Antalya 25.8: bump to 25.8.30

[zvonand]

Changelog category (leave one):

• Not for changelog (changelog entry is not required)

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Performance tests
• Aarch64 tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• OAuth (5m)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

[github-actions]

Workflow [PR], commit [b7d4012]

[zvonand]

@blau-ai

[blau-ai]

CI triage for #2224 (bump to 25.8.30)

Verdict: 8 red checks, none is a product regression introduced by this bump.
1 infra, 1 expected-for-bump (DCO), 1 pre-existing crash unrelated to the diff, and 4 stateless failures that are all new tests brought in by the bump failing in one specific CI config each (test-harness tagging), plus one deltalake test that needs a look but shows no security regression. Head SHA e3297834526.

Evidence: this PR is only 2 commits past antalya-25.8; the "product" surface is the merge of the v25.8.30.16-lts tag. All four failing stateless tests were added by that merge (none exist on the base branch), and every one of them passes in every other config and fails in exactly the config a standard exclusion tag would remove.

---

Not caused by this PR

Integration tests (amd_binary, 1/5 … 5/5) — all five shards report infrastructure error with no test-level results (only a job.log, no test artifacts). Runner/infra failure, not a product failure. → Re-run.

DCO — fails because the merge commit Merge tag 'v25.8.30.16-lts' and the upstream backport commits carry no Signed-off-by trailer. This is inherent to a version-bump PR that merges upstream history. → Maintainer bypass / override, as for previous bump PRs. Not a code issue.

AST fuzzer (amd_debug) — Logical error: 'Bad cast from type ColumnVector<unsigned long> to ColumnVector<char8_t>'. This is a real but pre-existing crash, not introduced here:

• Crash site: src/Processors/Formats/Impl/Parquet/Reader.cpp:2125 in Parquet::Reader::applyPrewhere — a typeid_cast<ColumnVector<UInt8>> on a ColumnVector<UInt64> column, i.e. a fuzzed PREWHERE cityHash64(...) (UInt64) fed to the native Parquet reader v3 (input_format_parquet_use_native_reader_v3=1).
• This bump makes zero changes under src/Processors/Formats/Impl/Parquet/ (git diff antalya-25.8..HEAD -- .../Parquet/ is empty), and applyPrewhere already exists on antalya-25.8. The bug lives on the base branch.
• → Not a blocker for this PR. Worth a separate issue against the native Parquet v3 reader (PREWHERE filter column must be cast to UInt8, not blindly to the column's own type). Safe to re-run the fuzzer here.

---

Introduced by the bump, but test-only / low-risk (owned by this PR)

All four are brand-new tests that came in with the tag merge. Three are missing a CI-config exclusion tag; one is a security test whose security invariant still holds.

1. 04299_deltalake_local_path_traversal — fails in all 6 stateless configs (deterministic).
Diff: the expected GOT ACCESS DENIED ERROR line is missing for both allow_experimental_delta_kernel_rs=1 and =0; but NO LEAK holds in every config — the crafted path-traversal delta log does not leak the out-of-table secret. So there is no security regression; only the specific PATH_ACCESS_DENIED error the test asserts is not being raised.
The guard (resolvePathInsideTable, backport ClickHouse#106115) is present and wired into both readers (DeltaLakeMetadata.cpp, DeltaLake/TableSnapshot.cpp), so this is most likely a path-normalization detail in the CI temp layout (e.g. pathStartsWith on the non-normalized base/../secret combination, or CLICKHOUSE_TMP under a symlinked path) rather than a missing check.
→ Needs a real look by the delta-lake owner (or the bump author): reproduce deltaLakeLocal(<crafted dir>, 'RawBLOB') and capture the actual error, then either fix the guard so PATH_ACCESS_DENIED is raised, or relax the test to assert "read is blocked" rather than the exact code. Not a merge blocker on security grounds, but must go green.

2. 03918_arrayjoin_join_on_duplicate_execution — fails only under old analyzer.
The old analyzer rejects arrayJoin(...) in a JOIN ON key with INVALID_JOIN_ON_EXPRESSION; the test is a regression test for a new-analyzer plan optimization (query_plan_use_new_logical_join_step) and passes under the new analyzer. → Tag it no-old-analyzer (that tag is already used by 04330_join_global_left_semi_chunk_consistency.sql).

