MySQL 8.1.0 → 26.10.0

40 releases · 36 breaking changes · 58 security fixes · 31 advisories fixed

58security36breaking109deprecated113feature573fix

Is 8.1.0 affected?

Vulnerabilities fixed by this upgrade

6.5 CVE-2024-21171 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnera…
2.2 CVE-2024-21101 Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.5.33 and prior, 7.6.29 and prior, 8.0.36 and prior and 8.3.0 a…
4.9 CVE-2024-21102 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vu…
4.9 CVE-2024-21096 Vulnerability in the MySQL Server product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulne…
4.9 CVE-2024-21087 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily expl…
4.9 CVE-2024-21069 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability…
4.9 CVE-2024-21061 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Audit Plug-in). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vul…
4.9 CVE-2024-21062 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnera…
4.9 CVE-2024-21047 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allo…
4.9 CVE-2024-20981 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability…
6.5 CVE-2024-20985 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability…
5.5 CVE-2024-20969 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability…
4.9 CVE-2024-20971 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnera…
6.5 CVE-2024-20973 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnera…
6.5 CVE-2024-20975 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.2.0 and prior. Easily exploitable vulnerability allows low priv…
6.5 CVE-2024-20977 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnera…
6.5 CVE-2024-20961 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnera…
6.5 CVE-2024-20963 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploita…
4.9 CVE-2024-20965 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnera…
5.5 CVE-2024-20967 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulne…
4.9 CVE-2023-22103 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability all…
4.9 CVE-2023-22114 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high pr…
6.5 CVE-2023-22095 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). The supported version that is affected is 8.1.0. Easily exploitable vulnerability allows low privileged a…
4.9 CVE-2023-22097 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high pr…
4.9 CVE-2023-22078 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability all…
4.9 CVE-2023-22084 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.43 and prior, 8.0.34 and prior and 8.1.0. Easily exploitable vulnerabil…
4.9 CVE-2023-22032 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability all…
6.5 CVE-2023-22059 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability all…
4.9 CVE-2023-22066 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high pr…
4.9 CVE-2023-22068 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high pr…
4.9 CVE-2023-22070 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability all…

Breaking changes

breaking As of this release, MySQL no longer supports Enterprise Linux 7 (and associated glibc 2.17 generic). in 26.7.0
breaking As of this release, MySQL no longer supports Enterprise Linux 7 (and associated glibc 2.17 generic). in 9.7.2
breaking Under certain circumstances, find_in_set() could return incorrect results. The optimization which caused this has been removed. Our thanks to Jingqi Tian for the contribution. (Bug #119995, Bug #39056621) in 9.7.0
breaking A number of unused symbols were removed from the code base. (Bug #38557463) in 9.6.0
breaking InnoDB: InnoDB redo logging error messages now include the current LSN and redo log capacity information. A new warning code ER_IB_WRN_REDO_DISABLED_INFO is added which includes the current LSN. A new error code ER_IB_MSG_LOG_WRITER_WAIT_ON_NEW_LOG_FILE_INFO is added to include the current log… in 9.6.0
breaking InnoDB: The field fk_max_recusive_level in dict_table_t struct is no longer used and has been removed. Our thanks to Xiaocong Ding for the contribution. (Bug #119063, Bug #38492574) in 9.6.0
breaking Important Change: IFNULL() used in a LIKE clause raised ER_CANT_AGGREGATE_2COLLATIONS. This was due to the fact that IFNULL() returns a binary collation and the collation derivation NONE, but NONE was not allowed in this context, leading to the error. We solve this problem by making a slight… in 9.4.0
breaking Removed a warning in gcs_xcom_networking.cc. (Bug #38021787) in 9.4.0
breaking MySQL Server now requires GCC version 11 or later to compile. As part of this change, support for ARM systems using RHEL7 is removed in this release, due to the lack of availability of GCC 11 on that platform. (Bug #38004285) in 9.4.0
breaking Removed workaround for old versions of CMake. Note The minimum version of CMake supported for building MySQL is 3.14.6. (Bug #37901122) in 9.4.0
breaking Removed warnings observed when compiling the server with Clang 20. (Bug #37785251) in 9.4.0
breaking Removed the unused file strings/utr11-dump.cc. (Bug #37549844) in 9.3.0
breaking Removed extraneous pipe characters (|) from the first example. in 9.3.0
breaking macOS: Removed obsolete CMake code from MacOS builds. (Bug #37258036) in 9.2.0
breaking macOS: Removed warnings of the form ld: warning: ignoring duplicate libraries and warnings specific to xcodebuild. (Bug #37065301) in 9.2.0
breaking Microsoft Windows: Removed compiler warnings issued when building MySQL with Visual Studio 2022. (Bug #113870, Bug #36256477) in 9.2.0
breaking Removed or fixed issues in a number of copyright header files. (Bug #37238155) in 9.2.0
breaking Removed a maybe-uninitialized error found in sql/item.cc when building MySQL with GCC 14. (Bug #37157201) in 9.2.0
breaking Removed an error in mysql_prepare_create_table() (in the file sql/sql_table.cc) found when compiling MySQL with XCode 16. (Bug #37068527) in 9.2.0
breaking When removal of the database directory as part of DROP DATABASE was unsuccessful due to a file system error or an unexpected shutdown, the transaction containing DROP DATABASE was not always rolled back; manual intervention was required in such cases to rectify the problem. in 9.1.0
breaking When compiling MySQL, we no longer check for Fedora versions 28 or 34, since these have reached end of life and are no longer supported. (Bug #36819263) in 9.1.0
breaking Support for AES ECB, which is insecure, has been removed from all MySQL keyring-related components. (Bug #36749277) in 9.1.0
breaking macOS: The Xcode version of zlib was removed from the default list of system libraries to use when configuring with -DWITH_SYSTEM_LIBS=ON. (Bug #36537593) in 9.0.0
breaking Removed linker warnings raised when compiling code that used RapidJSON. (Bug #36322583) in 9.0.0
breaking Removed warnings raised in sql/statement/ed_connection.cc when building on Ubuntu 23.04. (Bug #114436, Bug #36428465) in 9.0.0
breaking Important Change: ER_SUBQUERY_NO_1_ROW has been removed from the list of errors which are ignored by statements which include the IGNORE keyword. This has been done for the following reasons: Following an upgrade to this release, this change can make an UPDATE, DELETE, or INSERT statement which… in 9.0.0
breaking As of this release, MySQL no longer supports Enterprise Linux 7 (and associated glibc 2.17 generic). in 8.4.11
breaking InnoDB: InnoDB redo logging error messages now include the current LSN and redo log capacity information. A new warning code ER_IB_WRN_REDO_DISABLED_INFO is added which includes the current LSN. A new error code ER_IB_MSG_LOG_WRITER_WAIT_ON_NEW_LOG_FILE_INFO is added to include the current log… in 8.4.8
breaking macOS: Removed obsolete CMake code from MacOS builds. (Bug #37258036) in 8.4.4
breaking macOS: Removed warnings of the form ld: warning: ignoring duplicate libraries and warnings specific to xcodebuild. (Bug #37065301) in 8.4.4
breaking Removed a maybe-uninitialized error found in sql/item.cc when building MySQL with GCC 14. (Bug #37157201) in 8.4.4
breaking Removed an error in mysql_prepare_create_table() (in the file sql/sql_table.cc) found when compiling MySQL with XCode 16. (Bug #37068527) in 8.4.4
breaking macOS: The Xcode version of zlib was removed from the default list of system libraries to use when configuring with -DWITH_SYSTEM_LIBS=ON. (Bug #36537593) in 8.4.1
breaking Removed warnings raised in sql/statement/ed_connection.cc when building on Ubuntu 23.04. (Bug #114436, Bug #36428465) in 8.4.1
breaking mysql_refresh(): Reimplemented using mysql_real_query() to execute FLUSH statements in place of COM_REFRESH, which was removed in MySQL 8.3. in 8.4.0
breaking The libevent library has been removed. (Bug #36357190) in 8.4.0

