What MariaDB/server shipped
Written by FoxPlug from the repository's own releases; not affiliated with Mariadb. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/MariaDB/server; Mariadb did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Added the ANY_VALUE() function, the SQL:2023 T626 feature. Pull request #5151
- OPTIMIZE TABLE no longer grows tables, because PageBulk::init() takes a hint page number and tries to allocate adjacent pages for the index. Pull request #5985
- Fixed a crash when re-parsing an
sp_instr_setthat does not own its LEX, which happens when a multi-variable DECLARE shares one DEFAULT expression. Pull request #5643 - The mariabackup SST backup-data stream is now authenticated, since the per-transfer secret is generated regardless of ssl-mode, not only for VERIFY_* and not only for the GTID stage. Pull request #6090
- Mariabackup --prepare no longer trusts the
plugin_dirvalue from backup-my.cnf, so a backup arriving over an untrusted channel cannot redirect plugin loading. Pull request #6087 - Set GLOBAL innodb_log_archive=ON is now crash safe, because
log_t::header_rewrite() zeroes garbage entries at the end of the file before setting archive=true. Pull request #6079 - Recovery no longer hangs when a system or undo tablespace page is corrupted; the code path no longer holds an extra buffer-fix that corrupted_evict() would wait on. Pull request #6075
- Mariadb-binlog --start-datetime and --stop-datetime now handle values outside the TIMESTAMP range instead of silently treating them as 1970. Pull request #5983
- Restored the use of ER_TRUNCATE_ILLEGAL_FK when TRUNCATE TABLE hits a foreign key, since application frameworks depend on that error code number. Pull request #6015
- A parallel replication worker on a Galera node that loses local certification now raises ER_LOCK_DEADLOCK so the SQL thread retries the event group instead of stopping. Pull request #6055
Why it matters
This week covers crash safety and security around backup and recovery: the mariabackup SST data stream and plugin_dir handling are tightened, and log archive crash safety and corrupted tablespace recovery are fixed. It also restores an error code that applications depend on and adds a long-requested SQL function, while several fixes remove hangs in MTR, recovery and Galera replication.
Changelog entry
- ANY_VALUE() function added. Pull request #5151
- OPTIMIZE TABLE: allocate adjacent pages for the index so tables stop growing. Pull request #5985
- Fixed crash on re-parsing an
sp_instr_setthat does not own its LEX. Pull request #5643 - Mariabackup SST: authenticate the backup-data stream. Pull request #6090
- Mariabackup --prepare: do not trust
plugin_dirfrom backup-my.cnf. Pull request #6087 - Innodb_log_archive=ON is now crash safe. Pull request #6079
- Innodb_log_file_size change: zero-fill memory-mapped log before updating the header. Pull request #6073
- Fixed crash when os_file_set_size() fails to extend an innodb_log_archive=ON file on shutdown. Pull request #6064
- Recovery no longer hangs on a corrupted system or undo tablespace. Pull request #6075
- Mariadb-binlog --start-datetime/--stop-datetime now handle out-of-range values. Pull request #5983
- Restored ER_TRUNCATE_ILLEGAL_FK for TRUNCATE TABLE hitting a foreign key. Pull request #6015
- Galera async replica: retry the event group instead of stopping on lost certification. Pull request #6055
This week: ANY_VALUE() added, OPTIMIZE TABLE stops growing tables, mariabackup SST backup data authenticated, plugin_dir from backup-my.cnf no longer trusted, crash-safe innodb_log_archive, and recovery no longer hangs on a corrupted tablespace.
Changes this week in MariaDB server. ANY_VALUE() is added as a SQL:2023 T626 feature. OPTIMIZE TABLE no longer makes tables grow, because bulk page allocation now tries adjacent pages. The mariabackup SST backup-data stream is authenticated, and mariabackup --prepare no longer trusts plugin_dir from backup-my.cnf, which can arrive over an untrusted channel. Setting GLOBAL innodb_log_archive=ON is now crash safe. Recovery no longer hangs when a system or undo tablespace page is corrupted. TRUNCATE TABLE hitting a foreign key again returns ER_TRUNCATE_ILLEGAL_FK, which application frameworks rely on. mariadb-binlog date options now handle values outside the TIMESTAMP range.
Week of October 26, 2026
What shipped
- A fix for an InnoDB assertion failure when a DELETE IGNORE with foreign key cascades touches tables with FULLTEXT indexes. Pull request #6018
- An infinite loop in iterated partition index scans is fixed. Pull request #6017
- Deletes by key prefix in MEMORY BTREE tables no longer skip rows during a restarted scan. Pull request #6021
- IN, ALL and ANY subqueries that contain an OFFSET clause are now rejected instead of returning wrong results. Pull request #6008
- Deeply nested boolean-mode FULLTEXT queries no longer overflow the stack when the parse tree is freed. Pull request #5996
- Read views after a table was reloaded into the InnoDB dictionary cache no longer return wrong data following an ALTER TABLE copy. Pull request #5942
- A crash from an uninitialized table list struct in connection table handling is fixed. Pull request #5984
- A server crash on the second execution of a stored procedure that changes a view calling a stored function is fixed. Pull request #5992
- Galera no longer loses the gtid domain id setting across a pc.recovery restart. Pull request #6005
- REPAIR of a sequence table now reports the sequence as corrupt instead of returning OK. Pull request #5954
Why it matters
This week was dominated by corrective work: crashes, wrong results and races reported by users, including partition scans, MEMORY BTREE deletes, OFFSET in subqueries and FULLTEXT handling. Several fixes target statement and replication paths that only surface in production, such as foreign key cascades with FULLTEXT indexes and FederatedX connection handling. Test and build reliability on Windows, GnuTLS and Galera also got attention.
Changelog entry
- Fixed an InnoDB assertion on DELETE IGNORE with foreign key cascades on tables with FULLTEXT indexes. Pull request #6018
- Fixed an infinite loop in iterated partition index scan. Pull request #6017
- MEMORY BTREE: deleting by key prefix no longer skips rows, and the found key is always saved for restarted scans. Pull request #6021
- IN, ALL and ANY subqueries with an OFFSET clause are now rejected with ER_NOT_SUPPORTED_YET. Pull request #6008
- FULLTEXT parse tree release no longer recurses per nesting level, avoiding stack overflow. Pull request #5996
- Read views after a table reload into the dictionary cache no longer return wrong data following ALTER TABLE ALGORITHM=COPY. Pull request #5942
- Zeroed the new tmp TABLE_LIST struct in
close_cached_connection_tables_callback, avoiding a crash on garbage view and derived fields. Pull request #5984 - Fixed a crash in
check_grantanddelete_precheckon the second execution of a stored procedure that changes a view calling a stored function. Pull request #5992 - Galera no longer loses
wsrep_gtid_domain_idafter a pc.recovery restart. Pull request #6005 - Mariadb-check --repair now reports a sequence table with an invalid row count as corrupt. Pull request #5954
- FederatedX pushdown no longer produces a syntax error for BETWEEN with constant bounds in multi-table UPDATE and DELETE. Pull request #5987
- Stdout is flushed after mysqld --help, fixing truncated output on Windows. Pull request #5990
Changes this week: DELETE IGNORE with FK cascades on FULLTEXT tables no longer trips an InnoDB assertion; iterated partition scans no longer loop forever; deletes by key prefix in MEMORY BTREE tables no longer skip rows; OFFSET inside IN subqueries is now refused instead of retur
This week's changes were mostly fixes for problems users hit in production. InnoDB no longer asserts on DELETE IGNORE with foreign key cascades on tables with FULLTEXT indexes, iterated partition index scans no longer loop forever, and deletes by key prefix in MEMORY BTREE tables no longer skip rows. OFFSET inside IN, ALL and ANY subqueries is rejected rather than silently returning wrong results, and deeply nested boolean FULLTEXT queries no longer overflow the stack when freed. Elsewhere, read views after a table reload no longer see wrong data after ALTER TABLE, a crash on the second run of a stored procedure changing a view is fixed, and Galera keeps its gtid domain id setting across a pc.recovery restart.
