Skip to main content

StarRocks version 4.1

danger

Container Image Issue (v4.1.0)

Due to an unstable load order issue in the v4.1.0 container image, BE processes may fail to start reliably in container environments. Container environment users should NOT upgrade to v4.1.0. Please wait for v4.1.1, which includes the fix (#71825).

warning

Downgrade Notes

  • After upgrading StarRocks to v4.1, DO NOT downgrade to any v4.0 version below v4.0.6.

    Due to internal changes in data layout introduced in v4.1 (related to tablet splitting and distribution mechanisms), clusters upgraded to v4.1 may generate metadata and storage structures that are not fully compatible with earlier versions. As a result, downgrade from v4.1 is only supported to v4.0.6 or later. Downgrading to versions prior to v4.0.6 is not supported. This limitation is due to backward compatibility constraints in how earlier versions interpret tablet layout and distribution metadata.

4.1.6​

Release Date: September 30, 2026

Behavior Changes​

  • The default HTTP client for the AWS SDK is switched from Poco back to the SDK's own client: enable_poco_client_for_aws_sdk now defaults to false. Set it to true to restore the previous behavior. #78375
  • Online optimize table is now opt-in: the FE configuration enable_online_optimize_table defaults to false, so ALTER TABLE ... DISTRIBUTED BY ... again blocks writes unless the config is turned on. #78206
  • jemalloc's dedicated oversize arena is enabled by default, so large allocations no longer land in the per-CPU arena of the calling thread. This improves reuse of large buffers and reduces fragmentation, and changes how BE and CN memory is distributed across arenas. #78396
  • Shared-data tablet metadata and transaction log files are now written with an Adler-32 checksum by default (lake_enable_protobuf_file_checksum), so corruption is detected on read. Readers already verified the checksum whenever a file carried one, so no downgrade step is needed. #75334
  • A shared-data primary-key load that mixes UPSERT and DELETE rows for the same key now preserves their in-transaction order by default (lake_enable_pk_preserve_txn_delete_order). #76211
  • Multi-table transactions now participate in shared-data batch publish instead of publishing one transaction at a time, which removes the serialization that CDC micro-batches fanning out to many tables used to hit. #77029
  • A shared-data partition now advances straight to the final version of a batch publish instead of through each intermediate version, so a query can no longer request an intermediate version that has no tablet metadata object, which surfaced as The specified key does not exist. #79175
  • A shared-data publish that keeps failing now backs off and throttles its retry logging instead of emitting the previous publish version task has not finished message on every attempt, which could dominate the FE leader's CPU and log volume during an incident. #79299
  • Del-file tombstone rows now count toward cloud_native_pk_index_rebuild_rows_threshold, so a delete-heavy shared-data workload triggers the primary-key index early flush it was supposed to. #76222
  • A shared-data column-upsert publish that supersedes its own segments now merges the delete vector, which previously could leave two live rows for one primary key. The damage only surfaced much later, when a CN restart rebuilt the persistent index and reported insert found duplicate key. #78797
  • The shared-data primary-key index compactor no longer stops silently while the flush side keeps producing sstables, which left a tablet whose persistent index grew without bound. #78812
  • HDFS files are no longer hsynced before they are closed. The hsync was a workaround for a crash that a separate change had already fixed, and it forced an fsync() on every DataNode replica on each close. #78864
  • A Parquet null_count that under-reports NULLs is no longer taken at face value during decoding and pruning. Files written by older parquet-mr versions previously returned corrupted values or dropped rows. #78329
  • List partition pruning of !=, NOT IN, and IS NOT NULL no longer discards a multi-value partition just because its value list also contains NULL. Queries on such a table, including joins that derive IS NOT NULL on the join key, return the non-null rows that were previously lost. #78946
  • Batch DDL can now build date range partitions that start at year 0000, which is a legal DATE value. Such a statement previously failed with the range of the partition is invalid. #78746
  • max_partitions_in_one_batch and the partition-number limit now count the partitions the request in hand is about to create. An oversized batch is rejected up front instead of being admitted and only failing the following batch. #79379
  • TRUNCATE TABLE <external_catalog>.<db>.<table> now checks the DELETE privilege against the catalog named in the statement instead of the session's current catalog. A user who was previously allowed through may now be denied, and vice versa. #79047
  • Streaming aggregation tuning is now driven by the group-by cardinality instead of the rows left after HAVING, so a query whose HAVING clause filters most groups away no longer loses its local pre-aggregation. #79064
  • Audit log rows now carry scanBytes, scanRows, returnRows, cpuCostNs, and memCostBytes for DML that targets an external Iceberg or Hive table or the FILES() table function, and for asynchronous materialized-view refreshes. These fields previously reported 0. #74072 #74954
  • The query profile and EXPLAIN ANALYZE now report the plan a retried query actually ran, rather than the plan from the first attempt. #79225
  • A Broker Load no longer writes its submit-time snapshot of enable_tablet_pre_split back onto the submitting client's live session variable. #79177
  • ALTER MATERIALIZED VIEW ... ACTIVE works again for non-aggregate incremental materialized views; the storage-filled __ROW_ID__ column is kept out of the materialized-view DDL column list. #77017
  • The Operation column of SHOW ALTER TABLE OPTIMIZE now shows a readable description of the optimize operation instead of an internal object address such as com.starrocks.sql.ast.OptimizeClause@b5dc069. #75948
  • A column that is missing from the tablet schema no longer aborts the BE during predicate push-down; the predicate is simply not pushed down. #79234
  • When OlapTableSink initialization fails, the partially initialized sink is no longer taken through the full close path, which could dereference state that was never created and abort the BE. The original initialization error is returned instead. #79370
  • Short key index page geometry is now validated without 32-bit overflow, so a corrupted page footer is rejected instead of wrapping and causing a heap out-of-bounds write. #79048
  • An HTTPS request whose TLS handshake times out is no longer treated as connected and retried on the same socket. A stalled request now fails after approximately one timeout instead of connect_timeout plus two receive timeouts. #79369

Improvements​

  • LDAP and Active Directory groups can now be resolved from the user's memberOf attribute, so a new directory group no longer requires a matching group-provider configuration on the cluster. #79254
  • The audit log now records the query's error message, not just the coarse ErrorCode, so a syntax error, an unknown table, and a privilege failure are distinguishable without correlating back to fe.log. #78798
  • Added server-level spill metrics that aggregate spill activity across all spillable operators, broken down by local and remote storage backend. #71827
  • Hudi metadata readers are now reused across the partitions of one scan instead of being rebuilt per partition, which shortens planning for tables with many partitions when the Hudi metadata table is enabled. #79367
  • Tablet split points are now computed from a segment's existing indexes instead of a dedicated full sort key index page, so tables that never split no longer pay for writing and storing that page. #79050
  • /memz now accepts jemalloc's own statistics options, which makes the per-arena dirty and muzzy page counts and the extent size-class breakdown reachable from a running BE. #79090

Security​

  • [CVE-2026-55971] Bumped Apache Thrift to 0.24.0 to fix a heap-based buffer overflow in THeaderTransport::untransform() in the C++ bindings. #76922
  • [CVE-2026-42537, CVE-2026-59646] Bumped Apache Ranger to 2.9.0 to fix an RCE via JDBC URL injection, and Bouncy Castle to 1.85 to fix a DTLS reassembler buffer overrun. #79331
  • [CVE-2026-71290] Bumped Apache HttpClient5 to 5.6.4. #79538

Bug Fixes​

The following issues have been fixed:

  • SHOW PROFILELIST, ANALYZE PROFILE, get_query_profile(), and /api/profile returned every cached profile, including other users' SQL text and plans, to any authenticated user. The new FE configuration authorization_enable_query_profile_access_check restricts a cached profile to the user who ran the query and to holders of SYSTEM OPERATE. #79375
  • The authorization check, INSERT planning, view expansion, the privilege check, and inspect_mv_refresh_info made external-catalog round trips while holding an FE metadata lock, so a slow metastore stalled every DDL waiting on the same lock. Those calls now happen outside the lock. #79319 #79226
  • A gtid and a partition version epoch could be generated on a non-leader FE, so two nodes could produce the same number at the same moment. #78799
  • FULL OUTER JOIN ... USING (c1, c2, ...) returned the wrong values: the first USING column was correct and every later one carried the previous column's value. Adding ORDER BY <ordinal> to the same query failed with an IndexOutOfBoundsException. #79298
  • A HAVING predicate was lost when GROUPING SETS, ROLLUP, or CUBE was rewritten into a union, so the query returned rows it was supposed to filter out. #79415
  • GROUP BY ROLLUP(a, b, a), and CUBE or GROUPING SETS naming a column twice within one set, produced a grouping set that carried the same key twice. #78261
  • Removing the aggregation above an aggregate-key table dropped the query's LIMIT before it reached the storage layer, so the BE read the whole table. #79414
  • Splitting an OR join into a union lined up the branches inconsistently, because the union's output columns and the first branch were ordered by column id while the other branches followed the projection map's iteration order. #79473
  • The skew-join rewrite replicated the preserved side of an outer join, so one input row could be returned several times and the result moved between runs. Its salt table also received the generate_series arguments in the wrong order, so the series emitted nothing. #79168 #79268
  • SELECT DISTINCT accepted an ORDER BY on a column that the DISTINCT drops, and the distinct push-down below a window left dropped columns in a projection. #77217 #77218
  • A window over an always-non-null aggregate such as bitmap_union_count() lost its declared nullability, so a DISTINCT or GROUP BY over it failed with error nullablel column. #79009
  • percentile_cont merge tracked exhaustion by value instead of by position, which could abort the BE. #77261
  • count(DISTINCT percentile_hash(...)), and any DISTINCT aggregate over a PERCENTILE value, crashed the BE; such a call is now rejected. #78795
  • The scalar agg-state combinators crashed on a null memory pool and raced on their nested function context. #76910
  • A JSON subfield aggregate on an aggregate table failed with a raw NullPointerException, because the synthetic subfield column has no aggregation type. #77952
  • Streaming pre-aggregation could run out of memory under enable_spill = true, because the limited-memory budget was latched once and never revised. #76702
  • A spilling hash join cancelled while it was restoring build partitions crashed the BE, because the probe operator closed without waiting for the spill I/O tasks. #79085
  • The local pass-through exchange kept appending chunks after the receiver was cancelled, and its channel could be used after free because the sink and the receiver did not share ownership. Sink readiness notifications also selected the sink observable but emitted a source event, so a driver blocked on OUTPUT_FULL could stay blocked. #76603 #77088 #76782
  • The query cache could store an incomplete per-tablet result and serve it to later queries, and a fragment containing an ASOF join was cached even though the temporal condition never reached the digest. #77066 #77563
  • An ASOF join whose temporal condition does not compare the two sides crashed the BE; such a condition is now rejected. #79049
  • A nested-lambda slot with no parent tuple was treated as bound by the TopN node's tuple set when building runtime filters, and an order-by hint dereferenced a column-less slot pushed into the scan as a heavy expression. #78050 #78527
  • Nested array_map and array_sort lambdas failed to plan or evaluate with Input dependency cols check failed or Expr evaluate meet error: slot_id N not found, because common sub expressions hoisted by an inner lambda escaped the scope that defined them. #78645 #78769 #78915
  • array_sort's comparator validation shared one error Status across drivers, which could double-free it. #78314
  • array_contains(NULL, [1, 2]) and array_position(NULL, [1, 2]) failed with class com.starrocks.type.NullType cannot be cast to class com.starrocks.type.ArrayType. #76970
  • Analyzing __iceberg_transform_truncate or __iceberg_transform_bucket mutated the shared builtin function object in place, stamping its wildcard decimal signature with the precision and scale of the first query analyzed. #76777
  • PARTITION BY RANGE(<partition-function>()) with an empty argument list raised a raw IndexOutOfBoundsException instead of a parse error. #75080
  • A range predicate was mapped onto a partition expression regardless of whether the expression preserves order and in which direction, so range and list partition pruning could drop partitions that hold matching rows. A NULL partition key was also looked up at the column's type minimum rather than strictly below it. Retention conditions that cast a DATE or DATETIME to text are accepted again. #78024 #79111 #79187 #79257 #79688
  • The Iceberg predicate converter stripped a CastOperator unconditionally, so WHERE CAST(d AS BIGINT) = 10 on a DECIMAL(5,2) column could prune a file holding 10.50. #78351
  • An incremental materialized view on an Iceberg base table was permanently inactivated by routine rewrite_data_files compaction, because the delta boundary advanced onto a skipped REPLACE snapshot. #76950
  • The column min/max statistics cache was not invalidated by partition or schema DDL, so a stale entry could be served indefinitely. #77441
  • Hive-family catalogs failed outright when the metastore or AWS Glue denied permission to read column statistics; they now degrade to empty statistics. Glue column-statistics requests also carry catalogId, so a cross-account deployment reads statistics from the configured catalog. #78455 #78461
  • Elasticsearch external tables and Elasticsearch catalogs rejected clusters running version 8 or 9 with Unsupported/Unknown ES Cluster version, and concurrent queries could overwrite each other's request URL parameters, which surfaced as unrelated analysis errors such as Column 'id' cannot be resolved. #78267 #79391
  • Predicates on a DECIMAL column of a Paimon table were converted using the StarRocks type family's default precision and scale instead of the column's Paimon DecimalType, so the literal could not represent the value. #78760
  • Azure Blob credential lookup failed when the endpoint was configured as a full URL, because the Hadoop configuration key embedded the scheme. ADLS2 storage volumes also dropped their Azure Workload Identity token-file property on serialization, so reloading the volume fell back to Managed Identity and failed with Identity not found. #78241 #79444
  • A JSON path with an array index such as '[0].value.url' threw a C++ exception for every row whose array was shorter than the index, which turned a large scan into a lock convoy inside the stack unwinder. The index is now bounds-checked. #78569
  • timestampdiff(MONTH, ...), timestampdiff(YEAR, ...), months_diff, and years_diff returned -1 instead of 0 when both arguments fell in the same month or year and the second was the earlier one. #79037
  • Constant folding of CAST(<varbinary constant> AS VARCHAR) returned the Java identity hash code of the backing byte array, such as [B@233c25e5, instead of the value. #77718
  • DICTIONARY_GET rejected a non-NULL key as NULL when the input column's cached has_null flag stayed conservatively true. #76881
  • A low-cardinality dictionary was kept on a nested-loop join's ON columns even though the rewriter never decodes them, dictionary expressions were folded through derived dictionaries that carry their own codes, and a "rolling low-cardinality" column repeatedly invalidated the global dictionary and forced a full-table re-collection. #78229 #78633 #78486
  • A DECIMAL256 literal was hashed from its string representation while the BE buckets rows from the raw 32-byte value, so point lookups on a table distributed by a DECIMAL256 column were sent to the wrong bucket. #78495
  • An OLAP scan named its sort key columns by column name rather than by column id, so a renamed column no longer matched the tablet schema. #77967
  • PruneComplexTypeUtil disabled complex-type subfield pruning for every column in the statement when it met a single expression it could not describe. The bail-out is now scoped to the expression that caused it, and dead subfield slots pulled out of the scan by predicate expression reuse are dropped. #79181 #77456
  • AstToSQLBuilder printed the columns of a SELECT * EXCLUDE list in double quotes, which the grammar accepts nowhere, so the regenerated SQL no longer parsed. #78052
  • ALTER TABLE ... ADD COLUMN on an Aggregate table silently created a key column when neither an aggregate function nor the KEY keyword was given, changing the grain the table aggregates on. Such a statement is now rejected as ambiguous. #78359
  • A column whose type has no BE key coder, such as JSON, could be used as a sort key and crashed the BE; such a definition is now rejected in CREATE TABLE and ALTER TABLE across all distribution types. #76795
  • USING GIN("IMP_LIB" = "builtin") was accepted by CREATE TABLE and then broke every INSERT with Can not get inverted imp type, because the property key reached the BE with its original casing. #77818
  • A legacy NGRAMBF index persisted without its gram_num property made the BE read past the UTF-8 offset vector and crash the CN while building a segment. #76989
  • Null flags were indexed linearly rather than by ordinal when a pushed-down predicate read a sparse range, so every row after a gap took the null flag of a skipped row. The dictionary page decoder also failed to advance when a pushed-down filter rejected the whole dictionary, which aborted the BE. #78389 #79007
  • A child expression error aborted the BE instead of being propagated. #77442
  • ThreadPool swallowed task exceptions by default and counted the task as finished. #76863
  • Cancelling a load through OlapTableSink crashed the BE or CN with a SIGSEGV when Jaeger tracing was enabled. #76869
  • AsyncFlushOutputStream::close() satisfied its promise while still holding the stream's own mutex, so the I/O thread woke futexes on freed memory after the waiter had destroyed the stream. #79182
  • A CN could crash with SIGSEGV during graceful shutdown when an in-flight load reached a StarOS-backed filesystem after shutdown_staros_worker() had released the global worker. #79058
  • Parallel compaction ran filesystem I/O on the brpc bthread, so the CN aborted with Resource deadlock avoided. #76925
  • Compaction aborted with SIGFPE when a vector-index rowset reported a negative data_disk_size. #78959
  • A corrupted local cache copy was re-read on every retry when a lake txn log read hit corruption, and primary-key index sstable block reads never verified the crc32c block trailer that the writer had always produced. #78733 #77479
  • A partial-update rewrite that degenerated into a copy dropped the source's encryption metadata, leaving a segment that no reader could open and that compaction could not rewrite. #79053
  • A shared-data schema change could record a rowset that references no data, after which every MERGE_TABLET on the partition failed with tablet merge source has an empty ordinary rowset. #79167
  • Range-colocate split bounds were compared as serialized protobuf bytes, which the FE and the BE do not encode identically. #76968
  • A plain single-table query on a member of an unstable range-colocate group failed with range colocate group ... is in an unaligned state. #76971
  • Shards of a new physical partition of a hash-colocate shared-data table were created without colocation placement information and had to be migrated afterwards. #79223
  • The FE did not tell the BE that a dropped tablet's table is range-distributed, which leaked files after a reshard. #76861
  • Replaying a reshard job update did not refresh the resharding tablets, so after an FE leader change a partition's publish could 404 forever on a tablet metadata object that was never written. Replaying a reshard job could also write to the edit log when the table had been dropped, and reshard publish retries spun instead of being paced. #79426 #79485 #77691
  • Shared-data partition versions were mutated in memory before the mutating operation was journaled, so a replayed version could move backwards. They are now derived from the journal and only ever advance. #79296
  • A replication job divided by zero when the target tablet reported no replica. #79329
  • The DataCache key hash was taken from a runtime dispatch table, so any change to that dispatch orphaned every cached block across an upgrade or rollback. It is now pinned to MurmurHash3. #79262
  • The FE scan-range heap-safety check ran once per physical partition instead of once per scan node, which made it quadratic in the number of physical partitions. #76978
  • Rowset metadata cache entries kept their initial charge after lazy-loaded indexes had increased segment memory usage, so the cache under-reported its footprint. #77893
  • Tablet::get_average_row_size() walked _rs_version_map without holding _meta_lock, against the contract that map is declared with. #79250
  • The FE thrift accept loop stalled for minutes on worker-pool saturation, and workers kept serving connections that had been queued long after their callers were gone. #78838 #79173
  • A non-leader FE whose journal applier was stuck kept serving stale metadata locally instead of forwarding, because the readiness verdict was only reached after a replay cycle returned. #79041
  • The getLoads RPC returned every load record in a single message, so a busy cluster filled the leader log with FE RPC failure ... MaxMessageSize reached and the loads_history archive rolled back and permanently lost rows. The RPC is now paginated by job id. #78898
  • A task run that migrated between the pending queue, the running map, the in-memory history, and the archived history while task_runs was being read could be reported twice. #79438
  • SHOW ALTER TABLE ROLLUP and SHOW ALTER MATERIALIZED VIEW accepted WHERE, ORDER BY, and LIMIT and then ignored them; only SHOW ALTER TABLE COLUMN applied them. FinishedTime is also accepted in a SHOW ALTER TABLE ROLLUP predicate. #79281 #79498
  • Loading the SQL blacklist rebuilt and sorted its immutable snapshot once per rule, which is quadratic in the number of rules and ran at every FE start and checkpoint. #78752
  • AsyncTaskQueue busy-spun between getOutputs() and tryGetOutputs() after the consumer thread was interrupted, because the interrupt was swallowed without clearing hasMoreOutput. #79297
  • A runtime change of sys_log_level was written to the configuration but never applied, even though the item is documented as mutable. #79200
  • has_enable_heap_profile() read the boolean jemalloc node prof.active into an int, so it always reported heap profiling as disabled. #78820
  • System.print() on a script's foreign objects printed instance of <Class> instead of the object's text, because the toString bindings were registered as methods rather than getters. #78877
  • Loading into an expression-partitioned table through the multi-table transaction stream load interface failed at commit whenever the BE had to create a partition, with automatic create partition failed. error: txn ... not exist. #78790
  • In combined txn log mode, a coordinator whose own end-of-stream arrived early could wait for the txn log collector indefinitely when the load was cancelled. #79389
  • A completed merge-commit load could report less than full merge-window progress in information_schema.loads. #78723
  • The scan SampleTime counter reported a block count rather than elapsed time. #78732
  • The LZ4 and ZSTD Arrow IPC codecs were missing from the FE classpath for the Arrow Flight SQL service. #76921
  • Upgraded StarOS, starlet, and starcache to v4.1.4. #79429

