Antalya 26.6 - Bump to v26.6.2.160-stable

base/poco/NetSSL_OpenSSL/src/SecureSocketImpl.cpp

@@ -468,23 +468,27 @@ long SecureSocketImpl::verifyPeerCertificateImpl(const std::string& hostName)
 	    (mode != Context::VERIFY_STRICT && isLocalHost(hostName)))
 		return X509_V_OK;
 
+	// SSL_get1_peer_certificate returns a certificate whose reference count has
+	// been incremented; the caller owns that reference and must X509_free it,
+	// otherwise the peer certificate leaks on every verified handshake.
 	X509* pCert = SSL_get1_peer_certificate(_pSSL);
 	if (pCert)
 	{
+        long result = X509_V_ERR_APPLICATION_VERIFICATION;
         if (X509_check_host(pCert, hostName.c_str(), hostName.length(), 0, nullptr) == 1)
         {
-            return X509_V_OK;
+            result = X509_V_OK;
         }
         else
         {
             IPAddress ip;
             if (IPAddress::tryParse(hostName, ip))
             {
-                auto result = X509_check_ip_asc(pCert, hostName.c_str(), 0) == 1;
-                return result ? X509_V_OK : X509_V_ERR_APPLICATION_VERIFICATION;
+                result = X509_check_ip_asc(pCert, hostName.c_str(), 0) == 1 ? X509_V_OK : X509_V_ERR_APPLICATION_VERIFICATION;
             }
         }
-        return X509_V_ERR_APPLICATION_VERIFICATION;;
+        X509_free(pCert);
+        return result;
 	}
 	else return X509_V_OK;
 }

contrib/simdjson-cmake/CMakeLists.txt

@@ -29,6 +29,17 @@ if (NOT (ARCH_AMD64 AND X86_ARCH_LEVEL VERSION_GREATER_EQUAL 3))
     target_compile_options(_simdjson PRIVATE -DSIMDJSON_IMPLEMENTATION_FALLBACK=1)
 endif()
 
+# On LoongArch, simdjson's CPU dispatch reads the HWCAP_LOONGARCH_LSX / HWCAP_LOONGARCH_LASX
+# bits (see contrib/simdjson/src/internal/isadetection.h). These are kernel UAPI macros defined
+# in <asm/hwcap.h>, but simdjson only includes <sys/auxv.h>, which pulls in glibc's <bits/hwcap.h>.
+# The glibc in our LoongArch sysroot is old enough that its <bits/hwcap.h> defines no bits for this
+# architecture ("No bits defined for this architecture."), so the macros are unreachable and the
+# build fails. Force-include the kernel header so the macros are always available. The header has an
+# include guard and its values match glibc's, so this is a benign no-op once the sysroot is updated.
+if(ARCH_LOONGARCH64)
+    target_compile_options(_simdjson PRIVATE -include asm/hwcap.h)
+endif()
+
 # On ppc64le, ClickHouse globally defines __SSE2__ to enable SSE-to-AltiVec emulation.
 # This causes simdjson's experimental json_string_builder to activate its SSE2 code path,
 # which fails to compile due to __m128i vs __m128i_u type mismatch in the PPC SSE wrappers.

docs/en/engines/database-engines/datalake.md

@@ -81,4 +81,5 @@ SETTINGS
     onelake_client_secret = client_secret;
 SHOW TABLES IN database_name;
 SELECT count() from database_name.table_name;
-```
+```
+To authenticate without sharing a client secret, set `onelake_bearer_token` to a pre-obtained bearer token (scoped to `https://storage.azure.com`) instead of `onelake_client_id`/`onelake_client_secret`. ClickHouse does not refresh the token, so the database must be recreated after it expires.

