DSE 6.8.x is compatible with Apache Cassandra™ 3.11 and adds additional production-certified changes, if any. Components that are indicated with an asterisk (*) (if any) are known to be updated since the prior patch version.
Release notes of versions prior to 6.8.4 can be found here.
20 January 2026
- Apache Solr™ 6.0.1.4.2979
- Apache Spark™ 2.4.0.37*
- Apache TinkerPop™ 3.4.14-20251209-29b22637*
- Apache Tomcat® 9.0.113*
- DSE Java Driver 1.10.0-dse-20241015 (DSE internal-only version)
- Netty 4.1.128.1.dse
- Spark JobServer 0.8.0.57
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Hardened cluster foreign node checks. (DSP-24965)
- Added a metric to track sizes of read responses. (DSP-25035)
- Added logging to print the last recovered row during the restore process. (DSP-24760)
- Fixed the broken timeout for the size estimation call that affects consistent node replacement stability. (DSP-25000)
- Upgraded the commons-lang3 library to version 3.20.0. (DSP-25001, CVE-2025-48924)
- Upgraded the lz4-java library to version 1.10.2. (DSP-25027, CVE-2025-66566)
- Upgraded the lz4 library to version 1.8.1. (DSP-25002, CVE-2025-12183)
- Upgraded the okhttp library to version 4.9.2. (DSP-25004, CVE-2021-0341)
- Upgraded the jetty library to version 9.4.58.v20250814. (DSP-25005, CVE-2025-5115)
- Removed the unused tika-core 1.2.5 library. (DSP-25008, CVE-2025-66516)
- Upgraded tomcat to version 9.0.113. (DSP-25009, CVE-2025-24813)
13 November 2025
- Apache Solr™ 6.0.1.4.2979*
- Apache Spark™ 2.4.0.34
- Apache TinkerPop™ 3.4.14-20251106-f107ffba*
- Apache Tomcat® 8.5.100
- DSE Java Driver 1.10.0-dse-20241015 (DSE internal-only version)
- Netty 4.1.128.1.dse*
- Spark JobServer 0.8.0.57
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixed the handling of assertion errors in messaging subsystem to ensure the connection closes correctly. (DSP-24925)
- Fixed backpressure counters on overloaded nodes. (DSP-24944)
- Fixed
input_stream_channel_timeout_in_msalways being enforced. (DSP-24963)
- Fixed deadlock in real-time search index flushing. (DSP-24959)
- Upgraded Netty to version
4.1.128.1.dse, which is based on version4.1.128.Final. (DSP-24977, CVE-2025-59419)
15 September 2025
- Apache Solr™ 6.0.1.4.2976
- Apache Spark™ 2.4.0.34
- Apache TinkerPop™ 3.4.14-20250910-1a1484e8
- Apache Tomcat® 8.5.100
- DSE Java Driver 1.10.0-dse-20241015 (DSE internal-only version)
- Netty 4.1.127.1.dse
- Spark JobServer 0.8.0.57
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixed logic in the VERIFY BACKUP STORE command to remove blobs after read validation failed. (DSP-22975)
- Fixed the version.properties file to display the correct Cassandra and DSE versions. (DSP-24934)
- Fixed an issue where SSTables with implicitly frozen UDTs, including those with dropped columns, became unreadable during upgrades. (DSP-24600)
- Fixed a timeout issue for SAI and range queries. This fix prevents draining nodes from replying to echo messages and stops these nodes from executing faulty requests. (DSP-24792)
- Fixed an issue where incremental repairs failed during compaction. (DSP-24922)
- Upgraded Netty to version
4.1.127.1.dse, which is based on version4.1.127.Final. (DSP-24941, DSP-24942, CVE-2505-55163, CVE-2025-58506)
26 June 2025
- Apache Solr™ 6.0.1.4.2976
- Apache Spark™ 2.4.0.34
- Apache TinkerPop™ 3.4.14-20250603-79edee64
- Apache Tomcat® 8.5.100
- DSE Java Driver 1.10.0-dse-20241015 (DSE internal-only version)
- Netty 4.1.119.1.dse
- Spark JobServer 0.8.0.57
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixed issues retaining data after memtable flushes. (DSP-24872)
- Fixed column filtering to avoid querying cells of unselected complex columns. (DSP-24878)
12 June 2025
- Apache Solr™ 6.0.1.4.2976
- Apache Spark™ 2.4.0.34
- Apache TinkerPop™ 3.4.14-20250603-79edee64*
- Apache Tomcat® 8.5.100
- DSE Java Driver 1.10.0-dse-20241015 (DSE internal-only version)
- Netty 4.1.119.1.dse*
- Spark JobServer 0.8.0.57*
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Updated the Java Development Kit (JDK) versions to
8u452and11.0.27. These JDKs help build and test DSE, and are available in DSE Docker images. (DSP-24710) The following exceptions for DSE UBI images apply:- The DSE 6.9 UBI images use JDK version
11.0.25(from registry.access.redhat.com/ubi8/ubi-minimal:8.10-1255). - The DSE 6.8 UBI images use JDK versions
11.0.23and8u412(from the deprecated registry.redhat.io/ubi7/ubi:7.9-1445).
- The DSE 6.9 UBI images use JDK version
- Fixed the Red Hat-based Docker images to provide proper support for both the Java 8 JDK and the Java 11 JDK. (DSP-22445)
- Upgraded the
net.minidev:json-smartJava JSON parser package to version2.5.2to resolve a Denial of Service (DoS) vulnerability. (DSP-24851, CVE-2024-57699) - Upgraded the Apache Commons BeanUtils library to version
1.11.0to resolve a vulnerability. (DSP-24857, CVE-2025-48734) - Upgraded Netty to version
4.1.119.1.dse, which is based on version4.1.119.Final. (DSP-24850, CVE-2025-24970) - Upgraded the protocol buffers (protobuf) to version
4.29.4to support DSE core workloads. (DSP-24853, CVE-2024-7254) - Added a fix for HADOOP-19031 into the DSE Hadoop software codebase. (DSP-24859, CVE-2024-23454)
12 May 2025
- Apache Solr™ 6.0.1.4.2976
- Apache Spark™ 2.4.0.34*
- Apache TinkerPop™ 3.4.14-20250129-8982fe9c
- Apache Tomcat® 8.5.100
- DSE Java Driver 1.10.0-dse-20241015 (DSE internal-only version)
- Netty 4.1.100.1.dse
- Spark JobServer 0.8.0.56
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Added
--address-config, ansstableloaderoption to configure IP addresses from acassandra.yamlfile. (DSP-24826)
- Upgraded the Apache Parquet and Apache Avro libraries used by Apache Spark to version
1.15.1. (DSP-24802, CVE-2025-30065)
30 April 2025
- Apache Solr™ 6.0.1.4.2976
- Apache Spark™ 2.4.0.33
- Apache TinkerPop™ 3.4.14-20250129-8982fe9c
- Apache Tomcat® 8.5.100
- DSE Java Driver 1.10.0-dse-20241015 (DSE internal-only version)
- Netty 4.1.100.1.dse
- Spark JobServer 0.8.0.56
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixed an issue to prevent a deadlock for some operator commands. (DSP-24701)
- Added system properties
dse.bad_list_handlinganddse.write_side_list_validationto work around invalid list keys. You can set these properties in DSE or in DSE client tools (such assstabledump). (DSP-24819)
7 April 2025
- Apache Solr™ 6.0.1.4.2976*
- Apache Spark™ 2.4.0.33
- Apache TinkerPop™ 3.4.14-20250129-8982fe9c
- Apache Tomcat® 8.5.100
- DSE Java Driver 1.10.0-dse-20241015 (DSE internal-only version)
- Netty 4.1.100.1.dse
- Spark JobServer 0.8.0.56
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Improved permissions checking on system keyspaces to limit user privileges appropriately. (DSP-24657, CVE-2025-23015)
- Removed Apache MINA from the DataStax Agent bundled with DSE Docker images. (DSP-24697, CVE-2024-52046)
- Removed an old jquery library from Apache Solr. (DSP-24777, CVE-2020-11022, CVE-2020-11023)
- Removed demonstration code from Docker images that was being used for testing purposes, and resolved some potential vulnerabilities. (DSP-24782, CVE-2024-52046)
10 February 2025
- Apache Solr™ 6.0.1.4.2964
- Apache Spark™ 2.4.0.33
- Apache TinkerPop™ 3.4.14-20250129-8982fe9c*
- Apache Tomcat® 8.5.100
- DSE Java Driver 1.10.0-dse-20241015 (DSE internal-only version)
- Netty 4.1.100.1.dse
- Spark JobServer 0.8.0.56
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Updated the node startup process so that it verifies the minimum supported version of the Java Virtual Machine (JVM). If the current JVM version is not supported, the node startup process ends and notifies you of the minimum supported version. To view the latest recommended JVM patch version, see the DataStax Enterprise Release notes. To disable the node startup JVM verification check, set the
CASSANDRA_JDK_UNSUPPORTEDenvironment variable. (DSP-24659) - Improved handling of 64-bit values defined in
/proc/self/limitsto prevent displaying an exception. Before the fix, if you set theMax locked memoryfield in/proc/self/limitsto a value larger than 2 GB, the DSE logs might report an exception in the description. (DSP-24705)
- Upgraded the
ch.qos.logbacklibrary to version1.2.13. (DSP-24016, CVE-2023-6378) - Upgraded the Apache MINA core library to version
2.0.27. (DSP-24667, CVE-2024-52046) - Updated the Java Development Kit (JDK) versions to
8u432and11.0.25. These JDKs help build and test DSE, and are available in DSE Docker images. For DSE versions that use JDK 8, this update also fixes known security vulnerabilities. (DSP-24611, CVE-2024-21147, ) - Added a redaction flag for Apache Solr to improve security. (DSP-24474, CVE-2023-50291)
6 January 2025
- Apache Solr™ 6.0.1.4.2964
- Apache Spark™ 2.4.0.33
- Apache TinkerPop™ 3.4.14-20241206-5504ef11*
- Apache Tomcat® 8.5.100
- DSE Java Driver 1.10.0-dse-20241015 (DSE internal-only version)
- Netty 4.1.100.1.dse
- Spark JobServer 0.8.0.56
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Improved the implementation of
libjemallocto detectlibjemalloc2in Amazon Linux 2023 and Red Hat-based platforms. This is a subsequent fix fromDSP-24402. (DSP-24632) - Added a new
nodetoolcommand:nodetool checktokenmetadata. This command verifies if theTokenMetadatais in sync with the GossipendpointState. To fix a node withTokenMetadatathat is out of sync, restart the node. (DSP-24597) - Added configuration to warn or reject on wrong-topology single-partition local requests. These yaml configuration options are
log_out_of_token_range_requestsandreject_out_of_token_range_requests. They are not initially present incassandra.yamlbut can be added as desired. The defaults arelog_out_of_token_range_requests:trueandreject_out_of_token_range_requests:false. Enablingreject_out_of_token_range_requestsis mutually exclusive with nodesync. That is, NodeSync must be disabled before enablingreject_out_of_token_range_requests. (DSP-24437) - Fixed an issue where the outbound connection pending messages counter,
numPendingMessages, did not reset correctly. This fix prevents the connection from stalling, and keeps a node in a reachable state. (DSP-24617)
- Improved the reliability of the DataStax Connector for Apache Spark to Apache Cassandra. The connector now retries queries when it receives connectivity errors and timeouts. (DSP-24651)
- Removed some Apache ZooKeeper JAR files from the tarball to remove potential security vulnerabilities. (DSP-24531, CVE-2023-44981)
13 November 2024
- Apache Solr™ 6.0.1.4.2964
- Apache Spark™ 2.4.0.33*
- Apache TinkerPop™ 3.4.14-20241028-e6912cf4*
- Apache Tomcat® 8.5.100*
- DSE Java Driver 1.10.0-dse-20241015* (DSE internal-only version)
- Netty 4.1.100.1.dse
- Spark JobServer 0.8.0.56
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Updated the JDK used to build DSE to versions
8u422and11.0.24. (DSP-23997)
- Fixed sstablescrub to run with
-tdisabled by default. (DSP-24501) - Added a guardrail warning for large columns in the
cassandra.yamlfile. The new field,column_value_size_warn_threshold_in_kb, can be used to receive warnings when a column exceeds a specified size. By default, this field is not utilized. (DSP-24384)
- Updated DSE Java Driver with fix for JAVA-2738. (DSP-24514)
- Updated DSE Java Driver with fix for JAVA-3125. (DSP-24556)
- Added support for Amazon Linux 2023 (DSP-23827).
