26.9.24.8 Oct 21, 2026 Release notes ↗

fixBackported in: Fixed a query silently returning fewer rows after an unrelated JOIN had run: a join runtime filter (enable_join_runtime_filters) moved into a read's PREWHERE made the read record a "no matching rows" verdict in the query condition cache for granules, or Parquet row groups, whose…

fixBackported in: Mask credentials embedded in HTTP URIs. (Han Fei).

fixBackported in: Fix a stack overflow on a deeply nested query plan received in the QueryPlan packet of the native protocol. (Alexey Milovidov).

fixBackported in: Fix use-after-free in complex key ssd_cache dictionaries when the cache file wraps around its partitions. Fix CANNOT_READ_ALL_DATA when reading long values of ssd_cache dictionaries from the cache file. (Alexey Milovidov).

fixBackported in: Fixed count() with WHERE d = toDate32('1900-01-01') (or !=) over a MergeTree Date32 column returning the number of 1970-01-01 rows when optimize_trivial_count_with_sparsity_filter is enabled (the default since 26.8). Closes. (Groene AI).

breakingBackported in: Remove object addresses from NATS, io_uring and HDFS messages. (Raúl Marín).

breakingBackported in: Remove object addresses from logical error messages. (Raúl Marín).

26.9.23.15 Oct 20, 2026 Release notes ↗

otherBackported in: Reduce repeated IN evaluation when many adjacent singleton row-mask updates are applied to one part. (Sergey Kuznetsov).

featureBackported in: Estimating subcolumn sizes for PREWHERE (for example m['key'] of a Map(LowCardinality(String), String) column) no longer reads the LowCardinality dictionary or the Variant discriminators header of every data part, which made planning slow on object storage, especially for each new…

otherBackported in: BACKUP uses less memory per file it backs up: an entry of the backup no longer keeps a copy of the description of the disk the file is on. A backup of a table with millions of files saves a few gigabytes. (Julia Kartseva).

otherBackported in: Fatal error reports no longer contain runtime memory addresses: stack frames and the fault address are printed as offsets inside the executable or a library, which can be passed to addr2line, and other addresses are hidden. system.crash_log.fault_address now contains the offset…

otherBackported in: A JOIN whose ON condition has a constant-false conjunct now works with the experimental parallel_replicas_plan_based setting when the join uses grace_hash, spills to disk, or runs with join_use_nulls = 1, instead of terminating the server or failing with NOT_FOUND_COLUMN_IN_BLOCK.…

fixBackported in: Fixed a read of uninitialized memory when a Variant, Dynamic or JSON column holding only NULL values is compressed, for example on insert into a Memory table created with compress = 1, or when a block is compressed for a JOIN or for the query result cache. The reported size of such…

fixBackported in: BACKUP and RESTORE to S3 retry requests that fail with ExpiredToken after refreshing credentials. The retry time limit is 120 seconds by default and can be changed with backup_s3_expired_token_retry_timeout_ms. (Nikolai Ovchinnikov).

fixBackported in: Fixed a server crash (or missing rows in the view, with a Null source table) on INSERT into the source table of a materialized view when a row policy or additional_table_filters of a table read by the view references the source table, e.g. USING x IN src. (Groene AI).

fixBackported in: Fix a segmentation fault in GROUP BY with the adaptive aggregator and external aggregation when a memory limit was hit while draining staged records. (Alexey Milovidov).

fixBackported in: Fix segfault when reading a MySQLDump file whose CREATE TABLE query has an ENUM column without a list of values or with non-string values. (Alexey Milovidov).

fixBackported in: Fixed a heap-use-after-free in the view dependency graph after renaming a materialized view whose query selects from itself. CREATE MATERIALIZED VIEW and ALTER TABLE ... MODIFY QUERY now reject a query that makes a materialized view select from itself. (Groene AI).

fixBackported in: Fix a stack overflow when a Redis server replies with deeply nested arrays. (Alexey Milovidov).

fixBackported in: Fix a stack overflow on a Protobuf schema with a very long chain of nested messages. (Alexey Milovidov).

otherBackported in: Not required. (Groene AI).

26.9.22.3 Oct 19, 2026 Release notes ↗

otherBackported in: An equality with a Bool value that no statistics can estimate, such as WHERE j.f = false on a JSON path, a Bool column without statistics, or IN with a Bool set, is now estimated to match half of the rows per value instead of 1%, so a join on such a filtered table builds its hash…

fixBackported in: Fixed crashes of the interactive line editor of clickhouse-client and clickhouse-local, which also crashed the server when used through the web terminal or an SSH session: after a history search that found nothing on an edited recalled query, when the prompt or the line given to an…

26.9.21.9 Oct 17, 2026 Release notes ↗

breakingBackported in: CREATE TABLE x AS src inherits the credentials embedded in the engine of src, which are masked in SHOW CREATE TABLE. It now requires the SELECT privilege on src when the inherited definition can carry credentials, instead of only SHOW COLUMNS. (Yarik Briukhovetskyi).

otherBackported in: Reduced the memory usage of incremental BACKUP: the base backup keeps only the sizes and checksums of its files instead of the full information about each file. For a base backup of millions of files this saves gigabytes. (Julia Kartseva).

otherBackported in: Compare TOTP codes and plaintext_password passwords in constant time, so that the response time does not depend on how many leading characters are correct or on which time window matched. (Vladimir Cherkasov).

otherBackported in: The nodes in the output of EXPLAIN AST graph = 1 are numbered sequentially instead of being identified by memory addresses, so the output is the same on every run. (Raúl Marín).

fixBackported in: Requesting SSH-key authentication over the native protocol no longer reveals whether the named user exists, or how it authenticates, before its signature is checked. (Shaohua Wang).

fixBackported in: Reject CR and LF characters in values sent as HTTP headers or in the request line of outgoing HTTP requests (BigQuery, YTsaurus, url, DataLake catalogs, GCP OAuth, AI functions, S3 storage class), which could be used to inject headers or additional requests. (Raúl Marín).

fixBackported in: The setting http_zlib_compression_level now applies only to the gzip and deflate HTTP response compression. The level of other methods (zstd, lz4, br, xz, bz2) is controlled by output_format_compression_level. Previously, a level suitable for zlib was passed to every method, which…

otherBackported in: Use node ids instead of addresses in pipeline diagnostics. (Raúl Marín).

26.9.20.23 Oct 16, 2026 Release notes ↗

breakingBackported in: Overriding a key that is stored in a named collection now requires SHOW NAMED COLLECTIONS SECRETS on that collection. This also applies to overrides through an alias (including flat kafka_* settings over nested kafka.* keys), through a SETTINGS clause of a table engine or table…

otherBackported in: A filter on the PARTITION BY columns of a window function is no longer pushed below the window (this reverts). The push-down made queries up to 8 times slower when the window reads a JOIN and the filter removes every row, for example IN over an empty subquery, because the join built…

otherBackported in: A packet that cannot appear at the current point of the native protocol is now rejected without deserializing its payload. Previously the server deserialized the body of an unexpected Data packet — including arbitrary data types and aggregate function states — only to throw…

featureBackported in: Add S3 bucket to remote_url_allow_hosts. (Konstantin Vedernikov).

otherBackported in: Reduced the peak memory usage of RESTORE and of incremental BACKUP: the metadata file of a backup is now parsed while it is read, instead of being read into memory whole first. For backups of millions of files this saves gigabytes. (Julia Kartseva).

fixBackported in: Fixed a crash caused by a stack overflow when a deeply nested JSON document was parsed into a JSON column or passed to the JSONExtract family of functions. Such documents are now rejected with the TOO_DEEP_RECURSION error. (Pavel Kruglov).

