Antalya 26.3: Bump to 26.3.17

base/poco/JSON/include/Poco/JSON/ParserImpl.h

@@ -43,6 +43,9 @@ namespace JSON
         static const std::size_t JSON_PARSE_BUFFER_SIZE = 4096;
         static const std::size_t JSON_PARSER_STACK_SIZE = 128;
         static const int JSON_UNLIMITED_DEPTH = -1;
+        /// Default nesting limit so that parsing untrusted JSON cannot overflow the native stack via
+        /// Poco's recursive descent. Far above any legitimate JSON; raise per-parser with setDepth.
+        static const int JSON_DEFAULT_DEPTH = 1000;
 
         ParserImpl(const Handler::Ptr & pHandler = new ParseHandler, std::size_t bufSize = JSON_PARSE_BUFFER_SIZE);
         /// Creates JSON ParserImpl, using the given Handler and buffer size.
@@ -109,6 +112,7 @@ namespace JSON
         struct json_stream * _pJSON;
         Handler::Ptr _pHandler;
         int _depth;
+        int _currentDepth = 0;
         char _decimalPoint;
         bool _allowNullByte;
         bool _allowComments;

base/poco/JSON/src/ParserImpl.cpp

@@ -37,7 +37,7 @@ namespace JSON {
 ParserImpl::ParserImpl(const Handler::Ptr& pHandler, std::size_t bufSize):
 	_pJSON(new json_stream),
 	_pHandler(pHandler),
-	_depth(JSON_UNLIMITED_DEPTH),
+	_depth(JSON_DEFAULT_DEPTH),
 	_decimalPoint('.'),
 	_allowNullByte(true),
 	_allowComments(false)
@@ -53,6 +53,7 @@ ParserImpl::~ParserImpl()
 
 void ParserImpl::handle(const std::string& json)
 {
+	_currentDepth = 0;
 	if (!_allowNullByte && json.find("\\u0000") != json.npos)
 		throw JSONException("Null bytes in strings not allowed.");
 
@@ -139,6 +140,12 @@ void ParserImpl::stripComments(std::string& json)
 
 void ParserImpl::handleArray()
 {
+	// Enforce the configured depth limit (set via setDepth) to avoid a native-stack
+	// overflow on deeply nested input. _depth == JSON_UNLIMITED_DEPTH (-1) means no limit.
+	if (_depth != JSON_UNLIMITED_DEPTH && _currentDepth >= _depth)
+		throw JSONException("Maximum allowed JSON depth exceeded");
+	++_currentDepth;
+
 	json_type tok = json_peek(_pJSON);
 	while (tok != JSON_ARRAY_END && checkError())
 	{
@@ -148,11 +155,17 @@ void ParserImpl::handleArray()
 
 	if (tok == JSON_ARRAY_END) handle();
 	else throw JSONException("JSON array end not found");
+
+	--_currentDepth;
 }
 
 
 void ParserImpl::handleObject()
 {
+	if (_depth != JSON_UNLIMITED_DEPTH && _currentDepth >= _depth)
+		throw JSONException("Maximum allowed JSON depth exceeded");
+	++_currentDepth;
+
 	json_type tok = json_peek(_pJSON);
 	while (tok != JSON_OBJECT_END && checkError())
 	{
@@ -166,6 +179,8 @@ void ParserImpl::handleObject()
 
 	if (tok == JSON_OBJECT_END) handle();
 	else throw JSONException("JSON object end not found");
+
+	--_currentDepth;
 }
 
 

base/poco/Net/src/TCPServer.cpp

@@ -153,9 +153,9 @@ void TCPServer::run()
                     }
                 }
                 // Termination request
-                catch (Poco::InvalidArgumentException&)
+                catch (Poco::InvalidArgumentException& exc)
                 {
-                    break;
+                    ErrorHandler::logMessage(Message::PRIO_INFORMATION, "Shutting down TCPServer: " + exc.displayText());
                 }
                 catch (Poco::Exception& exc)
                 {