- Updated the spark version to
2.4.0.31to pull in the latest ivy library (vs 2.5.2) for a vulnerability fix. (DSP-23685, CVE-2022-46751) - Upgraded tomcat-embed-core to version
8.5.100. (DSP-24013, CVE-2023-46589) - Upgraded nimbus-jose-jwt to
9.41.2, json-smart to2.5.1, commons-lang3 to3.17.0, commons-io to2.17.0, and Azure SDK BOM to1.2.28. (DSP-24015, CVE-2023-52428) - Updated aws-java-sdk library from
1.12.549to1.12.774to address CVE 2024-21634. (DSP-24018, CVE-2024-21634) - Upgraded Docker images to OpenJDK 1.8.0.422 and 11.0.24. (DSP-24534, CVE-2024-21147)
- Upgraded orc-core from version
1.5.2to1.9.4. (DSP-24538, CVE-2024-36114) - Upgraded Apache Avro to version
1.11.4. (DSP-24540, CVE-2024-47561, CVE-2023-39410) - Upgraded reload4j to version
1.2.25. (DSP-24551, CWE-611) - Upgraded Spotify DNS Wrapper Library to version 3.3.2 and dnsjava library to version 3.4.2. (DSP-24545, CVE-2024-25638, CVE-2023-50868, CVE-2023-50387)
- Upgraded tika-core to version
1.28.5. (DSP-23425, CVE-2022-30126, CVE-2022-30973)
9 September 2024
- Apache Solr™ 6.0.1.4.2964
- Apache Spark™ 2.4.0.30
- Apache TinkerPop™ 3.4.14-20240307-bcc67d14
- Apache Tomcat® 8.5.94
- DSE Java Driver 1.10.0-dse-20240520 (DSE internal-only version)
- Netty 4.1.100.1.dse
- Spark JobServer 0.8.0.56
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixed SSBR to prevent dropping unused UDTs on restore. (DSP-24376)
- Fixed a bug in backup error handling that led to backups being stuck indefinitely in the running state, resulting in snapshots not getting cleaned up. (DSP-24390)
- Improved
libjemallocdetection to detectlibmalloc2in systems where this package is present. (DSP-24402) - Fixed a race condition in disabling of in-progress compactions when interrupting compaction types are initiated. Added debug logging to help identify in-progress and interrupting compactions. (DSP-24318)
- Improved Kerberos authentication provider for
cqlshby making it pluggable so you can plug in or customize how it works in your environment. (DSP-24129)
- Fixed the NPE in TieredTableStats. Return all TieredTableStats for all initialized tables for each jmx request, uninitialized tables are ignored until they are initialized and can be identified as TieredCompactionStrategy tables. (DSP-24395)
- Updated Debian package dependencies on
libaio1so that it can be installed on Ubuntu 24.04 (Noble Numbat). (DSP-24359)
- Upgraded jetty to version
9.4.56.v20240826. (DSP-24447, CVE-2024-22201) - Upgraded
commons-compressto version 1.26.2. (DSP-24380, CVE-2024-25710)
12 July 2024
- Apache Solr™ 6.0.1.4.2964
- Apache Spark™ 2.4.0.30
- Apache TinkerPop™ 3.4.14-20240307-bcc67d14
- Apache Tomcat® 8.5.94
- DSE Java Driver 1.10.0-dse-20240520 (DSE internal-only version)
- Netty 4.1.100.1.dse
- Spark JobServer 0.8.0.56*
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixed the loop situation on reconnections with overloaded nodes. (DSP-24194)
- Added the option to temporarily lock a role after too many failed authentication requests. This feature is enabled per role through role options by setting
unauthorized_access_max_attemptsand, optionally,unauthorized_access_lockout_duration_seconds(default is 15 minutes). Added the configuration parameter-Dauthentication_options.role_lockout_expire_secondsto set the maximum retention of expired locks (default is 1 day). Allowedthe dsetoolcommand with itsrole_locksoption to show and remove extant role locks. (DSP-23953)
10 June 2024
- Apache Solr™ 6.0.1.4.2964
- Apache Spark™ 2.4.0.30
- Apache TinkerPop™ 3.4.14-20240307-bcc67d14
- Apache Tomcat® 8.5.94
- DSE Java Driver 1.10.0-dse-20240520* (DSE internal-only version)
- Netty 4.1.100.1.dse
- Spark JobServer 0.8.0.54
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Prevents a Java driver request timeout for
drain()operations executed via Management API by setting the request timeout to 0. The request timeout change only affects the internal Java driver used in Management API and is only set to 0 explicitly for thedrain()operation. (DSP-23994)
- Secondary Index: Don't fail queries if one node is not available. (DSP-24163)
- Fix IllegalStateException when flushing range deletes with TWCS split_during_flush=true. (DSP-21571)
- Fixed, Spark-sql cast errors handling dates on joins. (DSP-24215)
- Fixed, observe spark.directJoin and spark.directJoinSizeRatio parameters. (DSP-24258)
- Adds partial support for client and internode connections using TLSv1_3. (DSP-23989)
- Upgraded JDK 8 and 11 versions in DSE Docker images to
8u402and11.0.22respectively. (DSP-24250)
- Upgrades
dse-java-driverto handle newer versions of Guava. (DSP-24191)
- Improved performance and lowered memory use of querying data based on SAI index for a table with large partitions. (DSP-24254)
13 May 2024
- Apache Solr™ 6.0.1.4.2964
- Apache Spark™ 2.4.0.30
- Apache TinkerPop™ 3.4.14-20240307-bcc67d14
- Apache Tomcat® 8.5.94
- DSE Java Driver 1.10.0-dse-20240212 (DSE internal-only version)
- Netty 4.1.100.1.dse
- Spark JobServer 0.8.0.54
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixed
NoClassDefFoundErrorin Azure backups that are configured to authenticate through a pod identity. (DSP-24143)
- Upgraded to Bouncy Castle v1.78.1, its latest known version. (DSP-24188, CVE-2024-30371)
25 April 2024
- Apache Solr™ 6.0.1.4.2964
- Apache Spark™ 2.4.0.30
- Apache TinkerPop™ 3.4.14-20240307-bcc67d14
- Apache Tomcat® 8.5.94
- DSE Java Driver 1.10.0-dse-20240212 (DSE internal-only version)
- Netty 4.1.100.1.dse
- Spark JobServer 0.8.0.54
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Adds two configuration parameters enabling reduction of table histogram metrics cardinality. Those are
-Dcassandra.table_metrics_default_histograms_aggregation=[INDIVIDUAL|AGGREGATED]which controls whether tables use individual (default) or keyspace histograms, and-Dtable_metrics_export_globals=[true|false]which controls whether global table histograms exist (default). (DSP-24166)
23 April 2024
- Apache Solr™ 6.0.1.4.2964
- Apache Spark™ 2.4.0.30
- Apache TinkerPop™ 3.4.14-20240307-bcc67d14
- Apache Tomcat® 8.5.94
- DSE Java Driver 1.10.0-dse-20240212 (DSE internal-only version)
- Netty 4.1.100.1.dse
- Spark JobServer 0.8.0.54
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Changed the default location of the histogram aggregation work, offloading it by default to a thread pool different than the main one. This unblocks the TPC threads when large numbers of tables exist. (DSP-24165)
This release is an internal DSE release identical to 6.8.46 release.
