1.3.1

Merged PRs

dolt

• 11665: go: sqle/resolve: Have SearchPath() parse the search path in a way which is more compliant with postgres.
  Correctly handle quoted identifiers and ToLower any unquoted ones.
• 11663: Add Doltgres transaction lifecycle callback
  Adds Doltgres transaction lifecycle notifications required by #3256.
• 11659: build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /integration-tests/go-sql-server-driver
  Bumps google.golang.org/grpc from 1.82.1 to 1.83.1.
  Release notes

  Sourced from google.golang.org/grpc's releases.

  Release 1.83.1

  Security

  • xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)
    • Special Thanks: @​nvxbug
  • xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#9258)
    • Special Thanks: @​nvxbug
  • xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#9332)
    • Special Thanks: @​alimony
  • xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#9332)
    • Special Thanks: @​alimony
  • xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#9332)
    • Special Thanks: @​alimony

  Performance

  • transport: Restrict memory overhead of buffering small data frames. (#9331)

  Release 1.83.0

  Security

  • server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
  • xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
  • xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
  • xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
  • xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#9223)

  New Features

  • xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#9133)
  • xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#9145)
  • authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#9142)
    • Special Thanks: @​hnefatl
  • xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
    • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#9119)
  • xds: Add support for xDS-based HTTP CONNECT proxies.
    • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#9151)
  • xds: Add support for contains_match in route header matchers. (#9223)

  Bug Fixes

  • credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#9197)
  • grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#9255)
    • Special Thanks: @​Yusufihsangorgel

  Release 1.82.2

  Security

  • server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (grpc/grpc-go#9365)

  ... (truncated)

  Commits

  • 1550d9e Change version to 1.83.1 (#9336)
  • ebba6f3 Cherry-pick #9258 and #9332 into v1.83.x (#9335)
  • 8cfeca0 Cherry-pick #9331 to v1.83.x (#9333)
  • dec6951 Change version to 1.83.1-dev (#9229)
  • 4c226da Change version to 1.83.0 (#9228)
  • c198988 Cherrypick 9223 into v1.83.x (#9279)
  • 8ce3ebf Cherrypick PR 9255 into v1.83.x (#9263)
  • e393849 Cherry-pick recent changes from master (#9240)
  • 2a112a8 authz: add onPolicyUpdate callback to authz file watcher (#9142)
  • 1a80fca vet: adds a check to disallow usage of regex.Compile in xDS code (#9216)
  • Additional commits viewable in compare view
  
  [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
  Dependabot commands and options

  
  You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/dolthub/dolt/network/alerts).
• 11654: build(deps): bump mysql2 from 3.9.8 to 3.22.0 in /integration-tests/mysql-client-tests/node
  Bumps mysql2 from 3.9.8 to 3.22.0.
  Release notes

  Sourced from mysql2's releases.

  v3.22.0

  3.22.0 (2026-04-10)

  Features

  • disable mysql_clear_password plugin by default (#4236) (884bec5), closes #1617
  • implement COM_RESET_CONNECTION with pool integration (#4148) (49a64cc)

  Performance Improvements

  • defer Error object creation to error handlers in promise wrappers (#4257) (ab131de)

  v3.21.1

  3.21.1 (2026-04-09)

  Bug Fixes

  • limit client flags to server capabilities (#4227) (e1930b8)
  • use Number.isSafeInteger for supportBigNumbers boundary check (#4225) (295264b)

  v3.21.0

  3.21.0 (2026-04-09)

  Features

  • add support for query attributes (#4223) (d732f78)
  • types: export ExecuteValues and QueryValues from entry point (9fafd6f)

  v3.20.0

  3.20.0 (2026-03-15)

  Features

  • add TracingChannel support for native APM instrumentation (#4178) (c06afc2)

  Bug Fixes

  • explicitly specify in auth plugins (#4175) (#4187) (5ac5563)
  • prevent double release from corrupting the connection pool (#4186) (7e57db6)
  • restore PoolConnection as subclass of Connection (#4183) (97855a6)

  v3.19.1

  3.19.1 (2026-03-09)

  ... (truncated)

  Changelog

  Sourced from mysql2's changelog.

  3.22.0 (2026-04-10)

  Features

  • disable mysql_clear_password plugin by default (#4236) (884bec5), closes #1617
  • implement COM_RESET_CONNECTION with pool integration (#4148) (49a64cc)

  Performance Improvements

  • defer Error object creation to error handlers in promise wrappers (#4257) (ab131de)

  3.21.1 (2026-04-09)

  Bug Fixes

  • limit client flags to server capabilities (#4227) (e1930b8)
  • use Number.isSafeInteger for supportBigNumbers boundary check (#4225) (295264b)

  3.21.0 (2026-04-09)

  Features

  • add support for query attributes (#4223) (d732f78)
  • types: export ExecuteValues and QueryValues from entry point (9fafd6f)

  3.20.0 (2026-03-15)

  Features

  • add TracingChannel support for native APM instrumentation (#4178) (c06afc2)

  Bug Fixes

  • explicitly specify in auth plugins (#4175) (#4187) (5ac5563)
  • prevent double release from corrupting the connection pool (#4186) (7e57db6)
  • restore PoolConnection as subclass of Connection (#4183) (97855a6)

  3.19.1 (2026-03-09)

  Bug Fixes

  • bound null-terminated string read to packet end (fixes a potential OOB read reported by Doruk Tan Ozturk (peaktwilight)) (#4161) (91c5229)
  • handle malformed geometry payloads (fixes a potential DoS vulnerability reported by Doruk Tan Ozturk (peaktwilight)) (#4164) (1869215)

  ... (truncated)

  Commits

  • 71bcbff chore(master): release 3.22.0 (#4237)
  • ab131de perf: defer Error object creation to error handlers in promise wrappers (#4257)
  • bb0100b build(deps-dev): bump the website-dev-dependencies group across 1 directory w...
  • 5f63557 build(deps-dev): bump the dev-dependencies group across 1 directory with 4 up...
  • 0b750e0 build(deps): bump the docusaurus group in /website with 2 updates (#4249)
  • 9566475 ci(dependabot): group dependency updates to reduce PR noise (#4248)
  • e4f3b42 build(deps): bump the react group in /website with 2 updates (#4247)
  • 53f9c9e ci(dependabot): group react and react-dom updates together (#4246)
  • 49a64cc feat: implement COM_RESET_CONNECTION with pool integration (#4148)
  • 884bec5 feat: disable mysql_clear_password plugin by default (#4236)
  • Additional commits viewable in compare view
  
  [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
  Dependabot commands and options

  
  You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/dolthub/dolt/network/alerts).
• 11652: go: sqle: Improve autotracker update robustness during dolt_reset --hard.
  Get rid of the unnecessary background work, and update the tracker state synchronously as part of the reset itself.
• 11651: store/val: return error on malformed adaptive value
  Fix panic when reading corrupted or truncated off-page storage chunks to return a SQL error.
  • Malformed addresses that aren't exactly 20 bytes now return ErrInvalidAddressLen.
  • Add varintPrefixLen to assert buffer length before reading varints, preventing out-of-bounds slice panics on truncated multi-byte headers.
  • Add ErrNullAdaptiveValue, ErrInlineAdaptiveValue, ErrTruncatedVarint, and ErrInvalidAddressLen for callers and tests.
    Fix #11641
• 11646: cmd/dolt: improve connection error reporting and stale server info cleanup
  CLI commands cleanup stale .dolt/sql-server.info files left by crashed servers and recover locally, while connection failures provide troubleshooting steps.
  • creds.go: Add ProcessExists.
  • server.go: Writing .dolt/sql-server.info is deferred until after InitSQLServer binds the listener.
  • queryist_utils.go: PingContext checks connectivity early and closes conn on dial failure.
    Fix dolthub/dolt#10856
    Close dolthub/dolt#11474
• 11634: build(deps): bump org.mariadb:r2dbc-mariadb from 1.2.2 to 1.4.1 in /integration-tests/mysql-client-tests/java
  Bumps org.mariadb:r2dbc-mariadb from 1.2.2 to 1.4.1.
  Release notes

  Sourced from org.mariadb:r2dbc-mariadb's releases.

