# Vitess v24.0.4

> Storage & Data · 2026-10-01

A security-focused maintenance release tightens TLS revocation and table ACL enforcement, removes a legacy `vtctld` HTTP surface, and includes compatibility changes for upgrades and Go package users. It also changes lz4 compression semantics and adds operational gRPC connection metrics.

## Action needed
- **[security]** TLS for gRPC clients with CRL configuration
  - A gRPC client configured with `--tablet-grpc-crl`, `--vtgate-grpc-crl`, or another `*-grpc-crl` flag now connects with TLS and verifies the server against system roots when no client certificate or CA is configured. Previously, it connected in plaintext and silently ignored the CRL. GHSA-fxqj-c35w-x6rq is addressed by this change.
- **[security]** Read checks under strict table ACL
  - Each read is checked like a plain `SELECT` of the same tables under strict table ACL, with the same dry-run and exempt-ACL behavior as other table ACL checks. The change applies to `--queryserver-config-strict-table-acl` and addresses GHSA-w6mx-2f8x-pqf4.
- **[security]** The `/api/` HTTP API, removed
  - The HTTP API that `vtctld` served under `/api/` has been removed because it was dead code that exposed a security attack surface.
- **[breaking]** Startup validation for CRL configurations
  - Configurations where the CRL cannot be applied as configured are now refused when the TLS configuration is built at startup.
- **[breaking]** Removed `vtctld` Go package APIs
  - For Go package users, `vtctld.InitVtctld`, `vtctld.ActionRepository`, `vtctld.ActionResult`, and `vtctld.TabletWithURL` have been removed.
- **[breaking]** Subqueries in settings under strict table ACL
  - Under strict table ACL, `vttablet` now rejects a setting whose expressions contain a subquery.

## Check if affected
- **[breaking]** Targeted `SET` statements with subqueries during upgrades
  - Applies when vttablets are upgraded before vtgates.
  - In the usual upgrade order, with vttablets upgraded before vtgates, targeted `SET` statements containing subqueries are not supported until every vtgate has been upgraded. The alternative upgrade order is to upgrade vtgates first.

## Plan ahead
- **[deprecated]** The `--cell`, `--proxy-tablets`, `--action-timeout`, and `--tablet-health-keep-alive` flags, deprecated
  - removal planned in v26
  - The flags `--cell`, `--proxy-tablets`, `--action-timeout`, and `--tablet-health-keep-alive` are deprecated in this release. They will be removed in v26.

## Other recorded changes
- 13 (value_changed 10, added 2, constraint_changed 1)

[Full analysis](https://ratatosk.io/en/releases/vitess/v24.0.4)

[Original release notes](https://github.com/vitessio/vitess/releases/tag/v24.0.4)