Skip to content

Stable 25.8: Bump to 25.8.30 - #2225

Open
zvonand wants to merge 161 commits into
stable-25.8from
bump/stable-25.8/25.8.30
Open

Stable 25.8: Bump to 25.8.30#2225
zvonand wants to merge 161 commits into
stable-25.8from
bump/stable-25.8/25.8.30

Conversation

@zvonand

@zvonand zvonand commented Aug 17, 2026

Copy link
Copy Markdown
Member

Changelog category (leave one):

  • Not for changelog (changelog entry is not required)

CI/CD Options

Exclude tests:

  • Fast test
  • Integration Tests
  • Stateless tests
  • Stateful tests
  • Performance tests
  • Aarch64 tests
  • All with ASAN
  • All with TSAN
  • All with MSAN
  • All with UBSAN
  • All with Coverage
  • All Regression
  • Disable CI Cache

Regression jobs to run:

  • Fast suites (mostly <1h)
  • Aggregate Functions (2h)
  • Alter (1.5h)
  • Benchmark (30m)
  • ClickHouse Keeper (1h)
  • Iceberg (2h)
  • LDAP (1h)
  • OAuth (5m)
  • Parquet (1.5h)
  • RBAC (1.5h)
  • SSL Server (1h)
  • S3 (2h)
  • S3 Export (2h)
  • Swarms (30m)
  • Tiered Storage (2h)

robot-clickhouse and others added 30 commits May 17, 2026 23:32
…on in JOIN ON with new logical join step
…ettings absent on 25.8

The backport of ClickHouse#104785 (ClickHouse#108444) cherry-picked the master regression test
verbatim. Two of its control queries use settings that do not exist on 25.8 —
`enable_join_runtime_filters` and `use_join_disjunctions_push_down` — so the
test aborts with `UNKNOWN_SETTING` on 25.8. Those optimizations are absent on
25.8, so the "off" controls are redundant with the baseline anyway; drop them
and their reference lines. The core fix assertions (ON-side arrayJoin ghost
removed: count = 6 not 18, ARRAY-JOIN plan count = 1 not 2) and the bilateral
both-side cases are kept. Verified the test passes against a locally-built
25.8 `clickhouse` binary.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…oin-test-25.8

Fix 03918 arrayJoin-join-on test on 25.8: drop query variants using settings absent on 25.8
…ing `RemoteHostFilter` for inline DDL params
…4881

Backport ClickHouse#104881 to 25.8: Use explicit flag for secondary on cluster queries
…_log for paimon*Cluster and deltaLakeS3 t…
…4785

Backport ClickHouse#104785 to 25.8: Fix duplicate `arrayJoin` execution in JOIN ON with new logical join step
…8509

Backport ClickHouse#108509 to 25.8: Match http_forbid_headers case-insensitively
The new auth_header validation rejects values not in 'HeaderName: HeaderValue'
format. test_database_hms/test.py exists only on 25.8 (not master), so the
original PR never updated its test_hide_sensitive_info, leaving it with an
invalid auth_header. Apply the same fix as the other catalog test files.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…9389

Backport ClickHouse#109389 to 25.8: Fix TSan data race in uniqExact two-level parallel merge
…4822

Backport ClickHouse#104822 to 25.8: Fix race between ALTER RENAME COLUMN and merge causing data loss (ClickHouse#80648)
`used_privileges` (and `missing_privileges`) rows in `system.query_log`
could contain privilege strings from completely unrelated earlier queries
of a different user, database, and session that had finished much earlier.

`Context::makeQueryContext` seeded the new query's `QueryPrivilegesInfo`
by copying the contents of the parent context's object:

    query_privileges_info = std::make_shared<QueryPrivilegesInfo>(*query_privileges_info);

The parent is the session (or global) context. Session contexts are
created via `createCopy(global_context)` and never call `makeQueryContext`,
so the session and global contexts share a single `QueryPrivilegesInfo`
object. Any privilege string that ever landed in that shared object — and
partial state observed when the copy raced a concurrent writer — leaked
into the `used_privileges` of unrelated later queries. The one-directional
spread and the 1-2 partial entries per polluted row match a copy-vs-write
race against this shared object.

A new query has checked no privileges yet, so there is nothing legitimate
to inherit. Seed every query with an empty `QueryPrivilegesInfo`. Child
contexts created via `createCopy` still share the query's object, so
sub-operations correctly contribute to the same query's `used_privileges`.

Added a deterministic unit test `MakeQueryContextDoesNotInheritPrivileges`
that pollutes a parent context's privileges, derives a query context, and
asserts the query starts clean and that its checks do not bleed back into
the parent.