  MariaDB Connector/R2DBC 1.4.1

  1.4.1 (Jun 2026)

  Full Changelog

  Notable Changes:

  • R2DBC-116 Add GraalVM native-image configuration and CI coverage
  • Update dependencies (Project Reactor 2025.0.6, Netty 4.2.15.Final)

  Bugs Fixed:

  • R2DBC-115 Clear-text authentication plugins (PAM, mysql_clear_password) must require a secure connection (report by fg0x0)
  • R2DBC-117 Cap BigDecimal/BigInteger string parsing length to prevent CPU exhaustion if MitM (report by tonghuaroot)
  • R2DBC-119 Fail closed when a classpath: SSL certificate is missing
  • R2DBC-120 Stored-procedure CALL detection wrongly matched any query containing "call" (thanks to yunhobb)
  • R2DBC-121 caching_sha2_password/sha256_password login fails with passwords of 20 characters or more (report by 4UjwXc)
  • R2DBC-124 Ensure a non-UTF8 charset cannot be used for protocol exchanges (report by fg0x0)
  • R2DBC-122 Fix SQL parser to correctly handle '--' in expressions
  • R2DBC-123 Pin Locale.ROOT on locale-sensitive wire-format codec sites (thanks to jmestwa-coder)

  MariaDB Connector/R2DBC 1.4.0

  1.4.0 (Feb 2026)

  Notable Changes:

  • R2DBC-109 Add fallbackToSystemTrustStore and fallbackToSystemKeyStore options
  • R2DBC-110 Support java.time.Instant parameters
  • R2DBC-114 Implement Wrapped interface to expose EventLoop scheduler for r2dbc-pool optimization

  Bugs Fixed:

  • R2DBC-108 Handle authentication plugin multi-exchange prefix (0x01) introduced in MDEV-37554
  • R2DBC-111 Potential hang when upstream subscription is cancelled before demand
  • R2DBC-112 Failed authentication when using caching_sha2_password with passwords longer than 18 characters
  • R2DBC-113 Add support for RSA public key content in cachingRsaPublicKey and rsaPublicKey options

  MariaDB Connector/R2DBC 1.3.1

  1.3.1 (Jun 2026)

  Maintenance release for the 1.3 line, back-porting the corrections, CI and security fixes made after 1.3.0. java.time.Instant parameter support is intentionally not included.

  Notable Changes:

  • R2DBC-108 Handle authentication plugin multi-exchange prefix (0x01) introduced in MDEV-37554
  • R2DBC-109 Add fallbackToSystemTrustStore and fallbackToSystemKeyStore options
  • R2DBC-113 Support inline RSA public key for sha256_password and caching_sha2_password
  • R2DBC-114 Implement Wrapped interface to expose the EventLoop scheduler for r2dbc-pool
  • R2DBC-116 Add GraalVM native-image configuration and CI testing

  Bugs Fixed:

  • R2DBC-111 Potential hang when upstream subscription is cancelled before demand
  • R2DBC-112 Failed authentication using caching_sha2_password with passwords longer than 18 characters

  ... (truncated)

  Changelog

  Sourced from org.mariadb:r2dbc-mariadb's changelog.

  1.4.1 (Jun 2026)

  Full Changelog

  Notable Changes:

  • R2DBC-116 Add GraalVM native-image configuration and CI coverage
  • Update dependencies (Project Reactor 2025.0.6, Netty 4.2.15.Final)

  Bugs Fixed:

  • R2DBC-115 Clear-text authentication plugins (PAM, mysql_clear_password) must require a secure connection (report by fg0x0)
  • R2DBC-117 Cap BigDecimal/BigInteger string parsing length to prevent CPU exhaustion if MitM (report by tonghuaroot)
  • R2DBC-119 Fail closed when a classpath: SSL certificate is missing
  • R2DBC-120 Stored-procedure CALL detection wrongly matched any query containing "call" (thanks to yunhobb)
  • R2DBC-121 caching_sha2_password/sha256_password login fails with passwords of 20 characters or more (report by 4UjwXc)
  • R2DBC-124 Ensure a non-UTF8 charset cannot be used for protocol exchanges (report by fg0x0)
  • R2DBC-122 Fix SQL parser to correctly handle '--' in expressions
  • R2DBC-123 Pin Locale.ROOT on locale-sensitive wire-format codec sites (thanks to jmestwa-coder)

  1.4.0 (Feb 2026)

  Notable Changes:

  • R2DBC-109 Add fallbackToSystemTrustStore and fallbackToSystemKeyStore options
  • R2DBC-110 Support java.time.Instant parameters
  • R2DBC-114 Implement Wrapped interface to expose EventLoop scheduler for r2dbc-pool optimization

  Bugs Fixed:

  • R2DBC-108 Handle authentication plugin multi-exchange prefix (0x01) introduced in MDEV-37554
  • R2DBC-111 Potential hang when upstream subscription is cancelled before demand
  • R2DBC-112 Failed authentication when using caching_sha2_password with passwords longer than 18 characters
  • R2DBC-113 Add support for RSA public key content in cachingRsaPublicKey and rsaPublicKey options

  1.3.0 (Oct 2024)

  Notable Changes:

  • R2DBC-106 Implement parsec authentication. see https://mariadb.com/kb/en/authentication-plugin-parsec/

  Commits

  • a82d265 bump 1.4.1
  • 44602cb [misc] fix flaky PrepareResultSetTest.cacheReuse under load
  • 68d9f81 [misc] test correction about pamOtherPwd sanitization
  • 4656951 [misc] bump dependencies
  • cd9b6f9 [misc] code style correction
  • 76181aa [R2DBC-121] caching_sha2_password/sha256_password login fails with passwords ...
  • ccf4326 [R2DBC-120] Stored-procedure CALL detection wrongly matched any query contain...
  • 84dc70c Merge PR #92 (yunhobb): fix incorrect stored procedure CALL detection in crea...
  • 11d92c0 [misc] mask pamOtherPwd in MariadbConnectionConfiguration.toString()
  • 1ec789e [misc] reject malformed auth-switch seed and column-definition packets cleanly
  • Additional commits viewable in compare view
  
  [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
  Dependabot commands and options

  
  You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/dolthub/dolt/network/alerts).
• 11633: build(deps): bump org.mariadb.jdbc:mariadb-java-client from 3.5.3 to 3.5.9 in /integration-tests/mysql-client-tests/java
  Bumps org.mariadb.jdbc:mariadb-java-client from 3.5.3 to 3.5.9.
  Release notes

  Sourced from org.mariadb.jdbc:mariadb-java-client's releases.

