Release 3.4.3.3 · taosdata/TDengine

Release date: 2026-10-18

Release type	Recommended for
Feature release	Users of stream processing, virtual tables, joins, or federated query, and users who need the security fixes in this release

1. Highlights

Layered stream rules and cross-source results: One stream rolls results up along a device path, from line to workshop to plant. Event windows support multi-level start conditions and nested windows, and settle on natural months, quarters, and years in the stream's own time zone. External work orders and quality tables can drive a stream. Runtime status is visible in system tables, taosExplorer, and TDinsight. Alert notifications are sent asynchronously, and the stream keeps producing after a leader change or a virtual-table reference change.
Virtual-table inheritance and cross-layer references: A virtual super table can inherit columns and tags from a parent model, and columns and tags can reference other virtual tables layer by layer. A virtual child table can add its own columns and tags, and virtual tables can be created or dropped in batches. External columns can be filtered before time alignment. One table can reference databases of different time precision. A broken reference names the failed object and the full chain.
Joins and subqueries: An ordinary JOIN can match on business columns, ranges, or combined conditions without a primary-timestamp equality. It can appear in the same SQL statement as ASOF JOIN and WINDOW JOIN, and either side can be a subquery or a virtual table. A scalar subquery can use the current outer row. A window query can return original columns and sequence results. TEXT and FILE can be queried directly.
Federated query: One SQL statement can query MySQL, PostgreSQL, InfluxDB, and local data together. Windows, aggregates, and INTERVAL can be pushed down to the external source. The feature is off by default and must be enabled explicitly.
Security fixes: Malformed input that could crash the server or access memory out of bounds is rejected, and known vulnerabilities in the sync module are fixed. The Grafana data-source plugin fixes 30 dependency vulnerabilities. DSNs in XNode tasks and jobs can be shown in encrypted form.

2. Features

2.1 Query

ASOF JOIN and WINDOW JOIN accept a virtual table or a subquery as input. WINDOW JOIN can name the time columns on both sides with WINDOW_TIME.
An ordinary JOIN can be nested with ASOF JOIN and WINDOW JOIN in the order given by SQL parentheses and join associativity. Stream queries support the same nesting.
An equality JOIN uses Hash Join when the inputs are unordered. Inputs already ordered by the join key still use Merge Join. A stable order requires ORDER BY.
Scalar correlated subqueries are supported. No matching row yields NULL. More than one row or column is an error.
DELETE WHERE can filter on ordinary columns and combine them with a time range and tag conditions using AND. Composite primary keys, SECURE_DELETE, and OR across time, tag, and ordinary-column conditions remain unsupported.
BIT_CHANGES, VALUE_CHANGES, and the time-weighted aggregates TWAVG, TWSUM, and TWVAR are available in queries and stream processing.
CSUM(expr) OVER (PARTITION BY ... ORDER BY ...) keeps a running sum for every row, by partition and the specified order.
Exact PERCENTILE is supported on single-source virtual child tables and virtual normal tables.
External windows support DIFF, CSUM, MAVG, LAG, LEAD, TOP, BOTTOM, SAMPLE, and HISTOGRAM. The rules match other time windows. See External Window.
SHOW TABLE DISTRIBUTED on a super table sums the compressed data-block size of all its child tables across vnodes. The same figures are available from INS_TABLE_FIXED_DISTRIBUTED. The total includes only data-file blocks.
External sources can be registered with CREATE EXTERNAL SOURCE. See Federated Query.
The Spark JDBC dialect com.taosdata.spark:TDengine-spark-dialect:1.0.0 lets PySpark access TDengine over WebSocket after it is registered.

2.2 Stream processing and virtual tables

Stream processing supports nested mixes of INNER JOIN and LEFT JOIN.
A stream can use a virtual table that references MySQL, PostgreSQL, or InfluxDB columns as its trigger table, mix those columns with local columns, and merge rows by timestamp. FILL_HISTORY and FILL_HISTORY_FIRST are not yet supported for such streams.
STREAM_OPTIONS(CONFIG) can freeze the time zone and the first day of the week, including natural quarters.
Stream processing supports multi-level nested child events.
A virtual child table can add its own columns and tags with CREATE VTABLE and ALTER VTABLE.
Tags of normal tables and virtual normal tables can be tag-ref sources for virtual tables, including chained references.
A virtual table can filter MySQL or PostgreSQL external columns with WHERE.
A virtual table can reference tables in millisecond, microsecond, and nanosecond databases. Query timestamps are converted automatically.
ALTER STABLE RENAME COLUMN renames a data column of a super table or a virtual super table. ALTER TABLE ... RENAME TAG renames a tag of a normal table or a virtual normal table.

2.3 Backup, XNode, and writes

Cluster-level and database-level full backup and offline restore cover mnode, snode, and vnode data, including stream checkpoints. CREATE FULL BACKUP, SHOW BACKUPS, KILL BACKUP, and taosd --restore are added. Incremental backup and backup of one database are not implemented in this release.
RESTART XNODE restarts xnoded on the node that holds the current mnode leader.
XNode DSN protection can be enabled. Sensitive fields in SHOW XNODE TASKS and SHOW XNODE JOBS are shown as ******, and runtime delivery uses envelope encryption. Submitting ****** in ALTER keeps the stored value.
taosX adds the archive subcommand to inspect and export archive and cache files.
A MySQL taosX source can keep a persistent checkpoint for a task-level job (job_id=-1). After double-vertical-bar string concatenation and storage-engine substitution are turned off, data can be synchronized from Apache Doris over the MySQL protocol.
taosExplorer can configure taosX -T transforms, such as super-table and child-table rename and mapping.
JDBC WebSocket connections add stmtCacheSize to cache prepared statements. The default is 5, efficient-write mode defaults to 2, and 0 turns the cache off.
taosAdapter supports the InfluxDB 1.x ping API. Compatible clients can check availability with GET or HEAD /influxdb/v1/ping.
taosgen provides a gRPC ingress. An external program pushes normalized rows, and STMT2 batches them into writes.
Secondary compression can load a pluggable hardware-accelerated zlib, zstd, or lz4 library through environment variables.

