Skip to content

duckdb

v1.4.5 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Relational Databases
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

analytics database embedded-database olap sql

Summary

AI summary

Fix unbounded row group growth for indexed tables on repeated load+insert cycles.

Full changelog

This is a bug fix release for various issues discovered after we released v1.4.4.

Please also refer to the announcement blog post: https://duckdb.org/2026/06/17/announcing-duckdb-145.html

What's Changed

  • Internal #7212: FILL Empty Chunk by @hawkfish in https://github.com/duckdb/duckdb/pull/20657
  • Secret Manager: Ensure secrets are created exactly once by @Mytherin in https://github.com/duckdb/duckdb/pull/20686
  • Use FileSystem APIs in QueryProfiler::Write by @Mytherin in https://github.com/duckdb/duckdb/pull/20727
  • Fix escape handling in AddEscapes function by @llukito in https://github.com/duckdb/duckdb/pull/20760
  • Fixup test/extension/update_extensions_ci.test [v1.4-andium] by @carlopi in https://github.com/duckdb/duckdb/pull/20777
  • Backport various race condition fixes to v1.4 by @Mytherin in https://github.com/duckdb/duckdb/pull/20804
  • bump ref to azure for v1.4.4 (rebuild) by @benfleis in https://github.com/duckdb/duckdb/pull/20888
  • Internal #7584: AsOf Simple Joins by @hawkfish in https://github.com/duckdb/duckdb/pull/21090
  • Do not write ccache to github cache for v1.4-andium by @smvv in https://github.com/duckdb/duckdb/pull/21109
  • Disable extension caching for v1.4 to free github cache space by @smvv in https://github.com/duckdb/duckdb/pull/21150
  • Disable save_cache for v1.4-andium by @smvv in https://github.com/duckdb/duckdb/pull/21167
  • Backport #19232: allow * Not similar to 'pattern' by @Dtenwolde in https://github.com/duckdb/duckdb/pull/21177
  • backport zstd PR to 1.4 by @artjomPlaunov in https://github.com/duckdb/duckdb/pull/21178
  • Fix unbounded row group growth for indexed tables on repeated load+insert cycles by @abramk in https://github.com/duckdb/duckdb/pull/21316
  • Backport #21271 by @artjomPlaunov in https://github.com/duckdb/duckdb/pull/21326
  • [lance] Add for v1.4-andium by @carlopi in https://github.com/duckdb/duckdb/pull/21410
  • add lance for v1.4 by @samansmink in https://github.com/duckdb/duckdb/pull/21113
  • Correctly detect overflows when decoding integers from storage by @Mytherin in https://github.com/duckdb/duckdb/pull/21482
  • Bump Julia to v1.4.4 on v1.4-andium by @taniabogatsch in https://github.com/duckdb/duckdb/pull/21589
  • Fix for CSV reader buffer-boundary value read by @Mytherin in https://github.com/duckdb/duckdb/pull/21577
  • Backport __EMSCRIPTEN__ fix by @Mytherin in https://github.com/duckdb/duckdb/pull/21581
  • counting fix by @artjomPlaunov in https://github.com/duckdb/duckdb/pull/21733
  • backport 22094 by @artjomPlaunov in https://github.com/duckdb/duckdb/pull/22136
  • backport 21815 & 21427 by @artjomPlaunov in https://github.com/duckdb/duckdb/pull/22137
  • remove CleanupState destructor and remove noexcept on DuckCleanupInfo… by @artjomPlaunov in https://github.com/duckdb/duckdb/pull/22186
  • Backport revert append fix to v1.4 by @Mytherin in https://github.com/duckdb/duckdb/pull/22414
  • Backport windows-32bit test fix to 1.4 by @staticlibs in https://github.com/duckdb/duckdb/pull/22639
  • Bump httpfs to fix CI by @sebastiaan-dev in https://github.com/duckdb/duckdb/pull/22817
  • bump avro hash for 1.4.5 by @djouallah in https://github.com/duckdb/duckdb/pull/22952
  • Rename emscripten action in v1.4 by @smvv in https://github.com/duckdb/duckdb/pull/23045
  • Add v1.4.5 to storage version map by @carlopi in https://github.com/duckdb/duckdb/pull/23081
  • Backport PR #22348 to andium by @carlopi in https://github.com/duckdb/duckdb/pull/23084
  • Backport variegata bugfixes into andium by @carlopi in https://github.com/duckdb/duckdb/pull/23085
  • Bump vortex in andium by @carlopi in https://github.com/duckdb/duckdb/pull/23091
  • Bump extensions to v1.4-andium by @carlopi in https://github.com/duckdb/duckdb/pull/23090
  • backport GetLocalFileSystem improvements to andium by @ccfelius in https://github.com/duckdb/duckdb/pull/23130
  • backport the out-of-bounds security fixes made in #23100 by @Tishj in https://github.com/duckdb/duckdb/pull/23197
  • Remove checked_array_iterator from fmt dep (1.4) by @carlopi in https://github.com/duckdb/duckdb/pull/23261
  • Remove checked_array_iterator from fmt dep (1.4) by @staticlibs in https://github.com/duckdb/duckdb/pull/23239

Full Changelog: https://github.com/duckdb/duckdb/compare/v1.4.4...v1.4.5

Security Fixes

  • Backport out-of-bounds security fixes from #23100

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track duckdb

Get notified when new releases ship.

Sign up free

About duckdb

DuckDB is an analytical in-process SQL database management system

All releases →

Related context

Beta — feedback welcome: [email protected]