4.1.5​

Release Date: September 8, 2026

Improvements​

  • Supports ANALYZE SAMPLE TABLE PREDICATE COLUMNS for external tables. #77243
  • Extended sample-based tablet pre-split: supports non-key expressions, dynamic-overwrite temporary partitions, and Iceberg and overwrite loads. #77843 #77842 #77983
  • Streams source segments for lake column updates to reduce memory usage. #77275
  • The background metadata refresh for Paimon catalogs now refreshes only recently accessed and changed tables instead of enumerating the whole warehouse each cycle. #78057
  • Passes limit to the Paimon getRemoteFiles call during partition pruning. #76943
  • Extended GROUPING SETS pushdown to support AVG and COUNT. #77832
  • Allows including EXPLAIN COSTS output in the query profile. #73005
  • Makes starlet object-store upload thresholds configurable at runtime. #78448
  • Reduced lock contention: removed the global metacache lock for lake segments and made SQL blacklist verification lock-free. #78260 #78476
  • Reclaims tablet metadata by dropping delete_predicate on compaction and replication archival. #76870
  • Checksums shared-data delete files with CRC32C. #77798
  • Bounds how long a cancelled query waits for unreported instances. #76909
  • Various jemalloc improvements for better memory efficiency and observability: builds a 4K-page variant alongside the 64K one on arm64, exposes dirty/muzzy page and mapped/retained metrics, and applies mutable jemalloc_conf options at runtime. #77886 #78159 #78225 #78320 #78333
  • Added observability: a max_journal_replay_lag gauge on the leader FE, and additional lake publish-version tracing. #78382 #76658 #77048
  • Releases the reshard output shards' placement pin when the job finishes. #76945
  • Upgraded StarOS to v4.1.2. #77657

Security​

  • [CVE-2025-55163] Aligned all io.grpc artifacts via grpc-bom so grpc-netty matches grpc-core. #77171
  • [CVE-2026-59902] Bumped Netty to 4.1.137.Final. #78287
  • [CVE-2026-54399] Bumped Apache HttpCore to 5.4.3 to fix an uncontrolled-resource-consumption (DoS) vulnerability in the HTTP/1.1 message parser. #77753
  • [CVE-2025-48924] Upgraded the Broker commons-lang3 to 3.20.0 and removed unused commons-lang 2.6 and commons-configuration 1.6. #77748
  • [CVE] Rebuilt the pprof binary on a newer release and removed unused flamegraph tooling from the BE container image. #77846

Bug Fixes​

The following issues have been fixed:

Crashes and stability

  • Force BE exit when the fatal-signal handler hangs after marking the process as crashing. #76491
  • Fixed BE crashes from constant/invalid arguments in tokenize, ngram_search, generate_series, corr/covar_pop/covar_samp, strpos (INT32_MIN), and count() over an array of decimal. #77102 #77103 #77216 #77260 #77092
  • Fixed a BE crash when one ALTER adds an ordinary column and a generated column, and a cache-select crash after a read-schema reorder. #77436 #77245
  • Fixed a BE crash when the query cache reuses a lane for a partitioned hash join, and a hang when a lane's join has an empty build side. #77564 #77571
  • Fixed an out-of-range read and silent row loss in JsonColumn append, an integer overflow in BinaryColumnBase::replicate, and an array_map DCHECK failure when one array column is passed as several lambda arguments. #77090 #77545 #77433
  • Fixed substr returning bytes of neighboring rows on invalid UTF-8, and array_sort's lambda comparator driving the sort out of bounds. #78722 #77687
  • Keep parquet decoder scratch buffers off the stack, and bound the raw-JSON view in the SimdJsonConverter error path. #77615
  • Fixed a tablet-scheduler NPE on a disk with no reported storage medium, and NPEs when deparsing INSERT ... VALUES (DEFAULT, ...) and in PrepareCollectMetaTask when the optimizer has no query id. #76966 #76963 #77051

Query engine and optimizer

  • Fixed wrong or missing results in several optimizer paths: streaming distinct global limit, ranking window pre-agg across sort groups, constant aggregated value re-appended in the merge phase, GROUP BY rules not applied to every child, and analytic frames starting at a FOLLOWING offset. #77086 #77068 #77069 #77099 #77342
  • Fixed an NL Join null-aware anti join losing probe rows, conjunct evaluation on an empty chunk in NL Join probe, and a GROUPING SETS aggregation joined on its group-by keys failing with no executable plan. #77970 #77344 #77296
  • Fixed grouping-sets-to-union-all rewrite ordering, duplicating a limit as a set operator, and keeping Set operators out of colocate exec groups to avoid a hang. #77380 #77692 #77025
  • Fixed subquery planning in a window's PARTITION BY/ORDER BY, keeping the decimal type of the if() built for multi-column count(distinct), and normalizing scan heavy-expr result columns to the slot's nullability. #77087 #77346 #77242
  • Fixed an untyped array literal gaining a bogus type (breaking views), a CTE anchoring issue when the force-inline limit is hit, and reuse of inferred CTAS columns for a recursive CTE. #76986 #77018 #76453
  • Fixed several query cache correctness issues by adding the scan schema, join predicate common sub-expressions, and the ANN search spec to the query cache digest, and disabling the cache when a SortNode builds the TOPN filter. #77559 #77565 #77586 #77404
  • Fixed folding COUNT(*) from row counts that never covered the visible version, unconditional UKFK constraint collection in join reorder, and keeping columns read by OR-resident predicates after inverted-index filtering. #77190 #77197 #77659
  • Fixed datetime parsing correctness: bounded the Teradata and Joda parsers to the input string, and kept DateValue::weekday() in range for out-of-range Julian values. #77098 #77310
  • Serialize EXCEPT/INTERSECT keys by row when the batch buffer would be huge, and rebuild the JSON key column when a set operation deserializes its keys. #77821 #77215
  • Additional optimizer/expression fixes: check the status before unwrapping a StatusOr, decide property satisfaction once when enforcing it, read constant arguments at index 0 in encode_fingerprint_sha256, skip CHAR predicate zero-padding for non-positive column length, do not push a non-positive ranking predicate into a TopN, keep the NULL partition when pruning with a deduced partition predicate, stop reading past the end of the output schema in _switch_context, sort a run and merge runs by the same NULL convention, fill Analytor::_fns before prepare can fail, and stop forcing external CTAS list partition columns to NOT NULL. #77052 #77091 #77104 #77444 #77445 #77596 #77660 #77679 #77758 #78468
  • Fixed statement/deparse issues: validate the static partition clause for Iceberg/Hive INSERT with a column list, keep the TEMPORARY qualifier when deparsing a partition reference, support CTAS deparse to fix an empty SQL statement in the profile, and set isSingleStmt in proxyExecute so forwarded statements keep the origin SQL. #76659 #76987 #77978 #77982

JSON and data types

  • Fixed a large BinaryColumn SerDe issue, statistics collection for columns with dots in names, and reading multi_unnest/unnest array offsets as uint32 instead of int32. #75504 #71301 #78479 #78480
  • Fixed reduced Flat JSON vertical-compaction memory usage and reading the values themselves when a struct-subfield predicate is evaluated by rowid. #77682 #77891

Materialized views

  • Fixed IVM refresh with external authorization, the MV rewrite staleness baseline (now uses the last-freshness-confirmed time), and skipping MV rewrite for time-travel queries. #77210 #76758 #77683
  • Fixed assigning index ids to GIN indexes created on a materialized view, and keeping view scan projection when replacing it back in view-based MV rewrite. #77340 #77613
  • Additional materialized view fixes: validate default_mv_refresh_mode, fix ORDER BY on an incremental MV widening its primary key instead of sorting, and bound information_schema.materialized_views internal queries by query_timeout. #77231 #77680 #77585

