This is an automated email from the ASF dual-hosted git repository. liyang-kylin pushed a commit to branch doc5.0 in repository https://gitbox.apache.org/repos/asf/kylin.git
commit 9f041f1e8cc0da9865826442d49e9f94caeb5658 Author: Li Yang <[email protected]> AuthorDate: Mon Jul 13 16:08:27 2026 +0800 Kylin 5.0.4 update --- website/docs/development/security.md | 51 ---------------------- website/docs/download.md | 16 +++---- website/docs/quickstart/intro.md | 3 ++ website/docs/release_notes.md | 26 +++++++++++ website/docusaurus.config.ts | 4 +- .../docusaurus-plugin-content-docs/current.json | 2 +- .../current/download.md | 16 +++---- .../current/quickstart/intro.md | 3 ++ .../current/release_notes.md | 26 +++++++++++ website/package.json | 2 +- 10 files changed, 78 insertions(+), 71 deletions(-) diff --git a/website/docs/development/security.md b/website/docs/development/security.md index fb0a9ad5fa..a5c5d150e9 100644 --- a/website/docs/development/security.md +++ b/website/docs/development/security.md @@ -33,54 +33,3 @@ Please report any security problems to the project security address before discl The ASF Security team maintains a page with a description of how vulnerabilities are handled, check their [Web page](http://apache.org/security/) for more information. -# Known Security Issues -## CVE-2024-48944: Apache Kylin: SSRF vulnerability in the diagnosis api -Severity: low - -Affected versions: - -- Apache Kylin 5.0.0 through 5.0.1 - -Description: - -Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api on another internal host and possibly get leaked information. There are two preconditions: 1) The attacker has got admin access to a kylin server; 2) Another internal host has the "/kylin/api/xxx/diag" api - -endpoint open for service. - - -This issue affects Apache Kylin: from 5.0.0 -through - -5.0.1. - -Users are recommended to upgrade to version 5.0.2, which fixes the issue. - -This issue is being tracked as KYLIN-5644 - -Credit: - -- Zevi (finder) - -## CVE-2025-30067: Apache Kylin: The remote code execution via jdbc url - -Severity: low - -Affected versions: - -- Apache Kylin 4.0.0 through 5.0.1 - -Description: - -Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. -If an attacker gets access to Kylin's system or project admin permission, the JDBC connection configuration maybe altered to execute arbitrary code from the remote. You are fine as long as the Kylin's system and project admin access is well protected. - -This issue affects Apache Kylin: from 4.0.0 through 5.0.1. - -Users are recommended to upgrade to version 5.0.2 or above, which fixes the issue. - -This issue is being tracked as KYLIN-5994 - -Credit: - -Pho3n1x (finder) - diff --git a/website/docs/download.md b/website/docs/download.md index dc62f36e79..ec780703a1 100644 --- a/website/docs/download.md +++ b/website/docs/download.md @@ -4,14 +4,14 @@ sidebar_position: 1 # Download Apache Kylin -### v5.0.2-GA +### v5.0.4-GA - For more information about this release, please check [Release Notes](release_notes.md) and [Overview](overview.md) -- Source download: [apache-kylin-5.0.2-source-release.zip](https://github.com/apache/kylin/releases/download/kylin-5.0.2/apache-kylin-5.0.2-source-release.zip) \[[asc](https://github.com/apache/kylin/releases/download/kylin-5.0.2/apache-kylin-5.0.2-source-release.zip.asc)\] \[[sha256](https://github.com/apache/kylin/releases/download/kylin-5.0.2/apache-kylin-5.0.2-source-release.zip.sha256)\] -- Binary download: [apache-kylin-5.0.2-bin.tar.gz](https://github.com/apache/kylin/releases/download/kylin-5.0.2/apache-kylin-5.0.2-bin.tar.gz) \[[asc](https://github.com/apache/kylin/releases/download/kylin-5.0.2/apache-kylin-5.0.2-bin.tar.gz.asc)\] \[[sha256](https://github.com/apache/kylin/releases/download/kylin-5.0.2/apache-kylin-5.0.2-bin.tar.gz.sha256)\] +- Source download: [apache-kylin-5.0.4-source-release.zip](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-5.0.4/apache-kylin-5.0.4-source-release.zip) \[[asc](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-5.0.4/apache-kylin-5.0.4-source-release.zip.asc)\] \[[sha256](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-5.0.4/apache-kylin-5.0.4-source-release.zip.sha256)\] +- Binary download: [apache-kylin-5.0.4-bin.tar.gz](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-5.0.4/apache-kylin-5.0.4-bin.tar.gz) \[[asc](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-5.0.4/apache-kylin-5.0.4-bin.tar.gz.asc)\] \[[sha256](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-5.0.4/apache-kylin-5.0.4-bin.tar.gz.sha256)\] +### v4.0.4-GA +- Source download: [apache-kylin-4.0.4-source-release.zip](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-4.0.4/apache-kylin-4.0.4-source-release.zip) \[[asc](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-4.0.4/apache-kylin-4.0.4-source-release.zip.asc)\] \[[sha256](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-4.0.4/apache-kylin-4.0.4-source-release.zip.sha256)\] +- Binary