Security changes

security Fixed an issue relating to server-supplied RSA public-key handling during client-side SHA-2 authentication. (Bug #39883040) in 26.10.0
security Fixed an issue relating to runtime key-type validation by keyring UDFs. (Bug #39838747) in 26.10.0
security Fixed an issue relating to client parsing of WebAuthn assertion challenge packets. (Bug #39740347) in 26.10.0
security Fixed an issue relating to resource cleanup during Enterprise Encryption digest-function initialization. (Bug #39665448) in 26.10.0
security Fixed an issue relating to nullable input supplied to keyring_key_generate(). (Bug #39633350) in 26.10.0
security Fixed an issue relating to nullable numeric arguments supplied to audit_api_message_emit_udf(). (Bug #39633136) in 26.10.0
security MySQL now supports post-quantum cryptography (PQC) in TLS 1.3 connections for OpenSSL 3.5.0 or later. This enables negotiation of PQC-capable TLS key-exchange groups, including hybrid classical/PQC groups, and advertising of PQC TLS handshake signature algorithms. The following system variables… in 26.7.0
security force_pqc: only accept main TLS connections negotiated with a PQC- compatible key exchange group. in 26.7.0
security admin_force_pqc: only accept admin TLS connections negotiated with a PQC- compatible key exchange group. in 26.7.0
security replication_force_pqc: require asynchronous replication TLS connections to use a PQC-compatible key exchange group. in 26.7.0
security group_replication_force_pqc: require Group Replication recovery TLS connections to use a PQC-compatible key exchange group. in 26.7.0
security mysqlx_force_pqc: only accept X Plugin TLS connections negotiated with a PQC-compatible key exchange group. in 26.7.0
security tls_kex: TLS key exchange groups to use for the main connection channel. in 26.7.0
security admin_tls_kex: TLS key exchange groups to use for the admin connection channel. in 26.7.0
security replication_tls_kex: TLS key exchange groups to use for asynchronous replication TLS connections. in 26.7.0
security group_replication_tls_kex: TLS key exchange groups to use for Group Replication recovery TLS connections. in 26.7.0
security mysqlx_tls_kex: TLS key exchange groups to use for X Plugin TLS connections. in 26.7.0
security The following boolean system variables define which algorithm is advertised. If enabled, PQC is used. If disabled, only classical TLS handshake signature algorithms are advertised. Note If enabled, but PQC is not available, the OpenSSL default is used. in 26.7.0
security use_pqc_sign: which algorithm is advertised on the main connection channel. in 26.7.0
security admin_use_pqc_sign: which algorithm is advertised on administration connections. in 26.7.0
security replication_use_pqc_sign: which algorithm is advertised on asynchronous replication connections. in 26.7.0
security group_replication_use_pqc_sign: which algorithm is advertised on Group Replication recovery connections. in 26.7.0
security mysqlx_use_pqc_sign: which algorithm is advertised on X Plugin connections. in 26.7.0
security Tls_key_exchange_algorithm: indicates the TLS key exchange group negotiated for the current TLS connection. in 26.7.0
security Tls_sign_algorithm: indicates the TLS handshake signature algorithm negotiated for the current TLS connection. in 26.7.0
security Mysqlx_force_pqc: value of the effective configuration applied to the current X plugin TLS channel. in 26.7.0
security Mysqlx_tls_kex: value of the effective configuration applied to the current X plugin TLS channel. in 26.7.0
security Mysqlx_use_pqc_sign: value of the effective configuration applied to the current X plugin TLS channel. in 26.7.0
security Fixed an issue relating to server-supplied RSA public-key handling during client-side SHA-2 authentication. (Bug #39883040) in 9.7.4
security Fixed an issue relating to runtime key-type validation by keyring UDFs. (Bug #39838747) in 9.7.4
security Fixed an issue relating to client parsing of WebAuthn assertion challenge packets. (Bug #39740347) in 9.7.4
security Fixed an issue relating to nullable numeric arguments supplied to audit_api_message_emit_udf(). (Bug #39633136) in 9.7.4
security This release is a Critical Security Patch Update. See Oracle Critical Security Patch Update Advisory - June 2026 for more information. in 9.7.1
security Authentication now supports PBKDF2 storage format with Caching_sha2_password, providing enhanced security and flexibility. This update allows for the use of PBKDF2 with SHA512, enabling a smoother migration path from existing formats and ensuring even stronger security guarantees. With this… in 9.7.0
security MySQL Enterprise Edition 9.7.0 introduces dynamic data masking policies. These policies enable masking at the column level in the base table, enabling least-privilege access. The following SQL statements are added: The following SQL statements are updated to support masking policies: The following… in 9.7.0
security CREATE MASKING POLICY in 9.7.0
security DROP MASKING POLICY in 9.7.0
security SHOW CREATE MASKING POLICY in 9.7.0
security CREATE TABLE in 9.7.0
security ALTER TABLE ... ADD COLUMN in 9.7.0
security ALTER TABLE ... ALTER COLUMN in 9.7.0
security CURRENT_ROLE_IN(role1,role2,...): supports a comma-separated list of roles. in 9.7.0
security CURRENT_USER_IN(user1,user2,...): supports a comma-separated list of usernames. in 9.7.0
security Important Change: MySQL now supports enhanced security and flexibility with the relocation of MD5() and SHA1() SQL functions to a separate component, allowing for greater control over deprecated hashing algorithms and improved compliance with security standards. You can install the classic_hashing… in 9.6.0
security Fixed an issue relating to authentication. (Bug #118447, Bug #38077617) in 9.6.0
security The error message returned when attempting to create a user with an existing user name was unclear. (Bug #28331, Bug #11746738) in 9.6.0
security Security Enhancement: The default value of caching_sha2_password_digest_rounds is increased to 10,000. (WL #16974) in 9.5.0
security MySQL Replication supports enhanced security features with encryption now being enabled for all replication connections by default. With this configuration change, the default value of the SOURCE_SSL option in the CHANGE REPLICATION SOURCE TO Statement has been changed to 1, the default value of… in 9.5.0
security This release introduces a MySQL component, component_keyring_hashicorp, which takes the place of the HashiCorp Vault keyring plugin; that plugin and its associated system variables are now deprecated (and subject to removal in a future version of MySQL). Like the plugin, the component allows… in 9.3.0
security Added CONTRIBUTING.md and SECURITY.md files to the MySQL sources to conform to Oracle's Open Source guidelines. (Bug #36998165) in 9.1.0
security Binary packages that include curl rather than linking to the system curl library have been upgraded to use curl 8.9.1. Important issues fixed in curl version 8.9.1 are described at https://curl.se/docs/security.html. (Bug #36967379, Bug #36955197) in 9.1.0
security If the view already exists, the statement appears to succeed but does not change the view definition, and yields a warning, as shown here: mysql> CREATE VIEW v1 AS SELECT c1, c3 FROM t1; Query OK, 0 rows affected (0.01 sec) mysql> CREATE VIEW v1 AS SELECT c2 FROM t1; ERROR 1050 (42S01): Table 'v1'… in 9.1.0
security Fixed an issue relating to server-supplied RSA public-key handling during client-side SHA-2 authentication. (Bug #39883040) in 8.4.13
security Fixed an issue relating to client parsing of WebAuthn assertion challenge packets. (Bug #39740347) in 8.4.13
security Fixed an issue relating to nullable numeric arguments supplied to audit_api_message_emit_udf(). (Bug #39633136) in 8.4.13
security Fixed an issue relating to authentication. (Bug #118447, Bug #38077617) in 8.4.8
security Added CONTRIBUTING.md and SECURITY.md files to the MySQL sources to conform to Oracle's Open Source guidelines. (Bug #36998165) in 8.4.3
security Binary packages that include curl rather than linking to the system curl library have been upgraded to use curl 8.9.1. Important issues fixed in curl version 8.9.1 are described at https://curl.se/docs/security.html. (Bug #36967379, Bug #36955197) in 8.4.3