Data Lake connectors (Iceberg, Paimon, Delta, Hive)

  • Fixed Iceberg correctness and stability: enforce NOT NULL columns on the write path, validate rewrite commits from the plan-time snapshot, invalidate the metadata cache after TRUNCATE, drop a table whose metadata file is missing, refresh the native table before cast-on-string-partition metadata delete, silent data loss in rewrite_data_files with a WHERE clause, and a too-small retention window in remove_orphan_files. #77589 #77709 #77385 #77786 #77335 #77797 #77394
  • Isolated Delta Lake per-table cloud credentials. #77424
  • Supports OpenX JsonSerDe column-name mapping for Hive external tables, one JSON field mapping to multiple Hive columns, and fixed table qualification in connector views for absent default-catalog and CTE references. #65515 #77716 #77887
  • Fixed Ranger view/MV authorization for external tables and restored the Ranger Solr audit destination on the FE classpath. #56316 #77294
  • Fixed the corrupt DELTA_BINARY_PACKED header being returned instead of thrown, and marking filter-excluded FLBA dictionary rows NULL in the Parquet reader. #77446 #78685
  • Fixed an NPE on ALTER TABLE RENAME for Iceberg REST catalogs, an NPE reading Iceberg $partitions with decimal or null timestamptz partition values, sharing one Hadoop FileSystem across Iceberg catalogs, and honoring paimon.option.cache-enabled=false again. #76498 #77742 #77297 #78271

Shared-data: compaction, vacuum, reshard, and replication

  • Compaction fixes: cache the compaction txn log that file bundling skips, sort candidates by max tablet score, fix read-chunk-size estimation, fix the Limiter resize losing tokens on shrink, and skip the publish-time segment rewrite for a delete-only write. #77578 #77482 #78192 #78087 #78071
  • Vacuum fixes: fixed wasted reads and stray v1 deletes in grace-blocked vacuum, kept the autovacuum retain floor at or above a reshard takeover, and avoided redundant lake metadata 404 probes. #78460 #78545 #78466
  • Reshard/split fixes: reject a reshard whose source tablet lives in a superseded materialized index, fix tablet split fallback cross-publish, silence expected reshard history lookup warnings, and prevent lake alter jobs from getting stuck after failover. #77512 #78270 #78059 #78517
  • Replication fixes: preserve shared lake files, read remote bundled lake metadata, and re-encrypt source lake files during replication. #77361 #77362 #78080
  • Recover corrupted local caches: drop and retry on checksum failure for delvec pages, and rebuild on corruption for PK-index SST compaction and tablet-merge SSTable rebuild. #78086 #77481 #78003
  • Fixed reading lake version-1 metadata from the partition-shared object, protecting snapshot-owned shared shard groups, and preserving dependency ordering in TransactionGraph.remove. #78731 #78800 #78077
  • Additional shared-data fixes: throttle transactions at final commit, do not pick a DECOMMISSION replica as the load primary, fix DML with shadow generated columns during online optimize, make spill_enable_direct_io actually engage O_DIRECT, fix a label-uniqueness race between concurrent BEGIN WITH LABEL, derive the query tracker reserve limit from the effective query memory limit, safely remap rowset IDs and references during tablet merge, apply a cross-published del file only to the keys the child owns, make tablet merge honor range-distribution colocate, refuse an incomplete combined txn log and stop replication_num from weakening the shared-data write quorum, keep explicit transactions on one tablet layout during reshard, drop a del file's local cache and retry on checksum failure, and report the abort reason when a closed lake delta writer rejects a task. #77015 #77035 #77252 #77255 #77401 #77408 #77690 #77744 #78113 #78162 #78625 #78022 #78632
  • Fixed shared-data sort-key and rowset-identity edge cases: project split boundaries onto the current sort key after a trailing key-column add, surface internal INSERT failures in recursive CTE execution, do not let an apportioned row count decide whether a cross-published rowset exists, make encode_sort_key reachable for narrow fixed-length IVM row ids and expand its constant argument, resolve the delta column group of an extended column through its root column, conserve range-split cross-publish statistics, fix FE max tablet compaction score collection, skip dead nodes when dropping the auto-increment map, measure the unsorted PK SST writer's map instead of counting allocations, propagate compression_level to synthetic sub-column metas, and skip standalone GIN index directory handling for the builtin inverted-index backend. #77504 #77510 #77511 #77751 #77847 #77759 #78269 #78496 #78561 #77498 #76949 #77101

Loading, transactions, and DML

  • Fixed bounding and checking chunk capacity on the data-load and column-mode partial-update paths, deciding condition update and partial update per owning child, and recording a merged rowset's del op_offset per statement. #77163 #78099 #78313
  • Fixed not journaling an insert-overwrite failure for a dropped table, and keeping the current row lifecycle correct across several partial-update paths. #77212
  • Fixed handing the disconnect kill to a worker instead of the I/O thread, and propagating accept() status in GroupedExecutionSinkOperator::push_chunk. #77590 #77737
  • Fail an internal DML/CONTROL statement that only records an error state, so the failure surfaces instead of being silently swallowed. #77388

Statistics, metrics, and FE/metadata

  • Fixed statistics correctness: reject null buckets/MCV in histograms, and make CancelableAnalyzeTask.cancel pick a single winner. #77024 #78593
  • Registered the pipe_driver_queue_len metric, added a BE metric for NotFound lake tablet metadata reads, skipped table metrics for non-table StarOS shards and checkpoint thread-pool metrics, and fixed the misspelled ZoneMapIndexFilter key in the profile dictionary. #77890 #78451 #78116 #77367 #78728
  • FE/metadata fixes: ignore recycled missing shard groups in meta sync, restore multiple connection groups per endpoint in bRPC, resolve compute-node hostnames in FE before shipping them to BE, make dropped FE exit itself on DROP FOLLOWER/OBSERVER, and expose colocate group scheduling sample knobs. #76604 #76765 #78390 #78215 #78450
  • Fixed skipping non-extended access paths when extending meta-scan tablets, matching a scan's access paths by column id, narrowing an OLAP scan's complex type only when the BE prunes it, and not pruning subfields of aggregate-state columns. #76593 #77987 #77894 #77901
  • Do not use a global dictionary for aggregate-state columns or dictionarize expressions returning ARRAY/STRUCT, and index page null flags by ordinal when a pushed-down predicate reads a sparse range. #77096 #78488
  • Additional metrics and FE fixes: report bRPC method error bvars as counters, report the real tablet count as Buckets for range-distribution partitions, fix an NPE in show proc '/global_current_queries', report data cache read stats in intermediate query statistics, use a minimal TSD fetch in jemalloc malloc_usable_size, stop the heap-profile toggle from writing prof.thread_active_init, prevent FE connection ID collisions after wrap, fix table stats health pinned at ~1.0 when many partitions are stale, use feature_log_dir for FE features-log paths, preserve inputIsBinary when copying logical window operators, and fix a Thrift client leak after cache invalidation. #76956 #77465 #77407 #77696 #77625 #78384 #78217 #76927 #77221 #77058 #77072

Other

  • Applied request timeouts to the pooled Poco session, upgraded Hyperscan to Vectorscan 5.4.12 on Linux AArch64, escalated the JAVA_OPTS_FOR_JDK_* warning, and stopped shipping test-scope jars in the java-extensions reader libs. #78361 #78326 #78328 #77752
  • Serialize dictionary_get keys by key size, catch exceptions in the thrift processor, and keep files() schema inference off the planner meta lock for CTAS. #78706 #78805 #78772
  • Read the last conf line when the file has no trailing newline, resolve the config YAML path against the cwd, name the GCS upload-threshold BE config gcs (not gs), upgrade StarOS and Starlet to 4.1.3, and removed an obsolete config forward-header split and a stray U+200E in doc filenames. #78065 #77132 #78452 #78038 #78780 #78612

4.1.4​

Release Date: August 5, 2026

Behavior Changes​

  • In shared-data mode, the TABLESAMPLE / SAMPLE clause and ANALYZE SAMPLE TABLE now take effect on lake tables. Previously the sample options never reached the BE, so a full scan was performed. #71874
  • ALTER TABLE changes to the flat_json configuration are now propagated to BE nodes through a versioned task so they take effect reliably. #74747
  • NOT MATCH predicates answered by a GIN inverted index no longer return NULL rows; NULL rows are now correctly excluded from the result. #75578
  • ANALYZE ... UPDATE HISTOGRAM ON no longer computes histograms for char-family columns (which the optimizer does not use) and computes only MCVs, reducing analyze cost. #75968
  • rewrite_manifests now clusters output manifests by order-preserving partition ranges, producing tighter per-manifest partition bounds and better manifest pruning on tables with many partitions. #76193
  • Multi-table stream load now honors each table's file_bundling property when deciding whether to use a combined transaction log, instead of following only the global lake_use_combined_txn_log config. #76806
  • A GIN inverted index combined with column-mode partial update on a Primary Key table no longer returns corrupted results; the index is now served from the delta column group segment. #76271
  • array_difference on integer arrays now computes adjacent differences in 64-bit before widening to BIGINT, fixing int32 overflow. #76569
  • Division expressions with a non-constant divisor are no longer treated as monotonic, fixing incorrect ZoneMap pruning that could produce wrong results. #76744
  • Array and map constructors now raise an error instead of silently corrupting data when the flattened result of a chunk exceeds 4 GB. #76419
  • Primary Key inserts now correctly reject keys that already exist in the L1/L2 persistent index; the existence check was previously skipped. #76591
  • Sample-based tablet pre-split on range-colocate tables now spreads new shards across compute nodes instead of packing them onto the source tablet's worker, fixing range batch imports that were roughly 3x slower than hash. #76608
  • Incremental-or-AUTO materialized views now rebuild the maintenance query for the PCT fallback in AUTO refresh mode, fixing refresh failures for shapes that IVM does not support. #75961
  • ALTER MATERIALIZED VIEW ... ACTIVE now works for non-aggregate INCREMENTAL materialized views; the storage-filled __ROW_ID__ column is kept out of the MV DDL column list so an inactive IVM can be re-activated. #77017
  • The Iceberg partition cache is now bounded by memory (not just entry count) and its usage is exposed, preventing unbounded growth on tables with many partitions. #76165
  • Iceberg REST catalogs using OAuth2 client credentials now self-heal after the background token-refresh task dies, instead of failing all subsequent requests. #76457
  • Lake full vacuum now reclaims orphaned .lcrm (Lake Compaction Rows Mapper) files that were previously skipped. #76522
  • Shared-data publish now refuses to write a bundle tablet metadata file that is missing tablets, preventing a partition from getting permanently stuck on publish. #76850
  • Abandoned external (Spark/Flink connector) scan contexts now cancel their pipeline fragments when reaped, and external scan plans set query_delivery_timeout to bound the QueryContext lifetime. #76535 #76536
  • Materialized view pinned-range maps are now keyed correctly (by table UUID), fixing MV bootstrap pinning being disabled for OLAP tables and mishandling of same-named tables in different databases. #76320 #76351
  • Audit logs for statements forwarded to the leader FE now record fully-qualified queried relations (matching the leader) instead of CTE aliases and unqualified table names. #76387
  • Aggregating a full STRUCT column together with ROLLUP, CUBE, or GROUPING SETS no longer fails at plan time with a usedStructFiledPos error. #76804
  • The FE memory Estimator now counts container overhead, and the Parquet scanner now pads missing columns using the bounded chunk size instead of the full batch size, improving memory accounting accuracy. #75971 #75981

Improvements​

  • Added support for an INCLUDE METADATA clause in Routine Load to expose Kafka/Pulsar message metadata (such as partition, offset, and timestamp). #73840
  • Made the Routine Load metadata alias optional. #76294
  • Added a LAST_FRESHNESS_CONFIRMED_AT column to information_schema.materialized_views. #74585
  • Exposed data cache metrics through the /metrics endpoint, and added FE compaction metrics, ALTER TABLE column-operation metrics and durations, and a CompressedInputBytes metric on the exchange sink. #58204 #72941 #76247 #76309
  • Exposed authentication and connectivity error details from connector metadata operations to end users. #75490
  • Improved error messages for large-column capacity limit checks. #76303
  • Added the hdfs_backend_selector_cache_replica_num variable, and made the object storage client cache size runtime mutable. #75023 #75851
  • Extended sample-based tablet pre-split meta-tier readers to more sort-key types, including CHAR, composite sort keys, and UTC-adjusted Parquet TIMESTAMP / ORC TIMESTAMP_INSTANT. #75937 #76011 #76114
  • Improved external-table statistics collection: predicate column usage is now tracked, multiple columns are collected in a single scan, and a bounded-cost scan budget is applied for Iceberg tables. #75938 #76638 #76549
  • Supports right-outer, semi, anti, and full-outer range-colocate joins. #76040
  • Optimized Query Queue V2 cost estimators. #76609
  • Pushed the wildcard literal prefix down to the S3 ListObjectsV2 call for FILES() globs, reducing objects listed. #76210
  • When scanning Iceberg manifest entries in remove_orphan_files, only the file_path column is now projected. #76020
  • Supports base compaction for lake Primary Key tablets, and load spill plus eager PK-index SST for separate-sort-key cloud-native PK tables. #76794 #76094
  • Supports a metadata-only add of a trailing sort-key column on shared-data range-distribution tables. #76341
  • Cancels in-flight exchange sink RPCs on fragment cancellation, and cancels in-flight compactions on resharded partitions during reshard cleaning. #75613 #76759
  • Fires multi-statement stream load channels before waiting, reducing load latency. #76715
  • Added a memory-limit check for column upgrades in Analytor::process. #75821
  • Preserves the real error status when an async delta writer is stopped. #76216
  • Records generation version on lake PK-index SSTables, applies op_write.seg_delvecs at lake Primary Key publish, and skips opening output segment footers during compaction publish conflict resolution. #76208 #76474 #76657
  • Added stack-trace and fine-grained trace counters for lake load and publish-version paths to aid diagnosis. #75901 #76810

