ProxySQL 3.1.9 Release Notes

Release date: 2026-06-04

ProxySQL 3.1.9 is a maintenance and feature release for the Innovative Tier
(the Stable core plus FFTO and TSDB). It carries the same core changes as 3.0.9
(below), plus a TSDB dashboard fix. Its
headline change is a new backend-pool session scheduler that keeps tail
latency in check when the connection pool is saturated. Alongside it, this
release introduces an optional, AST-based SQL parser engine (ParserSQL,
disabled by default), a major round of PostgreSQL work (an independent DNS
cache, much faster SCRAM-SHA-256 authentication, and several digest/startup
correctness fixes), MySQL/MariaDB protocol and charset fixes, AWS Aurora
replica autopurge, a long-standing query-routing bug fix, and a broad sweep of
dependency, build, and packaging hardening (GCC 16, new distros, signed-package
compatibility).

Release commit: 7ddb3dc01

Highlights

• Security: two critical CVEs fixed — a PROXY-Protocol-v1 source-IP spoof
  that bypassed client_addr ACLs (CVE-2026-48772) and a pre-auth heap overflow
  in first-packet handling (CVE-2026-48773). Upgrading is strongly recommended;
  see Security.
• Backend-pool session scheduler: a new per-thread session-partitioning pass
  that engages only under pool contention, cutting average and tail latency and
  preventing the oldest connection-waiters from being starved to timeout (#5819,
  #5825).
• ParserSQL (optional, off by default): a new vendored AST SQL parser that
  can drive query-digest generation, command-type classification, and SET
  parsing for both MySQL and PostgreSQL. Opt-in via mysql-set_parser_algorithm=3
  or mysql-query_processor_parser=1 (and the pgsql- equivalents); the legacy
  parser remains the default (#5736).
• Independent PostgreSQL DNS cache: PgSQL backends now resolve through their
  own DNS cache, removing a synchronous getaddrinfo stall inside libpq that
  could trip the watchdog when a resolver was degraded (#5806).
• Faster PostgreSQL SCRAM-SHA-256 authentication: caching the OpenSSL digest
  and SCRAM verifier roughly doubles connection throughput on SCRAM-heavy
  workloads, reaching parity with PgBouncer (#5689).
• AWS Aurora replica autopurge and a monitor race-condition fix (#5760).
• TSDB dashboard fixed: the embedded dashboard is now served from the REST
  API port so its metric queries resolve same-origin (#5775).
• Correctness fixes for query-rule fast routing, MariaDB collations,
  PostgreSQL query digests, and a large-packet double-free that could
  crash the proxy (#5763, #5807, #5764, #5808).

Security

This release fixes two critical, remotely-triggerable vulnerabilities. All
users on 3.0.8 and earlier should upgrade.

CVE-2026-48772 — PROXY-Protocol-v1 UNKNOWN source-IP spoofing

Critical · CVSS 10.0 · CWE-348/863 · GHSA-gw94-85m2-x8v2

When ProxySQL is configured to accept the PROXY protocol (v1), a header using the
UNKNOWN transport could still carry address fields, which ProxySQL parsed as
the client's source IP. A client able to speak the PROXY protocol to ProxySQL
could therefore present an arbitrary source address and bypass
mysql_query_rules.client_addr access-control rules. ProxySQL now rejects
address fields in UNKNOWN frames (commits 1d2e080a, 3ad60f68, with
regression tests). Affects 2.0.0–3.0.8; fixed in the 3.0.9 / 3.1.9 / 4.0.9 builds. Reported by
@addcontent.

CVE-2026-48773 — Pre-auth heap overflow in first-packet handling

Critical · CVSS 9.8 · CWE-787 · GHSA-58ww-865x-grpr

An unauthenticated client could trigger a heap buffer overflow in the
first-packet handling of both the MySQL and PostgreSQL data streams. ProxySQL now
bounds the first-packet recv() on both protocols (commit 1cb2ecc1, with the
oversize_first_pkt-t regression test). Affects 2.0.18–3.0.8; fixed in the 3.0.9 / 3.1.9 / 4.0.9 builds.
Reported by @kamil-sawicki.