--- Tags: long, no-random-settings
+-- Tags: long, no-random-settings, no-old-analyzer

3. 04510_s3_explicit_url_named_secret_mask — fails only under DatabaseReplicated.
Masking works ([HIDDEN] present); the reference mismatch is the extra replicated-DDL lines DatabaseReplicated injects into the SHOW CREATE stream (CREATE TABLE … UUID '…' and /* ddl_entry=… */ DROP TABLE … SYNC). → Tag no-replicated-database.

--- Tags: no-fasttest
+-- Tags: no-fasttest, no-replicated-database

4. 04296_alter_rename_column_in_memory_rollback — fails only under DatabaseReplicated (sequential).
The test enables the mt_alter_throw_in_start_mutation failpoint, which is specific to StorageMergeTree::alter. Under DatabaseReplicated the MergeTree table becomes ReplicatedMergeTree, whose ALTER path differs, so the in-memory rollback the test checks isn't exercised as intended (→ SELECT id, d hits UNKNOWN_IDENTIFIER: d). It passes in every non-replicated sequential config. → Tag no-replicated-database.

-# Tags: no-parallel
+# Tags: no-parallel, no-replicated-database

(One caveat worth a maintainer glance: confirm the ALTER-rename rollback semantics are equivalent — or intentionally out of scope — under a Replicated engine, so the tag documents a real scope boundary rather than hiding a Replicated-path gap.)

---

Suggested next steps

• Re-run the 5 Integration (amd_binary) shards and the AST fuzzer (both non-PR).
• DCO: maintainer override, as usual for bump PRs.
• File a separate issue for the pre-existing native-Parquet-v3 PREWHERE bad-cast crash.
• Tag fixes for 03918, 04510, 04296 (three one-line diffs above) — these will clear those three stateless suites.
• 04299_deltalake: hand to the delta-lake owner to confirm why PATH_ACCESS_DENIED isn't raised (no leak, so low severity).

I can open a blau/* PR with the three tagging one-liners against this branch if you'd like — just say the word (or tell me to commit them directly to bump/antalya-25.8/25.8.30). I'd leave 04299 and the Parquet-v3 crash for their code owners.

[zvonand]

@blau-ai

[blau-ai]

CI triage for #2224 (bump to 25.8.30)

Summary — 7 red checks: 4 are PR-caused (all with clear fixes), 1 pre-existing/flaky, 2 are not code (policy / base-image CVE).

Check	Failing item	Verdict
Integration tests (amd_binary, 2/5)	test_database_iceberg_nessie_catalog::test_hide_sensitive_info	PR-caused (real)
Stateless (old analyzer, s3, DatabaseReplicated, seq)	04296_alter_rename_column_in_memory_rollback	PR-caused (dropped tag)
Stateless (old analyzer, s3, DatabaseReplicated, par)	04510_s3_explicit_url_named_secret_mask	PR-caused (missing tag)
Stateless (old analyzer, s3, DatabaseReplicated, par)	03918_arrayjoin_join_on_duplicate_execution	PR-caused (missing tag)
Stateless (DatabaseReplicated par) + (amd_debug, par)	03749_cross_join_use_nulls_matcher	pre-existing / flaky
DCO	commits missing Signed-off-by	not code (policy)
Grype Scan (-alpine)	CVE-2026-14456, CVE-2025-60876 (High)	not code (base image)

All builds, fast test, stress, AST fuzzer, BuzzHouse, every regression suite, and the non-alpine Grype scans are green.

---

1. test_hide_sensitive_info — PR-caused, real ⚠️

This is the one genuine incompatibility. The bump backports upstream ClickHouse#98827 ("Implement http header validation for DataLakeCatalog", commit b28b0641164), which adds auth_header format validation in src/Databases/DataLake/DatabaseDataLake.cpp:

Code: 36. DB::Exception: Invalid auth header format. Expected 'HeaderName: HeaderValue'. (BAD_ARGUMENTS)
(query: CREATE DATABASE demo ENGINE = DataLakeCatalog(...) SETTINGS ... auth_header='SECRET_2')

Upstream ClickHouse#98827 changed the .cpp and updated the three DataLake integration tests to use a valid header. The backport carried only the .cpp change — the test update was dropped — so the pre-existing Altinity test still passes auth_header="SECRET_2" (no colon), which the new validation now rejects.

