4.1.7

4.1.7

Release Date: October 26, 2026

Behavior Changes

• Local (shared-nothing) Primary Key inserts no longer check the immutable L1 and L2 persistent-index files for duplicate keys by default. The new BE configuration skip_pindex_l1_l2_check_in_insert defaults to true; L0 (memtable) checks are always performed. Set it to false to restore the previous behavior. #81304
• BE JVM metrics are enabled by default (enable_jvm_metrics now defaults to true). They are collected only once a JVM exists, so enabling them no longer starts a JVM on a BE that does not otherwise need one. #81113 #81074
• The default of spill_max_dir_bytes_ratio is lowered from 0.8 to 0.5, so spill uses at most 50% of each spill directory's capacity. #80189
• Lake replication file copies now run in a dedicated CN-wide pool. lake_replication_file_copy_threads defaults to 16 instead of 0 (which meant 4 × CPU cores), and the new lake_replication_max_parallel_files_per_tablet (default 4) bounds the files copied in parallel for one tablet. #78078
• Delete-triggered base compaction of shared-data Primary Key tablets is now opt-in through the new BE configuration lake_pk_compaction_base_enable_delete_trigger, which defaults to false. #79926
• When pk_index_parallel_execution_threadpool_max_threads is 0, the Primary Key index parallel execution pool is sized to all CPU cores instead of half of them. #80460
• CAST(x AS CHAR(N)) now truncates the result to N characters, consistent with MySQL. Both constant folding in the FE and execution in the BE apply the truncation. #75909
• Credential values are masked wherever configurations and task definitions are displayed or logged: ADMIN SHOW FRONTEND CONFIG, the FE /variable page, BE /varz, information_schema.be_configs, task run definitions archived to task_run_history, and the request URIs and headers written to FE and BE HTTP logs. Values set through ADMIN SET FRONTEND CONFIG, the FE /api/_set_config endpoint, and the BE /api/update_config endpoint are masked as well. #80097 #80040 #80492 #80444 #80280 #80447 #80515 #80203
• The FE HTTP endpoints /service_id, /dump, and /dump_starmgr now require an admin user. #80749 #80701

Improvements

• Added the table property enable_statistic_auto_collect. Set it to false with CREATE TABLE or ALTER TABLE to exclude a table from automatic statistics collection. Collection triggered by data loading is not affected. #81027
• LDAP and Active Directory user and group names can be matched case-insensitively by setting the new FE configuration authentication_ldap_case_insensitive to true (default false). #79255
• Added ALTER GROUP PROVIDER to update the properties of a group provider in place. #79166
• Under Query Queue V2, query_queue_mem_used_pct_limit is applied to every node that runs queries. #81026
• Large Primary Key index deletes during publish are faster, using a parallel reverse lookup and a tombstone sstable path. #76785
• A searched CASE WHEN evaluates each branch only on the rows that reach it. #79484
• convert_tz caches daylight-saving-time offset lookups instead of converting the time zone for every row. #78459
• UNNEST is zero-copy for nullable arrays and with LEFT JOIN, expands multiple arrays one chunk at a time instead of materializing the whole input chunk, and the remaining table functions are guarded against out-of-memory. #79221 #79222
• A fragment's plan is serialized once for all of its instance requests. #80716
• Colocate aggregation and window functions can be planned on range-colocate tables. #79946
• Backported tablet pre-split improvements from the main branch, including new FE configurations that bound how much data the sample-based tablet pre-split scans (tablet_pre_split_data_tier_scan_byte_limit, tablet_pre_split_data_tier_min_scan_files, tablet_pre_split_data_tier_max_scan_files, and tablet_pre_split_meta_tier_footer_read_parallelism). #79949

Security

• Bumped pprof to release/20261012. #80439
• Bumped lz4-java to 1.11.4. #80319
• Bumped BouncyCastle to 1.86, Jackson to 2.21.7, zstd-jni to 1.5.7-15, and Parquet to 1.18.1. #80248
• Bumped the Tomcat used by Broker to 9.0.121. #79719
• Bumped ZooKeeper to 3.8.7 and 3.9.6. #79707
• The arguments of lookup_string are escaped to prevent SQL injection, and its internal query runs with the caller's identity. #79991 #79959
• The FE web console HTML-encodes admin- and host-provided values and table cells, including on the /system and /query pages, and validates and encodes the node parameter on /proc_profile. #80656 #80639 #80582 #80565 #80689

Bug Fixes

The following issues have been fixed:

• Iceberg equality deletes were not scoped to their partition. #81139
• Datacache memory writes could be rejected by the eviction probability even when free space was available. #80542
• Bucket properties were not carried along with the partition type of a pipeline source. #80099
• Bucket shuffle join inputs that the sender had already aligned were re-partitioned. #79769
• Driver partitioning was not aligned across EXCEPT/INTERSECT and hash join inputs. #78920
• yearweek crashed the BE on invalid str_to_date input. #78358
• A queued spill data task could still run while the spill channel was closing. #80252
• Lake compaction read buffers were not bounded by the per-worker memory budget. #80229
• A Java UDAF merge that could not wrap its states returned NULL instead of failing. #80098
• A failed spill append or partition split could be lost. #79457
• ORC TINYINT min/max statistics were wrong on platforms where char is unsigned. #81086
• The flat JSON path derivation trie was unbounded. #80316
• Scalar flat JSON sub-columns could be dropped when compaction derived its read layout. #80295
• A scanned column was not output when the scan predicate builder folded away its only conjunct. #80572
• PSlotDescriptor.global_dict_words was not declared as bytes, which produced UTF-8 warnings. #78657
• Resizing the primary index cache by update_memory_limit_percent did not divide by 100. #81067
• An MV in TRUE transparent mode stopped scanning the MV when a base table was dropped. #81088
• An out-of-range vector-search query vector aborted the BE instead of being rejected. #78658
• The ANN distance column did not tolerate a reused scan chunk. #78686
• json_query on the root of a flat JSON column did not rebuild the whole document. #80772
• A tokenize() result was sized by the viewer's data column instead of by rows. #80337
• A task that an MV refresh had scheduled was lost when the refresh inactivated the MV. This also fixes two follow-ups of the planner lock and Hive INSERT changes. #81033
• INSERT could miss Hive source rows, and SELECT * dropped resource-mapping Hive columns. #81032
• A cross-scope recursive CTE reference caused a stack overflow instead of being rejected. #78533
• A broken Ranger audit configuration failed catalog access, and the ZooKeeper classes that Solr audit needs were not shipped. #81075
• An MV refresh did not fail on a lock timeout for a non-reference base table, and inspect_mv_refresh_info took base table locks under a held lock. #81036
• A statistic bound outside the DATETIME domain was not rejected. #79388
• Comparing JSON numbers above INT64_MAX threw an exception. #78969
• An assertion that a selection is no longer than the column it selects from could fail. #80324
• An array_generate range too large to hold aborted the BE instead of being rejected. #80205
• A constant JSON/VARIANT to MAP cast was not kept as long as its input. #80679
• The scalar shuttle did not register the dict operators it has to clone. #79310
• The global dictionary was not invalidated after fast schema evolution. #78599
• Repeated columns were not cloned in the CTE consume project. #80158
• Relaxed dictionaries were not merged in unsigned byte order. #78659
• Struct fields of aggregates were rejected by GROUP BY checks. #79649
• Not every MV inactivation and its version-map clear was journaled. #81030
• MV version-map repair was skipped by the physical partition ID lookup. #78469
• Window function errors were not checked before an analytic result chunk was published. #81022
• MIN/MAX of a LIST partition column could be read from partition values that the data may not hold. #80558
• An analyze job stopped collecting the remaining tables after one table failed. #81028
• MV refresh and freshness were wrong under base table partition churn and batched refresh. #81034
• Three small pre-existing FE metadata concurrency issues. #81037
• Global dictionary expressions were dropped when skew join v2 replaced the shuffle exchanges. #78672
• MV partitions that outlived a dropped base partition were not refreshed. #79057
• A failed aligned allocation did not throw std::bad_alloc. #79054
• ALTER finish reports were not matched by job, and queued ALTER tasks expired. #81018
• Tablets of swapped-in temporary partitions were force-deleted. #81014
• Residual INSERT jobs were not finished or cancelled according to their transactions. #80711
• A complex-typed row identity key for an incremental MV was not rejected. #79312
• greplog did not support year-prefixed glog entries. #80990
• List partition values in archived MV task run history were not shrunk. #80944
• auto_refresh_partitions_limit was accepted on an incrementally maintained materialized view. #79051
• Bundle metadata was not re-read when a read failed verification. #79928
• INSERT OVERWRITE did not report a clear error when a source partition was gone at commit. #79902
• MV version map resets, TRUE transparent rewrite, and the timeliness cache could serve stale results. #80893
• List-partition drift was not compared against the live table. #78470
• Light compaction did not preserve the primary index size. #80746
• A standing force setting re-materialized an incrementally maintained materialized view. #79366
