ClickHouse 26.9.8.3 → 26.9.25.15
17 releases · 5 breaking changes · 2 security fixes · 0 advisories fixed
2security5breaking0deprecated8feature113fix
Breaking changes
- breaking Backported in: Remove object addresses from NATS, io_uring and HDFS messages. (Raúl Marín). in 26.9.24.8
- breaking Backported in: Remove object addresses from logical error messages. (Raúl Marín). in 26.9.24.8
- breaking Backported in: CREATE TABLE x AS src inherits the credentials embedded in the engine of src, which are masked in SHOW CREATE TABLE. It now requires the SELECT privilege on src when the inherited definition can carry credentials, instead of only SHOW COLUMNS. (Yarik Briukhovetskyi). in 26.9.21.9
- breaking Backported in: Overriding a key that is stored in a named collection now requires SHOW NAMED COLLECTIONS SECRETS on that collection. This also applies to overrides through an alias (including flat kafka_* settings over nested kafka.* keys), through a SETTINGS clause of a table engine or table… in 26.9.20.23
- breaking Backported in: Connections to MySQL (the mysql table function, the MySQL table and database engines, and MySQL dictionaries) that set ssl_ca or ssl_ca_pem now verify the server certificate chain and host name, after updating mariadb-connector-c to v3.4.10. Previously the CA was not enforced, so a… in 26.9.20.23
Security changes
- security Backported in: Update the vendored expat to 2.9.0, fixing a denial of service through a crafted backup manifest during RESTORE (CVE-2026-66046) and the other 2.8.3–2.9.0 security fixes. (Actuele AI). in 26.9.20.23
- security Backported in: Update mongo-c-driver to 2.5.5, fixing an out-of-bounds write during MongoDB connection monitoring reconnects (CVE-2026-96746). (Actuele AI). in 26.9.17.8
Every release in between
featureBackported in: Add the tcp_with_proxy_allow_interserver_mode server setting, which allows disabling the native protocol's interserver mode on tcp_with_proxy_port. (Pradeep Chhetri).
fixBackported in: Fix a possible crash or out-of-bounds memory access when reading from HDFS if a DataNode or NameNode sends malformed responses. (Alexey Milovidov).
otherBackported in: Improve glue catalog cache. Let's cache only mapping column name -> timestamp, not the whole metadata. (Konstantin Vedernikov).
fixBackported in: Fix a second-factor bypass in the MySQL protocol: a user configured with plaintext_password or double_sha1_password plus a time-based one-time password could authenticate with the password alone, because the mysql_native_password auth response was verified without checking the TOTP.…
fixBackported in: Fix query parameters in the filter of CREATE ROW POLICY and ALTER ROW POLICY being stored unsubstituted: a {db:Identifier} table qualifier was resolved in the current database of the query reading the table, and a value parameter made every read of the table fail. The parameters are…
fixBackported in: Fixed a row-policy bypass where an authenticated user could forge the result of a scalar subquery used in a row policy (e.g. USING has((SELECT ...), col)) by sending a Scalar packet (as with clickhouse-client --external ... --scalar) named with the subquery's query-tree hash, and…
fixBackported in: Creating a FileLog tables now require READ and WRITE privileges, analogous to File tables. (Robert Schulze).
fixBackported in: For users with a time-based one-time password, the error REQUIRED_SECOND_FACTOR is now returned whenever the code is missing, regardless of whether the password is correct. Previously a wrong password without a code returned AUTHENTICATION_FAILED, which allowed guessing the password…
fixBackported in: Keeper no longer pre-allocates memory for the array size declared in a request (for example the ACL list in Create) before it reads the array elements. Before this fix, a small malformed request could cause a large memory allocation. (Antonio Andelic).
fixBackported in: Fixed wrong strings, sometimes followed by an UNKNOWN_PACKET_FROM_SERVER error, when a sparse Nullable(String) column is sent over the native protocol to clickhouse-client or between servers by remote, cluster and Distributed, for example toString(nullIf(x, 0)) over a sparse column,…
fixBackported in: Fix polygonConvexHullCartesian returning garbage for a polygon with an empty exterior ring and a non-empty interior ring. (Alexey Milovidov).
fixBackported in: Fixes a crash in estimateCompressionRatio with codecs DoubleDelta and Gorilla. (Robert Schulze).
otherBackported in: Make 03673_columns_description_cache and 04257_102926_columns_descriptions_cache_nested_eviction robust to asynchronous part removal, applying the fix already made to their sibling 04510_shared_part_schema_metadata_eviction. (Groene AI).
otherBackported in: Do not skip the client output teardown when the terminal is gone. (Groene AI).