ci/docker/integration/mysql_java_client/Dockerfile

@@ -6,10 +6,13 @@ FROM eclipse-temurin:21-jdk-alpine
 
 RUN apk --no-cache add curl
 
-# Pin to 8.1.0 (original version): Connector/J 8.2.0+ and 9.x introduce breaking
-# changes to the ClickHouse MySQL protocol handshake. CLASSPATH=. is required so
-# javac-compiled .class files in the WORKDIR are found at runtime.
-ARG ver=8.1.0
+# Connector/J 8.2.0+ (including 9.x) reads the `info` field of the MySQL `OK`
+# packet as a length-encoded string; it used to be pinned to 8.1.0 because
+# ClickHouse wrote that field as a plain string and newer drivers failed to
+# connect. Fixed by length-encoding `info` (see #84542), so test against a
+# modern driver. CLASSPATH=. is required so javac-compiled .class files in the
+# WORKDIR are found at runtime.
+ARG ver=9.7.0
 RUN curl -L -o /mysql-connector-j-${ver}.jar https://repo1.maven.org/maven2/com/mysql/mysql-connector-j/${ver}/mysql-connector-j-${ver}.jar
 ENV CLASSPATH=.:/mysql-connector-j-${ver}.jar
 

cmake/autogenerated_versions.txt

@@ -2,13 +2,13 @@
 
 # NOTE: VERSION_REVISION has nothing common with DBMS_TCP_PROTOCOL_VERSION,
 # only DBMS_TCP_PROTOCOL_VERSION should be incremented on protocol changes.
-SET(VERSION_REVISION 54520)
+SET(VERSION_REVISION 54524)
 SET(VERSION_MAJOR 26)
 SET(VERSION_MINOR 3)
-SET(VERSION_PATCH 13)
-SET(VERSION_GITHASH d23c7536b980c34b39c850b08ef23c509f06aaaa)
-SET(VERSION_DESCRIBE v26.3.13.20001.altinityantalya)
-SET(VERSION_STRING 26.3.13.20001.altinityantalya)
+SET(VERSION_PATCH 17)
+SET(VERSION_GITHASH f3c09372ed98d0201254b0b7d1d87e180205801c)
+SET(VERSION_DESCRIBE v26.3.17.20001.altinityantalya)
+SET(VERSION_STRING 26.3.17.20001.altinityantalya)
 # end of autochange
 
 SET(VERSION_TWEAK 20001)

contrib/corrosion-cmake/CMakeLists.txt

@@ -134,7 +134,10 @@ if (SANITIZE STREQUAL "memory")
 elseif (SANITIZE STREQUAL "thread")
     set(RUST_CARGO_BUILD_STD "-Zbuild-std=std,panic_abort,core,alloc")
     list(APPEND RUSTFLAGS "-Zsanitizer=thread")
-elseif (SANITIZE STREQUAL "address")
+elseif (SANITIZE STREQUAL "address" OR SANITIZE STREQUAL "address,undefined")
+    # Rust has no UBSan, so the combined ASan+UBSan build applies only ASan. Besides the
+    # instrumentation itself, `-Zsanitizer=address` arms wasmtime's `cfg(asan)` guard, preventing
+    # a stray munmap of live memory at thread exit: https://github.com/bytecodealliance/wasmtime/issues/13857
     set(RUST_CARGO_BUILD_STD "-Zbuild-std=std,panic_abort,core,alloc")
     list(APPEND RUSTFLAGS "-Zsanitizer=address")
 endif()

