24.3.18.10427 Altinity Stable

24.3.18.10427 Altinity Stable (fcaf6e1) as compared to v24.3.18.10426.altinitystable (ef8a945bc84037671dd803577841a5e1563cec6e)

Improvements

• Hardening: certificate chains containing the compromised eMudhra intermediate CAs or the roots that issued them (emSign Root TLS CA - G3, emSign ECC Root CA - G3) are rejected even if the trust store of the operating system still trusts them. The CA certificates embedded into the binary (used only when the system has none) are updated from the Chromium root store. There is no security issue in typical use cases. (ClickHouse#127318 by @alexey-milovidov via #2726)

Bug Fixes (user-visible misbehavior in an official stable release)

• Bump brotli from v1.0.9 to v1.0.10; fix CVE-2026-111497 (#2689 by @zvonand)

CI Fixes or Improvements

• Stable 24.3 - Regression tests: use release branch instead of commit hash (#1830 by @CarlosFelipeOR)
• 24.3 Stable: use the clickhouse/minio-minio mirror image (#2701 by @zvonand)
• 24.3.18: bump Grype to v0.115.0 to fix Grype scan (#2717 by @blau-ai)
• 24.3 Stable: fix flaky 03210_variant_with_aggregate_function_type test (#2725 by @zvonand)
• Stable 24.3 - Use altinity-regression-tester labels (#2728 by @strtgbb)

Build report

Release notes

Packages

Available for both AMD64 and Aarch64 from https://builds.altinity.cloud/#altinitystable as either .deb, .rpm, or .tgz

Docker images

Available for both AMD64 and Aarch64: altinity/clickhouse-server:24.3.18.10427.altinitystable

Full Changelog: ef8a945...fcaf6e1