Antalya 25.8: update to 25.8.12

.github/workflows/release_branches.yml

@@ -770,6 +770,141 @@ jobs:
             python3 -m praktika run 'Install packages (arm_release)' --workflow "ReleaseBranchCI" --ci |& tee ./ci/tmp/job.log
           fi
 
+  stateless_tests_amd_asan_distributed_plan_parallel_1_2:
+    runs-on: [self-hosted, altinity-on-demand, altinity-func-tester]
+    needs: [config_workflow, dockers_build_amd, dockers_build_arm, build_amd_asan]
+    if: ${{ !failure() && !cancelled() && !contains(fromJson(needs.config_workflow.outputs.data).cache_success_base64, 'U3RhdGVsZXNzIHRlc3RzIChhbWRfYXNhbiwgZGlzdHJpYnV0ZWQgcGxhbiwgcGFyYWxsZWwsIDEvMik=') }}
+    name: "Stateless tests (amd_asan, distributed plan, parallel, 1/2)"
+    outputs:
+      data: ${{ steps.run.outputs.DATA }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.CHECKOUT_REF }}
+
+      - name: Setup
+        uses: ./.github/actions/runner_setup
+      - name: Docker setup
+        uses: ./.github/actions/docker_setup
+        with:
+          test_name: "Stateless tests (amd_asan, distributed plan, parallel, 1/2)"
+
+      - name: Prepare env script
+        run: |
+          rm -rf ./ci/tmp ./ci/tmp ./ci/tmp
+          mkdir -p ./ci/tmp ./ci/tmp ./ci/tmp
+          cat > ./ci/tmp/praktika_setup_env.sh << 'ENV_SETUP_SCRIPT_EOF'
+          export PYTHONPATH=./ci:.:
+          cat > ./ci/tmp/workflow_config_releasebranchci.json << 'EOF'
+          ${{ needs.config_workflow.outputs.data }}
+          EOF
+          cat > ./ci/tmp/workflow_status.json << 'EOF'
+          ${{ toJson(needs) }}
+          EOF
+          ENV_SETUP_SCRIPT_EOF
+
+      - name: Run
+        id: run
+        run: |
+          . ./ci/tmp/praktika_setup_env.sh
+          set -o pipefail
+          if command -v ts &> /dev/null; then
+            python3 -m praktika run 'Stateless tests (amd_asan, distributed plan, parallel, 1/2)' --workflow "ReleaseBranchCI" --ci |& ts '[%Y-%m-%d %H:%M:%S]' | tee ./ci/tmp/job.log
+          else
+            python3 -m praktika run 'Stateless tests (amd_asan, distributed plan, parallel, 1/2)' --workflow "ReleaseBranchCI" --ci |& tee ./ci/tmp/job.log
+          fi
+
+  stateless_tests_amd_asan_distributed_plan_parallel_2_2:
+    runs-on: [self-hosted, altinity-on-demand, altinity-func-tester]
+    needs: [config_workflow, dockers_build_amd, dockers_build_arm, build_amd_asan]
+    if: ${{ !failure() && !cancelled() && !contains(fromJson(needs.config_workflow.outputs.data).cache_success_base64, 'U3RhdGVsZXNzIHRlc3RzIChhbWRfYXNhbiwgZGlzdHJpYnV0ZWQgcGxhbiwgcGFyYWxsZWwsIDIvMik=') }}
+    name: "Stateless tests (amd_asan, distributed plan, parallel, 2/2)"
+    outputs:
+      data: ${{ steps.run.outputs.DATA }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.CHECKOUT_REF }}
+
+      - name: Setup
+        uses: ./.github/actions/runner_setup
+      - name: Docker setup
+        uses: ./.github/actions/docker_setup
+        with:
+          test_name: "Stateless tests (amd_asan, distributed plan, parallel, 2/2)"
+
+      - name: Prepare env script
+        run: |
+          rm -rf ./ci/tmp ./ci/tmp ./ci/tmp
