RATATOSKRATATOSK
Sign in

Vitess

v24.0.4Storage & Data
Oct 1, 2026

ACTION 6CHECK 1PLAN 1OTHER 13

A security-focused maintenance release tightens TLS revocation and table ACL enforcement, removes a legacy `vtctld` HTTP surface, and includes compatibility changes for upgrades and Go package users. It also changes lz4 compression semantics and adds operational gRPC connection metrics.

Action needed (6)

  • securityTLS for gRPC clients with CRL configuration

    A gRPC client configured with --tablet-grpc-crl, --vtgate-grpc-crl, or another *-grpc-crl flag now connects with TLS and verifies the server against system roots when no client certificate or CA is configured. Previously, it connected in plaintext and silently ignored the CRL. GHSA-fxqj-c35w-x6rq is addressed by this change.

  • securityRead checks under strict table ACL

    Each read is checked like a plain SELECT of the same tables under strict table ACL, with the same dry-run and exempt-ACL behavior as other table ACL checks. The change applies to --queryserver-config-strict-table-acl and addresses GHSA-w6mx-2f8x-pqf4.

  • securityThe /api/ HTTP API, removed

    The HTTP API that vtctld served under /api/ has been removed because it was dead code that exposed a security attack surface.

  • breakingStartup validation for CRL configurations

    Configurations where the CRL cannot be applied as configured are now refused when the TLS configuration is built at startup.

  • breakingRemoved vtctld Go package APIs

    For Go package users, vtctld.InitVtctld, vtctld.ActionRepository, vtctld.ActionResult, and vtctld.TabletWithURL have been removed.

  • breakingSubqueries in settings under strict table ACL

    Under strict table ACL, vttablet now rejects a setting whose expressions contain a subquery.

Check if affected (1)

  • breakingTargeted SET statements with subqueries during upgrades

    Applies when vttablets are upgraded before vtgates.

    In the usual upgrade order, with vttablets upgraded before vtgates, targeted SET statements containing subqueries are not supported until every vtgate has been upgraded. The alternative upgrade order is to upgrade vtgates first.

Plan ahead (1)

  • deprecatedThe --cell, --proxy-tablets, --action-timeout, and --tablet-health-keep-alive flags, deprecatedremoval planned in v26

    The flags --cell, --proxy-tablets, --action-timeout, and --tablet-health-keep-alive are deprecated in this release. They will be removed in v26.

All 13 other recorded changesfixes 16 · value changes 6 · constraints 2 · additions 1

fixes (16)

  • A SET of a system variable in a session targeted at a shard (use ks:-80) is now evaluated once on the target shard
  • mysql/json: read numbers the way MySQL does
  • fix(vdiff): map source PK columns to their SELECT positions in getSourcePKCols
  • vreplication: Fix --config-overrides silently erasing existing config keys
  • use tablet db name override when reading current sequence value in SwitchTraffic dry run
  • flagutil: keep the first value passed to StringSetFlag.Set
  • vtadmin: send a non-empty :authority so gRPC works behind a proxy
  • sqlparser: fix panic on WITH followed by parenthesized query
  • vtorc: pass a heartbeat interval to SetReplicationSource only for ReplicaMisconfigured
  • vttablet: reset connection settings with the DEFAULT keyword
  • smartconnpool: re-check capacity after getNew's CAS
  • vttablet: reset foreign_key_checks and unique_checks settings to the global value
  • tabletenv: Fix infinite recursion in OltpConfig.UnmarshalJSON
  • VTTablet: discard a transaction's connection after a CALL ran on it
  • vttablet: derive table ACL permissions the way MySQL resolves CTE names
  • vttestserver: fail, don't panic, on a vschema missing a table or vindex

value changes (6)

  • The exported planbuilder.BuildPermissions now returns a second result, tablesUndetermined bool, alongside the permissions.
  • The lz4 compression engine now uses the pierrec/lz4/v4 library instead of pierrec/lz4 v2.
  • vtgate: report RowsAffected for stored-procedure calls over the streaming path
  • vtgate: list the session's SET_VAR hint variables in a fixed order
  • Upgrade the Golang version to go1.26.8
  • vtgate: only scan shard records for MoveTables state when routing rules reference the keyspace

constraints (2)

  • VDiff: accept a target primary key that extends a unique source key
  • Only negotiate multi statement support on connections that send batches

additions (1)

  • now reports its connections by transport, tls or plaintext, in two new stats: GrpcOptionalTlsOpenConnections
Add Vitess to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Vitess releases →