Antalya 25.8 Change base to v25.8.11.66 lts

.github/workflows/master.yml

@@ -4178,7 +4178,7 @@ jobs:
     secrets: inherit
     with:
       runner_type: altinity-on-demand, altinity-regression-tester
-      commit: fc19ce3a7322a10ab791de755c950a56744a12e7
+      commit: 4a249bc0422d93c6e466edbe5af74fcb0f564820
       arch: release
       build_sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
       timeout_minutes: 300
@@ -4190,7 +4190,7 @@ jobs:
     secrets: inherit
     with:
       runner_type: altinity-on-demand, altinity-regression-tester-aarch64
-      commit: fc19ce3a7322a10ab791de755c950a56744a12e7
+      commit: 4a249bc0422d93c6e466edbe5af74fcb0f564820
       arch: aarch64
       build_sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
       timeout_minutes: 300

.github/workflows/pull_request.yml

@@ -4134,7 +4134,7 @@ jobs:
     secrets: inherit
     with:
       runner_type: altinity-on-demand, altinity-regression-tester
-      commit: fc19ce3a7322a10ab791de755c950a56744a12e7
+      commit: 4a249bc0422d93c6e466edbe5af74fcb0f564820
       arch: release
       build_sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
       timeout_minutes: 300
@@ -4146,7 +4146,7 @@ jobs:
     secrets: inherit
     with:
       runner_type: altinity-on-demand, altinity-regression-tester-aarch64
-      commit: fc19ce3a7322a10ab791de755c950a56744a12e7
+      commit: 4a249bc0422d93c6e466edbe5af74fcb0f564820
       arch: aarch64
       build_sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
       timeout_minutes: 300

ci/praktika/yaml_additional_templates.py

@@ -35,7 +35,7 @@ class AltinityWorkflowTemplates:
           echo "Workflow Run Report: [View Report]($REPORT_LINK)" >> $GITHUB_STEP_SUMMARY
 """
     # Additional jobs
-    REGRESSION_HASH = "fc19ce3a7322a10ab791de755c950a56744a12e7"
+    REGRESSION_HASH = "4a249bc0422d93c6e466edbe5af74fcb0f564820"
     ALTINITY_JOBS = {
         "GrypeScan": r"""
   GrypeScanServer:

cmake/autogenerated_versions.txt

@@ -2,13 +2,13 @@
 
 # NOTE: VERSION_REVISION has nothing common with DBMS_TCP_PROTOCOL_VERSION,
 # only DBMS_TCP_PROTOCOL_VERSION should be incremented on protocol changes.
-SET(VERSION_REVISION 54509)
+SET(VERSION_REVISION 54511)
 SET(VERSION_MAJOR 25)
 SET(VERSION_MINOR 8)
-SET(VERSION_PATCH 9)
-SET(VERSION_GITHASH 8a2475033080b4a8d57b7771f52140af663dd4e0)
-SET(VERSION_DESCRIBE v25.8.9.20000.altinityantalya)
-SET(VERSION_STRING 25.8.9.20000.altinityantalya)
+SET(VERSION_PATCH 11)
+SET(VERSION_GITHASH 02ec3a1ea1e08fb18d2d9638f00b2b557fa1cc1c)
+SET(VERSION_DESCRIBE v25.8.11.20000.altinityantalya)
+SET(VERSION_STRING 25.8.11.20000.altinityantalya)
 # end of autochange
 