+          mkdir -p ./ci/tmp ./ci/tmp ./ci/tmp
+          cat > ./ci/tmp/praktika_setup_env.sh << 'ENV_SETUP_SCRIPT_EOF'
+          export PYTHONPATH=./ci:.:
+          cat > ./ci/tmp/workflow_config_releasebranchci.json << 'EOF'
+          ${{ needs.config_workflow.outputs.data }}
+          EOF
+          cat > ./ci/tmp/workflow_status.json << 'EOF'
+          ${{ toJson(needs) }}
+          EOF
+          ENV_SETUP_SCRIPT_EOF
+
+      - name: Run
+        id: run
+        run: |
+          . ./ci/tmp/praktika_setup_env.sh
+          set -o pipefail
+          if command -v ts &> /dev/null; then
+            python3 -m praktika run 'Stateless tests (amd_asan, distributed plan, parallel, 2/2)' --workflow "ReleaseBranchCI" --ci |& ts '[%Y-%m-%d %H:%M:%S]' | tee ./ci/tmp/job.log
+          else
+            python3 -m praktika run 'Stateless tests (amd_asan, distributed plan, parallel, 2/2)' --workflow "ReleaseBranchCI" --ci |& tee ./ci/tmp/job.log
+          fi
+
+  stateless_tests_amd_asan_distributed_plan_sequential:
+    runs-on: [self-hosted, altinity-on-demand, altinity-func-tester]
+    needs: [config_workflow, dockers_build_amd, dockers_build_arm, build_amd_asan]
+    if: ${{ !failure() && !cancelled() && !contains(fromJson(needs.config_workflow.outputs.data).cache_success_base64, 'U3RhdGVsZXNzIHRlc3RzIChhbWRfYXNhbiwgZGlzdHJpYnV0ZWQgcGxhbiwgc2VxdWVudGlhbCk=') }}
+    name: "Stateless tests (amd_asan, distributed plan, sequential)"
+    outputs:
+      data: ${{ steps.run.outputs.DATA }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.CHECKOUT_REF }}
+
+      - name: Setup
+        uses: ./.github/actions/runner_setup
+      - name: Docker setup
+        uses: ./.github/actions/docker_setup
+        with:
+          test_name: "Stateless tests (amd_asan, distributed plan, sequential)"
+
+      - name: Prepare env script
+        run: |
+          rm -rf ./ci/tmp ./ci/tmp ./ci/tmp
+          mkdir -p ./ci/tmp ./ci/tmp ./ci/tmp
+          cat > ./ci/tmp/praktika_setup_env.sh << 'ENV_SETUP_SCRIPT_EOF'
+          export PYTHONPATH=./ci:.:
+          cat > ./ci/tmp/workflow_config_releasebranchci.json << 'EOF'
+          ${{ needs.config_workflow.outputs.data }}
+          EOF
+          cat > ./ci/tmp/workflow_status.json << 'EOF'
+          ${{ toJson(needs) }}
+          EOF
+          ENV_SETUP_SCRIPT_EOF
+
+      - name: Run
+        id: run
+        run: |
+          . ./ci/tmp/praktika_setup_env.sh
+          set -o pipefail
+          if command -v ts &> /dev/null; then
+            python3 -m praktika run 'Stateless tests (amd_asan, distributed plan, sequential)' --workflow "ReleaseBranchCI" --ci |& ts '[%Y-%m-%d %H:%M:%S]' | tee ./ci/tmp/job.log
+          else
+            python3 -m praktika run 'Stateless tests (amd_asan, distributed plan, sequential)' --workflow "ReleaseBranchCI" --ci |& tee ./ci/tmp/job.log
+          fi
+
   integration_tests_amd_asan_1_4:
     runs-on: [self-hosted, altinity-on-demand, altinity-func-tester]
     needs: [config_workflow, dockers_build_amd, dockers_build_arm, build_amd_asan]
@@ -1672,7 +1807,7 @@ jobs:
 