contrib/curl-cmake/CMakeLists.txt

@@ -15,6 +15,7 @@ set (SRCS
     "${LIBRARY_DIR}/lib/asyn-thrdd.c"
     "${LIBRARY_DIR}/lib/bufq.c"
     "${LIBRARY_DIR}/lib/bufref.c"
+    "${LIBRARY_DIR}/lib/cf-dns.c"
     "${LIBRARY_DIR}/lib/cf-h1-proxy.c"
     "${LIBRARY_DIR}/lib/cf-h2-proxy.c"
     "${LIBRARY_DIR}/lib/cf-haproxy.c"
@@ -37,7 +38,6 @@ set (SRCS
     "${LIBRARY_DIR}/lib/curl_memrchr.c"
     "${LIBRARY_DIR}/lib/curl_ntlm_core.c"
     "${LIBRARY_DIR}/lib/curl_range.c"
-    "${LIBRARY_DIR}/lib/curl_rtmp.c"
     "${LIBRARY_DIR}/lib/curl_sasl.c"
     "${LIBRARY_DIR}/lib/curl_sha512_256.c"
     "${LIBRARY_DIR}/lib/curl_share.c"
@@ -47,6 +47,7 @@ set (SRCS
     "${LIBRARY_DIR}/lib/cw-out.c"
     "${LIBRARY_DIR}/lib/cw-pause.c"
     "${LIBRARY_DIR}/lib/dict.c"
+    "${LIBRARY_DIR}/lib/dnscache.c"
     "${LIBRARY_DIR}/lib/doh.c"
     "${LIBRARY_DIR}/lib/dynhds.c"
     "${LIBRARY_DIR}/lib/easy.c"
@@ -100,6 +101,7 @@ set (SRCS
     "${LIBRARY_DIR}/lib/pingpong.c"
     "${LIBRARY_DIR}/lib/pop3.c"
     "${LIBRARY_DIR}/lib/progress.c"
+    "${LIBRARY_DIR}/lib/protocol.c"
     "${LIBRARY_DIR}/lib/psl.c"
     "${LIBRARY_DIR}/lib/rand.c"
     "${LIBRARY_DIR}/lib/ratelimit.c"
@@ -123,6 +125,8 @@ set (SRCS
     "${LIBRARY_DIR}/lib/system_win32.c"
     "${LIBRARY_DIR}/lib/telnet.c"
     "${LIBRARY_DIR}/lib/tftp.c"
+    "${LIBRARY_DIR}/lib/thrdpool.c"
+    "${LIBRARY_DIR}/lib/thrdqueue.c"
     "${LIBRARY_DIR}/lib/transfer.c"
     "${LIBRARY_DIR}/lib/uint-bset.c"
     "${LIBRARY_DIR}/lib/uint-hash.c"

contrib/curl-cmake/curl_config.h

@@ -57,8 +57,10 @@
 
 #define ENABLE_IPV6
 #define USE_OPENSSL
-#define USE_THREADS_POSIX
+#define HAVE_THREADS_POSIX
 #define USE_ARES
+#define USE_RESOLV_ARES
+#define CURL_ENABLE_NTLM
 
 #ifdef __illumos__
 #define HAVE_POSIX_STRERROR_R 1

contrib/libarchive-cmake/config.h

@@ -1028,6 +1028,9 @@ typedef uint64_t uintmax_t;
 /* Define to 1 if you have the <stdarg.h> header file. */
 #define HAVE_STDARG_H 1
 
+/* Define to 1 if you have the <stdckdint.h> header file. */
+#define HAVE_STDCKDINT_H 1
+
 /* Define to 1 if you have the <stdint.h> header file. */
 #define HAVE_STDINT_H 1
 

contrib/libxml2-cmake/linux_x86_64/include/config.h

@@ -77,7 +77,7 @@
 #define PACKAGE_NAME "libxml2"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "libxml2 2.15.1"
+#define PACKAGE_STRING "libxml2 2.15.3"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "libxml2"
@@ -86,15 +86,15 @@
 #define PACKAGE_URL ""
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "2.15.1"
+#define PACKAGE_VERSION "2.15.3"
 
 /* Define to 1 if all of the C90 standard headers exist (not just the ones
    required in a freestanding environment). This macro is provided for
    backward compatibility; new code need not use it. */
 #define STDC_HEADERS 1
 
 /* Version number of package */
-#define VERSION "2.15.1"
+#define VERSION "2.15.3"
 
 /* System configuration directory (/etc) */
 #define XML_SYSCONFDIR "/usr/local/etc"

contrib/libxml2-cmake/linux_x86_64/include/libxml/xmlversion.h

@@ -16,17 +16,17 @@
 /**
  * the version string like "1.2.3"
  */
-#define LIBXML_DOTTED_VERSION "2.15.1"
+#define LIBXML_DOTTED_VERSION "2.15.3"
 
 /**
  * the version number: 1.2.3 value is 10203
  */
-#define LIBXML_VERSION 21501
+#define LIBXML_VERSION 21503
 
 /**
  * the version number string, 1.2.3 value is "10203"
  */
-#define LIBXML_VERSION_STRING "21501"
+#define LIBXML_VERSION_STRING "21503"
 
 /**
  * extra version information, used to show a git commit description
@@ -37,7 +37,7 @@
  * Macro to check that the libxml version in use is compatible with
  * the version the software has been compiled against
  */
-#define LIBXML_TEST_VERSION xmlCheckVersion(21501);
+#define LIBXML_TEST_VERSION xmlCheckVersion(21503);
 
 #if 1
 /**

contrib/mariadb-connector-c-cmake/CMakeLists.txt

@@ -43,6 +43,14 @@ MATH(EXPR MARIADB_VERSION_ID "${MARIADB_CLIENT_VERSION_MAJOR} * 10000 +
                               ${MARIADB_CLIENT_VERSION_MINOR} * 100   +
                               ${MARIADB_CLIENT_VERSION_PATCH}")
 
+set(CPACK_PACKAGE_VERSION_MAJOR 3)
+set(CPACK_PACKAGE_VERSION_MINOR 1)
+set(CPACK_PACKAGE_VERSION_PATCH 29)
+set(CPACK_PACKAGE_VERSION "${CPACK_PACKAGE_VERSION_MAJOR}.${CPACK_PACKAGE_VERSION_MINOR}.${CPACK_PACKAGE_VERSION_PATCH}")
+MATH(EXPR MARIADB_PACKAGE_VERSION_ID "${CPACK_PACKAGE_VERSION_MAJOR} * 10000 +
+                                      ${CPACK_PACKAGE_VERSION_MINOR} * 100   +
+                                      ${CPACK_PACKAGE_VERSION_PATCH}")
+
 IF (NOT MARIADB_PORT)
   set(MARIADB_PORT 3306)
 ENDIF ()
@@ -207,7 +215,7 @@ set(LIBMARIADB_SOURCES ${LIBMARIADB_SOURCES}
 ${CC_SOURCE_DIR}/plugins/auth/my_auth.c
 ${CC_SOURCE_DIR}/libmariadb/ma_array.c
 ${CC_SOURCE_DIR}/libmariadb/ma_charset.c
-${CC_SOURCE_DIR}/libmariadb/ma_hash.c
+${CC_SOURCE_DIR}/libmariadb/ma_hashtbl.c
 ${CC_SOURCE_DIR}/libmariadb/ma_net.c
 ${CC_SOURCE_DIR}/libmariadb/mariadb_charset.c
 ${CC_SOURCE_DIR}/libmariadb/ma_time.c

contrib/postgres-cmake/CMakeLists.txt

@@ -56,6 +56,7 @@ set(SRCS
     "${POSTGRES_SOURCE_DIR}/src/port/pgstrcasecmp.c"
     "${POSTGRES_SOURCE_DIR}/src/port/pg_bitutils.c"
     "${POSTGRES_SOURCE_DIR}/src/port/path.c"
+    "${POSTGRES_SOURCE_DIR}/src/port/timingsafe_bcmp.c"
 )
 
 if(NOT OS_DARWIN)

contrib/postgres-cmake/pg_config.h

@@ -618,19 +618,24 @@
 #define PG_MAJORVERSION_NUM 18
 
 /* PostgreSQL minor version number */
-#define PG_MINORVERSION_NUM 3
+#define PG_MINORVERSION_NUM 4
 
-/* Define to best printf format archetype, usually gnu_printf if available. */
-#define PG_PRINTF_ATTRIBUTE gnu_printf
+/* Define to best C++ printf format archetype, usually gnu_printf if
+   available. */
+#define PG_CXX_PRINTF_ATTRIBUTE gnu_printf
+
+/* Define to best C printf format archetype, usually gnu_printf if available.
+   */
+#define PG_C_PRINTF_ATTRIBUTE gnu_printf
 
 /* PostgreSQL version as a string */
-#define PG_VERSION "18.3"
+#define PG_VERSION "18.4"
 
 /* PostgreSQL version as a number */
-#define PG_VERSION_NUM 180003
+#define PG_VERSION_NUM 180004
 
 /* A string containing the version number, platform, and C compiler */
-#define PG_VERSION_STR "PostgreSQL 18.3 on x86_64-pc-linux-gnu, compiled by gcc (GCC) 15.2.1 20250813, 64-bit"
+#define PG_VERSION_STR "PostgreSQL 18.4 on x86_64-pc-linux-gnu, compiled by gcc (GCC) 15.2.1 20250813, 64-bit"
 
 /* Define to 1 to allow profiling output to be saved separately for each
    process. */

docker/keeper/Dockerfile.distroless

@@ -146,7 +146,7 @@ RUN mkdir -p \
 # Stage 2: Production distroless image.
 # ──────────────────────────────────────────────────────────────────────────────
 # Pinned 2026-04-02. Refresh: docker pull gcr.io/distroless/cc-debian13:nonroot && docker inspect --format='{{index .RepoDigests 0}}' gcr.io/distroless/cc-debian13:nonroot
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:8f960b7fc6a5d6e28bb07f982655925d6206678bd9a6cde2ad00ddb5e2077d78 AS production
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:d3cda6e91129130d7229a1806b6a73d292ef245ab032da7851907798024cefba AS production
 
 COPY --from=ch-builder /output/ /
 
@@ -169,7 +169,7 @@ ENTRYPOINT ["/usr/bin/clickhouse", "docker-init", "--keeper"]
 #           at /busybox/sh for interactive troubleshooting.
 # ──────────────────────────────────────────────────────────────────────────────
 # Pinned 2026-04-02. Refresh: docker pull gcr.io/distroless/cc-debian13:debug-nonroot && docker inspect --format='{{index .RepoDigests 0}}' gcr.io/distroless/cc-debian13:debug-nonroot
-FROM gcr.io/distroless/cc-debian13:debug-nonroot@sha256:55dd32378f7562c890342098a04726f4ef386bb86c87bec3db6ed4eef27d99fb AS debug
+FROM gcr.io/distroless/cc-debian13:debug-nonroot@sha256:61e8df8909b98d2cf65fa8f620ee8292be40becd9de3b85d42852bee3f86fdb0 AS debug
 
 COPY --from=ch-builder /output/ /
 

docker/server/Dockerfile.distroless

@@ -164,7 +164,7 @@ RUN { \
 # Stage 2: Production distroless image.
 # ──────────────────────────────────────────────────────────────────────────────
 # Pinned 2026-04-02. Refresh: docker pull gcr.io/distroless/cc-debian13:nonroot && docker inspect --format='{{index .RepoDigests 0}}' gcr.io/distroless/cc-debian13:nonroot
-FROM gcr.io/distroless/cc-debian13:nonroot@sha256:8f960b7fc6a5d6e28bb07f982655925d6206678bd9a6cde2ad00ddb5e2077d78 AS production
+FROM gcr.io/distroless/cc-debian13:nonroot@sha256:d3cda6e91129130d7229a1806b6a73d292ef245ab032da7851907798024cefba AS production
 
 COPY --from=ch-builder /output/ /
 
@@ -187,7 +187,7 @@ ENTRYPOINT ["/usr/bin/clickhouse", "docker-init"]
 #           at /busybox/sh for interactive troubleshooting.
 # ──────────────────────────────────────────────────────────────────────────────
 # Pinned 2026-04-02. Refresh: docker pull gcr.io/distroless/cc-debian13:debug-nonroot && docker inspect --format='{{index .RepoDigests 0}}' gcr.io/distroless/cc-debian13:debug-nonroot
-FROM gcr.io/distroless/cc-debian13:debug-nonroot@sha256:55dd32378f7562c890342098a04726f4ef386bb86c87bec3db6ed4eef27d99fb AS debug
+FROM gcr.io/distroless/cc-debian13:debug-nonroot@sha256:61e8df8909b98d2cf65fa8f620ee8292be40becd9de3b85d42852bee3f86fdb0 AS debug
 
 COPY --from=ch-builder /output/ /