBackported in: I always find it difficult to add multiple metrics to the dashboard during debugging sessions. This patch adds a simpler way to add them directly from the source code or documentation. (Mikhail Artemenko).
fixBackported in: Validate column structure before applying patches. (Seva Potapov).
fixBackported in: Fix credential leak in query_log for paimonCluster, paimonS3Cluster, paimonAzureCluster, and deltaLakeS3 table functions. ### Documentation entry for user-facing changes. (JIaQi Tang).
fixBackported in: Fix LOGICAL_ERROR crash "Unexpected number of rows in column subchunk" in native Parquet V3 reader when reading nullable columns with a WHERE filter. (Groene AI).
fixBackported in: Fix a server abort during RESTORE of backups containing tables with cyclic dependencies. (Konstantin Bogdanov).
fixBackported in: Fixed a race between ALTER TABLE ... RENAME COLUMN and a concurrent OPTIMIZE TABLE ... FINAL (or any background merge) in MergeTree that could silently replace the renamed column's data with default values. The race window between publishing the new in-memory metadata and…
fixBackported in: Fixed a server crash that could occur when a query reading from PostgreSQL — via the postgresql table function, the PostgreSQL table engine, or a dictionary with a PostgreSQL source — was cancelled (for example with KILL QUERY) and cancelling the remote PostgreSQL query failed.…
fixBackported in: Fix optimize_skip_unused_shards did not apply (and force_optimize_skip_unused_shards falsely failing) when a Distributed table is queried through a Merge table or the merge table function, with the predicate applied above it. (Nikolai Kochetov).
fixBackported in: When deserializing Avro enum data, we don't validate the values, and if those are corrupted, it leads to OOB and abort. (Miсhael Stetsyuk).
fixBackported in: Fix a server crash when moving an empty part to a plain_rewritable disk (for example with ALTER TABLE ... MOVE PARTITION ... TO DISK for an empty part kept by remove_empty_parts = 0). (Groene AI).
fixBackported in: Fixed wrong query results caused by the query condition cache when on-fly mutations (apply_mutations_on_fly) or patch parts filtered rows before PREWHERE. A query reading with apply_mutations_on_fly = 1 could poison the cache so that a later query with apply_mutations_on_fly = 0 and…
fixBackported in: Incremental backups no longer store S3 credentials in the locator of the .backup metadata file. Backups created with use_same_s3_credentials_for_base_backup = 1, or with explicit base backup credentials matching this backup locator, store a non-secret marker and are restored without…
fixBackported in: Fixed SELECT ... FINAL and OPTIMIZE TABLE ... FINAL returning duplicate rows after CREATE TABLE ... CLONE AS, ATTACH PARTITION ... FROM or MOVE PARTITION ... TO TABLE adopted parts from a plain MergeTree into a ReplacingMergeTree, SummingMergeTree or AggregatingMergeTree. The…
fixBackported in: Fixed incorrect results from distributed queries selecting ALIAS columns that share a common subexpression: columns could be misaligned and values returned under the wrong column. (Vladimir Cherkasov).
fixBackported in: Fixed the MySQL interface being unusable with MySQL Connector/J 8.2.0 and newer (including 9.x). The info field of the OK packet is now length-encoded, matching the MySQL server, so the JDBC driver can connect. (Alexey Milovidov).
fixBackported in: Fix performance regression for Map subcolumns with PREWHERE. Closes. Caused by: https://github.com/ClickHouse/ClickHouse/pull/99200. (Pavel Kruglov).
fixBackported in: A transient error while refreshing data parts of a read-only table no longer permanently stops the background refresh task. (Alexey Milovidov).
fixBackported in: Hide sensitive info in system.query_views_log.view_query. (Valerii Mordovskii).
fixBackported in: SYSTEM RESET DDL WORKER now requires the new SYSTEM RESET DDL WORKER privilege. Previously any authenticated user (including readonly ones) could run it and repeatedly reset the DDL worker state, blocking ON CLUSTER DDL. (Groene AI).
fixBackported in: Restrict the model path of catboostEvaluate to the user_files directory, like file() and the dictionary sources. Previously the function accepted an arbitrary filesystem path with no containment check, which allowed probing the existence of and triggering reads of files outside…
fixBackported in: Fixed wrong results when using SELECT [...] SAMPLE [...] together with the query condition cache (setting use_query_condition_cache = 1 which is also the default). (Groene AI).
fixBackported in: Fixed a server crash (stack overflow) caused by deeply nested expressions such as [[[ ... ]]] or array(array( ... )) when max_parser_depth is set to a large value. (Raúl Marín).
fixBackported in: The MySQL wire protocol commands COM_FIELD_LIST (mysql_list_fields) and COM_INIT_DB (USE database) now enforce the same access control as their SQL equivalents (SHOW COLUMNS/DESCRIBE and USE). Previously they could disclose column names of tables the user only had partial column…
fixBackported in: Match http_forbid_headers case-insensitively. HTTP header names are case-insensitive, so forbidding Authorization now also blocks authorization, AUTHORIZATION and other case variants. Configured header_regexp patterns are now matched case-insensitively without needing an explicit…
fixBackported in: Fix a SELECT * projection returning a column's type default (e.g. 0) instead of its DEFAULT value (e.g. -1) when reading a column added with ALTER TABLE ... ADD COLUMN ... DEFAULT after the projection was created. Reads from the base table were already correct; only reads answered…
fixBackported in: Fixed direct read from multiple partially materialized text indexes. (Anton Popov).
fixBackported in: Fixed a startup failure where a DataLakeCatalog database created by an older version (25.12 or earlier) with a malformed auth_header could not be attached after upgrading to 26.2 or later, preventing the server from starting. The auth_header is now validated only on CREATE, and on…
fixBackported in: Fixed partition and primary key pruning being silently disabled when a LowCardinality(FixedString) (or LowCardinality(Nullable(FixedString))) key column is wrapped in a function in the key, for example PARTITION BY sipHash64(k) % N with WHERE k = 'literal'. Such queries scanned all…
fixBackported in: Fixed insert_quorum = 'auto' not rejecting inserts up front when fewer than a majority of replicas were alive. Such inserts now fail immediately with TOO_FEW_LIVE_REPLICAS instead of writing a local part and later timing out with UNKNOWN_STATUS_OF_INSERT. (Gagan Dhakrey).
fixBackported in: Fix a segmentation fault when merging uniqExact aggregate states with GROUPING SETS, ROLLUP or CUBE and max_threads > 1. (Raúl Marín).
fixBackported in: Fixed a server crash on asynchronous insert with deduplication when optimize_on_insert makes the inserted block empty (for example, rows summing to zero in SummingMergeTree). (Den Kalantaevskii).
fixBackported in: Fix a data race (and resulting rare crash) in the parallel merge of uniqExact aggregate states with two-level sets, which could occur with GROUPING SETS, ROLLUP and CUBE. (Groene AI).
fixBackported in: Fix redundant file segment contention introduced in 26.1+. (Kseniia Sumarokova).
fixBackported in: Fix system.tables silently skipping databases for users with per-database grants when the query reads only the name/database columns. Introduced in 26.2. (Samay Sharma).
fixBackported in: Make headers in getClientHTTPHeader case-insensitive according to RFC 9110. Fixes by adding authorization to the filtered-out headers. (Mikhail f. Shiryaev).
securityBackported in: Fix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze).
+12 more items in the release notes
26.3.16.16 Jun 28, 2026 Release notes ↗
fixBackported in: Credentials in JDBC, ODBC, and NATS connection strings are now masked in query logs and SHOW CREATE output, preventing accidental exposure of sensitive information. For URI-style connection strings (e.g. {scheme}://{user}:{password}@{host}), only the password portion is masked while…
fixBackported in: Fix wrong row count from arrayJoin() used inside JOIN ON: the result was multiplied by the array length an extra time. (Shaohua Wang).
fixBackported in: Fixed an exception when a vector search query uses a vector index and uses another skip index like minmax and use_skip_indexes_on_data_read = 1. (Shankar Iyer).
fixBackported in: Fix "Too many marks" for text index on an empty merged part. (Azat Khuzhin).
fixBackported in: Fixed a Block structure mismatch in UnionStep stream logical error (server abort on debug/sanitizer builds, Code: 49 on release builds) that occurred when one branch of a UNION/INTERSECT/EXCEPT read a Sparse-serialized column while the sibling branch read the same column as a full…
fixBackported in: Fixed a heap buffer overflow (server crash) in windowFunnel when finalizing a crafted aggregate-function state with an out-of-range event type, reachable by any user with a single SELECT. (uwezkhan).
fixBackported in: The fresh snapshot rebuilt inside update() already captures the C++ S3 client's current creds via createBuilder keep it instead of discarding it when the version matches, so the next kernel op runs on a freshly-credentialed engine and doesn't outlive the STS TTL. (Elmi Ahmadov).
fixBackported in: Fixed RESTORE for ReplicatedMergeTree tables so duplicate-content parts from a backup are preserved instead of being silently deduplicated. (Pablo Marcos).
fixBackported in: Fix set skip index not pruning granules over LowCardinality columns. (Konstantin Bogdanov).
fixBackported in: Fix a crash (SIGSEGV in release builds, type-mismatch assertion in debug builds) in has over a Map with a Dynamic key when the lookup argument is LowCardinality, e.g. has(map('a'::Dynamic, ...), toLowCardinality('b')). (Groene AI).
fixBackported in: Always run access cache batch-finished handlers, even on empty batch. (Azat Khuzhin).
fixBackported in: Fixed refreshable materialized view getting stuck if zookeeper connection is lost at the wrong moment. (Michael Kolupaev).
fixBackported in: Hide secret arguments of functions such as encrypt, decrypt, and HMAC in EXPLAIN actions, EXPLAIN header, and EXPLAIN PIPELINE output when format_display_secrets_in_show_and_select is disabled (the default). (Raúl Marín).
fixBackported in: Fix a metadata-disclosure where DESCRIBE loop('db', 'table') and DESCRIBE loop() bypassed the SHOW COLUMNS / source access check, letting an unprivileged user read a table's column schema. (Groene AI).
securityBump cc-debian13 digests, clears libssl3t64 CVE-2026-45447. (Rahul Nair).
26.3.15.4 Jun 23, 2026 Release notes ↗
fixBackported in: Fixed possible server stack overflow (crash) when reading a deeply nested schema or value in the MsgPack, BSON, ORC, Parquet, JSON, DeltaLake, Iceberg and Paimon formats. Such deeply nested input is now rejected with an exception. (Raúl Marín).
fixBackported in: Added missing bounds checks in Elf and DWARF parsing. (Michael Kolupaev).
fixBackported in: Reading Arrow/ArrowStream data with empty String/Binary columns produced by Apache Arrow Java < 19.0.0 (including Apache Spark) no longer throws INCORRECT_DATA. (Raúl Marín).