New Features

Backend-pool session scheduler (#5819, #5825)

Under heavy connection-pool contention — many client sessions competing for a
small backend pool — ProxySQL's per-thread session loop could spend its time
re-examining sessions that had no work to do, and could keep serving newer
pool-waiters ahead of older ones. This release adds a session-partitioning pass
to Base_Thread (shared by both the MySQL and PostgreSQL threads) that, on each
outer iteration, groups sessions into running / waiting-on-pool / idle bands so
that a connection released at the end of one session's query is handed to a
waiting session within the same iteration.

The pass is gated: it only engages when the pool is actually under pressure,
detected from the ratio of failed get_MyConn_from_pool() acquisitions with a
short hysteresis and a minimum-attempts floor so that low-volume noise does not
trip it. When contention is detected, the longest-waiting session in the
CONNECTING_SERVER band is promoted to be served first, so the session closest
to hitting connect_timeout_server_max is the one that gets the next freed
connection instead of being starved to an abort. A 1-in-N local
connection-cache change removes the per-thread connection hoarding that
previously caused a throughput cliff at higher thread counts. On a sustained
4 KB-row, TLS workload this moved a single worker from ~1,303 to ~1,487 tps
(384 ms → 336 ms average latency) and scaled cleanly with thread count. The
behavior is automatic; there is nothing to configure.

ParserSQL: optional AST SQL parser engine (#5736)

ProxySQL now vendors ParserSQL (1.0.9) as a static library and wires it in
through an adapter that can provide three things: query-digest generation,
command-type classification, and SET-statement parsing, for both the MySQL and
PostgreSQL dialects. It is disabled by default — the existing parser remains
in charge — and is enabled per protocol through two runtime variables:
set_parser_algorithm=3 switches only SET parsing to ParserSQL (conservative),
while query_processor_parser=1 routes digest, command-type, and SET through
it (full mode). The parser runs as per-thread state on the query hot path (no
locks, O(1) arena reset) and preserves SpookyHash digesting for backward
compatibility. This cycle also extended the engine's PostgreSQL SET handling to
cover the SET TIME ZONE alias and multi-value lists such as
SET search_path TO "$user", public (#5805).

Independent PostgreSQL DNS cache (#5806, fixes #5768)

The PostgreSQL side now owns a DNS cache that mirrors the MySQL one — its own
cache instance, resolver loop, and counters — so admin changes to one protocol's
cache no longer affect the other. On a cache hit, PgSQL_Connection passes
hostaddr=<ip> to libpq, so PQconnectStart() no longer blocks synchronously
inside getaddrinfo when the resolver is slow or broken. That synchronous stall
was the root cause behind the watchdog asserts reported in #5768. Three new
counters — PgSQL_Monitor_dns_cache_queried, _lookup_success, and
_record_updated — are exposed in stats_pgsql_global.

Faster PostgreSQL SCRAM-SHA-256 authentication (#5689)

On OpenSSL 3.x, EVP_sha256() performs a global, lock-contended EVP_MD_fetch()
on every call — roughly 4,096 redundant fetches per SCRAM PBKDF2 derivation, and
the dominant cost (~58% of CPU) on SCRAM-heavy PostgreSQL workloads. ProxySQL now
fetches the SHA-256 digest once and reuses it, and caches the derived SCRAM
verifier for plaintext-password accounts so repeat connections skip PBKDF2
entirely. In a serial connect/disconnect benchmark over SCRAM-SHA-256 + TLS this
raised throughput from ~137 to ~229 connections/sec — parity with PgBouncer.

AWS Aurora replica autopurge (#5760)

Aurora replicas that disappear from REPLICA_HOST_STATUS are now removed from
mysql_servers once they have been missing for the configured
autopurge_missing_checks threshold, instead of lingering as stale entries. The
change also fixes a monitor race condition in the Aurora discovery path.