  MariaDB Connector/Java 3.5.9

  3.5.9 (Jun 2026)

  Full Changelog

  Key Enhancements

  • CONJ-1223 - cache TLS trust/key managers across connections to reduce SSL connection cost
  • CONJ-1314 - add SPI for interactive dialog (PAM) authentication callback
  • CONJ-1311 - add dedicated option useIpForKillQuery for query cancellation
  • CONJ-1310 - Add full native image support and CI coverage

  Issues Resolved

  • CONJ-1320 - PAM (dialog) authentication must require a secure connection (report by fg0x0)
  • CONJ-1319 - Use constant-time comparison when validating the server certificate fingerprint (report by jmestwa-coder)
  • CONJ-1318 - enforce allowLocalInfile=false on the server's local-infile request, so a malicious server cannot read a client file despite the option being disabled
  • CONJ-1322 - match local infile filename case-sensitively (thanks to jmestwa-coder)
  • CONJ-1323 - LOAD LOCAL INFILE validation rejects statements preceded by line comments (thanks to sebdomdev)
  • CONJ-1315 - cap BigDecimal/BigInteger string parsing length to prevent CPU exhaustion if MitM (report by tonghuaroot)
  • CONJ-1317 - ensure non-UTF8 charset cannot be used for protocol exchanges (report by fg0x0)
  • CONJ-1304 - CallableStatement parameter metadata read from mysql.proc, with MySQL info_schema fallback
  • CONJ-1299 - keep VALUES literals after the last placeholder when rewriting batches
  • CONJ-1313 - race condition in HaMode#getAvailableHostInOrder can cause NPE
  • CONJ-1311 - Connection.cancelCurrentQuery fails with SslMode.VERIFY_FULL when client socket IP is set
  • CONJ-1264 - handle LocalDateTime as a zoneless wall-clock value
  • CONJ-1316 - pin Locale.ROOT on locale-sensitive call sites and date/time/Duration text formatting (fixes locale-dependent parsing/formatting, e.g. under tr_TR) (thanks to jmestwa-coder)
  • CONJ-1324 - fix SQL parser to correctly handle '--' in expressions and reset lastChar after block comments
  • CONJ-1323 - LOAD LOCAL INFILE validation rejects statements preceded by line comments (thanks to sebdomdev)

  MariaDB Connector/Java 3.5.8

  3.5.8 (Apr 2026)

  Full Changelog

  Issues Resolved

  • CONJ-1305 - XAResource.isSameRM() incorrectly returns true when rewriteBatchedStatements differs between connections
  • CONJ-1303 - Statement.cancel() fails to kill running query during result streaming

  Other

  • CONJ-1298 - Performance improvement: avoid decoding extended format

  MariaDB Connector/Java 3.5.7

  3.5.7 (Dec 2025)

  Full Changelog

  Key Enhancements

  ... (truncated)

  Changelog

  Sourced from org.mariadb.jdbc:mariadb-java-client's changelog.

  3.5.9 (Jun 2026)

  Full Changelog

  Key Enhancements

  • CONJ-1223 - cache TLS trust/key managers across connections to reduce SSL connection cost
  • CONJ-1314 - add SPI for interactive dialog (PAM) authentication callback
  • CONJ-1311 - add dedicated option useIpForKillQuery for query cancellation
  • CONJ-1310 - Add full native image support and CI coverage

  Issues Resolved

  • CONJ-1320 - PAM (dialog) authentication must require a secure connection (report by fg0x0)
  • CONJ-1319 - Use constant-time comparison when validating the server certificate fingerprint (report by jmestwa-coder)
  • CONJ-1318 - enforce allowLocalInfile=false on the server's local-infile request, so a malicious server cannot read a client file despite the option being disabled
  • CONJ-1322 - match local infile filename case-sensitively (thanks to jmestwa-coder)
  • CONJ-1323 - LOAD LOCAL INFILE validation rejects statements preceded by line comments (thanks to sebdomdev)
  • CONJ-1315 - cap BigDecimal/BigInteger string parsing length to prevent CPU exhaustion if MitM (report by tonghuaroot)
  • CONJ-1317 - ensure non-UTF8 charset cannot be used for protocol exchanges (report by fg0x0)
  • CONJ-1304 - CallableStatement parameter metadata read from mysql.proc, with MySQL info_schema fallback
  • CONJ-1299 - keep VALUES literals after the last placeholder when rewriting batches
  • CONJ-1313 - race condition in HaMode#getAvailableHostInOrder can cause NPE
  • CONJ-1311 - Connection.cancelCurrentQuery fails with SslMode.VERIFY_FULL when client socket IP is set
  • CONJ-1264 - handle LocalDateTime as a zoneless wall-clock value
  • CONJ-1316 - pin Locale.ROOT on locale-sensitive call sites and date/time/Duration text formatting (fixes locale-dependent parsing/formatting, e.g. under tr_TR) (thanks to jmestwa-coder)
  • CONJ-1324 - fix SQL parser to correctly handle '--' in expressions and reset lastChar after block comments
  • CONJ-1323 - LOAD LOCAL INFILE validation rejects statements preceded by line comments (thanks to sebdomdev)
  • CONJ-1318 - allowLocalInfile=false does not block LOAD DATA LOCAL INFILE against a malicious server (thanks to tharavel)

  3.4.3 (Jun 2026)

  Full Changelog

  Bugs Fixed

  • CONJ-1315 - cap BigDecimal/BigInteger string parsing length to prevent CPU exhaustion if Mitm (report by tonghuaroot)
  • CONJ-1316 - pin Locale.ROOT on locale-sensitive call sites and date/time/Duration text formatting (fixes locale-dependent parsing/formatting, e.g. under tr_TR) (thanks to jmestwa-coder)
  • CONJ-1259 - DatabaseMetaData read-only detection: handle MariaDB 12.0 @@read_only returning ON/OFF instead of 1/0
  • CONJ-1317 - ensure non-UTF8 charset cannot be used for protocol exchanges (report by fg0x0)
  • CONJ-1320 - PAM (dialog) authentication now requires a secure connection (TLS or unix socket), like mysql_clear_password (report by fg0x0)
  • CONJ-1319 - use constant-time comparison when validating the server certificate fingerprint (thanks to jmestwa-coder)
  • CONJ-1322 - match local infile filename case-sensitively (thanks to jmestwa-coder)
  • CONJ-1323 - LOAD LOCAL INFILE validation rejects statements preceded by line comments (thanks to sebdomdev)
  • CONJ-1318 - allowLocalInfile=false does not block LOAD DATA LOCAL INFILE against a malicious server (thanks to tharavel)

  3.3.5 (Jun 2026)

  ... (truncated)

