What StarRocks/starrocks shipped
Written by FoxPlug from the repository's own releases; not affiliated with Starrocks. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/StarRocks/starrocks; Starrocks did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- StarRocks 4.1.7 is released, and local primary key inserts no longer check the immutable L1 and L2 persistent-index files for duplicate keys by default, with the new
skip_pindex_l1_l2_check_in_insertBE configuration defaulting to true while L0 memtable checks still run. Release - StarRocks 4.0.17 is released with credential values now masked in the BE varz endpoint,
information_schema.be_configs, the FE ADMIN SHOW FRONTEND CONFIG output and variable endpoint, BE HTTP request logs, and values echoed back by BEupdate_configand set config APIs. Release - Lake compaction gains an opt-in table allowlist mode so operators can keep selected tables compacting while compaction is otherwise disabled during shared-data migrations. Pull request #80368
- Primary-key point lookups and
dict_mappingnow return CHAR values unpadded instead of padding them to the declared width. Pull request #82413 - An Iceberg identity partition on a DATETIME column now gets a one-second range instead of the one-day range a DATE gets, so two values on the same day no longer overlap. Pull request #81918
- External materialized view partitions whose values strip to the same name are kept apart instead of the second replacing the first, which fixes the case where -1 and 1 both became p1. Pull request #81917
- A NULL row's data no longer raises a decimal overflow error under ERROR_IF_OVERFLOW, which affected statistics loading when merging empty and non-empty min and max values. Pull request #82254
- A temporary partition can now adopt the bounds of the partition it overwrites, so
dynamic_overwriteno longer re-creates daily partitions that a merge had just removed. Pull request #78707 - Principal_field now supports path-based lookups for nested JWT claims, covering URI-namespaced keys used by providers that nest custom claims. Pull request #71749
- StarRocks 4.1.6 is released with the AWS SDK default HTTP client switching back to the SDK's own client, with
enable_poco_client_for_aws_sdkdefaulting to false. Release
Why it matters
This week brings four releases across the 4.0 and 4.1 lines, so users tracking either line get fixes for credential exposure in logs and endpoints, primary key insert behavior, and sample behavior on lake tables. Alongside the releases, the merged fixes target correctness issues users have hit in practice: overlapping Iceberg DATETIME partitions, colliding external materialized view partition names, unpadded CHAR from point lookups, and spurious decimal overflow errors on NULL rows. Operators doing shared-data migrations also get a narrower way to control lake compaction without disabling it globally.
Changelog entry
- Released 4.1.7; local primary key inserts skip immutable L1/L2 duplicate-key checks by default, with L0 memtable checks still running. Release
- Released 4.0.17; credential values are masked in BE and FE config endpoints, logs, and echoed
update_configresponses. Release - Added an opt-in table allowlist mode for lake compaction. Pull request #80368
- Primary-key point lookups and
dict_mappingnow return CHAR unpadded. Pull request #82413 - Iceberg identity partitions on DATETIME columns now use a one-second range. Pull request #81918
- External materialized view partitions that strip to the same name are no longer collapsed into one. Pull request #81917
- Under ERROR_IF_OVERFLOW, NULL rows no longer raise decimal overflow errors. Pull request #82254
- Temporary partitions can adopt the bounds of the partition they overwrite. Pull request #78707
- Principal_field supports path-based lookups for nested JWT claims. Pull request #71749
- Released 4.1.6; the AWS SDK default HTTP client switches back to the SDK's own client. Release
- Released 4.0.16; the AWS SDK default HTTP client switches back to the SDK's own client. Release
- Dropped Iceberg sql-tests that depend on
add_equality_delete_filesfrom branch-4.1, where the procedure is not available. Pull request #82592
Releases this week: 4.1.7, 4.1.6, 4.0.17, 4.0.16. Credential values masked in config endpoints and logs. Primary key inserts skip L1/L2 duplicate checks by default in local mode. Fixes for Iceberg DATETIME partitions, CHAR point lookups, and NULL-row decimal overflow.
