v2.5.0-alpha.1

First alpha of the 2.5.0 minor release. For preview and testing; production users stay on 2.4.x. Contains breaking default-configuration changes — read below before upgrading.

Full Changelog: v2.4.0...v2.5.0-alpha.1

⚠️ Breaking Changes

• Secure-by-default configuration (#4089): all default listeners now bind to 127.0.0.1 instead of 0.0.0.0 — REST management API (restIp), CLI service (basic.ip), and HTTP-push ingestion (httpServerIp). Remote access requires explicitly setting the bind address (and enabling authentication for remote REST). allowExternalFileAccess now defaults to false, restricting file access to the uploads directory; set it to true only for trusted external paths.
• REST sink header rules (inherited from 2.4.1, #4094): OAuth-only vs. row-template headers are strictly separated; arbitrary token-response fields and mixed templates in one header are no longer accepted.
• SQL sink dynamic field validation (inherited from 2.4.1, #4080): with fields unset, row keys outside [A-Za-z_][A-Za-z0-9_]* now fail with an error.
• Connection provisioning is now content-hash based (#4060): connections deleted via REST API are no longer recreated on restart unless connection.yaml (including env overrides) actually changed.

New Features

• Streaming LEAD analytic function with WHEN ... UNTIL ... lookahead and current_row(expr) for origin-row access by @ngjaying in #4122
• Cumulative analytic functions: acc_collect by @Yisaer in #4103, acc_max_by and acc_map_agg by @Yisaer in #4112, acc_min_by by @Yisaer in #4117
• array_avg array function by @Yisaer in #4108
• IoTDB predefined sink plugin by @CritasWang in #4110
• DEFAULT clause support by @Elia-Renzoni in #4025
• Query scan table content, with docs by @Elia-Renzoni in #4048 and #4051
• Connection hash-based provisioning by @ngjaying in #4060
• Disable option for sink actions by @Yisaer in #4100
• Schema file upload with upsert by @ngjaying in #4062

Security Hardening

• Harden default configuration security by @ngjaying in #4089
• Harden httpx dialer IP validation (fail closed, IPv6 zones) by @ngjaying in #4102
• Validate rule ID at the DeleteRule boundary to block path traversal via YAML import by @ngjaying in #4088
• Reject unsafe dynamic field names in SQL by @ngjaying in #4080
• Separate OAuth-only vs. row-template REST headers; fix dropped auth and token-refresh race by @ngjaying in #4094
• Fix swallowed certificate decryption error by @ngjaying in #4091
• Remove sample secrets by @ngjaying in #4086

Bug Fixes

• SQL: retry named connections after failure; quote table name in initPreparedStmt by @Yisaer in #4128 and @piepor in #4054
• XSQL: reset escape state after escaped quote; range-check string-to-int casts by @zjncs in #4125 and #4123
• Window: run WHERE after state window so transition rows are not dropped by @ngjaying in #4098
• Sink: support batchSize with dataTemplate (fix unknown data type: RawTuple) by @ngjaying in #4093
• Rule: prevent concurrent double start; fix createRule callback data race by @ngjaying in #4076 and #4069
• Topo: clear stale project caches by @ngjaying in #4074
• Planner: validate memory stream slice by @ngjaying in #4084
• SQLgen: fix ORDER BY index columns by @ngjaying in #4081
• Conf: fix log formatter data race by @ngjaying in #4072
• Protobuf: resolve absolute schema paths by @ngjaying in #4070
• Neuron: stop receive loop on closed socket by @ngjaying in #4066
• KV: prepare keyed state statement once by @Dream95 in #4058
• Logger: emit bootstrap errors to stderr by @ngjaying in #4120
• Docs: escape OAuth template placeholders by @ngjaying in #4096

Performance

• Optimize expression evaluation by @ngjaying in #4075
• Optimize topo runtime hot paths by @ngjaying in #4073

Dependencies and Chores

• Bump google.golang.org/grpc, golang.org/x/crypto, golang.org/x/net, opencontainers/runc, github.com/apache/thrift in #4056, #4057, #4059, #4087, #4116, #4121, #4127
• Internal refactors and CI/docs: strconv.FormatFloat in #4049, lint fixes in #4114, SECURITY.md in #4113, Bullseye APT snapshot pin in #4126, gocovmerge pin in #4129, README acknowledgment in #4083

New Contributors

• @CritasWang made their first contribution in #4110
• @zjncs made their first contribution in #4123