Releases — RATATOSK

Vitessv23.0.4Storage & DataMay 7, 2026

ACTION 2CHECK 1OTHER 27View full analysis

A maintenance release with bug fixes, compatibility and behavior changes, operational improvements, metric updates, and two Go dependency upgrades. It includes no disclosed security advisories or explicitly security-related fixes.

Action needed (2)

breakingUnqualified * rejection after commas in SELECT lists
vtgate now rejects an unqualified * after a comma in a SELECT list. The change ships in this release.
breakingBare * restriction in the sqlparser grammar
sqlparser now enforces the restriction on bare * in its grammar. The change ships in this release.

Check if affected (1)

breakingEmergencyReparentShard replication-stop error validation
Applies if you use EmergencyReparentShard.
EmergencyReparentShard now requires the stop replication error to come from PRIMARY. The validation change ships in this release.

Source ↗

Vitessv24.0.0Storage & DataApr 30, 2026

ACTION 3CHECK 12PLAN 4OTHER 244View full analysis

A broad feature and maintenance release adds routing, streaming, tracing, backup and restore, observability, and tablet-management capabilities alongside correctness, performance, and dependency updates. Operators should review changed defaults, backup behavior, removed endpoints and metrics, deprecated features, and security fixes affecting external decompression.

Action needed (3)

securityClear-text logging of sensitive information
The release addresses a code scanning alert about clear-text logging of sensitive information.
securityDirectory traversal protection in GetBackups
The file backup storage GetBackups RPC no longer permits directory traversal paths.
breakingStricter VTGate SELECT list validation
VTGate rejects an unqualified * after a comma in a SELECT list.

Check if affected (12)

securityOpt-in compressor commands from MANIFEST
Applicability is not stated in the release notes.
Restore no longer loads compressor commands from MANIFEST unless that behavior is explicitly enabled.
securityExternal decompressor commands from backup MANIFEST
Applies if you use backup storage.
The backup restore path changes the handling of --external-decompressor and --external-decompressor-use-manifest so that a writable backup MANIFEST cannot cause arbitrary commands to execute on the tablet.
securityBackup MANIFEST path traversal protection
Applies if backupengine runs.
backupengine disallows path traversal through a backup MANIFEST during restore.
+ 9 more on the release page

Plan ahead (4)

deprecatedThe glog deprecationremoval planned in v25
Applies if you use glog.
glog is deprecated in this release and is scheduled for removal in the next major release.
deprecatedThe OpenTracing backend deprecationsremoval planned in v25
Applies if you use opentracing-jaeger or opentracing-datadog.
The opentracing-jaeger and opentracing-datadog tracing backends are deprecated in this release and are scheduled for removal in v25. The related flags --jaeger-agent-host and --tracing-sampling-type are included in this change.
deprecatedVTOrc Snapshot Topology deprecationremoval planned in v25
Applies if you configure --snapshot-topology-interval.
VTOrc's Snapshot Topology feature is deprecated. It is enabled by setting --snapshot-topology-interval to a non-zero value, and its logic is planned for removal in v25.
+ 1 more on the release page

Source ↗