v1.8.23

1.8.23 (2026-11-13)

Bug Fixes

• api-gateway: Allow only one WS authorization at a time per connection (#12748) (220a1b5)
• cubesql: Don't push LIMIT 0 into ungrouped CubeScan of all members (#12717) (893d5c5)
• cubesql: Fix COUNT over NULL and reject aggregate FILTER (#12724) (935e9b0)
• cubesql: Fix duplicate field error for repeated operands with ORDER BY (#12716) (7143039)
• cubesql: Hide other users' query text in pg_stat_activity (#12720) (904eeda)
• cubesql: Load order-only members of ordered CubeScans (#12611) (eb065c6)
• cubesql: Reject malformed Bind parameters instead of panicking (#12770) (28483c9)
• cubestore: Disable local filesystem imports by default (#12779) (bcbe7fd)
• cubestore: Keep a queued query a client still waits for from being orphaned (#12761) (1b0e81f), closes cube-js/cube#12755
• cubestore: Reject path traversal in temp uploads and remote fs paths (#12773) (5c18c87)
• snowflake-driver: Hide connection details on connection error (#12774) (faa4348)

Features

• cubesql: Push down APPROX_DISTINCT aggregate (#12713) (edb6b66)
• cubesql: Support :name parameters in /v1/cubesql (#12612) (6ee7550)
• docker: Security upgrade Node.js from 24.22.1 to 24.22.3 (#12745) (8b2fc0a)
• model-schema: Ship types for the manifest the package returns (#12751) (2cf5ed9)
• Replace sqlstring with shared SQL formatter (#12742) (28ef461)

Performance Improvements

• cubesql: Cut memory use of SQL API query planning (#12719) (9ea33c3)