3. Enhancements

3.1 Query

HAVING can be used without GROUP BY, PARTITION BY, or a window.
A join ON condition supports equality of an expression on one side, a limited integer or time offset, range comparison, and combined conditions.
When a subquery sort disagrees with a JOIN time condition, the query returns rows for the actual time condition.
An INTERVAL grouped by tbname uses the fast path. Grouped last queries read the cache in batches. An eligible ordinary query can be served by a replica.
Super-table INTERP covers partition by tag or ordinary column, and transfers less data when results are emitted per child table.
Partitioned state windows spend less time switching among many small partitions, and keep time order inside a partition across vnodes.
A super-table query with a tbname equality uses the name index.
FAST_INTERVAL and EX_INTERVAL are hints for eligible fixed-window INTERVAL queries.
Comparison of NCHAR with a string literal uses the client character set.
CREATE SMA INDEX is no longer supported. Existing SMA objects can still be queried and dropped.
On Linux, federated query loads a third-party library from /usr/local/lib when it is not in an existing search directory. Libraries shipped with the package are still preferred.

3.2 Stream processing and virtual tables

A stream keeps producing correct results after a source vnode leader change or a vgroup redistribution. A virtual-table stream reloads table information after a leader change. A virtual-table stream with an unmapped source column is no longer redeployed repeatedly.
When virtual-table metadata changes while a stream is running, the trigger updates references and the child-table list online and the stream stays running.
Writing a stream into an existing super table checks only the order, names, and types of output columns against the saved columns.
Event notifications other than ON_FAILURE_PAUSE are sent asynchronously in batches.
streamTriggerMaxPendingParams limits the calculation parameters a trigger may queue.
Multi-group batching of an external window supports JOIN and nested windows. Under COUNT_WINDOW and related triggers, a calculation subquery that contains a derived aggregate can use an external window.
A nested-window stream that joins a dimension table reads that table in batches and, within budget, filters join data by equality keys.
A metadata transaction can include stream creation, stream deletion, and more table-schema changes.
When a source table or source column referenced by a virtual table is gone, the query and SHOW VTABLE VALIDATE name the failed object and the reference chain. A virtual super table whose source column was dropped no longer returns an empty result silently.
A federated query on a virtual table can push windows, aggregates, and INTERVAL down to the external source.

3.3 Storage and cluster

SPLIT VGROUP runs more efficiently and blocks online writes less.
REDISTRIBUTE VGROUP handles concurrency with writes, stream processing, subscriptions, and virtual-table queries.
CREATE DATABASE returns only after every vgroup has elected a leader, so a following SHOW CLUSTER ALIVE does not report partial availability.
BALANCE VGROUP LEADER is split into the default random rebalance and FORCE for an even distribution. Force may temporarily fail to elect a leader when replicas lag too far.
Forced balance falls back after about 2 minutes, so a lagging replica does not stay without a leader.
Cluster recovery after a multi-replica leader change is shorter.
Changing the replica count of a database can set concurrency with PARALLEL. restore dnode adds parallel.
compactSpeedLimitMB limits how fast COMPACT writes to disk. 0 means no limit.
snapshotMediumOnLag is off by default. When it is on, a replica that already has data but is behind catches up with a file-level incremental snapshot.
The BLOB value limit rises from 4 MB to 16 MB. The Python and Node.js connectors and taosX support that limit. Python reads larger than 64 KB, and Node.js binds of a larger BLOB, no longer fail.
A composite primary key can include a TIMESTAMP column.
Last Cache RocksDB parameters are configurable in taos.cfg as sLastCache*. information_schema.ins_last_cache_stats is added.
SHOW VARIABLES and SHOW LOCAL VARIABLES add a reboot column for a setting that has been changed and takes effect only after restart.
Slow-query, UDF, MQTT, and XNode log file names use the taos prefix. logKeepDays can remove expired slow-query logs.
taosd writes [KEYOP] logs for migration, compact, leader election, stream processing, subscription, and virtual-table DDL.
A free license is supported, and the system variable registerEmail is added.
The community edition cross-checks the operating system against an allowlist at startup, and supports Rocky Linux and AlmaLinux. A proprietary feature returns an error that names the feature.

3.4 Writes, subscription, and clients

STMT2 can reuse the same statement after a server execution error. taos_stmt2 supports parameter binding for UPDATE.
CSV table creation and import accept a UTF-8 BOM. A non-UTF-8 BOM is rejected.
A retry for a missing table refreshes table metadata and no longer runs USE on every retry.
Error codes, SQL prompts, client logs, and command-line tools correct English spelling and grammar. Error-code numbers are unchanged.
On Windows, taos supports Tab completion. libtaos prefers taosnative.dll and taosws.dll in the same directory.
JDBC WebSocket supports setTimezone and getTimezone. Parameter binding converts numeric types automatically.
The Rust connector in adapter_ha mode picks a taosAdapter per connection and refreshes failover addresses from the cluster registry.
A subscription rebalances automatically when vnodes are redistributed.
When TMQ consumes a wide table, projection column widths are refreshed only after the table schema changes.

