3.5.19

Release date: June 26, 2026

Behavior Changes

• parse_json now respects ALLOW_THROW_EXCEPTION: malformed JSON fails the query instead of silently producing NULL, mirroring the earlier get_json_string change. #74976
• FILES() and Broker Load now honor the Parquet isAdjustedToUTC=false flag for INT64 timestamps, so such timestamps are no longer shifted by the session time zone. #73674
• SHOW FUNCTIONS now surfaces the isolation property (shared or isolated) for Java UDFs and UDAFs. #75255
• The non-reserved keywords FLOOR and CEIL are now allowed as column names. #75241

Improvements

• Supports loading Arrow LARGE_LIST and FIXED_SIZE_LIST columns into JSON columns via FILES() and Broker Load. #73714 #73718
• Added an opt-in statistics_large_string_column_merge_threshold to isolate wide CHAR/VARCHAR columns into dedicated statistics collection. #73258
• Optimized base64_to_bitmap for constant inputs and hardened it against invalid base64-encoded bitmaps. #74684
• Added new metrics for lake vacuum batch size and retry counts, and gauges for CatalogRecycleBin size. #74112 #74440
• Supports auditing a statement twice. #73896

Bug fixes

The following issues have been fixed:

• Several wrong-result and planning issues: low-cardinality dictionary translation for expressions where f(NULL) is not NULL; a Multiple entries with same key error from common-subexpression elimination of commutative AND/OR; an AGGREGATE has mismatch types error; a compound predicate with an always-false nested branch under UNION returning no rows; and an off-by-one that dropped a row in RANK TopN at a chunk boundary. #69376 #72823 #74159 #74218 #75045
• Materialized view rewrite issues that could return incorrect results: aggregate MVs with a HAVING clause rewriting queries without (or with weaker) HAVING, and avg(DISTINCT x) being rewritten through a sum/count MV. #73610 #75071
• Incorrect window-function results when enable_push_down_pre_agg_with_rank split a window count into local pre-aggregation and global analytic merge, and an empty window operator generated after pushing down distinct aggregation. #74453 #74810
• Partition TopN losing a child operator's output column, and silently swallowing sort or pre-aggregation errors and returning wrong or partial results. #72848 #74693
• Iceberg equality-delete rows with NULL identity-column values were not applied. #67321
• A spurious strict-mode cast overflow error raised from undefined data in NULL rows. #74903
• Decimal scale could be lost when a column is entirely NULL. #73789
• BE crashes in to_base64 (stack overflow), JSON load of nested types via partial append, local partition TopN with a non-nullable aggregate result, partitioned join (out-of-bounds from inaccurate memory accounting), runtime profile serialization (counter min/max race), JIT compilation failure (use-after-free of LLVMContext), invalid JIT IR for CASE WHEN with mixed float/integer types, and partial column updates under schema drift. #70623 #73715 #69752 #74315 #72904 #74396 #74382 #74005
• An out-of-bounds read and potential oversized allocation in split, split_part, and str_to_map when the input ends with a truncated UTF-8 byte. #75068
• A memory leak from the UDAF context cache and inflated query-pool memory accounting in OlapTableSink. #74025 #73807
• Unexpected backend process restarts. #74424
• Materialized view issues: a slot-nullability crash for MVs defined with FULL OUTER JOIN under late materialization, an NPE refreshing nested MVs, a duplicated warehouse property in SHOW CREATE MATERIALIZED VIEW, and a vector ANN query polluting a shared table schema and breaking unrelated statements. #72621 #73644 #69418 #74785
• Querying Paimon tables whose DATE partition column contains NULL values. #73950
• Reading Hudi MOR tables with char/varchar columns when hudi_mor_force_jni_reader is enabled. #58521
• Nested INT96 timestamps (inside ARRAY, MAP, or STRUCT) were shifted by the session time zone during FILES()/Broker Load. #74868
• Incorrect bytes-read statistics in the audit log for connector scans, and incremental connector scan ranges being assigned to driver sequences absent from the deployed fragment, which could drop part of the scan. #73799 #74674
