25.8 Stable: Bump to 25.8.28

base/poco/JSON/include/Poco/JSON/ParserImpl.h

@@ -43,6 +43,9 @@ namespace JSON
         static const std::size_t JSON_PARSE_BUFFER_SIZE = 4096;
         static const std::size_t JSON_PARSER_STACK_SIZE = 128;
         static const int JSON_UNLIMITED_DEPTH = -1;
+        /// Default nesting limit so that parsing untrusted JSON cannot overflow the native stack via
+        /// Poco's recursive descent. Far above any legitimate JSON; raise per-parser with setDepth.
+        static const int JSON_DEFAULT_DEPTH = 1000;
 
         ParserImpl(const Handler::Ptr & pHandler = new ParseHandler, std::size_t bufSize = JSON_PARSE_BUFFER_SIZE);
         /// Creates JSON ParserImpl, using the given Handler and buffer size.
@@ -109,6 +112,7 @@ namespace JSON
         struct json_stream * _pJSON;
         Handler::Ptr _pHandler;
         int _depth;
+        int _currentDepth = 0;
         char _decimalPoint;
         bool _allowNullByte;
         bool _allowComments;

base/poco/JSON/src/ParserImpl.cpp

@@ -37,7 +37,7 @@ namespace JSON {
 ParserImpl::ParserImpl(const Handler::Ptr& pHandler, std::size_t bufSize):
 	_pJSON(new json_stream),
 	_pHandler(pHandler),
-	_depth(JSON_UNLIMITED_DEPTH),
+	_depth(JSON_DEFAULT_DEPTH),
 	_decimalPoint('.'),
 	_allowNullByte(true),
 	_allowComments(false)
@@ -53,6 +53,7 @@ ParserImpl::~ParserImpl()
 
 void ParserImpl::handle(const std::string& json)
 {
+	_currentDepth = 0;
 	if (!_allowNullByte && json.find("\\u0000") != json.npos)
 		throw JSONException("Null bytes in strings not allowed.");
 
@@ -139,6 +140,12 @@ void ParserImpl::stripComments(std::string& json)
 
 void ParserImpl::handleArray()
 {
+	// Enforce the configured depth limit (set via setDepth) to avoid a native-stack
+	// overflow on deeply nested input. _depth == JSON_UNLIMITED_DEPTH (-1) means no limit.
+	if (_depth != JSON_UNLIMITED_DEPTH && _currentDepth >= _depth)
+		throw JSONException("Maximum allowed JSON depth exceeded");
+	++_currentDepth;
+
 	json_type tok = json_peek(_pJSON);
 	while (tok != JSON_ARRAY_END && checkError())
 	{
@@ -148,11 +155,17 @@ void ParserImpl::handleArray()
 
 	if (tok == JSON_ARRAY_END) handle();
 	else throw JSONException("JSON array end not found");
+
+	--_currentDepth;
 }
 
 
 void ParserImpl::handleObject()
 {
+	if (_depth != JSON_UNLIMITED_DEPTH && _currentDepth >= _depth)
+		throw JSONException("Maximum allowed JSON depth exceeded");
+	++_currentDepth;
+
 	json_type tok = json_peek(_pJSON);
 	while (tok != JSON_OBJECT_END && checkError())
 	{
@@ -166,6 +179,8 @@ void ParserImpl::handleObject()
 
 	if (tok == JSON_OBJECT_END) handle();
 	else throw JSONException("JSON object end not found");
+
+	--_currentDepth;
 }
 
 

ci/docker/integration/mysql_java_client/Dockerfile

@@ -1,13 +1,19 @@
 # docker build -t altinityinfra/mysql-java-client .
 # MySQL Java client docker container
 