3.5 taosX, XNode, and taosExplorer

A taosX instance registered to one cluster cannot be taken over by another cluster.
MSSQL, Oracle, and MongoDB taosX sources use the same write-acknowledgement flow as MySQL and PostgreSQL. Cancelling a task does not advance the checkpoint.
If the XNode bound to a taosX task is missing or unavailable at start, the task tries another schedulable node.
XNode tasks and jobs return to their desired state after xnoded, taosd, or an Agent reconnects. This is on by default and can be turned off with --auto-resume or XNODED_AUTO_RESUME.
taosX and XNode add metrics for CPU, RPC, queues, downstream writes, and the persistent buffer.
Archive and cache files use a versioned frame format and deduplicate by failure reason. Old files can still be read.
taosExplorer supports an S3 connectivity test on the backup page, saving a taosX-Agent address, and a single-line truncation hint for long text.
The taosExplorer Tools page lines up with the Programming cards and adds tool descriptions. Export in the SQL result area uses a text button, as Run and Format do.
The TDgpt image mounts model and model_venvs on the host, so upgrading the image no longer overwrites models that were added later.
The default taosX and Java plugin packages no longer include OpenTelemetry or Swagger UI. Enable them when they are needed.
taosgen WebSocket writes reconnect after a disconnect and log retries and recovery.

4. Fixes

4.1 Severe issues

COUNT(DISTINCT) mixed with a plain aggregate returned unstable results. That part was fixed in v3.4.2.10 and v3.4.3.0. PARTITION BY with INTERVAL still collapses each partition into one row. The per-partition distinct fix is not in v3.4.3.3. Aggregate DISTINCT has existed since v3.4.2.0. Affected versions: v3.4.2.0 through v3.4.3.3. (#35495)
COUNT(DISTINCT) incorrectly used the tag-count optimization, so a GROUP BY result included rows outside the time filter. Affected versions: v3.4.2.0 through v3.4.2.11. (#35508)
A concurrent failure on the memory-pool session idle list allocated and destroyed the same session twice, and taosd crashed. Affected versions: v3.3.5.0 through v3.4.2.8. (#35485)
A dynamic super-table join allocated supplemental columns by row count instead of block capacity, corrupting the heap and crashing taosd. Affected versions: v3.3.6.0 through v3.4.2.10. (#35509)
After a query memory allocation failed, cleaning up a null subjob context crashed taosd (#35468, #35559). Affected versions: v3.4.0.0 through v3.4.3.2.
FILL_FORWARD on an integer column wrote 8 bytes, past the column width, and corrupted neighboring memory. Affected versions: v3.4.1.0 through v3.4.3.2. (#35550)
After a column compression was changed to TSZ, a later write and query crashed taosd. The encoding of a TSZ column must be DISABLED. Affected versions: v3.3.0.0 through v3.4.2.9. (#35475)
SET TAG on a normal table or a virtual normal table could crash. The tag value was not committed, and the query returned NULL. Affected versions: v3.4.2.12. (#35505)
A virtual-table column declared narrower than its source wrote past the buffer and crashed taosd. Buffers are now sized to the actual source width. A value that cannot be widened returns Query buffer limit has reached. Affected versions: v3.3.6.0 through v3.4.3.0. (#35570)
LAST with a time range on a virtual table could report Table schema is old or return the wrong column value. Affected versions: v3.4.2.3 through v3.4.3.0. (#35568)
DESCRIBE of a federated MySQL DECIMAL column that has no precision extension crashed taos and taosAdapter. Affected versions: v3.4.2.0 through v3.4.2.13. (#35534)
A repeated empty heartbeat reply while a stream was reading a virtual table could crash taosd. Affected versions: v3.4.0.0 through v3.4.2.12. (#35502)
When an external window settled a group with zero rows, the group alias was lost and a null pointer crashed taosd. Settlement of a fully filtered group could also be skipped. Affected versions: v3.4.1.0 through v3.4.2.12. (#35537)
With low-latency calculation off, new data kept postponing the realtime trigger batch deadline, so a COUNT_WINDOW subquery stream produced no output. Affected versions: v3.4.1.0 through v3.4.2.8. (#35490)
When a stream statement had more than one time condition on the same side, the scan range of a point window was computed as empty and the stream wrote no rows. Affected versions: v3.3.7.0 through v3.4.3.1. (#35566)
History recalculation of a grouped stream was treated as a single group. The stream became Failed and reported Stream internal error. Affected versions: v3.4.2.7 through v3.4.2.13. (#35474)
After an upgrade, a saved stream plan could not be restored because node numbers had changed, and starting it again still failed. Node numbers have differed since v3.4.2.0. Affected versions: v3.4.2.0 through v3.4.3.1. (#35556)
A stream kept using a cached virtual-table tag-ref, so it still used the old threshold after the config-table tag changed. Affected versions: v3.4.2.13 through v3.4.3.1. (#35491)
The Rust connector's native TMQ dropped a message silently when a receive timeout overlapped message arrival, so a subscription or a taosX sync missed rows. Affected versions: v3.4.2.0 through v3.4.3.0. (#35528)
tmq_write_raw swallowed the error and skipped the row when the destination table did not exist, so a caller that creates the table from that error no longer saw it. Affected versions: v3.4.2.0 through v3.4.2.8. (#35523)
A taosX sync did not commit the consumer offset of a partial batch on idle flush or exit. After a restart, or after the sink was briefly unable to write, already synchronized rows were replayed. Affected versions: v3.4.2.0 through v3.4.3.0. (#35571)
The query window and checkpoint of a taosX relational sync were wrong, so a migration over a large time range wrote no rows. Affected versions: v3.4.2.0 through v3.4.2.12. (#35510)
After the OPC UA source restarted, the taosX task still showed as running but collected nothing until the task was restarted by hand. Affected versions: v3.4.2.0 through v3.4.3.2. (#35557)
On Windows, NOW and NOW() returned a value near 1970-01-01. Since v3.4.1.0 the realtime clock and the monotonic clock shared a number. Affected versions: v3.4.1.0 through v3.4.3.1. (#35565)
When a dnode heartbeat carried an empty vnode-load list, SHOW VNODES showed vnodes as offline. Affected versions: v3.4.2.0 through v3.4.2.8. (#35481)