26.3.14.49 Jun 22, 2026 Release notes ↗
26.3.13.31 Jun 8, 2026 Release notes ↗
breakingBackported in: The setting show_data_lake_catalogs_in_system_tables has been renamed to show_remote_databases_in_system_tables and broadened: when its value is 0 (the default), MySQL and PostgreSQL databases are also hidden from system.tables, system.columns, and system.completions, in addition to…
featureBackported in: Added SYSTEM PAUSE VIEW [db.]name and SYSTEM PAUSE VIEWS queries for refreshable materialized views. Unlike SYSTEM STOP VIEW, SYSTEM PAUSE VIEW does not interrupt the currently running refresh — the in-flight refresh is allowed to complete and only subsequent refreshes are…
otherBackported in: Replicated refreshable materialized view in APPEND mode will no longer refresh twice if connection to zookeeper was briefly lost during refresh. (Michael Kolupaev).
fixBackported in: Fix NOT_FOUND_COLUMN_IN_BLOCK error when selecting from a VIEW over a table with a normal projection. (Amos Bird).
fixBackported in: Fix undefined behavior in MergeTreeDataPartWriterCompact::cancel when a stream allocation fails. (Alexey Milovidov).
fixBackported in: Fixes a case where timezone was not included during the assignment in the ALTER statement. Closes. Related https://github.com/ClickHouse/ClickHouse/pull/100647. (Yarik Briukhovetskyi).
fixBackported in: Fix materialize_skip_indexes_on_merge=false not suppressing text (full-text) indexes during merge. Previously, only non-text skip indexes (minmax, set, bloom_filter) were suppressed; text indexes continued to be built, wasting CPU and I/O. (Groene AI).
fixBackported in: Throw INCORRECT_DATA instead of LOGICAL_ERROR when client-supplied data in the Native format is truncated or malformed. (János Benjamin Antal).
fixBackported in: Fix cast_string_to_date_time_mode being ignored for CAST to Nullable(DateTime). Closes. (Pavel Kruglov).
fixBackported in: Fix data corruption when writing Parquet (and other trailer-bearing formats such as ORC and Arrow) to HDFS via INSERT INTO FUNCTION hdfs(...). Since 26.1, WriteBufferFromHDFS did not flush its working buffer on finalize(), so the last up to DBMS_DEFAULT_BUFFER_SIZE bytes of every…
fixBackported in: Long-running INSERT ... SELECT and other reads from a DataLakeCatalog database with catalog_type = 'glue' fail with Code: 117. DB::Exception: IOError: Code: 499. DB::Exception: Unable to parse ExceptionName: ExpiredToken Message: The provided token has expired. (S3_ERROR) ... While…
fixBackported in: Fix BAD_ARGUMENTS exception "It's a bug! Only integer types are supported by __bitWrapperFunc" thrown when a SELECT with a TYPE set(N) skip index has a WHERE atom whose result type is Float, BFloat16, or any other non-integer type (for example WHERE c0 + 0.1 or WHERE log(c0)). The…
fixBackported in: Fix dictGetOrDefault throwing CANNOT_INSERT_NULL_IN_ORDINARY_COLUMN when the default argument is a Nullable expression and short_circuit_function_evaluation is enabled with a mix of found and not-found dictionary keys. (Raúl Marín).
fixBackported in: Fix a server segfault in uniqStateOrNull / uniqStateOrDefault / uniqOrNullState (and similar combinator chains over uniq) when used with GROUP BY ... WITH ROLLUP, WITH CUBE, or WITH TOTALS and a Nullable argument. (Groene AI).
fixBackported in: Fix SEGFAULT in singleValueOrNull deserialization for JSON type. Closes. (Pavel Kruglov).
fixBackported in: Fix crash in replxx due to hitting FD_SETSIZE limitation of select() (replace with poll()). Note with enabled SSH/web terminal it may crash the server. (Azat Khuzhin).
fixBackported in: Hive partition value extraction now honors the cast_string_to_date_time_mode setting and accepts ISO 8601 timestamps with timezone suffixes (e.g. +0000, +00:00, Z) in partition keys by default. (Alexey Milovidov).
fixBackported in: Fixed a silent under-count in SELECT queries when use_query_condition_cache = 1 (default). A query of the shape PREWHERE pk_prefix = X WHERE non_pk IN (...) against a column with a bloom-filter skip index poisoned the QueryConditionCache for the pk_prefix = X predicate, so a…
fixBackported in: Fix a crash in the mongodb table function, MongoDB storage and MongoDB dictionary source when the collection name is empty or contains NUL bytes. (Raúl Marín).
fixBackported in: Fix Cannot find column error for distributed queries with IN Array(...) filter for the new analyzer. (Nikolai Kochetov).
fixBackported in: Fixed a possible crash due to a too-large string literal sent within the query. (Nikita Taranov).
fixBackported in: Fix system.dictionaries returning 0 rows with partial SHOW DICTIONARIES revoke. (Pavel Kruglov).
fixBackported in: Fixed a server crash when querying DeltaLake tables with allow_experimental_delta_kernel_rs enabled and a credential or option that contained invalid bytes (the Rust FFI panicked across the extern "C" boundary). (Raúl Marín).
otherNO CL ENTRY: 'Revert "Backport to 26.3: Honor cast_string_to_date_time_mode for hive partition values"'. (Nikita Taranov).
otherBackported in: Update mongo-c-driver to 2.3.0. (Raúl Marín).
fixBackported in: Fix azure init params. (Konstantin Vedernikov).
fixBackported in: Fix test_mysql_dotnet_client by anchoring to /testapp. (Raúl Marín).
otherBackported in: This PR modifies the settings history so that compatibility='X.Y' will never revert apply_row_policy_after_final to false. Previously, compatibility levels before 26.2 would revert the setting to false (the buggy pre-fix behavior). After this change, the setting remains true…
fixFix 04229_defer_partition_pruning_after_final test on 26.3. (Nikita Fomichev).
26.3.12.3 May 22, 2026 Release notes ↗
fixBackported in: Fixed a heap-buffer-overflow when reading Arrow or ArrowStream files with corrupted intermediate offsets in a binary or string column, and a null-pointer dereference when reading geo-tagged Arrow columns. (Raúl Marín).
otherBackported in: Use an explicit flag in Context for secondary DDL/ON CLUSTER queries instead of SECONDARY_QUERY. (Alexander Tokmakov).
26.3.11.36 May 22, 2026 Release notes ↗
otherBackported in: Skip deferring the row policy after FINAL when it depends only on sorting-key columns and is deterministic, and skip the corresponding PREWHERE deferral that the row policy was forcing in that case. (Yarik Briukhovetskyi).
otherBackported in: Improve the resilience of backups when Refreshable Materialized Views are constantly refreshed by making decisions based on the snapshotted tables' state rather than a global one. (Nikita Mikhaylov).
fixBackported in: Fix \lowerUTF8\ / \upperUTF8\ exception when processing large non-ASCII data sets (e.g. during text-index builds) where the accumulated output buffer would exceed 2 GiB; reject excessively long single rows with a clear error. (Shaohua Wang).
featureBackported in: New setting defer_partition_pruning_after_final (default 1) makes the 26.3-introduced behavior of skipping partition pruning under FINAL opt-out. Set it to 0 to restore pre-26.3 partition pruning — substantially faster on event-log workloads where same-PK rows cannot span…
fixBackported in: DataLakeCatalog now respects the server's http_forbid_headers configuration when validating the auth_header setting. (Michael Anastasakis).
fixBackported in: Fix "Not-ready Set" exception when a filter with IN (subquery) is moved to PREWHERE by the query optimizer. (Alexey Milovidov).
fixBackported in: Fix an exception that could occur when inserting a row into a JSON column where the row introduced a new dynamic field alongside a typed field with an incompatible value, and the column was subsequently used as a GROUP BY key. (Jimmy Aguilar Mena).
fixBackported in: Fix incorrect query results caused by join reordering pushing an INNER JOIN filter (referencing only the preserved side of an outer join) into the outer join’s ON clause. (Vladimir Cherkasov).
fixBackported in: Fix incorrect results for RIGHT ANY JOIN when the right table has multiple rows per key and the output block is split due to size limits. Close. (Vladimir Cherkasov).
fixBackported in: Fix possible crash when an ALTER query executed on tables from in-memory database (e.g. temporary tables). (Den Kalantaevskii).
fixBackported in: Check for stack overflow in Avro reader during nested types deserialization. (Pavel Kruglov).
fixBackported in: Fix backward compatibility break where old clients fail with UNEXPECTED_PACKET_FROM_SERVER when inserting into a newer server via remote() or distributed tables, caused by unconditional sendProgress at the end of processInsertQuery. (Sema Checherinda).
fixBackported in: Fix a data race for ClickHouse, MySQL, PostgreSQL and XDBC dictionary sources where clone() const reads from and isModified() const writes to the same invalidate_query_response string. (Miсhael Stetsyuk).
fixBackported in: Fix heap-use-after-free in multiplying an AggregateFunction state by an integer (e.g. quantilesExactState(...) * N). The exponentiation-by-squaring loop merged the state with itself, which is undefined when the aggregate function's merge reallocates its internal storage. Closes STID…
fixBackported in: Fixed an issue where text and bloom filter skip indices on ALIAS columns whose expression contained a lambda with captured constants (e.g. arrayMap((k, v) -> concat(k, '=', v), mapKeys(m), mapValues(m))) were silently ignored. (Anton Popov).
fixBackported in: Fix data part check and consistency check for talbes with JSON column. Previously it could lead to false positive errors about missing files. (Pavel Kruglov).
fixBackported in: Fix a use-after-free in StorageKafka2 that could crash the server when a Keeper session is replaced while the consumer is holding ephemeral topic-partition locks. (Groene AI).
fixBackported in: Fixed SQL injection vulnerability in PostgreSQL, Cassandra and XDBC dictionary sources: string keys containing single quotes were escaped with \' (backslash), which these backends treat as a literal backslash rather than an escape sequence, allowing arbitrary SQL to be injected into…
fixBackported in: Fix several edge case correctness issues in setting optimize_inverse_dictionary_lookup where the optimization could silently drop rows or suppress exceptions. Closes. Close. (Nihal Z. Miaji).
fixBackported in: Fix exceptions (NOT_FOUND_COLUMN_IN_BLOCK, LOGICAL_ERROR, AMBIGUOUS_COLUMN_NAME) when using projections with UNION ALL views, window functions, or alias-column name collisions. Regression from. (Amos Bird).
fixBackported in: Fixes a possible underflow in parsing postgres arrays. (Grant Holly).
fixBackported in: Fixed RESTORE of replicated MergeTree tables so restored part attachment uses backup_restore_keeper_max_retries instead of the regular insert Keeper retry budget. (Pablo Marcos).
fixBackported in: Fix Keeper termination and restart loop when get /keeper/availability_zone is sent with quorum_reads=true to a Keeper without configured. (myeongjun).
fixBackported in: Fix a TOCTOU data race in FutureSetFromTuple::buildOrderedSetInplace that results in a logical error. (Miсhael Stetsyuk).
fixBackported in: Fix segfault due to a use-after-free bug in AvroConfluentRowInputFormat. (Miсhael Stetsyuk).
fixBackported in: Fix data part consistency checks for types with dynamic structure and detect corrupted columns_substreams.txt. Resubmit of https://github.com/ClickHouse/ClickHouse/pull/103858 with additional changes. (Pavel Kruglov).
fixBackported in: Fix CANNOT_COMPILE_CODE Could not find symbol __fixunsdfti when JIT-compiling expressions that convert a Float to UInt128, such as toUInt128(). The unsigned 128-bit float-to-int compiler-rt builtins were missing from the JIT symbol resolver. Closes. (Raúl Marín).
featureBackported in: Implement a stress test for functions, checking the soundness of their various properties. (Michael Kolupaev).
otherBackported in:. (Pavel Kruglov).
featureBackported in: Add missing Keeper component tracking guard to no-arg loadStatistics. (murphy-4o).
fixBackported in: Fix flaky test 03706_statistics_preserve_checksums_on_mutations. (Groene AI).
otherBackported in: Refreshable MV: relax sanity checks in SECONDARY_CREATE. (Michael Kolupaev).
otherRevert "Update autogenerated version to 26.3.10.60 and contributors". (Max Kainov).
otherBackported in: Skip test_numbers_check on release branches. (Nikita Fomichev).