Security​

  • [CVE-2026-44891] Bumped Netty to 4.1.136.Final to fix a memory-exhaustion (DoS) vulnerability in the STOMP subframe decoder. #76555
  • [CVE-2026-55971] [CVE-2026-43871] Bumped Apache Thrift to 0.24.0 to fix a heap-based buffer overflow in the C++ bindings and an infinite-loop vulnerability. #76922
  • [CVE-2026-10050] Excluded vulnerable Jetty jars (client-side Digest auth bypass, pulled in transitively via Hadoop) and bumped pgjdbc to 42.7.12. #76783
  • [CVE-2011-4969] [CVE-2014-6071] Excluded the unused avro-ipc jar that bundled a vulnerable jQuery 1.4.2 (and other jQuery XSS CVEs). #76270
  • [CVE-2024-29857] Removed vulnerable stale transitive dependencies that shipped alongside their fixed counterparts (for example bcprov-jdk15on 1.70 and EOL okhttp 2.x) and added dependency bans to prevent regressions. #76097

Bug Fixes​

The following issues have been fixed:

  • Planner crash on an empty range in join predicate derivation. #75011
  • Aggregate incorrectly pushed down over a CASE with a non-null constant ELSE. #75037
  • PARTITION-TOP-N partition-by rewritten to a pruned dictionary slot. #75956
  • Wrong operator precedence in the join shuffle-join output-property branch, and predicateCommonOperators not carried through join operator construction. #76203 #76330 #76388
  • Incorrect nullability for view columns and for ROLLUP keys at analysis time. #75684 #76149
  • regexp_extract_all infinite loop on a zero-length capture group. #75798
  • Wrong nullsFraction clamp in LargeOrCalculatingVisitor. #75864
  • Incorrect CAST semantics for string-to-number schema-change conversion. #75538
  • Sync MV rewrite losing a rollup column for same-column min/max. #75528
  • Rewrite incorrectly applied inside an array_map lambda when pulling scan predicates up. #76380
  • COUNT(DISTINCT) over-count on Iceberg bucket tables under bucket-aware execution. #76601
  • Error on nullable output for UNNEST + GROUP BY of a required Iceberg column. #76730
  • Reduced lock contention across the INSERT OVERWRITE code path, and restored Operator salt to avoid a Memo self-reference during CBO table prune. #75828 #76542
  • Iceberg partition pruning, manifest row-count estimation, metadata delete, equality-delete application, and Delta Lake partition pruning were incorrect when a string date partition column is compared with a temporal value. #76068 #76107 #76197 #76280 #76348
  • Iceberg reads did not honor the targeted snapshot's schema and partition spec; query failure on an Iceberg V1 table after dropping a partition field; and MV rewrite serving stale results after rollback_to_snapshot. #74711 #75149 #75924
  • Iceberg manifest data-file cache served an incomplete file set; the incremental scan-range iterator was unsafe to close concurrently; and analysis-time time-travel snapshot binding is now best-effort. #76215 #75953 #76448
  • Iceberg/Delta metadata-derived statistics are now tagged with StatsSource=TABLE_METADATA. #76560
  • Delta Lake and Kudu un-partitioned materialized view query rewrite. #76359
  • GCS vended credentials ignored due to a gcs-connector 3.x config rename. #75979
  • Hive getTable() now reconnects before the get_table_req fallback and detects table-not-found by exception type instead of message text. #76456 #76459
  • BOOLEAN min/max not supported in Parquet column-index statistics. #74752
  • Flat-JSON subfield reads for keys whose name contains ., and reconstruction of an intermediate flat-JSON object instead of returning NULL; JSON subfield pushdown is now skipped when subfield keys collide case-insensitively. #75583 #75764 #76594
  • Kept OR-nested predicates when only one branch is bitmap-indexed. #76275
  • BE crash in Primary Key auto-increment partial-update apply. #76119
  • BE crash from a LoadChunkSpiller init race during load spill. #76098
  • Native Parquet reader crash on an incomplete nested lake schema, and an ASAN crash for BOOLEAN nested in Avro complex-type columns. #76455 #76041
  • bad_variant_access during schema change when converting an invalid string to a NOT NULL numeric column. #76707
  • Heap-buffer-overflow in the SimdJsonConverter error path, and a use-after-free on a multi-character CSV delimiter straddling a buffer expansion. #76752 #76718
  • Use-after-free on MorselQueueFactory during scan teardown, in the spillable join build set_finishing at cancel time, and a global runtime-filter timer leak / unscheduled timer in the PipelineDriver destructor. #76259 #76633 #76252
  • Null-safe SparseRangeIterator::has_more() to fix a physical-split empty-tablet CN crash, and a bRPC stub cache clean timer leak. #75985 #75973
  • ConnectContext not restored on query-deploy workers. #76366
  • Preserve upsert/delete order within a transaction for shared-data Primary Key tables, including making the spill merge op-aware. #75338 #75366
  • Read durable metadata in cal_new_base_version to avoid a dangling prev_garbage_version; keep base_version in sync with base_metadata in publish_version; and persist the merged parallel-compaction transaction log on the regular path. #75904 #76313 #76460
  • Range-colocate fixes: stopped an alignment job storm and fail-close unaligned colocate joins, fixed null-safe joins dropping matches under bucket-shuffle, and improved range-colocate join detection in plan feedback. #75930 #76104 #76121
  • Tablet split/reshard fixes: bump the table optimistic version on split so concurrent queries re-plan, flush the PK-index memtable before identical-tablet reshard, retain lake vacuum files by version interval across reshard, stop the auto-split job loop on un-splittable range-distribution tablets, and fix IS NULL pruning on range-distributed sort keys after a split. #76123 #76367 #76209 #76663 #76797
  • Reject a full-column ORDER BY that reorders the key columns of a key-derived range-distribution table. #76256
  • Consolidate load-spill parallel merge results in flush order, and exclude touched indexes by metaId in file-bundling carry-forward. #75951 #76368
  • Reserve dictionary size + 1 for NULL-absorbing dict-mapping group-by keys, and check driver readiness before a profile-report reschedule. #75357 #75725
  • PlannerMetaLocker skipped unlock when the lock never succeeded. #74041
  • Filter resource groups by warehouse. #73209
  • Escape the jsonpaths value in SHOW CREATE ROUTINE LOAD output. #75755
  • Fixed Arrow Flight prepared-statement forwarding. #76310
  • Fixed dictionary refresh-interval overflow and unintended auto refresh. #76634
  • Fixed a statistics cache load failure on empty min/max under ERROR_IF_OVERFLOW. #76684
  • Made the catalog-drop existence check atomic under a write lock. #76778

4.1.3​

Release Date: July 14, 2026

Behavior Changes​

  • CTAS now preserves explicitly declared VARCHAR(N) column lengths instead of widening them to VARCHAR(MAX). Existing tables are unaffected; new tables created with CTAS will enforce the declared length on subsequent writes. #73498
  • Querying sys.fe_memory_usage or sys.fe_locks without the OPERATE ON SYSTEM privilege now returns a clear access-denied error instead of a misleading node-lookup failure. #73567
  • FILES() and broker/stream load no longer apply a session timezone shift to INT64 Parquet timestamps written with isAdjustedToUTC=false; those timestamps are now treated as wall-clock values and loaded as-is. Data loaded from such files before v4.1.3 may differ from data loaded after upgrading; reload if consistency is required. #73674
  • Successfully committed multi-table transaction stream load jobs are now correctly shown as VISIBLE in information_schema.loads and SHOW STREAM LOAD instead of remaining stuck at PREPARING. #74386
  • Connector incremental scan range scheduling now consistently reuses the deployed fragment's driver layout, preventing scan ranges from being incorrectly assigned to non-existent drivers. #74674
  • LIKE constant-folding now matches MySQL 8 backslash-escape semantics, correcting cases where patterns such as 'a\\\\b' previously returned opposite results. #74814
  • Routine Load now supports the property.kafka_partition_discovery property, which allows partition auto-discovery to continue even when kafka_partitions and kafka_offsets are specified to seed exact starting offsets. When property.kafka_default_offsets is not set, the default starting offset for partitions discovered after the job already has consuming progress changes from OFFSET_END to OFFSET_BEGINNING — and this applies to all auto-discovery jobs, not only those using the new property. #74729
  • Non-group-by aggregates are now pushed down through UNION ALL branches before merging, reducing network transfer and memory usage for queries that aggregate over a union. #73930
  • IVM maintenance queries are now re-derived from the current view definition at each refresh instead of using the frozen query text stored at CREATE time; existing MVs automatically benefit from rewriter bug fixes without needing to be recreated. #74881
  • Sample-based tablet pre-split now spreads pre-split shards across all compute nodes (SPREAD placement) instead of packing them onto the source tablet's worker (PACK placement), improving load parallelism. #75514
  • ALTER TABLE ... MODIFY COLUMN that changes only the column comment now takes the lightweight metadata-only path instead of spawning a full schema-change job, and this now works on Primary Key columns as well. #75325
  • FLOOR and CEIL are now treated as non-reserved keywords and can be used as column names without quoting. #75241
  • SHOW FUNCTIONS output now always includes the isolation property (shared or isolated) in the Properties column for UDFs and UDAFs. #75255
  • The default value of lake_vacuum_min_batch_delete_size is raised from 100 to 200, improving vacuum throughput on object storage by batching more stale-file deletions per DeleteObjects request. #74304
  • Iceberg REST catalog tables with vended credentials are now cached and their credentials are refreshed in the background, eliminating per-getTable() GetDataAccess calls that caused AWS Lake Formation rate limiting. #75431
  • IVM bitmap_union, hll_union, and percentile_union aggregate states are now stored once in the materialized view instead of twice (visible column + hidden __AGG_STATE_ column), halving storage for those sketch types. #75760
  • Incremental materialized views now support bitmap_agg, hll_union, percentile_union, and bitmap_union aggregate functions, enabling exact distinct-count and sketch-based aggregations to be maintained incrementally. #75587 #75610
  • Sample-based tablet pre-split tablet count is now rounded up to the nearest multiple of the active compute-node count for even distribution, and bounded below by a minimum tablet size to avoid excessive fragmentation on small loads. #75360 #75584

Improvements​

  • The ngram_search function now accepts a non-constant needle argument. #74675
  • Added an HTTP authentication framework controlled by the enable_http_auth FE configuration, gating authentication and RBAC enforcement on all external HTTP endpoints. #73822
  • Added refresh and placement observability columns (refresh_warehouse, refresh_resource_group, refresh_mode, refresh_type, last_refresh_details) to information_schema.materialized_views. #74342
  • Added opt-in lazy refresh of the external statistics cache on journal replay, controlled by a new FE config, to prevent a slow or stuck external metastore from stalling FE journal replay or startup. #74371
  • VARCHAR length increase is now allowed on range-distribution (shared-data) sort-key columns via fast schema evolution without a data rewrite. #74698
  • Added a stack-trace dump when a shared-data transaction log write exceeds a configurable threshold, making slow put_txn_log / put_combined_txn_log calls easier to diagnose. #74704
  • Tablet pre-split meta-tier footer readers now support DATE, DATETIME, DECIMAL, VARCHAR, and ORC TIMESTAMP sort keys, reducing the number of loads that must fall back to data-tier sampling. #74710 #74739 #74792 #74902 #74955 #75186 #75209 #75427 #75697
  • Sample-based tablet pre-split now applies to INSERT INTO ... SELECT ... FROM <OLAP table> loads, and also to column-list INSERT statements that include all sort-key columns. #74828 #75345
  • Added Adler-32 checksum protection for shared-data tablet metadata and transaction log files, enabling silent corruption to be detected on read. #74924
  • Added the txn_max_committed_pending_publish_ms FE metric per database, reporting the age of the oldest committed-but-not-yet-published transaction to help detect stalled version publishing. #75025
  • Tablet split/merge is now triggered in real time from the publish-version response, reducing the lag between a load completing and automatic split/merge being initiated. #75010
  • Optimized condition-update compare phase for lake primary-key tables by routing no-SST condition-merge tasks to the pk_index_execution thread pool. #74572
  • Scoped lake schema-change and rollup job locks to the table level instead of the whole database, reducing lock contention on concurrent operations for other tables in the same database. #75087
  • Narrowed several database-level write locks to table-scoped intensive write locks in shared-nothing mode, reducing lock contention during BE report callbacks and cooldown operations. #74521 #74523
  • Avro Routine Load now supports native MAP and STRUCT target columns. #74901
  • Range-colocate tablet stability gating now waits for StarOS placement convergence before marking a group stable, ensuring colocate joins achieve host-local execution. #75290 #75656 #75883
  • Improved CBO statistics for external tables: the optimizer now estimates row counts from Iceberg manifests without full file enumeration, corrects Hive/Hudi row-count underestimation for Parquet/ORC compression, adds async row-count statistics for JDBC connectors, and provides NDV estimation fallback for Iceberg and external connectors when Puffin stats are unavailable. #75280 #75082 #75083 #75092 #75097 #75382 #75474
  • Iceberg manifest column statistics are now cached selectively for clustered columns only, reducing FE heap consumption for wide tables with many data files. #75395
  • External table statistics collection now supports persistent predicate-column tracking across FE restarts and HA failovers, enabling auto-ANALYZE to target the correct columns. #75653
  • Added structured [ExternalStats] log lines covering the full lifecycle of external-table statistics collection from scheduling through execution. #75335 #75529
  • SHOW ANALYZE STATUS now includes partition, column, and snapshot metadata in the Properties column for external table statistics jobs. #75630
  • The statistics source (TABLE_METADATA, ANALYZE, or NONE) for each external table is now exposed in the query runtime profile. #75253
  • Added support for partition filter requirement and partition count limit for Iceberg and Delta Lake external tables (previously only available for Hive, Hudi, and Paimon). #75790
  • Supports sub-1% sampling ratios in TABLE SAMPLE and histogram ANALYZE, fixing failures on large tables where the computed ratio would truncate to zero. #74551
  • Added the jemalloc_conf BE configuration item, making jemalloc runtime options visible via information_schema.be_configs. #75344
  • Added the compaction_chunk_reset_memory_tracker_threshold_percent BE configuration to reduce memory usage during Primary Key compaction in shared-nothing mode by releasing retained chunk capacity. #75091
  • Upgraded staros to v4.1.1, including persistent datacache.enable across restarts, per-worker-group shard warmup timeout override, and improved S3 retry jitter. #75204
  • Optimized SQL credential redaction on the audit hot path by skipping the regex scan when no credential marker is present in the SQL string. #74812
  • Expression-driven on-demand lazy column loading for the Parquet scanner reduces unnecessary I/O on multi-branch OR queries. #74886
  • ds_hll_count_distinct / DataSketchesHll now produces stable cardinality estimates by using the composite estimator instead of the order-dependent HIP estimator. #75053

