Arc 26.09.1

Arc v26.09.1

What's Changed

• fix(release): auto-generate Homebrew formula with real arm64 sha256 (#528) by @xe-nvdk in #529
• fix(cluster): strip client forwarding headers + harden loop guard (CVE-2026-45045 class) by @xe-nvdk in #530
• chore(cluster): remove unwired sharding subsystem (closes #448) by @xe-nvdk in #531
• feat(iceberg): Apache Iceberg export (zero-copy, opt-in) by @xe-nvdk in #532
• fix(iceberg): warehouseRelKey must trim the storage root, not the warehouse by @xe-nvdk in #534
• fix(pruning): cap partition-path generation to defuse amplification DoS (#536) by @xe-nvdk in #537
• fix(query): don't corrupt parenthesized args in date_trunc/time_bucket rewrite (#535) by @xe-nvdk in #538
• fix(cq): make continuous-query output idempotent to stop duplicate rows (#521) by @xe-nvdk in #539
• perf(storage): use filepath.WalkDir for local List/ListObjects (#347) by @xe-nvdk in #540
• fix(mqtt): honor explicit QoS 0 instead of overwriting it to 1 (#326) by @xe-nvdk in #541
• perf(query): FNV-1a shard key + raw-string cache key for SQL transform cache (#331) by @xe-nvdk in #542
• refactor(throttle): centralize 30s memory-release debounce into internal/throttle (#421) by @xe-nvdk in #543
• fix(mqtt): remove non-functional reconnect_min_seconds config (#327) by @xe-nvdk in #544
• perf(mqtt): use atomic for lastMessageAt instead of a per-message mutex (#328) by @xe-nvdk in #545
• fix(api): omit unset time.Time fields and render them in UTC (#546) by @xe-nvdk in #547
• fix(auth): validate name on UpdateOrganization/UpdateTeam (#324) by @xe-nvdk in #548
• fix(api): return 409/400 instead of 500 for RBAC client errors (#549) by @xe-nvdk in #550
• refactor(rbac): classify errors with sentinels instead of message strings by @xe-nvdk in #551
• fix(security): reject single-quoted strings in table position (GHSA-w8x2-cccw-25f7) by @xe-nvdk in #552
• fix(compaction): copy file slices when splitting candidate batches (#292) by @xe-nvdk in #553
• fix(backup): stream files instead of buffering them in memory (#322) by @xe-nvdk in #554
• fix(backup): clean up .part files and bound skip tolerance (#555, #556) by @xe-nvdk in #557
• fix(auth): serialize last_used_at updates through a single writer (#325) by @xe-nvdk in #558
• test(auth): fix deterministic -race timeout; rename cleanupDone to shutdown by @xe-nvdk in #559
• fix(compaction): preserve S3 prefix in subprocess; drop dead ResilientBackend (#320, #560) by @xe-nvdk in #561
• fix(startup): share the auth SQLite handle with MQTT, audit and tiering (#329) by @xe-nvdk in #563
• fix(startup): share the auth SQLite handle everywhere; drop audit's no-op vacuum (#562) by @xe-nvdk in #564
• fix: propagate manifest list errors, keep all-null columns, real fdatasync (#314, #337, #305) by @xe-nvdk in #565
• test(wal): wait for async writes instead of racing the writer goroutine by @xe-nvdk in #566
• fix(iceberg): address review blockers; merge main (#533) by @xe-nvdk in #567
• feat(iceberg): Apache Iceberg export (zero-copy, opt-in) (#532) by @xe-nvdk in #533
• feat(compaction): make batch size configurable; remove dead TargetSizeMB by @xe-nvdk in #568
• feat(sync): spoke-side ledger for edge-to-cloud replication (#569 PR 1/9) by @xe-nvdk in #570
• refactor(edgesync): rename internal/sync to internal/edgesync by @xe-nvdk in #571
• feat(edgesync): SyncTransport interface + in-process implementation (#569 PR 2/9) by @xe-nvdk in #572
• feat(security): HMAC authentication for edge-to-cloud sync (#569 PR 3/9) by @xe-nvdk in #573
• feat(edgesync): hub receive endpoint with verify-before-commit (#569 PR 4/9) by @xe-nvdk in #574
• feat(edgesync): batch reconcile with a hub-side received index (#569 PR 5/9) by @xe-nvdk in #575
• feat(edgesync): spoke registry with encrypted-at-rest secrets (#569 PRs 6+7/9) by @xe-nvdk in #576
• fix(api): give app.Test calls a timeout that survives -race by @xe-nvdk in #577
• feat(edgesync): spoke agent and manual sync pass (#569) by @xe-nvdk in #579
• feat(edgesync): add StateExported to the spoke ledger (#569) by @xe-nvdk in #580
• feat(edgesync): air-gap bundle export (#569) by @xe-nvdk in #581
• feat(edgesync): hub-side air-gap bundle import (#569) by @xe-nvdk in #582
• feat(edgesync): bundle acknowledgment, closing the air-gap loop (#569) by @xe-nvdk in #583
• docs(release-notes): describe both edge-sync transports in the intro by @xe-nvdk in #584
• fix(query): preserve JOIN modifiers and use current-string offsets when rewriting tables by @schotime in #587
• feat(query): make DuckDB preserve_insertion_order configurable, default false by @xe-nvdk in #588
• feat(ingest): disable Parquet dictionary encoding at ingest by default (+26% write throughput) by @xe-nvdk in #589
