26.3.60.10001 Altinity Stable

26.3.60.10001 Altinity Stable (f01425d) as compared to v26.3.53.10001.altinitystable (9446ac6622d0723467efe8f11bfa6dfff4f57c32)

Improvements

• Hardening: certificate chains containing the compromised eMudhra intermediate CAs or the roots that issued them (emSign Root TLS CA - G3, emSign ECC Root CA - G3) are rejected even if the trust store of the operating system still trusts them. The CA certificates embedded into the binary (used only when the system has none) are updated from the Chromium root store. There is no security issue in typical use cases. (ClickHouse#127318 by @alexey-milovidov via #2696)

Bug Fixes (user-visible misbehavior in an official stable release)

• Fix a possible crash when querying the view over Distributed with enable_analyzer=0 (ClickHouse#123431 by @mkmkme via #2650)
• Fix a bug where using aliases and row policies with enable_analyzer=0 could error out (ClickHouse#123436 by @mkmkme via #2653)
• Updated the bundled brotli library from v1.2.0 to v1.2.1. The new version rejects malformed Brotli streams with an invalid block switch instead of trying to decode them. (ClickHouse#127810 by @robot-clickhouse-ci-2 via #2683)
• Fixed ALTER MODIFY COLUMN failing when converting a Nullable column to a different type with a DEFAULT (e.g. Nullable(UInt8) → String,LowCardinality(String), or Array(UInt8)). (ClickHouse#102156 by @il9ue via #2711)

CI Fixes or Improvements

• Stable 26.3 - skip 04651_system_sync_transaction_log_access with encrypted storage (#2645 by @CarlosFelipeOR)
• Stable 26.3 - CI parity from 26.8 (#2723 by @strtgbb)

Build report

Packages

Available for both AMD64 and Aarch64 from https://builds.altinity.cloud/#altinitystable as either .deb, .rpm, or .tgz

Docker images

Available for both AMD64 and Aarch64: altinity/clickhouse-server:26.3.60.10001.altinitystable

Full Changelog: 9446ac6...f01425d