Galera wsrep session variables and MariaDB SET STATEMENT ... FOR (#5708, closes #5686)

wsrep_trx_fragment_size and wsrep_trx_fragment_unit are now tracked
session variables, captured on SET and synchronized to backend connections like
the existing wsrep_sync_wait. ProxySQL also recognizes MariaDB's
SET STATEMENT var=val ... FOR <statement> syntax and forwards it without locking
the session to a hostgroup — previously this syntax was unrecognized and could
lock the session, surfacing as error 9006 on a later query bound to a different
hostgroup.

MySQL greeting advertises CLIENT_PLUGIN_AUTH_LENENC_CLIENT_DATA (#5744, closes #4760)

ProxySQL already parsed length-encoded client auth data but never advertised the
corresponding capability bit, so stricter clients such as Boost.MySQL refused to
connect. The flag is now set in the server greeting.

TSDB dashboard served from the REST API port (#5775, fixes #5684)

The embedded TSDB dashboard issues relative-URL fetch() calls to /api/tsdb/*,
but it was served from admin-web_port (default 6080) while those endpoints live
on admin-restapi_port (default 6070), so every request 404'd and the dashboard
showed "Error loading metrics". The dashboard is now served from the REST API
port, making its requests same-origin with the API they call — no CORS, no
configuration changes.

Bug Fixes (Core ProxySQL)

• Large-packet COM_STMT_EXECUTE double-free / SIGSEGV (#5808, fixes #5639):
  an oversized binary prepared-statement packet that tripped
  mysql-max_allowed_packet could free the same buffer twice in
  handler_WCD_SS_MCQ_qpo_LargePacket(). With jemalloc this silently corrupted
  the allocator and crashed intermittently under load; the handler now detects
  the aliased buffer and frees it once.
• MariaDB collation regression (#5807, fixes #5790): a MySQL-9.x charset fix
  ...

ProxySQL 3.0.9 Release Notes

Release date: 2026-06-04

ProxySQL 3.0.9 is a maintenance and feature release for the Stable Tier. Its
headline change is a new backend-pool session scheduler that keeps tail
latency in check when the connection pool is saturated. Alongside it, this
release introduces an optional, AST-based SQL parser engine (ParserSQL,
disabled by default), a major round of PostgreSQL work (an independent DNS
cache, much faster SCRAM-SHA-256 authentication, and several digest/startup
correctness fixes), MySQL/MariaDB protocol and charset fixes, AWS Aurora
replica autopurge, a long-standing query-routing bug fix, and a broad sweep of
dependency, build, and packaging hardening (GCC 16, new distros, signed-package
compatibility).

Release commit: 7ddb3dc01

Highlights

• Security: two critical CVEs fixed — a PROXY-Protocol-v1 source-IP spoof
  that bypassed client_addr ACLs (CVE-2026-48772) and a pre-auth heap overflow
  in first-packet handling (CVE-2026-48773). Upgrading is strongly recommended;
  see Security.
• Backend-pool session scheduler: a new per-thread session-partitioning pass
  that engages only under pool contention, cutting average and tail latency and
  preventing the oldest connection-waiters from being starved to timeout (#5819,
  #5825).
• ParserSQL (optional, off by default): a new vendored AST SQL parser that
  can drive query-digest generation, command-type classification, and SET
  parsing for both MySQL and PostgreSQL. Opt-in via mysql-set_parser_algorithm=3
  or mysql-query_processor_parser=1 (and the pgsql- equivalents); the legacy
  parser remains the default (#5736).
• Independent PostgreSQL DNS cache: PgSQL backends now resolve through their
  own DNS cache, removing a synchronous getaddrinfo stall inside libpq that
  could trip the watchdog when a resolver was degraded (#5806).
• Faster PostgreSQL SCRAM-SHA-256 authentication: caching the OpenSSL digest
  and SCRAM verifier roughly doubles connection throughput on SCRAM-heavy
  workloads, reaching parity with PgBouncer (#5689).
• AWS Aurora replica autopurge and a monitor race-condition fix (#5760).
• Correctness fixes for query-rule fast routing, MariaDB collations,
  PostgreSQL query digests, and a large-packet double-free that could
  crash the proxy (#5763, #5807, #5764, #5808).