Fix (mirrors upstream ClickHouse#98827) — tests/integration/test_database_iceberg_nessie_catalog/test.py:299:

-        additional_settings={"auth_header": "SECRET_2"},
+        additional_settings={"auth_header": "Authorization: SECRET_2"},

The masking assertion assert "SECRET_2" not in show_result still holds. Upstream also added a test_invalid_auth_header_format case; optional to backport too.

2. 04296_alter_rename_column_in_memory_rollback — PR-caused, dropped tag

New test added by this bump. It uses a failpoint in StorageMergeTree::alter and expects the in-memory rename to roll back; under DatabaseReplicated the ALTER takes a different path and the column is actually renamed → Code: 47 ... Missing columns: 'd'. Upstream tags this no-parallel, no-replicated-database; the backport kept only no-parallel.

Fix — tests/queries/0_stateless/04296_alter_rename_column_in_memory_rollback.sh:2:

-# Tags: no-parallel
+# Tags: no-parallel, no-replicated-database

3. 04510_s3_explicit_url_named_secret_mask — PR-caused, missing tag

New test added by this bump. Secret masking itself works (every secret shows [HIDDEN]); the diff is only extra rows the test picks up from system.query_log under DatabaseReplicated — the internal replicated DDL (CREATE TABLE default.t_04510 UUID '…', /* ddl_entry=… */ DROP TABLE … SYNC). The final SELECT query FROM system.query_log isn't written for that mode.

Fix — tests/queries/0_stateless/04510_s3_explicit_url_named_secret_mask.sql:1:

--- Tags: no-fasttest
+-- Tags: no-fasttest, no-replicated-database

4. 03918_arrayjoin_join_on_duplicate_execution — PR-caused, missing tag

New test added by this bump. It exercises arrayJoin() in JOIN ON with the new-analyzer feature query_plan_use_new_logical_join_step. In the old-analyzer suite that path is rejected before it matters → Code: 403 ... Not allowed function in JOIN ON ... (INVALID_JOIN_ON_EXPRESSION). It passes in every new-analyzer suite. Upstream doesn't run this under old analyzer; the antalya matrix does, so it needs the guard.

Fix — tests/queries/0_stateless/03918_arrayjoin_join_on_duplicate_execution.sql:1:

--- Tags: long, no-random-settings
+-- Tags: long, no-random-settings, no-old-analyzer

5. 03749_cross_join_use_nulls_matcher — pre-existing / flaky (not PR-caused)

Present on antalya-25.8 and not touched by this PR. The diff is a pure row-reordering (same rows, different order) — the query has no ORDER BY:

SELECT concat(*) FROM numbers(2) AS n1, numbers(3) AS n2
RIGHT JOIN numbers(4) AS n3 ON n2.number = n3.number SETTINGS join_use_nulls = true;

Order-nondeterministic → flaky under parallel/random settings. Safe to re-run. A proper fix (add a deterministic ORDER BY) belongs in its own change, not this bump.

6. DCO — not code (policy)

Fails because backported/upstream commits (robot-clickhouse and upstream authors) carry no Signed-off-by. Expected for a release-bump PR; resolved by a maintainer DCO override, not a code change.

7. Grype Scan -alpine — not code (base image)

1 High finding on the alpine image only (CVE-2026-14456, CVE-2025-60876, matched via nvd:cpe); the regular server and keeper images scan clean (0 high/critical). These are Alpine base-package CVEs independent of this PR's code — a security-team/base-image triage, not a bump blocker.

---

Proposed action

Items 1–4 are the real work and are small, well-scoped, evidence-backed edits (three tag lines + one one-line test-value change). I have not pushed anything. Want me to:

• (a) open a separate PR from a blau/* branch with fixes 1–4, or
• (b) commit them directly to bump/antalya-25.8/25.8.30?

Say which and I'll deliver. (03749 / DCO / Grype are out of scope of these code fixes as noted.)