fixBackported in: Fix a server crash when a RIGHT JOIN/FULL JOIN is planned for parallel replicas (parallel_replicas_plan_based=1) and the join output header declares a column by type only — e.g. the residual column of a constant NULL conjunct in the ON clause. Type-only header columns are now…

fixBackported in: Fixed CANNOT_READ_ALL_DATA (while reading prefix of column ...) during query planning when a MergeTree table has an active empty Wide part, left by a TTL drop or by a mutation that deleted all rows of a part, and the query filters on a subcolumn, such as a key of a…

securityBackported in: Update the vendored expat to 2.9.0, fixing a denial of service through a crafted backup manifest during RESTORE (CVE-2026-66046) and the other 2.8.3–2.9.0 security fixes. (Actuele AI).

fixBackported in: Fixed loading, short ATTACH, and UNDROP TABLE for existing SQL-defined S3 disks whose endpoints are absent from remote_url_allow_hosts; new full-definition CREATE and ATTACH still reject disallowed endpoints. (Alexey Bakharew).

fixBackported in: Fixed ORDER BY ... LIMIT over a column of an Interval type (or Nullable, LowCardinality, Tuple or Array of one) failing with TYPE_MISMATCH when use_top_k_dynamic_filtering is enabled, which is the default. Closes. (Groene AI).

fixBackported in: Fixed a stack overflow crash on a deeply nested CapnProto schema that the nesting depth check missed: a comment or a byte order mark between import and its path, an escape sequence in the import path, or a backtick text line. A backtick text line with many brackets is no longer…

fixBackported in: Fixed a possible segmentation fault when reading an Avro map into a Map column (for example Map(DateTime, String)) with the AvroConfluent format, including Kafka tables. Closes. (Groene AI).

fixBackported in: Fixed an issue where pressing Ctrl-R and then Ctrl-Z in the web terminal or the SSH interface suspended the whole server process. (Alexey Milovidov).

fixBackported in: Fix a wrong result, or an exception in debug builds, when optimize_aggregators_of_group_by_keys eliminated any, min or max of a GROUPING SETS key with group_by_use_nulls. (Alexey Milovidov).

fixBackported in: Fixed a server crash when a RabbitMQ table with the headers exchange type had a routing key without =, or when rabbitmq_routing_key_list was empty. Routing keys without = for the headers exchange type are now rejected with an exception. The problem was found and reported by @dstesk…

fixBackported in: Allow to do vertical merge if result part storage type is not Full. (alesapin).

fixBackported in: Fixed a crash (stack overflow) on a CapnProto schema with a long chain of type expression suffixes (Int32.a.a..., Int32()()...) or of declarations that refer to each other (constants, aliases, struct fields, annotations, imports). Such a schema is now rejected with The CapnProto…

fixBackported in: Fixed Reading in parallel from replicas is enabled but cluster to execute query is not provided (CLUSTER_DOESNT_EXIST) when selecting from a Distributed table whose cluster is not declared in remote_servers - the cluster of a Replicated database, or one found by cluster discovery -…

otherBackported in: Update mariadb-connector-c to v3.4.10. (Actuele AI).

otherBackported in: Update vectorscan to 5.4.13. (Actuele AI).

otherBackported in: Observed as a bottleneck in the ci-logs cluster. (Mikhail Artemenko).

26.9.19.9 Oct 14, 2026 Release notes ↗

otherBackported in: DROP TABLE, DETACH TABLE, server shutdown and ALTER TABLE ... MODIFY SETTING refresh_statistics_interval no longer wait until a running background refresh of the statistics cache of a MergeTree table has read the statistics of every part. On object storage with thousands of parts…

fixBackported in: Fix ALTER TABLE ... MATERIALIZE STATISTICS / DROP STATISTICS failing forever and wedging the table's mutation queue when a server profile sets allow_statistics = 0 and the statement enables it per-session, the same opt-in ADD STATISTICS honours. Also close a hole where MATERIALIZE…

fixBackported in: Fix a credential written in cleartext to system.query_log and the server log when a key = value argument precedes the positional arguments of the mongodb, redis, remote, arrowFlight and ytsaurus table functions or the MongoDB, Redis, Remote, ArrowFlight, ExternalDistributed and…

fixBackported in: Fixed queries that go through another server (remote, Distributed, parallel replicas, GLOBAL IN) failing with SYNTAX_ERROR, UNKNOWN_CODEC or CORRUPTED_DATA when output_format_native_encode_types_in_binary_format or input_format_native_decode_types_in_binary_format is enabled. The…

fixBackported in: Free prefetched messages when StorageKafka2 partitions move between consumers, preventing per-partition memory growth until restart. (Aparajita Pandey).

fixBackported in: The web terminal and the SSH interface no longer reset the settings of the user (from settings profiles, roles, and CREATE USER ... SETTINGS) to default values. Previously, restrictions such as readonly, resource limits, and additional_table_filters were not applied in these…

fixBackported in: Don't fuse a filter into ARRAY JOIN before its row-only part is lifted below it, so the element filter doesn't copy the whole array to every element. (Konstantin Vedernikov).

otherBackported in: Not required. (Groene AI).

26.9.18.11 Oct 13, 2026 Release notes ↗

featureBackported in: optimize_and_compare_chain again derives transitive conditions through a DateTime or lower-scale DateTime64 constant compared with a DateTime64 expression, as it did before 26.8. For example, t1.ts = t2.ts adds t2.ts < toDateTime('2026-09-16 00:00:00'), so the other side of a join…

featureBackported in: Added a server setting access_control_improvements.readonly_restricts_set_role, false by default. When enabled, SET ROLE is refused with error code READONLY in a session or query whose readonly setting is not zero. Previously SET ROLE was the only identity-changing statement that…

featureBackported in: Added the setting use_aggregation_memory_tracker to choose how GROUP BY measures its memory when deciding on two-level aggregation. compatibility below 26.9 restores the measurement from before 26.7. (Hechem Selmi).

fixBackported in: Fix wrong results for uniq*, GROUP BY, LIMIT n BY, ORDER BY after GROUP BY, and window PARTITION BY over toString of a DateTime/DateTime64 in a time zone with a daylight-saving transition, and over toFixedString of a String. Both functions claimed to be injective while mapping…

fixBackported in: Fixed the LOGICAL_ERROR Reading from materialized CTE '...' before its materialization completed - DelayedPortsProcessor gate is missing in the query plan raised when an IN or other set subquery defines a MATERIALIZED CTE that two other MATERIALIZED CTEs of that subquery read (for…

fixBackported in: Fixed use_skip_indexes = 0 also disabling part pruning by the partition-key min-max index (since 26.5), which made such queries read every part of the table. (Ashish Kumar Choubey).

fixBackported in: Reject malformed serialized groupBitmap states with INCORRECT_DATA instead of failing later during bitmap operations. (Elmi Ahmadov).

fixBackported in: Fixed a WHERE condition or a row policy on a Hive partition column (use_hive_partitioning = 1) returning too few rows when the Parquet data file also has a column with that name and other values: Parquet row-group, page and dictionary pruning used the file's values instead of the…

fixBackported in: Fixed a heap use-after-free in the s3, azureBlobStorage, hdfs and other object storage table functions and engines when an exception (for example MEMORY_LIMIT_EXCEEDED) was thrown while creating the reader of a file in a row input format such as CSV. (Groene AI).

fixBackported in: Fixed a server crash, wrong results or a rejected query in ORDER BY ... WITH FILL ... INTERPOLATE when one INTERPOLATE expression has to be converted to its target's type and another item reads the same column or literal, for example INTERPOLATE (a AS b, b AS a) with targets of…

26.9.17.8 Oct 12, 2026 Release notes ↗

featureBackported in: Restore min/max pruning of Iceberg data files for a Decimal(38, 38) column. A manifest bound of magnitude above roughly 0.7 cannot be widened inside Int128 and was dropped, which left the column without a min/max condition; it is now saturated at the largest magnitude the precision…

fixBackported in: The collections of the Native protocol — the settings and the query parameters of a query, the client information, the granted roles and the table-status lists — are now bounded, so a small packet can no longer make the server allocate memory for data that has not arrived. (Alexey…

fixBackported in: Fixed a crash on a query with a deeply nested Dynamic or JSON constant. (Pavel Kruglov).

fixBackported in: Fix NOT_IMPLEMENTED for an outer JOIN with join_algorithm = 'full_sorting_merge' when optimize_and_compare_chain derived a condition on the preserved side of the join from the ON clause. (Yarik Briukhovetskyi).

securityBackported in: Update mongo-c-driver to 2.5.5, fixing an out-of-bounds write during MongoDB connection monitoring reconnects (CVE-2026-96746). (Actuele AI).

otherBackported in: Update thrift to v0.25.0. (Actuele AI).

fixBackported in: Fixed a crash on INSERT into a MergeTree table when a materialized view over it reads the same table from a correlated subquery, IN or a non-leftmost table of an IN subquery. (Groene AI).