Security

This release fixes two critical, remotely-triggerable vulnerabilities. All
users on 3.0.8 and earlier should upgrade.

CVE-2026-48772 — PROXY-Protocol-v1 UNKNOWN source-IP spoofing

Critical · CVSS 10.0 · CWE-348/863 · GHSA-gw94-85m2-x8v2

When ProxySQL is configured to accept the PROXY protocol (v1), a header using the
UNKNOWN transport could still carry address fields, which ProxySQL parsed as
the client's source IP. A client able to speak the PROXY protocol to ProxySQL
could therefore present an arbitrary source address and bypass
mysql_query_rules.client_addr access-control rules. ProxySQL now rejects
address fields in UNKNOWN frames (commits 1d2e080a, 3ad60f68, with
regression tests). Affects 2.0.0–3.0.8; fixed in the 3.0.9 / 3.1.9 / 4.0.9 builds. Reported by
@addcontent.

CVE-2026-48773 — Pre-auth heap overflow in first-packet handling

Critical · CVSS 9.8 · CWE-787 · GHSA-58ww-865x-grpr

An unauthenticated client could trigger a heap buffer overflow in the
first-packet handling of both the MySQL and PostgreSQL data streams. ProxySQL now
bounds the first-packet recv() on both protocols (commit 1cb2ecc1, with the
oversize_first_pkt-t regression test). Affects 2.0.18–3.0.8; fixed in the 3.0.9 / 3.1.9 / 4.0.9 builds.
Reported by @kamil-sawicki.

New Features

Backend-pool session scheduler (#5819, #5825)

Under heavy connection-pool contention — many client sessions competing for a
small backend pool — ProxySQL's per-thread session loop could spend its time
re-examining sessions that had no work to do, and could keep serving newer
pool-waiters ahead of older ones. This release adds a session-partitioning pass
to Base_Thread (shared by both the MySQL and PostgreSQL threads) that, on each
outer iteration, groups sessions into running / waiting-on-pool / idle bands so
that a connection released at the end of one session's query is handed to a
waiting session within the same iteration.

The pass is gated: it only engages when the pool is actually under pressure,
detected from the ratio of failed get_MyConn_from_pool() acquisitions with a
short hysteresis and a minimum-attempts floor so that low-volume noise does not
trip it. When contention is detected, the longest-waiting session in the
CONNECTING_SERVER band is promoted to be served first, so the session closest
to hitting connect_timeout_server_max is the one that gets the next freed
connection instead of being starved to an abort. A 1-in-N local
connection-cache change removes the per-thread connection hoarding that
previously caused a throughput cliff at higher thread counts. On a sustained
4 KB-row, TLS workload this moved a single worker from ~1,303 to ~1,487 tps
(384 ms → 336 ms average latency) and scaled cleanly with thread count. The
behavior is automatic; there is nothing to configure.

ParserSQL: optional AST SQL parser engine (#5736)

ProxySQL now vendors ParserSQL (1.0.9) as a static library and wires it in
through an adapter that can provide three things: query-digest generation,
command-type classification, and SET-statement parsing, for both the MySQL and
PostgreSQL dialects. It is disabled by default — the existing parser remains
in charge — and is enabled per protocol through two runtime variables:
set_parser_algorithm=3 switches only SET parsing to ParserSQL (conservative),
while query_processor_parser=1 routes digest, command-type, and SET through
it (full mode). The parser runs as per-thread state on the query hot path (no
locks, O(1) arena reset) and preserves SpookyHash digesting for backward
compatibility. This cycle also extended the engine's PostgreSQL SET handling to
cover the SET TIME ZONE alias and multi-value lists such as
SET search_path TO "$user", public (#5805).