4.2 Query

A branch of a multi-branch UNION ALL that folds to empty is pruned at parse time, so it is not scanned. (#35483)
When UNION ALL drops an empty branch, the output column aliases are copied onto the kept branch. An outer query that uses those aliases no longer fails. (#35539)
A client running many UNION or UNION ALL branches of the same type no longer overflows the stack because of deep nesting. (#35503)
With keepColumnName on, an implicit column name of a single-argument aggregate or selection function no longer collides with an explicit alias as a false column-ambiguity error. (#35498)
When metadata for a row's schema version cannot be found, the underlying error code is kept instead of always showing NOT_FOUND. (#35542)
System tables such as information_schema.ins_columns access only the current database when db_name = DATABASE(), and no longer contact an unrelated offline vnode. (#35535)
Scanning virtual-child-table tag references in information_schema.ins_tags no longer starts an RPC storm that cannot be interrupted. (#35515)
A virtual super-table query ends the catalog task when split vgroup makes a batch metadata request fail, so the query no longer hangs. (#35520)
A virtual-table query that references a deleted source table or column releases temporary memory. Repeating the query no longer grows taosd memory. (#35530)
Federated DESC of an external table keeps the original column-name case. (#35493)
An ordinary user can query a registered external source and a virtual table that references it without a privilege on a local database of the same name. Creating, altering, and dropping an external source still use the existing privilege checks. (#35569)

4.3 Stream processing and virtual tables

CREATE STREAM that reads a referenced tag from a virtual normal table or a virtual child table includes the physical source table and no longer reports Not found. (#35564)
An EVENT_WINDOW that sets only START and omits END can be deployed. When START becomes false, the window closes at the last row that satisfied the condition. (#35533)
A nested-window stream skips an empty child-table slice produced by PRE_FILTER. Later rows continue to be calculated. (#35511)
A transient failure to resolve a virtual-table reference no longer redeploys the whole stream, so an out-of-order recalculation result is kept. (#35477)
A stream that reads a virtual table releases the system-table scan request when the operator is reset or destroyed. (#35525)
When a notification has several destinations, a destination that already succeeded does not receive the same notification again on a later retry. (#35529)
Retry and timeout handling is complete when a stream notification is sent on a nonblocking WebSocket. (#35478)
A failed registration during the first deployment of a stream task no longer leaks the task object. A heartbeat skips a stream that is still being deployed instead of waiting on a slow connection. (#35561)

4.4 Writes, subscription, and clients

In STMT2 interlace mode, after a child table is dropped from another connection, writing the same child-table name into another super table no longer reports that the table already exists in another super table. (#35522)
STMT2 computes the DECIMAL scale from the fractional digits and exponent of the bound string. A legal decimal string of length 8 or 16 is no longer treated as binary. (#35540)
DROP TABLE commits only the dropped table's dirty last-cache entries. Dropping a table with the cache enabled is fast again. (#35499)
An MQTT subscription of a database or a super table includes the child-table name in the payload. (#35489)
A subscription allocates a variable-length column by its actual length and rejects a value longer than the column definition. A string longer than 65535 bytes no longer crashes taosd. (#35546)
Closing a TMQ consumer releases local resources even when unsubscribe fails, so the connection count no longer keeps growing. (#35497)
getData() in the Go TMQ connector frees the native buffer. A long-running consumer no longer grows memory without bound. (#35484)
After an upgrade from 3.3 to 3.4, an unfinished subscribe rebalance message no longer times out because of an incompatible format. (#35496)
taosAdapter releases a WebSocket query result after the result set is idle past its timeout. With gzip enabled, /metrics is no longer compressed twice. (#35516, #35488)
taosBenchmark no longer frees a failed child-table query result twice. (#35538)
taosdump -Z websocket uses port 6041 by default. On Windows it can back up databases and tables whose names contain a colon or Chinese characters. (#35517, #35482)
JDBC WebSocket no longer shifts a TIMESTAMP a second time when the connection time zone differs from the JVM time zone. (#35562)
When taos starts in WebSocket mode, notices for unimplemented entry points go to the client log and are no longer printed on the terminal. (#35558)
On Windows, the taosd service can start xnoded. Starting taosd in the foreground as Administrator and then as a LocalSystem service no longer fails because the stream temporary directory has a different owner. (#35501, #35555)
On Windows, when timezone is unset, the time zone name recognized by the system is kept. Creating a stream no longer fails because the name was truncated to System. ALTER with an invalid time zone is rejected before the transaction starts. (#35563, #35567)
Parsing a string timestamp is no longer slow because the time-zone library was built without optimizations. (#35518)
Client libraries no longer export statically linked third-party symbols, so they do not collide with OpenSSL when linking on Intel macOS. (#35543)
When the xnoded executable cannot be found, CREATE XNODE returns a clear error instead of Unknown error 65534. The first CREATE XNODE waits until the control endpoint is ready. (#35549, #35548)
Community taos no longer shows proprietary commands such as restore. (#35576)
Community taosd on a supported Linux system no longer refuses to start because dpkg is installed, another distribution's identity remains, or os-release files disagree. (#35551)