_{I can't build or run ClickHouse in this container — the above is from CI's praktika reports and the diff; correctness of the fixes would be confirmed by CI on delivery.}

[zvonand]

@blau-ai fix test_hide_sensitive_info and stateless fails related to this PR

[blau-ai]

Triage + fix for test_hide_sensitive_info and the stateless failures

Hi @zvonand — I dug into the failing checks on 04f6f26 (evidence from the praktika S3 reports). All five failures are test-side issues surfaced by the 25.8.30 bump — none is a server-code regression. No source or .reference changes are needed. Fixes are staged in my worktree; see the diff at the bottom.

1. Integration — test_database_iceberg_nessie_catalog/test.py::test_hide_sensitive_info (amd_binary 2/5)

Not a masking failure — the query is now rejected before masking runs:

Code: 36. DB::Exception: Invalid auth header format. Expected 'HeaderName: HeaderValue'. (BAD_ARGUMENTS)
(query: CREATE DATABASE demo ENGINE = DataLakeCatalog(...) SETTINGS ...,auth_header='SECRET_2')

The bump pulled in b28b0641164 ("Backport ClickHouse#98827 … Implement http header validation for DataLakeCatalog", via the v25.8.30.16-lts tag), which adds auth_header format validation in src/Databases/DataLake/DatabaseDataLake.cpp:741-756 (rejects a value with no :). That same commit updated the sibling tests (test_database_iceberg, test_database_iceberg_lakekeeper_catalog, test_database_hms) to the valid "Authorization: SECRET_2" form, but the Altinity-only nessie test (which doesn't exist upstream) was missed and kept the bare "SECRET_2".
Fix: use the valid header form (matches test_database_iceberg/test.py:389). Masking assertions still hold — the value after : renders as [HIDDEN].

2. Stateless — amd_binary, old analyzer, s3 storage, DatabaseReplicated (parallel) — 3 failed, 2 broken

(The 2 "broken" are pre-existing broken-list entries, not new failures.)

• 04510_s3_explicit_url_named_secret_mask — reference mismatch. Under a Replicated database the final system.query_log scan picks up the engine's internal DDL rows (/* ddl_entry=… */ …), which aren't in the .reference (generated under Atomic). Masking itself is correct. → add no-replicated-database.
• 03918_arrayjoin_join_on_duplicate_execution — Code: 403 … Not allowed function in JOIN ON … arrayJoin(...) (INVALID_JOIN_ON_EXPRESSION). The old analyzer rejects arrayJoin() in JOIN ON; the test targets an analyzer-only optimization. → add no-old-analyzer (same convention as 04330_join_global_left_semi_chunk_consistency.sql).
• 03749_cross_join_use_nulls_matcher — see §4 (also fails in suite §3).

3. Stateless — amd_debug (parallel) — 1 failed

• 03749_cross_join_use_nulls_matcher — see §4.

4. Stateless — amd_binary, old analyzer, s3 storage, DatabaseReplicated (sequential) — 1 failed

• 04296_alter_rename_column_in_memory_rollback — Code: 47 … Missing columns: 'd' (UNKNOWN_IDENTIFIER). This is by design of the fix under test: src/Storages/StorageMergeTree.cpp branches on hasReplicationThread(); under a Replicated DB the metadata is already committed to ZooKeeper and can't be rolled back, so it converges to the new schema. The test asserts the non-replicated (rollback) behavior. → add no-replicated-database.

03749_cross_join_use_nulls_matcher (fails in §2 and §3)

Nondeterministic row order — the single query has no ORDER BY, so RIGHT JOIN output order shifts with join settings. Same rows, different order. It's a pre-existing under-specified test (present on antalya-25.8). → add ORDER BY 1; with default ASC NULLS LAST this reproduces the existing .reference exactly, so no .reference change.