26.9.16.11 Oct 11, 2026 Release notes ↗

fixBackported in: Fixed TRUNCATE TABLE of an Alias table whose target is a MergeTree failing with DEADLOCK_AVOIDED when the alias is being read concurrently, while the same statement against the target table succeeds immediately. The lock for TRUNCATE is now chosen and taken on the table that…

fixBackported in: Fix a vector search returning fewer rows than its LIMIT, and missing true nearest neighbours, after a lightweight DELETE (or with a delete mutation applied on the fly): the vector index is no longer used for a part while it still holds deleted rows. (Alexey Milovidov).

fixBackported in: Fixed wrong results, or an ILLEGAL_COLUMN error, of a JOIN whose condition equates both a column and an expression of that column (for example ON t1.k = t2.k AND intDiv(t1.k, 2) = intDiv(t2.k, 2)) when a filter on that expression is pushed down to the other side of the join: the…

fixBackported in: Fixed parallel replicas not being used when reading a Distributed table whose underlying table is another Distributed table and every shard of the outer cluster has a single replica. (Igor Nikonov).

fixBackported in: Fixed duplicated rows returned by ANY RIGHT JOIN with any_join_distinct_right_table_keys = 1 when parallel replicas are enabled. (Groene AI).

fixBackported in: Fixed excessive memory usage when loading a data part with a corrupted columns_substreams.txt; such a part is now detached as broken. (Murphy).

fixBackported in: Fixed CREATE MATERIALIZED VIEW ... POPULATE and CREATE TABLE ... AS SELECT in a Replicated database with parallel replicas enabled: each replica sent its population to other replicas, so its rows landed in other replicas' tables (duplicated there, missing on the replica itself), or…

fixBackported in: Fixed slow planning of queries with skip indexes on tables with many parts and pending patch parts of lightweight updates. (Anton Popov).

fixBackported in: Fixed a crash (stack overflow) when reading an Avro file with an explicit structure that does not read a field nested through a long chain of named types, or a field of a recursive type holding deeply nested data such as a long linked list. Such a file now fails with…

otherBackported in: Do not use parallel replicas for clusterAllReplicas. (Igor Nikonov).

26.9.15.5 Oct 10, 2026 Release notes ↗

otherBackported in: Faster sorted-stream processing on a multi-column key whose leading column has long runs, in LIMIT BY, negative LIMIT BY, DISTINCT in order, window functions (peer groups and PARTITION BY boundaries), full_sorting_merge and partial_merge JOIN, and ReplacingMergeTree FINAL without…

fixBackported in: Fix corrupted shared data of nested JSON objects after a failed attempt to parse a value during insert. It could lead to errors like Unexpected version of JSON type binary encoding or Unknown type code when reading the data after merges or when serializing it in binary formats.…

fixBackported in: Fixed a query failing with an exception like Cannot parse UInt64 from String on a table with a text index on mapKeys or JSONAllPaths, when the predicate cannot be evaluated on the value of a missing map key or JSON path. (Anton Popov).

otherBackported in: Use castStorage for the Join row policy check in the legacy analyzer. (Vladimir Cherkasov).

26.9.14.10 Oct 9, 2026 Release notes ↗

otherBackported in: bloom_filter and text indexes are now used when a Nullable indexed column is cast to the non-Nullable type, such as CAST(x, 'String') or json.path::String. A query that would throw on a NULL value may not throw when the index skips the granules with NULL. (Anton Popov).

fixBackported in: Fix reading bucketed runtime Map values from JSON columns using advanced shared-data serialization. (Rory Shanks).

fixBackported in: Fix DeltaLake stats pruning with Date cast. (Arsen Muk).

fixBackported in: Fix EXPLAIN PLAN actions = 1 printing a secret function argument (for example the key of HMAC or encrypt) in cleartext when its value came from a subquery or from the other side of a JOIN. (Vladimir Cherkasov).

fixBackported in: Fix INSERT failing with ILLEGAL_FINAL or SAMPLING_NOT_SUPPORTED when a materialized view applies FINAL or SAMPLE to its own source table inside a subquery. Regression in. (Jimmy Aguilar Mena).

fixBackported in: Fix a rare server crash (SIGSEGV in mongoc_log) when a MongoDB dictionary source or MongoDB table was created while another thread created the first MongoDB connection in the process. Messages logged by the MongoDB driver now go to the server log. (Vladimir Cherkasov).

otherBackported in: CRoaring v5.2.3 exposes internal_validate() on the C++ RoaringBitmap wrappers, so RoaringBitmap data can be validated. (Elmi Ahmadov).

otherBackported in: Update cctz to 2026e. (Actuele AI).

fixBackported in: Fixed a LOGICAL_ERROR in arraySlice on a QBit column replicated by ARRAY JOIN or a JOIN. (Groene AI).

26.9.13.15 Oct 8, 2026 Release notes ↗

otherBackported in: A WHERE that no row passes is pushed to every JOIN input again, including the non-preserved side of an OUTER JOIN and a side with no column used above the join, so that input is no longer read and hash-built for nothing. For example, a UNION ALL branch whose constant column fails…

otherBackported in: Hash joins with many matches per key are faster when they output a LowCardinality column whose blocks have different dictionaries (several parts, FINAL, or a LowCardinality value computed per block): short ranges from another dictionary are now inserted key by key instead of through…

featureBackported in: Added the setting query_plan_filter_push_down_below_limit_by (default 1), controlling whether filters on LIMIT BY key columns are pushed below the LIMIT BY step. Setting it to 0 restores the plan shape used before 26.7, for queries where the pushed predicate makes index analysis…

fixBackported in: Mask secrets in the queries that a cluster-mode QueryRunner table writes to system.query_log as well as in queries executed as startup scripts. (Miсhael Stetsyuk).

fixBackported in: Tables in a database with lazy_load_tables were missing from system.parts, system.replicas and related system tables, and refused by replica commands, after a restart. (Nikolay Degterinsky).

fixBackported in: Fix a server abort when reading an Iceberg table whose sort order names a transform ClickHouse cannot parse (e.g. bucket[xyz]); ClickHouse now ignores that sort-order hint and keeps the table readable. (Ilias).

fixBackported in: Comparing an Enum column with a string literal that is not one of its elements no longer throws UNKNOWN_ELEMENT_OF_ENUM when validate_enum_literals_in_operators is disabled (the default) and the column is part of the primary key, the partition key, or a bloom_filter index. != with…

fixBackported in: Fix Found patch part ... that intersects mutation with version ... on lightweight updates in a table created with CREATE TABLE ... CLONE AS or ATTACH PARTITION ALL FROM a table with lightweight updates. (Nikolay Degterinsky).

fixBackported in: Fix UNKNOWN_IDENTIFIER in the analyzer when a table is referenced as database.table in FROM or JOIN and another table expression in the same query uses that database name as its alias, for example FROM db.t1 AS db INNER JOIN db.t2 AS t ON .... Closes. (Dmitry Novik).

fixBackported in: Fixed wrong results when a WHERE clause mixing AND and OR was evaluated with skip indexes (use_skip_indexes_for_disjunctions, enabled by default). If a minmax or set index could not evaluate one atom of the predicate for a granule, the per-atom verdicts recorded for that granule…

fixFix iceberg_tolerate_conflicting_manifest_schemas being reverted to false by compatibility settings of 26.8 or 26.9 on 26.9 servers, which made Iceberg reads fail with ICEBERG_SPECIFICATION_VIOLATION on tables whose manifest schemas conflict with metadata.json. (Asya Shneerson).

otherBackported in:. (Alexey Milovidov).

fixBackported in: Fix container existence check during RESTORE of a lightweight snapshot from Azure Blob Storage by parsing the saved namespace into container name and prefix. (Garrett Thomas).

otherBackported in: Reduced the setup of the 04510_distributed_final_many_partitions test from 150 to 65 partitions. (Groene AI).