docs/en/engines/table-engines/integrations/azureBlobStorage.md

@@ -29,7 +29,7 @@ CREATE TABLE azure_blob_storage_table (name String, value UInt32)
 - `account_key` - if storage_account_url is used, then account key can be specified here
 - `format` — The [format](/interfaces/formats.md) of the file.
 - `compression` — Supported values: `none`, `gzip/gz`, `brotli/br`, `xz/LZMA`, `zstd/zst`. By default, it will autodetect compression by file extension. (same as setting to `auto`).
-- `partition_strategy` – Options: `wildcard` or `hive`. `wildcard` requires a `{_partition_id}` in the path, which is replaced with the partition key. `hive` does not allow wildcards, assumes the path is the table root, and generates Hive-style partitioned directories with Snowflake IDs as filenames and the file format as the extension. Defaults to the `file_like_engine_default_partition_strategy` setting (`wildcard` under `compatibility` settings older than `26.6`, `hive` otherwise).
+- `partition_strategy` – Options: `wildcard` or `hive`. `wildcard` requires a `{_partition_id}` in the path, which is replaced with the partition key. `hive` does not allow wildcards, assumes the path is the table root, and generates Hive-style partitioned directories with Snowflake IDs as filenames and the file format as the extension. If the path contains a `{_partition_id}` placeholder, defaults to `wildcard` — the only strategy compatible with such a path. Otherwise defaults to the `file_like_engine_default_partition_strategy` setting (`wildcard` under `compatibility` settings older than `26.6`, `hive` otherwise).
 - `partition_columns_in_data_file` - Only used with `hive` partition strategy. Tells ClickHouse whether to expect partition columns to be written in the data file. Defaults `false`.
 - `extra_credentials` - Use `client_id` and `tenant_id` for authentication. If extra_credentials are provided, they are given priority over `account_name` and `account_key`.
 
@@ -105,7 +105,7 @@ For partitioning by month, use the `toYYYYMM(date_column)` expression, where `da
 
 #### Partition strategy {#partition-strategy}
 
-`wildcard`: Replaces the `{_partition_id}` wildcard in the file path with the actual partition key. Reading is not supported. Selected by default only under `compatibility` settings older than `26.6`; otherwise the default is `hive` (see the `file_like_engine_default_partition_strategy` setting).
+`wildcard`: Replaces the `{_partition_id}` wildcard in the file path with the actual partition key. Reading is not supported. Selected by default when the path contains a `{_partition_id}` placeholder (the only strategy compatible with such a path), and otherwise under `compatibility` settings older than `26.6`; in the remaining cases the default is `hive` (see the `file_like_engine_default_partition_strategy` setting).
 
 `hive` implements hive style partitioning for reads & writes. Reading is implemented using a recursive glob pattern. Writing generates files using the following format: `<prefix>/<key1=val1/key2=val2...>/<snowflakeid>.<toLower(file_format)>`.
 

docs/en/engines/table-engines/integrations/s3.md

@@ -45,9 +45,9 @@ CREATE TABLE s3_engine_table (name String, value UInt32)
 - `format` — The [format](/sql-reference/formats#formats-overview) of the file.
 - `aws_access_key_id`, `aws_secret_access_key` - Long-term credentials for the [AWS](https://aws.amazon.com/) account user.  You can use these to authenticate your requests. Parameter is optional. If credentials are not specified, they are used from the configuration file. For more information see [Using S3 for Data Storage](../mergetree-family/mergetree.md#table_engine-mergetree-s3).
 - `compression` — Compression type. Supported values: `none`, `gzip/gz`, `brotli/br`, `xz/LZMA`, `zstd/zst`. Parameter is optional. By default, it will auto-detect compression by file extension.
-- `partition_strategy` – Options: `WILDCARD` or `HIVE`. `WILDCARD` requires a `{_partition_id}` in the path, which is replaced with the partition key. `HIVE` does not allow wildcards, assumes the path is the table root, and generates Hive-style partitioned directories with Snowflake IDs as filenames and the file format as the extension. Defaults to the `file_like_engine_default_partition_strategy` setting (`WILDCARD` under `compatibility` settings older than `26.6`, `HIVE` otherwise).
+- `partition_strategy` – Options: `WILDCARD` or `HIVE`. `WILDCARD` requires a `{_partition_id}` in the path, which is replaced with the partition key. `HIVE` does not allow wildcards, assumes the path is the table root, and generates Hive-style partitioned directories with Snowflake IDs as filenames and the file format as the extension. If the path contains a `{_partition_id}` placeholder, defaults to `WILDCARD` — the only strategy compatible with such a path. Otherwise defaults to the `file_like_engine_default_partition_strategy` setting (`WILDCARD` under `compatibility` settings older than `26.6`, `HIVE` otherwise).
 - `partition_columns_in_data_file` - Only used with `HIVE` partition strategy. Tells ClickHouse whether to expect partition columns to be written in the data file. Defaults `false`.
-- `storage_class_name` - Options: `STANDARD` or `INTELLIGENT_TIERING`, allow to specify [AWS S3 Intelligent Tiering](https://aws.amazon.com/s3/storage-classes/intelligent-tiering/).
+- `storage_class_name` - Options: `STANDARD`, `REDUCED_REDUNDANCY`, `STANDARD_IA`, `ONEZONE_IA`, `INTELLIGENT_TIERING`, `GLACIER_IR`, `EXPRESS_ONEZONE`. Only S3 storage classes that allow immediate retrieval are supported (archival classes such as `GLACIER` and `DEEP_ARCHIVE` are not). Allows to specify [AWS S3 Intelligent Tiering](https://aws.amazon.com/s3/storage-classes/intelligent-tiering/).
 - `extra_credentials` - Optional. Used to pass a `role_arn` for role-based access in ClickHouse Cloud. See [Secure S3](/cloud/data-sources/secure-s3) for configuration steps.
 
