StarRocks/starrocks 4.0.16 on GitHub

4.0.16

Release Date: September 30, 2026

Behavior Changes

The default HTTP client for the AWS SDK is switched from Poco back to the SDK's own client: enable_poco_client_for_aws_sdk now defaults to false. Set it to true to restore the previous behavior. #78375
jemalloc's dedicated oversize arena is enabled by default, so large allocations no longer land in the per-CPU arena of the calling thread. This improves reuse of large buffers and reduces fragmentation, and changes how BE and CN memory is distributed across arenas. #78396
A shared-data transaction whose combined txn log was not fully written is now refused at commit instead of committing and then failing publish forever with txn log list does not contain txn log of tablet. replication_num no longer weakens the shared-data write quorum. #78162
A shared-data partition now advances straight to the final version of a batch publish instead of through each intermediate version, so a query can no longer request an intermediate version that has no tablet metadata object, which surfaced as The specified key does not exist. #79175
A shared-data publish that keeps failing now backs off and throttles its retry logging instead of emitting the previous publish version task has not finished message on every attempt, which could dominate the FE leader's CPU and log volume during an incident. #79299
A shared-data load cancelled by a user error now reports that error instead of the derived AsyncDeltaWriter has been closed. #78632
HDFS files are no longer hsynced before they are closed. The hsync was a workaround for a crash that a separate change had already fixed, and it forced an fsync() on every DataNode replica on each close. #78864
A Parquet null_count that under-reports NULLs is no longer taken at face value during decoding and pruning. Files written by older parquet-mr versions previously returned corrupted values or dropped rows. #78329
List partition pruning of !=, NOT IN, and IS NOT NULL no longer discards a multi-value partition just because its value list also contains NULL. Queries on such a table, including joins that derive IS NOT NULL on the join key, return the non-null rows that were previously lost. #78946
Batch DDL can now build date range partitions that start at year 0000, which is a legal DATE value. Such a statement previously failed with the range of the partition is invalid. #78746
Serialized datetime partition bounds now keep their microseconds. An operator-precedence error previously added the fractional seconds to the shift distance instead of the shifted value, corrupting the bound and potentially blocking metadata replay. #78922
max_partitions_in_one_batch and the partition-number limit now count the partitions the request in hand is about to create. An oversized batch is rejected up front instead of being admitted and only failing the following batch. #79379
Streaming aggregation tuning is now driven by the group-by cardinality instead of the rows left after HAVING, so a query whose HAVING clause filters most groups away no longer loses its local pre-aggregation. #79064
Audit log rows now carry scanBytes, scanRows, returnRows, cpuCostNs, and memCostBytes for DML that targets an external Iceberg or Hive table or the FILES() table function, and for asynchronous materialized-view refreshes. These fields previously reported 0. #74072 #74954
Internal queries issued while filling information_schema.materialized_views and SHOW MATERIALIZED VIEWS are now bounded by the outer statement's query_timeout instead of statistic_collect_query_timeout (default one hour), so such a statement can no longer hang far past its own timeout. #77585
SQL blacklist verification no longer holds a global read lock while matching, so an expensive pattern or a concurrent ADD/DELETE SQLBLACKLIST no longer stalls every query at the SQL entry point. #78476
paimon.option.cache-enabled = false disables the Paimon metadata cache again. #78271
The background metadata refresh for a Paimon catalog now visits only tables that were recently accessed and have changed, instead of enumerating and reloading the whole warehouse every cycle. A table that StarRocks has never queried is no longer refreshed. #78057
A VARCHAR column of a Paimon table now reports the length declared in the Paimon schema instead of an incorrect one. #68383
ALTER TABLE ... RENAME on an Iceberg REST catalog no longer fails with a NullPointerException. #76498