fixBackported in: Fixed a query silently returning fewer rows after an unrelated JOIN had run: a join runtime filter (enable_join_runtime_filters) moved into a read's PREWHERE made the read record a "no matching rows" verdict in the query condition cache for granules, or Parquet row groups, whose…
fixBackported in: Mask credentials embedded in HTTP URIs. (Han Fei).
fixBackported in: Fix a stack overflow on a deeply nested query plan received in the QueryPlan packet of the native protocol. (Alexey Milovidov).
fixBackported in: Fix use-after-free in complex key ssd_cache dictionaries when the cache file wraps around its partitions. Fix CANNOT_READ_ALL_DATA when reading long values of ssd_cache dictionaries from the cache file. (Alexey Milovidov).
fixBackported in: Fixed count() with WHERE d = toDate32('1900-01-01') (or !=) over a MergeTree Date32 column returning the number of 1970-01-01 rows when optimize_trivial_count_with_sparsity_filter is enabled (the default since 26.8). Closes. (Groene AI).
breakingBackported in: Remove object addresses from NATS, io_uring and HDFS messages. (Raúl Marín).
breakingBackported in: Remove object addresses from logical error messages. (Raúl Marín).
otherBackported in: Reduce repeated IN evaluation when many adjacent singleton row-mask updates are applied to one part. (Sergey Kuznetsov).
featureBackported in: Estimating subcolumn sizes for PREWHERE (for example m['key'] of a Map(LowCardinality(String), String) column) no longer reads the LowCardinality dictionary or the Variant discriminators header of every data part, which made planning slow on object storage, especially for each new…
otherBackported in: BACKUP uses less memory per file it backs up: an entry of the backup no longer keeps a copy of the description of the disk the file is on. A backup of a table with millions of files saves a few gigabytes. (Julia Kartseva).
otherBackported in: Fatal error reports no longer contain runtime memory addresses: stack frames and the fault address are printed as offsets inside the executable or a library, which can be passed to addr2line, and other addresses are hidden. system.crash_log.fault_address now contains the offset…
otherBackported in: A JOIN whose ON condition has a constant-false conjunct now works with the experimental parallel_replicas_plan_based setting when the join uses grace_hash, spills to disk, or runs with join_use_nulls = 1, instead of terminating the server or failing with NOT_FOUND_COLUMN_IN_BLOCK.…
fixBackported in: Fixed a read of uninitialized memory when a Variant, Dynamic or JSON column holding only NULL values is compressed, for example on insert into a Memory table created with compress = 1, or when a block is compressed for a JOIN or for the query result cache. The reported size of such…
fixBackported in: BACKUP and RESTORE to S3 retry requests that fail with ExpiredToken after refreshing credentials. The retry time limit is 120 seconds by default and can be changed with backup_s3_expired_token_retry_timeout_ms. (Nikolai Ovchinnikov).
fixBackported in: Fixed a server crash (or missing rows in the view, with a Null source table) on INSERT into the source table of a materialized view when a row policy or additional_table_filters of a table read by the view references the source table, e.g. USING x IN src. (Groene AI).
fixBackported in: Fix a segmentation fault in GROUP BY with the adaptive aggregator and external aggregation when a memory limit was hit while draining staged records. (Alexey Milovidov).
fixBackported in: Fix segfault when reading a MySQLDump file whose CREATE TABLE query has an ENUM column without a list of values or with non-string values. (Alexey Milovidov).
fixBackported in: Fixed a heap-use-after-free in the view dependency graph after renaming a materialized view whose query selects from itself. CREATE MATERIALIZED VIEW and ALTER TABLE ... MODIFY QUERY now reject a query that makes a materialized view select from itself. (Groene AI).
fixBackported in: Fix a stack overflow when a Redis server replies with deeply nested arrays. (Alexey Milovidov).
fixBackported in: Fix a stack overflow on a Protobuf schema with a very long chain of nested messages. (Alexey Milovidov).
otherBackported in: Not required. (Groene AI).
otherBackported in: An equality with a Bool value that no statistics can estimate, such as WHERE j.f = false on a JSON path, a Bool column without statistics, or IN with a Bool set, is now estimated to match half of the rows per value instead of 1%, so a join on such a filtered table builds its hash…
fixBackported in: Fixed crashes of the interactive line editor of clickhouse-client and clickhouse-local, which also crashed the server when used through the web terminal or an SSH session: after a history search that found nothing on an edited recalled query, when the prompt or the line given to an…
breakingBackported in: CREATE TABLE x AS src inherits the credentials embedded in the engine of src, which are masked in SHOW CREATE TABLE. It now requires the SELECT privilege on src when the inherited definition can carry credentials, instead of only SHOW COLUMNS. (Yarik Briukhovetskyi).