• Column ALTER on an incrementally maintained materialized view was not rejected. #78726
• MV lastRefreshTime was recomputed on replay instead of logged. #78467
• The IVM refresh window was not recorded on the transaction it commits with. #79315
• Primary key recovery failed on V2-encoded single-column fixed-length keys. #80446
• Not all files of a conflicting compaction were recorded as orphans in cloud-native Primary Key tablets. #80445
• FE-local version times were compared for shared-data MV base partitions. #79945
• The index block iterator was not released when MultiGet returned early. #79380
• Rows that a memtable did not receive were counted toward its row limit. #79705
• A nested Iceberg REST namespace dropped while being listed caused an error. #80846
• Repeated policy lookups and unbounded waits left by the planner lock fixes. #80943
• Tablet metadata dumps were not restricted to the local cache. #78449
• Driver queue counters were not preserved across resource group updates. #80889
• A malformed numeric HTTP parameter could kill the BE. #79022
• A read overflow in convert_hash_set_to_chunk. #80709
• Pre-existing metadata lock races in ALTER VIEW, INSERT OVERWRITE, and MV refresh, and the remaining planner and MV metadata lock gaps. #80891 #80892
• Reused file handling in lake replication. #79359
• Unsupported column types were accepted under bloom filters. #80871
• The load sink close ran on the pipeline poller. #80761
• Collected external statistics were discarded when a single collection query failed. #79518
• BE Thrift RPC retries were not jittered, and FE Thrift RPC retries did not back off with jitter. #80847 #80714
• Pipeline driver queue levels could starve level 0. #80760
• Resource-mapped external tables were not kept as declared when INSERT ... SELECT sources were refreshed. #80546
• Heavy expressions that depend on each other were pushed down. #80710
• The brpc future timeout contract was broken. #80783
• An analyzed INSERT's sources were not refreshed before the planner lock was taken, and a view's base tables were not locked before planning read them. #80786 #80784
• The Iceberg REST catalog was not closed when its connector shut down, and the Iceberg metadata cache background executor was not shut down on catalog shutdown. #80712 #80598
• SHOW PROC job detail failed a cast for ALTER jobs it cannot show instead of rejecting them. #80719
• Vector index files were not copied during rowset migration. #80391
• The tablets of a lake rollup were not removed from the inverted index when ADD ROLLUP failed. #80717
• The rewrite tasks of optimize and merge-partition jobs did not expire. #80718
• A shared buffer could be reused after a failed remote read. #79965
• Per-column min/max statistics collection was not throttled. #78544
• Idle pooled FE Thrift connections were reused instead of replaced. #80715
• hasDelete was not restored when visible DELETE transactions were applied. #80592
• The precision of a decimal map_agg key was lost. #80673
• The FE brpc client now uses com.starrocks:jprotobuf-rpc-core. #80684
• A non-boolean partial_update header on transaction Stream Load was not rejected. #79350
• Physical segment and rowset counts were not reported for split lake scans. #80359
• Lake compaction was not skipped during every lake rollup job. #80655
• Row source overflow in Primary Key compaction. #80472
• The FE web console /system page did not look up the raw proc path. #80648
• Statistics DML did not bind the internal context. #80473
• Driver capacity was not reserved before instantiation. #80495
• Peer cache data was not copied when block buffering was disabled. #80438
• Not every create task was counted when a partition had several indexes. #80640
• Runtime reset-to-auto did not work for Primary Key parallel execution threads. #80567
• A lost sink wake-up in local exchange with the event scheduler. #80547
• Tablet merge and tablet split results whose ranges disagreed with the FE were not rejected. #80538 #80418
• A hash join did not stay partitioned once a partition outgrew 32-bit binary offsets. #80488
• The bypass-write transaction begin timeout header was not treated as seconds. #80548
• The alter job history kept in FE memory was unbounded. #80465
• An outer join was converted on a recorded NULL rejection even when it did not reject the NULL-extended rows, and a join NULL rejection converted outer joins below a limit, top-N, or window. #80510 #79974
• Column-less and non-deterministic join predicates were dropped by join reorder. #80511
• BITMAP indexes were accepted on column types the BE cannot encode. #80459
• A short-circuit IN list that repeated a key returned a row more than once. #80318
• CSV files were split into byte ranges when enclose or escape was set. #80386
• Per-column ZSTD compression dictionaries could not be read. #77355
• Errors of failed multi-table transaction Stream Load commits were not reported correctly. #80351
• A request URI was not sanitized with the same query parser as the actions. #80461
• CANCEL ALTER TABLE ROLLUP without IDs did not cancel all rollup jobs. #80450
