Conversation
Reviewer's GuideAdds release notes documentation for Presto 0.297 by introducing a new Sphinx release page and temporarily checking in a large, auto-generated markdown file of missing release notes that must be deleted before merge. Flow diagram for 0_297 release notes authoring workflowflowchart TD
dev_start[Developer prepares 0_297 release notes] --> gen_notes[Run release notes generator]
gen_notes --> missing_md[Create release_notes_missing_0_297_md]
gen_notes --> rst_page[Create release_0_297_rst Sphinx page]
missing_md --> checklist[Review and complete missing release notes checklist]
checklist --> done_checklist[All release notes accounted for]
done_checklist --> remove_md[Delete release_notes_missing_0_297_md from repo]
rst_page --> review_pr[Open documentation pull request]
missing_md --> review_pr
review_pr --> ci_docs[Run docs build and release notes checks]
ci_docs --> approve_pr[Reviewer verifies release notes and missing file removal]
approve_pr --> merge[Merge PR with final 0_297 release notes]
Flow diagram for Sphinx release documentation structure with 0_297 pageflowchart TD
release_index[release_rst index] --> v296[release_0_296_rst]
release_index --> v297[release_0_297_rst]
release_index --> future_versions[Future_release_pages]
v297 --> sections[Per_feature_and_fix_sections]
sections --> links_prs[Links_to_GitHub_PRs]
sections --> user_visible_changes[Summaries_of_user_visible_changes]
sphinx_conf[Sphinx_configuration] --> release_index
sphinx_conf --> doctree[Docs_build_tree]
doctree --> html_output[Built_release_notes_html]
v297 --> html_output
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
There was a problem hiding this comment.
Hey - I've found 2 issues, and left some high level feedback:
- The helper file
release-notes-missing-0.297.mdis currently checked in at the repo root; since the PR description already calls this a temporary artifact, please remove it from the tree (or move it under a dedicated tooling location and .gitignore it) before merging so it doesn't ship with the release. - In
release-notes-missing-0.297.md, the trailing== NO RELEASE NOTE ==block contradicts the large extracted notes above; if you keep using this generator, consider removing or updating that placeholder so it doesn't cause confusion about whether release notes exist for 0.297.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The helper file `release-notes-missing-0.297.md` is currently checked in at the repo root; since the PR description already calls this a temporary artifact, please remove it from the tree (or move it under a dedicated tooling location and .gitignore it) before merging so it doesn't ship with the release.
- In `release-notes-missing-0.297.md`, the trailing `== NO RELEASE NOTE ==` block contradicts the large extracted notes above; if you keep using this generator, consider removing or updating that placeholder so it doesn't cause confusion about whether release notes exist for 0.297.
## Individual Comments
### Comment 1
<location path="presto-docs/src/main/sphinx/release/release-0.297.rst" line_range="20" />
<code_context>
+* Fix Materilized Views with ``DEFINER`` rights to require ``CREATE_VIEW_WITH_SELECT_COLUMNS`` on base tables. `#26902 <https://github.com/prestodb/presto/pull/26902>`_
</code_context>
<issue_to_address>
**issue (typo):** Correct spelling of 'Materilized' to 'Materialized'.
For consistency with the rest of the docs, this bullet should say “Materialized Views.”
```suggestion
* Fix Materialized Views with ``DEFINER`` rights to require ``CREATE_VIEW_WITH_SELECT_COLUMNS`` on base tables. `#26902 <https://github.com/prestodb/presto/pull/26902>`_
```
</issue_to_address>
### Comment 2
<location path="presto-docs/src/main/sphinx/release/release-0.297.rst" line_range="96" />
<code_context>
+* Upgrade ajvto 8.18.0 in response to `CVE-2025-69873 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69873>`_. `#27154 <https://github.com/prestodb/presto/pull/27154>`_
</code_context>
<issue_to_address>
**issue (typo):** Add a missing space between 'ajv' and 'to'.
Update this line to `Upgrade ajv to 8.18.0...` to fix the merged `ajvto` typo.