4.5 taosX and taosExplorer

After xnoded reconnects to taosX, an ingest task scheduled by XNode, such as OPC DA, no longer stops by itself. (#35527)
The query window of MySQL live sync can be configured, so incremental SQL can return rows. (#35476)
MQTT and SparkplugB sources accept version=3.x. taosX does not support MQTT 3.1 (MQIsdp). taosExplorer removes the "3.1" option. An existing task with that setting still connects as 3.1.1. (#35479, #35553)
OPC collection can parse GBK and GB18030 configuration. pSpace can parse Chinese node names in those encodings. (#35532, #35544)
taosExplorer can select and upload a CSV when configuring an OPC DA source. The OPC DA connectivity check and the CSV upload show a result. (#35519, #35536)
On Windows, CSV import accepts a \\?\ extended path, and the path is no longer truncated. (#35487)
The PI plugin connects to AF with the same credentials as the Data Archive. Starting a console realtime task no longer calls an uninitialized backfill manager. (#35526)
An S3 restore no longer hangs forever when the bucket has no backup files. Deleting a backup task also drops the oneshot topic it created. (#35492)
A scheduled backup no longer drops a due period while the previous run is still going. It runs that period as soon as the previous run finishes. (#35541)
When several taosX tasks connect to the same taosAdapter cluster, the connections spread across nodes. To pin one endpoint, set adapter_ha=false in the task DSN. (#35521)
Updating a task no longer writes a dropped column, so the cloud console can save a Kafka ingest task. (#35480)
A TDengine data-query task shows monitoring data in taosExplorer. (#35486)
Foreground replica and privileges commands create a log only when a diagnostic event occurs. They no longer leave an empty file or delete a service log that is still in use. (#35524)
taosExplorer can finish the SQLite migration and log in after an upgrade from an older version. (#35554)
The task list restores activity history after a refresh, start, or stop. (#35512)
Creating or editing a user and selecting database Read or Write also grants USE. Removing the last Read or Write privilege also revokes USE. This behavior applies from v3.4.0.0. (#35552)
Opening Data Subscription no longer reports that topics failed to load when the cluster-address or password cache is wrong and the topics were already returned. (#35560)
Viewing or editing a database no longer runs SHOW disk_info automatically. (#35514)
When editing a database, WAL_RETENTION_PERIOD accepts -1 through 2147483647 and no longer writes a legal value below 3600 back as 3600. The default for creating a database remains 3600. (#35531)
Advanced filter on a super table can enter conditions. An AND of different tags returns child tables that satisfy all of them. Past the display limit, the exact child-table count is shown. The list shows at most 500 tables by default. The rest are found by search. (#35545, #35513)
Editing an existing taosX-Agent fills in the endpoint and token. (#35536)
The community and compact editions no longer call proprietary taosX monitoring, token, license, and user-privilege APIs. The dashboard no longer queries proprietary tables that do not exist, and it shows taosX with the other components. (#35506, #35500, #35504)
When an XNode drain fails, the node stays in Drain. Tasks that have not been drained are not scheduled again. (#35547)