• perf(ingest): typed msgpack columnar decode, bypassing per-value interface boxing (+30%) by @xe-nvdk in #591
• feat(query): opt-in Arrow IPC dictionary encoding and buffer compress… by @xe-nvdk in #592
• feat(query): honor Accept-Encoding on JSON and msgpack query responses (zstd/gzip) by @xe-nvdk in #593
• fix(wal): restore crash durability and replay correctness (#590, #594) by @xe-nvdk in #595
• fix(compaction): skip partitions without a time column; stop retrying deterministic SQL errors by @xe-nvdk in #596
• feat(compaction): bound subprocess memory and threads (compaction.memory_limit, compaction.threads) by @xe-nvdk in #597
• fix(startup): refuse to start when built without -tags=duckdb_arrow by @xe-nvdk in #598
• fix(query): normalize decimals on the msgpack path and freeze the types contract by @xe-nvdk in #599
• fix(query): refresh S3 credentials on IRSA so queries survive session expiry (#600) by @xe-nvdk in #602
• feat(query): extend S3 credential refresher to all expiring sources (#601) by @xe-nvdk in #604
• feat(health): surface per-tier storage credential state in /health and /ready (#603) by @xe-nvdk in #606
• feat(query): Azure managed-identity credential refresher (#605) by @xe-nvdk in #607
• feat(license): boot resilience — bounded retry, failure taxonomy, cached-license fallback by @xe-nvdk in #608
• feat(license): offline air-gapped license files + license state in /health by @xe-nvdk in #609
• fix(edgesync): close the four audit blockers before 26.09.1 by @xe-nvdk in #617
• feat(edgesync): defer spoke compaction until delivery (#610) by @xe-nvdk in #618
• feat(edgesync): operator requeue/dismiss for failed ledger rows (#612) by @xe-nvdk in #620
• chore(edgesync): cleanup sweep — relay exclusion, hub-ID disclosure, dead schema (#616) by @xe-nvdk in #621
• fix(edgesync): audit mediums — origin node, fail-fast import, discovery/paging perf, state filter by @xe-nvdk in #623
• feat(edgesync): hub-side compaction of spoke namespaces (#619) by @xe-nvdk in #624
• docs(edgesync): Forget's gate comment reflects the #619 resolution by @xe-nvdk in #625
• fix: Reject concurrent backup operation requests by @mvanhorn in #622
• docs: release-notes entry + README contributor credit for #622 (#299) by @xe-nvdk in #627
• fix(deps): bump google.golang.org/grpc to v1.83.1 (GHSA-hrxh-6v49-42gf) by @xe-nvdk in #628
• fix(throttle): a first fire in the clock tick of construction no longer disarms the window by @xe-nvdk in #629
• fix(backup): DELETE joins the operation admission slot; progress reads no longer race the writer by @xe-nvdk in #630
• chore(ci): build + vet + race tests on every PR and main push by @xe-nvdk in #631
• fix(security): harden SQL validation on measurement query, CQ, and delete endpoints by @xe-nvdk in #640
• fix(cluster): authenticate the Raft consensus transport with the cluster shared secret by @xe-nvdk in #642
• fix(deploy): reference public ghcr.io/basekick-labs/arc image in compose + k8s by @xe-nvdk in #643
• feat(arcx): opt-in query router for the arcX engine (build-tag gated, off by default) by @xe-nvdk in #644
• fix(arcx): close the three router review follow-ups by @xe-nvdk in #645
• fix(arcx): repair both build modes — tagged build and untagged test build broken by @xe-nvdk in #646
• feat(arcx): decline census — classify why queries aren't arcx-eligible, without logging query text by @xe-nvdk in #647
• fix(logging): mask query literals and error echoes in server logs by @xe-nvdk in #648
• feat(arcxrouter): recognize ungrouped aggregation shapes (scan_agg) by @xe-nvdk in #649
• feat(arcxrouter): allow-list the first grouped shape (single-key count(*), no WHERE) by @xe-nvdk in #650
• feat(arcxrouter): widen the grouped allow-list to the full aggregate set (no WHERE) by @xe-nvdk in #651
• fix(api)+feat(arcxrouter): arcx serve UAF fix; widen grouped allow-list to WHERE-bearing shapes by @xe-nvdk in #652
• feat(arcxrouter): time-bucketed grouped shapes join the allow-list (the dashboard class) by @xe-nvdk in #653
• feat(arcxrouter): the epoch-math (Grafana $__timeGroup) bucket form joins the allow-list by @xe-nvdk in #654
• feat(arcxrouter): bucket+tag composite grouped shapes join the allow-list (the per-host panel) by @xe-nvdk in #655
• feat(arcxrouter): lift the flat-scan ±0.0 float-literal gates (the engine now serves them) by @xe-nvdk in #656
• feat(release): package Arc for Arch Linux (.pkg.tar.zst) by @xe-nvdk in #657
• feat(arcxrouter): arg_max/arg_min/max_by/min_by join the allow-list; shadow arg-tie WARN policy by @xe-nvdk in #658
• feat(pruning): experimental file-level time pruning + unquoted-INTERVAL pruning fix by @xe-nvdk in #660