```suggestion
* Upgrade ajv to 8.18.0 in response to `CVE-2025-69873 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69873>`_. `#27154 <https://github.com/prestodb/presto/pull/27154>`_
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Snapshot WarningsEnsure that dependencies are being submitted on PR branches. Re-running this action after a short time may resolve the issue. See the documentation for more information and troubleshooting advice. Scanned FilesNone |
Co-authored-by: Steve Burnett <burnett@pobox.com>
Co-authored-by: Steve Burnett <burnett@pobox.com>
Co-authored-by: Steve Burnett <burnett@pobox.com>
|
I am done with the first set of reviews, and this PR is now ready for the Release Shepherd - who for this release is @hantangwangd. What I have done:
What I did not do:
Work left to do: Thank you @hantangwangd for already populating the Breaking Changes and Highlights sections! I believe that the work remaining in this PR for the Release Shepherd is:
If there's anything else I can do to help, or any questions, please ask and I'm happy to. |
Missing Release Notes
Apurva Kumar
Chandrakant Vankayalapati
Dong Wang
rewrite_data_filesprocedure #26374 feat(plugin-iceberg): Addrewrite_data_filesprocedure (Merged by: Dong Wang)Maria Basmanova
Prabhu Shankar
Pramod Satya
Reetika Agrawal
Sreeni Viswanadha
XiaoDu
Zac
adheer-araokar
tanjialiang
Extracted Release Notes
optimizer.optimize-top-n-rankto enable the rewrite.24302.Connector.beginTransactionin a backward compatible way to support passing the autocommit context into connector transactions.Access-Control-Allow-Originheader validation for cross-origin requests and restricts WebSocket connections from IP addresses in theOriginheader unless explicitly configured viaallowedHosts. This dependency is used for local development only and does not affect production runtime.admin/properties:\`resource-manager.http-server-enabled``and :ref:admin/properties:``resource-manager.communication-protocol```.CVE-2025-59250<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59250>_.CVE-2025-66566 <https://nvd.nist.gov/vuln/detail/CVE-2025-66566>_.materialized_viewstable to the information schema.USE_STITCHINGmode formaterialized_view_stale_read_behaviorsession property to selectively recompute stale data instead of full recomputation.materialized_view_staleness_windowsession property to configure acceptable staleness duration.materialized_view_force_stalesession property for testing stale read behavior.iceberg.materialized-view-max-changed-partitionsconfig property (default: 100) to limit partition tracking for predicate stitching.http-server.https.keystore.scan-interval-secondsconfiguration flag to scan the keystore file periodically for new certs.CVE-2025-5115 <https://nvd.nist.gov/vuln/detail/CVE-2025-5115>_.materialized_view_stale_read_behaviorsession property andmaterialized-view-stale-read-behaviorconfig property.stale_read_behaviorandstaleness_windowtable properties for materialized views.img-src 'http: https:'in response toCWE-693 <https://cwe.mitre.org/data/definitions/693.html>_. :pr:25910.hive.restrict-procedure-callfor ranger and sql-standard access control. It defaults totrue, meaning procedure calls are restricted. To allow procedure calls, set this configuration property tofalse.iceberg.securityproperty in the Iceberg catalog properties file. The supported types areallow-allandfile.CVE-2024-53990 <https://github.com/advisories/GHSA-mfj5-cf8g-g2fv>_ andCVE-2025-12183 <https://github.com/advisories/GHSA-vqf4-7m7x-wgfc>_.CVE-2025-66566 <https://github.com/advisories/GHSA-cmp6-m4wj-q63q>_.CVE-2025-66453 <https://github.com/advisories/GHSA-3w8q-xq97-5j7x>_.CVE-2025-67735 <https://github.com/advisories/GHSA-84h7-rjj3-6jx4>_.CVE-2025-68161 <https://nvd.nist.gov/vuln/detail/CVE-2025-68161>_.CREATE BRANCH.CREATE BRANCHsupport for Iceberg.CREATE_VIEW_WITH_SELECT_COLUMNSpermission for definer rights MVs #26902 (Author: Timothy Meehan): fix(analyzer): CheckCREATE_VIEW_WITH_SELECT_COLUMNSpermission for definer rights MVsDEFINERrights to requireCREATE_VIEW_WITH_SELECT_COLUMNSon base tables.CVE-2025-68161 <https://nvd.nist.gov/vuln/detail/CVE-2025-68161>_.CVE-2020-26237 <https://github.com/advisories/GHSA-vfrc-7r7c-w9mx>_.functions/plugin-loaded-functions:array functions.CVE-2025-12183 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12183>_.NativeFunctionHandleparsing.CVE-2025-13465 <https://github.com/advisories/GHSA-xxjr-mmjv-4gpg>_.CVE-2025-13465 <https://github.com/advisories/GHSA-xxjr-mmjv-4gpg>_.native_max_target_file_sizesession property to control the maximum