Independent PostgreSQL DNS cache (#5806, fixes #5768)

The PostgreSQL side now owns a DNS cache that mirrors the MySQL one — its own
cache instance, resolver loop, and counters — so admin changes to one protocol's
cache no longer affect the other. On a cache hit, PgSQL_Connection passes
hostaddr=<ip> to libpq, so PQconnectStart() no longer blocks synchronously
inside getaddrinfo when the resolver is slow or broken. That synchronous stall
was the root cause behind the watchdog asserts reported in #5768. Three new
counters — PgSQL_Monitor_dns_cache_queried, _lookup_success, and
_record_updated — are exposed in stats_pgsql_global.

Faster PostgreSQL SCRAM-SHA-256 authentication (#5689)

On OpenSSL 3.x, EVP_sha256() performs a global, lock-contended EVP_MD_fetch()
on every call — roughly 4,096 redundant fetches per SCRAM PBKDF2 derivation, and
the dominant cost (~58% of CPU) on SCRAM-heavy PostgreSQL workloads. ProxySQL now
fetches the SHA-256 digest once and reuses it, and caches the derived SCRAM
verifier for plaintext-password accounts so repeat connections skip PBKDF2
entirely. In a serial connect/disconnect benchmark over SCRAM-SHA-256 + TLS this
raised throughput from ~137 to ~229 connections/sec — parity with PgBouncer.

AWS Aurora replica autopurge (#5760)

Aurora replicas that disappear from REPLICA_HOST_STATUS are now removed from
mysql_servers once they have been missing for the configured
autopurge_missing_checks threshold, instead of lingering as stale entries. The
change also fixes a monitor race condition in the Aurora discovery path.

Galera wsrep session variables and MariaDB SET STATEMENT ... FOR (#5708, closes #5686)

wsrep_trx_fragment_size and wsrep_trx_fragment_unit are now tracked
session variables, captured on SET and synchronized to backend connections like
the existing wsrep_sync_wait. ProxySQL also recognizes MariaDB's
SET STATEMENT var=val ... FOR <statement> syntax and forwards it without locking
the session to a hostgroup — previously this syntax was unrecognized and could
lock the session, surfacing as error 9006 on a later query bound to a different
hostgroup.

MySQL greeting advertises CLIENT_PLUGIN_AUTH_LENENC_CLIENT_DATA (#5744, closes #4760)

ProxySQL already parsed length-encoded client auth data but never advertised the
corresponding capability bit, so stricter clients such as Boost.MySQL refused to
connect. The flag is now set in the server greeting.

Bug Fixes (Core ProxySQL)

• Large-packet COM_STMT_EXECUTE double-free / SIGSEGV (#5808, fixes #5639):
  an oversized binary prepared-statement packet that tripped
  mysql-max_allowed_packet could free the same buffer twice in
  handler_WCD_SS_MCQ_qpo_LargePacket(). With jemalloc this silently corrupted
  the allocator and crashed intermittently under load; the handler now detects
  the aliased buffer and frees it once.
• MariaDB collation regression (#5807, fixes #5790): a MySQL-9.x charset fix
  inadvertently made ProxySQL treat MariaDB 10.x/11.x as MySQL ≥ 8 and forward
  SET NAMES utf8mb4 COLLATE utf8mb4_0900_ai_ci unmodified, failing with
  ERROR 1273: Unknown collation. MariaDB is now detected explicitly. The same
  PR repairs sibling version-detection sites, including two in MySQL_Monitor
  that broke health checks against MySQL 9.x Galera/PXC.
• Query rule apply=1 could bypass fast routing (#5763, closes #5620): when
  no mysql_query_rules rule matched but the last-iterated rule happened to have
  apply=1, mysql_query_rules_fast_routing was skipped, sending traffic to the
  default_hostgroup (or failing with ERROR 9001). The matcher no longer leaks
  the last-iterated rule past a non-match.
• __PostgreSQL...

