Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: VitessClear ×

Vitessv24.0.2Storage & DataJun 24, 2026

CHECK 2OTHER 22View full analysis

A bug-fix release with two security fixes, along with routine correctness fixes and Go toolchain dependency updates. The security changes affect users of the static grpc auth plugin or twopcz handler; the release also updates Go to go1.26.3 and go1.26.4.

Check if affected (2)

securityConstant-time password comparison in the static grpc auth plugin
Applies if you use the static grpc auth plugin.
The static grpc auth plugin now uses a constant-time password comparison. This security fix ships in release-24.0.
securityEscaping of reflected form values in the twopcz handler
Applies if you use the twopcz handler.
The twopcz handler now escapes reflected form values. This security fix ships in release-24.0.

Source ↗

Vitessv24.0.1Storage & DataMay 7, 2026

CHECK 1OTHER 1View full analysis

A maintenance release with a correctness fix that reverts a VTOrc flag addition. It also updates planner handling for merged DML IN and NOT IN subqueries.

Check if affected (1)

breakingThe VTOrc cell-watch flag, reverted
Applies if VTOrc runs.
The release reverts the addition of a flag for cells to watch in VTOrc.

Source ↗

Vitessv23.0.4Storage & DataMay 7, 2026

ACTION 2CHECK 1OTHER 27View full analysis

A maintenance release with bug fixes, compatibility and behavior changes, operational improvements, metric updates, and two Go dependency upgrades. It includes no disclosed security advisories or explicitly security-related fixes.

Action needed (2)

breakingUnqualified * rejection after commas in SELECT lists
vtgate now rejects an unqualified * after a comma in a SELECT list. The change ships in this release.
breakingBare * restriction in the sqlparser grammar
sqlparser now enforces the restriction on bare * in its grammar. The change ships in this release.

Check if affected (1)

breakingEmergencyReparentShard replication-stop error validation
Applies if you use EmergencyReparentShard.
EmergencyReparentShard now requires the stop replication error to come from PRIMARY. The validation change ships in this release.

Source ↗

Vitessv24.0.0Storage & DataApr 30, 2026

ACTION 3CHECK 12PLAN 4OTHER 244View full analysis

A broad feature and maintenance release adds routing, streaming, tracing, backup and restore, observability, and tablet-management capabilities alongside correctness, performance, and dependency updates. Operators should review changed defaults, backup behavior, removed endpoints and metrics, deprecated features, and security fixes affecting external decompression.

Action needed (3)

securityClear-text logging of sensitive information
The release addresses a code scanning alert about clear-text logging of sensitive information.
securityDirectory traversal protection in GetBackups
The file backup storage GetBackups RPC no longer permits directory traversal paths.
breakingStricter VTGate SELECT list validation
VTGate rejects an unqualified * after a comma in a SELECT list.

Check if affected (12)

securityOpt-in compressor commands from MANIFEST
Applicability is not stated in the release notes.
Restore no longer loads compressor commands from MANIFEST unless that behavior is explicitly enabled.
securityExternal decompressor commands from backup MANIFEST
Applies if you use backup storage.
The backup restore path changes the handling of --external-decompressor and --external-decompressor-use-manifest so that a writable backup MANIFEST cannot cause arbitrary commands to execute on the tablet.
securityBackup MANIFEST path traversal protection
Applies if backupengine runs.
backupengine disallows path traversal through a backup MANIFEST during restore.
+ 9 more on the release page

Plan ahead (4)

deprecatedThe glog deprecationremoval planned in v25
Applies if you use glog.
glog is deprecated in this release and is scheduled for removal in the next major release.
deprecatedThe OpenTracing backend deprecationsremoval planned in v25
Applies if you use opentracing-jaeger or opentracing-datadog.
The opentracing-jaeger and opentracing-datadog tracing backends are deprecated in this release and are scheduled for removal in v25. The related flags --jaeger-agent-host and --tracing-sampling-type are included in this change.
deprecatedVTOrc Snapshot Topology deprecationremoval planned in v25
Applies if you configure --snapshot-topology-interval.
VTOrc's Snapshot Topology feature is deprecated. It is enabled by setting --snapshot-topology-interval to a non-zero value, and its logic is planned for removal in v25.
+ 1 more on the release page

Source ↗

Vitessv22.0.4Storage & DataFeb 27, 2026

CHECK 2OTHER 14View full analysis

A maintenance release with security fixes in backup restore behavior, along with routine bug fixes, a Go toolchain dependency update, and a performance improvement. The backup changes affect manifest-based external decompression and protection against path traversal during restores.

Check if affected (2)

securitycriticalBackup restore path traversal protection
Applies if you use backup storage.
Vitess now prevents a common Path Traversal attack in which someone with write access to backup storage modifies the MANIFEST to escape the target restore directory and write to arbitrary filesystem paths. This fix includes CVE-2026-27969 and GHSA-r492-hjgh-c9gw.
securityhighManifest-based external decompression default, changed
Applies if you use an external decompressor command and do not pass --external-decompressor-use-manifest.
The external decompressor command stored in a backup's MANIFEST file is no longer used during restore by default. --external-decompressor-use-manifest restores manifest-based decompression in this release, which includes CVE-2026-27965 and GHSA-8g8j-r87h-p36x.

Source ↗

Vitessv23.0.3Storage & DataFeb 27, 2026

CHECK 2OTHER 12View full analysis

A security-focused maintenance release with changes to backup and restore behavior, bug fixes, and additional hardening. Backup MANIFEST handling now requires explicit opt-in for compressor commands, and restore blocks path traversal through MANIFEST files.

Check if affected (2)

securityLoading compressor commands from MANIFEST, opt-in
Applies if you use --external-decompressor-use-manifest.
Restore loads compressor commands from MANIFEST only when --external-decompressor-use-manifest is used. This opt-in behavior ships in the restore path.
securityPath traversal through backup MANIFEST on restore blocked
Applies if backupengine runs.
backupengine disallows path traversal through backup MANIFEST files during restore. The protection ships in the backup restore path.

Source ↗

Browse by month