This week StarRocks shipped 4.1.7, 4.1.6, 4.0.17 and 4.0.16. The 4.0.17 release masks credential values in BE and FE config endpoints and logs. In 4.1.7, local primary key inserts no longer check immutable L1 and L2 persistent-index files for duplicate keys by default, controlled by the skip_pindex_l1_l2_check_in_insert setting. Fixes landed for Iceberg identity partitions on DATETIME columns giving a one-second instead of one-day range, external materialized view partitions that stripped to the same name replacing each other, CHAR values returned padded from primary-key point lookups, and decimal overflow errors raised from NULL rows under ERROR_IF_OVERFLOW. Lake compaction also gains an opt-in table allowlist mode.
Week of October 26, 2026
What shipped
- Column-subset INSERT into primary key tables now plans as a plain insert when the target partitions were never written, avoiding the partial update path. Pull request #80741
- HAVING clauses are normalized after a constant group-by key is folded into them, fixing queries that group on a constant column from an empty join side. Pull request #81919
- String IN predicates longer than
max_pushdown_conditions_per_columnare no longer misread as dictionary codes during runtime filter normalization. Pull request #81676 - Columns required by late materialized view pruning predicates are now preserved after column pruning. Pull request #81687
- Unsupported scalar GEOGRAPHY and GEOMETRY operations are rejected during analysis instead of reaching unsupported backend paths. Pull request #81769
- Flat JSON paths dropped by the derivation trie are typed as JSON, fixing cases where a JSON path had no type after trie shrinkage. Pull request #81816
- NULL literal aggregate arguments are unfolded with their own type, so aggregate functions receive the correct input column. Pull request #81952
- Geo values in
map_aggstates are copied as columns, preserving geo descriptors and physical metadata. Pull request #81850 - FunctionHelper nested columns keep geo descriptors, preventing descriptor mismatches on copies from typed inputs. Pull request #81775
- Per-function checkpoints were removed from geo overlay and ST_SimplifyPreserveTopology while keeping coordinate, work and topology limits. Pull request #81739
Why it matters
This week brings several correctness fixes for primary key inserts, materialized view pruning and string IN predicates in runtime filters, which frequent users of those features will notice. Unsupported geography operations are now rejected earlier during analysis, and geo descriptor handling in aggregates is more consistent. Documentation and test fixes also reduce flaky behavior in development.
Changelog entry
- Plan a column-subset INSERT into a primary key table as a plain insert when its partitions were never written. Pull request #80741
- Normalize HAVING after a constant group-by key is folded into it. Pull request #81919
- Do not read a string IN predicate as dictionary codes in the runtime filter pass. Pull request #81676
- Preserve columns required by late materialized view pruning predicates. Pull request #81687
- Reject unsupported scalar GEOGRAPHY and GEOMETRY operations during analysis. Pull request #81769
- Type a flat JSON path as JSON when the trie bound dropped it. Pull request #81816
- Unfold a NULL literal aggregate argument with its own type. Pull request #81952
- Copy geo values in
map_aggstates as columns. Pull request #81850 - Keep geo descriptors in FunctionHelper nested columns. Pull request #81775
- Drop per-function checkpoints from geo overlay and ST_SimplifyPreserveTopology. Pull request #81739
- Reject nested GEOGRAPHY and GEOMETRY types during analysis. Pull request #81442
- Use TYPE_X_DESC instead of TypeDescriptor(TYPE_X) in backend sources. Pull request #82020
This week: primary key column-subset INSERT can skip the partial update path on unwritten partitions, HAVING is normalized after constant key folding, string IN predicates avoid dictionary misreads, and unsupported geo operations are rejected in analysis.
This week's changes include a planner improvement so column-subset INSERT into primary key tables uses a plain insert when target partitions were never written, avoiding the partial update path. HAVING clauses are normalized after a constant group-by key is folded in, string IN predicates longer than the pushdown limit are no longer read as dictionary codes during runtime filter normalization, and materialized view pruning now preserves columns needed by late predicates. Unsupported scalar GEOGRAPHY and GEOMETRY operations are rejected during analysis, and geo descriptor handling in aggregate states is more consistent.