ProxySQL 4.0.8 Release Notes

Release date: 2026-04-25

ProxySQL 4.0.8 is a maintenance release for the AI/MCP Tier, incorporating all improvements from ProxySQL 3.1.8 and 3.0.8. The headline 4.0-specific change in this cycle is the removal of the experimental Rust-based sqlite-rembed dependency, which eliminates the Rust toolchain requirement for PROXYSQLGENAI=1 builds and trims the GenAI documentation accordingly.

Release commit: 6ef036a00c6f1dbcf3f27fe7f6e07f3211d7d6f8

Highlights (AI/MCP Tier)

• No Rust Toolchain Required: With sqlite-rembed removed, PROXYSQLGENAI=1 (and therefore PROXYSQL31=1) builds no longer require rustc / cargo. sqlite-vec (the C-only sibling) is preserved.
• FFTO Enabled by Default (4.0.x): FFTO remains enabled by default in 4.0.x, providing full traffic observability out of the box. (FFTO is opt-in in 3.1.x.)
• All 3.1.8 / 3.0.8 Improvements Included: MySQL session-variable tracking (#5166), PostgreSQL Cluster Sync (#5297), per-server PgSQL backend SSL (#5583), PgSQL backend SSL keylog (#5567), mid-transaction backend-death recovery (#5654, #5659), mysql-zstd_compression_level (#5637), mysql-resolution_family (#5554), and the caching_sha2_password hex-rounds authentication fix.
• AI/MCP-Tier Package Coverage: The new on-demand package pipeline produces proxysql-4.0.8-* RPMs / DEBs for 13 distros × 2 architectures and proxysql-4.0.8-<sha>-macos-<arch>.tar.gz tarballs for macOS.

New Features (4.0.x)

Build Simplification

Removed Vendored sqlite-rembed and Rust Toolchain Requirement (#5616, c3266dd, 57c3e3f)

The experimental sqlite-rembed-0.0.1-alpha.9 Rust extension (previously vendored under deps/sqlite3/sqlite-rembed-source/) has been removed. The extension's hook pointer was permanently NULL in the runtime, with a TODO admitting the original integration was incomplete — so the extension was never registered at runtime in any tier, stable or GENAI.

With sqlite-rembed gone, the only consumer of rustc/cargo in the tree is removed, and the Rust toolchain detection block in deps/Makefile (along with the SQLITE3_* env exports that existed solely for the cargo build) goes with it. PROXYSQLGENAI=1 builds now succeed with rustc and cargo stripped from PATH.

Documentation in doc/GENAI.md and doc/SQLite3-Server.md has been updated to remove references to sqlite-rembed. Nine rembed-only auxiliary docs/scripts (shell demos, SQL examples, integration guide, posts-embeddings setup, MCP vector embeddings plan, python processor) are also removed. sqlite-vec (the C-only sibling) is preserved unchanged and continues to be registered under #ifdef PROXYSQLGENAI.

Known Limitation: GenAI on Older Distributions

The GenAI tier relies on C++17 features (notably std::regex::multiline) that are unavailable on the libstdc++ shipping with AlmaLinux 8 and on the libc++ shipping with openSUSE Leap 15. proxysql-4.0.8-*-almalinux8* and proxysql-4.0.8-*-opensuse15* packages are therefore not produced in this cycle. Use a newer distribution (AlmaLinux 9+, Fedora 42+, Debian 12+, Ubuntu 22.04+, openSUSE Leap 16) for the GenAI tier.

Features Inherited from v3.1.8 (Innovative Tier)

ProxySQL 4.0.8 includes all features from the v3.1.8 (Innovative) release, including:

• FFTO Default Behavior: FFTO remains enabled by default in 4.0.x.
• TSDB Subsystem: Behavior unchanged this cycle (warning cleanup and lint pass only).