target file size for writers. When a file exceeds this size during writing, the writer will close the current file and start writing to a new file.webpackfrom5.97.1to5.104.1to address security vulnerabilities including a user information bypass in HttpUriPlugin and SSRF prevention improvements. This is a development dependency used for building the Presto UI and does not affect production runtime./presto_cpp/limitations.PushdownThroughUnnestoptimizer rule that pushes projections and filter conjuncts not dependent on unnest output variables below the UnnestNode, gated by thepushdown_through_unnestsession property (default enabled).experimental.max-total-running-task-count-to-not-execute-new-query) is enabled.CVE-2025-67721 <https://www.cve.org/CVERecord?id=CVE-2025-67721>_.CVE-2025-69873 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69873>_.textfile_field_delim,textfile_escape_delim,textfile_collection_delim, andtextfile_mapkey_delim./connector/lancefor reading and writing LanceDB datasets.materialized_view_query_rewrite_cost_based_selection_enabledsession property.SimplifyCoalesceOverJoinKeysthat simplifies redundantCOALESCEexpressions over equi-join key pairs based on join type, enabling bucketed join optimizations for tool-generated queries. Controlled by thesimplify_coalesce_over_join_keyssession property (disabled by default).IFexpressions:IF(x, IF(y, v, E), E)is rewritten toIF(x AND y, v, E)when the outer and inner else branches are identical. Handles arbitrary nesting depth and both null and non-null else branches.pre_aggregate_before_grouping_sets. (:pr:27290).UPDATING FORclause.LIKE '%substring%'pattern matching by rewriting toSTRPOSinstead ofCARDINALITY(SPLIT(...)), improving CPU and memory efficiency. :pr:27311.CVE-2026-24281 <https://github.com/advisories/GHSA-7xrh-hqfc-g7qr>,CVE-2026-24308 <https://github.com/advisories/GHSA-crhr-qqj8-rpxc>./functions/table.ADD COLUMN DEFAULT.ADD COLUMN DEFAULT./developer/table-functions.flattedfrom3.3.3to3.4.2in response toGHSA-rf6f-7fwh-wjgh <https://github.com/WebReflection/flatted/security/advisories/GHSA-rf6f-7fwh-wjgh>_ addressing a HIGH severity prototype pollution vulnerability (CWE-1321) in the parse() function. This dependency is used by the UI development tooling and does not affect production runtime.UnaliasSymbolReferenceswhen alias mapping contains a cycle caused by multiple variables mapped to the same constant expression across different ProjectNodes.handlebarsfrom4.7.8to4.7.9in response to multiple security advisories includingGHSA-2w6w-674q-4c4q <https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q>,GHSA-3mfm-83xf-c92r <https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r>,GHSA-xhpv-hc6g-r9c6 <https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xhpv-hc6g-r9c6>,GHSA-xjpj-3mr7-gcpf <https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf>,GHSA-9cx6-37pm-9jff <https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff>,GHSA-2qvq-rjwj-gvw9 <https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9>,GHSA-7rx3-28cr-v5wh <https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-7rx3-28cr-v5wh>, andGHSA-442j-39wm-28r2 <https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-442j-39wm-28r2>. This dependency is used by thets-jesttesting framework and does not affect production runtime.CVE-2026-33891 <https://www.cve.org/CVERecord?id=CVE-2026-33891>_ (DoS in BigInteger.modInverse),CVE-2026-33894 <https://www.cve.org/CVERecord?id=CVE-2026-33894>_ (RSA-PKCS signature forgery),CVE-2026-33895 <https://www.cve.org/CVERecord?id=CVE-2026-33895>_ (Ed25519 signature forgery), andCVE-2026-33896 <https://www.cve.org/CVERecord?id=CVE-2026-33896>_ (basicConstraints bypass in certificate chain verification). This dependency is used bywebpack-dev-serverfor development and does not affect production runtime.CVE-2026-33871 <https://github.com/advisories/GHSA-w9fj-cfpg-grvv>_.All Commits
nimble.stats.enable_vectorizedfor consi… (misc: Rename config key tonimble.stats.enable_vectorizedfor consi… #27398) (Ke)LIKErewrites for prefix/suffix patterns in native execution (perf(native): AvoidLIKErewrites for prefix/suffix patterns in native execution #27363) (Pramod Satya)sorted_byfordata_rewrite_filesprocedure (feat: Supportsorted_byfordata_rewrite_filesprocedure #26804) (Dong Wang)Release Notes
Note: The full release notes summary was too large (76874 characters) for GitHub's PR body limit.
The complete summary has been saved to
release-notes-missing-0.297.mdin this pull request.Please delete this file before merging.
Summary by Sourcery
Documentation: