What vitessio/vitess shipped
Generated by FoxPlug from public activity — not affiliated with Vitess.
Week of September 14, 2026
What shipped
- VTTablet now fails closed under strict table ACL when a statement's table set cannot be determined, fixing a security gap where DO, CALL, REPAIR, OPTIMIZE and LOAD DATA statements bypassed ACL checks. Pull request #21053
- VTTablet table ACL now derives permissions the same way MySQL resolves CTE names, fixing a security issue where common table expressions could be used to bypass access controls. Pull request #21091
- VTTls now enforces certificate revocation lists in all SSL modes and on resumed TLS sessions, preventing revoked certificates from reconnecting. Pull request #21054
- VTTablet fixed a data race in transaction timeout handling that was causing all e2e_race test failures. Pull request #21024
- VTAdmin fixed a crash in the tablet info dialog and resolved multiple type errors from dependency API changes in react-query, react-router and headlessui. Pull request #21131
- CI replaced MinIO server with MicroCeph RGW for S3 backup tests after MinIO archived its community releases. Pull request #21086
- CI bumped Apache ZooKeeper to 3.9.6 since 3.9.5 is no longer available on the distribution site. Pull request #21099
- Removed a write-only timestamp field from LRUCache entries that had not been read since 2021. Pull request #21080
- VTAdmin declared children and JSX types that React 19 removed from its type definitions. Pull request #21130
- VTAdmin fixed project configuration errors that prevented TypeScript type checking from running. Pull request #21129
Why it matters
This week addresses three security vulnerabilities in table ACL enforcement and TLS certificate validation, plus a data race causing test failures. Infrastructure updates keep CI working as upstream projects archive old releases, and frontend improvements prepare VTAdmin for current tooling versions.
Changelog entry
- VTTablet: fail closed under strict table ACL when a statement's table set cannot be determined Pull request #21053
- VTTablet: derive table ACL permissions the way MySQL resolves CTE names Pull request #21091
- VTTls: Enforce CRLs in every SSL mode and on resumed TLS sessions Pull request #21054
- VTTablet: fix data race in transaction timeout publishing Pull request #21024
- VTAdmin: fix tablet info dialog crash and type errors from dependency API changes Pull request #21131
- CI: Replace MinIO server with MicroCeph RGW for S3 backup tests Pull request #21086
- CI: bump Apache ZooKeeper to 3.9.6 Pull request #21099
- Cache: remove unused timestamp field from LRUCache entries Pull request #21080
Shipped: table ACL and TLS security fixes, resolved e2e_race test failures, updated CI infrastructure for current ZooKeeper and S3 services.
This week's releases include important security fixes: VTTablet now properly enforces table ACL for all statement types, CTE name resolution matches MySQL behavior, and TLS certificate revocation checks work across all SSL modes and resumed sessions. We also fixed a data race in transaction timeouts and updated CI infrastructure as upstream projects archive releases.