Week of October 19, 2026
What shipped
- Security integration users can now authenticate over HTTP, Arrow Flight SQL and the load RPCs, not only the MySQL protocol. Pull request #80940
- Stored JSON that repeats a key now flattens one value per row instead of adding multiple values to a sub-column. Pull request #81102
- Prevented incorrect global dictionary renewal across FEs that caused Dict Decode failures on followers in a shared-nothing cluster. Pull request #79511
- Fixed a merged JSON column being held unsafely by the compactor while it writes it. Pull request #81117
- Held the slice lock on every path that reads a min/max runtime filter's bounds, preventing a scan from reading a VARCHAR bound freed by a TopN sort. Pull request #81138
- Bool_or can now merge an intermediate column that holds NULLs, avoiding a debug BE abort during aggregate spill. Pull request #81237
- Destroyed the wrapped state when an agg-state combinator batch-destroys, fixing a leak in spilled aggregation. Pull request #81054
- SHOW DATABASES FROM an external catalog now checks catalog-level privilege before running. Pull request #81414
- Fixed a union merge values order error in UnionToValuesRule. Pull request #81420
- The Iceberg REST catalog user agent is now built without NodeMgr, avoiding a failure on the checkpoint thread. Pull request #80660
Why it matters
This week brings security integration authentication to HTTP, Arrow Flight SQL and the load RPCs, so directory-backed users are no longer limited to the MySQL protocol. Several correctness fixes land in JSON flattening, global dictionary handling across FEs, and aggregate spill paths, reducing decode failures and debug aborts. A privilege check on SHOW DATABASES FROM closes a gap where users without catalog access could still list its databases.
Changelog entry
- Security integration users can authenticate over HTTP, Arrow Flight SQL and the load RPCs. Pull request #80940
- Stored JSON that repeats a key now flattens one value per row. Pull request #81102
- Prevent incorrect global dictionary renewal across FEs. Pull request #79511
- Hold the merged JSON column safely while the compactor writes it. Pull request #81117
- Hold the slice lock on every path that reads a min/max filter's bounds. Pull request #81138
- Bool_or can merge an intermediate column that holds NULLs. Pull request #81237
- Destroy the wrapped state when an agg-state combinator batch-destroys. Pull request #81054
- Check catalog privilege before SHOW DATABASES FROM an external catalog. Pull request #81414
- Fix union merge values order error in UnionToValuesRule. Pull request #81420
- Build the Iceberg REST catalog user agent without NodeMgr. Pull request #80660
- Bump FE ZooKeeper to 3.9.6 for CVE-2026-59739, CVE-2026-59969 and CVE-2026-79993. Pull request #81292
- Prefer native Paimon SDK reads for compatible splits and expand static coverage. Pull request #79856
StarRocks 4.0.17 is out. Security integration users can now authenticate over HTTP, Arrow Flight SQL and load RPCs. Also fixed: repeated-key JSON flattening, global dictionary renewal across FEs, SHOW DATABASES FROM privilege check, and aggregate spill issues.
StarRocks 4.0.17 is released. Security integration users can now authenticate over HTTP, Arrow Flight SQL and the load RPCs, not only through the MySQL protocol. This week also brings fixes for stored JSON that repeats a key, where flattening now emits one value per row; global dictionary renewal across FEs that caused Dict Decode failures on followers; an unsafe pointer in the JSON column compactor; and missing slice locks when reading min/max runtime filter bounds. SHOW DATABASES FROM an external catalog now checks catalog-level privilege first. Additional fixes cover bool_or merging an intermediate column with NULLs and a leak when an agg-state combinator batch-destroys.
