Arc 26.06.2

[xe-nvdk]

Arc v26.06.2

What's Changed

• chore(license): strengthen activation-response verification (26.06.2) by @xe-nvdk in chore(license): strengthen activation-response verification (26.06.2) #473
• fix(security): require admin permission for POST /api/v1/databases (security: POST /api/v1/databases accepts any-valid-token; should require admin #471) by @xe-nvdk in fix(security): require admin permission for POST /api/v1/databases (#471) #474
• fix(import): parse CSV/Parquet in-process via ArrowBuffer (import(csv,parquet): replace DuckDB-on-temp-file introspection with in-process row streaming via ArrowBuffer #472) by @xe-nvdk in fix(import): parse CSV/Parquet in-process via ArrowBuffer (#472) #475
• perf(import): single-parse CSV inference + buffer pre-sizing (follow-up to fix(import): parse CSV/Parquet in-process via ArrowBuffer (#472) #475) by @xe-nvdk in perf(import): single-parse CSV inference + buffer pre-sizing (follow-up to #475) #476
• feat(compaction): use batch-delete APIs for compaction cleanup on S3/Azure by @xe-nvdk in feat(compaction): use batch-delete APIs for compaction cleanup on S3/Azure #477
• feat(cluster): paginated FSM manifest walks for catch-up and API by @xe-nvdk in feat(cluster): paginated FSM manifest walks for catch-up and API #478
• fix(compaction): unexport metric fields to prevent mutex bypass by @xe-nvdk in fix(compaction): unexport metric fields to prevent mutex bypass #480
• fix(mqtt): replace error string comparisons with sentinel errors by @xe-nvdk in fix(mqtt): replace error string comparisons with sentinel errors #481
• fix(storage): add context cancellation checks to S3 and Azure listing loops by @xe-nvdk in fix(storage): add context cancellation checks to S3 and Azure listing loops #482
• fix(tiering): add periodic cleanup of tier_migrations table by @xe-nvdk in fix(tiering): add periodic cleanup of tier_migrations table #483
• fix(wal): use io.ReadFull instead of f.Read for WAL header reads by @xe-nvdk in fix(wal): use io.ReadFull instead of f.Read for WAL header reads #484
• fix(wal): track write failures, attempt rotation, fix nil-file panic by @xe-nvdk in fix(wal): track write failures, attempt rotation, fix nil-file panic #485
• fix(ingest): avoid strings.ToLower allocation in parseFieldValue by @xe-nvdk in fix(ingest): avoid strings.ToLower allocation in parseFieldValue #486
• fix(query): add RBAC permission checks to estimateQuery and listMeasurements by @xe-nvdk in fix(query): add RBAC permission checks to estimateQuery and listMeasurements #487
• fix(api): add SHOW command RBAC-gating to estimateQuery endpoint by @xe-nvdk in fix(api): add SHOW command RBAC-gating to estimateQuery endpoint #489
• test(api): endpoint-level regression tests for SHOW-command RBAC gate by @xe-nvdk in test(api): endpoint-level regression tests for SHOW-command RBAC gate #492
• fix(compaction): stop time-type-mismatch wedging partitions; un-wedge existing by @xe-nvdk in fix(compaction): stop time-type-mismatch wedging partitions; un-wedge existing #493
• fix(compaction): fix daily dedup time-bind (CTE-normalized window) + DuckDB regression test by @xe-nvdk in fix(compaction): fix daily dedup time-bind (CTE-normalized window) + DuckDB regression test #494
• fix(security): block DuckDB I/O function family in user SQL (GHSA-93cm-2v4m-c56c) by @xe-nvdk in fix(security): block DuckDB I/O function family in user SQL (GHSA-93cm-2v4m-c56c) #495
• fix(compaction): synchronize SetOnCompactionComplete with running jobs by @xe-nvdk in fix(compaction): synchronize SetOnCompactionComplete with running jobs #496
• fix(storage): track storage metrics in S3/Azure backends + export read counters to Prometheus by @xe-nvdk in fix(storage): track storage metrics in S3/Azure backends + export read counters to Prometheus #497
• fix(tiering): cache negative policy lookups by @xe-nvdk in fix(tiering): cache negative policy lookups #498
• fix(tiering): prevent Get from re-caching a concurrently deleted policy by @xe-nvdk in fix(tiering): prevent Get from re-caching a concurrently deleted policy #500
• fix(tiering): escape paths in router read_parquet builders (high(tiering): SQL injection in buildReadParquet via path interpolation #307) by @xe-nvdk in fix(tiering): escape paths in router read_parquet builders (#307) #501
• chore(tiering): remove dead read_parquet query builders by @xe-nvdk in chore(tiering): remove dead read_parquet query builders #502
• fix(ingest): floor-divide hour bucketing for pre-epoch timestamps by @xe-nvdk in fix(ingest): floor-divide hour bucketing for pre-epoch timestamps #503
• fix(cluster): require shared secret for clustering, authenticate heartbeats (GHSA-p378-jp5r-gpgw) by @xe-nvdk in fix(cluster): require shared secret for clustering, authenticate heartbeats (GHSA-p378-jp5r-gpgw) #505
• fix(api): require admin auth on /api/v1/logs (GHSA-m3qr-fvp4-78xj) by @xe-nvdk in fix(api): require admin auth on /api/v1/logs (GHSA-m3qr-fvp4-78xj) #506
• fix(cluster): add per-message-type HMAC domain separation labels (Cluster auth hardening follow-ups: HMAC domain separation + don't forward client auth headers to peers #504) by @xe-nvdk in fix(cluster): add per-message-type HMAC domain separation labels (#504) #507
• fix(security): add RequireRead middleware, lock auth DB to 0600, harden credential exposure by @xe-nvdk in fix(security): add RequireRead middleware, lock auth DB to 0600, harden credential exposure #508
• feat(supply-chain): SBOM, vuln scanning, signed releases, dep cleanup by @xe-nvdk in feat(supply-chain): SBOM, vuln scanning, signed releases, dep cleanup #511
• feat(fips): FIPS 140-3 build variant (arc-fips) by @xe-nvdk in feat(fips): FIPS 140-3 build variant (arc-fips) #512
• fix(security): S3 credentials into DuckDB secrets manager; escape read_parquet paths by @xe-nvdk in fix(security): S3 credentials into DuckDB secrets manager; escape read_parquet paths #513
• perf(ingest): radix flush-sort + defer per-hour bucketing by @xe-nvdk in perf(ingest): radix flush-sort + defer per-hour bucketing #514
• fix(compaction): materialize dedup normalization in temp table to stop bind wedge by @xe-nvdk in fix(compaction): materialize dedup normalization in temp table to stop bind wedge #515
• fix(database): credential-chain auth for primary S3 storage (IRSA) by @xe-nvdk in fix(database): credential-chain auth for primary S3 storage (IRSA) #517
• chore(helm): IRSA support for external S3 + bump appVersion to 26.06.1 by @xe-nvdk in chore(helm): IRSA support for external S3 + bump appVersion to 26.06.1 #518