Deprecations

deprecated Important Change: MySQL no longer supports OpenSSL versions older than 1.1.1. Build checks, packaging requirements, help text, and version guards now enforce the new minimum. (Bug #39546984) in 26.10.0
deprecated The component-facing psi_thread.h header now uses psi_thread_v7. PSI_THREAD_VERSION values 4 through 6 are deprecated for plugins. (Bug #39802197) in 26.10.0
deprecated The following replication system variables are deprecated in this release and scheduled for removal in a later release: (WL #17300) in 26.7.0
deprecated group_replication_communication_stack in 26.7.0
deprecated group_replication_ip_allowlist in 26.7.0
deprecated The following replication system variables are deprecated in this release and scheduled for removal in a later release: (WL #17300) in 9.7.2
deprecated group_replication_communication_stack in 9.7.2
deprecated group_replication_ip_allowlist in 9.7.2
deprecated MySQL now provides an INTERPRET_UTF8_AS_UTF8MB4 SQL mode that controls whether the deprecated utf8 character set and utf8_* collation aliases in SQL statements are interpreted as utf8mb3 or utf8mb4. The mode is disabled by default, preserving the previous utf8mb3 interpretation. When enabled, utf8… in 9.5.0
deprecated The group_replication_allow_local_lower_version_join system variable, deprecated in MySQL 8.4.0, has now been removed. (WL #16019) in 9.5.0
deprecated The replica_parallel_type system variable, deprecated in MySQL 8.0.29, has now been removed. (WL #13955) in 9.5.0
deprecated The SCRAM-SHA-1 authentication method for SASL LDAP authentication is now deprecated, and subject to removal in a future version of MySQL. You are encouraged to use SCRAM-SHA-256 instead. As part of this work, the default value for the authentication_ldap_sasl_auth_method_name system variable has… in 9.5.0
deprecated The following deprecated plugins are removed in this release: (WL #16801) in 9.5.0
deprecated semisync_master replaced by semisync_source. in 9.5.0
deprecated semisync_slave replaced by semisync_replica. in 9.5.0
deprecated The keyring_okv plugin is deprecated and replaced by the keyring_kmip component, enabling secure communication with Key Management Interoperability Protocol (KMIP) 1.1-compatible products such as Oracle Key Vault, Gemalto SafeNet KeySecure Appliance, Townsend Alliance Key Manager, and Entrust… in 9.5.0
deprecated Microsoft Windows: MySQL Configurator command-line option names and aliases have been revised to more clearly indicate their purpose. Multiword options accept either hyphens or underscores as separators, but the separator styles cannot be mixed within one option name. Deprecated names and aliases… in 9.5.0
deprecated Warnings raised by Clang 20 for non-trivially copyable types, deprecated literal operators, and incorrect main function declarations are no longer generated. (Bug #37785251) in 9.4.0
deprecated On MacOS, silenced deprecation warnings generated by Xcode 14; this includes suggestions to use snprintf(3) instead of sprintf(3), and warnings about possible loss of precision when converting from 64-bit to 32-bit integers. (Bug #34776172) in 9.4.0
deprecated Microsoft Windows: As MySQL Enterprise Edition 9.4.0 includes a new The MySQL Enterprise Firewall Component), intended to be a replacement for the now deprecated MySQL Enterprise Firewall plugin, the MySQL Configurator now supports enabling the firewall component and upgrading to it from the… in 9.4.0
deprecated As part of ongoing work to transition from MySQL plugins to MySQL components, the API used to write MySQL plugins is now deprecated and subject to removal in a future version of MySQL. This change has the following effects: Keyring Components Versus Keyring Plugins, provides a summary of the… in 9.4.0
deprecated The MySQL server's --early-plugin-load option is deprecated. Starting the server with this option now raises a deprecation warning. in 9.4.0
deprecated A deprecation warning is now issued whenever a keyring plugin is loaded. in 9.4.0
deprecated The system variable temptable_use_mmap, deprecated in version 8.0.26, is removed in this version. (WL #16745) in 9.4.0
deprecated The SQL functions MD5() and SHA1() are deprecated as of this release and scheduled for removal in a future release. (WL #16955) in 9.4.0
deprecated Packaging: This release includes a MySQL Enterprise Firewall component (see The MySQL Enterprise Firewall Component) intended to replace the firewall plugin, which is now deprecated and thus subject to removal in a future version of MySQL. The component implements most of the plugin's… in 9.4.0
deprecated Group Replication: The OpenSSL Engine interface is deprecated, and is no longer being included in OpenSSL v3 main packages by some Linux distributions, including Fedora. To avoid build issues, the usage of the OpenSSL Engine interface by the Group Communication System (GCS) is now restricted to… in 9.3.0
deprecated NDB Cluster: The --restore-privilege-tables option for ndb_restore, which was deprecated in NDB 8.0.16, has now been removed. (Bug #36298807) in 9.3.0
deprecated Replication: The replica_parallel_workers server system variable can no longer be set to 0; the minimum permitted value is now 1. (WL #13957) in 9.3.0