12 April 2024
- Apache Solr™ 6.0.1.4.2964
- Apache Spark™ 2.4.0.30
- Apache TinkerPop™ 3.4.14-20240307-bcc67d14
- Apache Tomcat® 8.5.94
- DSE Java Driver 1.10.0-dse-20240212 (DSE internal-only version)
- Netty 4.1.100.1.dse
- Spark JobServer 0.8.0.54
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixed millisecond precision point in time restore. (DSP-23993)
- Added support for AWS EC2 IMDSv2. Please beware that if you use Ec2Snitch or Ec2MultiRegionSnitch, by default it will communicate with AWS IMDSv2. This change is transparent and does not need anything done upon upgrade. Consult cassandra-rackdc.properties for more details. (DSP-23995)
- Fixed nodetool viewbuildstatus to query the responsible replica. It prevents returning unknown status when system_distributed RF is smaller than the number of nodes in the cluster. (DSP-23806)
- Fixed Solr credentials parsing. (DSP-24102)
- Added possibility to close/block connection per role by specifying
connection_idle_timeout_secondsandconnection_idle_behaviorvia a role custom options. (DSP-23951)
11 March 2024
- Apache Solr™ 6.0.1.4.2964
- Apache Spark™ 2.4.0.30*
- Apache TinkerPop™ 3.4.14-20240307-bcc67d14*
- Apache Tomcat® 8.5.94
- DSE Java Driver 1.10.0-dse-20240212* (DSE internal-only version)
- Netty 4.1.100.1.dse
- Spark JobServer 0.8.0.54
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Reverted the regression caused by DSP-23913 which introduced a change in batch size calculation that impacts the behaviour of the batch_size guardrail. Introduced a new guardrail called
batch_size_with_pk_warn_threshold_in_kb,batch_size_with_pk_fail_threshold_in_kbinstead that honours the updated logic. (DSP-24011)
- Fixed issue causing indefinite waits during flush operations when TPC executor gets overloaded and default queue size is exceeded. (DSP-23774)
- Modified DSE Advanced Authentication to preserve credentials cache in case of an LDAP internal error causing authentication failure. (DSP-12590)
- Improved LDAP logging by decreasing the frequency of search reference warning messages. (DSP-21177)
- Changed DSE Advanced Authentication to only record in audit log a login error when authentication fails due to matching credentials (and not for provider internal errors). (DSP-23952)
- Upgraded JDK versions in DSE Docker images to
8u392and11.0.21. (DSP-23213)
- Upgraded
org.json:jsonto version20240205. (DSP-23784, CVE-2023-5072) - Upgraded
snappy-javato version1.1.10.4. (DSP-23819, CVE-2023-43642) - Upgraded
jnr-posixto version3.1.8. (DSP-23820, CWE-416)
5 February 2024
- Apache Solr™ 6.0.1.4.2964
- Apache Spark™ 2.4.0.29
- Apache TinkerPop™ 3.4.14-20231030-479dc6d7
- Apache Tomcat® 8.5.94
- DSE Java Driver 1.10.0-dse-20220616 (DSE internal-only version)
- Netty 4.1.100.1.dse
- Spark JobServer 0.8.0.54
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixed mutation size calculation formula by taking into account static column updates. Backporting CASSANDRA-15293 achieved this fix. (DSP-23933)
- Fixed batch size guardrail to take into account the mutation primary key size. That prevents flooding the cluster with operations for tables that use the primary key without clustering columns. (DSP-23913)
- Fixed DSEFS file path handling that could fail when using filenames containing colons. (DSP-23947)
- Removed Python 2.7 libraries from
collectd. (DSP-23764)
- Upgraded the DSE 6.8 dependency on Ehcache to Terracotta's version of Ehcache v2.10.10.17.20. The Terracotta version does not include extra libraries (specifically Jackson databind). The previous Ehcache v2.10.9.2 was exposing a security vulnerability CVE-2020-36518. The vulnerability in
jackson-databindbefore v2.13.0 allowed a Java StackOverflow exception and denial of service via a large depth of nested objects. (DSP-23508, CVE-2020-36518, CVE-2017-17485, CVE-2017-7525, CVE-2018-11307, CVE-2018-7489, CVE-2019-16942)
18 December 2023
- Apache Solr™ 6.0.1.4.2964
- Apache Spark™ 2.4.0.29
- Apache TinkerPop™ 3.4.14-20231030-479dc6d7
- Apache Tomcat® 8.5.94*
- DSE Java Driver 1.10.0-dse-20220616 (DSE internal-only version)
- Netty 4.1.100.1.dse
- Spark JobServer 0.8.0.54
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixed deadlock in indexes initialization that occurs when the same table has both a secondary index and a search index and the entries in
IndexInfotable are missing. The deadlock is resolved by marking the SOLR index as built in a different thread than the main DSE thread. (DSP-23828)
- Fixed the
ConcurrentModificationExceptionexception occurring in error during the NodeSync old validations cleanup process. (DSP-23821)
- Upgraded Jetty to version
9.4.53.v20231009. (DSP-23734, CVE-2023-44487) - Upgraded Apache Tomcat to version
8.5.94. (DSP-23779, CVE-2023-45648)
7 November 2023
- Apache Solr™ 6.0.1.4.2964*
- Apache Spark™ 2.4.0.29
- Apache TinkerPop™ 3.4.14-20231030-479dc6d7*
- Apache Tomcat® 8.5.93
- DSE Java Driver 1.10.0-dse-20220616 (DSE internal-only version)
- Netty 4.1.100.1.dse*
- Spark JobServer 0.8.0.54
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Ensured that tombstones get NodeSynced before expiring by assigning segments that have never successfully been NodeSynced an urgent priority. (DSP-23710)
- Upgraded Netty to version
4.1.100.1.dsethat is based on4.1.100.Final. (DSP-23763, CVE-2023-44487, CVE-2022-41881, CVE-2023-34462) - Removed
htracecoming from Hadoop libraries (see HADOOP-17424). Removedjackson-databindversion2.4.0that was a transitive dependency ofhtrace. (DSP-23450) - Removed the
htraceversion from thelucene-solrlibrary.htraceis an unused dependency in DSE 6.8. This removal resolved security vulnerabilities related to thehtracedependency, despite its being unused. (DSP-23756)
9 October 2023
- Apache Solr™ 6.0.1.4.2959
- Apache Spark™ 2.4.0.29
- Apache TinkerPop™ 3.4.14-20230814-301fd418
- Apache Tomcat® 8.5.93
- DSE Java Driver 1.10.0-dse-20220616 (DSE internal-only version)
- Netty 4.1.86.1.dse
- Spark JobServer 0.8.0.54
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Ensured that DSE uses only version 1.12.x of the
aws-sdk-javalibrary. Removed the dependency on version 1.11.x which also eliminated the need for the outdated and vulnerablejackson-databindversion 2.6.7.3. (DSP-23613)
11 September 2023
- Apache Solr™ 6.0.1.4.2959
- Apache Spark™ 2.4.0.29*
- Apache TinkerPop™ 3.4.14-20230814-301fd418*
- Apache Tomcat® 8.5.93*
- DSE Java Driver 1.10.0-dse-20220616 (DSE internal-only version)
- Netty 4.1.86.1.dse
- Spark JobServer 0.8.0.54
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Changed logging level from
errortowarnfor a log message that is issued when folders are removed during a snapshot that calculates folder size. (DSP-23432) - Added a check to prevent running cleanup operations concurrently with operations that lead to token ownership changes, such as node addition or node decommission. Prior to this fix, running such concurrent operations could unintentionally delete valid data replicas. (DSP-23507)
- Changed reads from an SSTable to be delimited by and not exceed the declared row size in the row preamble. This prevents Out of Memory issues (OOM) with a corrupted SSTable. (DSP-23336)
- Upgraded
snappy-javato version 1.1.10.3. (DSP-23499)
- Improved SAI queries response time by reducing the number of skips in the predicate intersection algorithm when selectivity of predicates varies significantly. (DSP-23435)
- Added a JVM configuration option to disable Storage Attached Index (SAI) segment compaction. Disable compaction by setting the
cassandra.sai.enable_segment_compactionJVM flag tofalse. The default value istrue. (DSP-23440) - Fixed SAI index build failure for huge SSTables. (DSP-23478)
- Changed to use
collectdv0.1.6 bundle based on Ubuntu:18.04. (DSP-23519)
- Fixed the
nodetool repair --tracecommand to prevent it from hanging when it is run on an empty keyspace or on a keyspace with nodesync-enabled tables. (DSP-23408)
- Fixed a bug where Key Management Interoperability Protocol (KMIP) server failover was not working as intended because of exceptions that changed in the KMIP client library. (DSP-23343)
- Upgraded SnakeYAML library to the latest
2.0version. (DSP-23429, CVE-2022-1471) - Upgraded
java-xmlbuilderto version 1.3. (DSP-23489, CVE-2014-125087) - Upgraded Apache Tomcat to version 8.5.93. (DSP-23522, CVE-2023-41080)
- Upgraded ‘Google Guava’ to version 32.1.2-jre to remove CVE-2023-2976. Upgraded ‘FasterXML Jackson’ libraries to version 2.13.5. (DSP-23525, CVE-2023-2976)
- Enforced
net.sf.ehcachelibrary to use version 2.10.9.2 instead of 2.10.4. Removed indirect dependency onjackson-databindversion 2.3.3. (DSP-23528)
10 July 2023
- Added support for Red Hat Enterprise Linux 9. (DSP-23229)
- Added support for Oracle Linux 9. (DSP-22612)
- Apache Solr™ 6.0.1.4.2959
- Apache Spark™ 2.4.0.28
- Apache TinkerPop™ 3.4.14-20230523-37856751
- Apache Tomcat® 8.5.89
- DSE Java Driver 1.10.0-dse-20220616 (DSE internal-only version)
- Netty 4.1.86.1.dse
- Spark JobServer 0.8.0.54
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Allowed to encrypt
kmip_hostpasswords in thedse.yamlfile. New optional parameterpassword_encryption_key_namewas added to thekmip_hostsitems. DSP-23326 enabled password encryption before placing them indse.yaml. (DSP-23313) - Fixed the issue with dropping the UDT column, which potentially leads to a problem accessing data from the affected table after the node is restarted. (DSP-23337)
- Fixed race condition causing sstableloader to hang when the Connections Per Host (
-cph) value is greater than one (1). (DSP-23117)
- Updated official DSE Docker image, basing it on a more current Ubuntu 20.04 (Focal Fossa) that is FIPS certified and handles multiple known CVEs. (DSP-23397)
