Version 6.4.3¶

Released on 2026-08-19.

Note

If you are upgrading a cluster, you must be running CrateDB 5.0.0 or higher before you upgrade to 6.4.3.

We recommend that you upgrade to the latest 6.3 release before moving to 6.4.3.

A rolling upgrade from >= 6.3.0 to 6.4.3 is supported. Before upgrading, you should back up your data.

Warning

Tables that were created before CrateDB 5.x will not function with 6.x and must be recreated before moving to 6.x.x.

You can recreate tables using COPY TO and COPY FROM or by inserting the data into a new table.

Table of contents

See the Version 6.4.0 release notes for a full list of changes in the 6.4 series.

Breaking Changes ¶

Changed the error response for INSERT INTO .. VALUES bulk operations for errors like unavailable shards. In 5.10 the reporting was unintentionally changed to report the error on top-level instead of per bulk item. This restores the 5.9 behavior and reports the error per bulk item again. This allows to distinguish successful inserts if only a subset of shards wasn’t available. For example if using the HTTP interface, the response could look like this:

HTTP/1.1 200 OK
{
    "cols": [],
    "duration": 60112.33,
    "results": [
        {
            "rowcount": 1
        },
        {
            "rowcount": 1
        },
        {
            "error": {
                "code": 5002,
                "message": "UnavailableShardsException[[doc.tbl][1] primary shard is not active Timeout: [1m], request: [ShardRequest{, shardId=[tbl/tAwjETKASaGfQJRrnn1M4g][1], timeout=1m}]]"
            },
            "rowcount": -2
        }
    ]
}

Added requirement for AL privilege on cluster level in addition to the DDL privilege when issuing RESTORE SNAPSHOT, if the restored sections include user management metadata, (users, roles and privileges). This is the case for:
- RESTORE SNAPSHOT ... ALL
- RESTORE SNAPSHOT ... METADATA
- RESTORE SNAPSHOT ... USERMANAGEMENT
Previously the DDL privilege alone was sufficient. For more details see the security advisory.

Fixes ¶

Fixed a ClassCastException that could occur if using byte or short columns within an ORDER BY clause of a window functions OVER clause together with a RANGE BETWEEN window definition.
Authentication via HTTP is no longer cached on connection level to support proxy use-cases with keepalive. For more details see the security advisory.
Limited the duration clients using the PostgreSQL wire protocol can remain unauthenticated to make it more difficult to launch Denial of Service attacks. For more details see the security advisory.
Limited the size of messages accepted from unauthenticated clients using the PostgreSQL wire protocol to make it more difficult to launch Denial of Service attacks. For more details see the security advisory.
Fixed an issue that allowed authenticated users to bypass the COPY FROM restriction to read from file URIs - which is supposed to be restricted to superusers. For more details see the security advisory.
Fixed a security vulnerability that could allow clients to spoof the IP address used for host based authentication as a _local address if auth.trust.http_support_x_real_ip=true was set to true, and if there wasn’t a trusted proxy in use that filters or sanitizes X-Real-IP headers. For more details see the security advisory.
Fixed an issue that could cause partitions of tables to be excluded from a query if the WHERE clause contained a complex expression nesting an IS NULL clause.
Fixed a NullPointerException that could happen if using an aggregation function as window function with a FILTER clause on a column containing NULL values.
Fixed an issue that could lead to an OutOfMemoryError when running a query with aggregations under memory pressure.
Fixed a NullPointerException that could happen if using an aggregation function as window function with RANGE..FOLLOWING on a column containing NULL values.
Fixed an issue that caused a string_agg aggregation to fail with IndexOutOfBoundsException error when used as a part of a window function with windows of size 1, for example ROWS BETWEEN CURRENT ROW AND CURRENT ROW
Fixed an issue that caused a SUM aggregation to return wrong results when used as part of a window function and a not null value being last in one window and next window having only NULL-s. An Example:
```
select sum(x) OVER (ROWS BETWEEN CURRENT ROW AND CURRENT ROW)
from (
  select 10
  union all
  select null
) tbl (x);
```
Fixed an issue that could lead to a memory leak if nodes within the cluster were temporarily not reachable.
Fixed incorrect results in window function when using RANGE <offset> FOLLOWING/PRECEDING with ORDER BY <column> DESC.
Fixed an issue that caused WHERE starts_with(col, '') on an indexed column to only match rows where col is the empty string, instead of all rows where col is not NULL.
Fixed an issue that caused range queries, e.g. <, >= or BETWEEN, on a NUMERIC column with a precision of 18 or less which was created with INDEX OFF to not match any rows.
Fixed an issue that caused round(x, precision) to take a very long time, up to the point where a query seems to hang, if a negative number of large magnitude is used for precision, e.g.:
```
SELECT round(-1479165877, -556375977);
```
A large positive precision had the same effect and now is capped to 16383, meaning, if the precision exceeds 16383 the function would yield results as if the precision was set to the maximum value of 16383.
Fixed an issue that caused CREATE USER to fail with Setting '<name>' is not supported even when a valid session setting was provided, e.g.:
```
CREATE USER john WITH (password = 'foo', enable_hashjoin = false);
```
Such session settings are now saved with the created user. Like with ALTER ROLE, they can only be set for a user and not for a role.

Fixed an issue that caused a UNION ALL inside a sub-select to return values of the wrong column if the outer query used an ORDER BY on a column which was not selected. e.g.:

SELECT ts FROM (
  SELECT * FROM (SELECT l.k, l.ts FROM a l JOIN a r ON l.k = r.k) j WHERE 1 = 0
  UNION ALL
  SELECT * FROM a
) u ORDER BY k;

Fixed an issue that could cause a query containing two or more joins to hang indefinitely on a multi-node cluster. This happened when both the outer and the inner join were executed distributed, and their inputs were large enough to be transferred in more than one page between the nodes. Nested joins are now always executed non-distributed, only the very outer join is executed distributed. Note that this fix may cause performance degradation.
Fixed an issue that allowed authenticated users to read data from tables and views, on which they don’t have DQL privileges, by using sub-queries inside UPDATE or DELETE statements. Sub-queries used in such statements now require the DQL privilege on all involved tables and views. For more details see the security advisory.

Fixed incorrect results in rank() and dense_rank() window functions when an explicit window frame is specified, e.g.:

SELECT rank() OVER (
  ORDER BY <column> ROWS BETWEEN UNBOUNDED PRECEDING AND UNBOUNDED FOLLOWING)
FROM tbl

Fixed an issue causing queries with an OUTER JOIN return incorrect results if WHERE clause had a subquery.

Fixed an issue where lag and lead ignored row-dependent offset and default value expressions. e.g:

SELECT id,
   offset,
   lag(x, offset, -1) OVER (ORDER BY id) AS v
FROM t
ORDER BY id

Version 6.4.3¶

Breaking Changes¶

Fixes¶

Breaking Changes ¶

Fixes ¶