26.3.10.62 May 7, 2026 Release notes ↗
breakingBackported in: Reduced default http_max_fields from 1,000,000 to 1,000 and http_max_field_name_size from 128 KB to 4 KB to limit pre-authentication memory usage by HTTP connections. Added http_max_request_header_size and http_headers_read_timeout settings. Users who rely on the previous higher…
featureBackported in: Add s3_read_request_duration_microseconds and s3_read_request_bytes histogram metrics to observe S3 GET request connection lifetime and bytes consumed, visible in system.histogram_metrics and the Prometheus endpoint. (Sema Checherinda).
fixBackported in: Fixed excessive RabbitMQ table engine CPU usage. (Jaap Elst).
fixBackported in: Fix a memory leak when running queries with MATERIALIZED CTEs. (Alexey Milovidov).
fixBackported in: Revert "Move join step row estimation before check for 1 child" due to suspected performance regression. (Alexander Gololobov).
fixBackported in: Fix use-of-uninitialized-value in StringSearcher.h. (Konstantin Bogdanov).
fixBackported in: Fix workload IO scheduling being silently bypassed for S3/object-storage writes that go through the DiskObjectStorageTransaction path (used by s3_with_keeper disks and explicitly when use_fake_transaction=false). Previously, INSERT writes into MergeTree tables on such disks ignored…
fixBackported in: Fix crash (Logical error: isConst/isSparse/isReplicated assertTypeEquality) in merge algorithms when lazy column replication (enable_lazy_columns_replication) produces ColumnReplicated columns that flow into merge-sort pipelines with late-arriving inputs. (Groene AI).
fixBackported in: Fix a use-after-free in the filesystem cache write path that could cause reads from freed memory when logging completed file segments (detected by MemorySanitizer in BuzzHouse). (Groene AI).
fixBackported in: Fix BACKUP FROM SNAPSHOT AST formatting and cloning. (Pablo Marcos).
fixBackported in: Fix use-after-free crash in CPU lease scheduler when the wait timer outlives the worker thread whose ProfileEvents::Counters it references. (Antonio Andelic).
fixBackported in: Fix using wrong extreams in min-max index created on JSON column leading to wrong query result. Closes. (Pavel Kruglov).
fixBackported in: Fix silent data loss when reading tar archives from S3 with schema_inference_mode=union and heterogeneous Parquet schemas — the Parquet metadata cache incorrectly reused the first file's metadata for all subsequent files in the archive. (Ahaan Limaye).
fixBackported in: Fix segfault (or LOGICAL_ERROR in debug builds) when reading Parquet files with bloom filter push down enabled and WHERE clause equality/inequality conditions. The crash occurred due to an out-of-bounds memory access in the Parquet prefetcher's bloom filter data retrieval, and could…
fixBackported in: Fix NamedCollection CurrentMetric being inflated by CREATE NAMED COLLECTION IF NOT EXISTS on existing collections, and not being initialized for collections loaded from config or SQL storage at startup. Closes. (Pablo Marcos).
fixBackported in: Fix LOGICAL_ERROR exception when multiple concurrent CREATE TABLE IF NOT EXISTS queries target the same S3Queue table on a Shared database. (Nikita Taranov).
fixBackported in: Bug with row policy that gives 'Not found column in block' exception in some special cases. (Yarik Briukhovetskyi).
fixBackported in: Fixed a server exception in ClusterDiscovery when a static cluster (defined in config) temporarily had no live nodes. (Kseniia Sumarokova).
fixBackported in: Fix wrong date data type inference in case of overflow after timezone adjustment. Closes. (Pavel Kruglov).
fixBackported in: Fix SYSTEM WAIT VIEW hanging forever when the refreshable materialized view is dropped while the wait is in progress. (Nikolay Degterinsky).
fixBackported in: Fix columns_substreams.txt corruption during column rename in some cases. Closes. (Pavel Kruglov).
fixBackported in: Fix flattened Dynamic type serialization with binary encoded data types. Closes. (Pavel Kruglov).
fixBackported in: Apply Poisson sampling correction to collapsed jemalloc heap profiles to match jeprof output. Previously the collapsed format underestimated actual allocation sizes by not accounting for the sampling probability. (Antonio Andelic).
fixBackported in: Fix S3 requests failing with ios_base::clear: unspecified iostream_category error instead of being retried, caused by Poco BufferedStreamBuf::flushBuffer not handling short writes from the socket layer. (Sema Checherinda).
fixBackported in: Fix minmax_count_projection and trivial COUNT(*) optimizations being permanently disabled after a lightweight delete, even after all parts with a mask of lightweight delete were merged away. (Anton Popov).
fixBackported in: Fix random crashes in jemalloc due to LTO. (Azat Khuzhin).
fixBackported in: Optimize row policy OR-chains to IN in the new analyzer. (Azat Khuzhin).
fixBackported in: Fix jemalloc metadata corruption caused by page cache freeing with wrong alignment that may lead to crashes. (Azat Khuzhin).
fixBackported in: Disable trivial LIMIT optimization with row policies/additional_table_filters (to allow parallel index analysis). (Azat Khuzhin).
fixBackported in: Plain INSERTs without materialized views no longer request excessive ConcurrencyControl slots and threads (max_threads instead of max_insert_threads), preventing CC slot starvation and thread count blowup on clusters with high INSERT throughput. (Sema Checherinda).
fixBackported in: Hide secret key in HMAC SQL function. Fix. (Mikhail f. Shiryaev).
fixBackported in: Reintroduce ArrowMemoryPool to allow throwing MEMORY_LIMIT_EXCEEDED to avoid kernel OOM. (Azat Khuzhin).
fixBackported in: Fix MULTIPLE_EXPRESSIONS_FOR_ALIAS exception raised on distributed queries that reference the same quantile call multiple times (e.g. in SELECT, HAVING, and ORDER BY) with optimize_syntax_fuse_functions enabled. (tanner-bruce).
fixBackported in: Fix SELECT DISTINCT silently returning incomplete results when an aggregate projection matched the query and some parts of the table had no projection data (e.g. the projection was added on a table that already held data, and MATERIALIZE PROJECTION was not run). Closes. (Nihal Z.…
fixBackported in: Fix possible crash during statistics calculation in Map type with lazy replication. Closes. (Pavel Kruglov).
fixBackported in: Cap pre-auth TCP Hello packet strings to 64 KB and add handshake_timeout_milliseconds server setting to limit total handshake time, preventing unauthenticated clients from consuming excessive memory or holding threads indefinitely. (Sema Checherinda).
fixBackported in: Fix Parquet ColumnIndex stats min_value > max_value for String columns. (Saurabh Kumar Ojha).
fixBackported in: Check for malformed flattened Dynamic data in Native format. (Pavel Kruglov).
featureAdd distroless Docker image variant for server and keeper. (Rahul Nair).
featureAdd docker-init subcommand for distroless Docker image support. (Rahul Nair).
+21 more items in the release notes
26.3.10.60 May 8, 2026 Release notes ↗
breakingBackported in: Reduced default http_max_fields from 1,000,000 to 1,000 and http_max_field_name_size from 128 KB to 4 KB to limit pre-authentication memory usage by HTTP connections. Added http_max_request_header_size and http_headers_read_timeout settings. Users who rely on the previous higher…
featureBackported in: Add s3_read_request_duration_microseconds and s3_read_request_bytes histogram metrics to observe S3 GET request connection lifetime and bytes consumed, visible in system.histogram_metrics and the Prometheus endpoint. (Sema Checherinda).
fixBackported in: Fixed excessive RabbitMQ table engine CPU usage. (Jaap Elst).
fixBackported in: Fix a memory leak when running queries with MATERIALIZED CTEs. (Alexey Milovidov).
fixBackported in: Revert "Move join step row estimation before check for 1 child" due to suspected performance regression. (Alexander Gololobov).
fixBackported in: Fix use-of-uninitialized-value in StringSearcher.h. (Konstantin Bogdanov).
fixBackported in: Fix workload IO scheduling being silently bypassed for S3/object-storage writes that go through the DiskObjectStorageTransaction path (used by s3_with_keeper disks and explicitly when use_fake_transaction=false). Previously, INSERT writes into MergeTree tables on such disks ignored…
fixBackported in: Fix crash (Logical error: isConst/isSparse/isReplicated assertTypeEquality) in merge algorithms when lazy column replication (enable_lazy_columns_replication) produces ColumnReplicated columns that flow into merge-sort pipelines with late-arriving inputs. (Groene AI).
fixBackported in: Fix a use-after-free in the filesystem cache write path that could cause reads from freed memory when logging completed file segments (detected by MemorySanitizer in BuzzHouse). (Groene AI).
fixBackported in: Fix BACKUP FROM SNAPSHOT AST formatting and cloning. (Pablo Marcos).
fixBackported in: Fix use-after-free crash in CPU lease scheduler when the wait timer outlives the worker thread whose ProfileEvents::Counters it references. (Antonio Andelic).
fixBackported in: Fix using wrong extreams in min-max index created on JSON column leading to wrong query result. Closes. (Pavel Kruglov).
fixBackported in: Fix silent data loss when reading tar archives from S3 with schema_inference_mode=union and heterogeneous Parquet schemas — the Parquet metadata cache incorrectly reused the first file's metadata for all subsequent files in the archive. (Ahaan Limaye).
fixBackported in: Fix segfault (or LOGICAL_ERROR in debug builds) when reading Parquet files with bloom filter push down enabled and WHERE clause equality/inequality conditions. The crash occurred due to an out-of-bounds memory access in the Parquet prefetcher's bloom filter data retrieval, and could…
fixBackported in: Fix NamedCollection CurrentMetric being inflated by CREATE NAMED COLLECTION IF NOT EXISTS on existing collections, and not being initialized for collections loaded from config or SQL storage at startup. Closes. (Pablo Marcos).
fixBackported in: Fix LOGICAL_ERROR exception when multiple concurrent CREATE TABLE IF NOT EXISTS queries target the same S3Queue table on a Shared database. (Nikita Taranov).
fixBackported in: Bug with row policy that gives 'Not found column in block' exception in some special cases. (Yarik Briukhovetskyi).
fixBackported in: Fixed a server exception in ClusterDiscovery when a static cluster (defined in config) temporarily had no live nodes. (Kseniia Sumarokova).
fixBackported in: Fix wrong date data type inference in case of overflow after timezone adjustment. Closes. (Pavel Kruglov).
fixBackported in: Fix SYSTEM WAIT VIEW hanging forever when the refreshable materialized view is dropped while the wait is in progress. (Nikolay Degterinsky).
fixBackported in: Fix flattened Dynamic type serialization with binary encoded data types. Closes. (Pavel Kruglov).
fixBackported in: Apply Poisson sampling correction to collapsed jemalloc heap profiles to match jeprof output. Previously the collapsed format underestimated actual allocation sizes by not accounting for the sampling probability. (Antonio Andelic).
