This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+14 more
ReleasePort's take
Moderate signalStarRocks 3.5.18 patches several dependency CVEs and resolves multiple regressions across components.
Why it matters: Fixes high‑severity (severity 90) dependency vulnerabilities; addresses crashes, hangs, and race conditions in core processing pipelines.
Summary
AI summaryBroad release touches Behavior Changes, https://github.com/StarRocks/starrocks/pull/58292, https://github.com/StarRocks/starrocks/pull/72954, and https://github.com/StarRocks/starrocks/pull/73199.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Fixes dependency CVEs and broker regressions. Fixes dependency CVEs and broker regressions. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Feature | Medium |
Allows `SHOW` statements inside explicit transactions. Allows `SHOW` statements inside explicit transactions. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Feature | Medium |
`get_json_string` now respects `ALLOW_THROW_EXCEPTION` for JSON parsing errors. `get_json_string` now respects `ALLOW_THROW_EXCEPTION` for JSON parsing errors. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Feature | Medium |
Preserves `IGNORE NULLS` in view definitions when window function argument is an expression. Preserves `IGNORE NULLS` in view definitions when window function argument is an expression. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Feature | Medium |
Correctly applies Ranger row filter and masking policies to Hive views and expanded base tables. Correctly applies Ranger row filter and masking policies to Hive views and expanded base tables. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Feature | Medium |
Disables automatic per‑partition Hive partition statistics refresh; uses table‑level async batch refresh. Disables automatic per‑partition Hive partition statistics refresh; uses table‑level async batch refresh. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Feature | Medium |
Adds configurable FE write timeout `mysql_send_packet_timeout_ms` to prevent indefinite blocking of result sending to slow clients. Adds configurable FE write timeout `mysql_send_packet_timeout_ms` to prevent indefinite blocking of result sending to slow clients. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Bugfix | High |
Prevents empty ALTER TABLE statements from being parsed as OPTIMIZE clauses, avoiding default distribution loss. Prevents empty ALTER TABLE statements from being parsed as OPTIMIZE clauses, avoiding default distribution loss. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Bugfix | High |
Resolves concurrent SegmentFlushTask race and loss of merge_condition during rowset commit. Resolves concurrent SegmentFlushTask race and loss of merge_condition during rowset commit. Source: llm_adapter@2026-06-09 Confidence: high |
— |
| Bugfix | High |
Fixes crashes, hangs, and unsafe cleanup in multiple components (SinkBuffer, PipelineTimerTask, runtime filter workers, etc.). Fixes crashes, hangs, and unsafe cleanup in multiple components (SinkBuffer, PipelineTimerTask, runtime filter workers, etc.). Source: llm_adapter@2026-06-09 Confidence: high |
— |
Full changelog
Release date: June 5, 2026
Behavior Changes
SHOWstatements are now allowed inside explicit transactions. #72954get_json_stringnow respectsALLOW_THROW_EXCEPTIONwhen handling JSON parsing errors. #73199IGNORE NULLSis now preserved in view definitions when the window function argument is an expression. #69971- Ranger row filter and masking policies are now correctly applied to Hive views and to base tables expanded from Hive view definitions. #73265
- Hive partition statistics are no longer automatically refreshed per partition. Existing cached stats are preserved while a table-level asynchronous refresh updates the cache in batches. #73563
Improvements
- Supports caching Java UDAF class-level initialization so shared UDAFs can reuse loaded classes and generated stubs across aggregator and window-function instances. #72038
- Supports Paimon time types and improves Paimon materialized view handling. #58292
- Added an Avro schema cache for shadowed
PartitionDataduring partition load. #72215 - Added a configurable FE write timeout
mysql_send_packet_timeout_msfor the MySQL result send path to prevent indefinitely blocked result sending to slow clients. #73646 - Optimized
CatalogRecycleBinadjusted recycle timestamp lookup. #72128 - Reduced metadata and lock overhead in load balancing, compaction scheduling, consistency checks, and StarMgr metadata synchronization paths. #73555 #72218 #72178 #72108
- Improved diagnostics for filesystem copy failures and Parquet broker load errors by surfacing the underlying cause and file/column/row context. #73414 #73236
- Reduced external catalog and information schema metadata overhead by deferring JDBC REMARKS fetching, avoiding redundant Paimon snapshot lookups, and pushing down
table_namepredicates forinformation_schema.tables_config. #73488 #72892 #73210 - Simplified the scalar-function merge implementation by using
merge()directly. #69575
Bug fixes
The following issues have been fixed:
- Empty
ALTER TABLEstatements could be parsed as OPTIMIZE clauses, and replaying malformed OPTIMIZE jobs could clear a table's default distribution. #73352 - Decimal-valued unit counters in runtime profiles could cause query progress parsing failures and noisy FE warnings. #73683
- Concurrent
SegmentFlushTaskrace inDeltaWriter::commit()and loss ofmerge_conditionduring normal rowset commit. #73371 #72542 - Crashes, hangs, or unsafe cleanup in
SinkBuffergraceful exit,PipelineTimerTask, runtime filter workers, spillable hash join probe,information_schema.warehouse_queries, lake vacuum, HTTP connection unregister paths, and query queue timeout handling. #73202 #73082 #72058 #72626 #72397 #72019 #73088 #72006 #65802 - Materialized view issues involving JDBC SQL Server tables, lost index properties, cached plan context memory leaks, Paimon tables, and incorrect shuffle distribution after MV rewrite. #72962 #69187 #72300 #58292 #71075
- Query planning and rewrite issues in Spark connector external scans,
INSERT OVERWRITEre-planning, aggregation spill with small LIMIT, and generated columns produced byUNNEST. #73225 #72832 #72705 #72027 - Paimon Primary Key columns could be incorrectly marked as non-nullable when querying external catalogs. #71660
- Primary Key and tablet metadata issues including partial tablet schema short-key mismatch, rowset metadata cache warmup deadlock, disk data cache expansion failure, Azure filesystem client cache issues in Starlet, and colocate-heavy cluster-balance performance issues in StarOS. #70586 #71459 #58206 #73145 #72391
- Locker rollback and unlock-order issues during partial intensive-lock acquisition. #72789 #72423
- Dependency CVEs and broker dependency regressions. #72905 #72797 #72184 #72191
- JNI local-reference leaks in JDBC scanner initialization. #72913
- Arrow dictionary values in Parquet scanner and Apache Parquet namespace ambiguity during scanner builds. #71855 #72284
- NPE in Iceberg
getPartitionLastUpdatedTimewhen the snapshot is expired. #68925
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About starrocks
The world's fastest open query engine for sub-second analytics both on and off the data lakehouse. With the flexibility to support nearly any scenario, StarRocks provides best-in-class performance for multi-dimensional analytics, real-time analytics, and ad-hoc queries. A Linux Foundation project.
Related context
Related tools
Beta — feedback welcome: [email protected]