#5555th of 146 in Backends, databases and hosting
pinot
Distributed real-time OLAP datastore with SQL queries over streaming and batch data
- Stars
- 6.2k
- License
- Apache-2.0
- Last commit
- Nov 2026
- Last release
- Oct 2026
- Language
- Java
6,042 on 22 Apr 20266,174 on 11 Nov 2026
From GitHub's daily star counts.
Checked on GitHub.
Overview
Apache Pinot is a column-oriented distributed datastore for low-latency analytical SQL on fresh data. It ingests from Kafka, Pulsar and Kinesis as well as batch sources such as HDFS, S3, ADLS and GCS, and can combine both in one table. It also offers vector similarity search, with a built-in query console and REST API.
Who it is for: Teams building user-facing real-time analytics on streaming data at scale
Strengths
- Pluggable indexes: timestamp, inverted, StarTree, Bloom, range, text, JSON, geospatial
- Real-time ingest from Kafka, Pulsar and Kinesis, with upserts and batch/stream hybrid tables
- Joins, built-in multitenancy and a Helm chart for Kubernetes clusters
- Vector index supports semantic search and RAG on the same SQL engine
Weaknesses
- Multi-component cluster to operate; not a single-process database
- Building from source requires JDK 25+ and a long Maven build
- Suited to immutable, time-series style analytics rather than transactional workloads
- Lucene upgrades or downgrades can trigger index rebuilds, adding CPU and load time
What it needs
- RAM ≥ 6 GB
- no GPU
- Needs Apache Kafka (optional, for streaming ingest), Kubernetes/Helm (optional, for cluster deployment), JDK 25+ (to build)
- port 9000
What changed
“Pinot services now require Java 25 or newer to build and run. Java/JDBC”
“Drop-in security update for 1.5.0 — no behavioral changes.”
CVE-2025-55163, CVE-2025-59419, CVE-2026-33870, CVE-2026-33871, CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587, CVE-2026-34478, CVE-2026-34479, CVE-2026-34480, CVE-2026-34481, CVE-2026-45300, CVE-2026-40542, CVE-2026-5598, CVE-2026-0636, CVE-2026-5588, CVE-2026-45205, CVE-2026-2332. “Apache Pinot 1.5.1 is a security patch release based on 1.5.0. It contains only dependency updates and dependency-exclusion changes to resolve reported CVEs — no functional, API, configuration, or wi…”
- release-1.5.0 ↗ (opens in a new tab)Security fix
“TLS protocol allowlist: Allow configuring permitted TLS protocols and hardened JVM SSL initialization. #17776”
From the release notes. No flag means the note does not say so, not that the upgrade is safe.
Also in Backends, databases and hosting
See all 146| Rank | Project | Score |
|---|---|---|
| 1 | bunJavaScript and TypeScript runtime with bundler, test runner and package manager | 93 out of 100 |
| 2 | appwriteBackend with auth, databases, storage, functions and an MCP server for agents | 93 out of 100 |
| 3 | ormTypeScript ORM for PostgreSQL and MongoDB with a plugin SPI and agent skills | 93 out of 100 |
| #4 | strapiHeadless CMS that generates REST and GraphQL APIs from content models | 92 out of 100 |
| #5 | traefikHTTP reverse proxy and load balancer that auto-discovers routes from orchestrators | 92 out of 100 |