fixBackported in: Fix S3 requests failing with ios_base::clear: unspecified iostream_category error instead of being retried, caused by Poco BufferedStreamBuf::flushBuffer not handling short writes from the socket layer. (Sema Checherinda).
fixBackported in: Fix minmax_count_projection and trivial COUNT(*) optimizations being permanently disabled after a lightweight delete, even after all parts with a mask of lightweight delete were merged away. (Anton Popov).
fixBackported in: Fix random crashes in jemalloc due to LTO. (Azat Khuzhin).
fixBackported in: Optimize row policy OR-chains to IN in the new analyzer. (Azat Khuzhin).
fixBackported in: Fix jemalloc metadata corruption caused by page cache freeing with wrong alignment that may lead to crashes. (Azat Khuzhin).
fixBackported in: Disable trivial LIMIT optimization with row policies/additional_table_filters (to allow parallel index analysis). (Azat Khuzhin).
fixBackported in: Plain INSERTs without materialized views no longer request excessive ConcurrencyControl slots and threads (max_threads instead of max_insert_threads), preventing CC slot starvation and thread count blowup on clusters with high INSERT throughput. (Sema Checherinda).
fixBackported in: Hide secret key in HMAC SQL function. Fix. (Mikhail f. Shiryaev).
fixBackported in: Reintroduce ArrowMemoryPool to allow throwing MEMORY_LIMIT_EXCEEDED to avoid kernel OOM. (Azat Khuzhin).
fixBackported in: Fix MULTIPLE_EXPRESSIONS_FOR_ALIAS exception raised on distributed queries that reference the same quantile call multiple times (e.g. in SELECT, HAVING, and ORDER BY) with optimize_syntax_fuse_functions enabled. (tanner-bruce).
fixBackported in: Fix SELECT DISTINCT silently returning incomplete results when an aggregate projection matched the query and some parts of the table had no projection data (e.g. the projection was added on a table that already held data, and MATERIALIZE PROJECTION was not run). Closes. (Nihal Z.…
fixBackported in: Fix possible crash during statistics calculation in Map type with lazy replication. Closes. (Pavel Kruglov).
fixBackported in: Cap pre-auth TCP Hello packet strings to 64 KB and add handshake_timeout_milliseconds server setting to limit total handshake time, preventing unauthenticated clients from consuming excessive memory or holding threads indefinitely. (Sema Checherinda).
fixBackported in: Fix Parquet ColumnIndex stats min_value > max_value for String columns. (Saurabh Kumar Ojha).
fixBackported in: Check for malformed flattened Dynamic data in Native format. (Pavel Kruglov).
fixBackported in: Fix potential out-of-bounds read in the ALP codec decompression path when processing malformed input with an invalid bit-width. (Raufs Dunamalijevs).
featureAdd distroless Docker image variant for server and keeper. (Rahul Nair).
featureAdd docker-init subcommand for distroless Docker image support. (Rahul Nair).
+19 more items in the release notes
26.3.9.8 Apr 14, 2026 Release notes ↗
26.3.8.4 Apr 12, 2026 Release notes ↗
26.3.7.8 Apr 11, 2026 Release notes ↗
26.3.6.5 Apr 10, 2026 Release notes ↗
26.3.5.12 Apr 9, 2026 Release notes ↗
26.3.4.11 Apr 7, 2026 Release notes ↗
26.3.3.20 Apr 1, 2026 Release notes ↗
26.3.2.3 Mar 27, 2026 Release notes ↗
26.3.1.896 Mar 27, 2026 Release notes ↗
26.2.19.43 May 22, 2026 Release notes ↗
otherBackported in: Avoid index uncompressed cache overhead when the cache is disabled (server setting index_uncompressed_cache_size = 0, which is the default). (Michael Kolupaev).
otherBackported in: Reduced lock contention on the asynchronous remote-FS read path by making the per-query AsyncReadCounters lockless. (Nikita Mikhaylov).
otherBackported in: When apply_row_policy_after_final or apply_prewhere_after_final is enabled, compound AND conditions in row policies and PREWHERE are now decomposed to extract sorting-key atoms for primary key index analysis. Previously, if a deferred filter contained a mix of sorting-key and…
otherBackported in: Skip deferring the row policy after FINAL when it depends only on sorting-key columns and is deterministic, and skip the corresponding PREWHERE deferral that the row policy was forcing in that case. (Yarik Briukhovetskyi).
otherBackported in: Replicated refreshable materialized view in APPEND mode will no longer refresh twice if connection to zookeeper was briefly lost during refresh. (Michael Kolupaev).
fixBackported in: Fix \lowerUTF8\ / \upperUTF8\ exception when processing large non-ASCII data sets (e.g. during text-index builds) where the accumulated output buffer would exceed 2 GiB; reject excessively long single rows with a clear error. (Shaohua Wang).
fixBackported in: Fix JIT miscompilation of sign function for integer types wider than Int8 — values outside the -128..127 range could produce incorrect sign. (Alexey Milovidov).
fixBackported in: If the partition key columns are not covered by the sorting key, then partition pruning could incorrectly skip partitions containing rows that should "win" during FINAL deduplication. (Yarik Briukhovetskyi).
fixBackported in: Fix LOGICAL_ERROR exception "Projection cannot increase the number of rows in a block" when merging parts with TTL that deletes all rows and an aggregate projection with a constant GROUP BY key. (Alexey Milovidov).
fixBackported in: Fix null pointer dereference in dictGetOrDefault when the key argument is Nullable. (Alexey Milovidov).
fixBackported in: Fix two bugs in JIT expression compilation: a copy-paste error in nativeCast type checking that made integer-to-integer and float-to-float cast branches unreachable, and incorrect nullptr TargetMachine passed to LLVM PassBuilder preventing target-specific optimization passes from…
fixBackported in: DataLakeCatalog now respects the server's http_forbid_headers configuration when validating the auth_header setting. (Michael Anastasakis).
fixBackported in: Fix "Not-ready Set" exception when a filter with IN (subquery) is moved to PREWHERE by the query optimizer. (Alexey Milovidov).
fixBackported in: Fix an exception that could occur when inserting a row into a JSON column where the row introduced a new dynamic field alongside a typed field with an incompatible value, and the column was subsequently used as a GROUP BY key. (Jimmy Aguilar Mena).
fixBackported in: Fixes a case where timezone was not included during the assignment in the ALTER statement. Closes. Related https://github.com/ClickHouse/ClickHouse/pull/100647. (Yarik Briukhovetskyi).
fixBackported in: Fix incorrect query results caused by join reordering pushing an INNER JOIN filter (referencing only the preserved side of an outer join) into the outer join’s ON clause. (Vladimir Cherkasov).
fixBackported in: Fix incorrect results for RIGHT ANY JOIN when the right table has multiple rows per key and the output block is split due to size limits. Close. (Vladimir Cherkasov).
fixBackported in: Fix possible crash when an ALTER query executed on tables from in-memory database (e.g. temporary tables). (Den Kalantaevskii).
fixBackported in: Check for stack overflow in Avro reader during nested types deserialization. (Pavel Kruglov).
fixBackported in: Fix LOGICAL_ERROR crash "Unexpected number of rows in column subchunk" in native Parquet V3 reader when reading nullable columns with a WHERE filter. (Groene AI).
fixBackported in: Fix columns_substreams.txt corruption during column rename in some cases. Closes. (Pavel Kruglov).
fixBackported in: Fix a data race for ClickHouse, MySQL, PostgreSQL and XDBC dictionary sources where clone() const reads from and isModified() const writes to the same invalidate_query_response string. (Miсhael Stetsyuk).
fixBackported in: Fix heap-use-after-free in multiplying an AggregateFunction state by an integer (e.g. quantilesExactState(...) * N). The exponentiation-by-squaring loop merged the state with itself, which is undefined when the aggregate function's merge reallocates its internal storage. Closes STID…
fixBackported in: Fixed an issue where text and bloom filter skip indices on ALIAS columns whose expression contained a lambda with captured constants (e.g. arrayMap((k, v) -> concat(k, '=', v), mapKeys(m), mapValues(m))) were silently ignored. (Anton Popov).
fixBackported in: Fixed a data-correctness regression in 26.x where JIT-compiled if and multiIf with a Decimal result type and a non-Decimal (integer or float) literal in one branch silently returned a value 10^scale too small. The slow (non-JIT) path was unaffected. Workaround on affected versions:…
fixBackported in: Fix data part check and consistency check for talbes with JSON column. Previously it could lead to false positive errors about missing files. (Pavel Kruglov).
fixBackported in: Fix a use-after-free in StorageKafka2 that could crash the server when a Keeper session is replaced while the consumer is holding ephemeral topic-partition locks. (Groene AI).
fixBackported in: Fixed SQL injection vulnerability in PostgreSQL, Cassandra and XDBC dictionary sources: string keys containing single quotes were escaped with \' (backslash), which these backends treat as a literal backslash rather than an escape sequence, allowing arbitrary SQL to be injected into…
fixBackported in: Fix several edge case correctness issues in setting optimize_inverse_dictionary_lookup where the optimization could silently drop rows or suppress exceptions. Closes. Close. (Nihal Z. Miaji).
fixBackported in: Fixes a possible underflow in parsing postgres arrays. (Grant Holly).
fixBackported in: Fixed RESTORE of replicated MergeTree tables so restored part attachment uses backup_restore_keeper_max_retries instead of the regular insert Keeper retry budget. (Pablo Marcos).
fixBackported in: Fix Keeper termination and restart loop when get /keeper/availability_zone is sent with quorum_reads=true to a Keeper without configured. (myeongjun).
fixBackported in: Fix a TOCTOU data race in FutureSetFromTuple::buildOrderedSetInplace that results in a logical error. (Miсhael Stetsyuk).
fixBackported in: Fix segfault due to a use-after-free bug in AvroConfluentRowInputFormat. (Miсhael Stetsyuk).
fixBackported in: Fix data part consistency checks for types with dynamic structure and detect corrupted columns_substreams.txt. Resubmit of https://github.com/ClickHouse/ClickHouse/pull/103858 with additional changes. (Pavel Kruglov).
fixBackported in: Fix CANNOT_COMPILE_CODE Could not find symbol __fixunsdfti when JIT-compiling expressions that convert a Float to UInt128, such as toUInt128(). The unsigned 128-bit float-to-int compiler-rt builtins were missing from the JIT symbol resolver. Closes. (Raúl Marín).
featureBackported in: Implement a stress test for functions, checking the soundness of their various properties. (Michael Kolupaev).
otherBackported in:. (Pavel Kruglov).
fixBackported in: Fix handling of ColumnReplicated in PartialSortingTransform. (Nikita Taranov).
featureBackported in: Add missing Keeper component tracking guard to no-arg loadStatistics. (murphy-4o).
