25.8.33.10002 Altinity Stable

25.8.33.10002 Altinity Stable (2b3564e) as compared to v25.8.33.10001.altinitystable (f998c52e1ba9bfa0ef75e50f467ae99777b2c36d)

Performance Improvements

• Improves performance of fast queries with lots of parts in table (by optimizing MarkRanges by using devector over deque) (ClickHouse#86933 by @azat via #2637)
• Up to 8x faster SELECT queries with heavy partition pruning on tables with 10K+ parts (ClickHouse#85535 by @jawm via #2639)

Improvements

• Hardening: certificate chains containing the compromised eMudhra intermediate CAs or the roots that issued them (emSign Root TLS CA - G3, emSign ECC Root CA - G3) are rejected even if the trust store of the operating system still trusts them. The CA certificates embedded into the binary (used only when the system has none) are updated from the Chromium root store. There is no security issue in typical use cases. (ClickHouse#127318 by @alexey-milovidov via #2694)

Bug Fixes (user-visible misbehavior in an official stable release)

• The usage of ngram_bf index on a non-UTF-8 data led to an uninitialized memory read, with values that could reside in the resulting index structure. Closes ClickHouse#92576. (ClickHouse#93663 by @alexey-milovidov via #2672)
• Bump brotli from v1.0.9 to v1.0.10; fix CVE-2026-111497 (#2692 by @zvonand)

CI Fixes or Improvements

• Stable 25.8 - CI parity from 26.8 (#2718 by @strtgbb)

Build report

Packages

Available for both AMD64 and Aarch64 from https://builds.altinity.cloud/#altinitystable as either .deb, .rpm, or .tgz

Docker images

Available for both AMD64 and Aarch64: altinity/clickhouse-server:25.8.33.10002.altinitystable

Full Changelog: f998c52...2b3564e