download: [apache-kylin-4.0.4-bin.tar.gz](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-4.0.4/apache-kylin-4.0.4-bin.tar.gz) \[[asc](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-4.0.4/apache-kylin-4.0.4-bin.tar.gz.asc)\] \[[sha256](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-4.0.4/apache-kylin-4.0.4-bin.tar.gz.sha256)\] -### Dockerhub for preview - -To play and preview Kylin 5 in your laptop, -we recommend pulling the docker image and check the [standalone image](https://hub.docker.com/r/apachekylin/apache-kylin-standalone) in dockerhub. - +### Older versions +Please check out https://dist.apache.org/repos/dist/release/kylin/ diff --git a/website/docs/quickstart/intro.md b/website/docs/quickstart/intro.md index 86e81de4be..94034b0bc0 100644 --- a/website/docs/quickstart/intro.md +++ b/website/docs/quickstart/intro.md @@ -20,6 +20,9 @@ In this guide, we will explain how to quickly install and start Kylin 5. Before To explore new features in Kylin 5 on a laptop, we recommend pulling the Docker image and checking the [Apache Kylin Standalone Image on Docker Hub](https://hub.docker.com/r/apachekylin/apache-kylin-standalone) (For amd64 platform). +NOTE: The 5.0.2 docker version does NOT have the latest security fixes and is only good for personal function test. +ALWAYS USE THE LATEST VERSION for production and other serious tasks. + ```shell docker run -d \ --name Kylin5-Machine \ diff --git a/website/docs/release_notes.md b/website/docs/release_notes.md index 83ad6e77c3..a642ce00e5 100644 --- a/website/docs/release_notes.md +++ b/website/docs/release_notes.md @@ -15,6 +15,32 @@ or send to Apache Kylin mailing list: * User relative: [[email protected]](mailto:[email protected]) * Development relative: [[email protected]](mailto:[email protected]) +## v5.0.4 - 2026-07-13 + +__Bug Fix__ + +* [KYLIN-6078] - [Internal Table] job_range was occupied by another task, but the time partitions within job_range were refreshed successfully. +* [KYLIN-6084] - [Internal Table] Incorrect error message in internal table refresh API +* [KYLIN-6085] - Fix issue where ORDER BY in SQL subqueries does not take effect +* [KYLIN-6086] - [Internal Table] Fix Incorrect Data Range Display on Job Page +* [KYLIN-6089] - Validate table name in TableService#refreshTable +* [KYLIN-6090] - Add project permission verification to the job information retrieval API +* [KYLIN-6091] - Job handler parameters validation + +## v5.0.3 - 2025-09-19 + +__Enhancement__ + +* [KYLIN-5475] - Use javaCC to parse self define DML +* [KYLIN-6076] - Complete the verification of the additional tbl_properties field corresponding to storage_type in the internal table + +__Bug Fix__ + +* [KYLIN-6079] - Logical_view information was lost when upgrade Kylin +* [KYLIN-6080] - Support normal startup on macOS after packaging Kylin 5 with -withGluten +* [KYLIN-6081] - Remove unused endpoint +* [KYLIN-6082] - Fix API parameter check + ## v5.0.2 - 2025-03-31 __New Feature__ diff --git a/website/docusaurus.config.ts b/website/docusaurus.config.ts index f6e3ff1d71..c2fd0b98b4 100644 --- a/website/docusaurus.config.ts +++ b/website/docusaurus.config.ts @@ -23,7 +23,7 @@ function isPrerelease(version: string) { function getLastStableVersion() { // const lastStableVersion = versions.find((version) => !isPrerelease(version)); - const lastStableVersion = '5.0.2'; + const lastStableVersion = '5.0.4'; if (!lastStableVersion) { throw new Error('unexpected, no stable Docusaurus version?'); } @@ -120,7 +120,7 @@ const config = { lastVersion: 'current', versions: { current: { - label: '5.0.2', + label: '5.0.4', badge: true, path: '/', banner: 'none', diff --git a/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current.json b/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current.json index b76c844e75..0caf4ae4af 100644 --- a/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current.json +++ b/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current.json @@ -1,6 +1,6 @@ { "version.label": { - "message": "5.0.2", + "message": "5.0.4", "description": "The label for version current" }, "sidebar.DocumentSideBar.category.Quick Start": { diff --git a/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/download.md b/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/download.md index 121b34461f..9fd9203240 100644 --- a/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/download.md +++ b/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/download.md @@ -7,14 +7,14 @@ last_update: # 下载 Apache Kylin -### v5.0.2-GA +### v5.0.4-GA - 有关此版本的更多信息，请查看[版本注释](release_notes.md)和[概述](overview.md) -- 源码下载: [apache-kylin-5.0.2-source-release.zip](https://github.com/apache/kylin/releases/download/kylin-5.0.2/apache-kylin-5.0.2-source-release.zip) \[[asc](https://github.com/apache/kylin/releases/download/kylin-5.0.2/apache-kylin-5.0.2-source-release.zip.asc)\] \[[sha256](https://github.com/apache/kylin/releases/download/kylin-5.0.2/apache-kylin-5.0.2-source-release.zip.sha256)\] -- 