+2 more items in the release notes
26.2.18.8 May 8, 2026 Release notes ↗
featureBackported in: Added SYSTEM PAUSE VIEW [db.]name and SYSTEM PAUSE VIEWS queries for refreshable materialized views. Unlike SYSTEM STOP VIEW, SYSTEM PAUSE VIEW does not interrupt the currently running refresh — the in-flight refresh is allowed to complete and only subsequent refreshes are…
fixBackported in: Fix MEMORY_LIMIT_EXCEEDED exceptions being incorrectly reported as CORRUPTED_DATA during SummingMergeTree and CoalescingMergeTree merges. (János Benjamin Antal).
fixBackported in: Disable trivial LIMIT optimization with row policies/additional_table_filters (to allow parallel index analysis). (Azat Khuzhin).
fixBackported in: Fix SELECT DISTINCT silently returning incomplete results when an aggregate projection matched the query and some parts of the table had no projection data (e.g. the projection was added on a table that already held data, and MATERIALIZE PROJECTION was not run). Closes. (Nihal Z.…
fixBackported in: Fix SIZES_OF_ARRAYS_DONT_MATCH when reading AggregateFunction(topK(N), String) columns whose persisted alpha_size was grown by a pre-25.12 deserialize+serialize cycle. (Raúl Marín).
fixBackported in: Fix write out of bounds while deserializing quantileTiming state. (Alexey Milovidov).
otherBackported in: Bump libarchive form 3.8.6 to 3.8.7. (Robert Schulze).
26.2.17.31 May 4, 2026 Release notes ↗
breakingBackported in: Reduced default http_max_fields from 1,000,000 to 1,000 and http_max_field_name_size from 128 KB to 4 KB to limit pre-authentication memory usage by HTTP connections. Added http_max_request_header_size and http_headers_read_timeout settings. Users who rely on the previous higher…
featureBackported in: Add s3_read_request_duration_microseconds and s3_read_request_bytes histogram metrics to observe S3 GET request connection lifetime and bytes consumed, visible in system.histogram_metrics and the Prometheus endpoint. (Sema Checherinda).
otherBackported in: Increases MAX_BLOCK_NUMBER from ~1 billion to ~2.1 billion (the maximum Int32 value). On high-load instances with ~60 inserts per second, block numbers can exceed the old limit within months, which could cause operations like DROP PARTITION or mutations to silently skip newer parts.…
otherBackported in: Expose per-thread untracked_memory in system.stack_trace. (Azat Khuzhin).
otherBackported in: Apply max_network_bandwidth_for_user/max_network_bandwidth_for_all_users to remote filesystem reads/writes. (Azat Khuzhin).
fixBackported in: Revert "Move join step row estimation before check for 1 child" due to suspected performance regression. (Alexander Gololobov).
fixBackported in: Fixes a rare case where join with reordering can produce a wrong result. (Yarik Briukhovetskyi).
fixBackported in: Fix crash (Logical error: isConst/isSparse/isReplicated assertTypeEquality) in merge algorithms when lazy column replication (enable_lazy_columns_replication) produces ColumnReplicated columns that flow into merge-sort pipelines with late-arriving inputs. (Groene AI).
fixBackported in: Fix using wrong extreams in min-max index created on JSON column leading to wrong query result. Closes. (Pavel Kruglov).
fixBackported in: Fix LOGICAL_ERROR exception when multiple concurrent CREATE TABLE IF NOT EXISTS queries target the same S3Queue table on a Shared database. (Nikita Taranov).
fixBackported in: Bug with row policy that gives 'Not found column in block' exception in some special cases. (Yarik Briukhovetskyi).
fixBackported in: Fixed a server exception in ClusterDiscovery when a static cluster (defined in config) temporarily had no live nodes. (Kseniia Sumarokova).
fixBackported in: Fix wrong date data type inference in case of overflow after timezone adjustment. Closes. (Pavel Kruglov).
fixBackported in: Fix flattened Dynamic type serialization with binary encoded data types. Closes. (Pavel Kruglov).
fixBackported in: Apply Poisson sampling correction to collapsed jemalloc heap profiles to match jeprof output. Previously the collapsed format underestimated actual allocation sizes by not accounting for the sampling probability. (Antonio Andelic).
fixBackported in: Fix S3 requests failing with ios_base::clear: unspecified iostream_category error instead of being retried, caused by Poco BufferedStreamBuf::flushBuffer not handling short writes from the socket layer. (Sema Checherinda).
fixBackported in: Fix minmax_count_projection and trivial COUNT(*) optimizations being permanently disabled after a lightweight delete, even after all parts with a mask of lightweight delete were merged away. (Anton Popov).
fixBackported in: Optimize row policy OR-chains to IN in the new analyzer. (Azat Khuzhin).
fixBackported in: Plain INSERTs without materialized views no longer request excessive ConcurrencyControl slots and threads (max_threads instead of max_insert_threads), preventing CC slot starvation and thread count blowup on clusters with high INSERT throughput. (Sema Checherinda).
fixBackported in: Hide secret key in HMAC SQL function. Fix. (Mikhail f. Shiryaev).
fixBackported in: Reintroduce ArrowMemoryPool to allow throwing MEMORY_LIMIT_EXCEEDED to avoid kernel OOM. (Azat Khuzhin).
fixBackported in: Cap pre-auth TCP Hello packet strings to 64 KB and add handshake_timeout_milliseconds server setting to limit total handshake time, preventing unauthenticated clients from consuming excessive memory or holding threads indefinitely. (Sema Checherinda).
fixBackported in: Fix Parquet ColumnIndex stats min_value > max_value for String columns. (Saurabh Kumar Ojha).
fixBackported in: Check for malformed flattened Dynamic data in Native format. (Pavel Kruglov).
fixBackported in: Fix stale RPC causing replication stall after snapshot sync. (Seva Potapov).
fixBackported in: Populate _time column from url table function. (Nikita Taranov).
fixBackported in: Fix masking nested credentials in logs. (Vitaly Baranov).
fixBackported in: Fixes undefined behavior while parsing dateTime with a double fractional part. (Yarik Briukhovetskyi).
otherBackported in: Use xz 5.8.3. (Konstantin Bogdanov).
otherBackported in: CI: disable automerge for backport branches. (Max Kainov).
26.2.16.4 Apr 16, 2026 Release notes ↗
26.2.15.4 Apr 15, 2026 Release notes ↗
26.2.14.5 Apr 14, 2026 Release notes ↗
26.2.13.2 Apr 13, 2026 Release notes ↗
26.2.12.4 Apr 12, 2026 Release notes ↗
26.2.11.5 Apr 11, 2026 Release notes ↗
26.2.10.10 Apr 10, 2026 Release notes ↗
26.2.9.9 Apr 9, 2026 Release notes ↗
26.2.8.15 Apr 8, 2026 Release notes ↗
26.2.7.17 Apr 1, 2026 Release notes ↗
26.2.6.27 Mar 28, 2026 Release notes ↗
26.2.5.45 Mar 19, 2026 Release notes ↗
26.2.4.23 Mar 5, 2026 Release notes ↗
26.2.3.2 Mar 2, 2026 Release notes ↗
26.2.2.9 Mar 1, 2026 Release notes ↗
26.2.1.1139 Feb 27, 2026 Release notes ↗
26.1.12.23 May 11, 2026 Release notes ↗
breakingBackported in: Reduced default http_max_fields from 1,000,000 to 1,000 and http_max_field_name_size from 128 KB to 4 KB to limit pre-authentication memory usage by HTTP connections. Added http_max_request_header_size and http_headers_read_timeout settings. Users who rely on the previous higher…
featureBackported in: Add s3_read_request_duration_microseconds and s3_read_request_bytes histogram metrics to observe S3 GET request connection lifetime and bytes consumed, visible in system.histogram_metrics and the Prometheus endpoint. (Sema Checherinda).
otherBackported in: Expose per-thread untracked_memory in system.stack_trace. (Azat Khuzhin).
otherBackported in: Apply max_network_bandwidth_for_user/max_network_bandwidth_for_all_users to remote filesystem reads/writes. (Azat Khuzhin).
fixBackported in: Fix crash (Logical error: isConst/isSparse/isReplicated assertTypeEquality) in merge algorithms when lazy column replication (enable_lazy_columns_replication) produces ColumnReplicated columns that flow into merge-sort pipelines with late-arriving inputs. (Groene AI).
fixBackported in: Fix using wrong extreams in min-max index created on JSON column leading to wrong query result. Closes. (Pavel Kruglov).
fixBackported in: Fix LOGICAL_ERROR exception when multiple concurrent CREATE TABLE IF NOT EXISTS queries target the same S3Queue table on a Shared database. (Nikita Taranov).
fixBackported in: Fixed a server exception in ClusterDiscovery when a static cluster (defined in config) temporarily had no live nodes. (Kseniia Sumarokova).
fixBackported in: Fix wrong date data type inference in case of overflow after timezone adjustment. Closes. (Pavel Kruglov).
fixBackported in: Fix flattened Dynamic type serialization with binary encoded data types. Closes. (Pavel Kruglov).
fixBackported in: Fix S3 requests failing with ios_base::clear: unspecified iostream_category error instead of being retried, caused by Poco BufferedStreamBuf::flushBuffer not handling short writes from the socket layer. (Sema Checherinda).
fixBackported in: Fix minmax_count_projection and trivial COUNT(*) optimizations being permanently disabled after a lightweight delete, even after all parts with a mask of lightweight delete were merged away. (Anton Popov).
fixBackported in: Optimize row policy OR-chains to IN in the new analyzer. (Azat Khuzhin).
fixBackported in: Plain INSERTs without materialized views no longer request excessive ConcurrencyControl slots and threads (max_threads instead of max_insert_threads), preventing CC slot starvation and thread count blowup on clusters with high INSERT throughput. (Sema Checherinda).
fixBackported in: Hide secret key in HMAC SQL function. Fix. (Mikhail f. Shiryaev).
fixBackported in: Reintroduce ArrowMemoryPool to allow throwing MEMORY_LIMIT_EXCEEDED to avoid kernel OOM. (Azat Khuzhin).
fixBackported in: Cap pre-auth TCP Hello packet strings to 64 KB and add handshake_timeout_milliseconds server setting to limit total handshake time, preventing unauthenticated clients from consuming excessive memory or holding threads indefinitely. (Sema Checherinda).
fixBackported in: Fix Parquet ColumnIndex stats min_value > max_value for String columns. (Saurabh Kumar Ojha).
fixBackported in: Check for malformed flattened Dynamic data in Native format. (Pavel Kruglov).
fixBackported in: Populate _time column from url table function. (Nikita Taranov).
otherBackported in: Use xz 5.8.3. (Konstantin Bogdanov).
otherBackported in: CI: disable automerge for backport branches. (Max Kainov).
26.1.11.9 Apr 16, 2026 Release notes ↗
26.1.10.2 Apr 15, 2026 Release notes ↗
26.1.9.5 Apr 14, 2026 Release notes ↗
26.1.8.35 Apr 11, 2026 Release notes ↗
26.1.7.13 Mar 28, 2026 Release notes ↗
26.1.6.6 Mar 20, 2026 Release notes ↗
26.1.5.41 Mar 19, 2026 Release notes ↗
26.1.4.35 Mar 1, 2026 Release notes ↗
26.1.3.52 Feb 19, 2026 Release notes ↗
26.1.2.11 Feb 2, 2026 Release notes ↗
26.1.1.912 Jan 30, 2026 Release notes ↗
25.12.11.4 Apr 30, 2026 Release notes ↗
fixBackported in: Plain INSERTs without materialized views no longer request excessive ConcurrencyControl slots and threads (max_threads instead of max_insert_threads), preventing CC slot starvation and thread count blowup on clusters with high INSERT throughput. (Sema Checherinda).
otherUpgrade distroless Docker base image from Debian 12 to Debian 13 to eliminate CVEs in system libraries. (Rahul Nair).
otherRefresh distroless Docker base image to fix OpenSSL CVEs in libssl3t64. (Rahul Nair).
