Arc 26.04.1

[xe-nvdk]

Performance

Native DuckDB Arrow query path — bypasses database/sql row scanning entirely; results read as Arrow record batches directly from DuckDB. JSON endpoint: +59% (1.43M → 2.28M rows/sec). Arrow IPC endpoint: +157% (2.45M → 6.29M rows/sec) on 1.88B row dataset
Typed JSON streaming serialization — zero-allocation streaming writer replaces json.Marshal. ~8KB constant memory regardless of result size. 2.3x faster serialization, 99.9% fewer allocations
Basekick-Labs/msgpack v6 — lower-allocation decode path. Sustained throughput: 16.78M → 18.23M rec/s. 60s degradation: 22% → 13%

Security (update recommended)

RBAC write permission bypass fixed — CheckWritePermissions used wrong context key, silently bypassing all write restrictions. Update immediately if running RBAC.
Token create/update API now validates permission strings (privilege escalation fix)
RequireAdmin middleware added to all mutating endpoints (CQ, delete, retention, compaction, scheduler)
WAL reader OOM on corrupt WAL — payload length now validated before allocation
MessagePack decoder data race — non-atomic counters fixed
Ingestion buffer Close() race fixed
MQTT /stats and /health endpoints now require authentication
ARC_DATABASE_MEMORY_LIMIT validated against allowlist before DuckDB SET (SQL injection via config)
Delete WHERE clause blocks UNION, SELECT, CREATE, COPY, ATTACH, LOAD, PRAGMA, CALL, SET
Temp directories changed from 0755 to 0700

New Features

Automatic compaction deduplication — last-write-wins on identical tag+timestamp combinations. Zero config, zero overhead when no duplicates. Tag columns auto-detected from arc:tags Parquet metadata
Decimal128 type support — native Parquet DECIMAL for financial/scientific precision. Configure via ARC_INGEST_DECIMAL_COLUMNS
S3 path prefix (ARC_STORAGE_S3_PREFIX) — shared-bucket multi-tenant isolation
Bootstrap token (ARC_AUTH_BOOTSTRAP_TOKEN) — set known admin token at deploy time
Auth recovery (ARC_AUTH_FORCE_BOOTSTRAP) — adds recovery token without removing existing tokens
WAL drops metric — arc_wal_dropped_entries_total Prometheus counter. WAL buffer size configurable via ARC_WAL_BUFFER_SIZE
Slow query logging — configurable threshold (ARC_QUERY_SLOW_QUERY_THRESHOLD_MS), WARN log + arc_slow_queries_total counter

##Bug Fixes
Hourly compaction race with active ingestion — compaction now enforces 1-hour minimum file age. Default config corrected: hourly_min_age_hours = 1, hourly_min_files = 10
CQ scheduler now reloads immediately on update (no restart required)
Atomic CQ execution recording (SQLite transaction prevents duplicate/missing windows)
S3 delete-rewrite and backup restore now stream instead of loading full files into memory
Token expiration display fixed (*time.Time — non-expiring tokens no longer show as "Expired")
Auth bootstrap TOCTOU race fixed (INSERT ... WHERE NOT EXISTS)
Helm: default deployment strategy changed to Recreate (fixes RollingUpdate deadlock with ReadWriteOnce PVC)

Dependencies

DuckDB 1.4.3 → 1.4.4 (Parquet UTF-8 stats tolerance, Arrow string view pushdown fix, mode() use-after-free, S3 credential secure clear)
Arrow Go v18.4.1 → v18.5.2 (large string Parquet write fix, decompression regression, GC pressure reduction)
gRPC 1.79.1 → 1.79.3 (authorization bypass fix for malformed :path headers)

What's Changed

• feat(auth): add ARC_AUTH_BOOTSTRAP_TOKEN and ARC_AUTH_FORCE_BOOTSTRAP for predictable deployments and recovery by @xe-nvdk in feat(auth): add ARC_AUTH_BOOTSTRAP_TOKEN and ARC_AUTH_FORCE_BOOTSTRAP for predictable deployments and recovery #360
• fix(helm): default deployment strategy to Recreate for RWO volume compatibility by @xe-nvdk in fix(helm): default deployment strategy to Recreate for RWO volume compatibility #361
• fix(security): restrict temp file permissions and validate memory_limit by @xe-nvdk in fix(security): restrict temp file permissions and validate memory_limit #368

Full Changelog: v26.03.2...v26.04.1

---

This discussion was created from the release Arc 26.04.1.