Week of October 19, 2026
What shipped
- User account host names now accept CIDR notation, so CREATE USER u@'192.168.0.0/24' is normalized to the equivalent netmask form. Pull request #5500
- DuckDB values that are not VARCHAR are now converted with ToString() when read into MariaDB string fields, avoiding a SIGABRT on mixed COALESCE types. Pull request #5970
- Optimized array binding INSERT and REPLACE now run once per parameter set when a subquery result depends on those parameters, fixing wrong bulk insert values. Pull request #5876
- An UPDATE on an InnoDB table with several indexed virtual columns no longer overruns the update buffer in calc_row_difference(), fixing the failing assertion. Pull request #5944
- ALTER TABLE IMPORT TABLESPACE now invalidates old read views so an existing snapshot cannot break MVCC. Pull request #5938
- AES_ENCRYPT() and KDF() now allocate the EVP cipher context with EVP_CIPHER_CTX_new(), so CBC, CTR and GCM modes return values instead of NULL on OpenSSL 4.0. Pull request #5652
- ROW_NUMBER is now a non-reserved keyword, so it can be used as an unquoted column name while ROW_NUMBER() still parses. Pull request #5961
- TO_DATE was demoted from a reserved keyword to a function name, so it can again be used as a variable or column name. Pull request #5949
- Versioned InnoDB tables no longer corrupt indexes on UPDATE, including duplicate reports on virtual column updates and row-format binlog before-images. Pull request #5863
- STR_TO_DATE() with the %., %@ and %# format specifiers no longer reads past the end of the input string. Pull request #5932
Why it matters
This week brings a new way to write user account host names with CIDR notation, along with fixes for wrong bulk insert values, index corruption on versioned InnoDB tables, and several crash and assertion failures. Encryption functions also work again on OpenSSL 4.0, and keyword restrictions on ROW_NUMBER and TO_DATE were relaxed for existing schemas.
Changelog entry
- Accept CIDR notation as an input spelling of the ip/netmask host form for user accounts. Pull request #5500
- Convert non-VARCHAR DuckDB values with ToString() when reading into MariaDB string fields. Pull request #5970
- Execute optimized array binding INSERT and REPLACE per parameter set when a subquery result depends on parameters. Pull request #5876
- Size the InnoDB update buffer correctly so indexed virtual columns cannot overrun it in calc_row_difference(). Pull request #5944
- Invalidate old read views in row_import_for_mysql() so ALTER TABLE IMPORT TABLESPACE does not break MVCC. Pull request #5938
- Release the backup block and restore the old page when btr_page_reorganize_low() finds corruption. Pull request #5937
- Allocate the EVP cipher context with EVP_CIPHER_CTX_new() so AES_ENCRYPT() and KDF() work with OpenSSL 4.0. Pull request #5652
- Make ROW_NUMBER a non-reserved keyword so it can be used as an unquoted column name. Pull request #5961
- Demote TO_DATE from a reserved keyword to a function name so it can be used as a variable or column name. Pull request #5949
- Recompute virtual fields without the after-value so versioned InnoDB tables do not corrupt indexes on UPDATE. Pull request #5863
- Check for the end of the input before reading a byte in extract_date_time() for the %., %@ and %# specifiers. Pull request #5932
- Prevent InnoDB purge from being a target of BF aborts so TOI DDL cannot make purge loop forever. Pull request #5950
This week: CIDR notation in user account host names, correct bulk insert values with parameter-dependent subqueries, no more index corruption on versioned InnoDB updates, and AES_ENCRYPT()/KDF() fixed on OpenSSL 4.0. ROW_NUMBER and TO_DATE are usable as names again.
Changes in MariaDB this week: user account host names can now be written in CIDR notation, such as '192.168.0.0/24', and are normalized to the netmask form. Optimized array binding INSERT and REPLACE now execute once per parameter set when a subquery depends on those parameters, fixing wrong values in bulk inserts. UPDATE on versioned InnoDB tables no longer corrupts indexes, and an UPDATE with several indexed virtual columns no longer overruns the update buffer. AES_ENCRYPT() and KDF() work again on OpenSSL 4.0. ROW_NUMBER and TO_DATE were relaxed from reserved keywords so they can be used as identifiers, and STR_TO_DATE() no longer reads past the end of its input.
