SEP STS breaking changes#

This page compiles the breaking changes introduced in Starburst Enterprise platform (SEP) STS release 471-e and higher. When upgrading between SEP releases, refer to this page to address all breaking changes listed between the two.

483-e STS (16 Oct 2026)#

  • As of SEP 482-e.1, LDAP user and group synchronization no longer converts usernames and group names to lowercase. It now keeps the original case from the LDAP directory, which can change group membership for identifiers that were previously matched in lowercase. To keep the previous behavior, create etc/ldap-identifier-mapping.json with a lowercase mapping rule and set ldap-user-provisioning.identifier-mapping.file before upgrading. See LDAP user and group synchronization for more information.

  • Removed the raw JMX HTTP endpoint /v1/jmx/mbean/{objectName} from the Starburst Cache Service, Starburst Control Plane, and Starburst Metastore services. This endpoint allowed reading arbitrary MBean attributes and could expose sensitive JVM runtime arguments, including secrets passed as -D system properties. For example, truststore passwords. If you relied on this endpoint to scrape JMX metrics, use each service’s OpenMetrics endpoint (/metrics) instead. Note that /metrics exposes only numeric JMX attributes. Non-numeric MBean attribute data is no longer available over HTTP.

  • Removed the raw JMX HTTP endpoint /v1/jmx/mbean/{objectName} from SEP coordinators and workers. This endpoint allowed reading arbitrary MBean attributes and could expose sensitive JVM runtime arguments, including secrets passed as -D system properties. For example, truststore passwords. If you relied on this endpoint to scrape JMX metrics, use the OpenMetrics endpoint (/metrics) instead. Note that /metrics exposes only numeric JMX attributes. Non-numeric MBean attribute data is no longer available over HTTP.

  • The OpenAPI connector now exposes its generated table functions in a schema named api instead of default. Update any queries, views, or saved artifacts that reference <catalog>.default.<function> to use <catalog>.api.<function> instead.

  • To prevent Server Side Request Forgery (SSRF), the Starburst OpenAPI connector now rejects pagination links and redirects that target a different host or port than openapi.base-uri, or that downgrade from https to http. If your API paginates or redirects across hosts, configure a separate catalog per host.

  • Data Products as Code no longer accepts files that declare apiVersion: v1, including files without views or materialized views. The UI import and the starburst data-product lint and import commands reject these files. To convert a file, run starburst data-product migrate --to sep/v1, or re-export the data product. See Migrate a legacy file for more information.

  • Importing a Data Products as Code view or materialized view with a missing or blank definitionQuery now fails instead of creating the data product.

481-e STS (15 Jun 2026)#

  • Legacy Hadoop-based object storage support has been removed from the Delta Lake, Hive, and Iceberg connectors. Any catalog using fs.hadoop.enabled=true for cloud object storage or the legacy hive.s3.*, hive.azure.*, or hive.gcs.* configuration properties fail to start after upgrading. fs.hadoop.enabled now only activates HDFS support. You must migrate to native file system support before upgrading:

    • S3: set fs.native-s3.enabled=true and rename hive.s3.* properties

    • Azure: set fs.native-azure.enabled=true and rename hive.azure.* properties

    • GCS: set fs.native-gcs.enabled=true and rename hive.gcs.* properties

    See the migration guides for full property mapping tables.

  • The internal-communication.shared-secret and node.environment configuration properties are no longer supported in connector configuration files when managed statistics is enabled. Configurations containing these properties fail to initialize on startup, regardless of whether managed statistics is enabled. Remove these properties from your configurations before upgrading.

  • Geospatial functions now reject WKT input containing invalid geometry that was previously accepted and silently corrected. Queries passing non-conforming WKT strings now fail with a parse error. Validate and correct any WKT inputs in your queries before upgrading.

  • ST_Union() now returns an empty geometry collection instead of NULL when called with no input rows. Update any queries that check for a NULL result from ST_Union() on empty inputs.

  • ST_Union() no longer inserts additional vertices at intersection points when unioning a point with a line. Queries that depended on those extra intersection vertices in the output geometry produce different results after upgrading.

  • Removed the ai.agent.persona-directory-path configuration property and support for defining custom personas in JSON files. Remove the property from your coordinator configuration file or the cluster fails to start. You can now create and manage custom personas in the UI.