26.9.12.8 Oct 6, 2026 Release notes ↗

otherBackported in: Filesystem cache: make reserve granularity dynamic. (Kseniia Sumarokova).

fixBackported in: Fixed a text index dropping matching rows when a FixedString is involved in the comparison: a term-preserving tokenizer over a String column lost the rows whose value carries literal trailing zero bytes when the search constant is a FixedString, and an index over a FixedString…

fixBackported in: Rewriting the body of a view with ALTER TABLE ... MODIFY QUERY now needs the same grants as creating it with its SQL security: SET DEFINER on the definer of a SQL SECURITY DEFINER view, or ALLOW SQL SECURITY NONE for a SQL SECURITY NONE view. An ON CLUSTER MODIFY QUERY fails with…

fixBackported in: Fix basic statistics of parts written by 26.6 or 26.7: after ALTER TABLE ... UPDATE or a lightweight DELETE, non-Nullable columns reported a default-value count of 0, which made selectivity estimates wrong. Query results were not affected. To repair parts that are already affected,…

fixBackported in: Fix a possible hang of a query under workload CPU scheduling with cpu_slot_preemption enabled: when all its threads were preempted, the query could keep CPU slots it had already used and wait forever for one of them. (Sergei Trifonov).

fixBackported in: Fixed a LEFT/RIGHT/FULL JOIN without an equality key that failed with INVALID_JOIN_ON_EXPRESSION (Cannot determine join keys) when its WHERE clause also contained an IN (subquery). The WHERE filter now converts such a join to INNER again, as it did in 26.6, which also restores that…

fixBackported in: Respect iceberg_metadata_staleness_ms in metadata parsing. (Konstantin Vedernikov).

26.9.11.2 Oct 5, 2026 Release notes ↗

fixBackported in: Fixed a segmentation fault or std::length_error when reading TSV formats with input_format_tsv_crlf_end_of_line = 1 if an escape sequence ended exactly at the end of a read buffer. (Groene AI).

26.9.10.4 Oct 4, 2026 Release notes ↗

otherBackported in: Enabled the text index posting lists cache by default (use_text_index_postings_cache). Previously each query used a private cache capped at 100 MiB, which on large tables caused posting lists and phrase search results to be recomputed several times within a single query; a 4-token…

otherBackported in: Skip indexes (bloom_filter, tokenbf_v1, ngrambf_v1, minmax) and the primary key are now used when the indexed column is wrapped into a conversion that does not change its value, such as toLowCardinality, toNullable or a CAST to Nullable or LowCardinality. (Anton Popov).

fixBackported in: Fix an out-of-bounds read when deserializing a uniqTheta state shorter than 24 bytes, for instance from CAST( AS AggregateFunction(uniqTheta, ...)). (Alexey Milovidov).

26.9.9.28 Oct 3, 2026 Release notes ↗

otherBackported in: Faster planning of queries to Iceberg tables with many manifest files: when a manifest file header has the schema-id key and that schema is already known from metadata.json, the schema copy stored in the manifest header is no longer parsed and compared with it. ClickHouse now also…

otherBackported in: Hide the HTTP headers in the definition of HTTP dictionary sources in SHOW CREATE DICTIONARY, system.tables and query logs, the same way as passwords. They can be shown with the existing display_secrets_in_show_and_select mechanism. (Matheus Nerone).

fixBackported in: Fixed SYSTEM SYNC TRANSACTION LOG (local, non-ON CLUSTER form) not checking the SYSTEM_SYNC_TRANSACTION_LOG privilege. The ON CLUSTER form already required it via getRequiredAccessForDDLOnCluster, but the local execution path skipped checkAccess, so a user without the grant could…

fixBackported in: Fixed asynchronous TLS connections occasionally failing with an unrelated OpenSSL error left by another connection on the same OS thread. This could terminate distributed queries with a misleading network exception. (Dmitriy Borisenko).

fixBackported in: Fixed an ssl_certificate authentication bypass where an embedded NUL byte in a certificate's Common Name (for example john\0.evil.com) was truncated server-side to john, letting a holder of such a certificate authenticate as a different user. (Konstantin Bogdanov).

fixBackported in: Prevent asynchronous inserts that only need to buffer data from being blocked by another insert waiting for a flush worker while holding their shared queue lock. Ensure a global forced flush waits for batches removed from the queue that are still waiting for a worker. (RJ).

fixBackported in: Skip indexes (text, tokenbf_v1, ngrambf_v1) are now used when the indexed column or the searched constant is wrapped into LowCardinality, Nullable or an equivalent CAST. For example, m['key'] = 'value' on a Map(String, LowCardinality(String)) column and hasToken(s,…

fixBackported in: EXPLAIN AST printed secret function arguments, such as the key of encrypt, in clear text, and with optimize = 1 it did so for the body of a view the user may only SELECT from. The dump now prints '[HIDDEN]' in their place, under the same gate as SHOW CREATE. (Harikrishnan Prabakaran).

fixBackported in: Column-level SELECT privileges are now enforced for columns used only inside indexHint and for ALIAS columns referenced in PREWHERE. As in WHERE, referencing an ALIAS column in PREWHERE requires the grant on the alias name; a grant on its source columns is no longer sufficient. A…

fixBackported in: Fix a server crash (SIGSEGV) when a CREATE TABLE ... PROJECTION / ALTER TABLE ... ADD PROJECTION statement is restored from a clickhouse_json AST whose projection query subtree contains a function node without an arguments list. The malformed payload is now rejected with…

fixBackported in: Fixed a row policy bypass: a direct JOIN with an EmbeddedRocksDB, KeeperMap or Redis table in the legacy analyzer (enable_analyzer = 0) ignored the row policy of the right table and returned hidden rows, and joinGet on a Join table ignored its row policy in both analyzers. Such a…

fixBackported in: Fix NO_COMMON_TYPE in case of use_variant_as_common_type=0 for jemalloc fragmentation dashboard. (Azat Khuzhin).

fixBackported in: Now statistics parts pruning will not work if table has row level policy. (alesapin).

fixBackported in: Fix filesystem cache accounting when the directory for a new cache key cannot be created, for example because the cache disk is out of space or inodes. The failed reservation stayed counted in the cache until the query released the file segment. (Sema Checherinda).

fixBackported in: CREATE OR REPLACE in a Replicated database or with ON CLUSTER now requires the drop privilege for the kind of the table it replaces, so a user without DROP DICTIONARY can no longer replace a dictionary. (Nikolay Degterinsky).

fixBackported in: Fix LOGICAL_ERROR Cannot capture column N because it has incompatible type when a materialized view with a lambda over an Array(Tuple(...)) column receives a block while the source table's column type is being changed by ALTER TABLE ... MODIFY COLUMN. (Jimmy Aguilar Mena).