Reading the $partitions metadata table of an Iceberg table with a DECIMAL partition field, or with a null timestamptz partition value, no longer fails with a NullPointerException. #77742
A table with many stale partitions no longer reports a statistics health pinned near 1.0, so auto-ANALYZE is triggered when it should be. Tables that were previously considered healthy may now be re-analyzed. #76927
A column whose name contains a special character such as # no longer fails the low-cardinality dictionary collection query with a ParsingException; the generated alias is quoted. #77132
A GROUPING SETS aggregation joined to another one on its group-by keys no longer fails at planning with no executable plan for this sql. #77296
encode_sort_key now expands a constant argument once per row instead of writing the single stored element into every row buffer. #77847
A statement forwarded to the Leader FE now keeps its original SQL text in the audit log and the query profile, instead of a form rebuilt from the AST. #77982
A connection ID that wraps the 24-bit per-FE counter no longer collides with a live connection, which previously hid the older session and drifted the global and per-user connection accounting. #78217
A column that is missing from the tablet schema no longer aborts the BE during predicate push-down; the predicate is simply not pushed down. #79234
When OlapTableSink initialization fails, the partially initialized sink is no longer taken through the full close path, which could dereference state that was never created and abort the BE. The original initialization error is returned instead. #79370
Short key index page geometry is now validated without 32-bit overflow, so a corrupted page footer is rejected instead of wrapping and causing a heap out-of-bounds write. #79048
An HTTPS request whose TLS handshake times out is no longer treated as connected and retried on the same socket. A stalled request now fails after approximately one timeout instead of connect_timeout plus two receive timeouts. #79369
An expression returning ARRAY or STRUCT over a low-cardinality column is no longer rewritten to operate on dictionary ids, which crashed the BE at fragment prepare. #78488
starrocks_fe_max_tablet_compaction_score is reported correctly on a shared-nothing cluster after an FE restart; the active get_tablets_info response now carries the maximum tablet compaction score. #78496
FE feature log files are written under feature_log_dir instead of the general log directory. #77221
be.conf and fe.conf entries on a last line without a trailing newline are now read instead of silently dropped. #78065

Improvements

Supported Fast Schema Evolution for materialized views. #67915
Extended the grouping-sets push-down rule to AVG and COUNT, in addition to MAX, MIN, and SUM, which speeds up ROLLUP, CUBE, and GROUPING SETS queries with more than three levels. #77832
Removed the process-wide lock in front of the lake segment metadata cache, leaving the sharded LRU cache to do its own locking. #78260
Compaction and replication now drop the never-read delete_predicate when they archive a rowset into compaction_inputs, which reclaims tablet-metadata bloat at its source in shared-data clusters. #76870
Added server-level spill metrics that aggregate spill activity across all spillable operators, broken down by local and remote storage backend. #71827
Added the leader-FE gauge max_journal_replay_lag, which reports how far the furthest-behind follower or observer trails the leader in replayed journal ids. #78382
The jemalloc runtime options a BE or CN was started with are now visible through the jemalloc_conf configuration item, and its mutable options such as dirty_decay_ms and muzzy_decay_ms can be changed at runtime without a restart. #75344 #78333
Extended jemalloc observability: added dirty and muzzy page metrics, broke the metadata total down into extent metadata and the rtree, dumped stats.mapped and stats.retained in be.INFO, and let /memz take jemalloc's own statistics options so the per-arena section and the extent size-class breakdown are reachable from a running BE. #78159 #78225 #78320 #79090
On arm64, a 4K-page jemalloc variant is built alongside the 64K one and selected at runtime, which avoids the memory overhead of 64K page granularity on the common 4K-page kernels. The jemalloc libraries now live in dedicated directories selected through LD_LIBRARY_PATH instead of runtime symlink manipulation. #77886 #67667

Bug Fixes

The following issues have been fixed:

SHOW PROFILELIST, ANALYZE PROFILE, get_query_profile(), and /api/profile returned every cached profile, including other users' SQL text and plans, to any authenticated user. The new FE configuration authorization_enable_query_profile_access_check restricts a cached profile to the user who ran the query and to holders of SYSTEM OPERATE. #79375
In Ranger mode, the column privilege check mishandled views and materialized views over external tables. #56316
Addressed security vulnerabilities (CVE): upgraded Apache Ranger to 2.9.0 and Bouncy Castle to 1.85, Apache HttpClient5 to 5.6.4 and HttpCore to 5.4.3, Netty to 4.1.137.Final, ZooKeeper to 3.8.7 and 3.9.6, the broker's Tomcat to 9.0.121 and its commons-lang3 to 3.20.0, and aligned all io.grpc artifacts through grpc-bom. Test-scope jars are no longer shipped in the java-extensions reader lib directories. #79331 #79538 #77753 #78287 #79707 #79719 #77748 #77171 #77752
Upgraded StarOS, starlet, and starcache to v4.0.8. #79478 #77717
The authorization check, INSERT planning, view expansion, the privilege check, inspect_mv_refresh_info, and FILES() schema inference for CREATE TABLE AS SELECT all made external-catalog round trips while holding an FE metadata lock, so a slow metastore stalled every DDL waiting on the same lock. Those calls now happen outside the lock. #79319 #79226 #78772
PlannerMetaLocker unlocked metadata it had never successfully locked when lock() failed part way through. #74041
FULL OUTER JOIN ... USING (c1, c2, ...) returned the wrong values: the first USING column was correct and every later one carried the previous column's value. Adding ORDER BY <ordinal> to the same query failed with an IndexOutOfBoundsException. #79298
A HAVING predicate was lost when GROUPING SETS, ROLLUP, or CUBE was rewritten into a union, so the query returned rows it was supposed to filter out. #79415
GROUP BY ROLLUP(a, b, a), and CUBE or GROUPING SETS naming a column twice within one set, produced a grouping set that carried the same key twice. #78261
Removing the aggregation above an aggregate-key table dropped the query's LIMIT before it reached the storage layer, so the BE read the whole table. #79414
Splitting an OR join into a union lined up the branches inconsistently, because the union's output columns and the first branch were ordered by column id while the other branches followed the projection map's iteration order. #79473
The skew-join rewrite replicated the preserved side of an outer join, so one input row could be returned several times and the result moved between runs. Salting is now skipped in that case. #79168
A predicate under an OR whose branch was only partially covered by bitmap indexes was erased once its bitmap range had been applied, which produced false positives such as (a = 1 AND b = 2) OR (a = 2 AND b = 3) matching (a = 1, b = 3). #76275
A column read only by a predicate inside an OR subtree was pruned from the read set after GIN inverted index filtering, so the surviving predicate evaluated against a column that was never read. #77659
A predicate-free COUNT(*) could be folded from tablet row counts that never covered the visible version, because the guard only checked that a collection cycle had finished, not that its RPCs had succeeded. #77190
SELECT DISTINCT over a window aggregate left dropped columns in a projection after the distinct push-down below the window. #77218
Ranking-window pre-aggregation was applied when the aggregate window and the rank-related window were not in the same sort group. #77068
A window over an always-non-null aggregate such as bitmap_union_count() lost its declared nullability, so a DISTINCT or GROUP BY over it failed with error nullablel column. #79009
An analytic frame starting at a FOLLOWING offset dropped the current row. #77342
A subquery in a window's PARTITION BY or ORDER BY clause failed to plan with slot type shouldn't be invalid. #77087
Analytor::prepare() filled its function list only at the very end, so an error part way through left the destructor reading past the end of an empty vector and killing the BE. #77758
A merge-phase aggregate re-appended an already-replaced constant argument, which shifted every following constant argument one slot to the right. #77069
count() over an array of decimal produced an INVALID result type and failed with slot type shouldn't be invalid. #77092
The if() built for a multi-column count(DISTINCT) lost its decimal type, so the BE received an expression typed DECIMAL(-1,-1) and aborted. #77346
Common plan fusion skipped the _if combinator fall-back check, and GROUP BY rules were applied to only some children of an expression, so SELECT max(s) LIKE s FROM t failed with Invalid plan. #77099
corr, covar_pop, and covar_samp crashed the BE when the optimizer folded an argument into a constant after analysis. #77216
percentile_cont merge tracked exhaustion by value instead of by position, which could abort the BE. #77261
A global dictionary was used for aggregate-state columns and their subfields were pruned, both of which aborted the BE on a failed down-cast. #77096 #77901
A JSON subfield aggregate on an aggregate table failed with a raw NullPointerException, because the synthetic subfield column has no aggregation type. #77952
CTEAnchor was not pruned when its child was a value operator, which surfaced as MultiCastPlanFragment don't support return result. #64491
Duplicating a plan threw ClassCastException on every LogicalLimit, because the duplicator treated a limit as a set operator. #77692
UKFK constraints were collected conditionally during join reorder, so enable_ukfk_join_reorder could fail with a NullPointerException. #77197
Planning a query over a colocate table could fail with Cannot invoke "PhysicalPropertySet.equals(Object)" because "enforcedProperty" is null, because colocate-group stability was re-evaluated while the optimizer ran. #77091
A colocate UNION, EXCEPT, or INTERSECT could hang, because a branch whose source cannot local-shuffle stayed in the colocate execution group without a grouped exchange. #77025
A non-positive ranking predicate was pushed into a TopN, which aborted the BE. #77445
The global limit shared by parallel streaming-distinct instances truncated results incorrectly. #77086
DeferProjectAfterTopNRule matched a scan's access paths by column name instead of column id, so a renamed column lost its subfield pruning. #77987
An OLAP scan's complex type was narrowed even when the BE did not prune it by an access path, so downstream operators built columns from a type the BE never materialized. #77894
Dead subfield slots pulled out of the scan by predicate expression reuse were not dropped, which aborted the BE. #77456
PruneComplexTypeUtil disabled complex-type subfield pruning for every column in the statement when it met a single expression it could not describe, such as a CASE WHEN over a complex column. The bail-out is now scoped to the expression that caused it. #79181
Scan heavy-expression result columns were not normalized to the slot's nullability, which crashed the BE. #77242
The query cache could serve an entry built below a TOPN_FILTER that a SortNode produced, and its digest did not cover the scan schema, an ASOF join's temporal condition, a join predicate's common sub-expressions, or an ANN search specification, so unrelated queries could collide. #77404 #77559 #77563 #77565 #77586
The query cache crashed the BE when it reused a lane for a partitioned hash join, and hung when a lane's join had an empty build side. #77564 #77571
A view scan's projection was dropped when a partially rewritten view-based materialized view rewrite replaced the scan back with its inlined plan. #77613
A materialized view refresh on a Paimon base table performed a full scan because the partition predicate was not pushed down. #61813
REFRESH MATERIALIZED VIEW ... FORCE silently refreshed nothing when the materialized view had a partition_retention_condition. #77671
The column min/max statistics cache was not invalidated by partition or schema DDL, so a stale entry could be served indefinitely. #77441
Background auto-ANALYZE of an external table could fail with primary key size exceed the limit when the catalog, database, and table names made the encoded table_uuid primary key exceed the BE limit. The table_uuid is now hashed. #75735
CancelableAnalyzeTask.cancel() could be won by more than one caller, because it read and wrote its state without an atomic compare-and-set. #78593
Hive-family catalogs failed outright when the metastore or AWS Glue denied permission to read column statistics; they now degrade to empty statistics. Glue column-statistics requests also carry catalogId, so a cross-account deployment reads statistics from the configured catalog. #78455 #78461
Elasticsearch external tables and Elasticsearch catalogs rejected clusters running version 8 or 9 with Unsupported/Unknown ES Cluster version, and concurrent queries could overwrite each other's request URL parameters, which surfaced as unrelated analysis errors such as Column 'id' cannot be resolved. #78267 #79391
Predicates on a DECIMAL column of a Paimon table were converted using the StarRocks type family's default precision and scale instead of the column's Paimon DecimalType, so the literal could not represent the value. #78760
Table references inside a connector view were qualified incorrectly when the Iceberg view metadata recorded no default-catalog, and when the view body referenced a CTE. #77887
An Iceberg table whose metadata file is missing from storage could not be dropped, not even with DROP TABLE IF EXISTS ... FORCE. #77786
ALTER TABLE ... EXECUTE rewrite_data_files() WHERE <filter> on an Iceberg table silently dropped rows when the filter did not align with partition boundaries. #77797
Azure Blob credential lookup failed when the endpoint was configured as a full URL, because the Hadoop configuration key embedded the scheme. Endpoints are now normalized to the filesystem authority. #78241
The send and receive timeouts computed for an object-storage request were dropped when the pooled Poco session was reused, so only the connection timeout applied. #78361
Querying a Parquet DECIMAL column stored as FIXED_LEN_BYTE_ARRAY through a connector scan could return corrupted values and silently drop rows, non-deterministically between runs of the same query. #78685
A corrupt DELTA_BINARY_PACKED page header was thrown rather than returned, and since Status is not an exception type nothing caught it. #77446
Parquet decoder scratch buffers were sized as variable-length arrays on the stack, which a large data page could overflow. #77616
A JSON path with an array index such as '[0].value.url' threw a C++ exception for every row whose array was shorter than the index, which turned a large scan into a lock convoy inside the stack unwinder. The index is now bounds-checked. #78569
JsonColumn::append read out of range and silently lost rows when flat-JSON schemas differed between segments. #77090
The JSON key column was not rebuilt when a set operation deserialized its keys, which aborted the BE. #77215
Flat JSON vertical compaction in shared-data mode used more memory than necessary, because the merger retained the previous result column and the root metadata did not account for its children. #77682
Nested array_map and array_sort lambdas failed to plan or evaluate with Input dependency cols check failed or Expr evaluate meet error: slot_id N not found, because common sub expressions hoisted by an inner lambda escaped the scope that defined them. #78645 #78769 #78915
array_sort's lambda comparator could drive the sort out of bounds, and its comparator validation shared one error Status across drivers, which could double-free it. #77687 #78314
unnest and multi_unnest read array offsets as signed 32-bit integers, so an offset of 2^31 or more came back negative and crashed the BE. #78480 #78479
substr, left, lpad, rpad, and translate returned bytes from neighboring rows, and locate searched past the end of a value, when the input ended in a truncated UTF-8 lead byte. #78722
strpos indexed out of bounds on an INT32_MIN instance argument. #77260
timestampdiff(MONTH, ...), timestampdiff(YEAR, ...), months_diff, and years_diff returned -1 instead of 0 when both arguments fell in the same month or year and the second was the earlier one. #79037
DateValue::weekday() returned a negative index for an out-of-range Julian value, so trunc_to_week() read before the start of its lookup table. #77310
The Teradata and Joda datetime parsers read past the end of the input string, which aborted the BE. #77098
generate_series crashed on a step count that cannot be represented, such as generate_series(0, -2147483648, -1). #77103
Constant arguments to tokenize and ngram_search that crash the BE are now rejected. #77102
EXPLAIN printed the wrong number of dictionary keys for a dictionary_get call with multiple keys, because the key count was inferred from the number of children. #78706
A descending sort of an ARRAY, MAP, or STRUCT column placed NULLs inconsistently, because the run-sort and run-merge phases applied opposite NULL conventions. #77679
EXCEPT and INTERSECT sized their serialization buffer from the widest row in the chunk, so a single fat row could ask the memory pool for hundreds of gigabytes. Keys are now serialized row by row in that case. #77821