  Commits

  • df4ebe2 [misc] enhance TcpProxy and TcpProxySocket for improved thread safety and con...
  • 687c840 [misc] update environment variable for Maxscale version
  • 4466ad6 [misc] test stability improvement : update proxy close method in PooledConnec...
  • 1e29819 [misc] update README version
  • da297f1 Merge branch 'develop'
  • 83d3da9 [misc] Update CHANGELOG
  • e39e8b9 match local infile filename case-sensitively
  • d90b987 [misc] Implement secure authentication checks and add regression tests for cr...
  • f4a727c [CONJ-1320] PAM (dialog) authentication must require a secure connection
  • a87c711 [misc] update CHANGELOG
  • Additional commits viewable in compare view
  
  [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
  Dependabot commands and options

  
  You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/dolthub/dolt/network/alerts).
• 11630: argparser: fix panic on empty-string value for list options
  Passing an empty string as the value of a list-valued option (e.g. dolt log --not "", dolt diff --include-cols "") no longer panics.
  Close dolthub/dolt#11347
• 11623: build(deps): bump mariadb from 3.4.5 to 3.5.3 in /integration-tests/mysql-client-tests/node
  Bumps mariadb from 3.4.5 to 3.5.3.
  Release notes

  Sourced from mariadb's releases.

  MariaDB Connector/Node.js 3.5.3

  3.5.3 (Jun1 2026)

  Full Changelog

  Notable changes

  • Minimum supported Node.js version is now 20 (was 18; Node 18 went EOL in April 2025)
  • CONJS-346: Add RowsWithMeta<T> and WithMeta<T> helper types for typing query() / execute() result shapes — RowsWithMeta<T> for the default rows-array-with-meta shape, WithMeta<T> for the metaAsArray: true tuple form (types-only, no runtime change)

  Issues Fixed

  • CONJS-354: Reject a server-initiated LOAD DATA LOCAL INFILE request when permitLocalInfile is disabled (report by tharavel)
  • CONJS-353: PAM (dialog) authentication now requires a secure connection (TLS or a local unix socket), since it transmits the password in clear text (report by fg0x0)
  • CONJS-351: Use constant-time comparison when validating the server certificate fingerprint token, preventing a timing side-channel that could leak the token to a man-in-the-middle
  • CONJS-350: Fixed possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charset (report by fg0x0)
  • CONJS-344: Restore dual ESM/CJS support after the 3.5 ESM migration (#346):
    • TypeScript types now compile under moduleResolution: "Node16" / "NodeNext" / "Bundler" — fixes TS2846 / TS2834 reported in 3.5.1 and 3.5.2
    • Ship paired .d.cts declarations for the require condition
    • Ship a real CJS bundle in dist/ so require('mariadb') works on Node 20+ without --experimental-require-module or ExperimentalWarning
    • Restore the default ESM export, so import mariadb from 'mariadb' works again (matches 3.4.x behavior)

  MariaDB Connector/Node.js 3.5.2

  3.5.2 (Mar 2026)

  Full Changelog

  Issues Fixed

  • CONJS-342 Resolved TypeScript compilation errors introduced in mariadb-connector-nodejs v3.5.1
  • CONJS-343 Fixed an issue where batch operations would hang when provided with empty array parameter values

  MariaDB Connector/Node.js 3.5.1

  3.5.1 (Feb 2026)

  Full Changelog

  Notable changes

  • CONJS-338 Add asyncDispose support for Connection, PoolConnection and Pool #250
  • CONJS-339 Add default type parameter to Prepare interface and fix executeStream generic #334
  • CONJS-339 Add wildcard for values params on Prepare

  Issues Fixed

  • CONJS-331 Plugin authentication change correction
  • CONJS-335 Deno compatibility: send COM_QUIT synchronously to prevent socket cleanup race condition
  • CONJS-336 Connection attribute _server_host send host, but IP resulting of name resolution
  • CONJS-340 Fix pool connection event to emit wrapped connections and prevent user errors from breaking pool #342
  • CONJS-341 Support charset + collation combination in connection options #337

  MariaDB Connector/Node.js 3.5.0 RC

  3.5.0-rc.0 (Oct 2025)

  Full Changelog

  Notable changes

  • CONJS-326 migrate from commonJS to ESM
  • CONJS-325 deno compatibility

  ... (truncated)

  Changelog

  Sourced from mariadb's changelog.

  3.5.3 (Jun1 2026)

  Full Changelog

  Notable changes

  • Minimum supported Node.js version is now 20 (was 18; Node 18 went EOL in April 2025)
  • CONJS-346: Add RowsWithMeta<T> and WithMeta<T> helper types for typing query() / execute() result shapes — RowsWithMeta<T> for the default rows-array-with-meta shape, WithMeta<T> for the metaAsArray: true tuple form (types-only, no runtime change)

  Issues Fixed

  • CONJS-354: Reject a server-initiated LOAD DATA LOCAL INFILE request when permitLocalInfile is disabled (report by tharavel)
  • CONJS-353: PAM (dialog) authentication now requires a secure connection (TLS or a local unix socket), since it transmits the password in clear text (report by fg0x0)
  • CONJS-351: Use constant-time comparison when validating the server certificate fingerprint token, preventing a timing side-channel that could leak the token to a man-in-the-middle
  • CONJS-350: Fixed possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charset (report by fg0x0)
  • CONJS-344: Restore dual ESM/CJS support after the 3.5 ESM migration (#346):
    • TypeScript types now compile under moduleResolution: "Node16" / "NodeNext" / "Bundler" — fixes TS2846 / TS2834 reported in 3.5.1 and 3.5.2
    • Ship paired .d.cts declarations for the require condition
    • Ship a real CJS bundle in dist/ so require('mariadb') works on Node 20+ without --experimental-require-module or ExperimentalWarning
    • Restore the default ESM export, so import mariadb from 'mariadb' works again (matches 3.4.x behavior)

  3.4.6 (Jun 2026)

  Full Changelog

  Issues Fixed

  • CONJS-331: Corrected parsec authentication plugin handling
  • CONJS-350: Fixed possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charset (report by fg0x0)
  • CONJS-349: Fixed cleartext password disclosure to a man-in-the-middle when relying on certificate fingerprint validation (self-signed trust mode)
  • CONJS-351: Use constant-time comparison when validating the server certificate fingerprint token, preventing a timing side-channel that could leak the token to a man-in-the-middle
  • CONJS-353: PAM (dialog) authentication now requires a secure connection (TLS or a local unix socket), since it transmits the password in clear text (report by fg0x0)
  • CONJS-354: Reject a server-initiated LOAD DATA LOCAL INFILE request when permitLocalInfile is disabled (report by tharavel)
  • Refuse sending the password in clear (mysql_clear_password) over an unencrypted connection

  3.3.3 (Jun 2026)

  Full Changelog

  Issues Fixed

  • CONJS-350: Fixed possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charset (report by fg0x0)
  • CONJS-349: Fixed cleartext password disclosure to a man-in-the-middle when relying on certificate fingerprint validation (self-signed trust mode)
  • CONJS-351: Use constant-time comparison when validating the server certificate fingerprint token, preventing a timing side-channel that could leak the token to a man-in-the-middle
  • CONJS-353: PAM (dialog) authentication now requires a secure connection (TLS or a local unix socket), since it transmits the password in clear text (report by fg0x0)
  • CONJS-354: Reject a server-initiated LOAD DATA LOCAL INFILE request when permitLocalInfile is disabled (report by tharavel)
  • Refuse sending the password in clear (mysql_clear_password) over an unencrypted connection