 # This is the 'base' tweak of the version, build scripts will

docs/en/sql-reference/statements/grant.md

@@ -680,6 +680,23 @@ GRANT READ ON S3('s3://foo/.*') TO john
 GRANT READ ON S3('s3://bar/.*') TO john
 ```
 
+:::warning
+Source filter takes **regexp** as a parameter, so a grant
+`GRANT READ ON URL('http://www.google.com') TO john;`
+
+will allow queries
+```sql
+SELECT * FROM url('https://www.google.com');
+SELECT * FROM url('https://www-google.com');
+```
+
+because `.` is treated as an `Any Single Character` in the regexps. 
+This may lead to potential vulnerability. The correct grant should be
+```sql
+GRANT READ ON URL('https://www\.google\.com') TO john;
+```
+:::
+
 **Re-granting with GRANT OPTION:**
 
 If the original grant has `WITH GRANT OPTION`, it can be re-granted using `GRANT CURRENT GRANTS`:

packages/clickhouse-keeper.postinstall

@@ -28,6 +28,25 @@ if [ "$1" = configure ] || [ -n "$not_deb_os" ]; then
             "${KEEPER_USER}"
     fi
 
+    if [ -x "/bin/systemctl" ] && [ -f /lib/systemd/system/clickhouse-keeper.service ] && [ -d /run/systemd/system ]; then
+        # if old rc.d service present - remove it
+        if [ -x "/etc/init.d/clickhouse-keeper" ] && [ -x "/usr/sbin/update-rc.d" ]; then
+            /usr/sbin/update-rc.d clickhouse-keeper remove
+        fi
+
+        /bin/systemctl daemon-reload
+        /bin/systemctl enable clickhouse-keeper
+    else
+        # If you downgrading to version older than 1.1.54336 run: systemctl disable clickhouse-keeper
+        if [ -x "/etc/init.d/clickhouse-keeper" ]; then
+            if [ -x "/usr/sbin/update-rc.d" ]; then
+                /usr/sbin/update-rc.d clickhouse-keeper defaults 19 19 >/dev/null || exit $?
+            else
+                echo # Other OS
+            fi
+        fi
+    fi
+
     chown -R "${KEEPER_USER}:${KEEPER_GROUP}" "${KEEPER_CONFDIR}"
     chmod 0755 "${KEEPER_CONFDIR}"
 

src/AggregateFunctions/DDSketch.h

@@ -1,49 +1,49 @@
 #pragma once
 
-#include <memory> // for std::unique_ptr
-#include <cmath>
-#include <stdexcept>
 #include <limits>
-#include <iostream>
+#include <memory> // for std::unique_ptr
 #include <base/types.h>
 
-#include <IO/ReadBuffer.h>
-#include <IO/WriteBuffer.h>
-
+#include <AggregateFunctions/DDSketch/DDSketchEncoding.h>
 #include <AggregateFunctions/DDSketch/Mapping.h>
 #include <AggregateFunctions/DDSketch/Store.h>
-#include <AggregateFunctions/DDSketch/DDSketchEncoding.h>
+#include <IO/ReadBuffer.h>
+#include <IO/ReadHelpers.h>
+#include <IO/WriteBuffer.h>
+#include <IO/WriteHelpers.h>
+#include <Common/Exception.h>
 
 namespace DB
 {
 
 namespace ErrorCodes
 {
-    extern const int BAD_ARGUMENTS;
-    extern const int INCORRECT_DATA;
+extern const int BAD_ARGUMENTS;
+extern const int INCORRECT_DATA;
 }
 
 class DDSketchDenseLogarithmic
 {
 public:
     explicit DDSketchDenseLogarithmic(Float64 relative_accuracy = 0.01)
-        : mapping(std::make_unique<DDSketchLogarithmicMapping>(relative_accuracy)),
-          store(std::make_unique<DDSketchDenseStore>()),
-          negative_store(std::make_unique<DDSketchDenseStore>()),
-          zero_count(0.0),
-          count(0.0)
+        : mapping(std::make_unique<DDSketchLogarithmicMapping>(relative_accuracy))
+        , store(std::make_unique<DDSketchDenseStore>())
+        , negative_store(std::make_unique<DDSketchDenseStore>())
+        , zero_count(0.0)
+        , count(0.0)
     {
     }
 
-    DDSketchDenseLogarithmic(std::unique_ptr<DDSketchLogarithmicMapping> mapping_,
-             std::unique_ptr<DDSketchDenseStore> store_,
-             std::unique_ptr<DDSketchDenseStore> negative_store_,
-             Float64 zero_count_)
-        : mapping(std::move(mapping_)),
-          store(std::move(store_)),
-          negative_store(std::move(negative_store_)),
-          zero_count(zero_count_),
-          count(store->count + negative_store->count + zero_count_)
+    DDSketchDenseLogarithmic(
+        std::unique_ptr<DDSketchLogarithmicMapping> mapping_,
+        std::unique_ptr<DDSketchDenseStore> store_,
+        std::unique_ptr<DDSketchDenseStore> negative_store_,
+        Float64 zero_count_)
+        : mapping(std::move(mapping_))
+        , store(std::move(store_))
+        , negative_store(std::move(negative_store_))
+        , zero_count(zero_count_)
+        , count(store->count + negative_store->count + zero_count_)
     {
     }
 
@@ -97,7 +97,11 @@ class DDSketchDenseLogarithmic
         return quantile_value;
     }
 
-    void copy(const DDSketchDenseLogarithmic& other)
+    Float64 getGamma() const { return mapping->getGamma(); }
+
+    Float64 getCount() const { return count; }
+
+    void copy(const DDSketchDenseLogarithmic & other)
     {
         Float64 rel_acc = (other.mapping->getGamma() - 1) / (other.mapping->getGamma() + 1);
         mapping = std::make_unique<DDSketchLogarithmicMapping>(rel_acc);
@@ -109,9 +113,9 @@ class DDSketchDenseLogarithmic
         count = other.count;
     }
 