• Meta scan could fail after schema changes such as ADD COLUMN, which could fail background statistics collection. #72901
• Slow broker RPCs held the per-job Routine Load write lock and blocked admin RPCs and SHOW ROUTINE LOAD. #73591
• ALTER ROUTINE LOAD persisted an invalid statement for reserved-keyword table names, which could drop the load clause on FE restart. #74188
• GRANT/REVOKE on the public role did not invalidate cached merged privileges, leaving stale authorization. #73717
• A race allowing concurrent operations to observe torn state during table and materialized-view RENAME and SWAP, and a data race on MaterializedIndexMeta schema-update tracking. #74100 #74412
• Database-level UDFs were missing on FE followers after RESTORE ... AS <new_db>. #74313
• Queries could become unkillable when a coordinator held its lock during external resource cleanup. #72830
• A permanent version hole on non-primary-key replicas could cause queries to fail with version not found. #74408
• Force-killed SUBMIT TASK runs disappeared from task-run history (and session-prefixed task-run timeouts are now honored), and an illegal running-to-running edit log could wedge subsequent task runs. #74146 #73882
• ADMIN SHOW REPLICA STATUS emitted a misaligned row for missing replicas, which could hang or disconnect the client. #74393
• CatalogRecycleBin halted all deletions in shared-data mode when cluster snapshots kept failing, causing unbounded FE memory growth. #74379
• An NPE in statistics calculation when a partition is dropped concurrently, and zero row counts written into partition statistics after INSERT OVERWRITE corrupting cardinality estimates. #73711 #74801
• Colocate tablets with all replicas on dead BEs were reported as healthy when tablet_sched_disable_colocate_balance is enabled. #73550
• An IllegalMonitorStateException from a lock mismatch in the tablet checker could abort a checker round. #74596
• Reduced lock contention by narrowing several full-database WRITE locks to table-scoped locks in shared-nothing mode, and skipped unnecessary locking in TabletInvertedIndex.deleteTablets for empty input. #74523 #73955
• A race between transaction begin and autovacuum could delete a still-needed transaction log and permanently wedge publishing in shared-data mode; decorrelated jitter was also added to lake vacuum retry backoff. #74906 #74108
• Added lake_vacuum_enable_task_timeout to abort BE vacuum tasks once the FE caller's timeout elapses. #74694
• A crash from a missing null check when reading gtid during a data-rewriting schema change. #74855
• A thread-name race produced noisy warnings during BE data directory load. #73862
• An IllegalStateException during parallel profile collection for external-table queries when enable_profile is on. #74746
• ALTER TABLE ... MODIFY COLUMN ... AFTER a nonexistent column raised an internal NPE instead of a clean error. #75073
• Query hangs and operator stalls from missing notifications when a distinct aggregate source finishes and on missed operator state transitions, and sort merge provider errors now propagate to the fragment context. #74055 #74557 #73337
• FE dropped the connection (client ERROR 2013) instead of returning a proper error when connecting to a database the user lacks privileges on. #70072
• Prepared statements with a microsecond DATETIME parameter failed with Invalid date type: DECIMAL(6,0). #74141
• The audit log recorded ReturnRows=0 for SELECT ... INTO OUTFILE. #74467
• DATETIME_PRECISION was always NULL in information_schema.COLUMNS, which broke type mapping for some MySQL-protocol clients. #74623
• CTAS did not preserve an explicitly declared VARCHAR(N) length in the new table's schema. #73498
• enable_statistic_collect_on_first_load now allows a table-level setting to override the global configuration. #74794
• A typo in the azure_adls2_oauth2_client_endpoint configuration field name. #74581
• Assertion name lookup in assert-num-rows. #74178
• Several dependency CVEs by upgrading libthrift, Tomcat, and Netty, and excluding a vulnerable jline transitive dependency. #73243 #73797 #74668 #75066