Release 3.4.2.2 · taosdata/TDengine

Release date: 2026-07-22

Release type	Recommended for
Feature release	Users of federated query, window functions, stream processing, or virtual tables

1. Highlights

Federated query: External data sources can be queried through virtual tables, and a stream task can run a federated query. MySQL, PostgreSQL, and InfluxDB v3 are supported. The feature is off by default.
Query: Window functions and the OVER clause, aggregate DISTINCT, windows aligned to calendar time units, multi-column state windows, and TEXT / FILE inline data sources are added.
Timezone: A connection-level timezone is added, with IANA timezones and daylight saving time.
Virtual tables: A virtual super table can inherit another. Ordinary columns and tag columns of a virtual child table can reference other tables.
Stream processing: ROLLUP BY summarizes by tag hierarchy. true_for of an event window can set the start condition and the end condition separately.
Connections and security: The C, Go, Python, and Node.js WebSocket connectors support taosAdapter high availability. Several memory-safety issues that could crash taosd are fixed.

2. Features

2.1 Federated query and virtual tables

Federated query based on virtual tables is supported. External data sources are MySQL, PostgreSQL, and InfluxDB v3. Both the client and the server federatedQueryEnable must be on before use. The default is off. See Federated Query.
A stream task can run a federated query.
A virtual super table can inherit another virtual super table. See Virtual Supertable Inheritance.
An ordinary column of a virtual child table can reference another virtual child table.
A tag column of a virtual child table can reference a physical child table and another virtual child table.

2.2 SQL and query

Window functions and the OVER clause are supported. See Window Functions.
Aggregate functions support DISTINCT, for example COUNT(DISTINCT col).
TEXT and FILE inline data sources are added. Row values or a CSV file can be used directly in FROM without creating a table, and they can take part in SELECT, JOIN, UNION, and INSERT INTO SELECT. See TEXT Inline Data Source and FILE CSV Data Source.
Windows split by calendar time units are added. A window aligns to a local calendar boundary: calendar day, week, month, quarter, or year. The quarter unit q is added. See INTERVAL Queries.
A connection-level timezone is added, with IANA timezone names and daylight saving time. See Timezone.
A state window supports several state columns. See State Window.
An external window supports FILL. See External Window.
A window query can use original columns, tag columns, scalar functions, and variable-row functions.
A window query can use CSUM, DIFF, DERIVATIVE, MAVG, STATECOUNT, STATEDURATION, LAG, LEAD, and FILL_FORWARD, together with INTERVAL + FILL (NULL / NONE / VALUE / NULL_F / VALUE_F).
REGEXP_EXTRACT is added. See REGEXP_EXTRACT.
SLEEP is added to simulate a timeout in tests.
GREATEST / LEAST can skip NULL through ignoreNullInGreatest. The default does not skip NULL.
DIFF, CSUM, MAVG, STATECOUNT, LAG, LEAD, FILL_FORWARD, and UNIQUE can run when there is no time column.

2.3 Stream processing

A stream trigger adds ROLLUP BY tag_name, which summarizes by tag hierarchy. See Trigger Grouping.
true_for of an event window can set the start condition and the end condition separately.
SHOW STREAMS can name a database and match stream names with LIKE.

2.4 Metadata and cluster operations

Metadata updates of super tables, child tables, and virtual tables support transactions.
CPU affinity binding is supported and is off by default. See CPU Affinity.
A specified vnode can be turned off temporarily at runtime.
taosd -r adds --vnode to name the vnode to repair.
The data-repair tool adds a copy-repair mode.
snapshotRateLimit is added. It limits the snapshot-send bandwidth of each dnode. The default is 0, which means no limit.
retryOnOverloadBaseInterval and retryOnOverloadTimeout control client retry when the server is overloaded. The defaults are 1000 milliseconds and 60000 milliseconds.

2.5 Connectors

The C, Go, Python, and Node.js WebSocket connectors support taosAdapter high availability. The client parameter is adapterHa, default false.

2.6 taosX

Data can be exported as Parquet files.
DataOut can export data to Kafka.
An OPC UA data source can collect alarms and events (Alarm & Events).
Specified tables can be backed up and restored.