fixBackported in: Fix a server crash caused by unbounded recursion when decoding a deeply nested value inside a binary encoded type, for example an AggregateFunction parameter in a Dynamic value read from RowBinary or Native. (Pavel Kruglov).

fixBackported in: Fixes a server crash on CREATE TABLE or ALTER TABLE ... MODIFY TTL with a TTL expression that uses the result of arrayMap with a constant lambda, such as toString(arrayMap(x -> CAST(1, 'Dynamic'), arr)). (Groene AI).

fixBackported in: Fixed secret settings of S3Queue and AzureQueue tables written with the legacy s3queue_ prefix, such as s3queue_after_processing_move_secret_access_key, being shown in cleartext in SHOW CREATE TABLE, system.tables, system.query_log and the server log. They are now hidden as they are…

fixBackported in: Add more path validations. (Konstantin Vedernikov).

fixBackported in: S3 client check initial url in backup client. (Konstantin Vedernikov).

fixBackported in: Fix missing rows in hasAllTokens and hasAnyTokens searches over a text index when an earlier query with the same predicate read a narrower key range of the same part and use_text_index_postings_cache was enabled. (Anton Popov).

fixBackported in: Fix a crash when reading an ORC file whose root type is not a struct (for example, a file written with a bigint or array root type). Such files are now rejected with an INCORRECT_DATA error. Closes. (Groene AI).

fixBackported in: Fixed a crash and wrong results with convert_query_to_cnf = 1 when WHERE or HAVING references the same SELECT alias more than once. (Groene AI).

otherNO CL ENTRY: 'Revert "Backport to 26.9: Skip the direct join when the right table has a row policy"'. (Vladimir Cherkasov).

otherBackported in: Hide a Backup locator named like a COLUMNS matcher in EXPLAIN AST instead of throwing. (Groene AI).

otherBackported in: Do not dereference a null logs_queue in OwnSplitChannel::log. (Groene AI).

26.9.8.3 Oct 1, 2026 Release notes ↗

fixBackported in: Fix the Kafka and NATS table engines ignoring remote_url_allow_hosts: broker addresses from kafka_broker_list, nats_url, and nats_server_list are now checked against the remote host filter. A forbidden address is rejected at CREATE TABLE with UNACCEPTABLE_URL, as the RabbitMQ engine…

breakingBackported in: Remove --icf=safe linker warnings about SHT_LLVM_ADDRSIG in the stripped Rust libraries. (Raúl Marín).

26.9.7.9 Sep 30, 2026 Release notes ↗

otherBackported in: Parse some (geo) parquet metadata lazily. (Konstantin Vedernikov).

fixBackported in: Fixed max_memory_usage and max_server_memory_usage not being respected when reading a JSON column with the FLATTENED serialization version from the Native format. (Pavel Kruglov).

fixBackported in: Fixed out-of-bounds reads when reading a JSON or Dynamic column from a malformed Native block or a corrupted data part. A truncated stream, a duplicate type in a flattened Dynamic column, a duplicate or typed-colliding path in a JSON column, and a serialization version that is only…

fixBackported in: Kafka producer and consumer trace logs now show the value of secret librdkafka properties, such as sasl.password, as [HIDDEN] instead of the cleartext value. (János Benjamin Antal).

fixBackported in: Now clickhouse masks credentials in system.query_log even for wrong URLs for external table engines. (alesapin).

fixBackported in: The value of 'role_session_name' as of now is hidden in query_log. (Alexey Bakharew).

fixBackported in: Fix Keeper silently giving a new session to a ZooKeeper client (for example the Java client or kazoo) that reconnects and asks to continue its session. Such a client now gets SessionExpired, ZooKeeper's answer for a session that cannot be continued, instead of losing its ephemeral…

fixBackported in: Fix validation of Iceberg manifest-list entries during writes. (Arsen Muk).

26.9.6.6 Sep 29, 2026 Release notes ↗

breakingBackported in: Update the zxc library to v0.14.0, which changes the compressed block format of the experimental ZXC codec. Data written with CODEC(ZXC) by earlier versions cannot be read by the new version and fails with CANNOT_DECOMPRESS. If you used the experimental ZXC codec, re-encode the…

otherBackported in: Build Iceberg min/max hyperrectangles only for columns the filter uses. (Konstantin Vedernikov).

featureBackported in: Added the http_x_clickhouse_format_overrides_output_format setting (default true). When disabled, the X-ClickHouse-Format HTTP header only sets default_format, as it did before version 26.8, instead of overriding the FORMAT clause of the query via output_format. (Alexey Milovidov).

fixBackported in: Fixed a crash in plus and minus of an array of dates and an array of tuples holding NULL, for example toString([toDateTime64(1, 3)] + [(2, NULL)]), and the exception ColumnTuple cannot have ColumnConst as its element when adding a constant interval to a non-constant interval of…

fixBackported in: Link with --icf=safe instead of --icf=all, so the linker keeps functions whose address is taken distinct. gRPC queries with transport compression (gzip, deflate) no longer crash the server, as they could in official builds since 26.4. Closes. (Groene AI).

26.9.5.2 Sep 28, 2026 Release notes ↗

fixBackported in: The command line client no longer shows the as-you-type hints on a query recalled from the history (or otherwise displayed at once, e.g. pasted), so pressing Up/Down continues to navigate the history instead of the hint list. The hints appear again as soon as the line is edited.…

26.9.4.3 Sep 27, 2026 Release notes ↗

otherBackported in: A single-level GROUP BY result smaller than max_block_size is now split into several blocks when it was aggregated by several threads, so the steps after it, such as the probe of a following join, run in parallel instead of on one thread. Previously such queries could be several…

fixBackported in: Fixed a heap-use-after-free when a correlated subquery reading a Merge table was planned inside EXPLAIN, a subquery in FROM, a view or an IN subquery. (Groene AI).

26.9.3.38 Sep 26, 2026 Release notes ↗

featureBackported in: You can now disable reading through the executable table function and from Executable/ExecutablePool tables with the new allow_executable_tables setting, for a deployment that must not run arbitrary server-side scripts. It defaults to true, so existing behavior is unchanged. (Hanzi…

otherBackported in: Speed up extracting a value from a Map with LowCardinality keys. The key is now resolved to its dictionary position once instead of being compared against every entry of a row, so the cost of m[key] no longer grows with the position of the key in the row. Also fix extracting a value…

otherBackported in: Chained ARRAY JOINs no longer materialize the whole block of a lazily replicated array column before expanding it, which cuts their peak memory by several times. (Yarik Briukhovetskyi).

featureBackported in: Iceberg tables whose manifest file headers carry a schema that conflicts with the schema registered for the same schema-id in metadata.json are now readable: the metadata.json schema is preferred and the divergent manifest header copy is ignored with a warning, no matter which of…

featureBackported in: Add column size statistics in Avro files. (Konstantin Vedernikov).

otherBackported in: The AI function per-query quotas are now disabled by default: ai_function_max_input_tokens_per_query (previously 1000000), ai_function_max_output_tokens_per_query (previously 500000) and ai_function_max_api_calls_per_query (previously 1000) default to 0, meaning no limit. To keep…

otherBackported in: Do not drop the ClickHouse Keeper session when the client's outgoing request queue stays full for longer than operation_timeout_ms. The enqueue wait is now three times session_timeout_ms, so a short burst of backpressure no longer terminates the session and invalidates all its…

featureBackported in: Added the setting analyzer_compatibility_allow_cte_redefinition. When enabled, a CTE name may be defined more than once in a single WITH clause; a later definition shadows the earlier one as the query analysis before 24.3 did (a redefinition can read the previous definition, the…

fixBackported in: Fixed dropping whole parts with TTL (ttl_only_drop_parts = 1) still reading all data from large, fully-expired parts. (Michael Jarrett).

