What StarRocks/starrocks shipped
Generated by FoxPlug from public activity — not affiliated with Starrocks.
Week of September 14, 2026
What shipped
- Release 4.1.3 now preserves VARCHAR(N) column lengths declared in CTAS instead of widening them to VARCHAR(MAX). Release
- Iceberg GEOGRAPHY columns are now readable natively through the CN transport and raw WKB MySQL output paths. Pull request #79110
- Fixed a bug where FULL OUTER JOIN with multiple USING columns returned correct row counts but shifted values in non-first columns. Pull request #79298
- Updated Apache Ranger to 2.9.0 to fix CVE-2026-42537 (RCE via JDBC URL injection) and BouncyCastle to 1.85. Pull request #79331
- Made the shared-data publish version timeout configurable instead of using a fixed value. Pull request #79332
- Fixed CN abort with std::system_error in shared-data mode by preventing parallel-compaction filesystem IO from running on brpc bthread. Pull request #76925
- The large memory allocation report threshold is now exposed as a BE configuration parameter instead of hard-coded to 1GB. Pull request #79251
- Authorization checks, INSERT planning, and view expansion now execute off connector I/O when holding the metadata lock. Pull request #79221
- Fixed cached prepared point-query plans returning wrong rows by binding parameters by column instead of AND-tree position. Pull request #78979
- Fixed range predicate pruning on expression-partitioned tables to correctly account for what the partition expression preserves. Pull request #79111
Why it matters
This week addresses correctness issues in query results, security vulnerabilities in dependencies, and lock contention problems in shared-data mode. The fixes span FULL OUTER JOIN correctness, prepared statement parameter binding, and metadata lock handling under connector I/O, which impact query reliability and cluster performance.
Changelog entry
- CTAS now preserves explicitly declared VARCHAR(N) column lengths instead of widening them to VARCHAR(MAX) Release
- Iceberg GEOGRAPHY columns are now readable natively through CN transport and raw WKB MySQL output paths Pull request #79110
- Fixed FULL OUTER JOIN with multiple USING columns returning shifted values in non-first columns Pull request #79298
- Bumped Apache Ranger to 2.9.0 and BouncyCastle to 1.85 to fix CVE-2026-42537 and CVE-2026-59646 Pull request #79331
- Made shared-data publish version timeout configurable via FE parameters Pull request #79332
- Fixed CN abort in shared-data mode by preventing parallel-compaction filesystem IO on brpc bthread Pull request #76925
- Removed unnecessary hsync call on HDFS file close to improve write performance Pull request #78864
- Exposed large memory allocation report threshold as BE configuration parameter Pull request #79251
- Moved authorization checks, INSERT planning, and view expansion off connector I/O when holding metadata lock Pull request #79221
- Fixed prepared statement plan cache binding parameters by column instead of AND-tree position Pull request #78979
- Fixed range predicate pruning on expression-partitioned tables to account for expression monotonicity Pull request #79111
- Fixed replication job division by zero when target tablet has no replicas Pull request #79329
- Fixed AsyncTaskQueue busy-spinning after consumer interruption Pull request #79297
- Fixed dict page decoder to advance when pushed-down filter rejects whole dictionary Pull request #79007
- Added coredump collection support for CN containers Pull request #79148
StarRocks 4.1.3 ships with VARCHAR(N) length preservation in CTAS, native Iceberg GEOGRAPHY reads, and fixes for FULL OUTER JOIN value shifting, metadata lock contention, and security vulnerabilities.
StarRocks 4.1.3 is out with important correctness and performance fixes. FULL OUTER JOIN with multiple USING columns now returns accurate values, prepared statement caching respects parameter positions correctly, and metadata locks no longer block on external connector I/O. We've also added native Iceberg GEOGRAPHY support, made configuration more flexible with configurable publish timeouts, and patched security vulnerabilities in Apache Ranger and BouncyCastle.