  3.2.4 (Jun 2026)

  Full Changelog

  Issues Fixed

  • CONJS-350: Fixed possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charset (report by fg0x0)
  • CONJS-353: PAM (dialog) authentication now requires a secure connection (TLS or a local unix socket), since it transmits the password in clear text (report by fg0x0)

  ... (truncated)

  Commits

  • 14e0f16 [misc] Update CHANGELOG.md to include recent security fixes for PAM authentic...
  • cd00457 Merge branch 'develop'
  • f34b785 [misc] test stability: poll debug log until flushed instead of fixed wait
  • 2df7c26 [CONJS-354] Reject server-initiated LOAD DATA LOCAL INFILE when permitLocalIn...
  • 7d6e44a [misc] Cap the length of server-sent numeric strings before BigInt parsing, p...
  • 53b3042 [CONJS-353] PAM (dialog) authentication now requires a secure connection (TLS...
  • 41eec7f [CONJS-351] Implement constant-time comparison in validateFingerPrint to prev...
  • aa50c50 Update CHANGELOG.md for version 3.4.6, 3.3.3 and 3.2.4, adding fixed issues a...
  • 6c10db5 [misc] test stability correction
  • 5d5293a [misc] Refuse mysql_clear_password over an insecure connection
  • Additional commits viewable in compare view
  
  [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
  Dependabot commands and options

  
  You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/dolthub/dolt/network/alerts).
• 11614: go: sqle/dtablefunctions: defer dolt_query_diff execution to RowIter and enforce subquery auth
  Fix permission checking and planning for dolt_query_diff. With this change, permissions on tables, views, and databases referenced are verified during planning. Table rows are only fetched when the query is executed, fixing edge cases with EXPLAIN.
  • WithCatalog now calls engine.AnalyzeQuery to parse and validate permissions without instantiating rows.
  • Iterators are created only when results are requested.
  • Authorization is delegated to WithCatalog.
    Fix dolthub/dolt#10701
    Close dolthub/dolt#10822
• 11592: Say that a failed conjoin was deferred, not that something went fatal
  Reword the conjoin failure log line to say that compaction was deferred and will be retried, and add a deferred field so log consumers can classify it without parsing prose.
  Fixes #11591
  Close #11624
  Blocked by #11624
• 11449: pin the aborted-rebase state behind ErrRebaseDataConflictsCantBeResolved
  Related to #10951 — extends the existing dolt_rebase data-conflict enginetest to assert the abort that the error message promises actually happened: original branch restored, the dolt_rebase_<branch> working branch and the dolt_rebase plan table both gone, and dolt_conflicts empty.
• 11438: fix: populate dolt_statistics created_at
  Sets Statistic.Created on newly generated table-scan and index statistics so dolt_statistics.created_at reports the collection time instead of Go’s zero value, while cached statistics keep their existing timestamps.
  Fix #10168
  Close #11647

doltgresql

• 3259: Bump github.com/apache/thrift from 0.23.0 to 0.24.0
  Bumps github.com/apache/thrift from 0.23.0 to 0.24.0.
  Release notes

  Sourced from github.com/apache/thrift's releases.

  Version 0.24.0

  Please head over to the official release download source: http://thrift.apache.org/download

  The assets listed below are added by Github based on the release tag and they will therefore not match the checkums published on the Thrift project website.

  Changelog

  Sourced from github.com/apache/thrift's changelog.

  0.24.0

  Build Process

  • THRIFT-5000 - Thrift docker image publish on releases
  • THRIFT-5855 - Improve fuzzing support
  • THRIFT-5952 - Optimize MSVC Docker image to reduce size and speed up CI
  • THRIFT-5965 - Add zizmor for GitHub Actions workflows security analysis
  • THRIFT-5967 - Refactor SCA GitHub workflow for better extensibility
  • THRIFT-5973 - Automated CHANGELOG creation
  • THRIFT-6002 - Add netstd codegen test script and GitHub Actions CI matrix job (.NET 8/9/10)
  • THRIFT-6003 - Add Haxe codegen test script and GitHub Actions CI job
  • THRIFT-6077 - improve CHANGES.md generator section assignment
  • #3613 - Bump rubygems/release-gem from 1.2.0 to 1.4.0
  • #3616 - Bump ruby/setup-ruby from 1.310.0 to 1.314.0
  • #3617 - Bump rust-lang/crates-io-auth-action from 1.0.4 to 1.0.5
  • #3618 - Bump jvm from 2.3.21 to 2.4.0 in /lib/kotlin
  • #3619 - Bump com.diffplug.spotless from 8.5.1 to 8.7.0 in /lib/kotlin
  • #3615 - Bump actions/setup-go from 6.4.0 to 6.5.0
  • THRIFT-6092 - fix off-by-ten header bounds check in readHeaderFormat
  • #3593 - Bump shell-quote from 1.7.3 to 1.8.4 in /lib/js
  • #3591 - Bump shell-quote from 1.7.3 to 1.8.4 in /lib/ts
  • #3589 - Update MSVC CI to windows-2025-vs2026 runner and start Docker service explicitly
  • #3581 - Run the Haxe library unit tests (neko) in CI
  • #3576 - Bump ruby/setup-ruby from 1.306.0 to 1.310.0
  • #3575 - Bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6
  • #3577 - Bump actions/setup-dotnet from 4.3.1 to 5.2.0
  • #3574 - Bump com.diffplug.spotless from 8.4.0 to 8.5.1 in /lib/kotlin
  • #3572 - Bump org.jetbrains.kotlinx:kotlinx-coroutines-jdk8 in /lib/kotlin
  • #3578 - Harden the MSVC build workflow against transient Docker daemon unavailability
  • #3564 - Enable Copilot reviews
  • #3565 - Allow CI to fail on ruby-head
  • #3517 - Bump uuid and nyc
  • #3513 - Remove Ruby known failures from cross-test list
  • #3501 - Fix netstd CI .NET SDK setup
  • #3496 - Add generator paths to mergeable labels
  • #3430 - Updated projects settings in .asf.yaml (features, merge buttons, Jira autolinking)
  • #3487 - Update to setup-php 2.37.1
  • #3471 - Update build.yml
  • #3461 - Migration *.sln to *.slnx (except c++ libs)
  • #3454 - Fixing bundler on ruby-head build
  • #3440 - Removed deprecated 'publish' workflow
  • #3439 - Pin all actions to a specific SHA consistently
  • #3437 - Validate GitHub workflows against the ASF allowlist
  • #3433 - Pin actions/upload-artifact to a specific SHA consistently
  • #3433 - Bump actions/upload-artifact from 7.0.0 to 7.0.1
  • #3434 - Bump jvm from 2.3.20 to 2.3.21 in /lib/kotlin
  • #3423 - Bump uuid from 13.0.0 to 14.0.0
  • #3424 - Bump json from 2.18.1 to 2.19.2 in /lib/rb
  • #3404 - Cleanup Adobe Flex SDK installation following AS3 library removal

  ... (truncated)