otherBackported in: Reduced the memory usage of incremental BACKUP: the base backup keeps only the sizes and checksums of its files instead of the full information about each file. For a base backup of millions of files this saves gigabytes. (Julia Kartseva).
otherBackported in: Compare TOTP codes and plaintext_password passwords in constant time, so that the response time does not depend on how many leading characters are correct or on which time window matched. (Vladimir Cherkasov).
otherBackported in: The nodes in the output of EXPLAIN AST graph = 1 are numbered sequentially instead of being identified by memory addresses, so the output is the same on every run. (Raúl Marín).
fixBackported in: Requesting SSH-key authentication over the native protocol no longer reveals whether the named user exists, or how it authenticates, before its signature is checked. (Shaohua Wang).
fixBackported in: Reject CR and LF characters in values sent as HTTP headers or in the request line of outgoing HTTP requests (BigQuery, YTsaurus, url, DataLake catalogs, GCP OAuth, AI functions, S3 storage class), which could be used to inject headers or additional requests. (Raúl Marín).
fixBackported in: The setting http_zlib_compression_level now applies only to the gzip and deflate HTTP response compression. The level of other methods (zstd, lz4, br, xz, bz2) is controlled by output_format_compression_level. Previously, a level suitable for zlib was passed to every method, which…
otherBackported in: Use node ids instead of addresses in pipeline diagnostics. (Raúl Marín).
breakingBackported in: Overriding a key that is stored in a named collection now requires SHOW NAMED COLLECTIONS SECRETS on that collection. This also applies to overrides through an alias (including flat kafka_* settings over nested kafka.* keys), through a SETTINGS clause of a table engine or table…
breakingBackported in: Connections to MySQL (the mysql table function, the MySQL table and database engines, and MySQL dictionaries) that set ssl_ca or ssl_ca_pem now verify the server certificate chain and host name, after updating mariadb-connector-c to v3.4.10. Previously the CA was not enforced, so a…
otherBackported in: A filter on the PARTITION BY columns of a window function is no longer pushed below the window (this reverts). The push-down made queries up to 8 times slower when the window reads a JOIN and the filter removes every row, for example IN over an empty subquery, because the join built…
otherBackported in: A packet that cannot appear at the current point of the native protocol is now rejected without deserializing its payload. Previously the server deserialized the body of an unexpected Data packet — including arbitrary data types and aggregate function states — only to throw…
featureBackported in: Add S3 bucket to remote_url_allow_hosts. (Konstantin Vedernikov).
otherBackported in: Reduced the peak memory usage of RESTORE and of incremental BACKUP: the metadata file of a backup is now parsed while it is read, instead of being read into memory whole first. For backups of millions of files this saves gigabytes. (Julia Kartseva).
fixBackported in: Fixed a crash caused by a stack overflow when a deeply nested JSON document was parsed into a JSON column or passed to the JSONExtract family of functions. Such documents are now rejected with the TOO_DEEP_RECURSION error. (Pavel Kruglov).
fixBackported in: Fix a server crash when a RIGHT JOIN/FULL JOIN is planned for parallel replicas (parallel_replicas_plan_based=1) and the join output header declares a column by type only — e.g. the residual column of a constant NULL conjunct in the ON clause. Type-only header columns are now…
fixBackported in: Fixed CANNOT_READ_ALL_DATA (while reading prefix of column ...) during query planning when a MergeTree table has an active empty Wide part, left by a TTL drop or by a mutation that deleted all rows of a part, and the query filters on a subcolumn, such as a key of a…
securityBackported in: Update the vendored expat to 2.9.0, fixing a denial of service through a crafted backup manifest during RESTORE (CVE-2026-66046) and the other 2.8.3–2.9.0 security fixes. (Actuele AI).
fixBackported in: Fixed loading, short ATTACH, and UNDROP TABLE for existing SQL-defined S3 disks whose endpoints are absent from remote_url_allow_hosts; new full-definition CREATE and ATTACH still reject disallowed endpoints. (Alexey Bakharew).
fixBackported in: Fixed ORDER BY ... LIMIT over a column of an Interval type (or Nullable, LowCardinality, Tuple or Array of one) failing with TYPE_MISMATCH when use_top_k_dynamic_filtering is enabled, which is the default. Closes. (Groene AI).
fixBackported in: Fixed a stack overflow crash on a deeply nested CapnProto schema that the nesting depth check missed: a comment or a byte order mark between import and its path, an escape sequence in the import path, or a backtick text line. A backtick text line with many brackets is no longer…
fixBackported in: Fixed a possible segmentation fault when reading an Avro map into a Map column (for example Map(DateTime, String)) with the AvroConfluent format, including Kafka tables. Closes. (Groene AI).