- Improved SAI index-building process when reloading SSTables by building the indexes in parallel. (DSP-23415)
- Reduced allocations by removing some unnecessary autoboxing from SAI range iterators. (DSP-23419)
- Improved SAI exact match queries performance on the memtable index data by skipping unnecessary size calculations. (DSP-23280)
- Fixed a bug in the SAI intersection comparison. (DSP-23375)
- Upgraded Apache mina-core library to version 2.0.24. (DSP-23378, CVE-2021-41973)
- Upgraded Azure SDK client libraries to be based on BOM 1.2.13. (DSP-23382, CVE-2023-1370)
- Updated aws-java-sdk to version 1.12.486. (DSP-23383, CVE-2022-31159)
- Upgraded Apache Commons libraries to recently available versions:
commons-ioto2.11.0,commons-lang3to3.12.0,commons-math3to3.6.1, andcommons-collection4to4.4. (DSP-23384, CVE-2021-29425) - Upgraded
xerial/snappy-javalibrary to version1.1.10.1. (DSP-23391, DSP-23433, CVE-2023-34453, CVE-2023-34454, CVE-2023-34455) - Upgraded Jetty to version
9.4.51.v20230217. (DSP-23428, CVE-2023-26048) - Removed all dependencies on Netty 3 known to have security vulnerabilities. (DSP-22562, CVE-2019-16869)
12 June 2023
- Apache Solr™ 6.0.1.4.2959
- Apache Spark™ 2.4.0.28*
- Apache TinkerPop™ 3.4.14-20230523-37856751*
- Apache Tomcat® 8.5.89*
- DSE Java Driver 1.10.0-dse-20220616 (DSE internal-only version)
- Netty 4.1.86.1.dse
- Spark JobServer 0.8.0.54*
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixed compaction to ensure tombstones are not pruned for data in SSTables that are excluded from the compaction due to limited disk space. This fixes CASSANDRA-18507. (DSP-23305)
- Improved logging around index summary building. Introduced rounding that effectively uses the
min_index_intervaloption set to a multiple of 128 in the index summary building process. (DSP-23317)
- Fixed the bug in the Solr UI permissions when accessing segments information. It was not working with authorization enabled by implementing a segments view when granting the
SELECTpermission on the Solr-indexed table. (DSP-22295)
- Added
--keyoption to dsetool encryptconfigvalue command to allow using different key than the default one. (DSP-23326)
- Fixed memory leak in the chunk cache metadata caching. (DSP-23316)
- Upgraded commons-net library used in Hadoop and Tinkerpop. Removed old Hadoop
1.0.3dependency and replaced it with version universally used in DSE (2.7.1.xfor 5.1 and2.10.2.xfor 6.8). (DSP-23327, CVE-2021-37533, CVE-2012-4449) - Upgraded Apache Tomcat to version
8.5.89. (DSP-23329, CVE-2023-28709)
10 May 2023
- Apache Solr™ 6.0.1.4.2959
- Apache Spark™ 2.4.0.27
- Apache TinkerPop™ 3.4.14-20230215-3db1ca33
- Apache Tomcat® 8.5.87
- DSE Java Driver 1.10.0-dse-20220616 (DSE internal-only version)
- Netty 4.1.86.1.dse
- Spark JobServer 0.8.0.53
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixed regression in KMIP encryption introduced in DSP-22164. Moved the logic required for using old HashiVault KMIP under the feature flag
experimental_custom_attributes_modein dse.yaml, defined per kmip_hosts.per-kmip-group section. (DSP-23278)
- Fixed SAI numeric index validation on SSTables with over 2 billion rows. (DSP-23255)
- Improved CQLSH to support Python 3.11 and changed preferred interpreter from python2 to python3. Introduced CQLSH_PYTHON environment variable to allow users to specify the python interpreter used by CQLSH. (DSP-23257)
- Upgraded org.codehaus.jettison:jettison library to version 1.5.4. (DSP-23254, CVE-2023-1436)
- Upgraded com.google.auto.factory:auto-factory to version 1.0.1 to remove the dependency on org.eclipse.equinox. (DSP-22864, CVE-2021-41033)
11 April 2023
- Apache Solr™ 6.0.1.4.2959*
- Apache Spark™ 2.4.0.27
- Apache TinkerPop™ 3.4.14-20230215-3db1ca33
- Apache Tomcat® 8.5.87*
- DSE Java Driver 1.10.0-dse-20220616 (DSE internal-only version)
- Netty 4.1.86.1.dse
- Spark JobServer 0.8.0.53
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Set default systemd dse.service startup timeout to 7 minutes. (DSP-23225)
- Fixed memory leak that can happen while handling inbound large messages. (DSP-23156)
- Fixed race condition occurring in DSE Search with enabled real-time (RT) indexing that was causing client-side failures under query-heavy workload. (DSP-23184)
- Updated OS versions used to create DSE packages (Ubuntu 12.04 for
.debpackages, and CentOS 7.9 for.rpmpackages). (DSP-22750)
- Fixed regression scenario where DSE was not using keys on the KMIP server that were created either by a previous DSE version or outside of DSE. Regression was introduced in DSE v6.8.22. (DSP-23182)
- Upgraded
org.json:jsonto20230227to resolve a Denial of Service (DoS) vulnerability. Additionally, upgradedesri-geometry-apito2.2.4, which now follows the OGC and GeoJSON standard for polygon serialization. As a result, polygons' JSON representation is serialized with the exterior polygon in counterclockwise order and interior polygons (holes) in clockwise order. (DSP-23187, CWE-400) - Upgraded commons-fileupload to 1.5. Added a solrconfig.xml setting that limits the number of files allowed in multipart update requests. (DSP-23188, CVE-2023-24998)
- Upgraded Apache Tomcat to version 8.5.87. (DSP-23205, CVE-2023-24998)
6 March 2023
- Apache Solr™ 6.0.1.4.2951*
- Apache Spark™ 2.4.0.27*
- Apache TinkerPop™ 3.4.14-20230215-3db1ca33*
- Apache Tomcat® 8.5.84
- DSE Java Driver 1.10.0-dse-20220616 (DSE internal-only version)
- Netty 4.1.86.1.dse
- Spark JobServer 0.8.0.53*
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Exposed two configuration properties:
-Dcassandra.counter_locks_per_coreand-Dcassandra.lwt_locks_per_coreto be tuned for intensive counter batch workloads when observing WriteTimeoutExceptions. For example, update the default of 1024 to-Dcassandra.lwt_locks_per_core=16384. (DSP-23163) - Fixed SAI index metrics initialization potentially causing dse start failure due to NullPointerException. (DSP-23192)
- Added support for Rocky Linux 9. (DSP-22732)
- Added support for Rocky Linux 8. (DSP-23170)
- Added support for Oracle Linux 9. (DSP-22612)
- Fixed RPM package install for platforms requiring systemd services. (DSP-23146)
- Upgraded libthrift to v0.9.3-1. (DSP-18096, CVE-2018-1320)
- Upgraded groovy-sandbox to 1.20.1.DSE, which is a DataStax version based on OSS v1.20 that contains additional fixes. (DSP-21677, CVE-2018-1000865)
- Ported a security fix from Spark 2.4.6 that prevents RCE on unauthenticated Spark resource manager. (DSP-21782, CVE-2020-9480)
- Removed Postgresql driver from spark-jobserver. (DSP-22894, CVE-2022-21724, CVE-2020-13692, CVE-2018-10936)
- Upgraded insights-collectd to version 0.1.5 that removed libmodbus.so. (DSP-22809, CVE-2022-0367)
- Upgraded Gson that is used in Solr to v2.10.1. (DSP-22798, CVE-2022-25647)
- Upgraded Apache Derby used in Spark to v10.14.2.0. (DSP-23008, CVE-2018-1313)
- Removed unused, outdated org.mortbay.jetty libraries. (DSP-23004, CVE-2011-4461)
- Upgraded Jettison to 1.5.3, Xerces to 2.12.2, and Gson Hadoop to 2.10.1. Enforced the same Hadoop 2.10.2.x version for all DSE components. (DSP-23120, CVE-2022-40149, CVE-2022-40150, CVE-2013-4002)
- Upgraded Jcommander used in SJK to v1.82. (DSP-21783, SRCCLR-SID-22555)
7 February 2023
- Apache Solr™ 6.0.1.4.2947*
- Apache Spark™ 2.4.0.24*
- Apache TinkerPop™ 3.4.14-20230124-b2e47e9a*
- Apache Tomcat® 8.5.84
- DSE Java Driver 1.10.0-dse-20220616 (DSE internal-only version)
- Netty 4.1.86.1.dse
- Spark JobServer 0.8.0.52
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Added logging of unexpected failures in asynchronous reactive code. (DSP-23111)
- Fixed incorrect count(*) results when hitting guardrail paging limits. (DSP-22813)
- Allow the use of date with time in Solr range queries on SimpleDateField fields (time will be truncated). (DSP-23085)
- Fixed the CLI usage of namespace filtering in the dsetool utility. (DSP-23064)
- Fixed the dsetool utility ‘managekmip revoke’ command to correctly set the ‘compromiseOccurrenceDate’ field. (DSP-23110)
- Fixed error preventing cqlsh COPY from Mac M1 hardware. (DSP-22996)
- Upgraded httpclient version to 4.5.14 version. (DSP-22831, CVE-2020-13956)
- Upgraded Spark to version that is based on Hadoop 2.10.2. (DSP-22923, CVE-2016-6811, CVE-2017-3162)
- Upgraded TinkerPop to a version that uses Hadoop 2.10.2. (DSP-23092, CVE-2022-25168, CVE-2021-33036, CVE-2021-37404, CVE-2020-9492, CVE-2018-8009, CVE-2016-3086, CVE-2016-6811, CVE-2016-5393)
9 January 2023
- Apache Solr™ 6.0.1.4.2943
- Apache Spark™ 2.4.0.23
- Apache TinkerPop™ 3.4.14-20221125-fd3c10f9
- Apache Tomcat® 8.5.84*
- DSE Java Driver 1.10.0-dse-20220616 (DSE internal-only version)
- Netty 4.1.86.1.dse*
- Spark JobServer 0.8.0.52*
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Added a guarding exception that prevents the creation of an invalid range tombstone. Improved range tombstone addition by skipping the creation of a tombstone for the empty range. (DSP-23075)
- Upgraded Hadoop direct dependency to 2.10.2.1, a new version that is based on OSS 2.10.2. (DSP-22922)
- Upgraded apache-shiro used by spark-jobserver to version 1.10.1. (DSP-23019, CVE-2022-32532, CVE-2022-40664)
- Upgraded Netty to version 4.1.86.Final. (DSP-23062, CVE-2022-41915, CVE-2022-41881)
- Upgraded Tomcat to version 8.5.84. (DSP-23017, CVE-2022-34305)
12 December 2022
- Apache Solr™ 6.0.1.4.2943*
- Apache Spark™ 2.4.0.23*
- Apache TinkerPop™ 3.4.14-20221125-fd3c10f9*
- Apache Tomcat® 8.5.79
- DSE Java Driver 1.10.0-dse-20220616 (DSE internal-only version)
- Netty 4.1.78.1.dse
- Spark JobServer 0.8.0.51
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Changed log messages added when Insights functionality cannot be started from ERROR to WARN. (DSP-22962)
