v1.7.20
Security and stability release addressing use-after-free vulnerabilities in dependencies (lru, crossbeam), upgrading uuid and other critical packages, fixing LIKE wildcard escaping in schema compiler, and resolving key projection issues in tesseract.
1.7.20 (2026-08-16)
Bug Fixes
- cubestore: bump lru to 0.18.2 to clear two use-after-free advisories (#11531) (387e1ad)
- cubestore: drop async-std to clear the crossbeam advisories (#11546) (58f3cd7)
- deps: bump uuid from 8.3.2 to 11.1.1 across the packages that declare it (#11534) (c66cbbe)
- deps: float handlebars, form-data and tar to clear two criticals (#11549) (33c8828), closes #7891 #7589 #11109 #7589 #8252
- schema-compiler: escape LIKE wildcards on the native planner (#11569) (f050c08), closes #11570
- shared,templates: replace the unmaintained decompress package (#11532) (f7822ca)
- tesseract: project a primary key once in the keys subquery (#11527) (528d755), closes #11455
Source: original entry ↗
More from Cube
Follow Cube to get its new changes in your feed and email digest.
Stop rollupJoin and rollupLambda from leaking memory through memoized references
Fixed a memory leak in the schema-compiler where rollupJoin and rollupLambda functions were holding memoized references. This resolves performance degradation in long-running processes.
v1.8.5
Release 1.8.5 includes bug fixes for cubesql subqueries and databricks-jdbc-driver time handling, a new environment variable for controlling scheduled refresh timers, and performance improvements for pre-aggregation matching.
v1.8.4
This release includes bug fixes for API gateway SQL injection vulnerabilities, client state management issues, and decimal calculation accuracy in CubeStore, plus new CLI support for managing custom roles and improved leaf merge optimization in Tesseract.