Vitess
v23.0.5Storage & Data2026年6月25日
v23.0.5 is a bug-fix rollup with two medium-severity security hardening fixes. Changes span connection pooling, query planning, VReplication, VTOrc, topology, and backup/restore, with no API, config, or default changes.
securityTiming-safe password comparison in static gRPC auth plugin
The static gRPC auth plugin now uses constant-time comparison for passwords, closing a potential timing-based credential leak. Applies to all deployments using static gRPC authentication.
securityReflected-input escaping in twopcz handler
The twopcz debug handler now escapes reflected form values, preventing reflected input injection. Applies to any deployment where the twopcz handler endpoint is reachable.
主な変更 (7)
- Two medium-severity security fixes: constant-time password comparison in the static gRPC auth plugin and reflected-input escaping in the twopcz handler.
- smartconnpool fixes several connection lifecycle bugs: expired waiters receiving returned connections, MaxLifetime jitter, refresh worker loss after reopen, idle reopen stalls, close deadlocks, and rejection of SetCapacity on a closed pool.
- VTOrc resolves a data race in forgetAliases cache initialization, a deadlock between PrimaryIsReadOnly recovery and PrimarySemiSyncBlocked, and incorrect persistence of the CurrentErrantGTIDCount gauge after errant GTIDs are resolved.
- VReplication binlog handling now correctly preserves leading zeroes and trims leading zeroes for DECIMAL JSON values (e.g. 0.1) that a prior fix missed.
- VTGate planner corrects merged DML IN/NOT IN subquery substitution via ListArg placeholder; the Filter streaming path now uses ToBoolean() correctly and builds specialized plans for prepared statements in OLAP/streaming mode.
- vstream StopOnReshard hang on reshard convergence is fixed; stale healthcheck updates from a replaced tablet's canceled connection check are dropped.
- Additional fixes: mysqlctl remote shutdown timeout propagation, keyspaceState leak in Discovery, etcd2topo unbounded lock-acquisition cleanup RPCs, and vttablet Stream schema clobbering for non-keyspace fields.