5. Security

5.1 Vulnerability fixes

In the community edition, only a superuser can change system objects. A signed-in ordinary user can no longer ALTER DNODE, alter another user, or change their own IP whitelist. GHSA-xhwr-25r2-jg46, CWE-862. (#35667)
TMQ checks the consumer owner before returning vnode endpoints and rejects another user's consumerId. GHSA-crfh-3p34-23cw, CWE-639. (#35668)
INSERT deserialization rejects a column count or jump length that would wrap the length arithmetic. GHSA-gmhq-7r4w-7rp5, CWE-190. (#35669)
Sync Append Entries, sync snapshot processing, message lengths truncated to 32-bit integers, and string decoding that did not check the destination buffer correspond to GHSA-q86r-32wm-qwpg, GHSA-xg67-9f8r-64v5, GHSA-hr67-c6c8-mwpx, and GHSA-x8q3-55fg-4pwh. (#35670)
The Cluster ID check in sync RequestVote could be bypassed. GHSA-c39q-62fx-c853. (#35671)
A create-function request did not check the code length or the name length. GHSA-qh9p-wprq-p2hf, GHSA-8c53-8w6m-w28r. (#35672)
REPEAT() and an SQL Hint with an oversized parameter could overflow a buffer for an authenticated user. GHSA-f939-x5h3-cg4f, GHSA-j63p-9gcr-5fv8. (#35673)
A query plan whose DECIMAL TLV length disagrees with the declared byte size is rejected. GHSA-pc9g-w85r-7c6x. (#35674)
A stream heartbeat without a length check could underflow an integer. GHSA-382r-9pxq-7vg2. (#35675)
TDgpt installer extraction refuses to write outside the destination directory. GHSA-4w45-hf5j-95m3. (#35676)
taosKeeper audit writes escape request fields and check timestamps, database names, and table names, so that interface can no longer rewrite the audit log. GHSA-9m72-77jp-x5f2. The report interface no longer concatenates request fields into SQL, and TDengine.skipVerify is added. Certificate verification is still skipped by default. (#35677)
The zstd bundled with TSZ is upgraded from 1.3.5 to 1.3.8, fixing an out-of-bounds write when the destination buffer is too small. CVE-2019-11922, GHSA-2hff-w2r4-f7g5. See NVD. (#35678)
Updating a client endpoint set no longer computes the message length from uninitialized memory. TD-SEC-2026-001. (#35679)
taosX upgrades quinn-proto to 0.11.19, addressing RUSTSEC-2026-0342, RUSTSEC-2026-0339, RUSTSEC-2026-0340, RUSTSEC-2026-0338, and RUSTSEC-2026-0341 in 0.11.15. (#35680)
The Grafana plugin TDengine-datasource upgrades frontend and backend dependencies, fixing 30 known vulnerabilities, 1 critical and 10 high. (#35681)
DROP DNODE no longer treats the request FQDN as a format string when the node ID does not exist. (#35682)
The PRECISION range check on database creation takes effect. An out-of-range value is no longer used as a time-tick index. CWE-129. (#35683)
A super-table COMMENT rejects a value that is too long or whose length does not match. SHOW STABLES truncates a comment that was already stored too long. CWE-121. (#35684)
A TMQ subscribe request rejects a consumer group, client identifier, user, FQDN, or topic list that exceeds its capacity. CWE-121. (#35685)
A stream heartbeat rejects an out-of-range or inconsistent group id, an out-of-range deploy index, and an out-of-range trigger status, so mnode does not crash or touch freed memory. CWE-129, CWE-476, CWE-787. (#35686)
Shared-storage migration rejects a response whose vgroup index is out of range. Showing transaction details ignores a null stage action, avoiding a null-pointer crash. CWE-476. (#35687)
mnode rejects a configuration name longer than 128 bytes, an out-of-range vgroup replica count, and an oversized shared-storage migration database name. (#35688)
DECIMAL rejects an oversized exponent and an illegal precision or scale, avoiding an out-of-bounds access. (#35689)
Query-plan and SQL parsing check node types, required children, lengths, and nesting depth. A malformed plan returns an error. (#35690)
TMQ and MQTT check the response header, message type, data-block length, and batch metadata before decoding, and reject an illegal topic filter. (#35691)
Virtual-table metadata is rejected as an invalid message when the column-reference count disagrees, the batch response type is wrong, or the table name is missing. (#35692)
Message decoding no longer trusts a length declared by the peer. (#35693)
The TDgpt Analytics service tightens buffer bounds and access control, and limits the address used to create taosanode. Access to an internally deployed taosanode can be configured, and requests are no longer forwarded to taosanode automatically. (#35694)
taosdump restore checks lengths and column counts in an untrusted backup. (#35695)
taos writes interactive history one statement at a time. Create and alter statements that contain PASS, TOKEN, or TOTP_SECRET are not written to history. ~/.taos_history is tightened to mode 0600. Control characters in text returned by the server are dropped on display. (#35696)
On macOS, the related log files are created with mode 0666, so an ordinary user can write a log file created by root. (#35697)
Directory settings no longer expand commands. Log and archive files do not follow symbolic links. Compression decoding rejects an illegal codec marker and a length that would wrap. (#35698)
taosd no longer trusts an xnoded pid file or unix socket under dataDir, or the runtime files of udfd and taosmqtt. A pid file is not followed as a symbolic link. Only an xnoded whose owner and executable name both match is stopped. Companion processes are loaded only from the install directory. (#35699)
A user deleted and recreated with the same name no longer inherits ownership of the previous user's XNode tasks. (#35494)

5.2 Hardening

xnodeDsnProtection is added and defaults to 0. When it is on, XNode DSN passwords in SHOW and taosExplorer are shown as ******. Submitting the placeholder while editing keeps the stored password. Errors and logs no longer print a password, certificate, or private-key path. Connectivity checks, sampling, and preview carry only task_id. (#35700)
SHOW XNODE TASKS and SHOW XNODE JOBS support WITH ENCRYPTED. (#35701)
Stream wss:// notifications check the certificate chain and hostname by default. An untrusted, expired, or hostname-mismatched certificate is rejected. ws:// is unchanged. (#35702)
The database encryption key is checked before a vnode is opened. A wrong key returns a dedicated verification error. (#35703)
taosBenchmark reports an error and exits on a CSV row or tag table name that exceeds capacity, instead of writing past the buffer silently. (#35704)
Install and packaging tighten permissions on the data directory and driver libraries. Temporary files use mktemp. (#35705)
TSZ decode and compress check capacity. (#35706)
Object-storage downloads and TDB page offsets are bounds-checked. (#35707)
Stream heartbeats, task deployment, and result blocks check length, index, and task type. (#35708)

6. Upgrade notes

6.1 Upgrade path

Versions that can upgrade directly: v3.3.7 and later.
Rolling upgrade: supported, from v3.4.3.0 through v3.4.3.3.
Downgrade or rollback: supported, from v3.4.3.0 through v3.4.3.3.
Minimum client and connector version: v3.4.3.0.