Security​

  • [CVE-2026-45416] [CVE-2026-44249] [CVE-2026-45673] Upgraded Netty to 4.1.135.Final to fix SNI handler heap exhaustion (DoS), IPv6 subnet filter bypass, and DNS cache poisoning. #74668
  • [CVE-2026-54512] [CVE-2026-54513] Upgraded jackson-databind to 2.21.4 to fix two deserialization vulnerabilities. #75373
  • [GHSA-2r2c-cx56-8933] [GHSA-47qp-hqvx-6r3f] Excluded org.jline:jline-remote-telnet from Hadoop transitive dependencies to remediate unauthenticated Telnet-server DoS vulnerabilities. #75066
  • [CVE-2026-39822] Updated pprof prebuilt to fix a vulnerability in the pprof binary. #76248 #74669
  • Fixed SQL injection in information_schema.task_runs where a single quote in a predicate value could escape the literal boundary. #75520
  • tencent.cos.access_key, tencent.cos.secret_key, and iceberg.catalog.jdbc.password are now masked in SHOW CREATE CATALOG output. #74696
  • Fixed an out-of-bounds read in url_decode when the input ends with a truncated percent-escape sequence. #75139
  • Fixed HyperLogLog::deserialize accepting out-of-range SPARSE register indices, which could corrupt heap memory and crash the BE on malformed input. #75521
  • Fixed bar() rejecting negative width values, which previously allowed unbounded string growth and BE memory exhaustion. #75143

Bug Fixes​

The following issues have been fixed:

  • add_files populated Iceberg file bounds with Parquet physical encoding bytes instead of logical typed values, causing incorrect file-level min/max pruning (for example, on DECIMAL columns). #69207
  • ApplyTuningGuideRule threw UnsupportedOperationException when traversing plan nodes whose input lists were built as immutable List.of(...). #70785
  • INSERT OVERWRITE two-phase re-plan could produce stale lambda-argument column reference IDs from the first planning session, causing expr_type does not match slot_type errors. #73273
  • Partial updates on tables with GIN (inverted) indexes caused queries to hang indefinitely or fail when the GIN-indexed column was omitted from the update. #73773
  • Lake PCU (partial column update) crashed or silently corrupted data when a schema drift occurred between the rowset schema and the tablet schema. #74005
  • A combined ALTER TABLE on an external Iceberg table with multiple schema clauses incorrectly re-executed all previously queued actions on every clause dispatch. #74036
  • PartitionedSpillerWriter crashed with SIGSEGV when the num_rows snapshot exceeded the actual chunk row count during partition-flush and resource-group-cancellation interleaving. #74081
  • BE process could exit unexpectedly during startup (typically right after deployment) because SIGPIPE was not ignored in BE signal initialization. #74424
  • Parquet temporary dict-code columns leaked to upper layers when a struct VARCHAR subfield fill was skipped due to row-range filtering, causing type mismatches. #74452
  • SELECT ... INTO OUTFILE recorded ReturnRows=0 in the audit log instead of the actual exported row count. #74467
  • TabletChecker.doCheck() threw IllegalMonitorStateException in blockingAddTabletCtxToScheduler due to a lock type mismatch, causing entire checker rounds to abort silently. #74596
  • information_schema.COLUMNS always returned NULL for DATETIME_PRECISION, breaking MySQL-protocol clients that derive column size from that field. #74623
  • MV refresh failed with Duplicate key when the query joined two tables with the same unqualified name across different databases or catalogs. #74730
  • Spillable hash join probe crashed under certain conditions. #74978 #75140
  • Iceberg truncate and bucket transform functions crashed the BE with SIGFPE when the width or bucket count argument was zero. #74998
  • mod() and pmod() crashed the BE with SIGFPE when the dividend was TYPE_MIN and the divisor was -1. #74980
  • histogram() crashed the BE with SIGFPE when bucket_num was zero or negative. #75041
  • encode_fingerprint_sha256 crashed with SIGSEGV when all input rows were NULL. #75042
  • LIKE patterns containing the single-char wildcard _ returned incorrect results when evaluated via a GIN inverted index. #75551
  • AND-only MATCH queries against a GIN inverted index returned a spurious error when the target segment was empty. #75161
  • CLucene match_all queries returned incorrect results; resolved by upgrading the CLucene dependency. #75180
  • Vector index rewrite registered a synthetic distance column directly on the shared table schema, causing Multiple entries with same key errors for unrelated concurrent queries on the same table. #74785
  • Join reorder pruning could prune columns still referenced by scan predicates, causing statistics estimation to throw missing statistic of col. #74791
  • avg(DISTINCT x) was incorrectly rewritten via a sum/count materialized view, silently dropping the DISTINCT and returning wrong results when duplicates existed. #75071
  • ALTER TABLE ... MODIFY COLUMN ... AFTER <nonexistent_col> threw an internal NullPointerException instead of a clean semantic error. #75073
  • SHOW CREATE ROUTINE LOAD emitted a spurious leading comma before the first load-description clause for jobs without a COLUMNS TERMINATED BY clause. #75522
  • SECURITY INVOKER views with CTEs could fail privilege checks with an NPE when the CTE name was mistaken for a real table reference. #74813
  • ReduceCastRule aborted query planning with a SemanticException when a date/datetime boundary literal shifting would overflow the representable range (for example, <= '9999-12-31'). #75036
  • SplitJoinORToUnionRule emitted duplicate rows when a join condition used null-safe-equal (<=>) disjuncts. #75038
  • Tracers shared across parallel metadata-preparation threads for multi-table external queries caused IllegalStateException under enable_profile=true. #74746
  • Partition consumer errors in ChunksPartitioner were silently discarded, allowing a partitioned TopN to return partial or wrong results without surfacing an error. #74693
  • BE vacuum tasks continued running as zombies after the FE caller's timeout elapsed, exhausting the RELEASE_SNAPSHOT thread pool and collapsing vacuum throughput. #74694
  • An autovacuum race could momentarily compute a minActiveTxnId one greater than an in-flight transaction, causing the BE to delete still-needed combined transaction logs and permanently wedging publish. #74906
  • Queries were incorrectly marked as canceled after finishing successfully due to a race between FE EOS-cancel and BE stage-2 deploy. #75009
  • BE crashed with SIGSEGV in AggTopNRuntimeFilterUpdaterImpl when the aggregate TopN runtime filter build key was a ConstColumn. #74809 #74941
  • array_map / transform silently dropped NULL rows and returned wrong row counts when all non-null arrays were empty. #75141
  • LARGEINT / DECIMAL128 literals above 2^64 were silently truncated to 64 bits in JIT-compiled expressions. #75137
  • UTF-8 string functions (split, split_part, str_to_map) read beyond the end of the string when the last character had a truncated or invalid multi-byte lead byte with an empty delimiter. #75068
  • parse_json() silently returned NULL for malformed JSON even in ALLOW_THROW_EXCEPTION SQL mode instead of failing the query. #74976
  • Strict-mode numeric narrowing casts incorrectly raised overflow errors on NULL rows whose slot data was undefined. #74903
  • Pre-1970 Parquet INT64 timestamps with a non-zero sub-second part were decoded to garbage values due to negative truncating-division remainder. #75207
  • Pre-1970 ORC TIMESTAMP values had their sub-second component dropped on load. #75432
  • ORC stripe min/max timestamp statistics were decoded incorrectly for pre-1970 and sub-second bounds, causing data files to be incorrectly pruned. #75543
  • Nested INT96 Parquet timestamps inside ARRAY, MAP, or STRUCT columns lost one session-timezone offset on load. #74868
  • Parquet UINT_32 values were sign-extended instead of zero-extended when loaded into a BIGINT column, silently storing negative values for high-bit unsigned integers. #75002
  • HiveDataSource destructor caused a heap-use-after-free by destroying _pool (and its Expr nodes) before _scanner_ctx (which holds predicates referencing those nodes). #74818
  • Reading gzip-compressed JSON Hive external tables with OpenX SerDe failed with UTF8_ERROR when a multi-byte UTF-8 character straddled an 8 MB decompression buffer boundary. #74827
  • ADLS2 ListPaths crashed with SIGSEGV on non-HNS accounts due to missing JSON fields that the client accessed unconditionally. #75166
  • unnest crashed or returned wrong results when multiple UNNEST operators shared the same input array column and consumed different subfields. #75012 #75445 #76002
  • query_mem_limit was not enforced during unnest execution, allowing unnest over large arrays to OOM-kill the BE instead of failing the query. #75179
  • TopN with RANK boundary dropped one row when the rank limit fell exactly on a chunk boundary. #75045
  • Column pruning after PushDownDistinctAggregateRule could generate an empty analytic (window) operator, causing planning or execution errors. #74810
  • EliminateSortColumnWithEqualityPredicateRule set the row limit only on the scan operator without setting a global limit, causing COUNT(*) over a limited sub-query to return more rows than expected under concurrency. #74983
  • Lake primary-key persistent index rebuild used wrong segment iterator positions in segment-range mode, causing incorrect key-range filter application. #74887 #75206
  • DROP PERSISTENT INDEX modified rebuildPindexVersion without a table lock; RestoreJob post-restore mutated MV base-table info under only a DB READ lock; FinalizeCreateTableAction passed a DB-level lock across iterator creation. #74968
  • dumpImage could strand the global meta lock indefinitely if acquiring a per-database lock threw mid-loop. #75488
  • Multi-statement stream load leaked one TxnStateCallbackFactory entry per transaction, growing without bound and eventually exhausting FE heap. #75188
  • information_schema.task_runs row count for histogram statistics could overflow primary_key_limit_size (128 bytes) when catalog, database, table, or partition names were long. #75735
  • BE JVM metrics emitted invalid Prometheus # TYPE lines (label sets inside the metric name), causing Prometheus to abort the entire scrape. #75240
  • SHOW PARTITIONS and information_schema.partitions_meta reported all physical partitions' bucket counts as the table-level default instead of each partition's actual bucket count on shared-data tables. #75734
  • SHOW PROC '.../index_schema/<id>' returned the base table schema for all rollup indexes on shared-data (CLOUD_NATIVE) tables. #76069
  • ALTER TABLE ... MODIFY COLUMN no-op clauses were incorrectly routed to the lightweight comment path, causing MODIFY COLUMN COMMENT can not be combined with other alter operations errors in batch ALTER TABLE statements. #75736
  • isCommentOnlyModification could misidentify key/aggregation columns as comment-only changes due to incorrect isKey / aggregationType normalization. #75545
  • ALTER VIEW could commit a cyclic view definition that caused subsequent SELECT to throw StackOverflowError. #75033
  • OrderedPartitionExchanger caused a heap-use-after-free when a downstream consumer mutated the previous chunk while accept() still held a pointer to it. #75279
  • NLJoin crashed when the build-side's slot descriptor was non-nullable but the runtime state was nullable. #75343 #75788
  • CAST(json/variant AS struct) crashed the BE at fragment prepare when a struct field name was not a parseable JSON path. #75355
  • Dict-decode for nested dictionary expressions could produce incompatible dictionary translations between producer and consumer fragments, causing Dict Decode failed errors at runtime. #75246
  • Schema change crashed with a null-pointer dereference when get_rowset_by_version returned nullptr and the gtid comparison was placed before the null check. #74855
  • Shared-data cluster snapshots became unrestorable after a tablet split/merge because the snapshot manager did not consider reshard jobs when deciding whether to reap parent tablet metadata. #75638
  • File-bundling vacuum incorrectly flagged zero-row bundled segments of sibling tablets as non-shared, causing their bundle file to be deleted while other tablets still referenced it. #75689
  • Shared-data table compaction publish dropped rollup/synchronous-MV indexes that became visible after the compaction transaction began, leaving the bundle file without those indexes. #76105
  • Shared-data persistent-index compaction incorrectly deleted pass-through-reused SSTable files when a compaction was dropped during tablet reshard. #75726
  • NOT NULL-to-nullable flat-JSON column schema evolution caused a CHECK crash in the compaction read path. #75680
  • count_combine over a nullable column crashed the BE with SIGSEGV in the streaming pre-aggregation pass-through path. #75298
  • Java UDFs failed to load on JDK 21+ due to a reflective DirectByteBuffer constructor lookup that was removed in JDK 21. #75666
  • CTAS into a Unified catalog (Hive metastore) always failed because the parser did not support the ENGINE clause in CREATE TABLE AS SELECT. #75771
  • JoinTuningGuide feedback-driven join rebuild lost predicateCommonOperators, causing InputDependenciesChecker validation failures on plans with common sub-expression reuse. #75773
  • Query cache normalization crashed with Preconditions.checkState on tables with sub-partitions where empty sub-partitions were pruned before the version list was built. #75789
  • replayFromJson silently skipped session variables stored under a legacy alias, causing query dump replay to fall back to default values. #75813
  • Iceberg _row_id virtual column returned incorrect values for data files with more than one Parquet row group due to double-counting of the row-group start offset. #75758
  • Iceberg DELETE/UPDATE planner could not locate the target scan node because it matched by synthetic table ID instead of physical table identity, losing the base snapshot ID and conflict-detection filter. #76013
  • FragmentContext::set_final_status crashed with SIGSEGV when a cancel_plan_fragment RPC arrived before PipelineExecutorSet::start() was called. #75030
  • QueryContext could be reclaimed while FragmentExecutor was still tearing down a fragment, causing heap-use-after-free in ResGuard::reset(). #74978
  • StringSearch::_pattern was uninitialized, allowing a default-constructed search() to dereference an uninitialized pointer. #75614
  • DATETIME microseconds were rendered using the JVM default locale's digit set, causing non-ASCII digits on locales such as Arabic or Persian that broke boundary value parsing in tablet pre-split. #75001
  • Partition row counts could be written as zero into _statistics_.column_statistics after INSERT OVERWRITE before tablet stats were refreshed, causing the optimizer to collapse partition cardinality estimates. #74801
  • enable_statistic_collect_on_first_load table-level override could not enable first-load statistics collection when the global config disabled it. #74794
  • PushDownNonGroupedAggregateBelowUnion produced nullable outputs with non-nullable declared types when a union branch had no input rows, causing BE CHECK failures. #76101

