2025 Changelog

ClickHouse release v24.8.13.16-lts (c8a1e828dcf) FIXME as compared to v24.8.12.28-lts (832432bd021)

Bug Fix (user-visible misbehavior in an official stable release)

• Backported in #74804: Fix security issue to prevent SQL injection in postgresql and sqlite table functions. #74144 (Pablo Marcos).
• Backported in #74386: Fix logical error in s3queue during setting file as failed. #74216 (Kseniia Sumarokova).
• Backported in #74867: Keeper fix: fix reading log entries from disk. #74785 (Antonio Andelic).

Build/Testing/Packaging Improvement

• Backported in #75285: Improvement to set even more restrictive defaults. The current defaults are already secure - the user has to specify an option to publish ports explicitly. But when the default user doesn’t have a password set by CLICKHOUSE_PASSWORD and/or a username changed by CLICKHOUSE_USER environment variables, it should be available only from the local system as an additional level of protection. #75259 (Mikhail f. Shiryaev).

NOT FOR CHANGELOG / INSIGNIFICANT

• Backported in #74923: Fix calculation of metrics BackupsThreadsActive and RestoreThreadsActive. Those metrics were not updated before this PR. #74456 (Vitaly Baranov).
• Backported in #74681: A follow-up for #74399, send the event as early as possible. #74666 (Mikhail f. Shiryaev).
• Backported in #75328: Add option to skip user setup in entrypoint.sh. #75316 (Nikita Fomichev).