fixBackported in: Fixed an issue where pressing Ctrl-R and then Ctrl-Z in the web terminal or the SSH interface suspended the whole server process. (Alexey Milovidov).
fixBackported in: Fix a wrong result, or an exception in debug builds, when optimize_aggregators_of_group_by_keys eliminated any, min or max of a GROUPING SETS key with group_by_use_nulls. (Alexey Milovidov).
fixBackported in: Fixed a server crash when a RabbitMQ table with the headers exchange type had a routing key without =, or when rabbitmq_routing_key_list was empty. Routing keys without = for the headers exchange type are now rejected with an exception. The problem was found and reported by @dstesk…
fixBackported in: Allow to do vertical merge if result part storage type is not Full. (alesapin).
fixBackported in: Fixed a crash (stack overflow) on a CapnProto schema with a long chain of type expression suffixes (Int32.a.a..., Int32()()...) or of declarations that refer to each other (constants, aliases, struct fields, annotations, imports). Such a schema is now rejected with The CapnProto…
fixBackported in: Fixed Reading in parallel from replicas is enabled but cluster to execute query is not provided (CLUSTER_DOESNT_EXIST) when selecting from a Distributed table whose cluster is not declared in remote_servers - the cluster of a Replicated database, or one found by cluster discovery -…
otherBackported in: Update vectorscan to 5.4.13. (Actuele AI).
otherBackported in: Observed as a bottleneck in the ci-logs cluster. (Mikhail Artemenko).
otherBackported in: DROP TABLE, DETACH TABLE, server shutdown and ALTER TABLE ... MODIFY SETTING refresh_statistics_interval no longer wait until a running background refresh of the statistics cache of a MergeTree table has read the statistics of every part. On object storage with thousands of parts…
fixBackported in: Fix ALTER TABLE ... MATERIALIZE STATISTICS / DROP STATISTICS failing forever and wedging the table's mutation queue when a server profile sets allow_statistics = 0 and the statement enables it per-session, the same opt-in ADD STATISTICS honours. Also close a hole where MATERIALIZE…
fixBackported in: Fix a credential written in cleartext to system.query_log and the server log when a key = value argument precedes the positional arguments of the mongodb, redis, remote, arrowFlight and ytsaurus table functions or the MongoDB, Redis, Remote, ArrowFlight, ExternalDistributed and…
fixBackported in: Fixed queries that go through another server (remote, Distributed, parallel replicas, GLOBAL IN) failing with SYNTAX_ERROR, UNKNOWN_CODEC or CORRUPTED_DATA when output_format_native_encode_types_in_binary_format or input_format_native_decode_types_in_binary_format is enabled. The…
fixBackported in: Free prefetched messages when StorageKafka2 partitions move between consumers, preventing per-partition memory growth until restart. (Aparajita Pandey).
fixBackported in: The web terminal and the SSH interface no longer reset the settings of the user (from settings profiles, roles, and CREATE USER ... SETTINGS) to default values. Previously, restrictions such as readonly, resource limits, and additional_table_filters were not applied in these…
fixBackported in: Don't fuse a filter into ARRAY JOIN before its row-only part is lifted below it, so the element filter doesn't copy the whole array to every element. (Konstantin Vedernikov).
otherBackported in: Not required. (Groene AI).
featureBackported in: optimize_and_compare_chain again derives transitive conditions through a DateTime or lower-scale DateTime64 constant compared with a DateTime64 expression, as it did before 26.8. For example, t1.ts = t2.ts adds t2.ts < toDateTime('2026-09-16 00:00:00'), so the other side of a join…
featureBackported in: Added a server setting access_control_improvements.readonly_restricts_set_role, false by default. When enabled, SET ROLE is refused with error code READONLY in a session or query whose readonly setting is not zero. Previously SET ROLE was the only identity-changing statement that…
featureBackported in: Added the setting use_aggregation_memory_tracker to choose how GROUP BY measures its memory when deciding on two-level aggregation. compatibility below 26.9 restores the measurement from before 26.7. (Hechem Selmi).
fixBackported in: Fix wrong results for uniq*, GROUP BY, LIMIT n BY, ORDER BY after GROUP BY, and window PARTITION BY over toString of a DateTime/DateTime64 in a time zone with a daylight-saving transition, and over toFixedString of a String. Both functions claimed to be injective while mapping…
fixBackported in: Fixed the LOGICAL_ERROR Reading from materialized CTE '...' before its materialization completed - DelayedPortsProcessor gate is missing in the query plan raised when an IN or other set subquery defines a MATERIALIZED CTE that two other MATERIALIZED CTEs of that subquery read (for…
fixBackported in: Fixed use_skip_indexes = 0 also disabling part pruning by the partition-key min-max index (since 26.5), which made such queries read every part of the table. (Ashish Kumar Choubey).
