This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+14 more
Affected surfaces
ReleasePort's take
Moderate signalStarRocks 4.0.11 upgrades libthrift to 0.23.0 fixing a security vulnerability and introduces several behavior changes across APIs, configuration, and runtime.
Why it matters: Addresses a CVE in libthrift (severity 90) and alters API error handling, transaction‑scope SHOW statements, Java UDF/UDAF type support, default column checker, and resolves a memory leak; operators must review impacted code paths before upgrade.
Summary
AI summaryBroad release touches Behavior Changes, https://github.com/StarRocks/starrocks/pull/73199, https://github.com/StarRocks/starrocks/pull/72798, and https://github.com/StarRocks/starrocks/pull/73064.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Upgraded libthrift to 0.23.0 to address a security vulnerability (CVE). Upgraded libthrift to 0.23.0 to address a security vulnerability (CVE). Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Breaking | High |
`get_json_string` and other `get_json_*` functions now return JSON parse error instead of NULL when implicit VARCHAR-to-JSON parsing fails under ALLOW_THROW_EXCEPTION. `get_json_string` and other `get_json_*` functions now return JSON parse error instead of NULL when implicit VARCHAR-to-JSON parsing fails under ALLOW_THROW_EXCEPTION. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Breaking | High |
`pipeline_enable_large_column_checker` is now enabled by default. `pipeline_enable_large_column_checker` is now enabled by default. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Feature | Medium |
SHOW statements (e.g., SHOW GRANTS, SHOW WAREHOUSES) are now allowed inside explicit transactions. SHOW statements (e.g., SHOW GRANTS, SHOW WAREHOUSES) are now allowed inside explicit transactions. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Feature | Medium |
Java UDAF and UDTF now support STRUCT arguments and return types. Java UDAF and UDTF now support STRUCT arguments and return types. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Feature | Medium |
Scalar Java UDF now supports STRUCT arguments. Scalar Java UDF now supports STRUCT arguments. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Feature | Medium |
Java UDF now supports DATE and DATETIME types. Java UDF now supports DATE and DATETIME types. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Feature | Medium |
Java UDF now supports nested ARRAY/MAP types. Java UDF now supports nested ARRAY/MAP types. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Feature | Medium |
Added FE configuration `deploy_serialization_min_thread_pool_size`. Added FE configuration `deploy_serialization_min_thread_pool_size`. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Performance | Low |
Lake write-path load spill files use a flat, single-level directory layout with transaction ID in filenames and are reclaimed by txn-id-based vacuum. Lake write-path load spill files use a flat, single-level directory layout with transaction ID in filenames and are reclaimed by txn-id-based vacuum. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
| Performance | Low |
Avoided a redundant 'latestSnapshot()' call in 'PaimonMetadata#getTableVersionRange'. Avoided a redundant 'latestSnapshot()' call in 'PaimonMetadata#getTableVersionRange'. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
| Bugfix | Medium |
Fixed memory leak introduced by the UDAF cache. Fixed memory leak introduced by the UDAF cache. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Bugfix | Medium |
Fixed FE file‑descriptor leak by reusing HttpClient instances. Fixed FE file‑descriptor leak by reusing HttpClient instances. Source: granite4.1:30b@2026-06-09-audit Confidence: high |
— |
| Bugfix | Low |
Fixed incorrect implementation in aggregate combined functions. Fixed incorrect implementation in aggregate combined functions. Source: granite4.1:30b@2026-06-09-audit Confidence: high |
— |
| Bugfix | Low |
Resolved issue where per-partition coordinator claim was not re-recorded on every sender's open, preventing txn log loss. Resolved issue where per-partition coordinator claim was not re-recorded on every sender's open, preventing txn log loss. Source: granite4.1:30b@2026-06-09-audit Confidence: high |
— |
| Bugfix | Low |
Fixed read failure on Iceberg tables using a custom LocationProvider by lazily initializing it in SerializableTable. Fixed read failure on Iceberg tables using a custom LocationProvider by lazily initializing it in SerializableTable. Source: granite4.1:30b@2026-06-09-audit Confidence: high |
— |
| Bugfix | Low |
Replaced incompatible 'de.javakaffee' UnmodifiableCollectionsSerializer with Java 17‑compatible version, fixing serialization failures. Replaced incompatible 'de.javakaffee' UnmodifiableCollectionsSerializer with Java 17‑compatible version, fixing serialization failures. Source: granite4.1:30b@2026-06-09-audit Confidence: high |
— |
| Bugfix | Low |