Quick Start

Docker

docker run -d \
  -p 8000:8000 \
  -v arc-data:/app/data \
  ghcr.io/basekick-labs/arc:26.09.1

Debian/Ubuntu (amd64, arm64)

# Download and install
wget https://github.com/basekick-labs/arc/releases/download/v26.09.1/arc_26.09.1_amd64.deb
sudo dpkg -i arc_26.09.1_amd64.deb

# Start and enable
sudo systemctl enable arc
sudo systemctl start arc

# Check status
curl http://localhost:8000/health

RHEL/Fedora/Rocky (x86_64, aarch64)

# Download and install
wget https://github.com/basekick-labs/arc/releases/download/v26.09.1/arc-26.09.1-1.x86_64.rpm
sudo rpm -i arc-26.09.1-1.x86_64.rpm

# Start and enable
sudo systemctl enable arc
sudo systemctl start arc

Arch Linux / Omarchy (x86_64, aarch64)

# Download and install
wget https://github.com/basekick-labs/arc/releases/download/v26.09.1/arc-26.09.1-1-x86_64.pkg.tar.zst
sudo pacman -U arc-26.09.1-1-x86_64.pkg.tar.zst

# Start and enable
sudo systemctl enable arc
sudo systemctl start arc

Kubernetes (Helm)

helm install arc https://github.com/basekick-labs/arc/releases/download/v26.09.1/arc-26.09.1.tgz

Download Artifacts

Platform	Architecture	Package
Docker	amd64, arm64	ghcr.io/basekick-labs/arc:26.09.1
Debian/Ubuntu	amd64	arc_26.09.1_amd64.deb
Debian/Ubuntu	arm64	arc_26.09.1_arm64.deb
RHEL/Fedora	x86_64	arc-26.09.1-1.x86_64.rpm
RHEL/Fedora	aarch64	arc-26.09.1-1.aarch64.rpm
Arch Linux / Omarchy	x86_64	arc-26.09.1-1-x86_64.pkg.tar.zst
Arch Linux / Omarchy	aarch64	arc-26.09.1-1-aarch64.pkg.tar.zst
Kubernetes	-	arc-26.09.1.tgz (Helm)

Documentation

• Full Documentation

Community

• Discord: Join
• Issues: GitHub

New Contributors

• @mvanhorn made their first contribution in #622

Full Changelog: v26.06.3...v26.09.1