• information_schema.columns with LIMIT was not answered from the queried catalog. #80448
• Paimon branch state was not isolated by table, and dropped Paimon partitions were not removed from the metadata cache. #79879 #79442
• Range-distribution tablets were not created with their own initial metadata. #80421
• Duplicate output column names were rejected when unloading to CSV through INSERT INTO FILES. #79897
• A FULL OUTER JOIN ... USING column did not keep its own type on the join key. #79655
• Connector I/O ran under FE metadata locks. #80416
• Iceberg time travel was lost when the SQL dialect was Trino. #79171
• Iceberg decimal manifest bounds were not encoded using minimum-length two's complement. #78456
• Data-driven allocations in the Parquet, ORC, and CSV read paths were not bounded by the query memory limit. #78573
• Unloaded or failed statistics were cached as no statistics. #80236
• Loads whose partition or sort key column is a generated column were not pre-split, and tablet pre-split samples did not run in the load time zone. #80390 #80362
• Primary Key tablet cleanup was counted as an error state. #79558
• The LDAP group provider became unusable after an FE restart or on AD referrals. #80361
• Broker Load from GCS with an inline service account key failed on gcs-connector 3.x. #78649
• Week functions aborted on a datetime before year 0. #80228
• Upgraded StarOS and starlet to v4.1.5. #80347
• The MemSpaceMonitor thread was not stopped on destruction, which caused SIGABRT when the BE failed to start. #79691
• A connector query-triggered analyze leaked a running task and left a dead scheduler. #80329
• createShard was not replayed once when it failed without a StarMgr answer. #80312
• Filters on the right side of an ASOF join were not kept above the join. #80303
• NGRAMBF pruning was incorrect for NOT LIKE. #79243
• Cardinality estimation of join and range predicates was wrong. #80242
• The NULL group was lost when the top-N aggregate was split. #80143
• Adaptive MV partition refresh did not support cloud-native tables. #80270
• AnalyzeMgr.clearStalePartitionStats threw IllegalStateException when no table needed cleaning. #80265
• ViewsSystemTable held a database read lock instead of an intensive table lock. #78344
• DROP PARTITIONS WHERE dropped rows that its condition did not match. #79958
• Lake delete_tablets bookkeeping was not bounded by tablets plus versions. #80243
• Sink observers were not notified when the last sender left a finishing SinkBuffer. #80155
• A legacy MV task postRun was not ignored during refresh. #79943
• Group provider file I/O was unbounded, and replayed providers were not bridged until warm. #79896
• The BE crashed in Primary Key tablet get_compaction_status while a compaction waited for apply. #80167
• The filesystem was disconnected on cache eviction. #80087
• A 0-row commit counted the whole table as loaded rows. #80182
• A multi-statement transaction that mixed bundled and standalone statements was not published. #79894
• A finished transaction could be enqueued more than once in finalStatusTransactionStateDeque. #79988
• Parquet nested type edge cases in schema resolution, inference, the writer, and the reader. #80085
• Variant paths for struct casts with special characters. #74168
• NULL-passing runtime filters were pushed below RepeatNode on nulled grouping keys. #80051
• The primary-key distinct rewrite dropped other aggregates. #79895
• An Iceberg table cache refresh could overwrite a concurrent invalidation. #79968
• The SET_VAR-hinted custom_query_id was not recorded in the audit log. #79871
• JSON extended columns were registered on the shared catalog table. #78611
• Prepared statements leaked on COM_STMT_CLOSE. #79860
• A query whose range-colocate bucket assignment went stale was not re-planned. #79927
• MV spill I/O was not kept alive until the multicast exchange finished. #79899
• The exchange in front of a range child of a set operation or null-safe join was removed. #79901
• The BE crashed in LookUpOperator when the event scheduler was off. #79711
• sys.fe_memory_usage read an empty map instead of collecting. #79809
• Spill sort completion was not synchronized, and finish errors were not preserved. #79521
• The compressed group-by key serializer did not accept an only-null constant. #79499
• A materialized view rewrite left an aggregate in a projection. #79611
• The ADLS2 account scope was not preserved, and its credentials were not redacted. #79526
• QueryCumulativeCpuTime and QuerySpillBytes were counted once per fragment instance. #79774
• A SHOW statement whose LIMIT offset was past the end did not return an empty result. #79764
• The finish callback was not answered when a load spill merge task was cancelled. #79360
• SHOW ALTER TABLE OPTIMIZE did not resolve ORDER BY against its own columns. #79687
• Security integration (LDAP) users could not authenticate on the non-MySQL channels. #79165
• EvHttpServer closed unrelated file descriptors on shutdown. #79582
• A proc dir's row width was not checked where its rows became an answer. #79619
• A non-positive compact_threads crashed the CN instead of being rejected. #79641
• TableKeeper imported jdk.jshell. #79520