   finish_workflow:
     runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
-    needs: [config_workflow, dockers_build_amd, dockers_build_arm, build_amd_debug, build_amd_release, build_amd_asan, build_amd_tsan, build_amd_msan, build_amd_ubsan, build_arm_release, build_amd_darwin, build_arm_darwin, docker_server_image, docker_keeper_image, install_packages_amd_release, install_packages_arm_release, integration_tests_amd_asan_1_4, integration_tests_amd_asan_2_4, integration_tests_amd_asan_3_4, integration_tests_amd_asan_4_4, integration_tests_amd_asan_old_analyzer_1_6, integration_tests_amd_asan_old_analyzer_2_6, integration_tests_amd_asan_old_analyzer_3_6, integration_tests_amd_asan_old_analyzer_4_6, integration_tests_amd_asan_old_analyzer_5_6, integration_tests_amd_asan_old_analyzer_6_6, integration_tests_amd_tsan_1_6, integration_tests_amd_tsan_2_6, integration_tests_amd_tsan_3_6, integration_tests_amd_tsan_4_6, integration_tests_amd_tsan_5_6, integration_tests_amd_tsan_6_6, stress_test_amd_debug, stress_test_amd_tsan, stress_test_amd_ubsan, stress_test_amd_msan]
+    needs: [config_workflow, dockers_build_amd, dockers_build_arm, build_amd_debug, build_amd_release, build_amd_asan, build_amd_tsan, build_amd_msan, build_amd_ubsan, build_arm_release, build_amd_darwin, build_arm_darwin, docker_server_image, docker_keeper_image, install_packages_amd_release, install_packages_arm_release, stateless_tests_amd_asan_distributed_plan_parallel_1_2, stateless_tests_amd_asan_distributed_plan_parallel_2_2, stateless_tests_amd_asan_distributed_plan_sequential, integration_tests_amd_asan_1_4, integration_tests_amd_asan_2_4, integration_tests_amd_asan_3_4, integration_tests_amd_asan_4_4, integration_tests_amd_asan_old_analyzer_1_6, integration_tests_amd_asan_old_analyzer_2_6, integration_tests_amd_asan_old_analyzer_3_6, integration_tests_amd_asan_old_analyzer_4_6, integration_tests_amd_asan_old_analyzer_5_6, integration_tests_amd_asan_old_analyzer_6_6, integration_tests_amd_tsan_1_6, integration_tests_amd_tsan_2_6, integration_tests_amd_tsan_3_6, integration_tests_amd_tsan_4_6, integration_tests_amd_tsan_5_6, integration_tests_amd_tsan_6_6, stress_test_amd_debug, stress_test_amd_tsan, stress_test_amd_ubsan, stress_test_amd_msan]
     if: ${{ !cancelled() }}
     name: "Finish Workflow"
     outputs:

base/poco/Foundation/include/Poco/Exception.h

@@ -84,7 +84,7 @@ class Foundation_API Exception : public std::exception
     /// The copy can later be thrown again by
     /// invoking rethrow() on it.
 
-    virtual void rethrow() const;
+    [[noreturn]] virtual void rethrow() const;
     /// (Re)Throws the exception.
     ///
     /// This is useful for temporarily storing a

base/poco/Net/include/Poco/Net/HTTPChunkedStream.h

@@ -45,7 +45,7 @@ namespace Net
         ~HTTPChunkedStreamBuf();
         void close();
 
-        bool isComplete(bool read_from_device_to_check_eof = false);
+        bool isComplete(bool read_from_device_to_check_eof = false) noexcept;
 
     protected:
         int readFromDevice(char * buffer, std::streamsize length);

base/poco/Net/src/HTTPChunkedStream.cpp

@@ -140,7 +140,7 @@ int HTTPChunkedStreamBuf::readFromDevice(char* buffer, std::streamsize length)
 }
 
 
-bool HTTPChunkedStreamBuf::isComplete(bool read_from_device_to_check_eof)
+bool HTTPChunkedStreamBuf::isComplete(bool read_from_device_to_check_eof) noexcept
 {
 	if (read_from_device_to_check_eof)
 	{
@@ -150,7 +150,7 @@ bool HTTPChunkedStreamBuf::isComplete(bool read_from_device_to_check_eof)
 			/// "Unexpected EOF" exception would be thrown
 			readFromDevice(nullptr, 0);
 		}
-		catch (Poco::Net::MessageException &)
+		catch (...)
 		{
 			return false;
 		}

ci/workflows/release_branches.py

@@ -24,6 +24,7 @@
         JobConfigs.docker_sever,
         JobConfigs.docker_keeper,
         *JobConfigs.install_check_master_jobs,
+        *[job for job in JobConfigs.functional_tests_jobs if "asan" in job.name],
         *[
             job
             for job in JobConfigs.integration_test_asan_master_jobs

cmake/autogenerated_versions.txt

@@ -2,13 +2,13 @@
 
 # NOTE: VERSION_REVISION has nothing common with DBMS_TCP_PROTOCOL_VERSION,
 # only DBMS_TCP_PROTOCOL_VERSION should be incremented on protocol changes.
-SET(VERSION_REVISION 54509)
+SET(VERSION_REVISION 54512)
 SET(VERSION_MAJOR 25)
 SET(VERSION_MINOR 8)
-SET(VERSION_PATCH 9)
-SET(VERSION_GITHASH 8a2475033080b4a8d57b7771f52140af663dd4e0)
-SET(VERSION_DESCRIBE v25.8.9.20000.altinityantalya)
-SET(VERSION_STRING 25.8.9.20000.altinityantalya)
+SET(VERSION_PATCH 12)
+SET(VERSION_GITHASH fa393206741c830da77b8f1bcf18c753161932c8)
+SET(VERSION_DESCRIBE v25.8.12.20000.altinityantalya)
+SET(VERSION_STRING 25.8.12.20000.altinityantalya)
 # end of autochange
 
 # This is the 'base' tweak of the version, build scripts will

contrib/curl-cmake/CMakeLists.txt

@@ -19,6 +19,7 @@ set (SRCS
     "${LIBRARY_DIR}/lib/cf-h2-proxy.c"
     "${LIBRARY_DIR}/lib/cf-haproxy.c"
     "${LIBRARY_DIR}/lib/cf-https-connect.c"
+    "${LIBRARY_DIR}/lib/cf-ip-happy.c"
     "${LIBRARY_DIR}/lib/cf-socket.c"
     "${LIBRARY_DIR}/lib/cfilters.c"
     "${LIBRARY_DIR}/lib/conncache.c"
@@ -27,9 +28,9 @@ set (SRCS
     "${LIBRARY_DIR}/lib/cookie.c"
     "${LIBRARY_DIR}/lib/cshutdn.c"
     "${LIBRARY_DIR}/lib/curl_addrinfo.c"
-    "${LIBRARY_DIR}/lib/curl_des.c"
     "${LIBRARY_DIR}/lib/curl_endian.c"
     "${LIBRARY_DIR}/lib/curl_fnmatch.c"
+    "${LIBRARY_DIR}/lib/curl_fopen.c"
     "${LIBRARY_DIR}/lib/curl_get_line.c"
     "${LIBRARY_DIR}/lib/curl_gethostname.c"
     "${LIBRARY_DIR}/lib/curl_gssapi.c"
@@ -54,7 +55,6 @@ set (SRCS
     "${LIBRARY_DIR}/lib/fake_addrinfo.c"
     "${LIBRARY_DIR}/lib/file.c"
     "${LIBRARY_DIR}/lib/fileinfo.c"
-    "${LIBRARY_DIR}/lib/fopen.c"
     "${LIBRARY_DIR}/lib/formdata.c"
     "${LIBRARY_DIR}/lib/ftp.c"
     "${LIBRARY_DIR}/lib/ftplistparser.c"
@@ -81,7 +81,6 @@ set (SRCS
     "${LIBRARY_DIR}/lib/idn.c"
     "${LIBRARY_DIR}/lib/if2ip.c"
     "${LIBRARY_DIR}/lib/imap.c"
-    "${LIBRARY_DIR}/lib/krb5.c"
     "${LIBRARY_DIR}/lib/ldap.c"
     "${LIBRARY_DIR}/lib/llist.c"
     "${LIBRARY_DIR}/lib/macos.c"
@@ -93,6 +92,7 @@ set (SRCS
     "${LIBRARY_DIR}/lib/mqtt.c"
     "${LIBRARY_DIR}/lib/multi.c"
     "${LIBRARY_DIR}/lib/multi_ev.c"
+    "${LIBRARY_DIR}/lib/multi_ntfy.c"
     "${LIBRARY_DIR}/lib/netrc.c"
     "${LIBRARY_DIR}/lib/noproxy.c"
     "${LIBRARY_DIR}/lib/openldap.c"
@@ -170,16 +170,18 @@ set (SRCS
     "${LIBRARY_DIR}/lib/vtls/x509asn1.c"
     "${LIBRARY_DIR}/lib/curlx/base64.c"
     "${LIBRARY_DIR}/lib/curlx/dynbuf.c"
+    "${LIBRARY_DIR}/lib/curlx/fopen.c"
     "${LIBRARY_DIR}/lib/curlx/inet_ntop.c"
     "${LIBRARY_DIR}/lib/curlx/inet_pton.c"
     "${LIBRARY_DIR}/lib/curlx/multibyte.c"
     "${LIBRARY_DIR}/lib/curlx/nonblock.c"
+    "${LIBRARY_DIR}/lib/curlx/strerr.c"
     "${LIBRARY_DIR}/lib/curlx/strparse.c"
     "${LIBRARY_DIR}/lib/curlx/timediff.c"
     "${LIBRARY_DIR}/lib/curlx/timeval.c"
     "${LIBRARY_DIR}/lib/curlx/version_win32.c"
-    "${LIBRARY_DIR}/lib/curlx/warnless.c"
     "${LIBRARY_DIR}/lib/curlx/wait.c"
+    "${LIBRARY_DIR}/lib/curlx/warnless.c"
     "${LIBRARY_DIR}/lib/curlx/winapi.c"
 )
 

contrib/icu-cmake/CMakeLists.txt

@@ -40,6 +40,7 @@ set(ICUUC_SOURCES
 "${ICU_SOURCE_DIR}/common/errorcode.cpp"
 "${ICU_SOURCE_DIR}/common/filteredbrk.cpp"
 "${ICU_SOURCE_DIR}/common/filterednormalizer2.cpp"
+"${ICU_SOURCE_DIR}/common/fixedstring.cpp"
 "${ICU_SOURCE_DIR}/common/icudataver.cpp"
 "${ICU_SOURCE_DIR}/common/icuplug.cpp"
 "${ICU_SOURCE_DIR}/common/loadednormalizer2impl.cpp"
@@ -478,11 +479,11 @@ enable_language(ASM)
 
 if (OS_DARWIN)
     # Fine for both x86 and ARM
-    set(ICUDATA_SOURCE_FILE "${ICUDATA_SOURCE_DIR}/darwin_x86_64/icudt75l_dat.S")
+    set(ICUDATA_SOURCE_FILE "${ICUDATA_SOURCE_DIR}/darwin/icudt78l_dat.S")
 elseif (ARCH_S390X)
-    set(ICUDATA_SOURCE_FILE "${ICUDATA_SOURCE_DIR}/icudt75b_dat.S")
+    set(ICUDATA_SOURCE_FILE "${ICUDATA_SOURCE_DIR}/icudt78b_dat.S")
 else ()
-    set(ICUDATA_SOURCE_FILE "${ICUDATA_SOURCE_DIR}/icudt75l_dat.S")
+    set(ICUDATA_SOURCE_FILE "${ICUDATA_SOURCE_DIR}/icudt78l_dat.S")
 endif ()
 # ^^ you might be confused how for different little endian platforms (x86, ARM) the same assembly files can be used.
 # These files are indeed assembly but they only contain data ('.long' directive), which makes them portable accross CPUs.