deprecated The system variable innodb_undo_tablespaces, deprecated in MySQL 8.0.14, has been removed. (WL #16746) in 9.3.0
deprecated The system variables innodb_log_file_size and innodb_log_files_in_group, deprecated in MySQL 8.0.30, have been removed. (WL #16743) in 9.3.0
deprecated The Version Tokens plugin, which was deprecated in MySQL 9.2.0, has been removed in this release. (WL #16614) in 9.3.0
deprecated This release adds the CREATE_SPATIAL_REFERENCE_SYSTEM privilege, which allows the user to execute any of the statements CREATE SPATIAL REFERENCE SYSTEM, CREATE OR REPLACE SPATIAL REFERENCE SYSTEM, and DROP SPATIAL REFERENCE SYSTEM. Use of the SUPER privilege for this purpose should now be… in 9.2.0
deprecated Implemented the standards-compliant my_char_traits<unsigned char> for use as a drop-in replacement for std::char_traits<unsigned char>, which was deprecated in Clang 18 and removed in Clang 19. (Bug #37273525, Bug #37785339) in 9.2.0
deprecated The entries present in the mysql_option.option_usage table depended on whether the Option Tracker was installed before or after the Audit Log. See Option Tracker Component, and MySQL Enterprise Audit Plugin (Deprecated), for more information. (Bug #37037438) in 9.2.0
deprecated This release adds a Connection Control component (component_connection_control) intended to replace the Connection Control plugins (see Connection Control Plugins). A single component takes the place of both plugins, which are now deprecated and subject to removal in a future version of MySQL. One… in 9.2.0
deprecated Microsoft Windows: On Windows, MySQL Configurator no longer executes the deprecated FLUSH PRIVILEGES statement. (Bug #37170330) in 9.2.0
deprecated The FLUSH PRIVILEGES statement is now deprecated, and causes a warning when issued. You should expect this statement to be removed in a future MySQL release. The following constructs are also deprecated, and now cause a warning when used: The features listed here do not cause any warnings but… in 9.2.0
deprecated The FLUSH_PRIVILEGES privilege, and granting of this privilege in 9.2.0
deprecated mysqladmin flush-privileges in 9.2.0
deprecated mysqladmin reload. in 9.2.0
deprecated Flushing of privileges by SIGHUP in 9.2.0
deprecated Flushing of the caching_sha2 cache by FLUSH PRIVILEGES in 9.2.0
deprecated Flushing of privileges by mysqladmin refresh in 9.2.0
deprecated The Version Tokens plugin is now deprecated, and subject to removal in a future MySQL release. The following related features are also now deprecated, and raise deprecation warnings whenever they are invoked: Attempting to install the version_tokens plugin—or to start the server when this plugin… in 9.2.0
deprecated The functions version_tokens_delete(), version_tokens_edit(), version_tokens_lock_exclusive(), version_tokens_lock_shared(), version_tokens_set(), version_tokens_show(), and version_tokens_unlock() in 9.2.0
deprecated The VERSION_TOKEN_ADMIN privilege in 9.2.0
deprecated The version_tokens_session and version_tokens_session_number server system variables in 9.2.0
deprecated This release introduces an Amazon Web Services keyring component (component_keyring_aws); this component supersedes the AWS keyring plugin (keyring_aws), which is now deprecated and thus subject to removal in a future version of MySQL. For more information about the AWS keyring component, see… in 9.1.0
deprecated NDB Cluster APIs: Support for Node.js, which was deprecated in NDB Cluster 9.0, is removed in this release. (WL #16246) in 9.1.0
deprecated The keyring_aws plugin is now deprecated, and subject to removal in a future version of MySQL. Users should migrate to the AWS keyring component, which is introduced in this release. For more information about the AWS keyring component, see Using the component_keyring_aws AWS Keyring Component.… in 9.1.0
deprecated Replication: MySQL 9.0.0 deprecates transactions which update both transactional tables and nontransactional or noncomposable tables. Such a transaction now causes a deprecation warning to be written to both the client and the error log. Only the InnoDB and BLACKHOLE storage engines are… in 9.0.0
deprecated InnoDB and BLACKHOLE in 9.0.0
deprecated MyISAM and MERGE in 9.0.0
deprecated performance_schema and any other storage engine in 9.0.0
deprecated TempTable and any other storage engine in 9.0.0
deprecated The mysql_native_password authentication plugin, deprecated in MySQL 8.0, has been removed, and the server now rejects mysql_native authentication requests from older client programs which do not have CLIENT_PLUGIN_AUTH capability. For backward compatibility, mysql_native_password remains… in 9.0.0
deprecated The --mysql-native-password server option in 9.0.0
deprecated The --mysql-native-password-proxy-users server option in 9.0.0
deprecated The default_authentication_plugin server system variable in 9.0.0
deprecated The MIN_VALUE and MAX_VALUE columns of the Performance Schema variables_info table are now deprecated, and subject to removal in a future version of MySQL. Instead, you should use the MIN_VALUE and MAX_VALUE columns of the variables_metadata table, which provide the same information. (WL #15585) in 9.0.0