HdfsFsManager copy error messages now include the underlying cause. HdfsFsManager copy error messages now include the underlying cause. Source: granite4.1:30b@2026-06-09-audit Confidence: high |
— |
| Bugfix | Low |
Fixed concurrent SegmentFlushTask race in DeltaWriter::commit(). Fixed concurrent SegmentFlushTask race in DeltaWriter::commit(). Source: granite4.1:30b@2026-06-09-audit Confidence: high |
— |
| Bugfix | Low |
Propagates sort‑merge provider errors to fragment context instead of losing them. Propagates sort‑merge provider errors to fragment context instead of losing them. Source: granite4.1:30b@2026-06-09-audit Confidence: high |
— |
| Bugfix | Low |
Ensures Ranger row‑filter/masking policies on Hive views are applied, fixing skipped policy enforcement. Ensures Ranger row‑filter/masking policies on Hive views are applied, fixing skipped policy enforcement. Source: granite4.1:30b@2026-06-09-audit Confidence: high |
— |
| Bugfix | Low |
Parquet broker load errors now include file/column/row context. Parquet broker load errors now include file/column/row context. Source: granite4.1:30b@2026-06-09-audit Confidence: high |
— |
| Bugfix | Low |
Resolved slot lookup failure for output slots with empty col_name in Spark connector external scan. Resolved slot lookup failure for output slots with empty col_name in Spark connector external scan. Source: granite4.1:30b@2026-06-09-audit Confidence: high |
— |
| Bugfix | Low |
Fixed SinkBuffer crash during graceful exit. Fixed SinkBuffer crash during graceful exit. Source: granite4.1:30b@2026-06-09-audit Confidence: high |
— |
| Bugfix | Low |
Addressed query cache conflicts with local shuffle aggregation. Addressed query cache conflicts with local shuffle aggregation. Source: granite4.1:30b@2026-06-09-audit Confidence: high |
— |
| Bugfix | Low |
Fixed use‑after‑free of Hive partition descriptor across fragment teardown. Fixed use‑after‑free of Hive partition descriptor across fragment teardown. Source: granite4.1:30b@2026-06-09-audit Confidence: high |
— |
| Bugfix | Low |
Resolved thread‑safety issue in lake vacuum by using localtime_r. Resolved thread‑safety issue in lake vacuum by using localtime_r. Source: granite4.1:30b@2026-06-09-audit Confidence: high |
— |
| Bugfix | Low |
Fixed race condition between PipelineTimerTask doRun and unscheduling during query context destruction. Fixed race condition between PipelineTimerTask doRun and unscheduling during query context destruction. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
| Bugfix | Low |
Reduced lock contention on read‑only query‑engine paths by relaxing DB locks. Reduced lock contention on read‑only query‑engine paths by relaxing DB locks. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
| Bugfix | Low |
Fixed materialized view refresh failure with SQL Server tables in a JDBC catalog. Fixed materialized view refresh failure with SQL Server tables in a JDBC catalog. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
| Bugfix | Low |
Resolved JNI local‑reference leak in JDBCScanner::_init_jdbc_scanner. Resolved JNI local‑reference leak in JDBCScanner::_init_jdbc_scanner. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
| Bugfix | Low |
Prevented partition TopN from losing a child's output column. Prevented partition TopN from losing a child's output column. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
| Refactor | Low |
Skipped redundant partition key expression building when an 'add_partition_value' deduplication hit occurs. Skipped redundant partition key expression building when an 'add_partition_value' deduplication hit occurs. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
| Refactor | Low |
Deduplicated commutative AND/OR expressions in scalar operator common subexpression elimination. Deduplicated commutative AND/OR expressions in scalar operator common subexpression elimination. Source: granite4.1:30b@2026-06-09-audit Confidence: low |
— |
Full changelog
Release Date: June 5, 2026
Behavior Changes
get_json_stringand the otherget_json_*functions now return the JSON parse error instead of NULL when implicit VARCHAR-to-JSON parsing fails underALLOW_THROW_EXCEPTION. The default behavior (returning NULL when the mode is disabled) is unchanged. #73199pipeline_enable_large_column_checkeris now enabled by default. #72798
Improvements
- Lake write-path load spill files now use a flat, single-level directory layout with the transaction ID baked into each filename, and are reclaimed by a txn-id-based vacuum pass. This moves bulk deletes off the write hot path and lets vacuum clean up spill files leaked by BE crashes. #73064
- SHOW statements (such as
SHOW GRANTSandSHOW WAREHOUSES) are now allowed inside an explicit transaction, so BI/JDBC clients that automatically issue SHOW no longer break the transaction flow. #72954 - Java UDAF and UDTF now support STRUCT arguments and return types. #72911
- Scalar Java UDF now supports STRUCT arguments. #72620