2.7 Platform support

Windows supports MQTT subscription.
Windows supports UDF.

2.8 Tools

taosdump can export the statement that created a stream.

3. Enhancements

3.1 Query

INTERP interpolation queries are faster.
A subquery ordered by the primary-key column runs more efficiently.
While scanning a subquery, the intersection of the subquery time range and the outer query time range is used, so less data is scanned.
A subquery, UNION ALL, and a multi-level nested query automatically choose a TIMESTAMP column in the result set as the timeline column.
Metadata fetch and parse of a federated query are improved.

3.2 Stream processing

COUNT_WINDOW(N, 1) supports historical recalculation.
Stream processing supports cross-table references and tag references on virtual tables.
Aggregate queries on a virtual super table run more efficiently.
Stream startup is faster when the group count is between 500,000 and 1,000,000.

3.3 Storage and cluster

A multi-replica snapshot transfers files on demand, so recovery is faster.
After serverPort changes, the internal port used by data subscription is updated automatically.
The error is clearer when creating a TSMA fails because there is no snode.
RPC transport options on Windows are adjusted for higher performance.

3.4 Tools

taosdump backup speed, restore speed, and backup-file compression ratio are higher. An old backup file can be restored by the new version.
The prompt is clearer when the password entered with taosdump -p is wrong.
taosExplorer handles batch CSV upload and database import better.
taosExplorer shows database objects in a tree more clearly.

3.5 taosX

While ingesting pspace, a long point name can be split on / into child tags. The original long-name tag is kept, and a name variable is provided.
Synchronizing InfluxDB data is faster in a high-cardinality scenario.

4. Fixes

4.1 Severe issues

The following issues made the service unavailable or returned wrong data.

Scanning information_schema.ins_tags and resolving a virtual-table tag reference deadlocked taosd. Affected versions: v3.4.2.0 and v3.4.2.1.
A query entered an infinite loop when the start time of INTERVAL AUTO was INT_MAX. Affected versions: v3.3.5.0 through v3.4.1.17. The syntax was introduced in v3.3.5.0. It is fixed from v3.4.1.18 and from v3.4.2.0.
taosd crashed when stream processing failed to initialize the table list. Affected versions: v3.3.7.0 through v3.4.1.17.
Compressing or decompressing a single row crashed the process. Affected versions: v3.4.1.16 and earlier.
Binding and executing again after an asynchronous STMT write reported an error crashed the process. Affected versions: v3.3.3.0 through v3.4.1.16. The v3.3.6 patches from v3.3.6.53 onward are fixed.
On Windows, concurrent queries that used temporary files collided on file names, read the wrong data, and crashed. Affected versions: v3.4.1.17 and earlier.
A scheduled incremental backup in taosX occasionally missed data. Affected versions: all versions. The v3.3.6 patches from v3.3.6.52 onward, the v3.4.1 patches from v3.4.1.15 onward, and versions from v3.4.2.0 onward are fixed.
While taosX consumed Kafka for historical backfill, data earlier than the keep1 window was dropped. Affected versions: all versions. The v3.3.6 patches from v3.3.6.54 onward, the v3.4.1 patches from v3.4.1.19 onward, and versions from v3.4.2.1 onward are fixed.
After a taosX worker thread exited, resources were not released, and the XNode eventually became unavailable. Affected versions: from v3.4.0.0 until the fix in this release.
User tokens were not synchronized in time among a three-replica mnode. A newly created XNode failed authentication and stayed offline. Affected versions: v3.3.6.49 and later versions in that series, all of v3.4.0, v3.4.1.0 through v3.4.1.18, and v3.4.2.0 and v3.4.2.1. v3.3.7 has no user token.
After the IP allowlist was turned on at runtime, the dnode's own FQDN was not on the list, so cluster nodes could not log in. Affected versions: v3.1.1.46 through v3.4.1.14. The v3.3.6 patches from v3.3.6.52 onward are fixed.

4.2 Query

After the underlying super-table schema changed, a virtual table reported a column-order mismatch.
With BI mode on, LAST(), FIRST(), and LAST_ROW(*) on a virtual super table did not return the tbname column.
LEFT ASOF JOIN together with DIFF failed when the intermediate result exceeded 65535 rows.
Using TIMETRUNCATE in a JOIN converted timezones of the left and right tables inconsistently, so the result was wrong.
Querying information_schema.ins_tables, the group key such as stable_name was empty when COUNT was used with PARTITION BY or GROUP BY.

4.3 Stream processing

An event notification failed to send when INTO was not used.
When one trigger produced several windows, a scalar subquery used with a window pseudo column produced no output.
The WHERE filter of a notification was judged incorrectly, so the pushed result did not match expectations.
After a fill_history threshold was configured, writing data earlier than the threshold into an empty table still triggered historical backfill.

4.4 Writes and connectors

A parameter-bound STMT execution of a SELECT with INTERVAL blocked.
A schemaless write reported Invalid schema version.
An ODBC write failure returned no error message.
An illegal NCHAR written through TMQ or a raw block was not checked, and a later column filter on an ordinary table failed.

4.5 Data subscription

After a child-table tag was changed or a child table was dropped, the subscription filter result was wrong. Historical writes of a dropped child table in the WAL can be parsed normally.

4.6 taosX

A dual-active task stopped abnormally when it met an empty connection.
Backup to S3 or restore from S3 failed.
A failed backup task could not be deleted.
After a backup task was configured successfully, it did not appear in taosExplorer.
During data migration, a different tag order between the source database and the target database caused a write error.
When a Kafka data source configured several transform rules, a wrong sequence number left some fields empty.
The Dataset Filter configuration of PI Connector was abnormal.
The CSV downloaded by PI Connector was wrong when points were filtered by element.
PI Connector treated Int16 as Int32.

4.7 taosExplorer

An ordinary table could not be displayed.
User grants still used the old privilege syntax, so a grant statement reported an error.
The scrollbar on a table page could not be dragged.

5. Security

5.1 Vulnerability fixes

See the security advisories.

GHSA-vxcq-cqrc-f8j3: a double-free during SQL parsing can crash taosd. Affected versions: v3.2.3.8 through v3.4.1.14.
GHSA-v8cj-fw82-9jjf: a use-after-free or double-free during subquery processing can crash taosd. Affected versions: v3.4.1.0 through v3.4.1.14.
GHSA-f8pf-77fh-53wv: a double-free during projection can crash taosd. Affected versions: v3.0.0.0 through v3.4.1.14.
CVE-2025-58050: the PCRE2 dependency has a security vulnerability and has been upgraded to 10.47. Affected versions: v3.4.1.17 and earlier. The PCRE2 bundled with those versions is 10.45 or lower.
Privilege checks failed during automatic table creation, so a user could create a child table without privilege. Affected versions: v3.4.1.14 and earlier. The v3.3.6 patches from v3.3.6.52 onward are fixed.
A crafted RPC message could cause a denial of service. Message-length checks are stronger. Affected versions: v3.4.1.14 and earlier.
A key update took effect only on the mnode leader. Other nodes still used the old key. Affected versions: v3.4.1.16 and earlier.

5.2 Hardening

RPC communication adds authentication so the content is not sent in clear text.
After a password change, connections established with the old password are closed.
Temporary files spilled by a query are stored encrypted.
UDF file-path checks are stronger.
String-terminator checks are stronger.

6. Upgrade notes

6.1 Upgrade path

Source versions that support a direct upgrade: v3.3.7 and later
Rolling upgrade: supported, from v3.4.2.0 through v3.4.2.2
Downgrade or rollback: supported, from v3.4.2.0 through v3.4.2.2
Minimum matching client and connector version: v3.4.2.0

6.2 Behavior changes

RPC communication adds authentication so the content is not sent in clear text. A client and a server from an earlier version cannot communicate.
After a password change, connections established with the old password are closed, and later requests return an authentication failure. An application that uses a connection pool must update the configuration after the password change and rebuild the pool.
When an ordinary user writes a table that does not exist and has no wildcard privilege, the error changes from Permission denied or the target object does not exist to Table does not exist. An application that branches on the error text or error code needs to be adjusted.
A connection-level timezone is added. The precedence is SQL parameter, connection, then global configuration. When no connection-level setting is made, server-side calculation still falls back to the server global timezone. From this release, reading an ordinary column uses the connection timezone.
Temporary files spilled by a query are stored encrypted. Queries with a large result have a slight performance impact.
The output of USE on macOS changes to Database changed., matching Linux. A script that parses taos shell output needs to follow the new output.
ignoreNullInGreatest controls whether GREATEST / LEAST skips NULL. The default is 0: if any argument is NULL, the result is NULL, so existing query results do not change. Set it to 1 to skip NULL.

6.3 Configuration changes

6.3.1 License

Parameter	Purpose
`clsEnabled`	Whether the cluster license service is enabled. Default `0`, off
`clsUrl`	License service address. Default empty string
`clsLicenseId`	License ID. Default empty string
`clsQuotaSlotId`	Quota slot ID. Default empty string
`clsRefreshInterval`	License refresh interval. Default `3600` seconds

6.3.2 CPU affinity

Parameter	Purpose
`enableCpuAffinity`	Master switch. Default `0`. `0`: off; `1`: bind CPUs for management, read, and write
`managementCpuCores`	CPU cores used by management threads. Default `1`
`readCpuCores`	CPU cores used by read threads. Default is half of the remaining cores
`otherCpuCores`	CPU cores used by write threads. Default is the other half of the remaining cores

6.3.3 Federated query

Parameter	Purpose
`federatedQueryEnable`	Whether federated query is enabled. Default `false`
`federatedQueryConnectTimeoutMs`	Timeout, in milliseconds, for connecting to an external data source. Default `5000`
`federatedQueryQueryTimeoutMs`	Timeout, in milliseconds, for running an external query. Default `1000000000`. When it equals the maximum, there is no time limit
`federatedQueryMaxPoolSizePerSource`	Maximum connection pool of one data source. Default `64`
`federatedQueryIdleConnTtlSec`	Idle connection lifetime, in seconds. Default `600`
`federatedQueryProbeTimeoutMs`	Probe timeout, in milliseconds. Default `5000`. Not implemented yet

6.3.4 Authentication and security

Parameter	Purpose
`authMech`	Client authentication method: `auto`, `scram`, or `legacy`. Default `legacy`
`forceScram`	Force SCRAM and disable the legacy fallback. Off by default

6.3.5 Overload retry

Parameter	Purpose
`retryOnOverloadBaseInterval`	Initial client retry interval, in milliseconds, when the server is overloaded. Later retries use exponential backoff. Default `1000`
`retryOnOverloadTimeout`	Maximum total client retry time, in milliseconds, when the server is overloaded. Default `60000`

6.3.6 Synchronization

Parameter	Purpose
`snapshotRateLimit`	Upper limit, in MB/s, of snapshot-send bandwidth per dnode. Default `0`, which means no limit
`syncNegotiationWin`	Synchronization negotiation window size. Default `512`
`syncAssignedCheckAppliedGap`	Under two replicas, the apply-gap threshold checked before an assigned leader steps down. Default `20`. `0` means no check
`snapSendPullupInterval`	Snapshot-send pullup interval, in seconds. Default `10`

6.3.7 Other

Parameter	Purpose
`firstDayOfWeek`	First day of the week. Encoding `0` is Sunday through `6` is Saturday. When unset, the operating-system setting is read. If that read fails, the value is `4`
`ignoreNullInGreatest`	Whether `GREATEST` / `LEAST` skips NULL. Default `0`. `0`: if any argument is NULL, return NULL; `1`: skip NULL
`txnTimeout`	mnode transaction timeout, in seconds. Default `300`
`walCorruptionBackupDir`	Backup directory used when the WAL is damaged. Default empty string, which means a timestamped subdirectory is created under the WAL path

6.3.8 Removals and changes

Previous parameter	Description
`cacheLazyLoadThreshold`	Removed.
`queryBufferSize`	Removed. The replacement is `queryBufferPoolSize`.
`encryptPassAlgorithm`	Renamed to `encryptAlgorithm`. The old name no longer takes effect. Configuration must use the new name

6.4 Keyword changes

This section lists 39 keywords. When one of these words is used as a database, table, super table, child table, column, or tag name, quote it with backticks ` regardless of case, for example `BEGIN`.

6.4.1 Window-frame clause

OVER, CURRENT, ROW, ROWS, PRECEDING, FOLLOWING, UNBOUNDED, used by window-frame syntax.

6.4.2 State-window extensions

EXTEND, ZEROTH_STATE, NO_ZEROTH, used by state-window extension and the initial-state definition.

6.4.3 Window mode

SCALAR, AGG, for a scalar window and an aggregate window.

6.4.4 Federated-query DDL

EXTERNAL, SOURCE, SOURCES, REFRESH, OPTIONS, SCHEMA, TYPE, PASSWORD.

6.4.5 Transaction control

BEGIN, COMMIT, ROLLBACK, used by explicit transaction statements.

6.4.6 Manual vnode switch

OPEN, CLOSE, used by OPEN VNODE and CLOSE VNODE.

6.4.7 Virtual-table BASE ON and SERIES

BASE, REMOVE, SERIES, used by virtual-table BASE ON and InfluxDB Series migration.

6.4.8 Security policy

SECURITY_LEVEL, SECURITY_POLICIES.

6.4.9 SHOW extensions

CPU_ALLOCATION, ORPHANS, INHERITS.

6.4.10 Other

FIRST_DAY_OF_WEEK, TEXT (inline text table), PARALLEL (ALTER DATABASE parallelism), API_TOKEN, SMALLDATA_SCAN_SORT (hint), _TROLLUP_TBCOUNT (pseudo column).

6.5 System table changes

Ten tables are added. No table is removed. Five existing tables add columns.

6.5.1 New tables

ins_cpu_allocation: CPU allocation of threads on each dnode
ins_ext_sources: registered external data sources (federated query)
ins_security_policies: security-policy definitions
ins_snap_send_vnodes: snapshot-replication progress by vnode
ins_snap_send_filesets: snapshot-replication detail by fileset
ins_table_fixed_distributed: table data-block distribution statistics, replacing ins_table_distributed, which has been unavailable for a long time
ins_transactions: transaction information
ins_transaction_logs: historical logs of finished transactions
ins_transaction_orphans: orphan-transaction detection
ins_vstable_inherits: virtual-super-table inheritance

6.5.2 New columns on existing tables

ins_databases: adds sec_level, the database security level
ins_stables: adds sec_level, the super-table security level
ins_users and ins_users_full: add sec_levels, the security levels a user can access
ins_virtual_child_columns: adds col_type, the type code of a virtual child-table column

6.5.3 Removed tables

None.

6.6 Dependency changes

Component	Dependency	v3.4.1.13	v3.4.2.2
Server	PCRE2	10.45	10.47
taosX	quinn-proto	0.11.14	0.11.15
Python WebSocket connector	rustls-webpki	0.103.12	0.103.13
JDBC connector	taos-jdbcdriver	3.8.3	3.9.0
JDBC connector	jackson	2.21.1	2.22.0
JDBC connector	netty	4.2.13.Final	4.2.15.Final

6.7 Before you upgrade

Stream processing was redesigned after v3.3.6.0. Before upgrading from v3.3.6 or earlier to this release, the old stream objects must be removed and then rebuilt on the new version. If these steps are skipped, taosd fails to start.

Do the following in order before the upgrade:

Drop every stream task. DROP STREAM drops the task and does not drop result data already written. Use SHOW STREAMS first to list the tasks.
Drop every TSMA: DROP TSMA [db_name.]tsma_name. The TSMA result super table is dropped with the TSMA.
Drop every snode: DROP SNODE ON DNODE dnode_id. The snode and its replicas must be online, or the drop fails.
Delete the snode directories:
- the snode directory under dataDir, by default /var/lib/taos/snode
- the directory named by checkpointBackupDir, by default /var/lib/taos/backup/checkpoint/
Drop every stream result table (optional).

After the upgrade, deploy the new snodes, then recreate the streams with the new syntax.

7. Known issues