-FROM openjdk:8-jdk-alpine
+FROM eclipse-temurin:21-jdk-alpine
 
 RUN apk --no-cache add curl
 
-ARG ver=8.1.0
+# Connector/J 8.2.0+ (including 9.x) reads the `info` field of the MySQL `OK`
+# packet as a length-encoded string; it used to be pinned to 8.1.0 because
+# ClickHouse wrote that field as a plain string and newer drivers failed to
+# connect. Fixed by length-encoding `info` (see #84542), so test against a
+# modern driver. CLASSPATH=. is required so javac-compiled .class files in the
+# WORKDIR are found at runtime.
+ARG ver=9.7.0
 RUN curl -L -o /mysql-connector-j-${ver}.jar https://repo1.maven.org/maven2/com/mysql/mysql-connector-j/${ver}/mysql-connector-j-${ver}.jar
-ENV CLASSPATH=$CLASSPATH:/mysql-connector-j-${ver}.jar
+ENV CLASSPATH=.:/mysql-connector-j-${ver}.jar
 
 WORKDIR /jdbc
 COPY MySQLJavaClientTest.java MySQLJavaClientTest.java

ci/jobs/check_style.py

@@ -6,6 +6,7 @@
 from concurrent.futures import ProcessPoolExecutor
 from pathlib import Path
 
+from praktika.info import Info
 from praktika.result import Result
 from praktika.utils import Shell, Utils
 
@@ -322,7 +323,13 @@ def parse_args():
             )
         )
     testname = "test_numbers_check"
-    if testpattern.lower() in testname.lower():
+    # Skip on release branches and backport PRs: backports cherry-pick a small
+    # subset of test files, which legitimately leaves large gaps in the numbering.
+    info = Info()
+    release_branch_re = re.compile(r"^\d{2}\.\d+$")
+    branch_to_check = (info.base_branch or info.git_branch or "").removeprefix("release/")
+    is_release_branch = bool(release_branch_re.match(branch_to_check))
+    if testpattern.lower() in testname.lower() and not is_release_branch:
         results.append(
             Result.from_commands_run(
                 name=testname,

ci/jobs/install_check.py

@@ -29,7 +29,12 @@ def prepare_test_scripts():
 trap "bash -ex /packages/preserve_logs.sh" ERR
 test_env='TEST_THE_DEFAULT_PARAMETER=15'
 echo "$test_env" >> /etc/default/clickhouse
+# The init.d wrapper prints "Server started" once the pid file exists, but the TCP
+# listener can take longer to open on a slow CI host; poll for up to 30s. See #86278.
 /etc/init.d/clickhouse-server start
+for i in {1..30}; do
+    clickhouse-client -q 'SELECT version()' && break || sleep 1
+done
 clickhouse-client -q 'SELECT version()'
 grep "$test_env" /proc/$(cat /var/run/clickhouse-server/clickhouse-server.pid)/environ"""
     keeper_test = r"""#!/bin/bash

cmake/autogenerated_versions.txt

@@ -2,13 +2,13 @@
 
 # NOTE: VERSION_REVISION has nothing common with DBMS_TCP_PROTOCOL_VERSION,
 # only DBMS_TCP_PROTOCOL_VERSION should be incremented on protocol changes.
-SET(VERSION_REVISION 54523)
+SET(VERSION_REVISION 54528)
 SET(VERSION_MAJOR 25)
 SET(VERSION_MINOR 8)
-SET(VERSION_PATCH 23)
-SET(VERSION_GITHASH 6d29497525664acca46a1d1cd0d5787e9ad0857d)
-SET(VERSION_DESCRIBE v25.8.23.10001.altinitytest)
-SET(VERSION_STRING 25.8.23.10001.altinitytest)
+SET(VERSION_PATCH 28)
+SET(VERSION_GITHASH 33fef01d6a00ddd46f0a359a1716cd0a27fdd9c6)
+SET(VERSION_DESCRIBE v25.8.28.10001.altinitytest)
+SET(VERSION_STRING 25.8.28.10001.altinitytest)
 # end of autochange
 