- Fixed Debian package dependencies on Python so that it can be installed on Ubuntu 22.04. (DSP-22961)
- Use
com.google.cloud:libraries-bom:26.1.3libraries for GCE backup and restore functionality. Upgraded Guava from 19.0 to 31.1-jre. (DSP-22904, CVE-2020-8908, CVE-2018-10237, CVE-2020-7692) - Updated Apache Ivy of DSE Spark to version 2.5.1. (DSP-22949, CVE-2022-37865, CVE-2022-37866)
- Removed
lucene-benchmarkfromlucene-solras it contained unnecessary vulnerable library:nekohtml:1.9.17. (DSP-22902, CVE-2022-28366, CVE-2022-24839, CVE-2022-29546)
14 November 2022
- Apache Solr™ 6.0.1.4.2940
- Apache Spark™ 2.4.0.21*
- Apache TinkerPop™ 3.4.5-20220728-e115ab9a
- Apache Tomcat® 8.5.79
- DSE Java Driver 1.10.0-dse-20220616 (DSE internal-only version)
- Netty 4.1.78.1.dse
- Spark JobServer 0.8.0.51
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixed an issue in DSE Spark which was unable to read S3 objects with $ and = characters in the path. Updated aws-java-sdk to 1.11.892 and hadoop to 2.7.1.5. Dropped support of s3n, which is no longer undergoing active maintenance from the OSS Hadoop. (https://hadoop.apache.org/docs/current2/hadoop-aws/tools/hadoop-aws/index.html#S3N) Users are recommended to migrate to s3a instead. (DSP-22737)
- Upgraded
jackson-databindto version2.13.4.2. (DSP-22905, CVE-2022-42003) - Replaced the vulnerable
woodstox-corelibrary used byjackson-dataformat-xmlwith version 6.4.0. (DSP-22914, CVE-2022-40151, CVE-2022-40152, CVE-2022-40153, CVE-2022-40154, CVE-2022-40155, CVE-2022-40156)
28 October 2022
- Apache Solr™ 6.0.1.4.2940
- Apache Spark™ 2.4.0.20*
- Apache TinkerPop™ 3.4.5-20220728-e115ab9a
- Apache Tomcat® 8.5.79*
- DSE Java Driver 1.10.0-dse-20220616 (DSE internal-only version)
- Netty 4.1.78.1.dse*
- Spark JobServer 0.8.0.51
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixed regression in management api in 6.8.27 by ensuring that epoll netty libraries are included. (DSP-22895)
25 October 2022
NOTE: DSE 6.8.27 has a regression that hinders the use of the management api used in kubernetes. Use of DSE 6.8.27 is not adviced. DSE 6.8.28 resolves this regression.
- Apache Solr™ 6.0.1.4.2940
- Apache Spark™ 2.4.0.20*
- Apache TinkerPop™ 3.4.5-20220728-e115ab9a
- Apache Tomcat® 8.5.79*
- DSE Java Driver 1.10.0-dse-20220616 (DSE internal-only version)
- Netty 4.1.78.1.dse*
- Spark JobServer 0.8.0.51
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixed nodetool flush assertion failure on TWCS tables with split_during_flush=true. (DSP-20708)
- Fixed
dsetool core_indexing_statusto show consistent indexing status between calls with and without--allparameter. (DSP-21594)
- Fixed GraphOLAP spark connection problem in the multi-network cloud environments when GossipingPropertyFileSnitch (GPFS) is not used. (DSP-22707)
- Fixed permission issue in classic graph where DROP permissions were erroneously required for creating and altering a graph schema. (DSP-22024)
- Upgraded insightsCollectd to 0.1.4. (DSP-22739)
- Fixed an issue where EMPTY_LAST_CONTENT would no be written to the stream when the connection was closed. (DSP-22671)
Fixed an issue during DSE Spark cluster upgrade where InClusterAuthenticator would fail to compose and decode a token if it receives an old version token. (DSP-22723)
- Upgraded
jackson-databindto 2.13.4. (DSP-22780, CVE-2022-42004) - Upgraded Netty to version 4.1.78. (DSP-22511, CVE-2019-9512, CVE-2019-9514, CVE-2019-9515, CVE-2019-20444, CVE-2019-20445, CVE-2020-7238, CVE-2020-11612, CVE-2021-37136, CVE-2021-37137)
- Upgraded version of Apache Tomcat from 8.5.75 to 8.5.79. (DSP-22746, CVE-2022-34305, CVE-2022-29885)
- Upgraded org.apache.commons:commons-text to version 1.10.0. (DSP-22816, CVE-2022-42889)
- Upgraded SnakeYAML to 1.33. (DSP-22773, CVE-2022-25857)
- Upgraded jetty to 9.4.49.v20220914. (DSP-22774, CVE-2022-2048)
12 September 2022
- Apache Solr™ 6.0.1.4.2940
- Apache Spark™ 2.4.0.19
- Apache TinkerPop™ 3.4.5-20220728-e115ab9a*
- Apache Tomcat® 8.5.75
- DSE Java Driver 1.10.0-dse-20220616 (DSE internal-only version)
- Netty 4.1.34.3.dse
- Spark JobServer 0.8.0.51
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixed a bug in streaming that could connect back using the wrong address under a specific network setup. (DSP-22585)
- Ported CASSANDRA-15271 to make CLUSTERING ORDER validation less strict. (DSP-21801)
- Fixed ArrayIndexOutOfBoundsException during indexing SAI with ascii option enabled. (DSP-22601)
- Fixed the logic that orders columns in the SELECT list to maintain the given order of the column headers. (DSP-22420)
- Fixed command injection vulnerability in management-api. (DSP-22272)
- Made ‘nodetool status’ report the state of unreachable nodes in order to allow knowing why they are unreachable. (DSP-22648)
18 July 2022
- Apache Solr™ 6.0.1.4.2940
- Apache Spark™ 2.4.0.19*
- Apache TinkerPop™ 3.4.5-20220405-a52bbe2c
- Apache Tomcat® 8.5.75
- DSE Java Driver 1.10.0-dse-20220616* (DSE internal-only version)
- Netty 4.1.34.3.dse
- Spark JobServer 0.8.0.51*
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Upgraded internally used DSE Java driver to
1.10.0-dse-20220616. (DSP-22380) NOTE: - Replaced
1.9.13version ofjackson-core-aslandjackson-mapper-aslto be1.9.13.1.dsewhich contains the security fix. (DSP-22389, CVE-2019-10172) - Removed the PMD plugin from gradle config. (DSP-22575, CVE-2019-7722)
- Fixed the cqlsh tool to restore the ability to use the EXECUTE AS command. (DSP-22417)
- Fixed bug with overriding customer limits.d file if there are new values in the package upgrade. Complementary to DSP-21928. (DSP-22594)
- Changed outdated
nofileparameter value to1048576in/etc/security/limits.d/cassandra.conf. (DSP-21947)
- Fixed parsing range queries on DSE Search indexed columns of CQL types Date and Time. (DSP-22548)
- Added
SolrCoreindex size metric. (DSP-22546) - Added
SolrCorenumDocs,maxDoc, anddeletedDocsmetrics. (DSP-22587) - Added per core DSE Search indexing status as a metric. (DSP-22592)
- Changed Tomcat {{showServerInfo}} configuration parameter to {{false}} for not exposing Tomcat version in error pages. (DSP-22561)
- Upgraded jackson and jackson-databind to 2.13.3. (DSP-22452, CVE-2020-36518)
- Upgraded Spark library version containing change to sanitize passwords when printing spark commands to
stderr. (DSP-22481)
- Fixed an error when using the search index and traversing with an inequality operator such as gt or gte against Date or Time data types. (DSP-21279)
- Improved Management API logic to reduce the likelihood of resource leaks when DSE is starting up. (DSP-22539)
- Fixed
EXECUTE ASfunctionality to work with RLAC. (DSP-22508)
- Upgraded apache-shiro used by spark-jobserver to version 1.8.0. (DSP-22557, CVE-2021-41303)
15 June 2022
- Apache Solr™ 6.0.1.4.2940*
- Apache Spark™ 2.4.0.18
- Apache TinkerPop™ 3.4.5-20220405-a52bbe2c
- Apache Tomcat® 8.5.75
- DSE Java Driver 1.10.0-dse+20210424 (DSE internal-only version)
- Netty 4.1.34.3.dse
- Spark JobServer 0.8.0.50
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Implemented ability to replace the
THREEconsistency level with anALL_BUT_ONEconsistency level. (DSP-22366) - Removed Netty 3.6.2 and 3.7.0. (DSP-22381, CVE-2015-2156)
- Upgraded Jetty All Core to latest version (9.4.46.v20220331). (DSP-22491, CVE-2009-4611, CVE-2020-27216)
- Upgraded Azure SDK client libraries to be based on BOM 1.2.2 to remove CVE-2020-36518 and CVE-2020-5404. (DSP-22528, DSP-21781)
- Fixed the
TIMINGfeature in cqlsh which throws a message "global name 'request_start' is not defined" when enabled. (DSP-22435)
- Added two configurable variables
stream_outbound_permits_in_mbandinput_stream_channel_timeout_in_msto allow streaming of high density of data by using ZCS. (DSP-22362) - Fixed releasing of resources (including heap memory) for metrics removed from the registry (e.g. after table is dropped). (DSP-22516)
- Ported CASSANDRA-16987 and fixed python version check bug in cqlsh. (DSP-22517)
- Upgraded solr version which uses upgraded metadata-extractor 2.18.0 and XmpCore 6.1.11 libraries. (DSP-22406, CVE-2019-14262)
- Fixed dsetool expirekey/revoke commands by using KMIP custom attributes. (DSP-22421)
11 May 2022
- Apache Solr™ 6.0.1.4.2919*
- Apache Spark™ 2.4.0.18
- Apache TinkerPop™ 3.4.5-20220405-a52bbe2c
- Apache Tomcat® 8.5.75
- DSE Java Driver 1.10.0-dse+20210424 (DSE internal-only version)
- Netty 4.1.34.3.dse
- Spark JobServer 0.8.0.50
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Improved reading logic to ensure that sstables are not unnecessarily read for columns that are not selected. See CASSANDRA-16737. (Previously DB-4974). (DSP-22478)
- Fixed the
URISyntaxException: Malformed IPv6 addresswhen usingnodetoolordsetoolwith Java 8u331 or 11.0.15. This is due to the recent changes of JDK-8278972, in which parsing of URL Strings in Built-in JNDI Providers is more strict. (DSP-22474)
- Greater than '>' and less than '<' operators are swapped in the slow query log for a table with DESC clustering keys (port CASSANDRA-15503). (DSP-22369)
- Fixed a rare race condition where attempting to read from a sstable would fail with an assertion error. (DSP-22431)
- Upgraded xmlbeans version to 4.0.0. (DSP-22379, CVE-2021-23926)
- Upgraded Rome Library to
1.17.0that uses JDOM2.0.6.1version. (DSP-22405, CVE-2021-33813)
- Do not skip 5.1.x format sstables when running
nodetool upgradesstableswithout--include-all-sstables. (DSP-22424)
11 April 2022
- Introduced DSE support for Java 11 for core Cassandra workloads. Please note that DSE does not currently provide support for advanced workloads (Search, Spark and Graph) for Java 11.