- Java UDF now supports DATE and DATETIME types. #72337
- Java UDF now supports nested ARRAY/MAP types. #72283
- Added the FE configuration
deploy_serialization_min_thread_pool_size. #72274 - Skipped redundant partition key expression building when an
add_partition_valuededuplication hit occurs. #73156 - Avoided a redundant
latestSnapshot()call inPaimonMetadata#getTableVersionRange. #72892 - Deduplicated commutative AND/OR expressions in scalar operator common subexpression elimination. #72823
Bug Fixes
The following issues have been fixed:
- A memory leak introduced by the UDAF cache. #74025
- An incorrect implementation in aggregate combined functions. #74169
- An issue in shared-data combined txn log mode where the per-partition coordinator claim was not re-recorded on every sender's open, which could drop txn logs. #73962
- A read failure on Iceberg tables that use a custom
LocationProvider, fixed by lazily initializing theLocationProviderinSerializableTable. #73482 - A serialization failure caused by the
de.javakaffeeUnmodifiableCollectionsSerializer, now replaced with a Java 17-compatible version. #73458 HdfsFsManagercopy error messages now include the underlying cause. #73414- A concurrent
SegmentFlushTaskrace inDeltaWriter::commit(). #73371 - Sort merge provider errors are now propagated to the fragment context instead of being lost. #73337
- An issue where Ranger row-filter/masking policies on Hive views were skipped, so policies on the view or its base tables were not applied. #73265
- Upgraded libthrift to 0.23.0 to address a security vulnerability (CVE). #73243
- An FE file-descriptor leak, fixed by reusing
HttpClientinstances. #73239 - Parquet broker load errors now include file/column/row context. #73236
- A slot lookup failure for output slots with an empty
col_namein the Spark connector external scan. #73225 - A crash in
SinkBufferduring graceful exit. #73202 - Query cache conflicts with local shuffle aggregation. #73194
- A use-after-free of the Hive partition descriptor across fragment teardown. #73176
- A thread-safety issue in lake vacuum, fixed by using
localtime_r. #73088 - A race condition between
PipelineTimerTaskdoRunand unscheduling during query context destruction. #73082 - Lock contention on read-only query-engine paths, reduced by relaxing DB locks. #73067
- An materialized view refresh failure with SQL Server tables in a JDBC catalog. #72962
- A JNI local-reference leak in
JDBCScanner::_init_jdbc_scanner. #72913 - An issue where partition TopN could lose a child's output column. #72848
- An incorrect plan caused by not clearing
LambdaArgument.transformedOpbefore INSERT OVERWRITE re-planning. #72832 - The coordinator lock was held during external resource cleanup. #72830
Lockerrollback is now exception-safe and the unlock order is fixed. #72789- An incorrect byte order in
ColumnDict.merge, now using unsigned byte order. #72778 - A stack-buffer-overflow when formatting into a temporary
std::string. #72728 - The HAVING clause is now checked when disabling aggregation spill on a small LIMIT. #72705
- A hang caused by joining forwarded RPCs when draining the runtime_filter worker. #72626
- Incorrect lazy-materialization slot nullability for a materialized view over an outer join. #72621
merge_conditionwas not preserved when applying a normal rowset commit. #72542- Lock contention in
TabletScheduler/TabletSchedCtxhot paths during clone, reduced by relaxing DB locks. #72475 Lockerdid not roll back a partial intensive-lock acquisition. #72423- A spillable hash join probe crash. #72397
- COALESCE children are now cast to a common type in the JOIN USING transformer. #72338
- DB READ lock was held too broadly for single-table proc directories, now relaxed to per-table. #72334
- A memory leak when caching the materialized view plan context. #72300
- FSE-v2 did not set the schema for shared-data sorted schema change. #72235
ConsistencyCheckerheld a DB READ lock too broadly in periodic scans, now relaxed to per-table READ. #72218- A BE crash when querying
information_schema.warehouse_queries. #72019 - A trailing
\rwas not stripped before the closing enclose in CRLF CSV inputs. #71866 - Paimon primary key columns were incorrectly marked as non-nullable when querying an external catalog. #71660
- A redundant double slash was created when constructing the JDBC URL if the URI already ended with a trailing slash, breaking strict drivers such as ClickHouse. #70992
Security Fixes
- dep: libthrift upgraded to 0.23.0 to address a CVE security vulnerability
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About starrocks
The world's fastest open query engine for sub-second analytics both on and off the data lakehouse. With the flexibility to support nearly any scenario, StarRocks provides best-in-class performance for multi-dimensional analytics, real-time analytics, and ad-hoc queries. A Linux Foundation project.
Related context
Related tools
Beta — feedback welcome: [email protected]