 SET(VERSION_TWEAK 10001)

contrib/curl-cmake/CMakeLists.txt

@@ -15,6 +15,7 @@ set (SRCS
     "${LIBRARY_DIR}/lib/asyn-thrdd.c"
     "${LIBRARY_DIR}/lib/bufq.c"
     "${LIBRARY_DIR}/lib/bufref.c"
+    "${LIBRARY_DIR}/lib/cf-dns.c"
     "${LIBRARY_DIR}/lib/cf-h1-proxy.c"
     "${LIBRARY_DIR}/lib/cf-h2-proxy.c"
     "${LIBRARY_DIR}/lib/cf-haproxy.c"
@@ -37,7 +38,6 @@ set (SRCS
     "${LIBRARY_DIR}/lib/curl_memrchr.c"
     "${LIBRARY_DIR}/lib/curl_ntlm_core.c"
     "${LIBRARY_DIR}/lib/curl_range.c"
-    "${LIBRARY_DIR}/lib/curl_rtmp.c"
     "${LIBRARY_DIR}/lib/curl_sasl.c"
     "${LIBRARY_DIR}/lib/curl_sha512_256.c"
     "${LIBRARY_DIR}/lib/curl_share.c"
@@ -47,6 +47,7 @@ set (SRCS
     "${LIBRARY_DIR}/lib/cw-out.c"
     "${LIBRARY_DIR}/lib/cw-pause.c"
     "${LIBRARY_DIR}/lib/dict.c"
+    "${LIBRARY_DIR}/lib/dnscache.c"
     "${LIBRARY_DIR}/lib/doh.c"
     "${LIBRARY_DIR}/lib/dynhds.c"
     "${LIBRARY_DIR}/lib/easy.c"
@@ -100,6 +101,7 @@ set (SRCS
     "${LIBRARY_DIR}/lib/pingpong.c"
     "${LIBRARY_DIR}/lib/pop3.c"
     "${LIBRARY_DIR}/lib/progress.c"
+    "${LIBRARY_DIR}/lib/protocol.c"
     "${LIBRARY_DIR}/lib/psl.c"
     "${LIBRARY_DIR}/lib/rand.c"
     "${LIBRARY_DIR}/lib/ratelimit.c"
@@ -123,6 +125,8 @@ set (SRCS
     "${LIBRARY_DIR}/lib/system_win32.c"
     "${LIBRARY_DIR}/lib/telnet.c"
     "${LIBRARY_DIR}/lib/tftp.c"
+    "${LIBRARY_DIR}/lib/thrdpool.c"
+    "${LIBRARY_DIR}/lib/thrdqueue.c"
     "${LIBRARY_DIR}/lib/transfer.c"
     "${LIBRARY_DIR}/lib/uint-bset.c"
     "${LIBRARY_DIR}/lib/uint-hash.c"

contrib/curl-cmake/curl_config.h

@@ -55,8 +55,10 @@
 
 #define ENABLE_IPV6
 #define USE_OPENSSL
-#define USE_THREADS_POSIX
+#define HAVE_THREADS_POSIX
 #define USE_ARES
+#define USE_RESOLV_ARES
+#define CURL_ENABLE_NTLM
 