25.12.10.7 Apr 24, 2026 Release notes ↗
featureAdd distroless Docker image variants for clickhouse-server and clickhouse-keeper, tagged as -distroless. (Rahul Nair).
otherBackported in: Set this->exceptions(std::ios::badbit); for the std's streams inside poco. (Sema Checherinda).
fixBackported in: Fix tuple subcolumn access by name (e.g. SELECT x.a for Tuple(a UUID, b Int32)) for external tables passed via --external in clickhouse-client. Closes. (Pavel Kruglov).
fixBackported in: Credentials in JDBC, ODBC, and NATS connection strings are now masked in query logs and SHOW CREATE output, preventing accidental exposure of sensitive information. For URI-style connection strings (e.g. {scheme}://{user}:{password}@{host}), only the password portion is masked while…
fixBackported in: Fix LOGICAL_ERROR exception "Stream ... not found" when inserting into a table with nested Array(JSON) columns in wide parts with optimize_on_insert=0. (Pavel Kruglov).
fixBackported in: Fixes NOT_FOUND_COLUMN_IN_BLOCK cases where the projection SELECT part has columns that do not exist in the original SELECT part of the query. Closes. (Yarik Briukhovetskyi).
25.12.9.61 Mar 24, 2026 Release notes ↗
25.12.8.9 Mar 1, 2026 Release notes ↗
25.12.7.21 Feb 26, 2026 Release notes ↗
25.12.6.38 Feb 19, 2026 Release notes ↗
25.12.5.44 Feb 2, 2026 Release notes ↗
25.12.4.35 Jan 22, 2026 Release notes ↗
25.12.3.21 Jan 13, 2026 Release notes ↗
25.12.2.54 Jan 6, 2026 Release notes ↗
25.12.1.649 Dec 18, 2025 Release notes ↗
25.11.9.34 Feb 17, 2026 Release notes ↗
25.11.8.25 Jan 28, 2026 Release notes ↗
25.11.7.41 Jan 20, 2026 Release notes ↗
25.11.6.11 Jan 6, 2026 Release notes ↗
25.11.5.8 Dec 25, 2025 Release notes ↗
25.11.4.19 Dec 23, 2025 Release notes ↗
25.11.3.54 Dec 18, 2025 Release notes ↗
25.11.2.24 Dec 2, 2025 Release notes ↗
25.11.1.558 Nov 27, 2025 Release notes ↗
25.10.7.6 Apr 30, 2026 Release notes ↗
fixBackported in: Plain INSERTs without materialized views no longer request excessive ConcurrencyControl slots and threads (max_threads instead of max_insert_threads), preventing CC slot starvation and thread count blowup on clusters with high INSERT throughput. (Sema Checherinda).
otherUpgrade distroless Docker base image from Debian 12 to Debian 13 to eliminate CVEs in system libraries. (Rahul Nair).
otherRefresh distroless Docker base image to fix OpenSSL CVEs in libssl3t64. (Rahul Nair).
otherAccept COMMENT before AS SELECT in view parser for forward compatibility with newer versions. (Alexey Milovidov).
25.10.6.36 Feb 2, 2026 Release notes ↗
25.10.5.40 Jan 20, 2026 Release notes ↗
25.10.4.104 Jan 6, 2026 Release notes ↗
25.10.3.100 Nov 25, 2025 Release notes ↗
25.10.2.65 Nov 11, 2025 Release notes ↗
25.10.1.3832 Nov 1, 2025 Release notes ↗
25.9.7.56 Dec 19, 2025 Release notes ↗
25.9.6.117 Nov 25, 2025 Release notes ↗
25.9.5.21 Oct 30, 2025 Release notes ↗
25.9.4.58 Oct 23, 2025 Release notes ↗
25.9.3.48 Oct 7, 2025 Release notes ↗
25.9.2.1 Sep 27, 2025 Release notes ↗
25.8.33.6 Aug 26, 2026 Release notes ↗
fixBackported in: Fix exception when Iceberg metadata file path setting contains a null byte. (Alexey Milovidov).
fixBackported in: Fixes has, indexOf, countEqual, mapContainsKey, mapContainsValue and Map subscript returning "not found" for a constant LowCardinality needle equal to the element type's default value, such as an empty String or a zero number. (Groene AI).
fixBackported in: Fixed uniq, uniqExact, uniqHLL12 and uniqTheta returning a wrong result for an argument wrapped in an injective function that hides nullability, such as uniqExact(tuple(x)) over a Nullable column. The optimize_injective_functions_inside_uniq optimization removed the wrapping…
fixBackported in: Fixed a bug in the function formatRowNoNewline that could produce incorrect results or a logical error when a row is formatted to an empty result. (Alexey Milovidov).
fixBackported in: Do not return uninitialized memory in the result of a binary string literal whose length is not a multiple of eight, and from the LZ4 decompressor when a compressed block has no body. (Alexey Milovidov).
25.8.32.4 Aug 21, 2026 Release notes ↗
fixFixed a use-after-free when a LEFT JOIN to a dictionary with join_algorithm = 'direct' had a join key that is serialized Sparse. getColumnVectorData returned a PaddedPODArray reference into a column owned only by a function-local ColumnPtr, so the dictionary lookup read freed memory. (Groene AI).
fixBackported in: Fixed wrong results for SELECT count(arrayJoin(arr)) with the default optimize_trivial_count_query = 1. The stored row count was returned instead of the number of array elements, and on file() and url() the query returned 0. Closes. (Groene AI).
fixBackported in: Fix data race between BackgroundJobsAssignee::start and finish. (Alexey Milovidov).
25.8.31.9 Aug 20, 2026 Release notes ↗
fixBackported in: Fix invalid result on joining multiple table expressions, when leftmost table expression is a -Cluster table function. Resolves. (Konstantin Bogdanov).
fixBackported in: Fix a rare LOGICAL_ERROR "Attempt to release query context that does not exist" and the accompanying server crash when reading MergeTree tables through a filesystem cache disk created with enable_filesystem_query_cache_limit = 1. (Groene AI).
fixBackported in: RESTORE now fsyncs the restored part files when the destination table has fsync_after_insert enabled, so a restored part is as durable against power loss as an inserted one. Previously restored files were only written and closed (never fsynced), so a power loss right after RESTORE…
fixBackported in: Fixed a row policy containing a scalar subquery being evaluated only once and then reused forever after the table had been read through a Merge table. The parsed policy condition is cached and shared by all queries, and reading it through Merge rewrote the cached expression in…
fixBackported in: Fix CANNOT_CONVERT_TYPE and an exception in GroupingAggregatedTransform when reading a Merge table with one child being a Distributed table under custom-key parallel replicas (parallel_replicas_mode = 'custom_key_sampling' or 'custom_key_range'). Closes. (Alexey Milovidov).
fixBackported in: Fixed heap memory corruption when reading Parquet through an input format that owns its read buffer, for example a dictionary with SOURCE(FILE(... format 'Parquet')). Background prefetch and decode tasks could still read and write through the buffer after the pipeline released it,…
otherBackported in: Update libssh to 0.12.0. (Konstantin Bogdanov).
otherBackported in: unlink METADATA_VERSION_FILE_NAME before rewrite it, fix no such key thrown. (Sema Checherinda).
25.8.30.16 Aug 17, 2026 Release notes ↗
fixBackported in: Fix a segfault when a query arrives while the server is shutting down after an error during startup that happens in a narrow window between servers' startup and creating an exit scope for stopping and reaping of servers. (Miсhael Stetsyuk).
fixBackported in: Fixed server startup and ATTACH failing with WITH RECURSIVE is not supported with the old analyzer for a view with a recursive CTE when enable_analyzer = 0 is the server default. (Nikolay Degterinsky).
fixBackported in: Fixed a case where CREATE TABLE ... ENGINE = Distributed(...) without a column list could reveal the structure of a local table the creating user is not allowed to see. For a CREATE the local server executes itself, the structure is now inferred under the user's own context, so SHOW…
fixBackported in: Fixed reading the internal _temporary_and_external_tables database through the merge table function and the Merge table engine, which allowed one session to read the temporary tables of other sessions and other users, and caused an exception on the old analyzer path. A database…
fixBackported in: Fix a rare use-after-free bug that is triggered in a rare event of the async insert queue having different entries with identical deadlines. Now it's handled gracefully. (Miсhael Stetsyuk).
fixBackported in: Fixed a case where CREATE TABLE ... ENGINE = Buffer(...) without a column list could reveal the structure of a destination table the creating user is not allowed to see. For a CREATE the local server executes itself, the structure is now inferred under the user's own context, so…
fixBackported in: Fixed ATTACH of a Kafka table when kafka_num_consumers exceeds the limit derived from the number of CPU cores. (Nikolay Degterinsky).
fixUpdated the bundled curl library to 8.21.0, fixing several security issues affecting connection reuse, proxy authentication, cookie handling, and WebSocket support. (Chethan Kumar Reddy).
otherBackported in: Update the vendored libexpat to 2.8.2. (Konstantin Bogdanov).
otherBackported in: Update simdjson to v4.6.5. (Konstantin Bogdanov).
otherBackported in: Update jwt-cpp to v0.7.2. (Konstantin Bogdanov).
otherBackported in: Update Protocol Buffers to v35.1 and gRPC to v1.83.0. (Konstantin Bogdanov).
fixBackported in: test: fix flakiness of test_async_load_databases (pushing to MV reordered and lack of proper cleanup). (Azat Khuzhin).
otherBackported in: Iterate ColumnObject subcolumns in sorted path order. (Pavel Kruglov).
fixFix the double slash in the integration test runner play URL on 25.8. (Groene AI).