Week of October 12, 2026
What shipped
- CAST(x AS CHAR(N)) now truncates its result to N characters like MySQL, so MySQL-style SQL that relies on truncation returns the expected value. Pull request #75909
- INSERT OVERWRITE now reports a clear error when a source partition is dropped, renamed or expired before commit instead of failing obscurely. Pull request #79902
- The brpc future timeout contract is restored, so EXPORT jobs are no longer cancelled a few seconds after they start. Pull request #80783
- Queries mixing a dictionary-capable aggregate with a non-dictionary aggregate over the same low-cardinality string column are no longer rejected by the plan validator. Pull request #80355
- A scanned column whose only conjunct is folded away by the scan predicate builder is now output, replacing a crash or query error with correct results. Pull request #80572
- MIN and MAX on a single-column LIST partition column are no longer answered from partition values the data may not hold. Pull request #80558
- Array_generate with a range too large to hold now returns an error instead of throwing an uncaught exception that took down the BE. Pull request #80205
- Credentials in a SUBMIT TASK SQL are masked in the task run definitions archived to
task_run_history. Pull request #80447 - List-partition drift checks now compare the snapshot against the live table instead of against the snapshot on both sides. Pull request #78470
- Primary key recover now handles V2-encoded single-column fixed-length keys when a shared-data tablet is found inconsistent during publish. Pull request #80916
Why it matters
This week is mostly about removing failure modes users hit in production: clearer errors when partitions vanish mid-load, no more EXPORT jobs cancelled seconds after starting, no BE crashes from oversized array_generate ranges, and MySQL-compatible truncation for CAST to CHAR(N). Several fixes also stop wrong answers, such as MIN and MAX read from LIST partition definitions and JSON subfield reads returning NULL. Alongside that, the storage and diagnostics tooling got narrower: segment dumps and tablet metadata dumps can be scoped, and rowsets migrated in shared-data now carry their vector index files.
Changelog entry
- CAST(x AS CHAR(N)) truncates the result to N characters, matching MySQL. Pull request #75909
- INSERT OVERWRITE reports a clear error when a source partition disappears before commit. Pull request #79902
- Restore the brpc future timeout contract so EXPORT jobs are no longer cancelled soon after starting. Pull request #80783
- Allow aggregates with and without dictionary encoding over the same low-cardinality string column in one query. Pull request #80355
- Output a scanned column whose only conjunct the scan predicate builder folds away. Pull request #80572
- Stop answering MIN/MAX of a LIST partition column from partition values the data may not hold. Pull request #80558
- Reject an
array_generaterange too large to hold instead of aborting the BE. Pull request #80205 - Mask credentials in SUBMIT TASK SQL archived to
task_run_history. Pull request #80447 - Compare list-partition drift against the live table rather than the snapshot on both sides. Pull request #78470
- Fix primary key recover on V2-encoded single-column fixed-length keys. Pull request #80916
- Copy vector index files during rowset migration. Pull request #80801
- Re-read bundle metadata when a read fails verification. Pull request #79928
Weekly StarRocks: CAST(x AS CHAR(N)) truncates like MySQL, INSERT OVERWRITE gives a clear error when a source partition disappears, EXPORT jobs stop being cancelled seconds after start, MIN/MAX on LIST partition columns no longer returns values no row holds, and local paths in th
This week in StarRocks: CAST(x AS CHAR(N)) now truncates to N characters like MySQL, INSERT OVERWRITE reports a clear error when a source partition is dropped or renamed before commit, and EXPORT jobs are no longer cancelled a few seconds after they start. MIN and MAX on single-column LIST partition columns no longer return values the data may not hold, mixed dictionary and non-dictionary aggregates are no longer rejected, an oversized array_generate range returns an error instead of taking down the BE, and credentials in SUBMIT TASK SQL are masked in task_run_history. Shared-data fixes cover primary key recover on V2-encoded single-column fixed-length keys, vector index files during rowset migration, and bundle metadata re-reads, and the diagnostics tools can now scope segment and tablet
Week of October 5, 2026
What shipped
- Reclaim the primary key index sstables left behind by aborted shared-data loads, so full vacuum no longer leaves those files on object storage. Pull request #80382
- Keep a FULL OUTER JOIN USING column's own type on the join key instead of folding the synthesized COALESCE cast away. Pull request #79655
- Allow duplicate output column names when unloading to CSV through INSERT INTO FILES, so queries like SELECT l.*, r.* over a join analyse. Pull request #79897
- Isolate Paimon branch state per table so a multi-table query cannot apply one table's branch to another and silently fall back to main. Pull request #79879
- Add
s3_multipart_equal_part_sizeso multipart uploads write equal-size non-trailing parts for S3-compatible stores that reject uneven parts. Pull request #80377 - Report the real commit failure for multi-table transaction stream loads instead of returning an OK status with an empty message. Pull request #80351
- Lock MV partition-name snapshots during rewrite preparation to avoid a ConcurrentModificationException and an unnecessary fall back to base tables. Pull request #80356
- Keep the filesystem connected during cache eviction so HDFS and ABFS writers are not cut off mid-write. Pull request #80087
- Stop caching unloaded or failed external table statistics as no statistics, which made analyzed iceberg and hive tables plan with UNKNOWN stats after a restart. Pull request #80236
- Stop aborting week functions on a datetime before year 0, which previously took down a debug or ASAN backend. Pull request #80228
Why it matters
This week is mostly correctness work on shared-data loads and external tables: aborted loads no longer leak index sstables, Paimon branch state and external statistics stay per-table, and writer filesystems survive cache eviction. Several fixes also make failures visible rather than silent, such as multi-table transaction commits that previously reported OK. Backport series keep connector I/O off FE metadata locks on the 4.0 and 4.1 branches.
