This release makes the subnet function work directly with typed and string IP addresses, which removes boilerplate in TQL pipelines. It also fixes several stability issues in where, unroll, files, context::enrich, and collection indexing.
🚀 Features
Section titled “🚀 Features”IP address support in subnet
Section titled “IP address support in subnet”The subnet function now accepts typed IP addresses, plain IP strings, and
existing subnet values with an optional prefix length:
from {source_ip: 10.10.1.124}net = subnet(source_ip, 24)This returns 10.10.1.0/24 without converting the IP address to a string first.
When you omit the prefix, IPv4 addresses become /32 host subnets and IPv6
addresses become /128 host subnets.
🐞 Bug Fixes
Section titled “🐞 Bug Fixes”Large unroll output stability
Section titled “Large unroll output stability”The unroll operator no longer crashes when expanding very large lists into output that exceeds Arrow’s per-array capacity.
Recursive files traversal of unreadable directories
Section titled “Recursive files traversal of unreadable directories”The files operator now skips unreadable child directories during recursive traversal, emits a warning for each skipped directory by default, and continues listing accessible siblings. Set skip_permission_denied=true to ignore permission-denied paths silently: this suppresses warnings for skipped child directories and still makes an unreadable initial directory produce no events instead of an error. Non-permission filesystem errors continue to fail the pipeline.
Fixed unbounded memory growth context::enrich
Section titled “Fixed unbounded memory growth context::enrich”Apr 23, 2026 · @IyeOnline
We fixed an issue in the context::enrich operator that did cause unbounded
memory growth.
Crash fix for deep left-associated where expressions
Section titled “Crash fix for deep left-associated where expressions”Apr 23, 2026 · @tobim, @codex · #6068
Tenzir no longer segfaults on some very deep left-associated boolean
expressions in where clauses due to source-location handling.
Unsigned integer indexing in TQL
Section titled “Unsigned integer indexing in TQL”Both list and record indexing in TQL now work with signed and unsigned integer indices.
This also applies to record field-position indexing and to the get function for records and lists.