deprecated The variables_metadata table provides general information about system variables. This information includes the name, scope, type, range (where applicable), and description of each system variable recognized by the MySQL server. The MIN_VALUE and MAX_VALUE columns of this table are intended to… in 9.0.0
deprecated The Information Schema tables TP_THREAD_GROUP_STATE, TP_THREAD_GROUP_STATS, and TP_THREAD_STATE were deprecated in MySQL 8.0.14. Accessing any of these tables now produces a warning; you should use the equivalent Performance Schema tables instead. For more information, see Performance Schema… in 9.0.0
deprecated The following replication system variables are deprecated in this release and scheduled for removal in a later release: (WL #17300) in 8.4.11
deprecated group_replication_communication_stack in 8.4.11
deprecated group_replication_ip_allowlist in 8.4.11
deprecated Warnings raised by Clang 20 for non-trivially copyable types, deprecated literal operators, and incorrect main function declarations are no longer generated. (Bug #37785251) in 8.4.7
deprecated On MacOS, silenced deprecation warnings generated by Xcode 14; this includes suggestions to use snprintf(3) instead of sprintf(3), and warnings about possible loss of precision when converting from 64-bit to 32-bit integers. (Bug #34776172) in 8.4.6
deprecated Group Replication: The OpenSSL Engine interface is deprecated, and is no longer being included in OpenSSL v3 main packages by some Linux distributions, including Fedora. To avoid build issues, the usage of the OpenSSL Engine interface by the Group Communication System (GCS) is now restricted to… in 8.4.5
deprecated Implemented the standards-compliant my_char_traits<unsigned char> for use as a drop-in replacement for std::char_traits<unsigned char>, which was deprecated in Clang 18 and removed in Clang 19. (Bug #37273525, Bug #37785339) in 8.4.4
deprecated The deprecation warning issued when authenticating with the mysql_native_password plugin is now issued only once. (Bug #35792948) in 8.4.1
deprecated Important Change: The deprecated mysql_native_password authentication plugin is now disabled by default. It can be enabled by starting MySQL with the new --mysql-native-password=ON server option, or by adding mysql_native_password=ON to the [mysqld] section of your MySQL configuration file. For… in 8.4.0
deprecated Partitioning: Silent omission of columns with index prefixes as part of a table's partitioning key was deprecated in MySQL 8.0.21, and generated a warning. In this release, the use of any such columns in the proposed partitioning key is now expressly disallowed, and causes the CREATE TABLE or… in 8.4.0
deprecated Replication: Syntax for a number of features relating to MySQL Replication that was deprecated in previous versions of MySQL has now been removed. These features include aspects of SQL statement syntax as well as several system status variables in the MySQL server. These changes are detailed… in 8.4.0
deprecated CHANGE REPLICATION SOURCE TO options removed: MASTER_AUTO_POSITION (SOURCE_AUTO_POSITION), MASTER_HOST (SOURCE_HOST), MASTER_BIND (SOURCE_BIND), MASTER_USER (SOURCE_USER), MASTER_PASSWORD (SOURCE_PASSWORD), MASTER_PORT (SOURCE_PORT), MASTER_CONNECT_RETRY (SOURCE_CONNECT_RETRY), MASTER_RETRY_COUNT… in 8.4.0
deprecated START REPLICA options removed: MASTER_LOG_FILE (SOURCE_LOG_FILE) and MASTER_LOG_POS (SOURCE_LOG_POS). in 8.4.0
deprecated Group Replication: The group_replication_allow_local_lower_version_join system variable is now deprecated, and setting it raises a warning (ER_WARN_DEPRECATED_SYNTAX_NO_REPLACEMENT). You should expect this variable to be removed in a future version of MySQL. Since there is no longer any reason to… in 8.4.0
deprecated A number of server options and variables supported in previous versions of MySQL have been removed in this release. Attempting to set any of them in MySQL 8.4 raises an error. These options and variables are listed here: (Bug #36337893, WL #9677, WL #13965, WL #15461, WL #15839, WL #16056, WL… in 8.4.0
deprecated binlog_transaction_dependency_tracking: Deprecated in MySQL 8.0.35 and MySQL 8.2.0. There are no plans to replace this variable or its functionality, which has been made internal to the server: Now, when multithreaded replicas are in use, the source mysqld uses always writesets to generate… in 8.4.0
deprecated group_replication_recovery_complete_at: Deprecated in MySQL 8.0.34. Beginning with this release, the policy applied during the distributed recovery process is always to mark a new member online only after it has received, certified, and applied all transactions that took place before it joined the… in 8.4.0
deprecated avoid_temporal_upgrade and show_old_temporals: Both deprecated in MySQL 5.6. Each of these variables no longer had any effect, and has been removed. There are no plans to replace either variable. in 8.4.0
deprecated no-dd-upgrade: Deprecated in MySQL 8.0.16, now removed. Use --upgrade=NONE instead. in 8.4.0
deprecated old and --new: Both deprecated in MySQL 8.0.35 and MySQL 8.2.0, and now removed. in 8.4.0
deprecated language: This option was deprecated in MySQL 5.5, and has now been removed. in 8.4.0
deprecated The --ssl, --skip-ssl, and --admin-ssl server options, as well as the have_ssl and have_openssl server system variables, were all deprecated in MySQL 8.0.26, and are all removed in this release. Use --tls-version and --admin-tls-version instead. in 8.4.0
deprecated default_authentication_plugin: Deprecated in MySQL 8.0.27, and now removed. Use authentication_policy instead. You should also be aware that the syntax for setting the authentication_policy variable has changed; see its description in the Manual for more information. in 8.4.0
deprecated In cases where an aliased table was referenced in EXPLAIN output, the table name was qualified with a schema name, which was not necessary and could result in confusion. These schema qualifications have been removed from the output. (Bug #36053664) in 8.4.0
deprecated The unused INFORMATION_SCHEMA.TABLESPACES table, deprecated in MySQL 8.0.22, has now been removed. For InnoDB tables, the Information Schema INNODB_TABLESPACES and INNODB_DATAFILES tables provide tablespace metadata. (WL #14065) in 8.4.0
deprecated LOW_PRIORITY used with LOCK TABLES ... WRITE had had no effect since MySQL 5.5, and was deprecated in MySQL 5.6. It is removed in this release; including LOW_PRIORITY in LOCK TABLES now causes a syntax error. (WL #16057) in 8.4.0
deprecated Support for use of the AUTO_INCREMENT modifier with FLOAT and DOUBLE columns was deprecated in MySQL 8.0, and is now removed. Attempting to use these together in CREATE TABLE and ALTER TABLE statements now causes an Incorrect column specifier for column error (ER_WRONG_FIELD_SPEC). Important Prior… in 8.4.0
deprecated The mysql_ssl_rsa_setup utility, which was deprecated in MySQL 8.0.34, is removed in this release. For MySQL distributions compiled using OpenSSL, the MySQL server can perform automatic generation of missing SSL and RSA files at startup. For more inforamtion, Creating SSL and RSA Certificates and… in 8.4.0
deprecated This release removes support for the ENGINE clause from the following SQL statements: Other than in the exceptional cases listed previously, use of the ENGINE clause with ALTER TABLESPACE or DROP TABLESPACE causes the statement to be rejected with an error. ENGINE clauses for the ALTER TABLESPACE… in 8.4.0
deprecated DROP TABLESPACE (all variants) in 8.4.0
deprecated ALTER TABLESPACE ... DROP DATAFILE in 8.4.0
deprecated All other variants of ALTER TABLESPACE, with the two exceptions listed here: in 8.4.0
deprecated ALTER TABLESPACE ... ADD DATAFILE ENGINE={NDB|NDBCLUSTER} in 8.4.0
deprecated ALTER UNDO TABLESPACE ... SET {ACTIVE|INACTIVE} ENGINE=INNODB in 8.4.0
deprecated The SET_USER_ID privilege, deprecated in MySQL 8.2.0, has been removed in this release, and its use in GRANT statements now causes a syntax error. Use the SET_ANY_DEFINER and ALLOW_NONEXISTENT_DEFINER privileges instead. (WL #15875) in 8.4.0
deprecated Removed the mysql_upgrade utility, which was deprecated in MySQL 8.0.16. (WL #16096) in 8.4.0
deprecated Removed the deprecated mysqlpump utility along with its associated lz4_decompress and zlib_decompress helper utilities. Instead, use mysqldump or the MySQL Shell dump utilities. (WL #16096) in 8.4.0
deprecated The following plugins have been removed. They are noted in the list provided here, along with any server system variables, CMake options, and other features associated with them which have also been removed: (WL #15937, WL #15938, WL #15939, WL #15941, WL #16140) in 8.4.0
deprecated authentication_fido, authentication_fido_client: Use authentication_webauthn instead; see WebAuthn Pluggable Authentication. The authentication_fido_rp_id server system variable, mysql client --fido-register-factor option, and the -DWITH_FIDO CMake option have also been removed. in 8.4.0
deprecated keyring_file: Use component_keyring_file instead; see Using the component_keyring_file File-Based Keyring Component. The keyring_file_data system variable has also been removed. In addition, the CMake options -DINSTALL_MYSQLKEYRINGDIR and -DWITH_KEYRING_TEST have been removed. in 8.4.0
deprecated keyring_encrypted_file: Use component_keyring_encrypted_file instead; see Using the component_keyring_encrypted_file Encrypted File-Based Keyring Component. The keyring_encrypted_file_data and keyring_encrypted_file_password server system variables have also been removed. in 8.4.0
deprecated keyring_oci: Use component_keyring_oci instead; see Using the Oracle Cloud Infrastructure Vault Keyring Component. The following server system variables have also been removed: keyring_oci_ca_certificate, keyring_oci_compartment, keyring_oci_encryption_endpoint, keyring_oci_key_file,… in 8.4.0
deprecated openssl_udf: Use the MySQL Enterprise Encryption component instead; see MySQL Enterprise Encryption. in 8.4.0
deprecated Support for weak encryption ciphers has been removed. This means that, when configuring encrypted connections, MySQL no longer allows specifying any cipher that does not meet the following conditions: This has implications for setting the system variables ssl_cipher, admin_ssl_cipher,… in 8.4.0
deprecated Proper TLS version (TLS v1.2 or TLSv1.3, as appropriate) in 8.4.0
deprecated Forward secrecy in 8.4.0