Week of October 12, 2026
What shipped
- Fixed an ASAN stack-buffer-overflow in CONNECT XmlDB where the table name and XPath were copied into a 64-byte stack buffer, now built in a buffer sized to the real length. Pull request #5890
- DuckDB tables now reject SELECT... FOR UPDATE and LOCK IN SHARE MODE with ER_NOT_SUPPORTED instead of passing locking clauses to the embedded DuckDB parser. Pull request #5884
- Fixed a server crash when selecting DuckDB TIME values, since MariaDB TIME is a duration that can exceed DuckDB's clock range. Pull request #5904
- Fixed wrong results from JSON_OVERLAPS where unequal nested arrays such as [] and [[]] could be treated as equal. Pull request #5711
- Fixed HAVING pushdown marking a subtree immutable while its arguments were not, a follow-up correction to the earlier
set_extraction_flagchange. Pull request #5765 - Fixed a stack overrun in the range optimizer for selects with many ranges on a compound key with many parts. Pull request #5782
- Fixed an AUTO_INCREMENT race condition in partitioned tables where
restore_auto_incrementcould roll the ID pointer back into an older block after a failed row. Pull request #5627 - Fixed JSON_TABLE returning incorrect BIT values, where JSON numbers 0 and 1 mapped to BIT values 1 and 1. Pull request #5715
- Fixed a failed assertion in
trans_rollback_stmtwhen a BINLOG statement with malformed base64 was run from an AFTER INSERT trigger. Pull request #5696 - Added a --validate-config option that checks server configuration from files and the command line and exits without starting the server. Pull request #4716
Why it matters
This week's changes fix several crashes and wrong results that developers could hit in ordinary use: JSON_OVERLAPS, JSON_TABLE with BIT, DuckDB TIME selects, range selects on compound keys, and partitioned AUTO_INCREMENT inserts. There are also new operational tools, with --validate-config checking configuration without starting the server and the DuckDB locking reads now rejected cleanly instead of failing inside the embedded engine. CONNECT, Galera and replication areas also received fixes for corruption and assertion failures.
Changelog entry
- CONNECT XmlDB: build the XPath in a buffer sized by its real length instead of a 64-byte stack buffer. Pull request #5890
- DuckDB: reject SELECT... FOR UPDATE and LOCK IN SHARE MODE with ER_NOT_SUPPORTED. Pull request #5884
- DuckDB: fix server crash when converting TIME values outside DuckDB's clock range. Pull request #5904
- JSON_OVERLAPS: require nested arrays to match fully and in order. Pull request #5711
- JSON_TABLE: fix incorrect BIT values for JSON numbers. Pull request #5715
- Add --validate-config option to check configuration without starting the server. Pull request #4716
- Fix AUTO_INCREMENT race condition in partitioned tables. Pull request #5627
- Range optimizer: fix stack overrun with many ranges on a compound key with many parts. Pull request #5782
- HAVING pushdown: fix immutable marking when arguments are not immutable. Pull request #5765
- Fix assertion in
trans_rollback_stmtfor BINLOG statements with malformed payload in triggers. Pull request #5696 - PURGE BINARY LOGS: delete non-active binlog files instead of ending with a warning. Pull request #5849
- Generate-ssl-certs.sh: remove bashism so the script runs under plain sh. Pull request #5867
This week: JSON_OVERLAPS and JSON_TABLE BIT fixes for wrong results, no more crash selecting DuckDB TIME values, a range optimizer stack overrun fix, an AUTO_INCREMENT race in partitioned tables, and a new --validate-config option that checks configuration without starting the se
This week's MariaDB server work fixes several wrong results and crashes: JSON_OVERLAPS treating unequal nested arrays as equal, JSON_TABLE returning wrong BIT values, a server crash when selecting DuckDB TIME values, a stack overrun in the range optimizer on compound keys with many parts, and an AUTO_INCREMENT race in partitioned tables. Locking reads on DuckDB tables are now rejected with a clear unsupported error instead of failing inside the embedded engine. There is also a new --validate-config option that checks configuration from files and the command line and exits without starting the server, and fixes in CONNECT XmlDB buffer handling, BINLOG statements in triggers, and Galera.
Week of October 5, 2026
What shipped
- The mariadb client now stops printing tab separated results when Ctrl-C is pressed. Pull request #5699
- Replication filter system variables now respect the specified
default_master_connection. Pull request #5831 - HANDLER READ now checks column privileges and reopen performs full checks. Pull request #5840
- Multi-table UPDATE and DELETE using a view are no longer pushed down to the remote server. Pull request #5788
- Help table URLs now point to MariaDB Documentation instead of the old Knowledge Base. Pull request #5672
- Help table URLs now point to MariaDB Documentation instead of the old Knowledge Base. Pull request #5673
- Help table URLs now point to MariaDB Documentation instead of the old Knowledge Base. Pull request #5670
- Help table URLs now point to MariaDB Documentation instead of the old Knowledge Base. Pull request #5671
- Wsrep_sync_wait now works after COM_CHANGE_USER and COM_RESET_CONNECTION. Pull request #5814
- Converting an IN predicate with a nested ROW into an IN subquery no longer crashes the server. Pull request #5810
Why it matters
This week brings fixes for client interruption, privilege checks in HANDLER, replication variable handling, and FederatedX pushdown of view statements, along with documentation URL updates across branches. Users running replication filters, HANDLER, FederatedX, or Ctrl-C in the client get more predictable behavior. Several crash fixes improve stability.
