StarRocks/starrocks 4.0.10

on GitHub

4.0.10

Release Date: May 9, 2026

Behavior Changes

• Cloud storage credentials are now redacted in error messages produced by INSERT INTO FILES, preventing accidental exposure of secrets in error logs and SHOW LOAD output. #71245
• StarRocks no longer permits queries against insert-only ACID Hive tables in Hive catalog. Previously such queries could silently return more rows than actually visible because INSERT OVERWRITE operations were not recognized. Affected tables now return an explicit error instead of incorrect results. #71460

Improvements

• Added an Avro schema cache in Iceberg PartitionData construction to remove redundant Jackson ObjectMapper allocations during partition load on tables with many partitions. #72215
• Optimized CatalogRecycleBin.getAdjustedRecycleTimestamp to avoid rebuilding the table-id map on every call, reducing recycle-bin cleanup and tablet scheduling overhead. #72128
• OlapTableSink.createLocation now batches tablet-location lookups in shared-data mode, removing per-tablet StarOS RPCs that previously stalled the planner critical section. #72041
• Java UDAF instances are now loaded and initialized once per query and reused across pipeline driver instances, removing the linear driver-preparation overhead at high pipeline_dop. #72038
• Added BE metrics starrocks_be_staros_shard_info_fallback_total and starrocks_be_staros_shard_info_fallback_failed_total to track when the StarOS worker falls back to fetching shard info from starmgr because the local cache missed. #71620
• File-bundle writes now prefer a tablet-local aggregator so the bundled tablet metadata path does not require cross-node shard-info lookups. #71613
• Audit log entries now include the queried tables and views referenced by each query. #71596
• INSERT INTO FILES CSV export now supports csv.enclose and csv.escape properties for controlling field quoting and escaping. #71589
• Added LDAP direct bind authentication via DN pattern, removing the requirement for an admin search account in single-tenant LDAP setups. #71559
• Added the starrocks_fe_tablet_num metric for shared-data clusters to match the shared-nothing metric set. #71444
• star_mgr_meta_sync_interval_sec is now runtime-mutable via ADMIN SET FRONTEND CONFIG; the new interval takes effect on the next sync cycle without an FE restart. #71675

Bug Fixes

The following issues have been fixed:

• A race in shared-data combined txn log mode where INSERT into per-partition coordinator dispatch could classify legitimate txn logs as orphan and drop them, leaving the transaction stuck in non-VISIBLE state. #72237
• An issue where _incremental_open_node_channel channels in shared-data combined txn log mode silently dropped txn logs because the legacy "sender_id == 0 collects all logs" rule did not apply to incremental channels. #71992
• An issue where RuntimeProfile::to_thrift() could crash BE with std::bad_optional_access when another thread reset counter min/max values during profile serialization. #72904
• An inconsistency in flat JSON merge results when one side contributed empty values. #72973
• An issue where CREATE TABLE for an Iceberg table failed with "Multiple entries with same key: format-version" when the user explicitly specified format-version in PROPERTIES. #72828
• A CompactionScheduler.startCompaction lock scope that held a DB-wide READ lock across single-table critical work, blocking concurrent DDL on other tables in the same database. Switched to IS on DB plus READ on the target table. #72178
• An issue where StarMgrMetaSyncer.syncTableMetaInternal and syncTableColocationInfo held DB READ/WRITE locks across external StarOS RPCs, freezing CREATE/DROP/ALTER/RENAME on every table in the database for the duration of each RPC. #72108
• An issue where StarMgrMetaSyncer.getAllPartitionShardGroupId held the DB READ lock for full iteration over all cloud-native tables and physical partitions, stalling FE threads waiting for the DB write lock on large catalogs. #71614
• A redundant DB READ lock in getTableNamesViewWithLock. The underlying nameToTable is a ConcurrentHashMap, so the enclosing lock added contention without correctness benefit. #72042
• A DB WRITE lock in the read-only /api/{db}/{table}/_count REST endpoint that was unnecessary for computing proximateRowCount(). #72053
• A batch publish deadlock caused by partition version gaps that operations like tablet split, schema change, and alter jobs reserved by advancing nextVersion without a matching publish. #71483
• A deadlock in shared-nothing mode when warming up the LRU cache for rowset metadata while the cache was full. #71459
• A PipelineTimerTask that could remain stuck in waitUtilFinished due to incorrect ordering between consumer registration and finished signaling. #72058
• A condition race in ConnectorSinkPassthroughExchanger::accept that crashed BE with SIGSEGV via out-of-bounds vector access on _writer_count. #71848
• A use-after-free in LoadChannel::get_load_replica_status caused by destruction of a temporary shared_ptr. #71843
• A use-after-free in the information schema sink due to a missing reference count increment in async RPC closure handling. #71513
• A BE crash in reverse(DecimalV3) caused by improper handling of decimal value width. #71834
• A BE crash when UNNEST produced columns whose define-expression carried an ARRAY type, which was incompatible with global dictionary generation downstream. #72027
• An NPE in FE when creating an Iceberg external table with invalid transform argument order such as bucket(4, region); FE now returns a normal analyzer error. #71917
• An issue where Iceberg manifest data file cache entries were missing column statistics when the first query against a table did not request stats (for example SELECT *). #71913
• An issue where the Iceberg min/max optimization was silently skipped when the table was partitioned by bucket(col, N) because PruneHDFSScanColumnRule injected a placeholder materialized column. #71863
• An issue where AggregateJoinPushDownRule failed to rewrite materialized views over Iceberg base tables because Table.getId() was compared instead of identity, and connector-table ids can shift across plan rebuilds. #71856
• An issue where INSERT OVERWRITE into Hive dynamic partitions failed when the metastore listed a partition whose location no longer existed on the file system; the missing partition directory is now created before commit. #71810
• A Parquet scanner failure (Illegal converting from arrow type(dictionary) ...) when Arrow returned dictionary-typed columns, including dictionaries nested inside arrays, structs, and maps. #71855
• An issue where stale scan ranges from earlier batches persisted across ColocatedBackendSelector.Assignment incremental batches, causing files to be re-deployed and re-scanned. #71789
• An issue where PruneShuffleColumnRule did not update the Join outputProperty after pruning Exchange shuffle columns, leading to incorrect downstream distribution. #72003
• Incorrect shuffle distribution caused by a missing project node when PushDownJoinOnExpressionToChildProject was disabled during the first stage of multi-stage MV rewrite. #71075
• Duplicate Apply attachments in ReplaceSubqueryRewriteRule when predicate normalization made the same scalar-subquery placeholder appear multiple times. #71155
• A short-circuit issue in EventScheduler where a finished join probe could prevent the pipeline from transitioning to the finished state. #71740
• An issue where AWS assume-role configured via aws.s3.iam_role_arn was not applied to JNI scanners (RCFile / Avro / SequenceFile / Hudi), causing S3 403 errors. #71422
• An issue where Oracle JDBC predicate pushdown produced invalid SQL because date literals did not match the Oracle NLS format; literals are now emitted as date '...'. #71412
• An issue in shared-data mode where a follower FE forwarded DDL to the leader and waited only for FE journal replay, missing the StarMgr journal and producing "no queryable replica" errors for queries that immediately followed table creation. #71263
• An issue where get_tablet_stats for Primary Key tablets repeatedly reloaded the entire TabletMetadata for every segment via get_del_vec_in_meta(). #71672
• An Arrow Flight issue where empty result sets returned column names of r because the placeholder name was emitted instead of the actual schema. #71534
• An issue where parallel_clone_task_per_path updates did not include the store-path count when resizing the CLONE thread pool. #71484
• An issue where the resource group user classifier rejected digit-leading usernames that CREATE USER allowed. The classifier now uses the same validation rule as CREATE USER. #71470
• An issue where HttpServerHandler.channelInactive skipped unregisterConnection when isRegistered() was false, leaking connection-map entries for early-failing requests. #72006
• An issue where Java UDF JNI calls (NewObject, NewArray, NewStringUTF, etc.) did not check for exceptions or null returns, leading to silent failures or undefined behavior. #71734
• An issue where be_tablets.DATA_SIZE reported total_disk_size (including rowset-embedded indexes and the persistent PK index for lake PK tablets) instead of rowset column data bytes. #70735
• A noisy "Failed to batch drop tablets" warning printed by StarMgrMetaSyncer even when there were no shards to delete. #72209
• CVE-2026-42198 (pgjdbc) and CVE-2026-5598 (BouncyCastle): bumped org.postgresql:postgresql to 42.7.11 and BouncyCastle to 1.84. #72797
• CVE in netty: upgraded netty to 4.1.133.Final. #72905
• Cleaned broker CVEs by upgrading netty / jetty / awssdk / jackson dependencies in the broker. #72184
• Upgraded jetty-http to 9.4.58.v20250814 to address known CVEs in the previous jetty-http version. #71762
• Temporarily masked CVE-2026-2332 to unblock the build, since jetty 9.x is EOL and no upstream fix is published. #71914