6.2 Behavior changes

BALANCE VGROUP LEADER now rebalances at random by default. Add FORCE for the previous even distribution. When replicas lag too far, force may temporarily fail to elect a leader.
An equality JOIN uses Hash Join when the inputs are unordered. Results stay the same. Row order may change. Write ORDER BY when a stable order is required.
A subquery sort that disagrees with a JOIN time condition no longer returns an error. The query returns rows for the actual time condition.
CREATE SMA INDEX returns unsupported. Existing SMAs can still be queried and dropped.
When column compression is TSZ, that column's encoding must be DISABLED.
A taosX instance registered to one cluster cannot be taken over by another cluster.
taosX WebSocket connections are balanced across taosAdapter endpoints by default. To pin one endpoint, set adapter_ha=false in the task DSN.
A scheduled backup no longer drops a due period while the previous run is still going. It runs that period as soon as the previous run finishes. The actual interval may be shorter than the configured period.
Stream wss:// notifications check the server certificate by default. An untrusted, expired, or hostname-mismatched connection fails. ws:// is unchanged.
Event notifications other than ON_FAILURE_PAUSE are sent asynchronously by default. Under high load a notification may be dropped.
JDBC TSWSPreparedStatement changes from a class to an interface. Recompile after upgrading the driver, or the runtime throws IncompatibleClassChangeError. A statement cannot be used after close().
When a connection time zone is set and WebSocket is used, the epoch from getTimestamp() is correct again, and toString() follows the JVM default time zone. There is no change when the connection time zone is unset.
The next start of taos sets ~/.taos_history to mode 0600. Several statements on one line are stored as several history entries. Create and alter statements that contain PASS, TOKEN, or TOTP_SECRET are no longer written to history.
Slow-query, UDF, MQTT, and XNode log file names use the taos prefix. A collector that matches the old file names needs to be updated.
In the community edition, an ordinary user can no longer ALTER DNODE or change an IP whitelist. A proprietary feature returns an error that names the feature, instead of failing silently.
A TDgpt Lite container does not start models automatically after a restart.

6.3 Configuration changes

21 parameters are added. None are removed. The lower bound of 2 parameters is relaxed.

6.3.1 Stream processing

Parameter	Purpose
`streamNotifyWorkerNum`	Asynchronous notification threads on each snode. When unset, the value follows the CPU count, with a ceiling of 8. The configurable range is 1 to 16. A change takes effect after restart.
`streamNotifyBatchIntervalMs`	Longest wait, in milliseconds, before asynchronous notifications are sent together. The default is `5`, range 0 to 60000. A change takes effect after restart.
`streamNotifyParamPoolSize`	Size of the pending-object pool for asynchronous notifications, in KB. The default is `10240`, range 1 to 262144. A change takes effect after restart.
`streamTriggerMaxPendingParams`	Maximum parameters one nested trigger may hold. The default is `1048576`. A change takes effect immediately.

6.3.2 Query, storage, and cluster

Parameter	Purpose
`maxRetryTimes`	Retries for a query-scheduling task. The default is `12`, range 1 to 1000. A change takes effect after restart.
`enableFollowerRead`	Whether an eligible query may read from a vgroup replica. Off by default. Both the client and the server can change it dynamically, without a restart.
`compactSpeedLimitMB`	Limits `COMPACT` disk writes, in MB/s. The default is `0`, meaning no limit, range 0 to 1024. The actual speed may be lower than the setting.
`snapshotMediumOnLag`	A replica that holds data but is behind uses a file-level incremental snapshot. Off by default. A change takes effect immediately.
`backupPullupInterval`	Backup scheduler poll and catch-up interval, in seconds. The default is `10`, range 1 to 10000. It has no effect in the community edition.
`rpcQueueMemoryAllowed`	The configurable lower bound drops from 32 MB to 10 MB. The derived value and the derived quota use the new lower bound.
`syncLogBufferMemoryAllowed`	The configurable lower bound drops from 320 MB to 100 MB.

Last Cache RocksDB parameters can all be changed dynamically and take effect after restart.

Parameter	Purpose
`sLastCacheOptionsOverride`	Native RocksDB option string, lowest priority. Empty by default.
`sLastCacheCompressionType`	Compression algorithm. The default is `none`.
`sLastCacheBackgroundThreads`	Background threads. The default is `2`, range 1 to 256.
`sLastCacheMaxWriteBufferNumber`	Maximum number of memtables. The default is `2`, range 1 to 64.
`sLastCacheWriteBufferSize`	Size of one memtable, in MB. The default is `8`, range 1 to 1048576.
`sLastCacheBloomFilterBits`	Bloom filter bits. `0` turns it off. The default is `10`, range 0 to 32.
`sLastCacheMaxOpenFiles`	Maximum open files. The default is `-1`, meaning no limit.

6.3.3 Security, clients, and monitoring

Parameter	Purpose
`xnodeDsnProtection`	Whether DSN output of `ins_xnode_tasks` and `ins_xnode_jobs` is encrypted. The default is `0`, range 0 to 1. A change takes effect after restart.
`xnodeDsnPublicKeyFile`	Public-key file used to encrypt a DSN. Empty by default. A change takes effect after restart.
`xnodedDsnPrivateKeyFile`	Private-key file used to decrypt a DSN. Empty by default. A change takes effect after restart.
`anodeAllowInternalUrl`	Whether an ANODE may be created with an internal address. On by default. A change takes effect immediately.
`registerEmail`	Registration email for the free edition. Empty by default. A change takes effect immediately.
`stmtCacheSize`	JDBC WebSocket prepared-statement cache size. The default is `5`, efficient-write mode defaults to `2`, and `0` turns the cache off.
`TDengine.skipVerify`	Whether taosKeeper skips certificate verification when `usessl=true`. The default is `true`, matching the previous behavior.
`prometheus.maxTotalEntries`	Total entry limit of the taosKeeper v2 memory cache. The default is `100000`. New entries are rejected at the limit. Cached data is unchanged.
`prometheus.maxEntriesPerTable`	Per-table cache entry limit in taosKeeper. The default is `10000`.