- Apache Solr™ 6.0.1.4.2887
- Apache Spark™ 2.4.0.18
- Apache TinkerPop™ 3.4.5-20220405-a52bbe2c*
- Apache Tomcat® 8.5.75*
- DSE Java Driver 1.10.0-dse+20210424 (DSE internal-only version)
- Netty 4.1.34.3.dse*
- Spark JobServer 0.8.0.50
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Added a startup check that prevents starting DSE with advanced workloads on Java 11. (DSP-22358)
- Upgraded netty to 4.1.34 from 4.1.25. (DSP-22363)
- Removed
disk_cal.pyandcompaction-metrics.ipynbPython 2 tools. (DSP-22382) - Used azure sdk client libraries from bill of materials 1.2.0 for Azure Blob Storage backup and restore. Used okhttp based azure code http client instead of the netty based one. (DSP-22401)
- Reduced node bootstrapping and rebuild operation time by improving the algorithm that calculates the map of streaming candidates. (DSP-22339)
- Limited heap pressure during mutation repair for tables with materialized views by throttling number of concurrent batches (default 10). Number of batches can be controlled by new system property
cassandra.repair.mutation_repair_max_concurrent_batches. Setting to 0 (zero) disables throttling and reverts behavior before this change. (DSP-22344)
- Replaced log4j with reload4j in TinkerPop and bumped the version of TinkerPop. (DSP-22326)
- Changed heap size to 512M for command line tools on Azul Zing if
MAX_HEAP_SIZEis not specified. (DSP-22313)
- Upgraded Bouncy Castle to the latest 1.70 version. (DSP-22352)
- Ported fix from DSP-22315: Option to disable call to
NativeLibrary.trySkipCache. (DSP-22343)
- Upgraded azure-storage-blob from 12.4.0 to 12.15.0 version. (DSP-22377, CVE-2020-5403)
- Upgraded apache-commons compress library to 1.21 version. (DSP-22383, CVE-2021-35515, CVE-2021-35516, CVE-2021-35517, CVE-2021-36090)
- Upgraded snakeyaml version to 1.30. (DSP-22386, CVE-2017-18640)
- Upgraded ApacheVelocity to 2.3 version. (DSP-22387, CVE-2020-13936)
- Upgraded commons-beanutils version to 1.9.4 version. (DSP-22388, CVE-2019-10086)
- Upgraded Hazelcast to 5.1.1 version. (DSP-22390, CVE-2022-0265)
- Upgraded logback version to 1.2.11. (DSP-22237, CVE-2021-42550)
- Upgraded version of Apache Tomcat from 8.5.72 to 8.5.75. (DSP-22360, CVE-2022-23181)
- Upgraded version of azure-identity from 1.1.0 to 1.4.6. (DSP-22194, CVE-2017-1000190)
7 March 2022
- Apache Solr™ 6.0.1.4.2887
- Apache Spark™ 2.4.0.18
- Apache TinkerPop™ 3.4.5-20210816-c28c0de2
- Apache Tomcat® 8.5.72
- DSE Java Driver 1.10.0-dse+20210424 (DSE internal-only version)
- Netty 4.1.25.7.dse
- Spark JobServer 0.8.0.50
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Changes reading logic of compressed chunk offsets that are loaded from compression info for zero copied partial sstables. It results in smaller off-heap usage. (DSP-22247)
- Adds configurable snapshot size cache speeding up the retrieval of snapshot information. (DSP-22338)
- PKCS#11 needs Signature algorithms to be configured on some versions of Java 11 (see [https://bugs.openjdk.java.net/browse/JDK-8217611|https://bugs.openjdk.java.net/browse/JDK-8217611|smart-link]). In order to work with TLSv1.3, RSA keys in PKCS#11 key stores must have a key size of at least 4096 bits. (DSP-22276)
- RSA Certificates for SSL on Java 11 require larger keypairs than on Java 8. Testing on Java 11 is done with 1024 bit keys instead of 512 bit keys. (DSP-22277)
- Clean up ClientWarn State when message sending expired. (DSP-22290)
- fix deletion of a dropped vertex’s incoming edges when the far side of those edges involves multiple vertex labels. (DSP-22218)
- Fix validation age in the belated incremental NodeSync log warning. (DSP-22300)
- Removed log4j 1.2.x dependency from dse-spark/client/lib and replace it with reload4j 1.2.19. (DSP-22279, CVE-2021-44228, CVE-2019-17571, CVE-2022-23305, CVE-2022-23302, CVE-2021-4104)
- Upgraded version of Bouncy Castle to 1.67. (DSP-22301, CVE-2018-1000613, CVE-2018-1000180, CVE-2020-28052)
17 February 2022
- Apache Solr™ 6.0.1.4.2887
- Apache Spark™ 2.4.0.18
- Apache TinkerPop™ 3.4.5-20210816-c28c0de2
- Apache Tomcat® 8.5.72
- DSE Java Driver 1.10.0-dse+20210424 (DSE internal-only version)
- Netty 4.1.25.7.dse
- Spark JobServer 0.8.0.50
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Ported fix from CASSANDRA-17352: Remote code execution for scripted UDFs (DSP-22321, CVE-2021-44521)
24 January 2022
- Apache Solr™ 6.0.1.4.2887
- Apache Spark™ 2.4.0.18
- Apache TinkerPop™ 3.4.5-20210816-c28c0de2
- Apache Tomcat® 8.5.72
- DSE Java Driver 1.10.0-dse+20210424 (DSE internal-only version)
- Netty 4.1.25.7.dse
- Spark JobServer 0.8.0.50
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fix a possible overflow with elapsed nano-time calculation in messaging queue timeout. (DSP-22011)
- Await timeout for shutting down non periodic tasks is now configurable with the new jvm option
cassandra.non_periodic_tasks_shutdown_timeout_in_minutes. When timeout is reached, force shutdown those tasks. (DSP-22241) - Lower commitlog replay sstable origin warning to info. (DSP-22270)
- Fix the miscalculation of totalCDCSizeOnDisk. (DSP-22135)
- Retain changes to /etc/security/limits.d/cassandra.conf on yum upgrade. (DSP-21928)
- Removed unused log4j dependency to avoid false positives in vulnerability scans. (DSP-22234, CVE-2019-17571, CVE-2021-4104, CVE-2021-44228, CVE-2021-45105)
- Upgraded version of json-smart library used by Azure blob store access from 2.3 to 2.4.7 to fix CVE-2021-27568 and CVE-2021-31684. (DSP-22186, CVE-2021-27568, CVE-2021-31684)
8 December 2021
- Apache Solr™ 6.0.1.4.2887
- Apache Spark™ 2.4.0.18
- Apache TinkerPop™ 3.4.5-20210816-c28c0de2
- Apache Tomcat® 8.5.72*
- DSE Java Driver 1.10.0-dse+20210424 (DSE internal-only version)
- Netty 4.1.25.7.dse
- Spark JobServer 0.8.0.50
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fix calculation of
CompressionMetadataOffHeapMemoryUsedmetric accessible vianodetool tablestatscommand. (DSP-22181)
- Port and adjust CASSANDRA-16686 for DSE. (DB-5022)
- Upgraded version of Apache Tomcat from 8.5.70 to 8.5.72 to fix CVE-2021-42340. (DSP-22098)
- Fixed and updated javax.mail dependency to com.sun.mail. (DSP-22085)
- Upgraded version of Apache Tomcat from 8.5.70 to 8.5.72 to fix CVE-2021-42340. (DSP-22098)
4 November 2021
- Apache Solr™ 6.0.1.4.2887
- Apache Spark™ 2.4.0.18
- Apache TinkerPop™ 3.4.5-20210816-c28c0de2
- Apache Tomcat® 8.5.70
- DSE Java Driver 1.10.0-dse+20210424 (DSE internal-only version)
- Netty 4.1.25.7.dse
- Spark JobServer 0.8.0.50
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Enables periodic logging of system status (default every 5 minutes, configurable). (DSP-22039)
- Fix a possible issue that shell tool could break with
-h/--helpin package install. (DSP-20375)
- Fixed a bug in the authenticator that would use the default management mode instead of the defined mode by authentication when authenticating. (DSP-22067)
- Fixes stack overflow with secondary indexes on collections. (DSP-22070)
- Fixed an issue in preloading prepared statements that queries static columns. (DB-5012)
- Fixes issue that when disabling
system_info_encryptionconfiguration indse.yaml, encryption for tables in thesystem_backupskeyspace would not turn off. (DSP-22078)
- Prints TLS protocol information when running
cqlshwith--debugparameter. (DB-4981)
- Fixes broken partition filtering in hive metastore leading to missing data in the spark-sql queries results for queries involving numeric partition keys or complex conditions. (DSP-21651)
7 October 2021
- Apache Solr™ 6.0.1.4.2887*
- Apache Spark™ 2.4.0.18
- Apache TinkerPop™ 3.4.5-20210816-c28c0de2*
- Apache Tomcat® 8.5.70*
- DSE Java Driver 1.10.0-dse+20210424 (DSE internal-only version)
- Netty 4.1.25.7.dse
- Spark JobServer 0.8.0.50
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- The Change Data Capture (CDC) is now near real time as in Cassandra 4.x. Active commitlog segments can be processed from the CDC raw directory defined in your
cassandra.yamlwithout flushing tables. It also allows you to read the last mutation form the most recent commitlog file. See the Datastax Change Data Capture documentation page for more details. (DSP-21992)
- Added check against the negative value in local stream throughput
stream_throughput_outbound_megabits_per_secand inter dc stream throughputinter_dc_stream_throughput_outbound_megabits_per_sec(DB-5010) - Fixes output of compaction file progress. (DB-5028)
- Resolves a TPC weakness with large rows and collections, where DSE 6 would repeatedly attempt to read the same row and create a lot of on-heap garbage. (DB-3962)
- Ported fix from SOLR-12514 to dse lucene-Solr to fix CVE-2018-11802. (DSP-21685)
- Upgraded version of PDFBox and FontBox to 2.0.24, and version of JempBox to 1.8.16 to fix CVE-2018-8036 and CVE-2018-11797. (DSP-21688)
- Upgraded version of groovy to 2.4.21 (DSE 5.1/6.0/67) and to 2.5.14 (DSE 6.8) to fix CVE-2020-17521. (DSP-21767)
- Upgraded version of Tomcat from 8.5.65 to 8.5.70 to fix CVE-2021-33037. (DSP-21996)
31 August 2021
- Provide DSE support for Centos8, Red Hat Enterprise Linux 8 and Oracle Linux (DSP-19104). Please note that certification was done using Python 2.7 and Python 2.7 needs to be available on the target system. SparkR version included in DSE 6.8.15 is not compatible with the default R version >= 4.0.0.
26 August 2021
- Apache Solr™ 6.0.1.4.2840
- Apache Spark™ 2.4.0.18
- Apache TinkerPop™ 3.4.5-20200107-6cec00d8
- Apache Tomcat® 8.5.65
- DSE Java Driver 1.10.0-dse+20210424 (DSE internal-only version)
- Netty 4.1.25.7.dse
- Spark JobServer 0.8.0.50
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- upgraded Bootstrap version from 3.1.1 to 3.4.1, upgraded Flask from 0.10.1 to 1.1.4. (DSP-21682)
- Upgraded version of directory-ldap-api from DSE 1.0.0.2.dse to OSS 1.0.3 (DSP-21758)
- Spark had an unused dependency on azure-storage-blob jar files version 12.4.0 which was removed from Azure repos. This fix removes the dependency. (DSP-21978)
Execution of the back pressure task can be rejected in TPC, leading to the back pressure job being dropped entirely and then deadlocking. This was fixed by properly rescheduling the task. (DB-5027)
07 July 2021
- Provide DSE support for Ubuntu 20.04 (Focal) (DSP-21330). Please note that certification was done using Python 2.7 and Python 2.7 needs to be available on the target system.
- Apache Solr™ 6.0.1.4.2840
- Apache Spark™ 2.4.0.18
- Apache TinkerPop™ 3.4.5-20200107-6cec00d8
- Apache Tomcat® 8.5.65
- DSE Java Driver 1.10.0-dse+20210424 (DSE internal-only version)
- Netty 4.1.25.7.dse
- Spark JobServer 0.8.0.50
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Added warning message in case of dse start failure due to this issue (DSP-21795)
- Fixed concurrent modification exception in consistent replace (DSP-21836)
- Upgraded version of resteasy to
4.6.0.Final(DSP-21683) - Upgraded jetty version from
9.4.34.v20201102to9.4.41.v20210516(DSP-21684, DSP-21687)
- Fixed a bug where in rare cases search query routing might start to spin endlessly for a particular query (DSP-21838)
- Fixed an issue in the LDAP
group_search_filterdefault value that meant that group hierarchies were not being loaded if thegroup_search_filterwas not explicitly set in the dse.yaml. (DSP-21874)
- Removed a possible false-positive error message in the log that would cause confusion when multiple authentication schemes are defined. (DB-5015)
- Added unit Testcases for logic cqlsh TLS version. (DB-4979)
- When the Bloom filter is recreated due to FP chance change, sstable metadata is loaded and re-written in order to update validation metadata with the new fp chance. However, the loaded metadata lacked compaction metadata, so when rewritten, compaction metadata got truncated. (DB-5005)
- Fixed nodetool not able to
setstreamthroughputandsetinterdcstreamthroughput(DB-4940)
- Updated the python driver version used by cqlsh from
3.24.0to3.25.0(DB-4978)
18 May 2021
- Apache Solr™ 6.0.1.4.2840
- Apache Spark™ 2.4.0.18
- Apache TinkerPop™ 3.4.5-20200107-6cec00d8
- Apache Tomcat® 8.5.65
- DSE Java Driver 1.10.0-dse+20210424 (DSE internal-only version)
- Netty 4.1.25.7.dse
- Spark JobServer 0.8.0.50
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- AOSS returns additional parameter in
statusendpoint: "connection_hostname". The new parameter is a FQDN of the node hosting AOSS, it may be used for connections (instead of connection_address) if needed. (DSP-21811)
- Fixed an issue with DSE daemon being unable to stop after the default timeout expired. This issue only affected systems that use package install and init.d, such as centos. (DSP-21804)
- Fixed a problem where the Gremlin
phrase()predicate may not match Solr results for equivalent search. (DSP-21724)
- A new JVM option is added:
dse.search.fc.warmup:AUTO,ALWAYS&NEVER. (DSP-21813)
26 April 2021
- Apache Solr™ 6.0.1.4.2840*
- Apache Spark™ 2.4.0.18
- Apache TinkerPop™ 3.4.5-20200107-6cec00d8
- Apache Tomcat® 8.5.65*
- DSE Java Driver 1.10.0-dse+20200217 (DSE internal-only version)
- Netty 4.1.25.7.dse
- Spark JobServer 0.8.0.50
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixed an error in cqlsh encoding unicode in multi-line statements (DB-4855)
- Make cqlsh prefer newer TLS versions. (DB-4966)
- Address a problem where new or rebooted nodes may not be able to gossip with peers. (DSP-21753)
- Upgrade apache commons-compress to address CVE-2019-12402 (DSP-21679)
- Update tomcat version 8.5.61 to 8.5.65 (DSP-21798)
- Fixed a bug where under heavy load solr query worker threads would use 100% CPU due to contention on thread local map (DSP-21746)
9 April 2021
- Apache Solr™ 6.0.1.4.2814
- Apache Spark™ 2.4.0.18
- Apache TinkerPop™ 3.4.5-20200107-6cec00d8
- Apache Tomcat® 8.5.61*
- DSE Java Driver 1.10.0-dse+20200217 (DSE internal-only version)
- Netty 4.1.25.7.dse
- Spark JobServer 0.8.0.50*
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixes an issue where a login attempt with missing credentials logged a misleading warning message with stack trace instead of an error message about the missing username or password. (DB-4806)
- Fixes a bug when in rare cases a terminated repair session would leak on-heap memory (DB-4833)
- Print a timestamp when nodetool exits due to an error (DB-4826)
- Data export from cqlsh is now less noisy in the logs (DSP-21494)
- Fixes intermittent ERROR: java.util.ConcurrentModificationException at org.apache.cassandra.transport.CBUtil.writeStringList (DSP-21336)
- Fix for DESCRIBE TYPES in cqlsh (DSP-21667)
- Add asynchronous update to KMIP key cache to fix blocking of commit log (DSP-20582)
- Fixes CVE-2020-1945 affecting Apache Ant (DSP-21716)
- Fixes SRCCLR-SID-22742: Insecure Input Validation Vulnerability in the Apache Commons Codec library (DSP-21747)
- Update Tomcat version 8.0.53 to 8.5.61 (fixes CVE-2002-0493 CVE-2009-3548 CVE-2013-2185 CVE-2016-1240 CVE-2016-5018 CVE-2016-5388 CVE-2016-6796 CVE-2016-6797 CVE-2016-8745 CVE-2016-9774 CVE-2016-9775 CVE-2020-8022) (DSP-21394)
- Fixes a severe issue where flushing an empty MemtableIndex causes the index to not be queryable (DB-4934)
- Fixes a bug where FilterCache warmup triggered by node health change can block GossipStage-1 thread for several seconds (DSP-21674)
- Fixes CVE-2014-0114, CVE-2014-0114 (DSP-21668)
11 March 2021
- Apache Solr™ 6.0.1.4.2814
- Apache Spark™ 2.4.0.18*
- Apache TinkerPop™ 3.4.5-20200107-6cec00d8
- Apache Tomcat® 8.0.53
- DSE Java Driver 1.10.0-dse+20200217 (DSE internal-only version)
- Netty 4.1.25.7.dse
- Spark JobServer 0.8.0.49
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Works around a bug in JDK 1.8u282 (JDK-8260018) (DB-4884)
- Fixes a Null Pointer Excpetion in Gossip when upgrading from 5.1 to 6.8.6 (DB-4810)
- During package upgrade yum and apt managers overwrite unedited old jvm.options file. (DB-4705)
- Fixes a problem where FSReadError during streaming could causes DSE to shutdown (DB-4878)
- Port fix of CVE-2020-17516 onto DSE 6.8 (DB-4923)
- Dropped messages metrics calculation doesn't cause assertion errors when dropped messages contain remote batch mutation. (DB-3905)
- SSTablePartitions tool will no longer fail with "histogram overflowed" when its working for the server code (DB-2952)
- Fixes a problem where sstablescrub could not fix a corrupted file (DSP-21672)
- Addressed several Jackson databind vulnerabilities by upgrading jackson-databind to version 2.9.10.8 in DSE 5.1.21, 6.0.15 and 6.7.13 and version 2.10.5.1 in DSP 6.8.10. (DSP-21503) (DSP-21503)
- Fixes a problem where nodetool rebuild could fail intermittently with zerocopy streaming enabled (DSP-21564)
- Update Jetty to 9.4.34.v20201102 and update Spark Versions: DSE 5.1: 2.0.2.38; DSE 6.0: 2.2.3.16; DSE 6.7: 2.2.3.16; DSE 6.8: 2.4.0.17 (DSP-21506)
- SCC by default enables direct join optimization only when size_estimates for both tables are available. (DSP-21628)
- Fix: Spark Master fails to start if keystore (used by web UI) contains more than one certificate (DSP-21703)
- Both graph engines now accept either
byte[]orByteBufferfor blob-typed property values. (DSP-21643)
- Index segments are now merged into a single segment, after the index build. (DSP-19608)
- Fixes a problem where lucene threads were getting interrupted, causing problems with solr cores (DSP-21339)
- Search queries will no longer fail when querying clustering columns of certain types on which the order is reversed (DSP-21363)
- Spark Cassandra Connector supports Storage Attached Indexes (SAI). The connector pushes down predicates defined on columns with SAI indexes. (DSP-21655)
- DSE Spark supports connections to Astra clusters (DSP-21510)
7 January 2021
- Apache Solr™ 6.0.1.4.2814
- Apache Spark™ 2.4.0.16
- Apache TinkerPop™ 3.4.5-20200107-6cec00d8
- Apache Tomcat® 8.0.53
- DSE Java Driver 1.10.0-dse+20200217 (DSE internal-only version)
- Netty 4.1.25.7.dse
- Spark JobServer 0.8.0.49
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Addresses a severe issue where streaming an older file format to a new node could crash sending and receiving nodes. (DB-4846)
- Add support for multiple authorization sources (LDAP + DSE Internal) (DSP-14233)
- Fixed direct join optimization for spark sql. (DSP-21498)
15 December 2020
6.8.7 and DSE 6.8.8, these releases have been retracted. We recommend against upgrading to these versions at this time. If you have already upgraded to these versions, please EITHER set zerocopy_streaming_enabled=false in the cassandra.yaml and perform a rolling restart AND/OR run upgradesstables on all nodes in your cluster before adding new nodes, running repair, or restoring from backups. This bug has been addressed in DSE 6.8.9. All features and fixes for 6.8.8 and 6.8.7 are present in 6.8.9.