---

Proposed diff (test-only)

diff --git a/tests/integration/test_database_iceberg_nessie_catalog/test.py b/tests/integration/test_database_iceberg_nessie_catalog/test.py
--- a/tests/integration/test_database_iceberg_nessie_catalog/test.py
+++ b/tests/integration/test_database_iceberg_nessie_catalog/test.py
@@ def test_hide_sensitive_info(started_cluster):
         create_clickhouse_iceberg_database(
             started_cluster,
             node,
             CATALOG_NAME,
-            additional_settings={"auth_header": "SECRET_2"},
+            additional_settings={"auth_header": "Authorization: SECRET_2"},
         )

diff --git a/tests/queries/0_stateless/04510_s3_explicit_url_named_secret_mask.sql b/tests/queries/0_stateless/04510_s3_explicit_url_named_secret_mask.sql
--- a/tests/queries/0_stateless/04510_s3_explicit_url_named_secret_mask.sql
+++ b/tests/queries/0_stateless/04510_s3_explicit_url_named_secret_mask.sql
-- Tags: no-fasttest
+-- Tags: no-fasttest, no-replicated-database

diff --git a/tests/queries/0_stateless/03918_arrayjoin_join_on_duplicate_execution.sql b/tests/queries/0_stateless/03918_arrayjoin_join_on_duplicate_execution.sql
--- a/tests/queries/0_stateless/03918_arrayjoin_join_on_duplicate_execution.sql
+++ b/tests/queries/0_stateless/03918_arrayjoin_join_on_duplicate_execution.sql
-- Tags: long, no-random-settings
+-- Tags: long, no-random-settings, no-old-analyzer

diff --git a/tests/queries/0_stateless/04296_alter_rename_column_in_memory_rollback.sh b/tests/queries/0_stateless/04296_alter_rename_column_in_memory_rollback.sh
--- a/tests/queries/0_stateless/04296_alter_rename_column_in_memory_rollback.sh
+++ b/tests/queries/0_stateless/04296_alter_rename_column_in_memory_rollback.sh
# Tags: no-parallel
+# Tags: no-parallel, no-replicated-database

diff --git a/tests/queries/0_stateless/03749_cross_join_use_nulls_matcher.sql b/tests/queries/0_stateless/03749_cross_join_use_nulls_matcher.sql
--- a/tests/queries/0_stateless/03749_cross_join_use_nulls_matcher.sql
+++ b/tests/queries/0_stateless/03749_cross_join_use_nulls_matcher.sql
 RIGHT JOIN numbers(4) AS n3
     ON n2.number = n3.number
+ORDER BY 1
 SETTINGS join_use_nulls = true;

---

How do you want this delivered? I haven't pushed anything. Reply:

• @blau-ai commit to this branch — I'll commit these to bump/antalya-25.8/25.8.30 directly, or
• @blau-ai open a PR — I'll open a separate blau/* PR against antalya-25.8.

Correctness is validated by CI once pushed (I can't build/run ClickHouse in this container). Notes: the no-old-analyzer / no-replicated-database tags make the affected tests skip in the incompatible suite configurations (standard ClickHouse practice), and the ORDER BY 1 addition just makes an existing test deterministic. The Grype/DCO reds are unrelated to test correctness.

[zvonand]

@blau-ai commit to this branch

[blau-ai]

Committed to bump/antalya-25.8/25.8.30

Done, @zvonand — pushed the test-only fixes directly to this branch as b7d40128152 (on top of 04f6f265a75).

 tests/integration/test_database_iceberg_nessie_catalog/test.py          | 2 +-
 tests/queries/0_stateless/03749_cross_join_use_nulls_matcher.sql        | 1 +
 tests/queries/0_stateless/03918_arrayjoin_join_on_duplicate_execution.sql | 2 +-
 tests/queries/0_stateless/04296_alter_rename_column_in_memory_rollback.sh | 2 +-
 tests/queries/0_stateless/04510_s3_explicit_url_named_secret_mask.sql   | 2 +-
 5 files changed, 5 insertions(+), 4 deletions(-)

Contents are exactly the diff proposed above — no server-code or .reference changes:

1. test_hide_sensitive_info — auth_header now uses the valid "Authorization: SECRET_2" form required by the new DataLakeCatalog header validation.
2. 04510_s3_explicit_url_named_secret_mask — no-replicated-database.
3. 03918_arrayjoin_join_on_duplicate_execution — no-old-analyzer.
4. 04296_alter_rename_column_in_memory_rollback — no-replicated-database.
5. 03749_cross_join_use_nulls_matcher — ORDER BY 1 for deterministic output.

CI will now re-run on the new head and confirm correctness (I can't build/run ClickHouse in this container). The Grype/DCO reds remain unrelated to test correctness, as noted earlier.