Every release in between

26.10.0 Oct 20, 2026 Release notes ↗

fixFixed an issue relating to Audit Log filter UDF error-message formatting. (Bug #39472337)

fixThe version of Boost needed to build MySQL has been raised from 1.87.0 to 1.92.0. (Bug #40006694)

fixMySQL CMake configuration could fail with newer Cyrus SASL versions when plugins present in older library releases were unavailable. Plugin files are now copied on a best-effort basis, permitting builds with both older and newer plugin sets. (Bug #39964171)

fixRapidYAML 0.16.0 is now bundled for use as an optional dependency of opentelemetry-cpp when built with -DWITH_CONFIGURATION=ON. (Bug #39894165)

fixMySQL Server could fail to compile with GCC 16.1 due to warnings treated as errors. (Bug #39688855, Bug #39671507, Bug #39670670, Bug #39670901)

fixMySQL source builds can now be configured with OpenSSL 4.0. Compatibility updates were also made for curl, libfido2, and gRPC. (Bug #39102340)

fixMySQL command services did not return stored-procedure output parameters from prepared CALL statements. Prepared-statement multi-result support now returns those parameters as a result set to component consumers. (Bug #39836178)

fixThe public mysql_command_services API now supports password-authenticated local Classic Protocol connections through the write-only MYSQL_COMMAND_PASSWORD option. Any non-null value, including an empty string, selects normal authentication to the local server; null retains embedded behavior.…

fixComponents using mysql_account_database_security_context_lookup can now query an account's lock state through the read-only Boolean account_locked option exposed by mysql_security_context_options. (Bug #39702733)

fixWith the default command-service DOM consumer, mysql_use_result() could return a non-NULL result containing metadata for a nonempty query while mysql_fetch_row() immediately returned NULL. A private cursor now exposes the materialized rows while preserving unbuffered-result semantics, row lengths,…

fixThe default command-service DOM consumer could return incomplete MYSQL_FIELD metadata, including a null catalog and zero metadata-name lengths. It now returns catalog def with length 3 and supplies the byte lengths of the remaining metadata names, matching libmysql and Classic Protocol results.…

fixFixed an issue relating to concurrent operations during deinitialization of the connection_control component. (Bug #39564040)

fixFixed an issue relating to failed-authentication tracking and delays by the connection_control component. (Bug #39564049)

deprecatedImportant Change: MySQL no longer supports OpenSSL versions older than 1.1.1. Build checks, packaging requirements, help text, and version guards now enforce the new minimum. (Bug #39546984)

fixMicrosoft Windows: An upgrade could fail if the Firewall component was installed on the source version. The upgrade incorrectly selected the Firewall plugin's stored procedure upgrade path. (Bug #39735395, Bug #120932)

fixInnoDB: A previous InnoDB deadlock fix made row-size estimates more accurate for B-tree operations, but also made CREATE TABLE and ALTER TABLE validation stricter. As a result, some table definitions accepted by earlier MySQL LTS releases were unexpectedly rejected or produced warnings, disrupting…

fixWhen the external MeCab parser failed during deferred FULLTEXT tokenization, a base row could be committed without complete token postings, causing searches to miss the row. Parser failures now produce a client warning, including for autocommit statements. Errors were returned similar to the…

fixThe error log now reports warnings when the history-list length crosses innodb_max_purge_lag and when purge lag begins delaying DML. Existing purge-lag configuration controls the behavior; no new system variables were added. Our thanks to Tony Chen and the team at Amazon for the contribution. (Bug…

fixAfter an exported table was modified, its tablespace discarded, and an older exported image imported, point lookups could return rows or values from the discarded tablespace generation. Stale Adaptive Hash Index entries are now treated as misses so lookups fall back to normal B-tree traversal.…

fixAfter ALTER TABLE ... IMPORT TABLESPACE failed, stale pages from the discarded tablespace could later trigger an assertion during eviction. Failed-import cleanup now preserves the index space identifier required to remove stale Adaptive Hash Index entries. Errors were returned similar to the…

fixFixed an issue relating to null input supplied to the InnoDB redo-log consumer UDF. (Bug #39632565) References: See also: Bug #34085310, Bug #36004840.

fixFixed an issue relating to SHOW CREATE output for short non-SQL stored-program or library bodies. (Bug #39361183)

fixFixed an issue relating to validation of index pages during transportable tablespace import. (Bug #39295605)

fixFixed an issue relating to parser nesting for InnoDB full-text Boolean Mode expressions. (Bug #39234789)

fixFixed an issue relating to concurrent COPY ALTER operations. Our thanks to George Ma and the team at Alibaba for the contribution. (Bug #39134921)

fixFixed an issue relating to renaming columns used by self-referencing InnoDB foreign keys. (Bug #39091341)

fixIn debug builds, concurrent foreign-key operations with the adaptive hash index enabled could trigger an index-lifetime assertion. InnoDB now protects the referenced table throughout the foreign-key check. Errors were returned similar to the following: Assertion failure:…

fixAfter the final redo-recovery batch, InnoDB could write and evict every page loaded into the buffer pool, increasing recovery time and causing later rereads. It now writes and evicts only pages with buffered changes and sorts the flush lists. (Bug #37296558)

fixHigh-concurrency READ COMMITTED workloads could perform poorly on NUMA systems because repeatedly closing read views acquired a global mutex and copied the active transaction set. Read-view objects can now be reused without taking that mutex solely for closure. Our thanks to Bin Wang of…

featureJSON Relational Duality Views now support table- and column-level CHECK and NO CHECK annotations for ETAG participation, and column-level UPDATE and NO UPDATE annotations for field mutability. CHECK is the table-level default, and columns inherit table settings unless explicitly overridden.…

deprecatedThe component-facing psi_thread.h header now uses psi_thread_v7. PSI_THREAD_VERSION values 4 through 6 are deprecated for plugins. (Bug #39802197)

securityFixed an issue relating to server-supplied RSA public-key handling during client-side SHA-2 authentication. (Bug #39883040)

securityFixed an issue relating to runtime key-type validation by keyring UDFs. (Bug #39838747)

securityFixed an issue relating to client parsing of WebAuthn assertion challenge packets. (Bug #39740347)

securityFixed an issue relating to resource cleanup during Enterprise Encryption digest-function initialization. (Bug #39665448)

securityFixed an issue relating to nullable input supplied to keyring_key_generate(). (Bug #39633350)

securityFixed an issue relating to nullable numeric arguments supplied to audit_api_message_emit_udf(). (Bug #39633136)

featureImportant Change: MySQL Server now supports a four-part release identity in the form MAJOR.MINOR.PATCH.UPDATE, with an empty update component represented as zero. The complete version is available through VERSION_WITH_UPDATE(), the read-only global version_with_update variable, mysqld…

featureThe command-service option MYSQL_COMMAND_BYPASS_MAX_CONNECTIONS can now be set before connection. Its default of true preserves administrative admission; setting it to false makes an embedded session subject to max_connections without using the reserved extra slot. (Bug #39980933)

featureThe mysql_thd_attributes service now exposes a read-only is_substatement Boolean, enabling components to distinguish top-level statements from stored-function and trigger execution. (Bug #39980910)