fixBackported in: Fixes a server crash (double free) when finalizing an aggregate function with the -State combinator nested under a combinator that transfers several sub-states in one call (-Resample, -ForEach, -Map, -Tuple), for example groupArrayStateResample, if an exception such as a memory…

fixBackported in: Fixed Iceberg INSERT writing no lower_bounds/upper_bounds at all into the manifest entry when the table has a column whose type cannot be serialized into a statistics bound (for example Array(Int32)), or a column that is entirely NULL. Such a field is now omitted individually and…

fixBackported in: Fixed SQL injection through identifiers when inserting into a table with the SQLite engine. The remote table name and the column names were escaped with backslashes, which SQLite does not honour inside a quoted identifier, so a name containing a double quote could close its own…

fixBackported in: Fixed a Backup database engine printing the credentials of its destination in plaintext. SHOW CREATE DATABASE, system.databases.engine_full, system.query_log and the messages that reject a malformed locator showed an AzureBlobStorage account_key, a connection string or a presigned…

fixBackported in: KILL TRANSACTION ... ON CLUSTER, KILL PART_MOVE_TO_SHARD ... ON CLUSTER, SYSTEM STOP THREAD FUZZER ON CLUSTER, SYSTEM START THREAD FUZZER ON CLUSTER and SYSTEM RESET COVERAGE ON CLUSTER ran without checking any privilege, so a user holding only CLUSTER could roll back other users'…

fixBackported in: ALTER DATABASE ... MODIFY COMMENT on a database with ENGINE = Backup no longer writes a definition the server cannot read back, which made it refuse to start; metadata already written in that form now loads too. Backward incompatibility: a backup taken by an older server of a…

fixBackported in: Fix a patch part whose source_parts.dat lost its content to a zeroed block loading as an empty index, which silently unapplied an acknowledged lightweight UPDATE and then let background cleanup delete the only copy of it. Such a part is now detached as broken. (Alexey Milovidov).

fixBackported in: Fixed http_max_multipart_form_data_size silently truncating oversized multipart data instead of failing the query, and made it span a form's external-table parts instead of resetting per part. (Sema Checherinda).

fixBackported in: Fixed two ways a table with the Redis engine mishandled an MGET reply. Reading the whole table stopped at the first key without a string value and silently dropped every key scanned after it, so one key of another Redis type was enough to truncate the result. A reply carrying a…

fixBackported in: Bound the header column count in RowBinary formats to avoid excessive memory allocation from a crafted header. (George Larionov).

fixBackported in: Fixed settings constraints from a settings profile not being enforced against the other setting assignments in the same statement. SET profile = 'p', = could override a CONST, MIN/MAX or readonly constraint that profile p installs. The same escape existed through an in-query…

fixBackported in: Fixes a segmentation fault that happens when a refreshable materialized view is started up and shut down at the same time, for example when a failed ATTACH DATABASE rolls the database back, or when the server shuts down while tables are still loading asynchronously. (Groene AI).

fixBackported in: Fixed a performance regression where a query whose WHERE requires the same expression to equal two different constants stopped being recognized as always false when compatibility was set below 26.7, or when optimize_redundant_comparisons was disabled explicitly. Such a query…

fixBackported in: TRUNCATE ALL TABLES FROM and TRUNCATE TABLES FROM ... LIKE ... now skip Alias tables, which hold no data of their own. Previously such a statement could fail with LOGICAL_ERROR: RWLock is already locked in exclusive mode, truncate a target in another database, or fail when the alias…

fixBackported in: The text, tokenbf_v1, ngrambf_v1 and sparse_grams skip indexes are now used for IN when transform_null_in = 1 and the set contains no NULL. Previously such a query read every granule, and one using force_data_skipping_indices failed with INDEX_NOT_USED. (Jimmy Aguilar Mena).

fixBackported in: Fixed an out-of-bounds heap write in stem. The output buffer was sized from the input, but some stemmers lengthen a word (Turkish uag → uagı, Estonian keeb → keesi), so a block overran its allocation and returned uninitialized heap as result values. The buffer now grows when the…

fixBackported in: remote(, 'db', 'table', 'user', 'password'), and the same form of remoteSecure and of the Remote and RemoteSecure table engines, wrote the password into system.query_log, system.text_log and the server log in cleartext, while the remote('addresses_expr', ...) form hid it. The…

fixBackported in: Fix wrong values and a LOGICAL_ERROR when reading a partitioned Delta Lake table with allow_delta_kernel_rs = 0 and column types that differ from the ones in _delta_log. (Raúl Marín).

fixBackported in: Fixed a crash when deserializing an AST from JSON (formatQueryFromJSON, the clickhouse_json dialect): a deeply nested document exhausted the stack and killed the process with no log line. Such payloads now fail with TOO_DEEP_RECURSION. (Groene AI).

fixBackported in: Fixed a crash (stack exhaustion) in parseQueryToJSON when serializing a query nested deeper than the serializer could follow, reachable by raising max_parser_depth above its default. Such a query now fails with TOO_DEEP_RECURSION instead of terminating the server. (Groene AI).

fixBackported in: Fixed a server crash when the flameGraph aggregate function was constructed on a thread without a query context, for example while attaching a stored table whose column type names AggregateFunction(flameGraph, ...). (Groene AI).

fixBackported in: Fix a segmentation fault in Keeper when preallocating space for a changelog file fails because the disk is full. (Alexey Milovidov).

otherBackported in: Update cctz to 2026d. Time zone names with the file: prefix are now rejected. (Actuele AI).

otherBackported in: Reject a compressed block whose codec stores data verbatim (NONE, Quantized) when its declared uncompressed size does not match the body length. Previously the passthrough read path accepted such a block while every other decompression path rejected it. (Groene AI).

fixBackported in: Fix flaky 01780_column_sparse: order the arrayFilter result before limiting it. (Alexey Milovidov).

otherBackported in: Make test_multi_consumer_with_partition_affinity deterministic. (Aparajita Pandey).

fixFix 26.9 upgrade check. (Azat Khuzhin).

otherBackported in: Small performance optimisations of iceberg read path. (Konstantin Vedernikov).

26.9.2.8 Sep 22, 2026 Release notes ↗

breakingBackported in: A MySQL dictionary source created with a CREATE DICTIONARY query can no longer enable enable_local_infile, at the source or at one of its REPLICA entries; loading such a dictionary fails with BAD_ARGUMENTS, which with the default dictionaries_lazy_load is on first use rather than at…

fixBackported in: Fixes a case where date_time_overflow_behavior was ignored on parsing Date and DateTime. Closes. (Yarik Briukhovetskyi).

fixBackported in: Fix ALTER TABLE ... MODIFY SETTING name = DEFAULT skipping the checks an engine makes on a setting reset: TimeSeries allowed an immutable setting to be dropped, leaving the table unwritable, Memory removed a setting from the table definition while the table kept enforcing the old…

fixBackported in: Fix wrong results when a GROUP BY, DISTINCT, LIMIT BY or window PARTITION BY key was plus or minus of a partition column with a non-integer constant, for example f + 1.0 on Float64 or d + INTERVAL 1 MONTH on Date. Such a key was assumed injective, so each table partition was…

fixBackported in: Fix a server crash (std::terminate with write failed) in the embedded SSH client when the client's terminal was closed before the line reader was destroyed. (Alexey Milovidov).

fixBackported in: Fix spurious NATS connection failures when the vendored nats-io client gets EINTR while waiting for a socket, and include the upstream JetStream pull-subscription deadlock fix in the vendored client. (Alexey Milovidov).

otherBackported in: . (Antonio Andelic).