Changelog entry
- Reclaim the PK index sstables of aborted shared-data loads so full vacuum deletes them. Pull request #80382
- Keep a FULL OUTER JOIN USING column's own type on the join key. Pull request #79655
- Allow duplicate output column names when unloading to CSV via INSERT INTO FILES. Pull request #79897
- Isolate Paimon branch state by table to prevent branch leakage between tables. Pull request #79879
- Add
s3_multipart_equal_part_sizefor S3 stores that require equal-size parts. Pull request #80377 - Fix error reporting of failed multi-table transaction stream load commits. Pull request #80351
- Lock MV partition-name snapshots during rewrite preparation. Pull request #80356
- Keep the filesystem connected on cache eviction so in-flight writes do not fail. Pull request #80087
- Do not cache unloaded or failed statistics as no statistics. Pull request #80236
- Stop aborting week functions on a datetime before year 0. Pull request #80228
- Isolate statistics for parallel lake rowset reads under
enable_load_segment_parallel. Pull request #80385 - Run tablet pre-split samples in the load time zone. Pull request #80362
This week: aborted shared-data loads now reclaim their PK index sstables, FULL OUTER JOIN USING keeps the join key type, CSV unload via INSERT INTO FILES accepts duplicate column names, and Paimon branch state is isolated per table.
This week's changes focus on shared-data loads and external tables. Aborted loads now reclaim their primary key index sstables instead of leaving them on object storage for full vacuum to miss. Paimon branch state is isolated per table so multi-table queries cannot apply one table's branch to another. CSV unload through INSERT INTO FILES now accepts duplicate output column names, a FULL OUTER JOIN USING column keeps its own type on the join key, and failed multi-table transaction commits report the failure rather than an OK status. External table statistics that failed to load are no longer cached as no statistics, and cache eviction no longer disconnects a filesystem still in use by a writer. Connector I/O stays off FE metadata locks on the 4.0 and 4.1 branches.
Week of September 28, 2026
What shipped
- Released StarRocks 4.1.6. Release
- Released StarRocks 4.0.16. Release
- Added native H3 functions for spatial indexing using the Apache H3 4.5.0 library with signed BIGINT cell IDs. Pull request #80037
- Added native SRID metadata support and coordinate transforms between EPSG:4326 and EPSG:3857 for GEOMETRY type. Pull request #79999
- Added ST_Intersection polygon operation preserving shared edges and contact points. Pull request #80055
- Added ST_SimplifyPreserveTopology SQL function for topology-preserving geometry simplification. Pull request #80064
- Fixed query failures on
information_schema.viewswhen Ranger authorization is enabled by relaxing database read lock. Pull request #78344 - Fixed GROUP BY ROLLUP/CUBE/GROUPING SETS returning wrong NULL-keyed group counts by preventing NULL-passing runtime filters below RepeatNode. Pull request #80051
- Masked object storage credentials in BE /varz and
information_schema.be_configsto prevent credential exposure. Pull request #80040
Why it matters
Two new releases ship improvements across spatial analytics with H3 indexing and coordinate transforms, geometry operations, and fixes for authorization, grouping, and security issues. The week covers native GEOMETRY enhancements and bug fixes that improve query correctness and operational security.