  Commits

  • 6d2ec95 Tune make dist: drop generated/build artifacts, add missing sources
  • 4f303a2 Strip node_modules from dist to fix make dist symlink recursion
  • 270b81e Fix stale EXTRA_DIST references that broke make dist
  • c1df044 Fix Go and Rust version detection for multi-digit version numbers
  • 342a803 updated CHANGES.md
  • 0d66913 bump doap & debian changelog
  • f961cdb fix info-header string bound check in THeaderTransport::readString
  • 0ab16e3 enforce max_string_size on non-strict binary message name
  • 817e0f1 Bump rubygems/release-gem from 1.2.0 to 1.4.0
  • 6dfb0b2 THRIFT-6073: Allow injecting external SSL_CTX into C++ SSLContext
  • Additional commits viewable in compare view
  
  [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
  Dependabot commands and options

  
  You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/dolthub/doltgresql/network/alerts).
• 3256: Implement transaction-scoped advisory locks
  Implements transaction-scoped PostgreSQL advisory locks using transaction lifecycle support from dolthub/dolt#11663.
• 3254: Bump google.golang.org/grpc from 1.82.1 to 1.83.1
  Bumps google.golang.org/grpc from 1.82.1 to 1.83.1.
  Release notes

  Sourced from google.golang.org/grpc's releases.

  Release 1.83.1

  Security

  • xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)
    • Special Thanks: @​nvxbug
  • xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#9258)
    • Special Thanks: @​nvxbug
  • xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#9332)
    • Special Thanks: @​alimony
  • xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#9332)
    • Special Thanks: @​alimony
  • xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#9332)
    • Special Thanks: @​alimony

  Performance

  • transport: Restrict memory overhead of buffering small data frames. (#9331)

  Release 1.83.0

  Security

  • server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
  • xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
  • xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
  • xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
  • xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#9223)

  New Features

  • xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#9133)
  • xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#9145)
  • authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#9142)
    • Special Thanks: @​hnefatl
  • xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
    • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#9119)
  • xds: Add support for xDS-based HTTP CONNECT proxies.
    • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#9151)
  • xds: Add support for contains_match in route header matchers. (#9223)

  Bug Fixes

  • credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#9197)
  • grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#9255)
    • Special Thanks: @​Yusufihsangorgel

  Release 1.82.2

  Security

  • server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (grpc/grpc-go#9365)

  ... (truncated)

  Commits

  • 1550d9e Change version to 1.83.1 (#9336)
  • ebba6f3 Cherry-pick #9258 and #9332 into v1.83.x (#9335)
  • 8cfeca0 Cherry-pick #9331 to v1.83.x (#9333)
  • dec6951 Change version to 1.83.1-dev (#9229)
  • 4c226da Change version to 1.83.0 (#9228)
  • c198988 Cherrypick 9223 into v1.83.x (#9279)
  • 8ce3ebf Cherrypick PR 9255 into v1.83.x (#9263)
  • e393849 Cherry-pick recent changes from master (#9240)
  • 2a112a8 authz: add onPolicyUpdate callback to authz file watcher (#9142)
  • 1a80fca vet: adds a check to disallow usage of regex.Compile in xDS code (#9216)
  • Additional commits viewable in compare view
  
  [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
  Dependabot commands and options