安装包下载: [apache-kylin-5.0.2-bin.tar.gz](https://github.com/apache/kylin/releases/download/kylin-5.0.2/apache-kylin-5.0.2-bin.tar.gz) \[[asc](https://github.com/apache/kylin/releases/download/kylin-5.0.2/apache-kylin-5.0.2-bin.tar.gz.asc)\] \[[sha256](https://github.com/apache/kylin/releases/download/kylin-5.0.2/apache-kylin-5.0.2-bin.tar.gz.sha256)\] +- Source download: [apache-kylin-5.0.4-source-release.zip](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-5.0.4/apache-kylin-5.0.4-source-release.zip) \[[asc](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-5.0.4/apache-kylin-5.0.4-source-release.zip.asc)\] \[[sha256](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-5.0.4/apache-kylin-5.0.4-source-release.zip.sha256)\] +- Binary download: [apache-kylin-5.0.4-bin.tar.gz](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-5.0.4/apache-kylin-5.0.4-bin.tar.gz) \[[asc](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-5.0.4/apache-kylin-5.0.4-bin.tar.gz.asc)\] \[[sha256](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-5.0.4/apache-kylin-5.0.4-bin.tar.gz.sha256)\] +### v4.0.4-GA +- Source download: [apache-kylin-4.0.4-source-release.zip](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-4.0.4/apache-kylin-4.0.4-source-release.zip) \[[asc](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-4.0.4/apache-kylin-4.0.4-source-release.zip.asc)\] \[[sha256](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-4.0.4/apache-kylin-4.0.4-source-release.zip.sha256)\] +- Binary download: [apache-kylin-4.0.4-bin.tar.gz](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-4.0.4/apache-kylin-4.0.4-bin.tar.gz) \[[asc](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-4.0.4/apache-kylin-4.0.4-bin.tar.gz.asc)\] \[[sha256](https://dist.apache.org/repos/dist/release/kylin/apache-kylin-4.0.4/apache-kylin-4.0.4-bin.tar.gz.sha256)\] -### Dockerhub预览 - -在个人电脑中体验 Kylin 5, -我们建议在dockerhub中拉出docker镜像并检查[独立镜像](https://hub.docker.com/r/apachekylin/apache-kylin-standalone). - +### 更多老版本 +请访问 https://dist.apache.org/repos/dist/release/kylin/ diff --git a/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/quickstart/intro.md b/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/quickstart/intro.md index c72074a759..81a6fdee79 100644 --- a/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/quickstart/intro.md +++ b/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/quickstart/intro.md @@ -20,6 +20,9 @@ In this guide, we will explain how to quickly install and start Kylin 5. Before To explore new features in Kylin 5 on a laptop, we recommend pulling the Docker image and checking the [Apache Kylin Standalone Image on Docker Hub](https://hub.docker.com/r/apachekylin/apache-kylin-standalone) (For amd64 platform). +NOTE: The 5.0.2 docker version does NOT have the latest security fixes and is only good for personal function test. +ALWAYS USE THE LATEST VERSION for production and other serious tasks. + ```shell docker run -d \ --name Kylin5-Machine \ diff --git a/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/release_notes.md b/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/release_notes.md index 10380708ae..9bd2c67387 100644 --- a/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/release_notes.md +++ b/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/release_notes.md @@ -17,6 +17,32 @@ last_update: * 用户列表: [[email protected]](mailto:[email protected]) * 开发者列表: [[email protected]](mailto:[email protected]) +## v5.0.4 - 2026-07-13 + +__Bug修复__ + +* [KYLIN-6078] - [Internal Table] job_range was occupied by another task, but the time partitions within job_range were refreshed successfully. +* [KYLIN-6084] - [Internal Table] Incorrect error message in internal table refresh API +* [KYLIN-6085] - Fix issue where ORDER BY in SQL subqueries does not take effect +* [KYLIN-6086] - [Internal Table] Fix Incorrect Data Range Display on Job Page +* [KYLIN-6089] - Validate table name in TableService#refreshTable +* [KYLIN-6090] - Add project permission verification to the job information retrieval API +* [KYLIN-6091] - Job handler parameters validation + +## v5.0.3 - 2025-09-19 + +__增强__ + +* [KYLIN-5475] - Use javaCC to parse self define DML +* [KYLIN-6076] - Complete the verification of the additional tbl_properties field corresponding to storage_type in the internal table + +__Bug修复__ + +* [KYLIN-6079] - Logical_view information was lost when upgrade Kylin +* [KYLIN-6080] - Support normal startup on macOS after packaging Kylin 5 with -withGluten +* [KYLIN-6081] - Remove unused endpoint +* [KYLIN-6082] - Fix API parameter check + ## v5.0.2 - 2025-03-31 __新功能__ diff --git a/website/package.json b/website/package.json index 8111cd6df3..69c8c64be3 100644 --- a/website/package.json +++ b/website/package.json @@ -1,6 +1,6 @@ { "name": "website", - "version": "5.0.2", + "version": "5.0.4", "private": true, "scripts": { "docusaurus": "docusaurus",