Closes: ClickHouse#105983

CI report:
https://s3.amazonaws.com/clickhouse-test-reports/json.html?REF=master&sha=fa6d98d95368955ee5619a28a21527da7a9b83cb&name_0=MasterCI&name_1=Stateless%20tests%20%28amd_asan_ubsan%2C%20distributed%20plan%2C%20parallel%2C%202%2F2%29

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit 3a3c454)

# Conflicts:
#	src/Interpreters/tests/gtest_context_race.cpp
…8508

Backport ClickHouse#108508 to 25.8: Enforce access control for MySQL COM_FIELD_LIST and COM_INIT_DB
Backport ClickHouse#98827 to 25.8: Implement http header validation for DataLakeCatalog
…0529

Backport ClickHouse#100529 to 25.8: Fix: fix Credential leak in query_log for paimon*Cluster and deltaLakeS3 t…
…7675

Backport ClickHouse#107675 to 25.8: fix column order for distributed alias columns
…9874

Backport ClickHouse#109874 to 25.8: Bump libarchive from 3.8.7 to 3.8.8
mstetsyuk and others added 24 commits August 6, 2026 10:45
…3363

Backport ClickHouse#113363 to 25.8: Fix use-after-free in async insert queue due to deadline collision
Two symbols the backport relies on differ on this branch.
`getInMemoryMetadataPtr` takes no arguments here, while master passes a
context and a `bypass_metadata_cache` flag; the no-argument form already
behaves as the `false` that was being passed.

`isLoadingFromExistingMetadata` does not exist on this branch at all, so
add it next to the enum it tests. Nothing else calls it yet. The comment
drops master's reference to `dynamic_disk_allow_*`, a setting that has no
counterpart here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…2594

Backport ClickHouse#112594 to 25.8: Bump `simdjson` from v4.2.4 to v4.6.5
The backported code calls `isLoadingFromExistingMetadata`, which does not
exist on this branch, so add it next to the enum it tests. Nothing else
here calls it yet.

Identical to the addition in the backport of ClickHouse#113372 to this branch, so
whichever merges second is not a conflict.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…3372

Backport ClickHouse#113372 to 25.8: Infer an omitted Buffer structure under the user's context
…2593

Backport ClickHouse#112593 to 25.8: Bump vendored `libexpat` from 2.8.1 to 2.8.2
…3220

Backport ClickHouse#113220 to 25.8: Infer an omitted Distributed structure under the user's context
…2614

Backport ClickHouse#112614 to 25.8: Bump `google-protobuf` to v35.1 and `grpc` to v1.83.0
Backport ClickHouse#88573 to 25.8: test: fix flakiness of test_async_load_databases (pushing to MV reordered and lack of proper cleanup)
…3224

Backport ClickHouse#113224 to 25.8: Do not read the internal database of temporary tables in `Merge`
…9675

Backport ClickHouse#109675 to 25.8: Fix segfault due to bad shutdown ordering on startup exception
Fixes 10 CVEs from the curl 8.21.0 security disclosure that apply
to our build (connection reuse, cookie handling, proxy/Digest auth,
mTLS matching, WebSocket support). Updated curl-cmake/CMakeLists.txt
for curl 8.21.0's source layout: lib/noproxy.c was removed upstream
(logic moved into new lib/proxy.c); also added cf-recvbuf.c,
cf-setup.c, creds.c, peer.c, and vtls/vtls_config.c.

Verified: ninja _curl builds and links clean.
…2601

Backport ClickHouse#112601 to 25.8: Iterate ColumnObject subcolumns in sorted path order
…2784

Backport ClickHouse#112784 to 25.8: Fix startup and ATTACH of a view with a recursive CTE with the old analyzer
…3390

Backport ClickHouse#113390 to 25.8: Fix ATTACH of Kafka tables with a large kafka_num_consumers
@zvonand zvonand added the 25.8 25.8 Altinity Stable label Aug 17, 2026
@github-actions

github-actions Bot commented Aug 17, 2026

Copy link
Copy Markdown

Workflow [PR], commit [dc287f3]

The harness always puts `--send_logs_level=<level>` into $CLICKHOUSE_CLIENT
(tests/queries/shell_config.sh), so the explicit `--send_logs_level fatal`
made the client reject the command line with "option '--send_logs_level'
cannot be specified more than once". clickhouse-test only injects
`--allow_repeated_settings` when settings randomization produced options,
so this failed in Fast test, which runs with --no-random-settings.
04299_deltalake_local_path_traversal: pass --allow_local_data_lakes=1 to
clickhouse-local, otherwise deltaLakeLocal is rejected with
SUPPORT_IS_DISABLED before the path-containment check is reached, so the
test never observed PATH_ACCESS_DENIED.

03918_arrayjoin_join_on_duplicate_execution: tag no-old-analyzer. The old
analyzer rejects arrayJoin() in JOIN ON with INVALID_JOIN_ON_EXPRESSION,
and query_plan_use_new_logical_join_step only exists on the analyzer path.

04510_s3_explicit_url_named_secret_mask: tag no-replicated-database. Its
final assertion dumps every query_log row of the database in order, and a
Replicated database logs an extra row per DDL from the internal
DDL-worker execution.
@zvonand

zvonand commented Aug 21, 2026

Copy link
Copy Markdown
Member Author

@blau-ai

@blau-ai

blau-ai commented Aug 21, 2026

Copy link
Copy Markdown
Collaborator

CI triage — 3 red checks: 1 real & PR-related (trivial fix), 1 policy (DCO), 1 aggregate

Head SHA dc287f37. Everything else is green (Fast test, all other Stateless splits, Stress, all Regression suites). Verdict:

Check Class PR-caused?
Stateless tests (amd_binary, old analyzer, s3 storage, DatabaseReplicated, sequential) Real test failure Yes — trivial fix below
DCO Sign-off policy Not a code issue — needs a human decision
PR Aggregate gate Just reflects the two above

1. Stateless / DatabaseReplicated — 04296_alter_rename_column_in_memory_rollback (PR-caused, 1-line fix)

Only 1 test failed in the whole suite (575 passed):

04296_alter_rename_column_in_memory_rollback   FAIL   return code: 47
Code: 47. DB::Exception: Missing columns: 'd' while processing:
'SELECT id, d FROM t_rename_rollback ORDER BY id ASC' ... (UNKNOWN_IDENTIFIER)

Root cause — a missing tag on a newly-added test, not a product bug. This test is new to this PR; it was added by backport commit 17ca607 ("Backport ClickHouse#104822 … Fix race between ALTER RENAME COLUMN and merge causing data loss"). It injects the mt_alter_throw_in_start_mutation failpoint into a plain MergeTree table, runs ALTER … RENAME COLUMN, and asserts that after the throw the in-memory metadata was reverted so SELECT d still works. That invariant is specific to the standalone StorageMergeTree::alter code path. Under --database-replicated the RENAME is driven through the replicated DDL/metadata layer instead, so the storage-level in-memory revert isn't the source of truth and SELECT d legitimately fails → the test is simply not applicable in that mode.

The same backport already knows this: every sibling failpoint/rollback test it adds is tagged no-replicated-database, and the DatabaseReplicated case has its own dedicated test (04311). 04296 is the only one that got no-parallel but not no-replicated-database:

04296_alter_rename_column_in_memory_rollback          # Tags: no-parallel                          <-- missing
04308_alter_rename_column_prepared_mutation_cleanup   # Tags: no-parallel, no-replicated-database
04309_alter_rename_column_post_registration_rollback  # Tags: no-parallel, no-replicated-database
04310_alter_rename_column_settings_rollback           # Tags: no-parallel, no-replicated-database
04311_alter_rename_column_replicated_db_rollback      # Tags: no-parallel, zookeeper, no-replicated-database
04312_alter_rename_column_durable_rollback_throw      # Tags: no-parallel, no-replicated-database

This is deterministic (a failpoint, not a race) and confined to the DatabaseReplicated split — the test passed in every other sequential suite (debug, AsyncInsert, ParallelReplicas, distributed-plan). Not flaky, not infra.

Proposed fix (tests/queries/0_stateless/04296_alter_rename_column_in_memory_rollback.sh), matching its siblings:

 #!/usr/bin/env bash
-# Tags: no-parallel
+# Tags: no-parallel, no-replicated-database
 # Tag no-parallel: uses fail points which affect the whole server.

2. DCO (not PR-code-caused — maintainer decision)

There are 87 commits incorrectly signed off … Sign-off not found

These are the upstream v25.8.30 tag commits pulled in by the merge (e.g. ea13bcb, the backport commits, etc.) — they don't carry Signed-off-by trailers. This is the normal state for a stable-bump PR that merges an upstream tag, and is not something to "fix" in code: rewriting sign-offs across 87 commits would rewrite the merged history. This one is a human call — either override/waive the DCO gate for this bump PR (as is customary here) or configure it to skip merge-bump PRs. I won't rewrite those commits.

3. PR (aggregate)

Green once #1 is fixed and DCO is waived — it carries no independent error.


Health check

The bump is in good shape: Fast test (6940 passed), Stress, all Regression suites (iceberg/parquet), and every other Stateless split are green. The only functional red is a single mis-tagged new test — a one-line change. The remaining red (DCO) is a sign-off-policy artifact of merging the upstream tag, not a defect.

Delivery: you asked for the fix but didn't say how you'd like it delivered, so I haven't pushed. Want me to commit the one-line tag fix directly to bump/stable-25.8/25.8.30, or open a separate blau/* PR against it? Say the word and I'll do it.

@blau-ai · evidence: praktika result_pr.json for dc287f37, backport commit 17ca607

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

25.8 25.8 Altinity Stable

Projects

None yet

Development

Successfully merging this pull request may close these issues.