+131 more items in the release notes

26.7.0 Jul 28, 2026 Release notes ↗

fixWith legacy audit-log filtering, setting audit_log_include_accounts, clearing it to NULL, and then changing audit_log_exclude_accounts could filter out every account and stop audit logging. (Bug #35137790)

fixThe server could close unexpectedly if audit_log_encryption_password_get(keyring ID) was called. (Bug #33296125)

featureThe following Audit Log status variables are introduced in this version: This variable reports the number of audit log files generated by the Audit Log plugin or component when audit_log_format=JSON. The value is incremented for automatic rotations and decremented for pruning actions. (WL #17292)

deprecatedThe following replication system variables are deprecated in this release and scheduled for removal in a later release: (WL #17300)

deprecatedgroup_replication_communication_stack

deprecatedgroup_replication_ip_allowlist

featureInnoDB undo tablespace creation and truncation no longer rely on a local undo truncate log files. Undo truncation progress information is now stored in the Undo Tablespace header. As of this release, undo truncation logs are no longer generated. Note For backward compatibility, existing truncate…

breakingAs of this release, MySQL no longer supports Enterprise Linux 7 (and associated glibc 2.17 generic).

featureImportant Change: MySQL 26.7 introduces the Change Stream Applier (CSA), a new implementation of the replica SQL applier for multi-threaded replication. CSA is an opt-in, per-channel alternative to the Multi-Threaded Applier (MTA). It uses a modular scheduling and execution design to improve…

featureAllows parallel reads of relay-log-backed transactions and release cached event memory as transactions are consumed.

featureAPPLIER_VERSION = 1|2: Selects the applier implementation.

feature1: Multi-Threaded Applier. Default for new channels.

featureAPPLIER_WORKER_COUNT: CSA-only. Sets the number of CSA workers for the channel. Range is 1-1024. If omitted for a new channel, replica_parallel_workers is used.

featureAPPLIER_EVENT_MEMORY_LIMIT: CSA-only. Sets a per-channel cache limit for binlog events. Default is 0 when omitted for a new channel. The effective cache limit is at least equal to the value of replica_max_allowed_packet, a lower configured value produces a warning.

securityMySQL now supports post-quantum cryptography (PQC) in TLS 1.3 connections for OpenSSL 3.5.0 or later. This enables negotiation of PQC-capable TLS key-exchange groups, including hybrid classical/PQC groups, and advertising of PQC TLS handshake signature algorithms. The following system variables…

securityforce_pqc: only accept main TLS connections negotiated with a PQC- compatible key exchange group.

securityadmin_force_pqc: only accept admin TLS connections negotiated with a PQC- compatible key exchange group.

securityreplication_force_pqc: require asynchronous replication TLS connections to use a PQC-compatible key exchange group.

securitygroup_replication_force_pqc: require Group Replication recovery TLS connections to use a PQC-compatible key exchange group.

securitymysqlx_force_pqc: only accept X Plugin TLS connections negotiated with a PQC-compatible key exchange group.

securitytls_kex: TLS key exchange groups to use for the main connection channel.

securityadmin_tls_kex: TLS key exchange groups to use for the admin connection channel.

securityreplication_tls_kex: TLS key exchange groups to use for asynchronous replication TLS connections.

securitygroup_replication_tls_kex: TLS key exchange groups to use for Group Replication recovery TLS connections.

securitymysqlx_tls_kex: TLS key exchange groups to use for X Plugin TLS connections.

securityThe following boolean system variables define which algorithm is advertised. If enabled, PQC is used. If disabled, only classical TLS handshake signature algorithms are advertised. Note If enabled, but PQC is not available, the OpenSSL default is used.

securityuse_pqc_sign: which algorithm is advertised on the main connection channel.

securityadmin_use_pqc_sign: which algorithm is advertised on administration connections.

securityreplication_use_pqc_sign: which algorithm is advertised on asynchronous replication connections.

securitygroup_replication_use_pqc_sign: which algorithm is advertised on Group Replication recovery connections.

securitymysqlx_use_pqc_sign: which algorithm is advertised on X Plugin connections.

securityTls_key_exchange_algorithm: indicates the TLS key exchange group negotiated for the current TLS connection.

securityTls_sign_algorithm: indicates the TLS handshake signature algorithm negotiated for the current TLS connection.

securityMysqlx_force_pqc: value of the effective configuration applied to the current X plugin TLS channel.

securityMysqlx_tls_kex: value of the effective configuration applied to the current X plugin TLS channel.

securityMysqlx_use_pqc_sign: value of the effective configuration applied to the current X plugin TLS channel.

featureImportant Change: MySQL Server now uses calendar-based versioning for releases after the 9.7 LTS series. Version values use Year.Month.Patch (YY.M.P) format. MySQL 26.7.0 is the first such calendar-version release. The following are added to the mysql_version.h to identify the previous LTS…

featureMYSQL_PREVIOUS_LTS_VERSION: The previous LTS version number. For example, "9.7.0" is the previous LTS version for MySQL 26.7.0.

featureMYSQL_PREVIOUS_LTS_VERSION_ID: The identifier of the previous LTS version. For example, "9.7.0" is represented as 90700.

featureMySQL upgrade performance is improved by streamlining the ALTER TABLE statements which run on mysql.general_log and mysql.slow_log. Our thanks to Karry Zhang and the team at Alibaba for the contribution. (Bug #118132, Bug #37944523)

+157 more items in the release notes

9.7.4 Oct 20, 2026 Release notes ↗