  • The Starburst Control Plane OAuth2/OIDC redirect URI (callback URL) changed from /oidc/callback to /auth/oauth/callback. If you configured OAuth2 authentication for Control Plane, update the redirect URI registered with your identity provider to https://<control-plane-domain-name>/auth/oauth/callback.

  • The Trino S3 file system implementation (io.trino.hdfs.s3.TrinoS3FileSystem) was removed in Trino 481. If you use Ranger Audit with SEP, you must update your file system to one supported directly by Hadoop. Reference Hadoop documentation for more information. For one example, if you are using Ranger Audit to S3, update the following properties in your Ranger Audit configuration:

Ranger Audit to S3 properties#

Former property

Former value

New property

New value

xasecure.audit.destination.hdfs.config.fs.s3.impl

io.trino.hdfs.s3.TrinoS3FileSystem

xasecure.audit.destination.hdfs.config.fs.s3a.impl

org.apache.hadoop.fs.s3a.S3AFileSystem

xasecure.audit.destination.hdfs.config.fs.AbstractFileSystem.s3.impl

io.trino.hdfs.s3.TrinoS3FileSystem

xasecure.audit.destination.hdfs.config.fs.AbstractFileSystem.s3a.impl

org.apache.hadoop.fs.s3a.S3AFileSystem

xasecure.audit.destination.hdfs.config.trino.s3.endpoint

Unchanged

xasecure.audit.destination.hdfs.config.fs.s3a.endpoint

Unchanged

xasecure.audit.destination.hdfs.config.trino.s3.access-key

Unchanged

xasecure.audit.destination.hdfs.config.fs.s3a.access.key

Unchanged

xasecure.audit.destination.hdfs.config.trino.s3.secret-key

Unchanged

xasecure.audit.destination.hdfs.config.fs.s3a.secret.key

Unchanged

xasecure.audit.destination.hdfs.config.trino.s3.path-style-access

Unchanged

xasecure.audit.destination.hdfs.config.fs.s3a.path.style.access

Unchanged

Additionally, xasecure.audit.destination.hdfs.dir must have the s3a:/// scheme instead of s3:///.

478-e STS (8 Dec 2025)#

  • As of SEP 478-e, the default implementation of the ConnectorFactory#getSecuritySensitivePropertyName method is abstract. This method identifies configuration properties that may contain security-sensitive information so the engine can mask their values. Custom connectors must provide their own implementation. This change affects only customers who maintain custom plugins.

472-e STS (17 Apr 2025)#

  • The following HTTP client property prefixes have been renamed:

    • workerInfo to worker-info

    • memoryManager to memory-manager

    If you use these properties in your configuration files, the old names are no longer recognized. Update your configurations to use the new names to avoid unexpected behavior.

  • The following Hive metastore HTTP client properties have been removed:

    • hive.metastore.http.client.additional-headers

    • hive.metastore.http.client.authentication.type

    • hive.metastore.http.client.bearer-token

    • hive.metastore.http.client.read-timeout

    If your current configuration includes any of these properties, update your configuration to remove them. If left in place, you may experience connection and authentication issues when interacting with the Hive metastore.

  • The Db2 connector no longer supports setting fetchSize in the JDBC connection URL. You must remove fetchSize from your connection-url property and use the db2.fetch-size property instead.

471-e STS (1 Apr 2025)#

  • The minimum required Java runtime for the JDBC driver and CLI has been updated to Java 11. If you are using an earlier version, you must upgrade to Java 11 or later.

  • The optimize_hash_generation session property and the optimizer.optimize-hash-generation configuration option have been removed. You must remove these properties from your configuration or the cluster fails to start.

  • The following Unity catalog metastore configuration properties have been renamed in the Delta Lake connector:

    • delta.metastore.unity.host to hive.metastore.unity.host

    • delta.metastore.unity.catalog-name to hive.metastore.unity.catalog-name

    • delta.metastore.unity.access-token to hive.metastore.unity.token

    Update these properties in your catalog configuration file or the cluster fails to start.

  • The Kinesis connector has been removed. Update your dependencies and configurations to use an alternative connector.