26.9.1.1629 Sep 21, 2026 Release notes ↗

breakingThe default compression method is changed from LZ4 to ZSTD(3). For client/server and server/server network communication it switches uniformly to ZSTD(3). For on-disk table data, MergeTree column data now uses a size-aware built-in default — LZ4 below 100 MB and ZSTD(3) at or above it, applied to…

breakingRemoved the CatBoost integration. The catboostEvaluate function, the system.models table and the SYSTEM RELOAD MODEL(S) queries are no longer available. Queries, views and grants referring to them have to be migrated before the upgrade: in particular, revoke SYSTEM RELOAD MODEL from all users and…

breakingFix setting temporary_files_buffer_size or format_avro_schema_registry_* to an out-of-range value making every subsequent query in the session fail, with no way to recover; the values are now bounded when they are set. (Pedro Ferreira).

breakingFixed wrong results from runningConcurrency. Its value depends on the rows processed before it, but it declared itself deterministic within a query, so a predicate on it above a LEFT or ANY join let optimizer passes rewrite the join and change the row set it sees, and if, multiIf, and and or…

breakingThe experimental WINDOW VIEW feature is removed, together with the WATCH statement and the windowID function. It has been non-functional since version 24.12 (inserts into the source table were silently not delivered to window views) and was never supported by the analyzer, which is enabled by…

breakingRemoved the deprecated read_resource and write_resource disk options from storage_configuration. Attach a scheduler resource to a disk with CREATE RESOURCE name (READ DISK disk, WRITE DISK disk) instead. (Sergei Trifonov).

breakingRemoved the WasmEdge engine for WebAssembly UDFs. wasmtime, which has always been the default, is now the only supported value of the webassembly_udf_engine server setting. A server configured with wasmedge will not start; remove that setting or set it to wasmtime. On binaries where wasmtime is…

breakingRemoved the sharded GROUP BY aggregation (setting enable_sharding_aggregator, disabled by default) in favor of the adaptive aggregation (enable_adaptive_aggregator, enabled by default), which targets the same high cardinality workloads without the weaknesses on skewed or low-cardinality keys and…

breakingBackported in: Outbound TLS connections now verify that the server certificate names the host that was connected to. This affects clickhouse-client --secure, remoteSecure(), Distributed over the secure native protocol, secure Keeper connections, and HTTPS clients such as s3(), url(), HTTP…

breakingmax_bytes_before_external_join and max_bytes_ratio_before_external_join are now the spill threshold for every hash-based join_algorithm, including grace_hash, which previously ignored them and spilled on max_rows_in_join / max_bytes_in_join instead. Those two are a hard cap again for every…

breakingSetting allow_experimental_codecs is obsolete. Use the per-codec settings enable__codec instead. (Raufs Dunamalijevs).

breakingReading a File source with rename_files_after_processing set now requires the WRITE ON FILE grant on top of READ ON FILE, on the initiator for fileCluster: the setting renames the files a SELECT has read, which is a write to the source, and it used to happen for anyone who could read them. A query…

breakingThe interface and http_method columns of system.query_log, system.query_thread_log and system.processes are now Enum8 instead of UInt8, over the value set system.session_log.interface already uses, plus Unknown for an unrecognized reported interface. Comparing to a number keeps working (WHERE…

breakingThe analyzer can no longer be disabled: the enable_analyzer setting (and its old name allow_experimental_analyzer) is obsolete, an attempt to set it to 0 is rejected, and the compatibility setting no longer reverts it. The analyzer has been the default since 24.3, and the query analysis used…

breakingCREATE TABLE ... AS mergeTreeIndex(...) is no longer accepted, nor the same form over mergeTreeProjection, mergeTreeAnalyzeIndexes, mergeTreeAnalyzeIndexesUUID, mergeTreeTextIndex and mergeTreeCodecBlockCounts. The storage these functions return holds its source table's storage object, so once…

breakingHeaders that Google Cloud Storage spells with an x-goog- prefix are now translated for every request, not only for server-side copies. Custom object metadata written to GCS over the S3 API without HMAC credentials — how ClickHouse Cloud on GCP accesses object storage — previously did not take…

breakingNullable(Tuple(...)) is now generally available and enabled by default. Nullable(Tuple(...)) columns can be created without any setting, schema inference of nullable structs in the Parquet, Arrow, ORC, Avro and JSON formats returns Nullable(Tuple(...)), and a Tuple subcolumn extracted from a…

breakingRemove s3_disable_checksum, since checksum calculation for S3 does not read the source second time anymore (previously the problem was that sources has been read twice, once for sending data, second for checksum calculation). (Azat Khuzhin).

breakingCREATE TABLE ... AS timeSeriesSamples(...) is no longer accepted, nor over its alias timeSeriesData or over timeSeriesTags and timeSeriesMetrics. The persisted proxy renamed that live target table in memory on first read: DROP TABLE then dropped the user's table and destroyed its rows, and reads…

breakingNew setting validate_group_by_all_key_types (default true) gates the key type validation that GROUP BY ALL applies to the grouping keys it expands the SELECT expressions into. Since 26.7 it rejects a Variant or Dynamic grouping key, for example an untyped JSON subpath, that earlier versions…

featureOperations '+' and '-' between DateTime and Time data types. (Yarik Briukhovetskyi).

featureAdded the opt-in MergeTree setting skip_empty_columns_on_insert, which avoids storing columns containing only their type-default value. It requires serialization_info_version = 'with_missing_columns'; keep an older serialization version during rolling upgrades with servers that cannot read the new…

featureNew LIMIT forms that select rows by boundary conditions instead of by position, following the stream order (use ORDER BY to define it): LIMIT n AFTER cond returns up to n rows starting at the first row where cond is true (SELECT number FROM numbers(10) ORDER BY number LIMIT 3 AFTER number >= 5…

featureAdd type_json_skip_null_typed_paths setting for JSON type. When enabled, typed paths in JSON columns that have NULL values are treated as absent, matching the behavior of dynamic paths. Closes:. (Pavel Kruglov).

featureAdd support for accessing JSON subcolumns using bracket syntax, e.g. json['key1']['key2'], which the parser translates to nested arrayElement calls. (Pavel Kruglov).

featureSupport BACKUP/RESTORE for WORKLOAD and RESOURCE entities. SQL-defined CREATE WORKLOAD / CREATE RESOURCE definitions are now included when backing up system.workloads / system.resources and are recreated on restore, including ON CLUSTER. (Sergei Trifonov).

featureAuthentication methods in CREATE USER and ALTER USER ... ADD IDENTIFIED support a GRANTS (SELECT ON db.table, ...) clause which limits the access rights of sessions authenticated with that method to the intersection with the listed grants. This allows using additional credentials as tokens for…

featureAdded the system.session_query_ids system table, which contains the query ids of the queries executed in the current session, in execution order. It makes it easy to find "the queries I just ran" in system.query_log without assigning query_id client-side or tagging queries with log_comment, which…

featureAdds support for mode='exclusive' in S3Queue engine, for high-throughput and self-hosted scenarios. (Ivan Tkatchev).

featureDisks with the plain_rewritable metadata (s3_plain_rewritable, and azure/local object storages with metadata_type = plain_rewritable) support hard links if configured with the new enable_hard_links setting, which enables ALTER operations and mutations on MergeTree tables stored on them. Mutations…

featureNew function arrayFlattenedLength, returning the total number of elements of a multidimensional array, as if it was flattened with arrayFlatten. Unlike cardinality/length, which count only the elements of the outermost array, it counts elements at every nesting level, matching PostgreSQL's…

featureRefreshable materialized views can now refresh incrementally with REFRESH ... APPEND INCREMENTAL, appending only the rows committed to the source table since the previous refresh instead of re-reading the whole source. (Smita Kulkarni).

featureSupport exactly-once incremental refresh of refreshable materialized views into Iceberg targets by committing the refresh cursor atomically inside the Iceberg snapshot summary. (Smita Kulkarni).

