# Vitess v23.0.7

> Storage & Data · 2026-10-01

A security-focused maintenance release closes TLS certificate revocation, table ACL, and legacy HTTP API attack surfaces. It also changes compression behavior, strengthens statement permission checks, and removes or deprecates `vtctld` interfaces that may affect compatible clients and Go package users.

## Action needed
- **[security]** TLS for gRPC clients configured with CRLs
  - A gRPC client with `--tablet-grpc-crl`, `--vtgate-grpc-crl`, `--vtctld-grpc-crl`, or another `*-grpc-crl` flag now connects with TLS and verifies the server against the system roots when neither a client certificate nor a CA is configured. Previously, it connected in plaintext with the CRL silently ignored. This addresses GHSA-fxqj-c35w-x6rq.
- **[security]** The `planbuilder.BuildPermissions` result
  - The exported `planbuilder.BuildPermissions` function now returns a second result, `tablesUndetermined bool`, alongside the permissions. This change supports the strict table ACL enforcement addressed by GHSA-w6mx-2f8x-pqf4.
- **[security]** The `/api/` HTTP API
  - The HTTP API that `vtctld` served under `/api/` has been removed. The affected components include `vtctldclient` and `VtctldServer`.
- **[breaking]** The `--compression-level` value `1`, reassigned to the fast compressor
  - Values `0` and `1`, including the default `1`, now select the fast compressor. Previously, `1` requested a hash-chain search depth of 1.
- **[breaking]** Targeted `SET` statements with subqueries
  - Targeted `SET` statements with subqueries must be avoided until every `vtgate` is upgraded, or the `vtgate` instances must be upgraded first.
- **[breaking]** Removed `vtctld` Go package symbols
  - For Go package users, `vtctld.InitVtctld`, `vtctld.ActionRepository`, `vtctld.ActionResult`, and `vtctld.TabletWithURL` have been removed.

## Plan ahead
- **[deprecated]** Deprecated `vtctld` and `vtcombo` API flags
  - removal planned in v26
  - The `--cell`, `--proxy-tablets`, `--action-timeout`, and `--tablet-health-keep-alive` flags of `vtctld` and `vtcombo` are now deprecated no-ops. They previously configured the removed API.

## Other recorded changes
- 12 (value_changed 7, added 2, defect_corrected 2, constraint_changed 1)

[Full analysis](https://ratatosk.io/en/releases/vitess/v23.0.7)

[Original release notes](https://github.com/vitessio/vitess/releases/tag/v23.0.7)