25.8.29.51 Aug 5, 2026 Release notes ↗
featureBackported in: Add cache for bcrypt authentication. (Nikolay Degterinsky).
fixBackported in: Fixed reading of the auth_response length in the MySQL handshake, where a length byte >= 128 was interpreted as a multi-gigabyte value because it was read as a signed char. (uwezkhan).
fixBackported in: Add a full permissions check on the create stage for the underlying query inside a materialized view. (pufit).
fixBackported in: Improve masking passwords in url used in table engine URL() and table function url(). (Vitaly Baranov).
fixBackported in: The loop table function was calling inner_storage->read() directly, bypassing the interpreter layer where row policies, column-level grants, and other security checks are applied. This allowed a user restricted by row policies to read all rows via loop(table) even when a direct…
fixBackported in: Fix RBAC bypass that allowed users to DESCRIBE any table via remote(), remoteSecure(), cluster(), or clusterAllReplicas() pointed at localhost, without requiring SHOW_COLUMNS privilege. (pufit).
fixBackported in: DataLakeCatalog now respects the server's http_forbid_headers configuration when validating the auth_header setting. (Michael Anastasakis).
fixBackported in: Fix RBAC bypass that allowed users to obtain table structure via DESCRIBE TABLE or CREATE TABLE AS on table functions (mysql(), postgresql(), sqlite(), arrowFlight(), jdbc(), odbc(), etc.) without the required source access privileges. For functions that infer schema from remote…
fixBackported in: Fixed heap-buffer-overflow in CompressionCodecT64 and process abort in CompressionCodecMultiple when decompressing malformed compressed data. Both issues were found by new libFuzzer targets. The codecs now throw an exception instead of crashing. (Rahul Nair).
fixBackported in: Fix MySQL dictionary source bypassing RemoteHostFilter for inline DDL params. (Shaohua Wang).
fixBackported in: Fix logical error exception when reading Iceberg tables whose format version was upgraded by an external tool (e.g. Spark). (Alexey Milovidov).
fixBackported in: Fix credential leak in query_log for paimonCluster, paimonS3Cluster, paimonAzureCluster, and deltaLakeS3 table functions. ### Documentation entry for user-facing changes. (JIaQi Tang).
fixBackported in: Fixes bug in arrayLevenshteinDistanceWeighted and arraySilimarity functions. Closes. (Mikhail f. Shiryaev).
fixBackported in: Fixed SQL injection vulnerability in PostgreSQL, Cassandra and XDBC dictionary sources: string keys containing single quotes were escaped with \' (backslash), which these backends treat as a literal backslash rather than an escape sequence, allowing arbitrary SQL to be injected into…
fixBackported in: Fix wrong row count from arrayJoin() used inside JOIN ON: the result was multiplied by the array length an extra time. (Shaohua Wang).
fixBackported in: Fixed a race between ALTER TABLE ... RENAME COLUMN and a concurrent OPTIMIZE TABLE ... FINAL (or any background merge) in MergeTree that could silently replace the renamed column's data with default values. The race window between publishing the new in-memory metadata and…
fixBackported in: Continuation of https://github.com/ClickHouse/ClickHouse/pull/96754 but for delta lake. (Konstantin Vedernikov).
fixBackported in: Fix a LOGICAL_ERROR (Invalid number of rows in Chunk) in JoiningTransform for a LEFT JOIN with unique right keys, a mixed ON condition, and a small max_joined_block_size_rows. (Groene AI).
fixBackported in: Fix a Logical error: Stream ... variant_discr ... is not found that could occur when merging or reading a MergeTree part produced by a mutation of a table with a Dynamic column. (Alexey Milovidov).
fixBackported in: Fixed incorrect results from distributed queries selecting ALIAS columns that share a common subexpression: columns could be misaligned and values returned under the wrong column. (Vladimir Cherkasov).
fixBackported in: Fix server crash (SIGSEGV) when reading Protobuf data with input_format_allow_errors_num > 0 and a valid message precedes a bad (skippable) message in the same block. (Andrey Tsarevskiy | Андрей Царевский ).
fixBackported in: Hide sensitive info in system.query_views_log.view_query. (Valerii Mordovskii).
fixBackported in: The MySQL wire protocol commands COM_FIELD_LIST (mysql_list_fields) and COM_INIT_DB (USE database) now enforce the same access control as their SQL equivalents (SHOW COLUMNS/DESCRIBE and USE). Previously they could disclose column names of tables the user only had partial column…
fixBackported in: Match http_forbid_headers case-insensitively. HTTP header names are case-insensitive, so forbidding Authorization now also blocks authorization, AUTHORIZATION and other case variants. Configured header_regexp patterns are now matched case-insensitively without needing an explicit…
fixBackported in: Fix a SELECT * projection returning a column's type default (e.g. 0) instead of its DEFAULT value (e.g. -1) when reading a column added with ALTER TABLE ... ADD COLUMN ... DEFAULT after the projection was created. Reads from the base table were already correct; only reads answered…
fixBackported in: Fix a server crash (out-of-bounds access) in S3Queue/AzureQueue with enable_hash_ring_filtering = 1 when a batch contained a non-processable file and the Keeper request to set the batch as processing failed at the same time. (Groene AI).
fixBackported in: Fix data loss of a column with no default expression when a merge runs concurrently with ALTER TABLE ... RENAME COLUMN, or when the column's only values come from a lightweight UPDATE. The column could be dropped from the merged part, so all of its values read back as NULL. (Groene…
fixBackported in: Fix a data race (and resulting rare crash) in the parallel merge of uniqExact aggregate states with two-level sets, which could occur with GROUPING SETS, ROLLUP and CUBE. (Groene AI).
fixBackported in: Fix a segfault in groupArrayLastMerge. Deserialization of aggregated function state is now validated. So a broken state does not lead to OOB. (Miсhael Stetsyuk).
fixBackported in: Fix credential leaks in SHOW CREATE, system.query_log, server logs and EXPLAIN output. Every S3 locator form now masks session_token and Google ADC secrets, extra_credentials/headers values at any argument position, duplicated or expression secret keys, invalid positional forms…
fixBackported in: Make headers in getClientHTTPHeader case-insensitive according to RFC 9110. Fixes by adding authorization to the filtered-out headers. (Mikhail f. Shiryaev).
fixBackported in: Fixed a possible crash (heap-buffer-overflow) when a quantileTDigest-family aggregate-function state column was used as a GROUP BY key and serialized concurrently by several threads. (Groene AI).
fixBackported in: Fixed a server crash (native stack overflow) when a deeply nested Array/Tuple/Map/Object literal is copied or destroyed, for example a query with a very deeply nested literal at a raised max_parser_depth. (Raúl Marín).
fixBackported in: Fixed reading Arrow/ArrowStream data with empty nested Array/Map columns produced by Apache Arrow Java < 19.0.0 (bundled with Apache Spark), which were previously rejected with an INCORRECT_DATA error about the offsets buffer being too small. (Raúl Marín).
fixBackported in: Fix CREATE OR REPLACE of a dictionary with an object of another kind: it failed with CANNOT_DETACH_DICTIONARY_AS_TABLE after the replace was already committed, leaving an orphan tmp_replace* table. (Nikolay Degterinsky).
fixBackported in: Fix a memory leak of the peer certificate on every TLS handshake with certificate verification enabled: SecureSocketImpl::verifyPeerCertificateImpl did not free the certificate returned by SSL_get1_peer_certificate. (Konstantin Bogdanov).
fixBackported in: Fix mutations with a query parameter as the partition (ALTER TABLE ... UPDATE/DELETE ... IN PARTITION {param:Type}): the substituted partition value was serialized into the mutation entry in a form that could not be parsed back, which broke loading of the table (for replicated…
fixBackported in: Fix a segfault due to out-of-bounds memory access when deserializing a malformed aggregate function state containing a String value. Such states are now validated and rejected instead of leading to segfaults. (Miсhael Stetsyuk).
fixBackported in: Fixes a segfault and silent data corruption when an INSERT into the File engine or the file table function appends to a non-empty file in a format that does not support appending, such as Avro. Writing through a file descriptor or a partitioned path bypassed the existing check, so…
securityBackported in: Fix krb5 CVE-2026-40355 & CVE-2026-40356. (Robert Schulze).
+10 more items in the release notes
25.8.28.1 Jul 5, 2026 Release notes ↗
25.8.27.1 Jul 4, 2026 Release notes ↗
25.8.26.11 Jul 3, 2026 Release notes ↗
fixBackported in: Fix a server abort during RESTORE of backups containing tables with cyclic dependencies. (Konstantin Bogdanov).
fixBackported in: Incremental backups no longer store S3 credentials in the locator of the .backup metadata file. Backups created with use_same_s3_credentials_for_base_backup = 1, or with explicit base backup credentials matching this backup locator, store a non-secret marker and are restored without…
fixBackported in: Fixed the MySQL interface being unusable with MySQL Connector/J 8.2.0 and newer (including 9.x). The info field of the OK packet is now length-encoded, matching the MySQL server, so the JDBC driver can connect. (Alexey Milovidov).
fixBackported in: Fixed ssl_certificate user identification so a single wildcard matches exactly one name component (RFC 6125 6.4.3). Previously a wildcard in a CN or DNS: SAN subject (for example .corp.example.com) also matched multi-label names such as evil.deep.corp.example.com, letting a holder…
fixBackported in: Fixed a server crash (stack overflow) caused by deeply nested expressions such as [[[ ... ]]] or array(array( ... )) when max_parser_depth is set to a large value. (Raúl Marín).
fixBackported in: Fix a segmentation fault when merging uniqExact aggregate states with GROUPING SETS, ROLLUP or CUBE and max_threads > 1. (Raúl Marín).
fixBackported in: Fix TSan data race in Keeper AuthID between preprocess and commit. (Alexey Milovidov).
fixBackported in: Fix flaky test_async_load_databases::test_materialized_views_replicated. (Groene AI).
otherStabilize 04201_trivial_count_with_additional_filter on 25.8. (Groene AI).
fixFix flaky Run server init.d install check on 25.8 (backport of). (Alexey Milovidov).
25.8.25.37 Jun 30, 2026 Release notes ↗
fixBackported in: Fix uncaught exception during background named collections reload when zookeeper storage is used. Closes https://github.com/ClickHouse/clickhouse-private/issues/44180. (Kseniia Sumarokova).
fixBackported in: Sanitize query_id in the HTTP handler to prevent CRLF injection into response headers via the X-ClickHouse-Query-Id header. (Pablo Marcos).
fixBackported in: Check for stack overflow in Avro reader during nested types deserialization. (Pavel Kruglov).
fixBackported in: Fixed RESTORE of replicated MergeTree tables so restored part attachment uses backup_restore_keeper_max_retries instead of the regular insert Keeper retry budget. (Pablo Marcos).
fixBackported in: Fixed a heap-buffer-overflow when reading Arrow or ArrowStream files with corrupted intermediate offsets in a binary or string column, and a null-pointer dereference when reading geo-tagged Arrow columns. (Raúl Marín).
fixBackported in: Fix SIGSEGV when reading Dynamic subcolumns from compressed Memory table after ALTER. Closes. (Pavel Kruglov).
fixBackported in: Fix SEGFAULT in singleValueOrNull deserialization for JSON type. Closes. (Pavel Kruglov).
fixBackported in: Fix a server crash (SIGSEGV) reachable by any user with CREATE TABLE rights when sending CREATE TABLE ... TO INNER UUID '...' without an ENGINE clause over HTTP or the native protocol. The same bug also crashed the client. The parser now reports a proper BAD_ARGUMENTS error instead…
fixBackported in: Fix crash when inserting tuples of different sizes in the same VALUES clause into a String column. Closes. (Pavel Kruglov).
fixBackported in: Fix OOB read in flattened Dynamic column Native deserialization. (Pavel Kruglov).
fixBackported in: Fix a crash in the mongodb table function, MongoDB storage and MongoDB dictionary source when the collection name is empty or contains NUL bytes. (Raúl Marín).
fixBackported in: Fix system.dictionaries returning 0 rows with partial SHOW DICTIONARIES revoke. (Pavel Kruglov).
fixBackported in: Fix a crash and a possible NOT_FOUND_COLUMN_IN_BLOCK error when constraint-based optimization (optimize_using_constraints) is used with correlated subqueries. (Raúl Marín).
fixBackported in: Fix multiple heap out-of-bounds reads in the Arrow IPC format reader (ArrowColumnToCHColumn). A malformed Arrow file could declare more rows than its buffers contain, declare list/struct/map child lengths inconsistent with their parent, supply non-monotonic list offsets, or truncate…
fixBackported in: Fixed multiple memory-safety and resource-exhaustion issues in format readers reachable from untrusted input: a heap out-of-bounds read in the native Parquet reader's DataPageV2 definition/repetition level-length handling, a stack overflow on Parquet files with deeply nested…
fixBackported in: Fixed a heap buffer overflow (server crash) in decodeHTMLComponent when decoding strings containing the expanding HTML entities &nGt; or &nLt;, reachable by any user with a single SELECT. (Raúl Marín).