A nested-loop join evaluated conjuncts on an empty chunk, and its null-aware anti join lost probe rows when a joined chunk had no matched rows, so NOT IN queries silently dropped rows on a multi-BE cluster. #77344 #77970
The BE read past the end of the output schema in _switch_context when a segment had to force-encode a string column to global dictionary ids. #77660
ALTER TABLE that added an ordinary column and a generated column in one statement killed the BE on a table that already had data. #77436
ALTER TABLE ... ADD COLUMN on an Aggregate table silently created a key column when neither an aggregate function nor the KEY keyword was given, changing the grain the table aggregates on. Such a statement is now rejected as ambiguous. #78359
PARTITION BY RANGE(<partition-function>()) with an empty argument list raised a raw IndexOutOfBoundsException instead of a parse error. #75080
USING GIN("IMP_LIB" = "builtin") was accepted by CREATE TABLE and then broke every INSERT with Can not get inverted imp type, because the property key reached the BE with its original casing. #77818
An unchecked StatusOr unwrap turned a recoverable error into an exception that escaped into the pipeline, a child expression error aborted the BE instead of being propagated, and an exception escaping the Thrift processor aborted the BE. #77052 #77442 #78805
GroupedExecutionSinkOperator::push_chunk swallowed the status returned by the local exchanger, so spill failures and closed-exchanger states went unreported. #77737
SystemMetrics::update() shared its getline() buffer across threads, which could double-free it. #71040
BE and CN could crash inside jemalloc with unrelated stacks, because malloc_usable_size performed a full thread-specific-data fetch; the heap profile toggle also wrote prof.thread_active_init and has_enable_heap_profile() read the boolean prof.active node into an int, so profiling was reported as disabled and later profiles were damaged. #77625 #78384 #78820
System.print() on a script's foreign objects printed instance of <Class> instead of the object's text, because the toString bindings were registered as methods rather than getters. #78877
An FE dropped with ALTER SYSTEM DROP FOLLOWER or DROP OBSERVER never exited and became a zombie that held elections forever. #78215
TabletInvertedIndex.markTabletsForceDelete() resolved tablet backend ids while holding the index write lock, which could deadlock the FE against a replica deletion. #78102
The tablet scheduler threw a NullPointerException on a disk that reported no storage medium. #76966
Dropping the auto-increment map waited on dead BEs and CNs, so the operation blocked for the full 60-second timeout whenever a registered node was down. #78561
PrepareCollectMetaTask threw a NullPointerException when the optimizer had no query id, which happens when materialized-view plan contexts are built on their own thread pool. #77051
Removing a transaction from the dependency graph while its predecessors were still present corrupted the graph, so a later transaction on the same table could lose its dependency edge. #78077
Three FE paths shipped a raw compute-node hostname to the BE instead of a resolved address, which made compute nodes resolve peer hostnames themselves and could flood the DNS server in containerized deployments. #78390
The getLoads RPC returned every load record in a single message, so a busy cluster filled the leader log with FE RPC failure ... MaxMessageSize reached and the loads_history archive rolled back and permanently lost rows. The RPC is now paginated by job id. #78898
A task run that migrated between the pending queue, the running map, the in-memory history, and the archived history while task_runs was being read could be reported twice. #79438
SHOW ALTER TABLE ROLLUP and SHOW ALTER MATERIALIZED VIEW accepted WHERE, ORDER BY, and LIMIT and then ignored them; only SHOW ALTER TABLE COLUMN applied them. FinishedTime is also accepted in a SHOW ALTER TABLE ROLLUP predicate. #79281 #79498
A client disconnect was handled inline on the XNIO I/O thread rather than on a worker, so killing the running query blocked the event loop. #77590
Loading the SQL blacklist rebuilt and sorted its immutable snapshot once per rule, which is quadratic in the number of rules and ran at every FE start and checkpoint. #78752
AsyncTaskQueue busy-spun between getOutputs() and tryGetOutputs() after the consumer thread was interrupted, because the interrupt was swallowed without clearing hasMoreOutput. #79297