 #ifdef __illumos__
 #define HAVE_POSIX_STRERROR_R 1

contrib/krb5-cmake/CMakeLists.txt

@@ -132,16 +132,18 @@ set(ALL_SRCS
     "${KRB5_SOURCE_DIR}/lib/gssapi/krb5/ser_sctx.c"
     "${KRB5_SOURCE_DIR}/lib/gssapi/krb5/k5sealv3.c"
     "${KRB5_SOURCE_DIR}/lib/gssapi/krb5/acquire_cred.c"
-    "${KRB5_SOURCE_DIR}/lib/gssapi/krb5/k5unseal.c"
+    # "${KRB5_SOURCE_DIR}/lib/gssapi/krb5/k5unseal.c"
     "${KRB5_SOURCE_DIR}/lib/gssapi/krb5/rel_cred.c"
     "${KRB5_SOURCE_DIR}/lib/gssapi/krb5/util_cksum.c"
+    "${KRB5_SOURCE_DIR}/lib/gssapi/krb5/verify_mic.c"
+    "${KRB5_SOURCE_DIR}/lib/gssapi/krb5/unwrap.c"
     "${KRB5_SOURCE_DIR}/lib/gssapi/generic/disp_com_err_status.c"
     "${KRB5_SOURCE_DIR}/lib/gssapi/generic/gssapi_generic.c"
     "${KRB5_SOURCE_DIR}/lib/gssapi/generic/rel_oid_set.c"
     "${KRB5_SOURCE_DIR}/lib/gssapi/generic/oid_ops.c"
     "${KRB5_SOURCE_DIR}/lib/gssapi/generic/util_buffer.c"
     "${KRB5_SOURCE_DIR}/lib/gssapi/generic/util_buffer_set.c"
-    "${KRB5_SOURCE_DIR}/lib/gssapi/generic/util_set.c"
+    # "${KRB5_SOURCE_DIR}/lib/gssapi/generic/util_set.c"
     "${KRB5_SOURCE_DIR}/lib/gssapi/generic/util_token.c"
     "${KRB5_SOURCE_DIR}/lib/gssapi/generic/disp_major_status.c"
     "${KRB5_SOURCE_DIR}/lib/gssapi/generic/util_seqstate.c"
@@ -415,6 +417,7 @@ set(ALL_SRCS
     "${KRB5_SOURCE_DIR}/lib/krb5/os/realm_dom.c"
     "${KRB5_SOURCE_DIR}/lib/krb5/os/dnssrv.c"
     "${KRB5_SOURCE_DIR}/lib/krb5/os/mk_faddr.c"
+    "${KRB5_SOURCE_DIR}/lib/krb5/os/addr.c"
     # "${KRB5_SOURCE_DIR}/lib/krb5/os/dnsglue.c"
     "${KRB5_SOURCE_DIR}/lib/krb5/os/sendto_kdc.c"
     "${KRB5_SOURCE_DIR}/lib/krb5/os/hostrealm_registry.c"
@@ -585,11 +588,11 @@ if(CMAKE_SYSTEM_NAME MATCHES "Darwin")
         file(COPY "${CMAKE_CURRENT_SOURCE_DIR}/kcmrpc.hin"
             DESTINATION "${CMAKE_CURRENT_BINARY_DIR}/include_private/"
         )
-        file(RENAME 
+        file(RENAME
             "${CMAKE_CURRENT_BINARY_DIR}/include_private/kcmrpc.cin"
             "${CMAKE_CURRENT_BINARY_DIR}/include_private/kcmrpc.c"
         )
-        file(RENAME 
+        file(RENAME
             "${CMAKE_CURRENT_BINARY_DIR}/include_private/kcmrpc.hin"
             "${CMAKE_CURRENT_BINARY_DIR}/include_private/kcmrpc.h"
         )

contrib/libarchive-cmake/config.h

@@ -1031,6 +1031,9 @@ typedef uint64_t uintmax_t;
 /* Define to 1 if you have the <stdint.h> header file. */
 #define HAVE_STDINT_H 1
 
+/* Define to 1 if you have the <stdio.h> header file. */
+#define HAVE_STDIO_H 1
+
 /* Define to 1 if you have the <stdlib.h> header file. */
 #define HAVE_STDLIB_H 1
 

contrib/libxml2-cmake/linux_x86_64/include/config.h

@@ -77,7 +77,7 @@
 #define PACKAGE_NAME "libxml2"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "libxml2 2.15.1"
+#define PACKAGE_STRING "libxml2 2.15.3"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "libxml2"
@@ -86,15 +86,15 @@
 #define PACKAGE_URL ""
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "2.15.1"
+#define PACKAGE_VERSION "2.15.3"
 
 /* Define to 1 if all of the C90 standard headers exist (not just the ones
    required in a freestanding environment). This macro is provided for
    backward compatibility; new code need not use it. */
 #define STDC_HEADERS 1
 
 /* Version number of package */
-#define VERSION "2.15.1"
+#define VERSION "2.15.3"
 
 /* System configuration directory (/etc) */
 #define XML_SYSCONFDIR "/usr/local/etc"

contrib/libxml2-cmake/linux_x86_64/include/libxml/xmlversion.h

@@ -16,17 +16,17 @@
 /**
  * the version string like "1.2.3"
  */
-#define LIBXML_DOTTED_VERSION "2.15.1"
+#define LIBXML_DOTTED_VERSION "2.15.3"
 
 /**
  * the version number: 1.2.3 value is 10203
  */
-#define LIBXML_VERSION 21501
+#define LIBXML_VERSION 21503
 
 /**
  * the version number string, 1.2.3 value is "10203"
  */
-#define LIBXML_VERSION_STRING "21501"
+#define LIBXML_VERSION_STRING "21503"
 