Changelog entry
- Mariadb client: Ctrl-C now interrupts tab separated result output Pull request #5699
- Replication filter system variables respect
default_master_connectionPull request #5831 - HANDLER READ checks column privileges; reopen validates privileges Pull request #5840
- FederatedX: do not push down multi-table UPDATE/DELETE using a view Pull request #5788
- Help table URLs updated to MariaDB Documentation (11.8 part) Pull request #5672
- Help table URLs updated to MariaDB Documentation (12.3 part) Pull request #5673
- Help table URLs updated to MariaDB Documentation (10.11 part) Pull request #5670
- Help table URLs updated to MariaDB Documentation (11.4 part) Pull request #5671
- Wsrep_sync_wait works after COM_CHANGE_USER and COM_RESET_CONNECTION Pull request #5814
- Fix crash converting IN with a nested ROW into IN subquery Pull request #5810
- Fix assertion with CREATE TABLE... SELECT... FOR UPDATE on MyISAM temporary tables under binary logging Pull request #5027
- Fix memcpy overlap in dict_table_rename_in_cache() Pull request #5819
This week: Ctrl-C now stops tab separated output in the mariadb client, HANDLER READ checks column privileges, replication filter variables respect default_master_connection, and view statements no longer get pushed down by FederatedX. Docs URLs updated across branches.
This week's changes: the mariadb client now interrupts tab separated result output on Ctrl-C. HANDLER READ performs column privilege checks and reopen validates privileges. Replication filter system variables respect the default_master_connection qualifier. Multi-table UPDATE and DELETE that use a view are no longer pushed down to a remote server. Help table documentation URLs were updated across supported branches to point to MariaDB Documentation. Several crash fixes landed, including a fix for converting an IN predicate with a nested ROW into an IN subquery, and wsrep_sync_wait now works after COM_CHANGE_USER and COM_RESET_CONNECTION.
Week of September 28, 2026
What shipped
- Fixed server crash in Item_func_match::init_search on second execution of prepared statements with MATCH clauses. Pull request #5614
- Fixed ASAN use-after-poison error in JSON_CONTAINS_PATH by properly bounding array access. Pull request #5801
- Fixed multi-table DELETE on FederatedX tables when a primary key lookup makes the target a const table. Pull request #5792
- Fixed stack buffer overflow in backup_log_ddl() when handling RENAME TABLE with long special-character names. Pull request #5747
- Fixed DATE_FORMAT result truncation for negative TIME values by including the minus sign in length calculation. Pull request #5793
- Fixed assertion failure in
decimal_bin_sizeby bounding unbounded var-uint values in dynamic_column_decimal_read(). Pull request #5744 - Fixed CONCAT silently dropping first argument when it references external string data like JSON_TYPE() or GET_FORMAT(). Pull request #5713
- Added RISC-V Zvbc accelerated CRC-32C implementation for systems with vector carry-less multiply support. Pull request #5746
- Fixed system-versioned DELETE via
row_endindex leaving rows undeleted by handling index modifications during scan. Pull request #5677 - Fixed BIT_AND, BIT_OR, and BIT_XOR window functions returning incorrect values when sliding frames contain NULL rows. Pull request #5720
Why it matters
This week addresses critical bugs in prepared statements, JSON operations, and window functions that could cause server crashes or return wrong results. It also includes security fixes for privilege checks and improvements to backup functionality and CRC-32C performance on RISC-V systems.
Changelog entry
- MDEV-32383: Fixed server crash in Item_func_match::init_search on 2nd execution of PS Pull request #5614
- MDEV-41156: Fixed ASAN use-after-poison in JSON_CONTAINS_PATH with proper array bounds Pull request #5801
- MDEV-41211: Fixed FederatedX multi-table DELETE with const table row from primary key lookup Pull request #5792
- MDEV-41175: Fixed stack-buffer-overflow in backup_log_ddl() with long special-character table names Pull request #5747
- MDEV-34215: Fixed DATE_FORMAT result truncation for negative TIME values Pull request #5793
- MDEV-41144: Fixed assertion failure in
decimal_bin_sizefrom unbounded var-uint values Pull request #5744 - MDEV-40673: Fixed CONCAT silently dropping first argument from JSON_TYPE() or GET_FORMAT() Pull request #5713
- MDEV-41230: Added RISC-V Zvbc accelerated CRC-32C implementation Pull request #5746
- MDEV-41050: Fixed system-versioned DELETE via
row_endindex leaving rows undeleted Pull request #5677 - MDEV-40689: Fixed BIT_AND/BIT_OR/BIT_XOR window functions with NULL values in frames Pull request #5720
- Fixed ppc64 CRC-32C probe to check elf_aux_info() return value Pull request #5806
- MDEV-41319: Removed unnecessary AVX512DQ requirement from CRC-32C implementation Pull request #5762
MariaDB fixes: prepared statement MATCH crashes, JSON array bounds errors, FederatedX DELETE issues, DATE_FORMAT with negative TIME, decimal overflow assertions, CONCAT dropping arguments, RISC-V CRC-32C acceleration, versioned DELETE index bugs, window function NULL handling.
This week's MariaDB update addresses 10+ critical issues: fixed server crashes in prepared statements with MATCH clauses, corrected ASAN errors in JSON operations, resolved FederatedX DELETE problems, fixed DATE_FORMAT truncation, prevented decimal overflow assertions, repaired CONCAT argument loss, added RISC-V Zvbc CRC-32C acceleration, corrected system-versioned DELETE index behavior, and fixed window function NULL handling in bit aggregates.
Week of September 21, 2026
What shipped
- Fixed a crash in multi-table DELETE statements with index hints, impossible WHERE conditions, and window functions that failed to initialize deletion tables. Pull request #5478
- Fixed
innodb_stats_methodsetting being ignored wheninnodb_stats_persistentis enabled. Pull request #4204 - Fixed buffer overflow in CREATE DATABASE COMMENT when comment length validation did not properly truncate the string in all SQL modes. Pull request #5743
- Fixed heap buffer overflow in CONNECT engine when pushing down WHERE clauses with large string literals to external tables. Pull request #5750
- Fixed SELECT with descending ORDER BY on partitioned tables through secondary indexes stopping early and omitting qualifying rows. Pull request #5708
- Fixed indefinite hang when innodb_encryption_threads=0 and innodb_encryption_rotation_iops=0 due to incomplete condition signaling. Pull request #5653
- Deferred PROXY protocol host validation checks until after SSL handshake completion to avoid sending them in clear text. Pull request #5736
- Fixed instant ALTER TABLE rollback corrupting virtual columns by preventing double-free of virtual column definitions. Pull request #5691
- Added hardware-accelerated CRC32C implementation for 64-bit RISC-V systems with Zbc carry-less multiplication support. Pull request #5669
- Changed sys schema routine installation to use CREATE OR REPLACE instead of DROP/CREATE to preserve EXECUTE grants during upgrades. Pull request #5698
Why it matters
This week addresses critical crashes and data corruption issues in DELETE operations, partitioned table queries, and instant ALTER TABLE. Security improvements defer PROXY protocol checks to after SSL handshake. Multiple buffer overflow and uninitialized value fixes enhance stability across different storage engines and platforms.
Changelog entry
- MDEV-40573: Fixed crash in multi-table DELETE with impossible WHERE and window functions Pull request #5478
- MDEV-19574:
innodb_stats_methodnow honored with innodb_stats_persistent=ON Pull request #4204 - MDEV-41157: Fixed CREATE DATABASE COMMENT buffer overflow Pull request #5743
- MDEV-41193: Fixed CONNECT engine heap buffer overflow in WHERE clause pushdown Pull request #5750
- MDEV-41055: Fixed indefinite hang with innodb_encryption_threads=0 and zero rotation IOPS Pull request #5653
- MDEV-40479: Fixed incorrect results in partitioned table descending ORDER BY through secondary index Pull request #5708
- MDEV-40967: Deferred PROXY protocol host validation until after SSL handshake Pull request #5736
- MDEV-41072: Fixed instant ALTER TABLE rollback corrupting virtual columns Pull request #5691
- MDEV-41115: Added RISC-V Zbc hardware-accelerated CRC32C implementation Pull request #5669
- MDEV-39993: Use CREATE OR REPLACE for sys schema routines to preserve EXECUTE grants Pull request #5698
MariaDB weekly: Fixed multi-table DELETE crashes, partitioned table query results, buffer overflows in CONNECT and CREATE DATABASE, instant ALTER TABLE corruption, and PROXY protocol security. Added RISC-V CRC32C acceleration.
