Skip to content

starrocks

v3.5.18 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

analytics big-data cloudnative database datalake delta-lake
+14 more
distributed-database hudi iceberg join lakehouse lakehouse-platform mpp olap real-time-analytics real-time-updates realtime-database sql star-schema vectorized

ReleasePort's take

Moderate signal
editorial:auto 1mo

StarRocks 3.5.18 patches several dependency CVEs and resolves multiple regressions across components.

Why it matters: Fixes high‑severity (severity 90) dependency vulnerabilities; addresses crashes, hangs, and race conditions in core processing pipelines.

Summary

AI summary

Broad release touches Behavior Changes, https://github.com/StarRocks/starrocks/pull/58292, https://github.com/StarRocks/starrocks/pull/72954, and https://github.com/StarRocks/starrocks/pull/73199.

Changes in this release

Security Critical

Fixes dependency CVEs and broker regressions.

Fixes dependency CVEs and broker regressions.

Source: llm_adapter@2026-06-09

Confidence: high

Feature Medium

Allows `SHOW` statements inside explicit transactions.

Allows `SHOW` statements inside explicit transactions.

Source: llm_adapter@2026-06-09

Confidence: high

Feature Medium

`get_json_string` now respects `ALLOW_THROW_EXCEPTION` for JSON parsing errors.

`get_json_string` now respects `ALLOW_THROW_EXCEPTION` for JSON parsing errors.

Source: llm_adapter@2026-06-09

Confidence: high

Feature Medium

Preserves `IGNORE NULLS` in view definitions when window function argument is an expression.

Preserves `IGNORE NULLS` in view definitions when window function argument is an expression.

Source: llm_adapter@2026-06-09

Confidence: high

Feature Medium

Correctly applies Ranger row filter and masking policies to Hive views and expanded base tables.

Correctly applies Ranger row filter and masking policies to Hive views and expanded base tables.

Source: llm_adapter@2026-06-09

Confidence: high

Feature Medium

Disables automatic per‑partition Hive partition statistics refresh; uses table‑level async batch refresh.

Disables automatic per‑partition Hive partition statistics refresh; uses table‑level async batch refresh.

Source: llm_adapter@2026-06-09

Confidence: high

Feature Medium

Adds configurable FE write timeout `mysql_send_packet_timeout_ms` to prevent indefinite blocking of result sending to slow clients.

Adds configurable FE write timeout `mysql_send_packet_timeout_ms` to prevent indefinite blocking of result sending to slow clients.

Source: llm_adapter@2026-06-09

Confidence: high

Bugfix High

Prevents empty ALTER TABLE statements from being parsed as OPTIMIZE clauses, avoiding default distribution loss.

Prevents empty ALTER TABLE statements from being parsed as OPTIMIZE clauses, avoiding default distribution loss.

Source: llm_adapter@2026-06-09

Confidence: high

Bugfix High

Resolves concurrent SegmentFlushTask race and loss of merge_condition during rowset commit.

Resolves concurrent SegmentFlushTask race and loss of merge_condition during rowset commit.

Source: llm_adapter@2026-06-09

Confidence: high

Bugfix High

Fixes crashes, hangs, and unsafe cleanup in multiple components (SinkBuffer, PipelineTimerTask, runtime filter workers, etc.).

Fixes crashes, hangs, and unsafe cleanup in multiple components (SinkBuffer, PipelineTimerTask, runtime filter workers, etc.).

Source: llm_adapter@2026-06-09

Confidence: high

Full changelog

Release date: June 5, 2026

Behavior Changes

  • SHOW statements are now allowed inside explicit transactions. #72954
  • get_json_string now respects ALLOW_THROW_EXCEPTION when handling JSON parsing errors. #73199
  • IGNORE NULLS is now preserved in view definitions when the window function argument is an expression. #69971
  • Ranger row filter and masking policies are now correctly applied to Hive views and to base tables expanded from Hive view definitions. #73265
  • Hive partition statistics are no longer automatically refreshed per partition. Existing cached stats are preserved while a table-level asynchronous refresh updates the cache in batches. #73563