fixBackported in: Do not hold mutex across ZooKeeper reads in access entities refresh. (Azat Khuzhin).
fixBackported in: Fixed possible server stack overflow (crash) when reading a deeply nested schema or value in the MsgPack, BSON, ORC, Parquet, JSON, DeltaLake, Iceberg and Paimon formats. Such deeply nested input is now rejected with an exception. (Raúl Marín).
fixBackported in: Fixed a heap buffer overflow (server crash) in windowFunnel when finalizing a crafted aggregate-function state with an out-of-range event type, reachable by any user with a single SELECT. (uwezkhan).
fixBackported in: Fix an integer underflow in the PostgreSQL wire protocol parser where a message with a length field smaller than 4 caused a size - 4 wraparound and an oversized resize/ignore. (uwezkhan).
fixBackported in: Added missing bounds checks in Elf and DWARF parsing. (Michael Kolupaev).
fixBackported in: Added missing bounds checks in ORC reader. (Michael Kolupaev).
fixBackported in: Fixed two path-traversal issues in the replicated part fetch protocol that could let a malicious replica write files outside the part directory. (Antonio Andelic).
fixBackported in: Fixed RESTORE for ReplicatedMergeTree tables so duplicate-content parts from a backup are preserved instead of being silently deduplicated. (Pablo Marcos).
fixBackported in: Reading Arrow/ArrowStream data with empty String/Binary columns produced by Apache Arrow Java < 19.0.0 (including Apache Spark) no longer throws INCORRECT_DATA. (Raúl Marín).
fixBackported in: Fix a crash (SIGSEGV in release builds, type-mismatch assertion in debug builds) in has over a Map with a Dynamic key when the lookup argument is LowCardinality, e.g. has(map('a'::Dynamic, ...), toLowCardinality('b')). (Groene AI).
fixBackported in: Hide secret arguments of functions such as encrypt, decrypt, and HMAC in EXPLAIN actions, EXPLAIN header, and EXPLAIN PIPELINE output when format_display_secrets_in_show_and_select is disabled (the default). (Raúl Marín).
otherBackported in: Updated libxml2 from 2.15.1 to 2.15.3. (Konstantin Bogdanov).
otherBackported in: Use postgres REL_18_4. (Konstantin Bogdanov).
otherBackported in: Upgrade krb5 to 1.22.2. (Konstantin Bogdanov).
otherBackported in: Update bundled curl to 8.20.0. (Konstantin Bogdanov).
otherBackported in: Bumped mariadb-connector-c to 3.1.29. All the ClickHouse-relevant patches preserved. (Nikita Mikhaylov).
otherBackported in: Update mongo-c-driver to 2.3.0. (Raúl Marín).
otherBackported in: Skip test_numbers_check on release branches. (Nikita Fomichev).
fixBackported in: Fix test_mysql_dotnet_client by anchoring to /testapp. (Raúl Marín).
securityBump cc-debian13 digests, clears libssl3t64 CVE-2026-45447. (Rahul Nair).
25.8.24.21 May 20, 2026 Release notes ↗
otherBackported in: Avoid index uncompressed cache overhead when the cache is disabled (server setting index_uncompressed_cache_size = 0, which is the default). (Michael Kolupaev).
fixBackported in: Fix null pointer dereference in dictGetOrDefault when the key argument is Nullable. (Alexey Milovidov).
fixBackported in: Fix an exception that could occur when inserting a row into a JSON column where the row introduced a new dynamic field alongside a typed field with an incompatible value, and the column was subsequently used as a GROUP BY key. (Jimmy Aguilar Mena).
fixBackported in: Fix exception escaping from S3 Client::~Client destructor causing server termination. (Gagan Dhakrey).
fixBackported in: Coalescing merge tree fix for array type. This closes. (Konstantin Vedernikov).
fixBackported in: Disable trivial LIMIT optimization with row policies/additional_table_filters (to allow parallel index analysis). (Azat Khuzhin).
fixBackported in: Plain INSERTs without materialized views no longer request excessive ConcurrencyControl slots and threads (max_threads instead of max_insert_threads), preventing CC slot starvation and thread count blowup on clusters with high INSERT throughput. (Sema Checherinda).
fixBackported in: Fix a data race for ClickHouse, MySQL, PostgreSQL and XDBC dictionary sources where clone() const reads from and isModified() const writes to the same invalidate_query_response string. (Miсhael Stetsyuk).
fixBackported in: Fix heap-use-after-free in multiplying an AggregateFunction state by an integer (e.g. quantilesExactState(...) * N). The exponentiation-by-squaring loop merged the state with itself, which is undefined when the aggregate function's merge reallocates its internal storage. Closes STID…
fixFixed S3_ERROR: Response checksums mismatch when using GCS over S3 disks after upgrading to 25.8.22 (caused by aws-sdk-cpp 1.11.771 enabling CRC32 flexible checksums by default, which GCS does not support). (Eugene Klimov).
fixBackported in: Fix masking nested credentials in logs. (Vitaly Baranov).
fixBackported in: Fixes undefined behavior while parsing dateTime with a double fractional part. (Yarik Briukhovetskyi).
fixBackported in: Fix a use-after-free in StorageKafka2 that could crash the server when a Keeper session is replaced while the consumer is holding ephemeral topic-partition locks. (Groene AI).
fixBackported in: Fix write out of bounds while deserializing quantileTiming state. (Alexey Milovidov).
fixBackported in: Fixes a possible underflow in parsing postgres arrays. (Grant Holly).
fixBackported in: Fix Keeper termination and restart loop when get /keeper/availability_zone is sent with quorum_reads=true to a Keeper without configured. (myeongjun).
fixBackported in: Fix a TOCTOU data race in FutureSetFromTuple::buildOrderedSetInplace that results in a logical error. (Miсhael Stetsyuk).
fixBackported in: Fix segfault due to a use-after-free bug in AvroConfluentRowInputFormat. (Miсhael Stetsyuk).
featureBackported in: Implement a stress test for functions, checking the soundness of their various properties. (Michael Kolupaev).
otherBackported in: Bump libarchive form 3.8.6 to 3.8.7. (Robert Schulze).
25.8.23.13 May 4, 2026 Release notes ↗
fixBackported in: Fix using wrong extreams in min-max index created on JSON column leading to wrong query result. Closes. (Pavel Kruglov).
fixBackported in: Fix SIGSEGV in MergeTreeDataPartWriterWide::cancel when a stream constructor throws during addStreams, leaving a null entry in column_streams. (Antonio Andelic).
fixBackported in: Fix wrong date data type inference in case of overflow after timezone adjustment. Closes. (Pavel Kruglov).
fixBackported in: Fix flattened Dynamic type serialization with binary encoded data types. Closes. (Pavel Kruglov).
fixBackported in: Optimize row policy OR-chains to IN in the new analyzer. (Azat Khuzhin).
fixBackported in: Fix Parquet ColumnIndex stats min_value > max_value for String columns. (Saurabh Kumar Ojha).
fixBackported in: Check for malformed flattened Dynamic data in Native format. (Pavel Kruglov).
otherBackported in: Use openssl 3.5.6. (Konstantin Bogdanov).
otherRefresh distroless Docker base image to fix OpenSSL CVEs in libssl3t64. (Rahul Nair).
otherNO CL ENTRY: 'Upgrade distroless base image to cc-debian13 (25.8)'. (Rahul Nair).
otherBackported in: CI: disable automerge for backport branches. (Max Kainov).
otherBackported in: The releases were failing due to a timeout on keyserver.ubuntu.com. This PR fixes it permanently by using a chain of keyservers to reliably receive the GPG key. (Mikhail f. Shiryaev).
25.8.22.28 Apr 17, 2026 Release notes ↗
25.8.21.7 Mar 28, 2026 Release notes ↗
25.8.20.4 Mar 20, 2026 Release notes ↗
25.8.19.20 Mar 19, 2026 Release notes ↗
25.8.18.1 Mar 2, 2026 Release notes ↗
25.8.17.37 Mar 1, 2026 Release notes ↗
25.8.16.34 Feb 2, 2026 Release notes ↗
25.8.15.35 Jan 21, 2026 Release notes ↗
25.8.14.17 Jan 6, 2026 Release notes ↗
25.8.13.73 Dec 22, 2025 Release notes ↗
25.8.12.129 Nov 25, 2025 Release notes ↗
25.8.11.66 Oct 27, 2025 Release notes ↗
25.8.10.7 Oct 9, 2025 Release notes ↗
25.8.9.20 Oct 7, 2025 Release notes ↗
25.8.8.26 Sep 30, 2025 Release notes ↗
25.8.7.3 Sep 25, 2025 Release notes ↗
25.8.6.11 Sep 24, 2025 Release notes ↗
25.8.5.17 Sep 23, 2025 Release notes ↗
25.8.4.13 Sep 18, 2025 Release notes ↗
25.8.3.66 Sep 16, 2025 Release notes ↗
25.8.2.29 Sep 4, 2025 Release notes ↗
25.8.1.5101 Aug 29, 2025 Release notes ↗
25.7.8.71 Oct 14, 2025 Release notes ↗
25.7.7.68 Sep 23, 2025 Release notes ↗
25.7.6.21 Sep 2, 2025 Release notes ↗
25.7.5.34 Aug 26, 2025 Release notes ↗
25.7.4.11 Aug 14, 2025 Release notes ↗
25.7.3.13 Aug 12, 2025 Release notes ↗
25.7.2.54 Aug 7, 2025 Release notes ↗
25.7.1.3997 Jul 29, 2025 Release notes ↗
25.6.13.41 Oct 14, 2025 Release notes ↗
25.6.12.10 Sep 16, 2025 Release notes ↗
25.6.11.18 Sep 11, 2025 Release notes ↗
25.6.10.16 Sep 9, 2025 Release notes ↗
25.6.9.98 Sep 2, 2025 Release notes ↗
25.6.8.10 Aug 7, 2025 Release notes ↗
25.6.7.23 Aug 5, 2025 Release notes ↗
25.6.6.29 Jul 31, 2025 Release notes ↗
25.6.5.41 Jul 24, 2025 Release notes ↗
25.6.4.12 Jul 15, 2025 Release notes ↗
25.6.3.116 Jul 10, 2025 Release notes ↗
25.6.2.5 Jun 27, 2025 Release notes ↗
25.6.1.3206 Jun 26, 2025 Release notes ↗
25.5.11.15 Oct 15, 2025 Release notes ↗
25.5.10.95 Aug 26, 2025 Release notes ↗
25.5.9.14 Jul 22, 2025 Release notes ↗
25.5.8.13 Jul 17, 2025 Release notes ↗
25.5.7.52 Jul 15, 2025 Release notes ↗
25.5.6.14 Jul 3, 2025 Release notes ↗
25.5.5.19 Jul 1, 2025 Release notes ↗
25.5.4.38 Jun 26, 2025 Release notes ↗
25.5.3.75 Jun 19, 2025 Release notes ↗
25.5.2.47 Jun 3, 2025 Release notes ↗
25.5.1.2782 May 22, 2025 Release notes ↗
See how far your stack has drifted from upstream. Release data from vendors’ own sources · feed under CC BY 4.0 · Code under AGPL-3.0 Settings Feed status