Arc 26.06.2

Arc v26.06.2

What's Changed

• chore(license): strengthen activation-response verification (26.06.2) by @xe-nvdk in #473
• fix(security): require admin permission for POST /api/v1/databases (#471) by @xe-nvdk in #474
• fix(import): parse CSV/Parquet in-process via ArrowBuffer (#472) by @xe-nvdk in #475
• perf(import): single-parse CSV inference + buffer pre-sizing (follow-up to #475) by @xe-nvdk in #476
• feat(compaction): use batch-delete APIs for compaction cleanup on S3/Azure by @xe-nvdk in #477
• feat(cluster): paginated FSM manifest walks for catch-up and API by @xe-nvdk in #478
• fix(compaction): unexport metric fields to prevent mutex bypass by @xe-nvdk in #480
• fix(mqtt): replace error string comparisons with sentinel errors by @xe-nvdk in #481
• fix(storage): add context cancellation checks to S3 and Azure listing loops by @xe-nvdk in #482
• fix(tiering): add periodic cleanup of tier_migrations table by @xe-nvdk in #483
• fix(wal): use io.ReadFull instead of f.Read for WAL header reads by @xe-nvdk in #484
• fix(wal): track write failures, attempt rotation, fix nil-file panic by @xe-nvdk in #485
• fix(ingest): avoid strings.ToLower allocation in parseFieldValue by @xe-nvdk in #486
• fix(query): add RBAC permission checks to estimateQuery and listMeasurements by @xe-nvdk in #487
• fix(api): add SHOW command RBAC-gating to estimateQuery endpoint by @xe-nvdk in #489
• test(api): endpoint-level regression tests for SHOW-command RBAC gate by @xe-nvdk in #492
• fix(compaction): stop time-type-mismatch wedging partitions; un-wedge existing by @xe-nvdk in #493
• fix(compaction): fix daily dedup time-bind (CTE-normalized window) + DuckDB regression test by @xe-nvdk in #494
• fix(security): block DuckDB I/O function family in user SQL (GHSA-93cm-2v4m-c56c) by @xe-nvdk in #495
• fix(compaction): synchronize SetOnCompactionComplete with running jobs by @xe-nvdk in #496
• fix(storage): track storage metrics in S3/Azure backends + export read counters to Prometheus by @xe-nvdk in #497
• fix(tiering): cache negative policy lookups by @xe-nvdk in #498
• fix(tiering): prevent Get from re-caching a concurrently deleted policy by @xe-nvdk in #500
• fix(tiering): escape paths in router read_parquet builders (#307) by @xe-nvdk in #501
• chore(tiering): remove dead read_parquet query builders by @xe-nvdk in #502
• fix(ingest): floor-divide hour bucketing for pre-epoch timestamps by @xe-nvdk in #503
• fix(cluster): require shared secret for clustering, authenticate heartbeats (GHSA-p378-jp5r-gpgw) by @xe-nvdk in #505
• fix(api): require admin auth on /api/v1/logs (GHSA-m3qr-fvp4-78xj) by @xe-nvdk in #506
• fix(cluster): add per-message-type HMAC domain separation labels (#504) by @xe-nvdk in #507
• fix(security): add RequireRead middleware, lock auth DB to 0600, harden credential exposure by @xe-nvdk in #508
• feat(supply-chain): SBOM, vuln scanning, signed releases, dep cleanup by @xe-nvdk in #511
• feat(fips): FIPS 140-3 build variant (arc-fips) by @xe-nvdk in #512
• fix(security): S3 credentials into DuckDB secrets manager; escape read_parquet paths by @xe-nvdk in #513
• perf(ingest): radix flush-sort + defer per-hour bucketing by @xe-nvdk in #514
• fix(compaction): materialize dedup normalization in temp table to stop bind wedge by @xe-nvdk in #515
• fix(database): credential-chain auth for primary S3 storage (IRSA) by @xe-nvdk in #517
• chore(helm): IRSA support for external S3 + bump appVersion to 26.06.1 by @xe-nvdk in #518

Quick Start

Docker

docker run -d \
  -p 8000:8000 \
  -v arc-data:/app/data \
  ghcr.io/basekick-labs/arc:26.06.2

Debian/Ubuntu (amd64, arm64)

# Download and install
wget https://github.com/basekick-labs/arc/releases/download/v26.06.2/arc_26.06.2_amd64.deb
sudo dpkg -i arc_26.06.2_amd64.deb

# Start and enable
sudo systemctl enable arc
sudo systemctl start arc

# Check status
curl http://localhost:8000/health

RHEL/Fedora/Rocky (x86_64, aarch64)

# Download and install
wget https://github.com/basekick-labs/arc/releases/download/v26.06.2/arc-26.06.2-1.x86_64.rpm
sudo rpm -i arc-26.06.2-1.x86_64.rpm

# Start and enable
sudo systemctl enable arc
sudo systemctl start arc

Kubernetes (Helm)

helm install arc https://github.com/basekick-labs/arc/releases/download/v26.06.2/arc-26.06.2.tgz

Download Artifacts

Platform	Architecture	Package
Docker	amd64, arm64	ghcr.io/basekick-labs/arc:26.06.2
Debian/Ubuntu	amd64	arc_26.06.2_amd64.deb
Debian/Ubuntu	arm64	arc_26.06.2_arm64.deb
RHEL/Fedora	x86_64	arc-26.06.2-1.x86_64.rpm
RHEL/Fedora	aarch64	arc-26.06.2-1.aarch64.rpm
Kubernetes	-	arc-26.06.2.tgz (Helm)

Documentation

• Full Documentation
• Migration Guide

Community

• Discord: Join
• Issues: GitHub

Full Changelog: v26.06.1...v26.06.2