Changelog entry
- Release 4.1.6 Release
- Release 4.0.16 Release
- Add native H3 functions: H3_FromGeo, H3_GridDisk, H3_ToParent, H3_ToChildren with signed BIGINT cell IDs Pull request #80037
- Add ST_SRID, ST_SetSRID, ST_Transform for EPSG:4326/EPSG:3857 coordinate transforms Pull request #79999
- Add ST_Buffer native Cartesian geometry operation Pull request #80058
- Add ST_Intersection polygon operation Pull request #80055
- Add ST_SimplifyPreserveTopology for topology-preserving simplification Pull request #80064
- Fix
information_schema.viewsquery failures with Ranger authorization Pull request #78344 - Fix GROUP BY ROLLUP/CUBE/GROUPING SETS NULL group count errors Pull request #80051
- Mask object storage credentials in BE /varz and
be_configsPull request #80040 - Bump jackson to 2.21.6 for CVE-2026-68497 Pull request #79947
StarRocks 4.1.6 and 4.0.16 released. New native H3 spatial indexing, SRID support, ST_Buffer and ST_Intersection operations. Fixes for Ranger authorization, GROUP BY correctness, and credential masking.
StarRocks 4.1.6 and 4.0.16 are now available. This week's releases include native H3 spatial indexing functions, SRID metadata and coordinate transforms for GEOMETRY, new polygon operations (ST_Buffer, ST_Intersection, ST_SimplifyPreserveTopology), and important fixes for Ranger authorization queries, GROUP BY ROLLUP/CUBE correctness, and object storage credential security.
Week of September 21, 2026
What shipped
- Native GEO containment predicates added for POINT with POLYGON/MULTIPOLYGON spatial queries. Pull request #79808
- ARM64 CPU feature detection expanded to include NEON, CRC32, PMULL, AES, LSE, SVE, and SVE2. Pull request #79278
- Sys.fe_memory_usage now returns actual memory usage data instead of empty results. Pull request #79809
- LDAP and Active Directory user and group names now treated as case-insensitive. Pull request #79255
- QueryCumulativeCpuTime and QuerySpillBytes metrics fixed to count once per fragment instance instead of inflating. Pull request #79774
- Materialized view rewrite bug fixed that left aggregates in projections causing query failures. Pull request #79611
- Retention conditions with date-to-text casts now accepted instead of being rejected. Pull request #79688
- Paimon partition metadata cache now removes dropped partitions instead of keeping stale entries. Pull request #79442
- ADLS2 credentials now fully redacted in administrative output and account scope preserved during serialization. Pull request #79526
- INSERT-from-table pre-split path now accepts partial or reordered target column lists. Pull request #79832
Why it matters
This week fixes critical operational issues like memory reporting and metric inflation that affect cluster observability, adds spatial query support for geographic data, and improves LDAP/AD authentication handling. Several test infrastructure improvements ensure previously-hidden test cases now execute and catch regressions.
Changelog entry
- Add native GEO containment predicates for POINT with POLYGON/MULTIPOLYGON Pull request #79808
- Add comprehensive ARM64 CPU feature detection to CpuInfo Pull request #79278
- Fix sys.fe_memory_usage to return collected memory data Pull request #79809
- Treat LDAP/AD user and group names as case-insensitive Pull request #79255
- Fix QueryCumulativeCpuTime and QuerySpillBytes counted once per fragment instance Pull request #79774
- Fix materialized view rewrite leaving aggregate in projection Pull request #79611
- Allow retention conditions with date-to-text casts Pull request #79688
- Remove dropped Paimon partitions from metadata cache Pull request #79442
- Preserve ADLS2 account scope and fully redact credentials Pull request #79526
- Accept partial or reordered column lists in INSERT-from-table pre-split Pull request #79832
StarRocks: GEO containment for spatial queries, ARM64 CPU detection, memory usage reporting fixed, LDAP case-insensitive auth, and metrics counting corrected.
