[acmeguy]

Summary

Upgrades all @cubejs-backend/* from 1.7.30 to 1.8.16 and fixes everything the upgrade breaks or newly exposes.

Breaks fixed

• Base image → bookworm. Cube ≥1.7.36's x86_64 native module needs glibc 2.34; bullseye has 2.31 (GLIBC_2.32 not found at load). The build now fails fast if @cubejs-backend/native cannot load.
• Java 8 → 21. The JDBC drivers start the JVM with --add-opens, which Java 8 rejects by segfaulting the process.
• driverFactory builds drivers with ServerCore.createDriver. Since 1.7.37 drivers ship ESM entry points, and new (await import(pkg)).default() threw "is not a constructor" on every raw-driver route (test connection, get-schema, smart-gen, exports…).
• loadExport imports QueryType from the api-gateway root. 1.8 renamed the dist enum, and the named import failed at link time, so the server would not start.
• Postinstall: gate on 1.8.16; drop the ClickHouse String patch (fixed upstream in 1.7.38). The other four patches still apply unchanged.
• Removed upstream: the Elasticsearch driver (gone since 1.7.0; ES datasources already failed on 1.7.30). The @knowitall Vertica alias is swapped for the official driver.

Security (new exposure from the upgrade)

• Tenant datasource types duckdb, sqlite, jdbc, databricks-jdbc, cubestore are refused.
  • DuckDB starts loading on bookworm and can read any file on the pod; /proc/self/environ holds JWT_KEY.
  • JDBC starts working on Java 21, and a tenant customClassPath can load the bundled HSQLDB/Derby jars and run Java in our JVM.
  • cubestore is our own store, holding every tenant's pre-aggregations.
  • Only types Cube knows are accepted, so the third-party package lookup by type name never runs. Dev uses only ClickHouse, Postgres and BigQuery.
• Join aliases (new in 1.8): under row rules, member paths through a model-declared join alias are rejected, because row rules attach to a path's first segment.

Dependency hygiene

• extract-zip shim removed: nothing in the tree requests it any more.
• Production npm audit: 97 → 79 findings, criticals 3 → 1, none introduced.

Verification

• arm64 image: yarn test 727/727; the new tests fail on the old driverFactory/loadExport (is not a constructor, Named export 'QueryType' not found).
• Local side-by-side, 1.7.30 vs 1.8.16 (with CubeStore 1.8.16) on real ClickHouse/BigQuery/Postgres datasources: 25 datasources, /meta member lists identical.
  • /load: 109 identical results, 0 new-only errors. The 38 queries that fail on both versions are pre-existing model or data errors.
  • The one remaining difference is freshness: the old stack serves a rollup last refreshed 2026-10-22; 1.8.16 had just rebuilt it.
  • CSV and Arrow exports, test, get-schema and the SQL API (row-rule partition filter injected) all match.
• Refresh worker on 1.8.16: builds rollups. BigQuery "table not found" errors fail only that build; the worker stays up, so the stream patch still holds.
• Adversarial review (3 lenses + 2 refuters per finding); the confirmed findings are fixed in the second commit.
• CI on this PR: amd64 build + native load check + test suite.

Deploy notes (dev)

• Merge order:
  1. cxs2 #2159, so usedPreAggregations in /load is read as an object.
  2. The fraios infra PR, which keeps dev query pods building rollups on demand (Cube 1.7.47+ ignores NODE_ENV=development), keeps query-log values unredacted, and moves CubeStore to 1.8.16.
  3. This PR.
• Rollup rebuilds: only rollups that count on a ClickHouse cube with a composite primary key rebuild (the cast changes to Nullable(String)); 54/55 sampled rollups keep their table version.

Not in this PR (pre-existing, found during review)

• Queries on views don't get row-rule filters: views aren't in the cube→table map, so their name is used as the table name.
• scripts/checkLiveSchemas.mjs compiles empty models since perf(cubejs): scheduler reads model code once per version, not every interval #95, so it fails every context on any version.

🤖 Generated with Claude Code