fixBackported in: Reject malformed serialized groupBitmap states with INCORRECT_DATA instead of failing later during bitmap operations. (Elmi Ahmadov).
fixBackported in: Fixed a WHERE condition or a row policy on a Hive partition column (use_hive_partitioning = 1) returning too few rows when the Parquet data file also has a column with that name and other values: Parquet row-group, page and dictionary pruning used the file's values instead of the…
fixBackported in: Fixed a heap use-after-free in the s3, azureBlobStorage, hdfs and other object storage table functions and engines when an exception (for example MEMORY_LIMIT_EXCEEDED) was thrown while creating the reader of a file in a row input format such as CSV. (Groene AI).
fixBackported in: Fixed a server crash, wrong results or a rejected query in ORDER BY ... WITH FILL ... INTERPOLATE when one INTERPOLATE expression has to be converted to its target's type and another item reads the same column or literal, for example INTERPOLATE (a AS b, b AS a) with targets of…
featureBackported in: Restore min/max pruning of Iceberg data files for a Decimal(38, 38) column. A manifest bound of magnitude above roughly 0.7 cannot be widened inside Int128 and was dropped, which left the column without a min/max condition; it is now saturated at the largest magnitude the precision…
fixBackported in: The collections of the Native protocol — the settings and the query parameters of a query, the client information, the granted roles and the table-status lists — are now bounded, so a small packet can no longer make the server allocate memory for data that has not arrived. (Alexey…
fixBackported in: Fixed a crash on a query with a deeply nested Dynamic or JSON constant. (Pavel Kruglov).
fixBackported in: Fix NOT_IMPLEMENTED for an outer JOIN with join_algorithm = 'full_sorting_merge' when optimize_and_compare_chain derived a condition on the preserved side of the join from the ON clause. (Yarik Briukhovetskyi).
securityBackported in: Update mongo-c-driver to 2.5.5, fixing an out-of-bounds write during MongoDB connection monitoring reconnects (CVE-2026-96746). (Actuele AI).
otherBackported in: Update thrift to v0.25.0. (Actuele AI).
fixBackported in: Fixed a crash on INSERT into a MergeTree table when a materialized view over it reads the same table from a correlated subquery, IN or a non-leftmost table of an IN subquery. (Groene AI).
fixBackported in: Fixed TRUNCATE TABLE of an Alias table whose target is a MergeTree failing with DEADLOCK_AVOIDED when the alias is being read concurrently, while the same statement against the target table succeeds immediately. The lock for TRUNCATE is now chosen and taken on the table that…
fixBackported in: Fix a vector search returning fewer rows than its LIMIT, and missing true nearest neighbours, after a lightweight DELETE (or with a delete mutation applied on the fly): the vector index is no longer used for a part while it still holds deleted rows. (Alexey Milovidov).
fixBackported in: Fixed wrong results, or an ILLEGAL_COLUMN error, of a JOIN whose condition equates both a column and an expression of that column (for example ON t1.k = t2.k AND intDiv(t1.k, 2) = intDiv(t2.k, 2)) when a filter on that expression is pushed down to the other side of the join: the…
fixBackported in: Fixed parallel replicas not being used when reading a Distributed table whose underlying table is another Distributed table and every shard of the outer cluster has a single replica. (Igor Nikonov).
fixBackported in: Fixed duplicated rows returned by ANY RIGHT JOIN with any_join_distinct_right_table_keys = 1 when parallel replicas are enabled. (Groene AI).
fixBackported in: Fixed excessive memory usage when loading a data part with a corrupted columns_substreams.txt; such a part is now detached as broken. (Murphy).
fixBackported in: Fixed CREATE MATERIALIZED VIEW ... POPULATE and CREATE TABLE ... AS SELECT in a Replicated database with parallel replicas enabled: each replica sent its population to other replicas, so its rows landed in other replicas' tables (duplicated there, missing on the replica itself), or…
fixBackported in: Fixed slow planning of queries with skip indexes on tables with many parts and pending patch parts of lightweight updates. (Anton Popov).
fixBackported in: Fixed a crash (stack overflow) when reading an Avro file with an explicit structure that does not read a field nested through a long chain of named types, or a field of a recursive type holding deeply nested data such as a long linked list. Such a file now fails with…
otherBackported in: Do not use parallel replicas for clusterAllReplicas. (Igor Nikonov).
otherBackported in: Faster sorted-stream processing on a multi-column key whose leading column has long runs, in LIMIT BY, negative LIMIT BY, DISTINCT in order, window functions (peer groups and PARTITION BY boundaries), full_sorting_merge and partial_merge JOIN, and ReplacingMergeTree FINAL without…
fixBackported in: Fix corrupted shared data of nested JSON objects after a failed attempt to parse a value during insert. It could lead to errors like Unexpected version of JSON type binary encoding or Unknown type code when reading the data after merges or when serializing it in binary formats.…
fixBackported in: Fixed a query failing with an exception like Cannot parse UInt64 from String on a table with a text index on mapKeys or JSONAllPaths, when the predicate cannot be evaluated on the value of a missing map key or JSON path. (Anton Popov).
otherBackported in: Use castStorage for the Join row policy check in the legacy analyzer. (Vladimir Cherkasov).
otherBackported in: bloom_filter and text indexes are now used when a Nullable indexed column is cast to the non-Nullable type, such as CAST(x, 'String') or json.path::String. A query that would throw on a NULL value may not throw when the index skips the granules with NULL. (Anton Popov).
fixBackported in: Fix reading bucketed runtime Map values from JSON columns using advanced shared-data serialization. (Rory Shanks).
fixBackported in: Fix DeltaLake stats pruning with Date cast. (Arsen Muk).
fixBackported in: Fix EXPLAIN PLAN actions = 1 printing a secret function argument (for example the key of HMAC or encrypt) in cleartext when its value came from a subquery or from the other side of a JOIN. (Vladimir Cherkasov).
fixBackported in: Fix INSERT failing with ILLEGAL_FINAL or SAMPLING_NOT_SUPPORTED when a materialized view applies FINAL or SAMPLE to its own source table inside a subquery. Regression in. (Jimmy Aguilar Mena).
fixBackported in: Fix a rare server crash (SIGSEGV in mongoc_log) when a MongoDB dictionary source or MongoDB table was created while another thread created the first MongoDB connection in the process. Messages logged by the MongoDB driver now go to the server log. (Vladimir Cherkasov).
otherBackported in: CRoaring v5.2.3 exposes internal_validate() on the C++ RoaringBitmap wrappers, so RoaringBitmap data can be validated. (Elmi Ahmadov).
otherBackported in: Update cctz to 2026e. (Actuele AI).
fixBackported in: Fixed a LOGICAL_ERROR in arraySlice on a QBit column replicated by ARRAY JOIN or a JOIN. (Groene AI).
otherBackported in: A WHERE that no row passes is pushed to every JOIN input again, including the non-preserved side of an OUTER JOIN and a side with no column used above the join, so that input is no longer read and hash-built for nothing. For example, a UNION ALL branch whose constant column fails…
otherBackported in: Hash joins with many matches per key are faster when they output a LowCardinality column whose blocks have different dictionaries (several parts, FINAL, or a LowCardinality value computed per block): short ranges from another dictionary are now inserted key by key instead of through…
featureBackported in: Added the setting query_plan_filter_push_down_below_limit_by (default 1), controlling whether filters on LIMIT BY key columns are pushed below the LIMIT BY step. Setting it to 0 restores the plan shape used before 26.7, for queries where the pushed predicate makes index analysis…
fixBackported in: Mask secrets in the queries that a cluster-mode QueryRunner table writes to system.query_log as well as in queries executed as startup scripts. (Miсhael Stetsyuk).
fixBackported in: Tables in a database with lazy_load_tables were missing from system.parts, system.replicas and related system tables, and refused by replica commands, after a restart. (Nikolay Degterinsky).
fixBackported in: Fix a server abort when reading an Iceberg table whose sort order names a transform ClickHouse cannot parse (e.g. bucket[xyz]); ClickHouse now ignores that sort-order hint and keeps the table readable. (Ilias).
fixBackported in: Comparing an Enum column with a string literal that is not one of its elements no longer throws UNKNOWN_ELEMENT_OF_ENUM when validate_enum_literals_in_operators is disabled (the default) and the column is part of the primary key, the partition key, or a bloom_filter index. != with…
fixBackported in: Fix Found patch part ... that intersects mutation with version ... on lightweight updates in a table created with CREATE TABLE ... CLONE AS or ATTACH PARTITION ALL FROM a table with lightweight updates. (Nikolay Degterinsky).
fixBackported in: Fix UNKNOWN_IDENTIFIER in the analyzer when a table is referenced as database.table in FROM or JOIN and another table expression in the same query uses that database name as its alias, for example FROM db.t1 AS db INNER JOIN db.t2 AS t ON .... Closes. (Dmitry Novik).
fixBackported in: Fixed wrong results when a WHERE clause mixing AND and OR was evaluated with skip indexes (use_skip_indexes_for_disjunctions, enabled by default). If a minmax or set index could not evaluate one atom of the predicate for a granule, the per-atom verdicts recorded for that granule…
fixFix iceberg_tolerate_conflicting_manifest_schemas being reverted to false by compatibility settings of 26.8 or 26.9 on 26.9 servers, which made Iceberg reads fail with ICEBERG_SPECIFICATION_VIOLATION on tables whose manifest schemas conflict with metadata.json. (Asya Shneerson).
otherBackported in:. (Alexey Milovidov).
fixBackported in: Fix container existence check during RESTORE of a lightweight snapshot from Azure Blob Storage by parsing the saved namespace into container name and prefix. (Garrett Thomas).
otherBackported in: Reduced the setup of the 04510_distributed_final_many_partitions test from 150 to 65 partitions. (Groene AI).
otherBackported in: Filesystem cache: make reserve granularity dynamic. (Kseniia Sumarokova).
fixBackported in: Fixed a text index dropping matching rows when a FixedString is involved in the comparison: a term-preserving tokenizer over a String column lost the rows whose value carries literal trailing zero bytes when the search constant is a FixedString, and an index over a FixedString…
fixBackported in: Rewriting the body of a view with ALTER TABLE ... MODIFY QUERY now needs the same grants as creating it with its SQL security: SET DEFINER on the definer of a SQL SECURITY DEFINER view, or ALLOW SQL SECURITY NONE for a SQL SECURITY NONE view. An ON CLUSTER MODIFY QUERY fails with…
fixBackported in: Fix basic statistics of parts written by 26.6 or 26.7: after ALTER TABLE ... UPDATE or a lightweight DELETE, non-Nullable columns reported a default-value count of 0, which made selectivity estimates wrong. Query results were not affected. To repair parts that are already affected,…
fixBackported in: Fix a possible hang of a query under workload CPU scheduling with cpu_slot_preemption enabled: when all its threads were preempted, the query could keep CPU slots it had already used and wait forever for one of them. (Sergei Trifonov).
fixBackported in: Fixed a LEFT/RIGHT/FULL JOIN without an equality key that failed with INVALID_JOIN_ON_EXPRESSION (Cannot determine join keys) when its WHERE clause also contained an IN (subquery). The WHERE filter now converts such a join to INNER again, as it did in 26.6, which also restores that…
fixBackported in: Respect iceberg_metadata_staleness_ms in metadata parsing. (Konstantin Vedernikov).
fixBackported in: Fixed a segmentation fault or std::length_error when reading TSV formats with input_format_tsv_crlf_end_of_line = 1 if an escape sequence ended exactly at the end of a read buffer. (Groene AI).
otherBackported in: Enabled the text index posting lists cache by default (use_text_index_postings_cache). Previously each query used a private cache capped at 100 MiB, which on large tables caused posting lists and phrase search results to be recomputed several times within a single query; a 4-token…
otherBackported in: Skip indexes (bloom_filter, tokenbf_v1, ngrambf_v1, minmax) and the primary key are now used when the indexed column is wrapped into a conversion that does not change its value, such as toLowCardinality, toNullable or a CAST to Nullable or LowCardinality. (Anton Popov).
fixBackported in: Fix an out-of-bounds read when deserializing a uniqTheta state shorter than 24 bytes, for instance from CAST( AS AggregateFunction(uniqTheta, ...)). (Alexey Milovidov).
otherBackported in: Faster planning of queries to Iceberg tables with many manifest files: when a manifest file header has the schema-id key and that schema is already known from metadata.json, the schema copy stored in the manifest header is no longer parsed and compared with it. ClickHouse now also…
otherBackported in: Hide the HTTP headers in the definition of HTTP dictionary sources in SHOW CREATE DICTIONARY, system.tables and query logs, the same way as passwords. They can be shown with the existing display_secrets_in_show_and_select mechanism. (Matheus Nerone).
fixBackported in: Fixed SYSTEM SYNC TRANSACTION LOG (local, non-ON CLUSTER form) not checking the SYSTEM_SYNC_TRANSACTION_LOG privilege. The ON CLUSTER form already required it via getRequiredAccessForDDLOnCluster, but the local execution path skipped checkAccess, so a user without the grant could…
fixBackported in: Fixed asynchronous TLS connections occasionally failing with an unrelated OpenSSL error left by another connection on the same OS thread. This could terminate distributed queries with a misleading network exception. (Dmitriy Borisenko).
fixBackported in: Fixed an ssl_certificate authentication bypass where an embedded NUL byte in a certificate's Common Name (for example john\0.evil.com) was truncated server-side to john, letting a holder of such a certificate authenticate as a different user. (Konstantin Bogdanov).
fixBackported in: Prevent asynchronous inserts that only need to buffer data from being blocked by another insert waiting for a flush worker while holding their shared queue lock. Ensure a global forced flush waits for batches removed from the queue that are still waiting for a worker. (RJ).
fixBackported in: Skip indexes (text, tokenbf_v1, ngrambf_v1) are now used when the indexed column or the searched constant is wrapped into LowCardinality, Nullable or an equivalent CAST. For example, m['key'] = 'value' on a Map(String, LowCardinality(String)) column and hasToken(s,…
fixBackported in: EXPLAIN AST printed secret function arguments, such as the key of encrypt, in clear text, and with optimize = 1 it did so for the body of a view the user may only SELECT from. The dump now prints '[HIDDEN]' in their place, under the same gate as SHOW CREATE. (Harikrishnan Prabakaran).
fixBackported in: Column-level SELECT privileges are now enforced for columns used only inside indexHint and for ALIAS columns referenced in PREWHERE. As in WHERE, referencing an ALIAS column in PREWHERE requires the grant on the alias name; a grant on its source columns is no longer sufficient. A…
fixBackported in: Fix a server crash (SIGSEGV) when a CREATE TABLE ... PROJECTION / ALTER TABLE ... ADD PROJECTION statement is restored from a clickhouse_json AST whose projection query subtree contains a function node without an arguments list. The malformed payload is now rejected with…
fixBackported in: Fixed a row policy bypass: a direct JOIN with an EmbeddedRocksDB, KeeperMap or Redis table in the legacy analyzer (enable_analyzer = 0) ignored the row policy of the right table and returned hidden rows, and joinGet on a Join table ignored its row policy in both analyzers. Such a…
fixBackported in: Fix NO_COMMON_TYPE in case of use_variant_as_common_type=0 for jemalloc fragmentation dashboard. (Azat Khuzhin).
fixBackported in: Now statistics parts pruning will not work if table has row level policy. (alesapin).
fixBackported in: Fix filesystem cache accounting when the directory for a new cache key cannot be created, for example because the cache disk is out of space or inodes. The failed reservation stayed counted in the cache until the query released the file segment. (Sema Checherinda).
fixBackported in: CREATE OR REPLACE in a Replicated database or with ON CLUSTER now requires the drop privilege for the kind of the table it replaces, so a user without DROP DICTIONARY can no longer replace a dictionary. (Nikolay Degterinsky).
fixBackported in: Fix LOGICAL_ERROR Cannot capture column N because it has incompatible type when a materialized view with a lambda over an Array(Tuple(...)) column receives a block while the source table's column type is being changed by ALTER TABLE ... MODIFY COLUMN. (Jimmy Aguilar Mena).
fixBackported in: Fix a server crash caused by unbounded recursion when decoding a deeply nested value inside a binary encoded type, for example an AggregateFunction parameter in a Dynamic value read from RowBinary or Native. (Pavel Kruglov).
fixBackported in: Fixes a server crash on CREATE TABLE or ALTER TABLE ... MODIFY TTL with a TTL expression that uses the result of arrayMap with a constant lambda, such as toString(arrayMap(x -> CAST(1, 'Dynamic'), arr)). (Groene AI).
fixBackported in: Fixed secret settings of S3Queue and AzureQueue tables written with the legacy s3queue_ prefix, such as s3queue_after_processing_move_secret_access_key, being shown in cleartext in SHOW CREATE TABLE, system.tables, system.query_log and the server log. They are now hidden as they are…
fixBackported in: Add more path validations. (Konstantin Vedernikov).
fixBackported in: S3 client check initial url in backup client. (Konstantin Vedernikov).
fixBackported in: Fix missing rows in hasAllTokens and hasAnyTokens searches over a text index when an earlier query with the same predicate read a narrower key range of the same part and use_text_index_postings_cache was enabled. (Anton Popov).
fixBackported in: Fix a crash when reading an ORC file whose root type is not a struct (for example, a file written with a bigint or array root type). Such files are now rejected with an INCORRECT_DATA error. Closes. (Groene AI).
fixBackported in: Fixed a crash and wrong results with convert_query_to_cnf = 1 when WHERE or HAVING references the same SELECT alias more than once. (Groene AI).
otherNO CL ENTRY: 'Revert "Backport to 26.9: Skip the direct join when the right table has a row policy"'. (Vladimir Cherkasov).
otherBackported in: Hide a Backup locator named like a COLUMNS matcher in EXPLAIN AST instead of throwing. (Groene AI).
otherBackported in: Do not dereference a null logs_queue in OwnSplitChannel::log. (Groene AI).