 ### Data cache {#data-cache}
@@ -89,7 +89,7 @@ For partitioning by month, use the `toYYYYMM(date_column)` expression, where `da
 
 #### Partition strategy {#partition-strategy}
 
-`WILDCARD`: Replaces the `{_partition_id}` wildcard in the file path with the actual partition key. Reading is not supported. Selected by default only under `compatibility` settings older than `26.6`; otherwise the default is `HIVE` (see the `file_like_engine_default_partition_strategy` setting).
+`WILDCARD`: Replaces the `{_partition_id}` wildcard in the file path with the actual partition key. Reading is not supported. Selected by default when the path contains a `{_partition_id}` placeholder (the only strategy compatible with such a path), and otherwise under `compatibility` settings older than `26.6`; in the remaining cases the default is `HIVE` (see the `file_like_engine_default_partition_strategy` setting).
 
 `HIVE` implements hive style partitioning for reads & writes. Reading is implemented using a recursive glob pattern, it is equivalent to `SELECT * FROM s3('table_root/**.parquet')`.
 Writing generates files using the following format: `<prefix>/<key1=val1/key2=val2...>/<snowflakeid>.<toLower(file_format)>`.
@@ -165,7 +165,8 @@ ENGINE = S3(
            'http://minio:10000/clickhouse//test_{_partition_id}.csv',
            'minioadmin',
            'minioadminpassword',
-           'CSV')
+           'CSV',
+           partition_strategy='wildcard')
 PARTITION BY column3
 ```
 

docs/en/operations/named-collections.md

@@ -98,6 +98,16 @@ To use ZooKeeper/Keeper we also need to set up a `path` (path in ZooKeeper/Keepe
 
 An optional configuration parameter `update_timeout_ms` by default is equal to `5000`.
 
+You can inspect the active storage type through `system.server_settings` and `getServerSetting`:
+
+```sql
+SELECT value, getServerSetting('named_collections_storage_type')
+FROM system.server_settings
+WHERE name = 'named_collections_storage.type';
+```
+
+Changing the storage type requires a server restart; `SYSTEM RELOAD CONFIG` does not change the active backend.
+
 ## Storing named collections in configuration files {#storing-named-collections-in-configuration-files}
 
 ### XML example {#xml-example}

docs/en/operations/system-tables/server_settings.md

@@ -14,7 +14,7 @@ import SystemTableCloud from '@site/docs/_snippets/_system_table_cloud.md';
 ## Description {#description}
 
 Contains information about global settings for the server, which are specified in `config.xml`.
-Currently, the table shows only settings from the first layer of `config.xml` and doesn't support nested configs (e.g. [logger](../../operations/server-configuration-parameters/settings.md#logger)).
+The table also includes supported nested settings with a fixed structure; dynamic sections such as lists are not included.
 
 ## Columns {#columns}