TableKeeper declared a jdk.jshell exception type that does not exist on a JRE, so reflection on the class failed with NoClassDefFoundError. #79520
Loading into an expression-partitioned table through the multi-table transaction stream load interface failed at commit whenever the BE had to create a partition, with automatic create partition failed. error: txn ... not exist. #78790
A completed merge-commit load could report less than full merge-window progress in information_schema.loads. #78723
A VARCHAR column holding non-UTF-8 bytes made protobuf log an invalid UTF-8 data warning once per dictionary word on every tablet writer open RPC. #78657
Data cache read counters were missing from the intermediate query statistics, so the audit log field CacheHitRatio and the FE cache-hit-ratio metrics under-reported in shared-data mode. #77696
In combined txn log mode, a coordinator whose own end-of-stream arrived early could wait for the txn log collector indefinitely when the load was cancelled, and the compaction txn log that file bundling skips writing was not cached. #79389 #77578
A corrupted local cache copy was re-read on every retry when a primary-key index SST compaction or a delvec page checksum hit corruption, so the operation failed the same way until the entry happened to be evicted. The corrupted entry is now dropped and the read retried. #77481 #78086
A partial-update rewrite that degenerated into a copy dropped the source's encryption metadata, leaving a segment that no reader could open and that compaction could not rewrite. #79053
A CN could crash with SIGSEGV during graceful shutdown when an in-flight load reached a StarOS-backed filesystem after shutdown_staros_worker() had released the global worker. #79058
AsyncFlushOutputStream::close() satisfied its promise while still holding the stream's own mutex, so the I/O thread woke futexes on freed memory after the waiter had destroyed the stream. #79182
Snapshot-protected and post-snapshot physical partitions that share a shard group could have the snapshot's shards deleted by StarMgr metadata sync, which made snapshot restoration unsafe and could surface as missing tablet errors. Shard groups already removed by the recycle bin are also ignored during meta sync. #78800 #76604
Bundled tablet metadata readers probed a per-tablet object that does not exist in a bundled partition and paid an avoidable HTTP 404 first, because the partition marker was keyed differently by producers and readers. A BE counter for NotFound lake tablet metadata reads was added. #78466 #78451
A shared-data partition with the highest compaction score in the cluster could be admitted on every scheduling round and never started, because candidates were not sorted by maximum tablet score. Runtime changes of compact_threads also lost tokens when the limiter shrank. #77482 #78087
A lake alter job could get stuck after an FE failover, because replaying a pending online rewrite job did not restore its table-state reservation. #78517
Rowset metadata cache entries kept their initial charge after lazy-loaded indexes had increased segment memory usage, so the cache under-reported its footprint. #77893
Primary-key compaction estimated its read chunk size from compressed disk size and from rowset metadata that had not been loaded. #78192
Tablet::get_average_row_size() walked _rs_version_map without holding _meta_lock, against the contract that map is declared with. #79250
CACHE SELECT could crash the CN when the read schema contained complex-type columns and was reordered for predicate evaluation. #77245
The pipe_driver_queue_len metric had been missing from the BE /metrics output since v3.5.0. #77890
The profile dictionary carried a misspelled ZoneMapIndexFiter key that never matched what the BE emits, and the scan SampleTime counter reported a block count rather than elapsed time. #78728 #78732
BinaryColumnBase::replicate overflowed a 32-bit integer when computing the total size, which crashed the BE. #77545
The warning for JAVA_OPTS_FOR_JDK_11 and JAVA_OPTS_FOR_JDK_9_AND_LATER understated that these variables override JAVA_OPTS outright and that support for them will be removed. #78328
A runtime change of sys_log_level was written to the configuration but never applied, even though the item is documented as mutable. #79200
paimon-reader did not inherit the managed libthrift version. #78747