6.4 Keyword changes

Nine keywords are added. None are removed. When one of these words is used as a database, table, super table, child table, column, or tag name, quote it with backticks regardless of case. See Reserved Keywords.

6.4.1 Backup

BACKUP, BACKUPS, and INCREMENTAL, used by CREATE BACKUP, SHOW BACKUPS, and KILL BACKUP.

6.4.2 Nodes

RESTART, used by RESTART XNODE.

6.4.3 Joins

CROSS, used by CROSS JOIN. WINDOW_TIME, used by WINDOW JOIN to name the time columns. MERGE_JOIN and JOIN_ALGO, used by the hint that selects a join algorithm.

6.4.4 Stream processing

_EVENT_CONDITION_PATH, the condition-path pseudo column of an event window.

6.5 System table changes

Two tables are added. Four existing tables gain columns. Two existing tables lengthen columns. No table is removed.

6.5.1 New tables

information_schema.ins_backups: cluster backup records. Columns are id, status, chain, database, full, encrypted, size, vgroups, start_time, and update_time.
information_schema.ins_last_cache_stats: Last Cache runtime statistics. It includes the dnode, vgroup, and database name, block-cache capacity and usage, memtable size and flush, compaction and SST files, whether writes are throttled, and update_time.

6.5.2 New columns on existing tables

information_schema.ins_streams: timezone and first_day_of_week.
information_schema.ins_dnode_variables: reboot, whether a runtime change takes effect only after restart. SHOW VARIABLES and SHOW LOCAL VARIABLES return the same column.
information_schema.ins_xnode_tasks and information_schema.ins_xnode_jobs: desired_state, the state restored after a task restarts.

6.5.3 Lengthened columns

information_schema.ins_xnode_tasks: from and to are twice as long. The column names and meanings are unchanged.
information_schema.ins_xnode_jobs: config is lengthened to the SHOW display limit. The column name and meaning are unchanged.

6.5.4 Removed tables

None.

6.6 Dependency changes

The table lists dependencies in the install package whose versions changed. The zstd and quinn-proto vulnerabilities are described in chapter 5.

Component	Dependency	v3.4.2.8	v3.4.3.3
TSZ	zstd	1.3.5	1.3.8
taosX	quinn-proto	0.11.15	0.11.19
taosX	rustls	0.23.38	0.23.46
taosX	rustls-webpki	0.103.13	0.103.15
taosX	aws-lc-rs	1.16.3	1.18.1
taosX	aws-lc-sys	0.40.0	0.45.0
Rust connector	rustls	0.23.35	0.23.45
Rust connector	rustls-webpki	0.103.13	0.103.14
Rust connector	aws-lc-rs	1.16.3	1.18.1
Rust connector	aws-lc-sys	0.40.0	0.45.0
Python WebSocket connector	rustls	0.23.37	0.23.45
Python WebSocket connector	rustls-webpki	0.103.13	0.103.14
JDBC connector	taos-jdbcdriver	3.9.0	3.10.0
JDBC connector	jackson	2.22.0	2.22.1
JDBC connector	netty	4.2.15.Final	4.2.17.Final
taosAdapter	golang.org/x/crypto	0.53.0	0.57.0
taosAdapter	golang.org/x/net	0.56.0	0.60.0
taosKeeper	gorilla/websocket	1.5.0	1.5.3
taosKeeper	driver-go	3.7.8	3.8.3
Go connector	gorilla/websocket	1.5.0	1.5.3
Grafana plugin tdengine-datasource	axios	1.16.0	1.18.0
Grafana plugin tdengine-datasource	immutable	4.3.8	4.3.9
Grafana plugin tdengine-datasource	dompurify	3.4.11	3.4.13
Grafana plugin tdengine-datasource	protobufjs	7.6.3	7.6.5
Grafana plugin tdengine-datasource	kin-openapi	0.131.0	0.144.0
Grafana plugin tdengine-datasource	grpc	1.79.3	1.83.2
Grafana plugin tdengine-datasource	OpenTelemetry SDK	1.43.0	1.45.0
Grafana plugin tdengine-datasource	OpenTelemetry OTLP exporter	1.28.0 / 1.29.0	1.45.0
Grafana plugin tdengine-datasource	golang.org/x/mod	0.37.0	0.40.0

6.7 Before you upgrade

An upgrade from v3.3.6 cannot keep the old stream processing. If the old streams, TSMA, snode, and their data directories are not removed, taosd fails to start. See Compatibility Notes.

A cluster that already rebuilt stream processing on v3.4.0.0 or later does not need to repeat those steps when rolling to this release.

Also check these three items:

For a wss:// stream notification, the certificate is trusted, not expired, and the hostname matches the URL.
If taosX still has cache that has not been replayed, drain it before rolling back. Old-format files can still be read.
If a JDBC application holds TSWSPreparedStatement, recompile it after upgrading the driver.

7. Known issues