Quick Start

Docker

docker run -d \
  -p 8000:8000 \
  -v arc-data:/app/data \
  ghcr.io/basekick-labs/arc:26.06.2

Debian/Ubuntu (amd64, arm64)

# Download and install
wget https://github.com/basekick-labs/arc/releases/download/v26.06.2/arc_26.06.2_amd64.deb
sudo dpkg -i arc_26.06.2_amd64.deb

# Start and enable
sudo systemctl enable arc
sudo systemctl start arc

# Check status
curl http://localhost:8000/health

RHEL/Fedora/Rocky (x86_64, aarch64)

# Download and install
wget https://github.com/basekick-labs/arc/releases/download/v26.06.2/arc-26.06.2-1.x86_64.rpm
sudo rpm -i arc-26.06.2-1.x86_64.rpm

# Start and enable
sudo systemctl enable arc
sudo systemctl start arc

Kubernetes (Helm)

helm install arc https://github.com/basekick-labs/arc/releases/download/v26.06.2/arc-26.06.2.tgz

Download Artifacts

Platform	Architecture	Package
Docker	amd64, arm64	ghcr.io/basekick-labs/arc:26.06.2
Debian/Ubuntu	amd64	arc_26.06.2_amd64.deb
Debian/Ubuntu	arm64	arc_26.06.2_arm64.deb
RHEL/Fedora	x86_64	arc-26.06.2-1.x86_64.rpm
RHEL/Fedora	aarch64	arc-26.06.2-1.aarch64.rpm
Kubernetes	-	arc-26.06.2.tgz (Helm)

Documentation

• Full Documentation
• Migration Guide

Community

• Discord: Join
• Issues: GitHub

Full Changelog: v26.06.1...v26.06.2

---

This discussion was created from the release Arc 26.06.2.