- Apache Solr™ 6.0.1.4.2814*
- Apache Spark™ 2.4.0.16
- Apache TinkerPop™ 3.4.5-20200107-6cec00d8
- Apache Tomcat® 8.0.53
- DSE Java Driver 1.10.0-dse+20200217 (DSE internal-only version)
- Netty 4.1.25.7.dse
- Spark JobServer 0.8.0.49
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- During Backup Service startup, to avoid stalling during service initialization, check cluster readiness in response to endpoint "on alive" events. (DB-4818)
- Fixed an issue in DSE that prevented the Management API to work with DSE versions 6.8.5 - 6.8.7 (DSP-21607)
- The issue: When flushing text column indexes, the internal ordering of terms can be processed out of order causing an "*java.lang.AssertionError: Incremental trie requires sorted keys*" error. When this happens, all flushing of indexes involved in this transaction is aborted and the indexes are marked non-queryable. Recovering from this issue involves either rebuilding the indexes or restarting the nodes. (DSP-21580)
- Fixes a performance regression in SAI for versions 6.8.6 and 6.8.7 regarding *MultiRangeReadCommand*. (DSP-21601)
- A system property
dse.solr.fuzzy.max.expansionwas added which allows the user to define a custom number of fuzzy query expansions. The maximal possible value is 1024. When unset, the default number of max expansions is 50. (DSP-21605)
- Adjust available framework values for
--frameworkparameter. (DSP-21500)
23 November 2020
6.8.7 and DSE 6.8.8, these releases have been retracted. We recommend against upgrading to these versions at this time. If you have already upgraded to these versions, please EITHER set zerocopy_streaming_enabled=false in the cassandra.yaml and perform a rolling restart AND/OR run upgradesstables on all nodes in your cluster before adding new nodes, running repair, or restoring from backups. This bug has been addressed in DSE 6.8.9. All features and fixes for 6.8.8 and 6.8.7 are present in 6.8.9.
- Apache Solr™ 6.0.1.4.2794
- Apache Spark™ 2.4.0.16
- Apache TinkerPop™ 3.4.5-20200107-6cec00d8
- Apache Tomcat® 8.0.53
- DSE Java Driver 1.10.0-dse+20200217 (DSE internal-only version)
- Netty 4.1.25.7.dse
- Spark JobServer 0.8.0.49
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixed a bug where the slow query log would fill with queries that do not meet the slow query threshold (DSP-21417)
- Fixed a bug where a single partition read might fail if the following conditions were true:
- several sstables had the same partition level deletion info
- some of the sstables had wide rows whereas others had not
- the sstables in question contained range tombstone markers (DSP-21346)
- Fixed a bug in
cassandra.repair.mutation_repair_rows_per_batchsetting that caused sending all repair mutations at once (DSP-21429) - There is a change in SSTable format and/or version. Please refer to the compatibility documentation for more details.
- On the CQLSH
CREATE CUSTOM INDEX ... WITH OPTIONSstatement, SAI adds support for an ascii option. If set totrue, converts alphabetic, numeric, and symbolic characters that are not in the Basic Latin Unicode block (first 127 ASCII characters) to their ASCII equivalent, if one exists. For example, the filter changes à to a. The default isfalse. (DSP-21409) - Make the SAI read path synchronous. (DSP-21451)
- Fixed "java.lang.ArithmeticException: integer overflow" printing in
system.logwhen retrieving the SAI indexsegmentRowID(DSP-21522
- A meaningful error message is logged when two properties with the same name but different types are used in a single core graph. Classic graph was not affected. (DSP-21490)
- Optimized retrieval when
memberof_searchused the wrong attribute to retrieve groups of the user. (DSP-21537)
- Multi-datacenter backup and restore, new
CompositeStoretype of backup store. (DB-4489) - Adds the possibility to restore a backup marked as
INCOMPLETEby using the newFORCE RESTOREstatement.
- Addressed a bug where a "CommitLogReplayException" is caused by a bad header but correct CRC after restart (DB-3996)
- Fixed a bug where some part of the commit log might not be replayed after injecting a foreign sstable to a node or, on 6.8, after zero-copy streaming of an sstable (DB-4629)
- Fixed an issue where zero copy streaming could cause file descriptor leakage (DB-4594)
- SStableloader now uses
native_transport_port_sslovernative_transport_portwhen passed a config file with the property set (DB-4632)
- Fixed memory leak in Netty resulting in OOM. (DB-4664)
- Fixed a problem in the scheduling and counting of active materialized view updates that could cause too many to be executed concurrently, overwhelming the node. (DB-4782)
12 November 2020
- Apache Solr™ 6.0.1.4.2794
- Apache Spark™ 2.4.0.16
- Apache TinkerPop™ 3.4.5-20200107-6cec00d8
- Apache Tomcat® 8.0.53
- DSE Java Driver 1.10.0-dse+20200217 (DSE internal-only version)
- Netty 4.1.25.7.dse
- Spark JobServer 0.8.0.49
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- A node may be stuck in repair while joining the cluster if broadcast_address is set differently than local_address (DB-4786)
20 October 2020
- Apache Solr™ 6.0.1.4.2794
- Apache Spark™ 2.4.0.16
- Apache TinkerPop™ 3.4.5-20200107-6cec00d8
- Apache Tomcat® 8.0.53
- DSE Java Driver 1.10.0-dse+20200217 (DSE internal-only version)
- Netty 4.1.25.7.dse
- Spark JobServer 0.8.0.49
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Server side backup and restore now supports Microsoft Azure cloud storage as a backup target. (DB-3894)
- snapshot
schema.cqlfiles will now containIF NOT EXISTSclause forCREATE TYPEstatements (DB-4685)
- Fixes a problem where races in notifying compaction strategies of added and removed sstables can cause compaction to try to use non-existing sstables and repeatedly fail to make progress. (DB-4711)
- Fixed node restart issue after dropping a PointType column. (DSP-21326)
- Fixed extreme local pauses on all nodes in the cluster on a node restart. (DB-4657)
- Improves performance of estimation of partition counts for subranges. (DB-3679)
- Fsync nodes metadata to prevent FSReadError issues on startup. (DB-4672)
- Fixes LDAP user permissions problem following LDAP server restart. (DSP-21284)
- Fixes LDAP user permissions problem following LDAP server restart. (DSP-21284)
- Escape single-quotes in certain graph-search query predicates. (DSP-21450)
- Fix: Spark Application contacting Nodes in Non Local DC (DSP-19961)
DataStax Enterprise (DSE) 6.8.4 includes all changes from previous DSE versions. See TinkerPop upgrade documentation for all changes.
17 September 2020
- Apache Solr™ 6.0.1.4.2794
- Apache Spark™ 2.4.0.16
- Apache TinkerPop™ 3.4.5-20200107-6cec00d8
- Apache Tomcat® 8.0.53
- DSE Java Driver 1.10.0-dse+20200217 (DSE internal-only version)
- Netty 4.1.25.7.dse
- Spark JobServer 0.8.0.49
NOTE: above-listed DSE Java Driver is an internal-version only. If you're developing applications, please refer to the Java Driver documentation to choose an appropriate version.
- Fixes compaction getting stuck on acquiring references for non-existing sstables. (DB-4290)
- Distributes Netty connections more uniformly across TPC cores (DB-4683)
- Distributes Netty connections more uniformly across TPC cores (DB-4683)
- Adds TTL and TimeWindowCompactionStrategy (TWCS) to
system_distributed.repair_historyandsystem_distributed.parent_repair_historytables. (DB-2009) - DNS Service Discovery is now a part of the DSE/LDAP integration. (DSP-11450)
- New system property to cap the maximum amount of memory used by bloom filters:
-Dcassandra.max_bf_memory_mb}. By default, this is unlimited. (DSP-21344)
- DNS Service Discovery is now a part of the DSE/LDAP integration. (DSP-11450)
- DSEFS waits for a schema agreement before starting and issuing the first CQL query. (DSP-20743)
- Storage-Attached Indexing (SAI) adds support for creating multiple SAI indexes on the same collection map column. See SAI collection map examples with keys, values, and entries. (DSP-21306)
DataStax Enterprise (DSE) 6.8.4 includes all changes from previous DSE versions. See TinkerPop upgrade documentation for all changes.
Release notes for previous DSE patch releases can be found here: https://docs.datastax.com/en/dse/6.8/dse-admin/datastax_enterprise/releaseNotes/RNdse.html#RNdse