4.1.2​

Release Date: June 18, 2026

Behavior Changes​

  • Connecting to a database that the user has no privilege on now returns a proper MySQL error packet instead of closing the connection with ERROR 2013. #70072
  • SHOW FUNCTIONS now masks UDF file and object-file paths as *** for users who can see a function through function-level privileges but do not hold the create-function scope privilege. #73425
  • Ranger row filter and column masking policies are now correctly applied when querying Hive views from external catalogs. #73265
  • ALTER TABLE ... ADD COLUMN ... DEFAULT current_timestamp now correctly preserves the current_timestamp generator expression. DESCRIBE and information_schema now reflect the expression rather than the backfill-time literal. #73455
  • information_schema.loads load-time filtering no longer shifts filter bounds on clusters whose session timezone differs from UTC+8. Load times are now exchanged as UTC epoch milliseconds across the FE–BE boundary. #73365
  • The connector_max_split_size session variable now correctly applies to Paimon scan split calculation instead of always using the default value. #71756
  • pipeline_enable_large_column_checker is now enabled by default. #72798
  • Hive partition statistics are no longer refreshed automatically per key on a timer. Partition stats are now only refreshed during explicit refreshTable() calls, reducing HMS load on large partitioned tables. #73563
  • When an Iceberg or external-catalog base table undergoes schema drift (column type change, column drop, or table drop), the dependent materialized view is now marked inactive at the next refresh instead of silently producing NULL rows or opaque errors. #73770
  • The Iceberg connector now partially pushes down the convertible side of AND compound predicates instead of discarding the entire predicate when only one side is convertible, improving partition pruning and data skipping. #70293
  • Explicit-transaction COMMIT now correctly waits up to query_timeout seconds (not milliseconds) for the database write lock, preventing spurious lock-timeout failures under brief concurrent write activity. #73549
  • IVM refresh now surfaces strict-load filter errors to the caller instead of silently dropping filtered rows. #73938
  • count_combine(nullable_col) now correctly excludes NULL rows, matching COUNT(col) semantics. Incremental MVs backed by COUNT(<nullable column>) were previously materializing inflated counts. #74029
  • SHOW ALTER TABLE COLUMN now also displays asynchronous metadata-only alter jobs triggered by ALTER TABLE ... SET (...) for properties such as file_bundling and enable_persistent_index on cloud-native (shared-data) tables. #74198
  • Creating an incremental MV with a HAVING clause that references an aggregate function now fails at CREATE time with a clear error instead of producing an internal plan error on first refresh. #74054
  • IVM now supports MIN/MAX(DECIMAL) aggregate functions in incremental materialized views. #73969
  • IVM adaptive refresh now correctly bounds the delta window when the first delta trait already exceeds mv_max_rows_per_refresh, preventing the entire backlog from being refreshed in one task run. #74464
  • GROUP-BY-only incremental MVs (for example, SELECT k FROM t GROUP BY k) now correctly encode __ROW_ID__ as VARCHAR, fixing a crash on the second refresh. #74030

Improvements​

  • Supports Paimon views, including CREATE/REPLACE/DROP, SHOW/DESC, and querying Paimon views from external catalogs. Table references inside Paimon views are now resolved against the Paimon catalog instead of default_catalog. #56058 #70217
  • Supports an explicit schema parameter in FILES() for stable schema control when reading files with schema drift or complex nested types. #72033
  • get_query_profile() now retrieves query profile information across all FE nodes, not only the connected FE. #71123
  • Added the query_id() built-in function, which returns the UUID of the currently executing query. #73621
  • CREATE/ALTER STORAGE VOLUME in shared-data mode now validates storage location accessibility (credentials and endpoints) before persisting metadata, failing early on misconfiguration. #70053
  • Added WebIdentity token provider support for AWS S3 credentials in BE, matching the existing FE support for AWS_S3_USE_WEB_IDENTITY_TOKEN_FILE. #69966
  • Added the ADMIN SKIP COMMITTED TRANSACTION command to unblock stuck COMMITTED transactions on shared-data tables when publish is permanently blocked by missing txnlog, lost segments, or slow remote I/O. #73553
  • information_schema.tables_config now pushes down table_name predicates to the FE, greatly reducing overhead for single-table lookups. #73210
  • Added missing MySQL 8 columns to information_schema tables to improve compatibility with BI tools and JDBC drivers that inspect MySQL 8 schemas during connection introspection. #73370
  • Added the enable_pipeline_event_scheduler BE configuration as a cluster-wide kill switch that overrides the per-session variable when set to false. #73264
  • Added opt-in wide-string column isolation for statistics collection to reduce per-query memory peaks when collecting statistics on tables with multiple wide string columns. #73258
  • Slow-lock logging now supports per-event rate limiting and configurable stack-capture controls to prevent JVM safepoint stalls under high lock contention. #73647
  • MV refresh log entries now include the database name in the prefix, making log lines distinguishable in multi-tenant deployments where the same MV name exists in multiple schemas. #73521
  • enable_profile_log FE configuration is now mutable and can be toggled at runtime via ADMIN SET FRONTEND CONFIG without an FE restart. #73894
  • Added the enable_print_load_profile_to_log FE configuration (default false) to write load profiles (stream load, routine load, broker load, and merge-commit load) to fe.profile.log, preserving them even when the in-memory store is evicted by query-profile bursts. #74150
  • SHOW ROUTINE LOAD now correctly renders column mappings in JobProperties instead of Java object references. #74199
  • CachingIcebergCatalog now uses table-level locking instead of catalog-level locking, reducing refresh serialization lag on catalogs with many concurrently active tables. #73079
  • Meta scan (background statistics collection) now handles ADD COLUMN, DROP COLUMN, RENAME COLUMN, and REORDER COLUMN schema changes gracefully instead of failing with a not-found error on post-change segment files. #72901
  • Sample-based tablet pre-split now covers multi-partition range-distribution tables and Broker Load, enabling first-load parallelism without an existing data-tier baseline. #73101 #73912 #74048
  • MySQL result serialization no longer uses per-row virtual dispatch; a typed column writer is built once per chunk, reducing serialization overhead for wide or large result sets. #66316
  • DATETIME/DATE-to-string casts now write directly to the output buffer, eliminating per-row heap allocations. #73801
  • Query statistics merge path replaced a SpinLock with a lock-free parallel map, reducing CPU usage on large clusters when workers send intermediate or final statistics. #73796
  • Aggregation hash-map and hash-set prefetch is now gated on L2-cache residency, avoiding a 4–9% regression when the bucket array fits in L2. The prefetch distance is now configurable. #73943
  • Pipelined per-segment .lcrm reads for light-compaction publish on shared-data Primary Key tables reduce sequential object-storage round-trips. #73992
  • Cold PK-index rebuild scan in shared-data mode is now parallelized across segments, reducing rebuild time when segment reads are remote-I/O bound. #74249
  • Internal queries (statistics collection, task runs, MV refreshes) are now visible in SHOW PROC '/current_queries' and can be killed with KILL QUERY. #74488
  • Added lake vacuum batch-size and retry-count bvar metrics for monitoring S3 throttling and tuning lake_vacuum_min_batch_delete_size. #74112
  • Added CatalogRecycleBin size gauge metrics to surface recycle-bin growth before it pressures FE heap. #74440
  • LIST-partitioned tables now open all partitions in OlapTableSink instead of applying the latest-N heuristic designed for range-partition tables, reducing incremental-open RPC overhead. #74099
  • Supports loading LARGE_LIST and FIXED_SIZE_LIST Arrow types into JSON columns via FILES() or Broker Load. #73714 #73718
  • Supports combined transaction log and file bundling for merge-commit (FRONTEND_STREAMING) loads on shared-data tables, aligning them with other load types. #74460
  • Added the mutable FE configuration slow_publish_partition_log_threshold_ms (default 3000 ms) to control the lake publish phase-breakdown warning threshold without an FE restart. #74043

Security​

  • [CVE-2026-43869] Bumped libthrift to 0.23.0 to address improper certificate host validation. #73243
  • [CVE-2026-41293] Bumped Apache Tomcat to 9.0.118 to address HTTP/2 request header validation. #73797
  • [CVE-2026-45416] [CVE-2026-44249] [CVE-2026-45673] Bumped Netty to 4.1.135.Final to address SNI handler heap exhaustion (DoS), IPv6 subnet filter bypass, and DNS cache poisoning. #74668
  • Upgraded pprof prebuilt binaries to Go 1.25.11 to include Go standard library security fixes. #73545 #74669

Bug Fixes​

The following issues have been fixed:

  • parse_url() returned a wrong host when the URL contained : outside a host:port pattern. #63542
  • Dictionary-translated expressions incorrectly assumed f(null) = null for expressions where this does not hold (for example, IF(col = '1', NULL, 'ok')). #69376
  • Transaction stream load used the default RPC timeout instead of the user-specified timeout, causing premature timeouts. #67584
  • Iceberg equality delete files with NULL values in identity columns failed to delete matching rows because NULL = NULL evaluates to UNKNOWN in the join predicate. #67321
  • Error messages for tables with INJECTED partition-projection columns are now more descriptive, showing which columns are causing the issue. #68052
  • Queries on insert-only ACID Hive tables returned more rows than expected because insert-overwrite operations were not recognized. #71460
  • Disk cache overflowed its configured capacity when Iceberg metadata entries were pinned during concurrent reads. #71651
  • Paimon primary key columns were incorrectly marked as non-nullable when querying external catalogs. #71660
  • Optimizer timed out when MultiDistinctByMultiFuncRewriter applied the same rule repeatedly on queries with multiple ARRAY_AGG(DISTINCT <const>) inputs. #70605
  • Oracle JDBC date predicates pushed down without the DATE/TIMESTAMP keyword caused NLS format errors. #71412
  • Partition TopN could lose required output columns from its child operator. #72848
  • Unpartitioned MVs could not be created on Iceberg tables with partition evolution. #72285
  • Compaction task stats were overwritten and lost for parallel subtasks in information_schema.be_cloud_native_compactions. #72331
  • SHOW CREATE MATERIALIZED VIEW for sync MVs failed with "Table is not found". #73396
  • Lake publish multi-statement transactions deadlocked during schema change when statement .log files landed at the 4-segment path. #73423
  • Sort merge provider errors were not propagated to the fragment context, causing silent query failures. #73337
  • ConnectorTableId overflowed from int to negative values on long-running follower FEs, causing Iceberg and Hive queries to fail with misleading "Invalid table type" errors. #73344
  • ALTER TABLE with an empty optimize clause (no distribution or partition spec) was incorrectly parsed and could corrupt the table's default distribution on FE replay. #73352
  • FE startup failed during ADLS2 shared-data disaster recovery because AZURE_PATH_KEY was not recognized as a valid StorageVolumeMgr parameter. #73509
  • Avro complex-type decoding failed when the optimizer pruned part of a nested type to UNKNOWN_TYPE, or when nullable array, map, or struct schemas were used. #73474
  • COW column mutation optimization caused a crash in map_apply and similar functions due to two NullableColumns sharing the same NullColumn object. #73480
  • Iceberg tables with a custom LocationProvider failed on SELECT queries with ClassNotFoundException because the provider was eagerly instantiated on FE. #73482
  • JDBC getTable() performed an extra getTableComment() round-trip on every cache miss, extending the intensive planning-phase lock hold and blocking concurrent DDL. #73488
  • Nested MV refresh threw NullPointerException when a nested MV returned FULL or UNKNOWN timeliness. #73644
  • FE worker blocked indefinitely sending query results to a slow MySQL client. The result-send path now enforces a write timeout. #73646
  • PK .del files were not transcoded when replicating Primary Key tables from a V1-encoded (shared-nothing) to a V2-encoded (shared-data) cluster, or between two shared-data clusters. #73649 #73958
  • Duplicate replicas accumulated in TabletInvertedIndex during VERSION_INCOMPLETE recovery because the stale replica reference was not removed before adding the live one. #73661
  • Shared-data lake replication file-copy crashed the CN because REPLICATE_SNAPSHOT tasks and per-file copy sub-tasks shared the same thread pool. #73666
  • RuntimeProfileParser threw NumberFormatException when unit counters were formatted with a .000 decimal suffix by the BE. #73683
  • Physical rowid encoding for shared segments in shared-data PK tablet split was incorrect, causing wrong rss_rowid entries. #73686
  • Mixed range-colocate × hash-distributed JOIN queries returned Unknown error instead of valid results. #73702
  • TimeUtils.longToTimeString used a fixed UTC+8 formatter; output now respects the session time_zone. #73619
  • Decimal-typed columns lost scale when all values were NULL and the column passed through the nullable unary function path, corrupting downstream result types. #73789
  • JSON partial-append for nested types caused an ASAN crash. #73715
  • Privilege cache for the public role was not invalidated on GRANT/REVOKE, leaving stale privileges in effect until expiration. #73717
  • FlatJson crashed when sub-writers had no appends. #73730
  • Aggregate MV rewrite was incorrectly applied when the MV itself had a HAVING predicate, potentially returning incomplete results. #73610
  • Data race on the spill writer's auto_flush flag when entering parallel merge mode caused unintended segment flushes on ARM. #73616
  • Routine load scheduler held a per-job write lock while making blocking BE RPCs to fetch Kafka or Pulsar partition metadata, causing lock-hold times of up to 33.6 s. #73591
  • Colocate tablets on dead BEs were incorrectly reported as HEALTHY when tablet_sched_disable_colocate_balance was enabled. #73550
  • ADMIN SHOW REPLICA STATUS desynchronized the MySQL result stream when a MISSING (phantom) replica row was present, causing client hangs or disconnects. #74393
  • Per-partition coordinator claim was not re-recorded on every sender's open RPC in shared-data mode, causing some senders to be missed in the coordinator election and leaving combined_txn_log files unwritten. #73962
  • _statistics_.pipe_file_list internal table was not re-created after the _statistics_ database or table was dropped. #73970
  • Task runs force-killed by TaskCleaner were not archived, causing them to disappear from information_schema.task_runs with no trace. #74146
  • RENAME TABLE and SWAP TABLE/SWAP MATERIALIZED VIEW held only an intensive table lock instead of a database write lock, allowing concurrent readers to observe a torn intermediate name-to-table mapping. #74100
  • PK index compaction output sstables were opened without tablet metadata, causing permanent metadata is null when loading delvec failures. #74037
  • A partial-update INSERT inside an explicit transaction targeting a table already modified in the same transaction silently corrupted data at COMMIT. #74344
  • ALTER TABLE operations incompatible with range distribution (schema change, sort-key change) are now rejected with actionable errors instead of silently corrupting metadata. #74020
  • Aggregate functions with type-mismatched children in the optimizer caused incorrect query results. #74159
  • ALTER ROUTINE LOAD with a reserved-keyword table name wrote an unparseable origStmt, causing column mappings to be lost after FE restart. #74188
  • IVM state_union compatibility check did not recurse into nested types (for example, ARRAY<VARCHAR>), causing CREATE MATERIALIZED VIEW to fail for ARRAY_AGG IMVs. #73627
  • Parquet temporary dictionary-code columns leaked to upper layers when a scan range was fully filtered out, causing downstream type mismatches. #74452
  • CASE WHEN with mixed float and integer WHEN and result types produced invalid JIT IR, causing incorrect results or crashes. #74382
  • JIT compilation failure caused use-after-free of LLVMContext, resulting in SIGSEGV. #74396
  • Background statistics tasks overwrote the session WAREHOUSE setting, affecting subsequent user queries on the same connection context. #74385
  • CatalogRecycleBin stopped erasing entries when no cluster snapshot had ever completed successfully, causing unbounded FE memory growth under heavy INSERT OVERWRITE workloads. #74379
  • Non-PK replica version holes were not detected by the FE; queries were permanently routed to holed replicas with a frozen max_version. #74408
  • Data race on MaterializedIndexMeta.updateSchemaBackendId (a HashSet mutated under a shared read lock) could cause lost entries or set corruption. #74412
  • Vacuum watermark was not reported correctly when retain-boundary metadata had already been vacuumed, stalling the file_bundling switch-version cleanup. #74429
  • Lake vacuum retry used deterministic exponential backoff; decorrelated jitter is now added to spread retries across CNs under S3 throttling. #74108
  • Memory accounting in OlapTableSink was inflated because RPC requests allocated from the query memory pool were released in the process context. #73807
  • Race condition in TabletSinkSender::_send_chunk_by_node when automatic partition creation triggered _incremental_open_node_channel concurrently. #73820
  • UDAF context created by a backport of upstream changes caused a memory leak via unique_ptr::release. #74025
  • Potential out-of-bounds in partitioned join probe caused by inaccurate memory accounting in append_selective. #74315
  • azure_adls2_oauth2_client_endpoint config field had a typo in its name. #74581
  • StarMgrMetaSyncer incorrectly reaped range-colocate PACK shard groups as orphans, permanently deleting active shards in shared-data mode. #74117
  • Sort-key arity for colocate tablet split was resolved from the base schema instead of the materialized schema for PRIMARY KEY tables and tables without an explicit ORDER BY, causing split jobs to complete without reducing tablet size. #74409
  • Auto-merge daemon merged pre-split tablets back together when partition data was below the merge threshold, undoing the parallelism benefit of sample-based pre-split. #74583
  • db-level UDFs were missing on follower FEs after RESTORE ... AS <new_db> because the function's FunctionName.db still pointed at the source database. #74313
  • Wrong CN group was assigned for immutable-partition tablet locations in shared-data DISTRIBUTED BY RANDOM CTAS/INSERT when the warehouse had multiple CN groups. #74316
  • NullPointerException in StatisticsCalcUtils when a partition was dropped concurrently during statistics estimation. #73711
  • InformationSchemaDataSource and FrontendServiceImpl metadata RPC handlers held full database READ locks, blocking DDL on unrelated tables. #73936 #73913
  • Pipeline operators that flipped their finished state without notifying shared-context observers could stall peer drivers under the event scheduler. #74055 #74056
  • Non-root compound predicates in predicate pushdown yielded NotPushDown instead of a scan-level EOF, causing OlapScanNode to emit no rows when an impossible nested AND branch was present under UNION. #74218
  • BackendLoadStatistic.init performed an expensive per-replica scan on BEs with a single storage medium; the check is now O(1) for homogeneous-disk BEs. #73555
  • Thread-name setting race on data-dir load threads caused noisy failed to set thread name warnings on every BE startup. #73862
  • Task manager wrote an illegal RUNNING→RUNNING edit log, causing task runs to appear stuck in the running map indefinitely. #73882
  • PK multi-statement batch transactions did not accumulate num_rows, data_size, and num_dels across composite rowsets, causing incorrect row-count statistics on shared-data Primary Key tables. #74059
  • Lake load spill cleanup now uses txn-id-based vacuum-driven reclaim, preventing orphaned spill files after BE crash or OOM. #73064
  • PostgreSQL JDBC time values starting from year 0000 caused incorrect type mapping results. #70842
  • Null-check was missing before reading gtid from a rowset during schema change, causing an NPE crash. #74855

