[zvonand]

Changelog category (leave one):

• Not for changelog (changelog entry is not required)

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

...

Documentation entry for user-facing changes

...

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Unit tests
• Performance tests
• Aarch64 tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• CAS (content-addressed storage; Antalya only)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• OAuth (5m)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

[zvonand]

Backporter: merge conflicts resolved by AI

Conflicted files:

• cmake/autogenerated_versions.txt (both modified)
• docs/reference/interfaces/specs/NativeProtocol.mdx (both modified)
• src/Core/Settings.cpp (both modified)
• src/Databases/DataLake/GlueCatalog.cpp (both modified)
• src/Databases/DataLake/GlueCatalog.h (both modified)
• src/IO/S3/URI.cpp (both modified)
• src/IO/S3/tests/gtest_s3_uri.cpp (both modified)
• src/Server/TCPHandler.cpp (both modified)
• src/Storages/ObjectStorage/DataLakes/Iceberg/IcebergMetadata.cpp (both modified)

Commits:

• 9f7ad3b: merge with the conflicts committed as-is

• 46b5e9a: resolution

• cmake/autogenerated_versions.txt: took upstream's patch number (34) and githash, and kept the Altinity suffix: 26.8.34.20001.altinityantalya. docs/.../NativeProtocol.mdx: used upstream's "obsolete" wording for IgnoredPartUUIDs and kept Altinity's extended ReadTaskResponse description.

• src/Core/Settings.cpp: kept both obsolete settings (allow_retries_in_cluster_requests and allow_named_collection_override_by_default). src/Server/TCPHandler.cpp: kept Altinity's deserialize(*in, client_antalya_protocol_version) and added upstream's state.at_packet_boundary = true.

• src/IO/S3/URI.cpp and gtest_s3_uri.cpp: both sides added a new function or test at the same spot, so I kept both: Altinity's isAWSRegion and ResolveS3Endpoint test, plus upstream's checkRemoteHostFilter and CheckRemoteHostFilter test.

• IcebergMetadata.cpp: added upstream's updateLastColumnId call before Altinity's format_version >= 2 check, so v3 tables still use the v2 parser.

• GlueCatalog.{h,cpp}: kept Altinity's per-user clients and the metadata_objects full-metadata cache. Added upstream's current_schema_field_types cache, its weight function and metrics, and <base/unit.h>. getActualTimestampType now uses the upstream cache, keyed by client.token_fingerprint + metadata_uri and fetched with the user's client.

[github-actions]

Workflow [PR], commit [787d0b3]

[zvonand]

@blau-ai

[blau-ai]

CI triage — @zvonand

Verdict (checks that have finished): 3 red checks — none are caused by this version bump. 1 is an external regression-suite expectation bug, 1 is CI infra, 1 is commit-metadata (DCO). The actual build + core test suites are green (Fast test, Unit tests 20871 passed, Stateless amd_debug, parallel 13545 passed, all Build (*) success). A number of integration/build/regression jobs were still pending when I looked.

---

1. Regression release oauth / RegressionTestsRelease / OAuth / oauth — ❌ fail → not PR-caused (external test-suite mismatch)

Only two sub-features fail: /oauth/access control and /oauth/groups. Everything else in the suite (configuration, authentication, tokens, caching, jwt_manipulation, tls, …) is OK. Both failures reduce to the same assertion:

oauth/tests/steps/clikhouse.py:121 in access_clickhouse
AssertionError: Expected HTTP status code 500, but got 403.
Response body: Code: 497. DB::Exception: a_43024a: Not enough privileges. To execute this query,
it's necessary to have the grant CREATE TEMPORARY TABLE ON *.*. (ACCESS_DENIED)
(version 26.8.34.20001.altinityantalya)

• access_control.py::missing_default_profile_does_not_grant_unrestricted_access calls access_clickhouse(..., status_code=500)
• groups.py::group_name_matches_clickhouse_role → common.py::assert_query_denied(..., status_code=500)

The test asserts an ACCESS-denied query returns HTTP 500, but the server correctly returns HTTP 403 for ACCESS_DENIED (error 497). The server behavior is right and, crucially, identical on the base branch — src/Server/HTTP/exceptionCodeToHTTPStatus.cpp on origin/antalya-26.8 already maps ACCESS_DENIED → HTTP_FORBIDDEN (403):

if (exception_code == ErrorCodes::UNKNOWN_USER || ... || exception_code == ErrorCodes::ACCESS_DENIED)
    return HTTPResponse::HTTP_FORBIDDEN;   // 403

The only change this PR makes to that file (backport ClickHouse#125823) adds REQUIRED_SECOND_FACTOR to a different branch; it does not touch the ACCESS_DENIED mapping. So the 500→403 mismatch cannot be introduced by this bump — it's a stale expectation in the oauth suite, which lives in Altinity/clickhouse-regression, not in this repo.

Suggested fix (not in this PR): update the two expectations in Altinity/clickhouse-regression to status_code=403 — oauth/tests/steps/common.py::assert_query_denied and oauth/tests/access_control.py::missing_default_profile_does_not_grant_unrestricted_access. Nothing to change on #2661.

---

2. Keeper Stress Tests (PR) — ❌ error → infra, not PR-caused

Status message: ClickHouse binary not found at /home/ubuntu/_work/ClickHouse/ClickHouse/ci/tmp/c… — the stress job couldn't find the server binary it was supposed to run. All Build (*) jobs for this SHA succeeded, so this is a transient artifact/job-ordering failure, not a build or code problem.

Suggested next step: re-run the job. Safe to ignore unless it reproduces.

---

3. DCO — ❌ fail → not PR-caused in the code sense (commit metadata)

The DCO app reports 79 commits "incorrectly signed off" (Sign-off not found) — these are the upstream backport commits (robot-clickhouse, clickhouse-gh[bot], etc.) pulled in by the bump; merge commits are correctly skipped. This is inherent to how these bump PRs are assembled and is not a code defect.

Fixing it would require rewriting all 79 commits' history (git rebase --signoff + force-push), which I will not do — force-push and history rewrites are outside my permissions, and it would mangle the backport provenance. This is a maintainer decision: either bypass/override DCO for the bump PR (as is normally done for these) or re-generate the branch with sign-offs on your side.

---

Still pending at analysis time

Integration tests (amd_asan_ubsan, db disk, old analyzer, 1-8/8), Build (amd_release / arm_release), and regression suites Iceberg, Parquet, ParquetS3, Swarms, S3Export were not finished — no verdict on those yet.

---

Bottom line: nothing here blocks the bump on its own merits. OAuth needs a one-line expectation bump in the external regression repo; Keeper Stress just needs a re-run; DCO is the usual backport-signoff noise for a version bump.

🤖 Generated with Claude Code