Merge remote-tracking branch 'origin/main' into qwp_query_reset_dict_flag

# Conflicts:
#	core/src/test/java/io/questdb/client/test/cutlass/qwp/websocket/TestWebSocketServer.java

Author: bluestreak01

.claude/skills/review-pr/SKILL.md

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# Assert the glibc runtime floor of a Linux native library.
+#
+# Usage: check-glibc-floor.sh <path-to-libquestdb.so> <max-glibc-version>
+#   e.g. check-glibc-floor.sh core/.../linux-x86-64/libquestdb.so 2.14
+#        check-glibc-floor.sh core/.../linux-aarch64/libquestdb.so 2.17
+#
+# The dynamic linker resolves .gnu.version_r at load time, so the HIGHEST
+# GLIBC_x.y version node the library imports is its hard load floor: a host
+# whose glibc is older than that node fails System.loadLibrary/dlopen with
+# `version 'GLIBC_x.y' not found`. This script extracts every versioned import
+# and fails if the highest one exceeds the allowed floor.
+#
+# Why the floors are what they are:
+#   * linux-x86-64 -> 2.14. The oldest node we intentionally keep is
+#     memcpy@GLIBC_2.14; clock_gettime is pinned back to GLIBC_2.2.5 by
+#     src/main/c/share/glibc_compat.h, and stat/fstat resolve to the inline
+#     __xstat/__fxstat@GLIBC_2.2.5 wrappers when built in a low-glibc container.
+#     A build on a modern host (glibc >= 2.33) instead emits stat@GLIBC_2.33 /
+#     fstat@GLIBC_2.33 and trips this guard -- that is exactly the regression it
+#     exists to catch.
+#   * linux-aarch64 -> 2.17. glibc gained aarch64 support in 2.17, so 2.17 is
+#     the lowest floor physically achievable on that architecture.
+#
+# Portable to bash 3.2 (no mapfile / no negative array indices) so it can be run
+# locally on macOS as well as in the glibc build containers.
+set -euo pipefail
+
+lib="${1:?usage: check-glibc-floor.sh <lib.so> <max-glibc-version>}"
+floor="${2:?usage: check-glibc-floor.sh <lib.so> <max-glibc-version>}"
+
+if [ ! -f "$lib" ]; then
+  echo "::error::check-glibc-floor: library not found: $lib"
+  exit 1
+fi
+
+# All distinct versioned GLIBC nodes (e.g. 2.14, 2.2.5), sorted ascending.
+# objdump prints them as (GLIBC_x.y) or GLIBC_x.y depending on the toolchain;
+# the -o regex captures the token regardless of surrounding parentheses.
+# GLIBC_PRIVATE has no digit after the underscore, so it is naturally excluded.
+versions="$(
+  objdump -T "$lib" \
+    | grep -oE 'GLIBC_[0-9]+(\.[0-9]+)+' \
+    | sed 's/^GLIBC_//' \
+    | sort -Vu
+)"
+
+if [ -z "$versions" ]; then
+  echo "::error::check-glibc-floor: no versioned GLIBC symbols found in $lib (unexpected)."
+  exit 1
+fi
+
+highest="$(printf '%s\n' "$versions" | tail -n1)"
+
+echo "GLIBC version nodes required by $lib:"
+printf '%s\n' "$versions" | sed 's/^/  GLIBC_/'
+echo "Highest required: GLIBC_${highest} (allowed floor: GLIBC_${floor})"
+
+# leq A B -> succeeds when version A <= version B: sorting {A, B} with -V puts B
+# last, or they are equal.
+leq() {
+  [ "$1" = "$2" ] && return 0
+  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$2" ]
+}
+
+if leq "$highest" "$floor"; then
+  echo "OK: $lib floor is GLIBC_${highest} (<= GLIBC_${floor})."
+  exit 0
+fi
+
+echo "::error::GLIBC floor regression in $lib: requires GLIBC_${highest}, above the GLIBC_${floor} floor."
+echo "::error::This library will fail to load on hosts with glibc < ${highest}."
+echo "Offending nodes above the floor and the symbols that pull them in:"
+printf '%s\n' "$versions" | while IFS= read -r v; do
+  if ! leq "$v" "$floor"; then
+    echo "  GLIBC_${v}:"
+    objdump -T "$lib" | grep -E "GLIBC_${v//./\\.}([^0-9]|\$)" | awk '{print "    " $NF}' | sort -u
+  fi
+done
+exit 1

.github/scripts/check-glibc-floor.sh

@@ -9,9 +9,10 @@ downloaded="core/target/downloaded-native-artifacts"
 staged="core/target/native-libs/io/questdb/client/bin"
 
 # platform -> library filename
+# darwin-x86-64 is intentionally not shipped: no CI runs the test suite on x64
+# macOS, so the release does not build or bundle a binary it cannot test.
 declare -A libs=(
   [darwin-aarch64]=libquestdb.dylib
-  [darwin-x86-64]=libquestdb.dylib
   [linux-aarch64]=libquestdb.so
   [linux-x86-64]=libquestdb.so
   [windows-x86-64]=libquestdb.dll

.github/scripts/stage-native-artifacts.sh

@@ -17,17 +17,20 @@ defaults:
 jobs:
   # JDK 8 is the source of truth: the client ships as a Java 8 artifact
   # (io.questdb:questdb-client) and is released from JDK 8, so on JDK 8 it must
-  # compile, the full test suite must pass against the committed native
-  # libraries, and the javadoc jar must build (-P javadoc attaches it at the
-  # package phase). The committed native .so/.dylib/.dll are enough -- the only
-  # git submodule (zstd) is needed solely for C++ native rebuilds, not here.
+  # compile, the full test suite must pass, and the javadoc jar must build
+  # (-P javadoc attaches it at the package phase). The native libraries are no
+  # longer committed, so this job compiles libquestdb.so from source (hence the
+  # zstd submodule + cmake/nasm/build-essential toolchain) before the tests run.
   build-jdk8:
     name: Build, test & javadoc (JDK 8)
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
       - name: Check out
         uses: actions/checkout@v4
+        with:
+          # zstd is required to compile the native library.
+          submodules: recursive
 
