Release 483-e STS (16 Oct 2026)#

Starburst Enterprise platform (SEP) 483-e is the follow up SEP release to 482-e. It includes all improvements from the following Trino releases:

This release is a short term support (STS) release.

Breaking changes#

  • As of SEP 482-e.1, LDAP user and group synchronization no longer converts usernames and group names to lowercase. It now keeps the original case from the LDAP directory, which can change group membership for identifiers that were previously matched in lowercase. To keep the previous behavior, create etc/ldap-identifier-mapping.json with a lowercase mapping rule and set ldap-user-provisioning.identifier-mapping.file before upgrading. See LDAP user and group synchronization for more information.

  • Removed the raw JMX HTTP endpoint /v1/jmx/mbean/{objectName} from the Starburst Cache Service, Starburst Control Plane, and Starburst Metastore services. This endpoint allowed reading arbitrary MBean attributes and could expose sensitive JVM runtime arguments, including secrets passed as -D system properties. For example, truststore passwords. If you relied on this endpoint to scrape JMX metrics, use each service’s OpenMetrics endpoint (/metrics) instead. Note that /metrics exposes only numeric JMX attributes. Non-numeric MBean attribute data is no longer available over HTTP.

  • Removed the raw JMX HTTP endpoint /v1/jmx/mbean/{objectName} from SEP coordinators and workers. This endpoint allowed reading arbitrary MBean attributes and could expose sensitive JVM runtime arguments, including secrets passed as -D system properties. For example, truststore passwords. If you relied on this endpoint to scrape JMX metrics, use the OpenMetrics endpoint (/metrics) instead. Note that /metrics exposes only numeric JMX attributes. Non-numeric MBean attribute data is no longer available over HTTP.

  • The OpenAPI connector now exposes its generated table functions in a schema named api instead of default. Update any queries, views, or saved artifacts that reference <catalog>.default.<function> to use <catalog>.api.<function> instead.

  • To prevent Server Side Request Forgery (SSRF), the Starburst OpenAPI connector now rejects pagination links and redirects that target a different host or port than openapi.base-uri, or that downgrade from https to http. If your API paginates or redirects across hosts, configure a separate catalog per host.

  • Data Products as Code no longer accepts files that declare apiVersion: v1, including files without views or materialized views. The UI import and the starburst data-product lint and import commands reject these files. To convert a file, run starburst data-product migrate --to sep/v1, or re-export the data product. See Migrate a legacy file for more information.

  • Importing a Data Products as Code view or materialized view with a missing or blank definitionQuery now fails instead of creating the data product.

General#

  • Added the insights.query-history.timeout configuration property, which sets a timeout for queries that Insights runs on the backend service database.

  • Added the --prune-metadata-before-import flag to the HMS to Starburst Metastore migration tool. The flag removes the schemas contained in the export dump, and all objects that belong to those schemas, from Starburst Metastore before import.

  • Added the starburst data-product migrate command to convert a Data Products as Code file from the legacy apiVersion: v1 format to sep/v1. See Migrate a legacy file for more information.

  • Improved CTE reuse to support queries that contain correlated scalar subqueries.

  • Updated the default time range of the After date filter on the query overview page from 14 days to 1 day. To change the default, set the insights.query-history.range.default configuration property.

  • Updated the Data Products as Code file format to use apiVersion: sep/v1 and to group views and materializedViews under one datasets section. See Manage data products for details about the file format and CLI.

  • Fixed an issue where the HMS to Starburst Metastore migration tool failed to import tables with more than 100 partitions. Export and import operations must use the same version of the CLI. Dumps exported with earlier versions cannot be imported.

  • Fixed an issue where the Run and troubleshoot archive was missing the configs/ directory when two or more access control configuration files set the same access-control.name value.

  • Added support for Microsoft Fabric OneLake locations in the native Azure Storage file system. To enable access, add fabric.microsoft.com to the azure.endpoints property.

  • Added the azure.endpoints property to the Azure Storage file system configuration. azure.endpoints accepts a list of allowed Azure storage endpoint suffixes. A single catalog can now access locations that use different endpoints, such as core.windows.net and fabric.microsoft.com. The default remains core.windows.net. The azure.endpoint property is now deprecated. Use azure.endpoints instead.

Security#

  • Added compatibility with Apache Ranger Admin 2.9. Upgrade SEP before you upgrade Ranger Admin.