Improvements

  • Supports caching Java UDAF class-level initialization so shared UDAFs can reuse loaded classes and generated stubs across aggregator and window-function instances. #72038
  • Supports Paimon time types and improves Paimon materialized view handling. #58292
  • Added an Avro schema cache for shadowed PartitionData during partition load. #72215
  • Added a configurable FE write timeout mysql_send_packet_timeout_ms for the MySQL result send path to prevent indefinitely blocked result sending to slow clients. #73646
  • Optimized CatalogRecycleBin adjusted recycle timestamp lookup. #72128
  • Reduced metadata and lock overhead in load balancing, compaction scheduling, consistency checks, and StarMgr metadata synchronization paths. #73555 #72218 #72178 #72108
  • Improved diagnostics for filesystem copy failures and Parquet broker load errors by surfacing the underlying cause and file/column/row context. #73414 #73236
  • Reduced external catalog and information schema metadata overhead by deferring JDBC REMARKS fetching, avoiding redundant Paimon snapshot lookups, and pushing down table_name predicates for information_schema.tables_config. #73488 #72892 #73210
  • Simplified the scalar-function merge implementation by using merge() directly. #69575

Bug fixes

The following issues have been fixed:

  • Empty ALTER TABLE statements could be parsed as OPTIMIZE clauses, and replaying malformed OPTIMIZE jobs could clear a table's default distribution. #73352
  • Decimal-valued unit counters in runtime profiles could cause query progress parsing failures and noisy FE warnings. #73683
  • Concurrent SegmentFlushTask race in DeltaWriter::commit() and loss of merge_condition during normal rowset commit. #73371 #72542
  • Crashes, hangs, or unsafe cleanup in SinkBuffer graceful exit, PipelineTimerTask, runtime filter workers, spillable hash join probe, information_schema.warehouse_queries, lake vacuum, HTTP connection unregister paths, and query queue timeout handling. #73202 #73082 #72058 #72626 #72397 #72019 #73088 #72006 #65802
  • Materialized view issues involving JDBC SQL Server tables, lost index properties, cached plan context memory leaks, Paimon tables, and incorrect shuffle distribution after MV rewrite. #72962 #69187 #72300 #58292 #71075
  • Query planning and rewrite issues in Spark connector external scans, INSERT OVERWRITE re-planning, aggregation spill with small LIMIT, and generated columns produced by UNNEST. #73225 #72832 #72705 #72027
  • Paimon Primary Key columns could be incorrectly marked as non-nullable when querying external catalogs. #71660
  • Primary Key and tablet metadata issues including partial tablet schema short-key mismatch, rowset metadata cache warmup deadlock, disk data cache expansion failure, Azure filesystem client cache issues in Starlet, and colocate-heavy cluster-balance performance issues in StarOS. #70586 #71459 #58206 #73145 #72391
  • Locker rollback and unlock-order issues during partial intensive-lock acquisition. #72789 #72423
  • Dependency CVEs and broker dependency regressions. #72905 #72797 #72184 #72191
  • JNI local-reference leaks in JDBC scanner initialization. #72913
  • Arrow dictionary values in Parquet scanner and Apache Parquet namespace ambiguity during scanner builds. #71855 #72284
  • NPE in Iceberg getPartitionLastUpdatedTime when the snapshot is expired. #68925

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track starrocks

Get notified when new releases ship.

Sign up free

About starrocks

The world's fastest open query engine for sub-second analytics both on and off the data lakehouse. With the flexibility to support nearly any scenario, StarRocks provides best-in-class performance for multi-dimensional analytics, real-time analytics, and ad-hoc queries. A Linux Foundation project.

All releases →

Related context

Earlier breaking changes

  • v4.0.11 `pipeline_enable_large_column_checker` is now enabled by default.
  • v4.0.11 `get_json_string` and other `get_json_*` functions now return JSON parse error instead of NULL when implicit VARCHAR-to-JSON parsing fails under ALLOW_THROW_EXCEPTION.

Beta — feedback welcome: [email protected]