25.8.33.20003 Altinity Antalya

25.8.33.20003 Altinity Antalya (d8b19fa) as compared to v25.8.33.20002.altinityantalya (872f7bf3881c674b5777e0169303bf754f7ee84a)

Performance Improvements

• Improves performance of fast queries with lots of parts in table (by optimizing MarkRanges by using devector over deque) (ClickHouse#86933 by @azat via #2638)
• Up to 8x faster SELECT queries with heavy partition pruning on tables with 10K+ parts (ClickHouse#85535 by @jawm via #2640)

Improvements

• Hardening: certificate chains containing the compromised eMudhra intermediate CAs or the roots that issued them (emSign Root TLS CA - G3, emSign ECC Root CA - G3) are rejected even if the trust store of the operating system still trusts them. The CA certificates embedded into the binary (used only when the system has none) are updated from the Chromium root store. There is no security issue in typical use cases. (ClickHouse#127318 by @alexey-milovidov via #2695)

Bug Fixes (user-visible misbehavior in an official stable release)

• Logical Error fixed if both Alias and original column are selected. (#2560 by @ilejn)
• Fixed a server crash when reading Parquet files with the native v3 reader and a PREWHERE condition returning a numeric type other than UInt8. (#2571 by @mkmkme)
• Fix incorrect query results when reading Parquet files with PREWHERE filters that compute expressions also used elsewhere in the query. (#2627 by @mkmkme)
• Fix a crash when reading Iceberg tables with equality delete files. If a column is nullable in the equality delete file but non-nullable in the table schema (or vice versa), the values read from the delete file were inserted into a column of a different type through an unchecked cast (a column type confusion), corrupting the column and crashing the server. (ClickHouse#109551 by @mstetsyuk via #2631)
• The usage of ngram_bf index on a non-UTF-8 data led to an uninitialized memory read, with values that could reside in the resulting index structure. Closes ClickHouse#92576. (ClickHouse#93663 by @alexey-milovidov via #2673)
• Bump brotli from v1.0.9 to v1.0.10; fix CVE-2026-111497 (#2693 by @zvonand)
• Fixed ALTER MODIFY COLUMN failing when converting a Nullable column to a different type with a DEFAULT (e.g. Nullable(UInt8) → String,LowCardinality(String), or Array(UInt8)). (ClickHouse#102156 by @il9ue via #2710)

Build/Testing/Packaging Improvements

• Antalya 25.8 Backport of ClickHouse#91128 - Disable join_use_nulls for 03716_multiple_joins_using_top_level_identifier (#2569 by @CarlosFelipeOR)
• Update source upload to reduce amount of space needed. (#2635 by @MyroTk)

CI Fixes or Improvements

• Antalya 25.8 - bump actions version (#2563 by @strtgbb)
• Antalya 25.8 Backport of #2585 - Use local abseil for host protoc build (#2634 by @CarlosFelipeOR)
• Antalya 25.8 - Backport submodule cache from 26.8 (#2642 by @strtgbb)
• Antalya 25.8 - CI parity from 26.8 (#2719 by @strtgbb)

Build report

Packages

Available for both AMD64 and Aarch64 from https://builds.altinity.cloud/#altinityantalya as either .deb, .rpm, or .tgz

Docker images

Available for both AMD64 and Aarch64: altinity/clickhouse-server:25.8.33.20003.altinityantalya

Full Changelog: 872f7bf...d8b19fa