       - name: Set up JDK 8
         uses: actions/setup-java@v4
@@ -36,6 +39,26 @@ jobs:
           java-version: "8"
           cache: maven
 
+      - name: Install native build toolchain
+        run: sudo apt-get update && sudo apt-get install -y cmake nasm build-essential
+
+      - name: Build native libquestdb.so
+        # JAVA_HOME points at the JDK 8 above, so the lib is compiled against the
+        # Java 8 JNI headers -- the artifact's Java floor. Copy it into src
+        # resources (not target/) so it survives the `mvn clean` in the next step
+        # and gets packaged + loaded via the production bin/<platform> path.
+        # NOTE: this builds on ubuntu-latest for FUNCTIONAL testing only; the
+        # library's glibc runtime floor is validated separately by the
+        # `glibc-floor` job, which rebuilds in the release low-glibc container.
+        run: |
+          cd core
+          cmake -DCMAKE_BUILD_TYPE=Release -B cmake-build-release -S.
+          cmake --build cmake-build-release --config Release
+          test -f target/classes/io/questdb/client/bin-local/libquestdb.so
+          mkdir -p src/main/resources/io/questdb/client/bin/linux-x86-64
+          cp target/classes/io/questdb/client/bin-local/libquestdb.so \
+             src/main/resources/io/questdb/client/bin/linux-x86-64/libquestdb.so
+
       - name: Compile, test, and build javadoc
         run: mvn -B -ntp -P javadoc clean install
 
@@ -61,3 +84,80 @@ jobs:
 
       - name: Compile (main + test) and build javadoc (no tests run)
         run: mvn -B -ntp -P javadoc -DskipTests clean package
+
+  # GLIBC floor guard. The native libraries are built at release time in
+  # low-glibc manylinux containers (see maven_central_release.yml) and are NOT
+  # committed, so a floor regression is invisible to the functional test job
+  # above (it builds on ubuntu-latest, whose glibc is new enough to load almost
+  # anything). This job rebuilds the linux libraries in the SAME low-glibc
+  # environment as release and asserts the runtime floor with objdump, so a
+  # change that raises the floor (e.g. a new stat/fstat call pulling in
+  # stat@GLIBC_2.33 on a modern build host) fails the PR instead of silently
+  # shipping a library that cannot load on older distros.
+  #
+  #   * linux-x86-64  -> GLIBC_2.14 (the intended floor: memcpy@GLIBC_2.14).
+  #   * linux-aarch64 -> GLIBC_2.17 (the lowest floor glibc offers on aarch64).
+  #
+  # Uses manylinux_2_28 for both arches (stock Node 24, no glibc-2.17 shadow
+  # hack). The x86-64 floor is identical in manylinux2014 (2.17) and
+  # manylinux_2_28 (2.28) -- both resolve stat/fstat to the inline
+  # __xstat/__fxstat@GLIBC_2.2.5 wrappers -- so this validates the real shipped
+  # floor without the heavier manylinux2014 release toolchain.
+  glibc-floor:
+    name: GLIBC floor guard (${{ matrix.platform }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux-x86-64
+            os: ubuntu-latest
+            image: quay.io/pypa/manylinux_2_28_x86_64
+            jdk_arch: x64
+            floor: "2.14"
+            cmake_args: ""
+            build_dir: cmake-build-release
+          - platform: linux-aarch64
+            os: ubuntu-22.04-arm
+            image: quay.io/pypa/manylinux_2_28_aarch64
+            jdk_arch: aarch64
+            floor: "2.17"
+            cmake_args: "-DCMAKE_TOOLCHAIN_FILE=./src/main/c/toolchains/linux-arm64.cmake"
+            build_dir: cmake-build-release-arm64
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    container:
+      image: ${{ matrix.image }}
+    steps:
+      - name: Check out
+        uses: actions/checkout@v4
+        with:
+          # zstd is required to compile the native library.
+          submodules: recursive
+
+      - name: Install tooling
+        # binutils provides objdump for the floor check; nasm/zstd are build deps.
+        run: |
+          yum update -y
+          yum install -y wget nasm zstd binutils
+
+      - name: Install Temurin JDK 8 (for jni.h)
+        # Build against the Java 8 JNI headers -- JDK 8 is the artifact's floor.
+        # The JDK version does not affect the glibc floor; it only supplies jni.h.
+        run: |
+          wget -v --timeout=180 -O jdk8.tar.gz \
+            "https://api.adoptium.net/v3/binary/latest/8/ga/linux/${{ matrix.jdk_arch }}/jdk/hotspot/normal/eclipse"
+          mkdir jdk8
+          tar xfz jdk8.tar.gz -C jdk8 --strip-components=1
+          echo "JAVA_HOME=$(pwd)/jdk8" >> "$GITHUB_ENV"
+
+      - name: Build native libquestdb.so
+        run: |
+          cd core
+          cmake ${{ matrix.cmake_args }} -DCMAKE_BUILD_TYPE=Release -B ${{ matrix.build_dir }} -S.
+          cmake --build ${{ matrix.build_dir }} --config Release
+
+      - name: Assert GLIBC floor
+        run: |
+          ./.github/scripts/check-glibc-floor.sh \
+            core/target/classes/io/questdb/client/bin-local/libquestdb.so \
+            "${{ matrix.floor }}"