StarRocks improvements this week: Native GEO containment predicates for POINT/POLYGON queries, ARM64 CPU feature detection (NEON, CRC32, SVE), fixed sys.fe_memory_usage reporting, case-insensitive LDAP/AD authentication, corrected QueryCumulativeCpuTime and QuerySpillBytes metrics, and materialized view rewrite fixes.
Week of September 14, 2026
What shipped
- Release 4.1.3 now preserves VARCHAR(N) column lengths declared in CTAS instead of widening them to VARCHAR(MAX). Release
- Iceberg GEOGRAPHY columns are now readable natively through the CN transport and raw WKB MySQL output paths. Pull request #79110
- Fixed a bug where FULL OUTER JOIN with multiple USING columns returned correct row counts but shifted values in non-first columns. Pull request #79298
- Updated Apache Ranger to 2.9.0 to fix CVE-2026-42537 (RCE via JDBC URL injection) and BouncyCastle to 1.85. Pull request #79331
- Made the shared-data publish version timeout configurable instead of using a fixed value. Pull request #79332
- Fixed CN abort with std::system_error in shared-data mode by preventing parallel-compaction filesystem IO from running on brpc bthread. Pull request #76925
- The large memory allocation report threshold is now exposed as a BE configuration parameter instead of hard-coded to 1GB. Pull request #79251
- Authorization checks, INSERT planning, and view expansion now execute off connector I/O when holding the metadata lock. Pull request #79221
- Fixed cached prepared point-query plans returning wrong rows by binding parameters by column instead of AND-tree position. Pull request #78979
- Fixed range predicate pruning on expression-partitioned tables to correctly account for what the partition expression preserves. Pull request #79111
Why it matters
This week addresses correctness issues in query results, security vulnerabilities in dependencies, and lock contention problems in shared-data mode. The fixes span FULL OUTER JOIN correctness, prepared statement parameter binding, and metadata lock handling under connector I/O, which impact query reliability and cluster performance.
Changelog entry
- CTAS now preserves explicitly declared VARCHAR(N) column lengths instead of widening them to VARCHAR(MAX) Release
- Iceberg GEOGRAPHY columns are now readable natively through CN transport and raw WKB MySQL output paths Pull request #79110
- Fixed FULL OUTER JOIN with multiple USING columns returning shifted values in non-first columns Pull request #79298
- Bumped Apache Ranger to 2.9.0 and BouncyCastle to 1.85 to fix CVE-2026-42537 and CVE-2026-59646 Pull request #79331
- Made shared-data publish version timeout configurable via FE parameters Pull request #79332
- Fixed CN abort in shared-data mode by preventing parallel-compaction filesystem IO on brpc bthread Pull request #76925
- Removed unnecessary hsync call on HDFS file close to improve write performance Pull request #78864
- Exposed large memory allocation report threshold as BE configuration parameter Pull request #79251
- Moved authorization checks, INSERT planning, and view expansion off connector I/O when holding metadata lock Pull request #79221
- Fixed prepared statement plan cache binding parameters by column instead of AND-tree position Pull request #78979
- Fixed range predicate pruning on expression-partitioned tables to account for expression monotonicity Pull request #79111
- Fixed replication job division by zero when target tablet has no replicas Pull request #79329
- Fixed AsyncTaskQueue busy-spinning after consumer interruption Pull request #79297
- Fixed dict page decoder to advance when pushed-down filter rejects whole dictionary Pull request #79007
- Added coredump collection support for CN containers Pull request #79148
StarRocks 4.1.3 ships with VARCHAR(N) length preservation in CTAS, native Iceberg GEOGRAPHY reads, and fixes for FULL OUTER JOIN value shifting, metadata lock contention, and security vulnerabilities.
StarRocks 4.1.3 is out with important correctness and performance fixes. FULL OUTER JOIN with multiple USING columns now returns accurate values, prepared statement caching respects parameter positions correctly, and metadata locks no longer block on external connector I/O. We've also added native Iceberg GEOGRAPHY support, made configuration more flexible with configurable publish timeouts, and patched security vulnerabilities in Apache Ranger and BouncyCastle.