featureAdd MergeTree settings max_table_size_rows, max_table_size_bytes_compressed, and max_table_size_bytes_uncompressed that limit the total size of a table. The limits are checked at the beginning of INSERT and when new data parts are committed (including the results of background merges and…

featureclickhouse-client accepts --ssh-key-file without a value: the key is looked up the same way as ssh does it - the identity files configured for the host in ~/.ssh/config, the default identity files, such as ~/.ssh/id_ed25519, and the keys held by the ssh-agent. Authentication with a key held by the…

featureAdd the max_tables database setting to limit the number of tables in Atomic and Ordinary databases. Every table-like object counts toward the limit: tables, views and dictionaries. (Alexey Milovidov).

featureJemalloc Fragmentation Profiler. (Azat Khuzhin).

featureNew text index tokenizer keyValuePairs, which indexes a Map(String, String) column directly and answers map['key'] = 'value' from the index without reading the map column. (Jimmy Aguilar Mena).

featureIceberg v3 has two new fields in manifest file - first_row_id and last_seq_num. This PR allows to read them as virtual columns. (Konstantin Vedernikov).

featureAdded nats_ca_file, nats_client_cert_file and nats_client_key_file settings to the NATS engine, for verifying a broker certificate signed by a private CA and for client-certificate authentication. The feature was first proposed in by sidhmads. (Nikolay Degterinsky).

+1346 more items in the release notes

26.8.33.10 Oct 21, 2026 Release notes ↗

otherBackported in: An equality with a Bool value that no statistics can estimate, such as WHERE j.f = false on a JSON path, a Bool column without statistics, or IN with a Bool set, is now estimated to match half of the rows per value instead of 1%, so a join on such a filtered table builds its hash…

otherBackported in: A JOIN whose ON condition has a constant-false conjunct now works with the experimental parallel_replicas_plan_based setting when the join uses grace_hash, spills to disk, or runs with join_use_nulls = 1, instead of terminating the server or failing with NOT_FOUND_COLUMN_IN_BLOCK.…

fixBackported in: Mask credentials embedded in HTTP URIs. (Han Fei).

fixBackported in: Creating a FileLog tables now require READ and WRITE privileges, analogous to File tables. (Robert Schulze).

fixBackported in: Fixed a heap-use-after-free in the view dependency graph after renaming a materialized view whose query selects from itself. CREATE MATERIALIZED VIEW and ALTER TABLE ... MODIFY QUERY now reject a query that makes a materialized view select from itself. (Groene AI).

fixBackported in: Fix use-after-free in complex key ssd_cache dictionaries when the cache file wraps around its partitions. Fix CANNOT_READ_ALL_DATA when reading long values of ssd_cache dictionaries from the cache file. (Alexey Milovidov).

fixBackported in: Fixed count() with WHERE d = toDate32('1900-01-01') (or !=) over a MergeTree Date32 column returning the number of 1970-01-01 rows when optimize_trivial_count_with_sparsity_filter is enabled (the default since 26.8). Closes. (Groene AI).

fixBackported in: Fix polygonConvexHullCartesian returning garbage for a polygon with an empty exterior ring and a non-empty interior ring. (Alexey Milovidov).

otherBackported in: Make 03673_columns_description_cache and 04257_102926_columns_descriptions_cache_nested_eviction robust to asynchronous part removal, applying the fix already made to their sibling 04510_shared_part_schema_metadata_eviction. (Groene AI).

26.8.32.14 Oct 20, 2026 Release notes ↗

breakingBackported in: CREATE TABLE x AS src inherits the credentials embedded in the engine of src, which are masked in SHOW CREATE TABLE. It now requires the SELECT privilege on src when the inherited definition can carry credentials, instead of only SHOW COLUMNS. (Yarik Briukhovetskyi).

otherBackported in: Reduce repeated IN evaluation when many adjacent singleton row-mask updates are applied to one part. (Sergey Kuznetsov).

featureBackported in: Estimating subcolumn sizes for PREWHERE (for example m['key'] of a Map(LowCardinality(String), String) column) no longer reads the LowCardinality dictionary or the Variant discriminators header of every data part, which made planning slow on object storage, especially for each new…

otherBackported in: BACKUP uses less memory per file it backs up: an entry of the backup no longer keeps a copy of the description of the disk the file is on. A backup of a table with millions of files saves a few gigabytes. (Julia Kartseva).

fixBackported in: Fixed a server crash and an out-of-bounds write when inserting into a column with a long chain of compression codecs, for example CODEC(FPC, FPC, ..., FPC). CompressionCodecMultiple compounded each stage's reserved size in a UInt32 without checking for overflow, so a long enough…

fixBackported in: Fixed a read of uninitialized memory when a Variant, Dynamic or JSON column holding only NULL values is compressed, for example on insert into a Memory table created with compress = 1, or when a block is compressed for a JOIN or for the query result cache. The reported size of such…

fixBackported in: BACKUP and RESTORE to S3 retry requests that fail with ExpiredToken after refreshing credentials. The retry time limit is 120 seconds by default and can be changed with backup_s3_expired_token_retry_timeout_ms. (Nikolai Ovchinnikov).

fixBackported in: Fixed a server crash (or missing rows in the view, with a Null source table) on INSERT into the source table of a materialized view when a row policy or additional_table_filters of a table read by the view references the source table, e.g. USING x IN src. (Groene AI).

fixBackported in: Fix a segmentation fault in GROUP BY with the adaptive aggregator and external aggregation when a memory limit was hit while draining staged records. (Alexey Milovidov).

fixBackported in: Fix segfault when reading a MySQLDump file whose CREATE TABLE query has an ENUM column without a list of values or with non-string values. (Alexey Milovidov).

fixBackported in: Fix a stack overflow when a Redis server replies with deeply nested arrays. (Alexey Milovidov).

fixBackported in: Fix a stack overflow on a Protobuf schema with a very long chain of nested messages. (Alexey Milovidov).

otherBackported in: Not required. (Groene AI).

26.8.31.2 Oct 19, 2026 Release notes ↗

fixBackported in: Fixed crashes of the interactive line editor of clickhouse-client and clickhouse-local, which also crashed the server when used through the web terminal or an SSH session: after a history search that found nothing on an edited recalled query, when the prompt or the line given to an…

26.8.30.8 Oct 17, 2026 Release notes ↗

otherBackported in: Reduced the memory usage of incremental BACKUP: the base backup keeps only the sizes and checksums of its files instead of the full information about each file. For a base backup of millions of files this saves gigabytes. (Julia Kartseva).

otherBackported in: Compare TOTP codes and plaintext_password passwords in constant time, so that the response time does not depend on how many leading characters are correct or on which time window matched. (Vladimir Cherkasov).

fixBackported in: Fix reading dropped column with existing column in data file. Closes. (Konstantin Vedernikov).

fixBackported in: Requesting SSH-key authentication over the native protocol no longer reveals whether the named user exists, or how it authenticates, before its signature is checked. (Shaohua Wang).

fixBackported in: Reject CR and LF characters in values sent as HTTP headers or in the request line of outgoing HTTP requests (BigQuery, YTsaurus, url, DataLake catalogs, GCP OAuth, AI functions, S3 storage class), which could be used to inject headers or additional requests. (Raúl Marín).

fixBackported in: The setting http_zlib_compression_level now applies only to the gzip and deflate HTTP response compression. The level of other methods (zstd, lz4, br, xz, bz2) is controlled by output_format_compression_level. Previously, a level suitable for zlib was passed to every method, which…

fixFixes distributed queries incorrectly disabling the analyzer on shards when a native application reports its own version. Compatibility decisions use the connecting ClickHouse server's version and preserve explicit analyzer choices, including on the first query of a connection. (Ye Yuan).

26.8.29.10 Oct 16, 2026 Release notes ↗