  
  You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/dolthub/doltgresql/network/alerts).
• 3252: Support the built-in FOUND variable in plpgsql
  FOUND is declared for every function and set by the statements PostgreSQL defines as setting it: INTO clauses, bare DML, PERFORM, FOR..IN..SELECT, RETURN QUERY, and both kinds of FOR loop on exit. A FOR loop reports whether its body ran at all, which it records on its own scope rather than in FOUND, since PostgreSQL leaves FOUND alone while the loop is running. Every way of leaving a scope now routes through a single exitScope, so a loop reports FOUND and closes its cursor whether it ends normally, by EXIT, or by a labelled CONTINUE of an outer loop. A dynamic EXECUTE and a utility statement such as CREATE TABLE deliberately leave FOUND alone, so statements are classified at conversion time and the opcode that dynamic execution shares with static execution is told apart by an operation option.
• 3248: Support conditional ON CONFLICT updates
  Support the action-level WHERE clause on ON CONFLICT DO UPDATE. The predicate is evaluated against the existing and proposed rows before assignments, with false and NULL results leaving the conflicting row unchanged.
  Conditional upserts now report PostgreSQL-compatible command tags while preserving shared MySQL affected-row behavior. Coverage includes true, false, NULL, mixed multi-row, qualified predicates, bind variables, exact command tags, and final table state.
  Follow-up work is required for unconditional ON CONFLICT DO UPDATE command tags. PostgreSQL counts every executed conflict update as one row, including updates that leave values unchanged. Applying that policy to unconditional updates currently conflicts with MySQL-specific affected-row expectations in the shared enginetests, so the exact fix needs dialect-specific affected-row expectations in the test framework.
  Fixes #3235
  Depends on:
  • dolthub/vitess#483
  • dolthub/go-mysql-server#3746
• 3241: Expose vector dimensions in PostgreSQL catalogs
  Populate pg_attribute.atttypmod from stored column types and extend format_type() to render extension and user-defined types with PostgreSQL-compatible typmods, array spelling, quoting, and schema qualification.
  Adds catalog coverage for bounded and unbounded pgvector types, dimensioned arrays, views, quoted names, and shadowed schemas. The new queries were also validated unchanged against PostgreSQL 16 with pgvector.
  Fixes #3230
• 3240: Fix INSERT SELECT parameter type inference
  Treat unresolved source types in INSERT ... SELECT as PostgreSQL unknown, allowing assignment casts to use the destination column type without dereferencing a nil DoltgresType.
  Infer direct projected bind-variable OIDs from the INSERT destination for PostgreSQL-compatible Parse/Describe responses while preserving explicit client-supplied OIDs. Add extended-protocol regression coverage for inferred int4, int8, and text parameters and successful execution.
  Fixes #3234
• 3238: Fix CONTINUE statement in plpgsql FOR ... IN ... SELECT loops and integer FOR loops.
• 3237: Fix INTO semantics in plpgsql
  An INTO clause without STRICT has three behaviors that Doltgres got wrong. A query matching no rows raised instead of setting every target to NULL. A query matching several rows raised instead of keeping the first and discarding the rest. And a target had to have exactly the type the query column produced, rather than accepting anything with an assignment cast to it.
  An INTO naming several variables also assigned only the first of them, because the loop that walked the targets was indexed by row rather than by target.
  QueryRowReturn replaces the two paths that INTO used to take, so a single target and several targets are now handled the same way, and reports whether the query produced a row at all. The casting that QuerySingleReturn did inline is extracted as castQueryValue so both share it.
• 3233: Resolve SQL standard type aliases by name in the parser type table
  A schema-qualified type name such as pg_catalog.boolean reaches the PL/pgSQL interpreter as text rather than as parser input, so it can only be resolved by looking the name up in the parser's type name table, which listed almost none of the SQL standard aliases. This adds them, and normalizes whitespace within a name so that the multi-word spellings match however they happen to be written. The interpreter now maps a name it finds to the spelling the type is registered under, which also fixes bytea, bpchar and json resolving to a different type or to none.
• 3228: Minor optimization for result row batching
  Batch pgwire row metadata in result-owned chunks and normalize result format codes once per result set. This removes per-row metadata allocations without pooling or changing payload encoding. Covers text, binary, mixed-format, NULL, and short-final-batch results.
  Local sysbench runs against an isolated 24-column dataset, median text-scan latency improved 2.9% (16.25 to 15.77 ms). Mixed-type and binary results were within run-to-run variation, so no latency improvement is claimed for those workloads, due to the increase latency for binary protocol format encoding.
• 3223: Fold plpgsql identifiers the way Postgres does
  Declarations were already folded but references used the source text as written. DECLARE MyVar was unreachable as MYVAR, quoted declarations and references were poorly handled, and a trigger body could not write new/old in lowercase because TriggerCall had registered the identifiers as NEW/OLD.
  Fold variable names at reference sites in the source text, including in expression references, assignment targets, RAISE arguments and EXECUTE USING arguments. Correspondingly register lowercase names for NEW/OLD and TG_ variables.
  We needed to add variable name quoting in the two places where the engine generates SQL that mentions a variable whose declared name we already hold: the integer FOR loop's condition and increment, and the CASE temporary.
• 3222: Expand table-returning functions into columns in a FROM clause
  A function called in a FROM clause is already rewritten into a vitess.TableFuncExpr and resolved through GMS's TableFunctionWrapper, which asks sql.ExtendedTableFunction for the function's result columns. CompiledFunction answered that question with the function's OUT parameters only, so a function declared RETURNS TABLE(...) or RETURNS SETOF - which stores its result columns as the fields of a composite return type rather than as OUT parameters - reported a single column, and SELECT * FROM figures() returned one record value per row instead of one column per field.
  OutParametersSchema now falls back to the fields of a composite return type, and Eval expands each record value back into separate columns, assignment casting each field to the result type the function declares. The SELECT-list shape is unchanged: EvalRowIter keeps returning one record value per row, so it now calls the underlying overload directly rather than going through Eval.
  Also fixes a PL/pgSQL function declared RETURNS SETOF , whose RETURN QUERY results were buffered as one-field records and so failed to render in either a FROM clause or a SELECT list.
• 3212: Reject DISTINCT window aggregates
  Match PostgreSQL by rejecting DISTINCT window aggregates with SQLSTATE 0A000 after resolving the exact function overload, instead of silently ignoring DISTINCT. Preserve PostgreSQL scalar-function diagnostics, including user-defined and schema-qualified name collisions.
  Depends on: go-mysql-server #3732
• 3155: Support DROP TABLE ... CASCADE and RESTRICT
  Reworks DROP TABLE ... CASCADE to reuse the standard DROP TABLE plan node, with the pre-execution hook dropping dependent objects (views, foreign keys, row-type columns, and functions/procedures) at execution time.
  Fixes #3120.
  Companion PRs:
  • dolthub/vitess: dolthub/vitess#482
  • dolthub/go-mysql-server: dolthub/go-mysql-server#3745
• 3154: Support ALTER TABLE ... ALTER COLUMN ... TYPE ... USING
  Adds support for ALTER TABLE ... ALTER COLUMN ... TYPE ... USING .
  Fixes #3119.
• 3153: Fix boolean output of dolt system table columns
  Boolean columns of dolt system tables (e.g. dolt.branches.dirty) are now sent over the wire as booleans in text format.
  Fixes #3116.
• 3152: Support implicit lateral joins for set-returning functions in FROM
  Set-returning functions in the FROM list can now reference columns of preceding tables (implicit and explicit LATERAL joins).
  Fixes #3112.
• 3151: Fix max1Row error for set-returning functions over point lookups
  Fixes a "result max1Row iterator returned more than one row" error when a set-returning function is projected over a unique-index point lookup.
  Fixes #3111.
  Companion PR: dolthub/go-mysql-server#3741
• 3150: Fix pg_index per-column vectors to have one entry per key column
  Fixes pg_index per-column vectors (indoption, indcollation, indclass) to have one entry per key column, and populates indnkeyatts.
  Fixes #3110.
• 3101: SET LOCAL support
  This PR adds support for transaction-scoped session vars via SET LOCAL.
  Companion PR: dolthub/go-mysql-server#3704

go-mysql-server

• 3748: sql.ValueRows: Correctly handle NULLs in comparisons.

  This fixes a correctness issue running a query against a Dolt MySQL server:
  The test currently passes prior to this PR. This is because the test harness needs to be updated to more accurately reflect running against a Dolt MySQL server, but this currently causes other tests to fail. Instead, this change was tested locally to with the new test harness, and I confirmed that this PR fixes some of the failing tests and does not introduce any new failures.

• 3747: sql.ValueRows: Correctly handle filter expressions that aren't bools

  This fixes a correctness issue running the following queries from TestQueries against a Dolt MySQL server:

  SELECT i,v from stringandtable WHERE i
  SELECT i,v from stringandtable WHERE v
  SELECT i FROM mytable WHERE NULL > 10;
  SELECT i FROM mytable WHERE NULL IN (10);
  SELECT i FROM mytable WHERE NULL IN (NULL, NULL);
  SELECT i FROM mytable WHERE NOT NULL NOT IN (NULL);
  SELECT i FROM mytable WHERE NOT (NULL) <> 10;
  SELECT i FROM mytable WHERE NOT NULL <> NULL;
  

  There are no test changes because the test harness needs to be updated for every query test at once, once every test passes. I ran the new test harness locally and confirmed that this PR fixes some of the failing tests and does not introduce any new failures.

• 3746: Support conditional duplicate updates
  Adds support for conditionally applying duplicate-key updates, as required by PostgreSQL’s ON CONFLICT DO UPDATE ... WHERE.
  When an insert conflicts with an existing row, the optional condition is evaluated against the existing and proposed rows. A false condition skips that row; a true condition applies the update. The change also supports returning the updated row and lets PostgreSQL count a duplicate update as one affected row without changing MySQL’s default behavior.
  Tests cover conditional updates, RETURNING, affected-row counts, and a batch of 100,000 filtered conflicts.
  Supports dolthub/doltgresql#3235.
  Depends on: dolthub/vitess#483

• 3745: Plumb DROP TABLE ... CASCADE through to plan.DropTable
  Adds a Cascade flag to plan.DropTable (populated from the vitess AST) so that integrator pre-execution hooks can implement dialect-specific cascade semantics; the engine itself does not act on it.
  Companion PRs:

  • dolthub/vitess: dolthub/vitess#482
  • dolthub/doltgresql: #3155

• 3744: sql/mysql_db: Make OverwriteUsersAndGrantsData leave ephemeral users in place.
  Ephemeral users are part of in-memory process-local state, and any functionally equivalent users are not included in the persisted payload coming in for OverwriteUsersAndGrantsData. This allows Dolt CLI access to retain access through dolt_local_user even when cluster replication replicates users and grants to a replica.