4.1.1​

Release Date: May 29, 2026

Behavior Changes​

  • The Hive connector now uses a native C++ Avro scanner instead of the JNI Avro scanner by default. #73237 #73569
  • Query rewrite over INCREMENTAL/AUTO materialized views is now disabled, and FORCE refresh and partition refresh are rejected for INCREMENTAL/AUTO materialized views. #72890 #72336 #71355

Improvements​

  • Java UDF/UDAF/UDTF now support more types: STRUCT arguments and return values for UDAF/UDTF, nested ARRAY/MAP types, DATE/DATETIME, DECIMAL, and varargs. #72911 #72283 #72337 #72208 #68596
  • Scalar UDFs now support STRUCT arguments. #72620
  • Python UDFs now support nested ARRAY/MAP types. #72210
  • UDAFs are now loaded and initialized once and reused across queries, reducing per-query overhead. #72038
  • Replaced the JNI Avro scanner with a native C++ scanner for the Hive connector, with direct binary decoding and support for avro.schema.literal and avro.schema.url. #73237 #73283 #73257 #73569
  • Supports the Trino WITH clause in CTAS statements. #71960
  • Completed Iceberg timestamptz partition transform support on the sink path. #73397
  • Enabled TopN runtime filter pushdown for Iceberg table aggregation. #72332
  • Supports Iceberg datetime min/max optimization. #71870
  • Allows HDFS HA configuration passthrough in Catalog and BE to support accessing multiple HDFS clusters. #71521
  • Added a partition scan number limit for external table queries. #68480
  • Fails fast for unsupported Iceberg V3 features. #70242
  • Supports csv.enclose and csv.escape for CSV exports via INSERT INTO FILES. #71589
  • Added the enable_push_down_schema INSERT property for full schema push-down to files(). #70978
  • Routine Load jobs are now paused on non-retryable errors (for example, primary key size exceeded). #71161
  • Supports join reorder for complex expressions from two children. #71615
  • Improved CBO statistics estimation, including MCV/null-fraction propagation for date_trunc, array_map, CASE WHEN, IS NULL, UNION, and constants. #72233 #70372 #70221 #70865 #70989 #71000
  • Improved skew join detection: skew is only detected when all join keys are skewed, and a force_group_by_skew_eliminate_when_skewed switch was added to force the skew rule. #72753 #71382
  • Supports constant folding for regexp_replace in the FE. #70804
  • Optimized MIN/MAX on date partition columns with constant partition values. #69880
  • Introduced the SCHEDULE keyword as a synonym for ASYNC in materialized view refresh. #72329
  • Supports tablet creation retry for Lake tables in shared-data mode. #71068
  • Supports conditional update for Lake column-mode partial update. #71961
  • Parallelized partial-update publish, persistent index initialization, and SSTable opening to improve ingestion throughput. #71652 #71217 #72112 #71145 #72986
  • Supports DCG file synchronization during shared-nothing to shared-data replication. #69339
  • Supports schema evolution for widening VARCHAR length on both key and non-key columns. #70747
  • Added the snapshot_meta.json marker for cluster snapshot integrity checks. #71209
  • Supports LDAP direct bind authentication via a DN pattern. #71559
  • Added the get_query_dump_from_query_id meta function for easier query troubleshooting. #72875
  • Supports auditing queried relations in the audit log. #71596
  • Added session variables for MySQL binary result encoding. #71415
  • Added metrics for better observability, including tablet_num for shared-data clusters, MemtableIOSpeed, staros_shard_count, and Iceberg metadata-table query metrics. #71444 #69842 #73096 #70825
  • Added the FE configuration deploy_serialization_min_thread_pool_size. #72274
  • Added the tablet_reshard_enable_tablet_merge configuration to disable MergeTabletJob creation. #70906
  • Eliminated HTTP-server accept thundering-herd via SO_REUSEPORT. #72956
  • Supports SQL UDF creation via CREATE FUNCTION ... AS <sql_body>. #67558
  • Supports loading UDFs from S3. #64541
  • Added the uuid_v7 function, which generates time-ordered UUID v7 values. #67694
  • Added per-catalog-type query metrics for external catalog observability. #70533
  • Supports an explicit skew hint for window functions, automatically optimizing window functions with skewed partition keys by splitting into UNION. #68739

Security​

  • [CVE] Upgraded Netty to 4.1.133.Final. #72905
  • [CVE-2026-42198] [CVE-2026-5598] Bumped pgjdbc to 42.7.11 (client-side DoS via unbounded SCRAM PBKDF2 iteration count) and BouncyCastle to 1.84 (FrodoKEM private-key leakage). #72797
  • [CVE-2026-32280] [CVE-2026-32282] Built pprof with go1.25.9 to eliminate Golang CVEs. #71944 #73545
  • Upgraded jetty-http to 9.4.58.v20250814. #71762
  • Cleaned up Broker dependency CVEs and removed wildfly-openssl. #72184 #71908
  • Redacted credentials in INSERT INTO FILES error messages. #71245

Bug Fixes​

The following issues have been fixed:

  • CN segfault on startup caused by hash_util static initialization order. #71825
  • CN crash when scanning an empty tablet with physical split enabled. #70281
  • BE crash when querying information_schema.warehouse_queries. #72019
  • SIGFPE in Lake compaction when rowset num_rows is zero. #71742
  • Division-by-zero in ExecutionDAG fragment connection. #67918
  • Graceful-exit crash in SinkBuffer. #73202
  • Spillable hash join probe crash. #72397
  • Stack-buffer-overflow when formatting into a temporary std::string. #72728
  • Crash in reverse(DecimalV3). #71834
  • Use-after-free in LoadChannel::get_load_replica_status caused by temporary shared_ptr destruction. #71843
  • Use-after-free in ThreadPool::do_submit when thread creation fails. #71276
  • Hive partition descriptor use-after-free across fragment teardown. #73176
  • An information schema sink use-after-free. #71513
  • An FE file descriptor leak by reusing HttpClient instances. #73239
  • JNI local-reference leak in JDBCScanner::_init_jdbc_scanner. #72913
  • Memory leak when caching the MV plan context. #72300
  • Unexpected memory overuse in local exchange. #72262
  • Race on response->tablet_metas in Lake publish_version. #73274
  • Concurrent SegmentFlushTask race in DeltaWriter::commit(). #73371
  • RuntimeProfile min/max race during serialization. #72904
  • Race condition in PipelineTimerTask during query context destruction. #73082
  • Race condition in _all_global_rf_ready_or_timeout. #70920
  • Shared NullColumn issue in map_apply and array_length. #71258
  • Batch-publish deadlock caused by a partition version gap. #71483
  • Deadlock when warming up the LRU cache for rowset metadata in shared-nothing mode. #71459
  • Locker rollback is not exception-safe and unlock order is incorrect. #72789
  • Lock contention with DDL and StarOS RPCs caused by several DB locks on read-only and metadata paths. #73067 #72475 #72108 #72218 #72178
  • Incorrect shuffle distribution due to a missing project node. #71075
  • An AGG TopN runtime filter exprOrder mismatch causing crashes and wrong results. #71479
  • Wrong results from dict-merge GROUP BY. #70866
  • Query cache conflicts with local shuffle aggregation. #73194
  • Inconsistent global dictionary generation in flat JSON. #72953
  • Flat JSON merge empty inconsistency. #72973
  • A type mismatch in map literals when explicit key/value types are declared. #71316
  • COALESCE children is not casted to a common type in the JOIN USING transformer. #72338
  • VARCHAR length is not preserved after reduce-cast with global variables. #70269
  • VARBINARY is incorrectly encoded inside nested types in MySQL result sets. #71346
  • Check-having-clause issue when disabling aggregation spill on small LIMIT. #72705
  • Quotes are not stripped before date parsing, and PostgreSQL date/time bug. #48517 #71016
  • Data file shared-flag loss that caused vacuum to delete files still referenced by sibling split tablets. #71585
  • Tablet merge correctness for the split→compaction→merge sequence. #72350
  • Cross-published txn log num_rows/data_size inflation during tablet splits. #71144
  • Delvec orphan entries caused by write-before-compaction in the same publish batch. #71001
  • "no queryable replica" on follower FE by syncing the StarMgr journal replay. #71263
  • merge_condition is not preserved when applying a normal rowset commit. #72542
  • Iceberg DELETE conflict detection using an incorrect snapshot ID and filter. #73354
  • An NPE on invalid Iceberg transform arguments. #71917
  • Iceberg min/max optimization being skipped due to extra columns injected by the planner. #71863
  • Aggregate-join-pushdown MV rewrite on Iceberg base tables. #71856
  • Missing Hive partition directory before INSERT OVERWRITE commit. #71810
  • AWS assume-role not being applied for the JNI scanner. #71422
  • Avro complex-type decoding for pruned children and nested nullable schemas. #73474
  • File/column/row context is missing in Parquet Broker Load errors. #73236
  • Lacking support for Arrow dictionary values in the Parquet scanner. #71855
  • The Primary Key for Paimon tables is not shown in SHOW CREATE and DESC returns. #70535
  • PostgreSQL/Oracle JDBC type compatibility and JDBC URL construction with trailing slashes. #70626 #70992
  • Materialized view refresh issue with SQL Server tables in a JDBC catalog. #72962
  • Lazy-materialization slot nullability issue for materialized views over outer joins. #72621
  • Rejected AUTO and INCREMENTAL materialized view partition refresh. #71355
  • The materialized view scheduler is not stopped after a materialized view becomes inactive. #71265
  • Lacking support for SHOW GRANTS FOR CURRENT_USER() for MySQL client compatibility. #71959
  • SHOW statements are not allowed inside an explicit transaction. #72954
  • Arrow Flight returning the column name r for an empty result set. #71534
  • Lacking JNI exception-handling checks in Java UDF code. #71734
  • ai_query function registration issue. #72103
  • Stream Load profile collection issue when enable_load_profile is used. #71952
  • Profile START_TIME/END_TIME is not displayed with the session timezone. #71429
  • star_mgr_meta_sync_interval_sec is not runtime mutable. #71675
  • information_schema.tables not escaping special characters in equality predicates. #71273
  • Use-after-free in parallel segment/rowset loading on the error path. #71083
  • Potential hash table data loss in aggregation spill set_finishing. #70851
  • PK tablet rowset meta loss caused by a GC race during disk re-migration (A→B→A). #70727
  • DB read lock leak in SharedDataStorageVolumeMgr. #70987
  • IVM refresh recording incomplete PCT partition metadata. #71092
  • NPE when analyzing generated columns in Stream Load/Broker Load if a referenced column is missing. #71116
  • Missing partition predicate in short-circuit point lookup. #71124