contrib/libarchive-cmake/config.h

@@ -334,16 +334,16 @@ typedef uint64_t uintmax_t;
 /* #undef ARCHIVE_XATTR_LINUX */
 
 /* Version number of bsdcpio */
-#define BSDCPIO_VERSION_STRING "3.7.4"
+#define BSDCPIO_VERSION_STRING "3.9.0"
 
 /* Version number of bsdtar */
-#define BSDTAR_VERSION_STRING "3.7.4"
+#define BSDTAR_VERSION_STRING "3.9.0"
 
 /* Version number of bsdcat */
-#define BSDCAT_VERSION_STRING "3.7.4"
+#define BSDCAT_VERSION_STRING "3.9.0"
 
 /* Version number of bsdunzip */
-#define BSDUNZIP_VERSION_STRING "3.7.4"
+#define BSDUNZIP_VERSION_STRING "3.9.0"
 
 /* Define to 1 if you have the `acl_create_entry' function. */
 /* #undef HAVE_ACL_CREATE_ENTRY */
@@ -405,6 +405,12 @@ typedef uint64_t uintmax_t;
 /* Define to 1 if you have the `chroot' function. */
 #define HAVE_CHROOT 1
 
+/* Define to 1 if you have the `closefrom' function. */
+/* #undef HAVE_CLOSEFROM */
+
+/* Define to 1 if you have the `close_range' function. */
+/* #undef HAVE_CLOSE_RANGE */
+
 /* Define to 1 if you have the <copyfile.h> header file. */
 /* #undef HAVE_COPYFILE_H */
 

docs/en/sql-reference/statements/grant.md

@@ -680,6 +680,23 @@ GRANT READ ON S3('s3://foo/.*') TO john
 GRANT READ ON S3('s3://bar/.*') TO john
 ```
 
+:::warning
+Source filter takes **regexp** as a parameter, so a grant
+`GRANT READ ON URL('http://www.google.com') TO john;`
+
+will allow queries
+```sql
+SELECT * FROM url('https://www.google.com');
+SELECT * FROM url('https://www-google.com');
+```
+
+because `.` is treated as an `Any Single Character` in the regexps. 
+This may lead to potential vulnerability. The correct grant should be
+```sql
+GRANT READ ON URL('https://www\.google\.com') TO john;
+```
+:::
+
 **Re-granting with GRANT OPTION:**
 
 If the original grant has `WITH GRANT OPTION`, it can be re-granted using `GRANT CURRENT GRANTS`:

packages/clickhouse-keeper.postinstall

@@ -28,6 +28,25 @@ if [ "$1" = configure ] || [ -n "$not_deb_os" ]; then
             "${KEEPER_USER}"
     fi
 
+    if [ -x "/bin/systemctl" ] && [ -f /lib/systemd/system/clickhouse-keeper.service ] && [ -d /run/systemd/system ]; then
+        # if old rc.d service present - remove it
+        if [ -x "/etc/init.d/clickhouse-keeper" ] && [ -x "/usr/sbin/update-rc.d" ]; then
+            /usr/sbin/update-rc.d clickhouse-keeper remove
+        fi
+
+        /bin/systemctl daemon-reload
+        /bin/systemctl enable clickhouse-keeper
+    else
+        # If you downgrading to version older than 1.1.54336 run: systemctl disable clickhouse-keeper
+        if [ -x "/etc/init.d/clickhouse-keeper" ]; then
+            if [ -x "/usr/sbin/update-rc.d" ]; then
+                /usr/sbin/update-rc.d clickhouse-keeper defaults 19 19 >/dev/null || exit $?
+            else
+                echo # Other OS
+            fi
+        fi
+    fi
+
     chown -R "${KEEPER_USER}:${KEEPER_GROUP}" "${KEEPER_CONFDIR}"
     chmod 0755 "${KEEPER_CONFDIR}"