• 3742: Avoid redundant window output sort
  Window execution currently performs a second stable sort after evaluating results solely to restore input order, even though each result already carries its original row ordinal.
  Place results directly at their original ordinals and compact empty positions for grouped windows. This changes output restoration from O(n log n) to O(n) while preserving row order and grouped output cardinality.
  A temporary 1,000-row ROW_NUMBER benchmark matching the reported query shape improved from approximately 1.03 ms/op to 0.76 ms/op on an Apple M1 Max, about 25%. Allocations changed from 10,041 to 10,038 per operation.
  Fixes dolthub/dolt#11626

• 3741: Don't re-evaluate set-returning expressions in the final projection
  When a select alias is materialized in an inner projection (e.g. so an ORDER BY can reference it), the final projection re-evaluated the alias expression. For expressions that return a RowIter (set-returning functions), the inner projection has already expanded the rows, so re-evaluation multiplied them again and clobbered the sort order. The final projection now references the expanded column instead.
  There's an engine test with a synthetic function, but most testing lives in Doltgres. Companion PR:
  #3151

• 3740: Convert LOAD_FILE filename to text type
  Fixes dolthub/dolt#11564
  Casting filename to string was causing a panic when it was not a string type. Using TypeAwareConversion first is much safer and prevents the panic.

• 3739: Fix HAVING aggregate alias resolution
  Resolve HAVING aggregate inputs using their full table qualifiers so joins with duplicate column names do not bind the wrong source.
  Fixes dolthub/dolt#11627

• 3738: Don't set the max1Row query flag for plans containing RowIter exprs
  Set-returning functions multiply output rows, so a strict index lookup no longer guarantees at most one result row when the plan contains one.
  See #3151

• 3737: Preserve LEFT JOIN semantics for lateral joins with no join filters
  A LEFT JOIN LATERAL with a trivially true condition (e.g. ON true) had its filter simplified away, and the memo exec builder then rebuilt every filterless lateral join as a lateral cross join incorrectly.

• 3735: handle parenthesized select with trailing order by and limit
  Enable planning engine to evaluate parenthesized query expressions in CREATE TABLE ... AS (SELECT ....) with optional modifiers.

  • Apply trailing ORDER BY and LIMIT clauses in buildSelectStmt.
  • Add shared buildLimitAndOffset helper.
    Fix dolthub/dolt#11620
    Blocked by dolthub/vitess#481

• 3732: Validate DISTINCT windows after function resolution
  Add an optional validation hook for engine-specific DISTINCT window-function behavior after the exact function overload has been resolved. This lets consumers enforce their compatibility policy without changing native MySQL behavior.

• 3730: Return an error for a bind variable in an AS OF clause
  An unresolved bind variable in an AS OF clause caused the query planner to evaluate a nil expression, triggering a panic instead of returning a SQL error. This change detects that case and returns ErrInvalidAsOfExpression, preventing callers from hanging during transaction cleanup.
  Now, the bigger question if this PR should be accepted or not, si that this can silently return the current db state when "AS OF" cannot be resolved. Not sure if semantically this is acceptable or not.
  Other paths, notably SHOW TABLES and CALL, allow an unresolved AS OF placeholder during the initial prepare pass and bind it on execution. This change intentionally leaves those paths unchanged.

• 3724: Added extended vector support
  This adds support for extended vector operations, to primarily be used by integrators

• 3704: transaction-scoped session var support
  MySQL has no concept of these, but Postgres does.

vitess

• 483: Add conditional duplicate update metadata
  Add insert AST metadata for a duplicate-update predicate and single-row affected-count semantics. This lets PostgreSQL dialect translation carry ON CONFLICT DO UPDATE ... WHERE behavior through the shared parser boundary.
  Adds formatting and AST-walk coverage for the predicate.
  Supports dolthub/doltgresql#3235.
• 482: Add Cascade field to DDL for DROP statements
  Adds a Cascade field to the DDL AST node for DROP statements, which the MySQL grammar never sets (MySQL parses but ignores CASCADE) but integrators with real CASCADE semantics can set when constructing statements.
  Companion PRs:
  • dolthub/go-mysql-server: dolthub/go-mysql-server#3745
  • dolthub/doltgresql: #3155
• 481: support parenthesized select in create table as select (CTAS)
  Allow CREATE TABLE ... AS statements to accept queries enclosed in parentheses. Data tools can emit this syntax, such as dbt (data transformation tool).
  • sql.y: Extract paren_select rule to parse (SELECT ...).
  • sql.y: Add paren_select as a production for the create_query_expression rule.
  • ast.go: Implement missing methods and fields on the ParenSelect struct to store ORDER BY, LIMIT, WITH and FOR UPDATE (locking).
  • ast.go: Add shared newLock helper.
    Fix dolthub/dolt#11620
    Block dolthub/go-mysql-server#3735
• 480: parse N as integer only for window functions

Closed Issues

• 3235: ON CONFLICT ... DO UPDATE ... WHERE (conditional upsert) is rejected as unsupported
• 3120: DROP TABLE CASCADE support
• 3230: vector(N) columns enforce dimensions but expose atttypmod = -1 and format_type = '???'
• 3231: JSONB values are returned as Python strings through psycopg-backed raw cursors
• 3110: pg_index missing indoption data
• 3246: Projected set-returning functions duplicate results for multi-row IN lookups
• 3111: unnest and other set-returning functions incompatible with max1Row iterator
• 3112: implicit lateral join for set-returning functions
• 3234: Server panic (nil DoltgresType) on INSERT ... SELECT $1 with uncast bind parameters
• 3014: dolthub/doltgresql image: CREATE EXTENSION fails with exec: "pg_config": executable file not found in $PATH
• 3116: dolt.branches.dirty does not have boolean output
• 3119: ALTER TABLE .. USING support
• 11638: Wrong results: a scalar subquery's aggregate returns the OUTER query's aggregate when both use the same aggregate expression on the same table
• 11412: Dolt returns a negative value for ABS(-9223372036854775808).
• 11547: Dolt rejects a legal REGEXP_REPLACE position after the source
• 11507: CRC32 rejects a legal binary value produced by a window
• 11648: git-remote: dolt_remote_info under refs/heads/ makes concurrent git fetch fail with "incorrect old value provided"
• 11509: STR_TO_DATE() errors instead of propagating NULL
• 11589: Incorrect NULL filtering with nullable projection and ORDER BY
• 11658: sql-server logs expected idle-connection reaps at ERROR (6565 lines/day on a healthy server)
• 11468: Dolt panics when FIRST_VALUE receives the star placeholder
• 11469: Legal BIT(2) RANGE following frame panics
• 11641: AdaptiveValue decode paths panic in hash.New on a malformed out-of-band address instead of returning an error
• 11639: Cluster standby: dolt sql fails with Access denied for user '__dolt_local_user__' after users/grants replication
• 10856: Error when LateBindQueryist fails to connect to the running sql-server noted in sql-server.info is confusing
• 10168: dolt_statistics.created_at is always 0001-01-01 00:00:00
• 11626: Window-function CTE query is 2.2x slower than MySQL
• 11627: Second reference to a CTE fails with table not found for its alias
• 11564: Dolt panics when LOAD_FILE receives a numeric argument below a window
• 11591: Conjoin failure logs git's fatal auth text on a push that succeeded
• 11620: Dolt - ctas statement raises Syntax Error if 'as' subquery is wrapped in parens
• 10701: DOLT_QUERY_DIFF: Scope privilege checks to tables referenced in queries