  • Added the starburst.access-control.role-to-user-assignment.enabled configuration property to disable direct role assignment to users in built-in access control.

  • Added support for the {user} placeholder in the catalog, schema, and table fields of file-based access control rules.

  • Fixed an issue where row filters and column masks that reference a table without a catalog name failed in Hive Ranger access control when the database name provider was set to CATALOG_SCHEMA.

  • Fixed a security issue where the JMX HTTP endpoint (/v1/jmx/mbean/{objectName}) on SEP coordinators and workers could expose sensitive JVM runtime arguments, such as truststore passwords configured as -D system properties, to unauthenticated or under-authenticated requests. The raw JMX HTTP endpoint has been removed. JMX-derived metrics remain available through the OpenMetrics /metrics endpoint.

Starburst AI#

  • Added the external MCP servers entity to built-in access control. A role needs the USE privilege on a server to view the server and attach it to an AIDA chat session.

  • Added support for Entra ID (OAuth 2.0 client credentials) authentication for Azure AI Foundry trusted connections that use the /openai/responses endpoint.

  • Added support for customizing a chart in an AIDA chat session, including its title, chart type, and series colors.

  • Fixed an issue where the Interaction details dialog in the Agent logs tab failed to open after the related AI Agent session was deleted.

  • Fixed an issue where the AIDA page went blank after you switched roles.

BigQuery connector#

  • Fixed an issue where the flush_metadata_cache procedure didn’t flush the cache used by table reads, so newly created tables could remain hidden after you ran the procedure.

Cosmos DB connector#

Delta Lake connector#

Elasticsearch connector#

Google Sheets connector#

Great Lakes connector#

  • Added support for the extra_properties property when creating Hive tables and views.

  • Added support for AWS Lake Formation access control.

HBase connector#

Hive connector#

  • Fixed an issue where querying a Hive view failed when the view definition used an IN predicate in a JOIN ... ON clause.

Hudi connector#

Iceberg connector#

  • Added support for caching table and view metadata for the Iceberg REST catalog.

  • Added support for HashiCorp Vault as a KMS provider for Iceberg table encryption.

  • Added support for web identity token credentials when signing REST catalog requests with SigV4. To use web identity token credentials, set s3.auth-type to WEB_IDENTITY.

  • Added support for a commit queue that reduces commit failures when many queries write to the same table at the same time.

  • Fixed an issue where SHOW STATS and INSERT statements with partition_statistics_collect_on_write enabled, failed to read partition statistics when vended credentials were enabled for an Iceberg REST catalog.

  • Fixed an issue where the Iceberg REST catalog was failing to access a table’s own root location when vended credentials were enabled for Google Lakehouse Iceberg REST Catalog.

  • Fixed an issue where queries failed when vended credentials were enabled for an Iceberg REST catalog that keys Azure SAS tokens by storage host name, such as Databricks Unity Catalog.

Kafka connector#

KDB+ connector#

Kudu connector#

  • Added support for the VARCHAR(n) data type.

MaxCompute connector#

MongoDB connector#

OpenSearch connector#

Oracle connector#

  • Improved performance of large table scans in the Oracle connector by enabling the dynamic fetch size heuristic for split queries.

Pinot connector#

Prometheus connector#

Redis connector#

Redshift connector#

Snowflake connector#

  • Added support for pushdown of DOUBLE, REAL, and BOOLEAN constants and the abs() function.

  • Added support for pushdown of the substring(), trim(), ltrim(), and rtrim() functions on VARCHAR columns when the snowflake.experimental-pushdown.enabled configuration property or the corresponding experimental_pushdown_enabled session property is set to true.

  • Fixed a vulnerability where role names used for role impersonation were not quoted, which could allow a user to assume an unintended Snowflake role. Role names that require quoting, such as names that contain dashes or spaces, now resolve correctly.

  • Fixed an issue where listing or querying tables in Snowflake catalog-linked databases failed or returned no results when snowflake.database-prefix-for-schema.enabled is set to true.

  • Fixed an issue where Snowflake connector queries that cast char or varchar values to a shorter length failed.

Synapse connector#

  • Added support for pushdown of = and IN predicates on NVARCHAR columns that use a case-sensitive or binary collation.

  • Fixed incorrect results for joins on NVARCHAR columns that use a case-sensitive or binary collation when values differ only in trailing spaces.

Thrift connector#

TPC-DS connector#

TPC-H connector#