MariaDB weekly digest: This week's fixes address critical stability and security issues. We resolved crashes in multi-table DELETE with window functions, incorrect results in partitioned table descending scans, and buffer overflows in the CONNECT engine. Security improvements defer PROXY protocol validation until after SSL handshake. Virtual column corruption during instant ALTER TABLE rollback is fixed. We also added hardware-accelerated CRC32C for RISC-V systems and improved sys schema upgrade handling to preserve user grants.
Week of September 14, 2026
What shipped
- MariaDB Community Server 13.1.1 RC released. Release
- MariaDB Community Server 13.0.2 released. Release
- FILTER clause support added for aggregate functions, enabling SQL-standard filtering without CASE workarounds. Pull request #4439
- Galera appliers no longer hang when using foreign keys with UUID, INET4, or INET6 data types. Pull request #5634
- UPDATE...IN(SELECT) no longer acquires spurious gap locks on foreign key indexes, reducing deadlock occurrences. Pull request #4682
- DELETE now properly reports errors when the storage engine fails during row positioning instead of silently skipping rows. Pull request #5685
- INFORMATION_SCHEMA.INNODB_SYS_TABLES queries no longer crash after
innodb_force_recoverywhen uncommitted CREATE TABLE records exist. Pull request #5644 - Item_sum and Item_cache now implement proper deep_copy() instead of shallow copies, fixing issues with key value copying. Pull request #5536
- Memory leak in
wsrep_sst_prepareerror handling fixed by preserving original error codes. Pull request #5690 - LRU list scan pointer now correctly stays in place until crossing the old/young boundary rather than rewinding on every call. Pull request #5695
Why it matters
Two new release versions provide stability improvements and bug fixes. Major features like FILTER clause for aggregates and fixes to Galera foreign key handling address long-standing usability issues. Critical fixes to error handling, memory management, and query locking reduce crashes and deadlocks in production environments.
Changelog entry
- DELETE now reports errors from storage engine ha_rnd_pos() failures instead of silently skipping rows. Pull request #5685
- LRU iterator scan hand pointer correctly maintains position in cold sublist and rewinds only when crossing to hot sublist. Pull request #5695
- INFORMATION_SCHEMA.INNODB_SYS_TABLES no longer aborts when reading uncommitted CREATE TABLE records during
innodb_force_recovery. Pull request #5644 - Memory leak in
wsrep_sst_prepareerror handling fixed by preserving malloc failure codes. Pull request #5690 - UPDATE...IN(SELECT) no longer acquires spurious gap locks on foreign key secondary indexes. Pull request #4682
- Item_sum and Item_cache implement proper deep_copy() to avoid sharing references in key part operations. Pull request #5536
- Innodb_buffer_pool_size_max now defined as 0 on ThreadSanitizer builds to prevent excessive startup time. Pull request #5680
- FILTER clause now supported for SQL-standard aggregate function filtering. Pull request #4439
- CHANGE MASTER error cleanup no longer crashes when relay log file name exceeds OS limits. Pull request #5624
- Galera appliers no longer hang when processing foreign keys with UUID, INET4, or INET6 data types. Pull request #5634
MariaDB 13.1.1 RC and 13.0.2 are now available. This week brings FILTER clause support for aggregates, fixes for Galera applier hangs with UUID/INET types, and improved error reporting in storage engine operations.
Two releases this week: MariaDB Community Server 13.1.1 RC and 13.0.2. Notable improvements include SQL-standard FILTER clause for aggregate functions, resolution of Galera applier hangs with UUID/INET4/INET6 foreign keys, elimination of spurious gap locks in UPDATE...IN(SELECT), and fixes to error handling in replication and recovery scenarios. These updates address both new functionality requests and critical stability issues.