 /**
  * extra version information, used to show a git commit description
@@ -37,7 +37,7 @@
  * Macro to check that the libxml version in use is compatible with
  * the version the software has been compiled against
  */
-#define LIBXML_TEST_VERSION xmlCheckVersion(21501);
+#define LIBXML_TEST_VERSION xmlCheckVersion(21503);
 
 #if 1
 /**

contrib/mariadb-connector-c-cmake/CMakeLists.txt

@@ -43,6 +43,14 @@ MATH(EXPR MARIADB_VERSION_ID "${MARIADB_CLIENT_VERSION_MAJOR} * 10000 +
                               ${MARIADB_CLIENT_VERSION_MINOR} * 100   +
                               ${MARIADB_CLIENT_VERSION_PATCH}")
 
+set(CPACK_PACKAGE_VERSION_MAJOR 3)
+set(CPACK_PACKAGE_VERSION_MINOR 1)
+set(CPACK_PACKAGE_VERSION_PATCH 29)
+set(CPACK_PACKAGE_VERSION "${CPACK_PACKAGE_VERSION_MAJOR}.${CPACK_PACKAGE_VERSION_MINOR}.${CPACK_PACKAGE_VERSION_PATCH}")
+MATH(EXPR MARIADB_PACKAGE_VERSION_ID "${CPACK_PACKAGE_VERSION_MAJOR} * 10000 +
+                                      ${CPACK_PACKAGE_VERSION_MINOR} * 100   +
+                                      ${CPACK_PACKAGE_VERSION_PATCH}")
+
 IF (NOT MARIADB_PORT)
   set(MARIADB_PORT 3306)
 ENDIF ()
@@ -207,7 +215,7 @@ set(LIBMARIADB_SOURCES ${LIBMARIADB_SOURCES}
 ${CC_SOURCE_DIR}/plugins/auth/my_auth.c
 ${CC_SOURCE_DIR}/libmariadb/ma_array.c
 ${CC_SOURCE_DIR}/libmariadb/ma_charset.c
-${CC_SOURCE_DIR}/libmariadb/ma_hash.c
+${CC_SOURCE_DIR}/libmariadb/ma_hashtbl.c
 ${CC_SOURCE_DIR}/libmariadb/ma_net.c
 ${CC_SOURCE_DIR}/libmariadb/mariadb_charset.c
 ${CC_SOURCE_DIR}/libmariadb/ma_time.c

contrib/mongo-c-driver-cmake/CMakeLists.txt

@@ -5,13 +5,13 @@ if(NOT USE_MONGODB)
 endif()
 
 set(libbson_VERSION_MAJOR 2)
-set(libbson_VERSION_MINOR 2)
-set(libbson_VERSION_PATCH 2)
-set(libbson_VERSION 2.2.2)
+set(libbson_VERSION_MINOR 3)
+set(libbson_VERSION_PATCH 0)
+set(libbson_VERSION 2.3.0)
 set(libmongoc_VERSION_MAJOR 2)
-set(libmongoc_VERSION_MINOR 2)
-set(libmongoc_VERSION_PATCH 2)
-set(libmongoc_VERSION 2.2.2)
+set(libmongoc_VERSION_MINOR 3)
+set(libmongoc_VERSION_PATCH 0)
+set(libmongoc_VERSION 2.3.0)
 
 set(LIBBSON_SOURCES_ROOT "${ClickHouse_SOURCE_DIR}/contrib/mongo-c-driver/src")
 set(LIBBSON_SOURCE_DIR "${LIBBSON_SOURCES_ROOT}/libbson/src")

contrib/postgres-cmake/CMakeLists.txt

@@ -56,6 +56,7 @@ set(SRCS
     "${POSTGRES_SOURCE_DIR}/src/port/pgstrcasecmp.c"
     "${POSTGRES_SOURCE_DIR}/src/port/pg_bitutils.c"
     "${POSTGRES_SOURCE_DIR}/src/port/path.c"
+    "${POSTGRES_SOURCE_DIR}/src/port/timingsafe_bcmp.c"
 )
 
 if(NOT OS_DARWIN)