4.1.0​

Release Date: April 13, 2026

Shared-data Architecture​

  • New Multi-Tenant Data Management

    Shared-data clusters now support range-based data distribution and automatic splitting and merging of tablets. Tablets can be automatically split when they become oversized or hotspots, without requiring schema changes, SQL modifications, or data re-ingestion. This feature can significantly improve usability, directly addressing data skew and hotspot issues in multi-tenant workloads. #65199 #66342 #67056 #67386 #68342 #68569 #66743 #67441 #68497 #68591 #66672 #69155

  • Large-Capacity Tablet Support (Phase 1)

    Enables shared-data clusters to host significantly more data per tablet, with a long-term target of 100 GB per tablet. Phase 1 introduces intra-tablet parallelism across the entire ingestion, Primary Key update, and Compaction pipeline, so a single Lake tablet no longer becomes a single-threaded bottleneck as it grows. Improvements include parallel Compaction within a single tablet (with segment-level splitting), parallel MemTable finalization, flush, and merge for Lake loading (including the load-spill path), tablet-internal parallel publish and parallel condition updates for Primary Key tables, and range-split / parallel / size-tiered Compaction for the cloud-native Primary Key index with remote-storage mapper file support. Together, these changes substantially reduce ingestion memory overhead, compaction amplification, and FE metadata pressure for large-tablet workloads. #66424 #66522 #66778 #66586 #67432 #67478 #67554 #66796 #67392 #67878 #65908 #68677 #68123 #69865

  • Fast Schema Evolution V2

    Shared-data clusters now support Fast Schema Evolution V2, which enables second-level DDL execution for schema operations, and further extends the support to materialized views. #65726 #66774 #67915

  • [Beta] Inverted Index on shared-data

    Enables built-in inverted indexes for shared-data clusters to accelerate text filtering and full-text search workloads. #66541

  • Cache Observability

    Query-level cache hit ratio is now exposed in audit logs and the monitoring system for better cache transparency and latency diagnosis. Additional Data Cache metrics include memory and disk quota usage, and page cache statistics. #63964

  • Added segment metadata filter for Lake tables to skip irrelevant segments based on sort key range during scans, reducing I/O for range-predicate queries. #68124

  • Supports fast cancel for Lake DeltaWriter, reducing latency for cancelled ingestion jobs in shared-data clusters. #68877

  • Added support for interval-based scheduling for automated cluster snapshots. #67525

  • Supports pipeline execution for MemTable flush and merge, improving ingestion throughput for cloud-native tables in shared-data clusters. #67878

  • Supports dry_run mode for repairing cloud-native tables, allowing users to preview repair actions before execution. #68494

  • Added a thread pool for publish transactions in shared-nothing clusters, improving publish throughput. #67797

Data Lake Analytics​

  • Iceberg DELETE Support

    Supports writing position delete files for Iceberg tables, enabling DELETE operations on Iceberg tables directly from StarRocks. The support covers the full pipeline of Plan, Sink, Commit, and Audit. #67259 #67277 #67421 #67567

  • TRUNCATE for Hive and Iceberg Tables

    Supports TRUNCATE TABLE on external Hive and Iceberg tables. #64768 #65016

  • Incremental materialized view on Iceberg

    Extends the support for incremental materialized view refresh to Iceberg append-only tables, enabling query acceleration without full table refresh. #65469 #62699

  • VARIANT Type for Semi-Structured Data in Iceberg

    Supports the VARIANT data type in Iceberg Catalog for flexible, schema-on-read storage and querying of semi-structured data. Supports read, write, type casting, and Parquet integration. #63639 #66539

  • Iceberg v3 Support

    Added support for Iceberg v3 default value feature and row lineage. #69525 #69633

  • Iceberg Table Maintenance Procedures

    Added support for rewrite_manifests procedure and extended expire_snapshots and remove_orphan_files procedures with additional arguments for finer-grained table maintenance. #68817 #68898

  • Supports reading file path and row position metadata columns from Iceberg tables. #67003

  • Supports reading _row_id from Iceberg v3 tables, and supports global late materialization for Iceberg v3. #62318 #64133

  • Supports creating Iceberg views with custom properties, and displays properties in SHOW CREATE VIEW output. #65938

  • Supports querying Paimon tables with a specific branch, tag, version, or timestamp. #63316

  • Supports complex types (ARRAY, MAP, STRUCT) for Paimon tables. #66784

  • Supports Partition Transforms with parentheses syntax when creating Iceberg tables. #68945

  • Supports Iceberg global shuffle based on Transform Partition for improved data organization. #70009

  • Supports dynamically enabling global shuffle for Iceberg table sink. #67442

  • Introduced a Commit queue for Iceberg table sink to avoid concurrent Commit conflicts. #68084

  • Added host-level sorting for Iceberg table sink to improve data organization and reading performance. #68121

  • Enabled additional optimizations in ETL execution mode by default, improving performance for INSERT INTO SELECT, CREATE TABLE AS SELECT, and similar batch operations without explicit configuration. #66841

  • Added commit audit information for INSERT and DELETE operations on Iceberg tables. #69198

  • Supports enabling or disabling view endpoint operations in Iceberg REST Catalog. #66083

  • Optimized cache lookup efficiency in CachingIcebergCatalog. #66388

  • Supports EXPLAIN on various Iceberg catalog types. #66563

  • Supports partition projection for tables in AWS Glue Catalog tables. #67601

  • Added resource share type support for AWS Glue GetDatabases API. #69056

  • Supports Azure ABFS/WASB path mapping with endpoint injection (azblob/adls2). #67847

  • Added a database metadata cache for JDBC catalog to reduce remote RPC overhead and impact of external system failures. #68256

  • Supports column comments for PostgreSQL tables in information_schema. #70520

  • Improved Oracle and PostgreSQL JDBC type mapping. #70315 #70566

Query Engine​

  • Recursive CTE

    Supports Recursive Common Table Expressions (CTEs) for hierarchical traversals, graph queries, and iterative SQL computations. #65932

  • Improved Skew Join v2 rewrite with statistics-based skew detection, histogram support, and NULL-skew awareness. #68680 #68886

  • Improved COUNT DISTINCT over windows and added support for fused multi-distinct aggregations. #67453

  • Supports explicit skew hint for window functions, with automatic optimization of window functions with skewed partition keys by splitting into UNION. #67944

  • Supports EXPLAIN and EXPLAIN ANALYZE for INSERT statements in Trino Parser. #70174

  • Supports EXPLAIN for query queue visibility. #69933

Functions and SQL Syntax​

  • Added the following functions:
    • array_top_n: Returns the top N elements from an array ranked by value. #63376
    • arrays_zip: Combines multiple arrays element-wise into an array of structs. #65556
    • json_pretty: Formats a JSON string with indentation. #66695
    • json_set: Sets a value at a specified path within a JSON string. #66193
    • initcap: Converts the first letter of each word to uppercase. #66837
    • sum_map: Sums MAP values across rows with the same key. #67482
    • current_timezone: Returns the current session timezone. #63653
    • current_warehouse: Returns the name of the current warehouse. #66401
    • sec_to_time: Converts the number of seconds to a TIME value. #62797
    • ai_query: Calls an external AI model from SQL for inference workloads. #61583
    • raise_error: Raises a user-defined error in SQL expressions. #69661
  • Provides the following function or syntactic extensions:
    • Supports a lambda comparator in array_sort for custom sort ordering. #66607
    • Supports USING clause for FULL OUTER JOIN with SQL-standard semantics. #65122
    • Supports DISTINCT aggregation over framed window functions with ORDER BY/PARTITION BY. #65815 #65030 #67453
    • Supports ARRAY type in lead/lag/first_value/last_value window functions. #63547
    • Supports VARBINARY for count distinct-like aggregate functions. #68442
    • Supports date and string type casting in IN expressions. #61746
    • Supports WITH LABEL syntax for BEGIN/START TRANSACTION. #68320
    • Supports WHERE/ORDER/LIMIT clauses in SHOW statements. #68834
    • Supports ALTER TASK statements for task management. #68675
    • Supports multiple compression formats (GZIP/SNAPPY/ZSTD/LZ4/DEFLATE/ZLIB/BZIP2) for CSV file exports. #68054
    • Supports STRUCT_CAST_BY_NAME SQL mode for name-based struct field matching. #69845

Management & Observability​

  • Supports warehouses, cpu_weight_percent, and exclusive_cpu_weight attributes for resource groups to improve multi-warehouse CPU resource isolation. #66947
  • Introduces the information_schema.fe_threads system view to inspect the FE thread state. #65431
  • Supports SQL Digest Blacklist to block specific query patterns at the cluster level. #66499
  • Supports Arrow Flight Data Retrieval from nodes that are otherwise inaccessible due to network topology constraints. #66348
  • Introduces the REFRESH CONNECTIONS command to propagate global variable changes to existing connections without reconnecting. #64964
  • Added built-in UI functions to analyze query profiles and view formatted SQL, making query tuning more accessible. #63867
  • Implements ClusterSummaryActionV2 API endpoint to provide a structured cluster overview. #68836
  • Added a global read-only system variable @@run_mode to query the current cluster run mode (shared-data or shared-nothing). #69247
  • Enabled query_queue_v2 by default for improved query queue management. #67462
  • Supports user-level default warehouse for Stream Load and Merge Commit operations. #68106 #68616
  • Added skip_black_list session variable to bypass backend blacklist verification when needed. #67467
  • Added enable_table_metrics_collect option for the metrics API. #68691
  • Added impersonate user support for query detail HTTP API. #68674
  • Added table_query_timeout as a table-level property. #67547
  • Supports adding FE observer nodes. #67778
  • Supports Merge Commit information in information_schema.loads for better load job visibility. #67879
  • Supports showing tablet status in cloud-native tables for better troubleshooting. #69616

Security​

  • [CVE-2026-33870] [CVE-2026-33871] Replaced AWS bundle and bumped Netty to 4.1.132.Final. #71017
  • [CVE-2025-27821] Upgraded Hadoop to v3.4.2. #68529
  • [CVE-2025-54920] Upgraded spark-core_2.12 to 3.5.7. #70862

Bug Fixes​

The following issues have been fixed:

  • Fixed data loss after tablet split by skipping data file deletion for range distribution tablets. #71135
  • Fixed a memory leak in DefaultValueColumnIterator for complex types. #71142
  • Fixed a memory leak caused by shared_ptr cycle between BatchUnit and FetchTaskContext. #71126
  • Fixed double-free crash in SystemMetrics due to concurrent getline access. #71040
  • Fixed crash in SpillMemTableSink when eager merge consumes all blocks. #69046
  • Fixed NPE when auto-created partition is dropped by TTL cleaner. #68257
  • Fixed NPE in IcebergCatalog.getPartitionLastUpdatedTime when snapshot is expired. #68925
  • Fixed incorrect predicate rewrite for outer join with constant-side column reference. #67072
  • Fixed error query results after modify CHAR column length in shared-data. #68808
  • Fixed MV refresh bug in the case of multiple tables. #61763
  • Fixed incorrect MV recycle time if force refreshed. #68673
  • Fixed all-null value handling bug in sync MV. #69136
  • Fixed duplicate column id error when querying MV after fast schema change ADD COLUMN. #71072
  • Fixed low-cardinality rewrite NPE caused by shared DecodeInfo. #68799
  • Fixed low-cardinality join predicate type mismatch. #68568
  • Fixed Segfault in Parquet Page Index Filter when null_counts empty. #68463
  • Fixed JSON flatten array and object conflict on identical paths. #68804
  • Fixed Iceberg cache weigher inaccuracies. #69058
  • Fixed Iceberg table cache memory limit. #67769
  • Fixed Iceberg delete column nullability issue. #68649
  • Fixed Azure ABFS/WASB FileSystem cache key to include container. #68901
  • Fixed deadlock when the HMS connection pool is full. #68033
  • Fixed incorrect length for VARCHAR field type in Paimon Catalog. #68383
  • Fixed Paimon catalog refresh crash with ClassCastException on ObjectTable. #70224
  • Fixed FULL OUTER JOIN USING with constant subqueries. #69028
  • Fixed join on clause bug with CTE scope. #68809
  • Fixed ConnectContext memory leaks by using bindScope() pattern. #68215
  • Fixed memory leak in CatalogRecycleBin.asyncDeleteForTables for shared-nothing clusters. #68275
  • Fixed Thrift accept thread from exiting when it encounters any exception. #68644
  • Fixed UDF resolution in routine load column mappings. #68201
  • Fixed DROP FUNCTION IF EXISTS ignoring ifExists flag. #69216
  • Fixed scan result error when dict page is too large. #68258
  • Fixed range partition overlap. #68255
  • Fixed query queue allocation time and pending timeout. #65802
  • Fixed array_map crash when processing null literal array. #70629
  • Fixed stack overflow for to_base64. #70623
  • Fixed case-insensitive username normalization for LDAP authentication. #67966
  • Mitigated SSRF risk for API proc_file. #68997
  • Masked user auth strings in audit and SQL redaction. #70360

Behavior Changes​

  • ETL execution mode optimizations are now enabled by default. This benefits INSERT INTO SELECT, CREATE TABLE AS SELECT, and similar batch workloads without explicit configuration changes. #66841
  • The third argument of lag/lead window functions now supports column references in addition to constant values. #60209
  • FULL OUTER JOIN USING now follows SQL-standard semantics: the USING column appears once in the output instead of twice. #65122
  • query_queue_v2 is now enabled by default. #67462
  • SQL transactions are gated behind the session variable enable_sql_transaction by default. #63535
  • Previously, the FE configuration item max_scalar_operator_flat_children (default 10000) limited the node count only of expressions built by CASE WHEN. It now limits every scalar expression that the optimizer rewrites, and the node count is recalculated after each rewrite instead of reusing a cached value. As a result, after an upgrade a query that ran before can be rejected in the analysis phase with Expression too complex. Current nodes: N, Limit: M., typically when inlining a view, a CTE, or a subquery expands its expression tree. Simplify the expression, or increase max_scalar_operator_flat_children, which can be modified dynamically. #66324
Rocky the happy otterStarRocks Assistant

AI generated answers are based on docs and other sources. Please test answers in non-production environments.