-    void merge(const DDSketchDenseLogarithmic& other)
+    void merge(const DDSketchDenseLogarithmic & other)
     {
-        if (mapping->getGamma() != other.mapping->getGamma())
+        if (*mapping != *other.mapping)
         {
             // modify the one with higher precision to match the one with lower precision
             if (mapping->getGamma() > other.mapping->getGamma())
@@ -147,7 +151,7 @@ class DDSketchDenseLogarithmic
 
     /// NOLINTBEGIN(readability-static-accessed-through-instance)
 
-    void serialize(WriteBuffer& buf) const
+    void serialize(WriteBuffer & buf) const
     {
         // Write the mapping
         writeBinary(enc.FlagIndexMappingBaseLogarithmic.byte, buf);
@@ -165,7 +169,7 @@ class DDSketchDenseLogarithmic
         writeBinary(zero_count, buf);
     }
 
-    void deserialize(ReadBuffer& buf)
+    void deserialize(ReadBuffer & buf)
     {
         // Read the mapping
         UInt8 flag = 0;
@@ -219,7 +223,7 @@ class DDSketchDenseLogarithmic
         auto new_positive_store = std::make_unique<DDSketchDenseStore>();
         auto new_negative_store = std::make_unique<DDSketchDenseStore>();
 
-        auto remap_store = [this, &new_mapping](DDSketchDenseStore& old_store, std::unique_ptr<DDSketchDenseStore>& target_store)
+        auto remap_store = [this, &new_mapping](DDSketchDenseStore & old_store, std::unique_ptr<DDSketchDenseStore> & target_store)
         {
             for (int i = 0; i < old_store.length(); ++i)
             {

src/AggregateFunctions/DDSketch/DDSketchEncoding.h

@@ -1,7 +1,6 @@
 #pragma once
 
-#include <vector>
-#include <stdexcept>
+#include <base/types.h>
 
 /**
   * An encoded DDSketch comprises multiple contiguous blocks (sequences of bytes).
@@ -36,7 +35,10 @@ class DDSketchEncoding
     {
     public:
         UInt8 byte;
-        Flag(UInt8 t, UInt8 s) : byte(t | s) { }
+        Flag(UInt8 t, UInt8 s)
+            : byte(t | s)
+        {
+        }
         [[maybe_unused]] UInt8 Type() const { return byte & flagTypeMask; }
         [[maybe_unused]] UInt8 SubFlag() const { return byte & subFlagMask; }
     };

src/AggregateFunctions/DDSketch/Mapping.h

@@ -1,26 +1,29 @@
 #pragma once
 
-#include <base/types.h>
 #include <cmath>
-#include <stdexcept>
 #include <limits>
+#include <base/types.h>
 
 #include <IO/ReadBuffer.h>
+#include <IO/ReadHelpers.h>
 #include <IO/WriteBuffer.h>
+#include <IO/WriteHelpers.h>
+#include <Common/Exception.h>
 
 namespace DB
 {
 
 namespace ErrorCodes
 {
-    extern const int BAD_ARGUMENTS;
+extern const int BAD_ARGUMENTS;
 }
 
 class DDSketchLogarithmicMapping
 {
 public:
     explicit DDSketchLogarithmicMapping(Float64 relative_accuracy_, Float64 offset_ = 0.0)
-        : relative_accuracy(relative_accuracy_), offset(offset_)
+        : relative_accuracy(relative_accuracy_)
+        , offset(offset_)
     {
         if (relative_accuracy <= 0 || relative_accuracy >= 1)
         {
@@ -44,48 +47,40 @@ class DDSketchLogarithmicMapping
         return static_cast<int>(logGamma(value) + offset);
     }
 
-    Float64 value(int key) const
-    {
-        return lowerBound(key) * (1 + relative_accuracy);
-    }
+    Float64 value(int key) const { return lowerBound(key) * (1 + relative_accuracy); }
 
-    Float64 logGamma(Float64 value) const
-    {
-        return std::log(value) * multiplier;
-    }
+    Float64 logGamma(Float64 value) const { return std::log(value) * multiplier; }
 
-    Float64 powGamma(Float64 value) const
-    {
-        return std::exp(value / multiplier);
-    }
+    Float64 powGamma(Float64 value) const { return std::exp(value / multiplier); }
 
-    Float64 lowerBound(int index) const
-    {
-        return powGamma(static_cast<Float64>(index) - offset);
-    }
+    Float64 lowerBound(int index) const { return powGamma(static_cast<Float64>(index) - offset); }
 
-    Float64 getGamma() const
-    {
-        return gamma;
-    }
+    Float64 getGamma() const { return gamma; }
 
-    Float64 getMinPossible() const
-    {
-        return min_possible;
-    }
+    Float64 getMinPossible() const { return min_possible; }
 
-    [[maybe_unused]] Float64 getMaxPossible() const
+    [[maybe_unused]] Float64 getMaxPossible() const { return max_possible; }
+
+    bool operator==(const DDSketchLogarithmicMapping & other) const
     {
-        return max_possible;
+        if (gamma == other.gamma)
+        {
+            return true;
+        }
+
+        auto [min, max] = std::minmax(gamma, other.gamma);
+        const Float64 difference = max - min;
+        const Float64 acceptable = (std::nextafter(min, max) - min) * min;
+        return difference <= acceptable;
     }
 
-    void serialize(WriteBuffer& buf) const
+    void serialize(WriteBuffer & buf) const
     {
         writeBinary(gamma, buf);
         writeBinary(offset, buf);
     }
 
-    void deserialize(ReadBuffer& buf)
+    void deserialize(ReadBuffer & buf)
     {
         readBinary(gamma, buf);
         readBinary(offset, buf);