Features Inherited from v3.0.8 (Stable Tier)

ProxySQL 4.0.8 includes all features, bug fixes, and improvements from the v3.0.8 release, including:

• MySQL Session-Variable Tracking — new mysql-session_track_system_variables mode (DISABLED / OPTIONAL / ENFORCED) with backend-driven variable sync and per-server backoff (#5166).
• PostgreSQL Cluster Sync — peer-to-peer sync for PgSQL admin tables with runtime checksums and save-to-disk (#5297).
• Per-Server PgSQL Backend SSL — new pgsql_servers_ssl_params admin table mirroring mysql_servers_ssl_params (#5583).
• PgSQL Backend SSL Keylog — NSS-format keylog for PgSQL backends via libpq PQsetSSLKeyLogCallback patch (#5567).
• PgSQL Mid-Transaction Backend-Death Recovery — pgsql-preserve_client_on_broken_backend_in_tx (default true) keeps client sessions alive across mid-tx backend death, with new pgsql_tx_poisoned_* counters (#5654, #5659).
• PgSQL Monitor: Scheduler Clamp on Interval Change — runtime interval changes take effect immediately (#5614).
• PgSQL CopyCmdMatcher — fast-reject + comment-tolerant regex (#5596).
• GTID Ranged Updates — internal Gtid_Interval/GTID_Set rework + I3/I4 wire-message parsing (#5224, #5557).
• MySQL mysql-zstd_compression_level — decoupled from zlib, range 1–22 default 3 (#5637).
• MySQL mysql-resolution_family — deterministic IPv4/IPv6 backend hostname resolution (#5554).
• Greeting Capabilities Restored — upper-word capability bits re-advertised in the MySQL greeting.
• Authentication: caching_sha2_password rounds parsed as hex; CACHING_SHA2_PASSWORD() accepts an optional rounds argument (#5640).
• Bug Fixes: MySQL 9.x charset handling in validate_charset; GR Monitor first-iteration probe; GTID range validation; GTID parser NULL check after strchr; PgSQL MD5 → EVP migration.
• Build & Platform: macOS build support (#5664); 156 on-demand Linux package workflows + 6 macOS workflows landing in a single canonical draft release (#5662, #5666, #5668, #5671); ASAN unit-test coverage (#5618).
• Code Quality: lint and static-analysis sweep across ~100+ files (#5594).

For a detailed list of these core improvements, please refer to the ProxySQL 3.0.8 Release Notes.

Contributors

ProxySQL is a community-driven project, and we are grateful to all the contributors who helped make this release possible. A special thank you to:

• @wazir-ahmed for MySQL session-variable tracking (#5166), GTID range parsing and unit tests, TSDB / MCP stack maintenance, and the GTID strchr NULL-check.
• @rahim-kanji for PostgreSQL Cluster Sync (#5297), the mid-transaction backend-death recovery (#5654, #5659), per-server PgSQL SSL parameters (#5583), PgSQL backend SSL keylog (#5567), the CopyCmdMatcher improvements (#5596), the PgSQL Monitor scheduler clamp (#5614), and the MD5→EVP migration.
• @proton-lisandro-pin for the initial GTID interval refactor that made ranged updates possible (#5224).
• @mirostauder for continued build system and distribution-support work.

We also thank everyone who reported bugs, tested experimental features, and provided feedback during this release cycle.

Hashes

The release commit is: 6ef036a00c6f1dbcf3f27fe7f6e07f3211d7d6f8

SHA256s:

a0d752e8237d7430ce0402cc44f405167465e6d4af61f6ba5b8c553411d86caa  proxysql-4.0.8-1-almalinux10-clang.x86_64.rpm
afee23221dea2d14a1bfa70b3955d767205793ccc5e9bda0bb7063a562f183f4  proxysql-4.0.8-1-almalinux10.aarch64.rpm
a54365781a64b19404e889ddc4f9ca41c84476d05b52592b80c0c84d3b989207  proxysql-4.0.8-1-almalinux10.x86_64.rpm
0af0f13a9ffaf1327dc9f73ed9288d81a006e37c105d44d7735df3efbd1b9020  proxysql-4.0.8-1-almalinux8-clang.x86_64.rpm
e087cdd8043e22e50c4397e796288fd0bba3dae2e73e0b476966d377d20ebb2a  proxysql-4.0.8-1-almalinux9-clang.x86_64.rpm
d4b3218b69381cdf32b2a98c9d39ff254863be5222129e59b9d93f2f67fdfa51  proxysql-4.0.8-1-almalinux9.aarch64.rpm
195511daf4b6ba5a492d723e773f5f0f2480d28baa153094b16306b647624a5b  proxysql-4.0.8-1-almalinux9.x86_64.rpm
1b4de34df68be976ed845386bf59f3f21cae8a12ebdc7b9dc81d1b8608d16669  proxysql-4.0.8-1-centos10-clang.x86_64.rpm
2dd449a30e553904546a31689dc9ad567bc895b829d6523bab53c79280fe88d2  proxysql-4.0.8-1-centos10.aarch64.rpm
c00b87676efcdd14151ca6e6903d4261512042b7b59e083bd5a7a47bdec5fc17  proxysql-4.0.8-1-centos10.x86_64.rpm
a31a41ce0854da778dbbf0717d183a5c5a2f908ee2237647e361b2ce3f76f416  proxysql-4.0.8-1-centos9-clang.x86_64.rpm
35b90544d06f15843a1a2ebe173cce1512a8af674c5e397b9e2890b73e500c85  proxysql-4.0.8-1-centos9.aarch64.rpm
633904432573058dd14a406f0c34866e226fe12674702e52dd78211a5750f10b  proxysql-4.0.8-1-centos9.x86_64.rpm
6c75ad2a5dc16713f78c93220f51e28aaa232d6d048ca7f304d21fb98e20e9c9  proxysql-4.0.8-1-dbg-almalinux10.x86_64.rpm
7618f395f70e78111394413da71331ab9778d8e1feb7b556c8f5f7e96bf11a09  proxysql-4.0.8-1-dbg-almalinux9.x86_64.rpm
794eb173364a6d9f34bb8a6128e98643ec212afc548136699bc6d99034759354  proxysql-4.0.8-1-dbg-centos10.x86_64.rpm
182918b181516afd2eec4a7c7b21b87568298f5d3e8482aedb06f8106d13f0a7  proxysql-4.0.8-1-dbg-centos9.x86_64.rpm
c5f1aa0e6e34aab390734d20d7db159aaa1e5297b18e00337ebee3bea95c1fe4  proxysql-4.0.8-1-dbg-fedora42.x86_64.rpm
fa666ac3e9e55a10a10d08a1e2ce9902f26c05ba0bae5fb6b0956c5206c02486  proxysql-4.0.8-1-dbg-fedora43.x86_64.rpm
1bbc1917f9c82203e3089b3094e4b1b3111cc62c904de501d1ac06c2f3732204  proxysql-4.0.8-1-dbg-opensuse16.x86_64.rpm
75674ace4668a47a22853de405e9e4d3f2c22838ce1f1a7029ab88eb9c758b28  proxysql-4.0.8-1-fedora42-clang.x86_64.rpm
4eae9c412b5689c12fb3610d50e99157afeda9c900daffe2a833060f55ce9376  proxysql-4.0.8-1-fedora42.aarch64.rpm
b1a357dfb596eec65751403a911edf2329641ecf93552820b8f60cfa3ccacb9c  proxysql-4.0.8-1-fedora42.x86_64.rpm
e70577994e8ce44baef3d0198500641fb0b3a935b65237e19c366eaec747dedc  proxysql-4.0.8-1-fedora43-clang.x86_64.rpm
426ab9c855cbc692b796b598981c484bf8aab69db30f04e6aa9f013acc20bd0c  proxysql-4.0.8-1-fedora43.aarch64.rpm
e45b1c415e6b14fae122e7c06eb26540974c19dacde2573a01ce3628a79939f6  proxysql-4.0.8-1-fedora43.x86_64.rpm
b5aa0d57e860e1039c7bc4ff31a575d08fdca13b5a8a681c17f49f95f75badc9  proxysql-4.0.8-1-opensuse16-clang.x86_64.rpm
e7ffaa00743c32dc00bc8645f1f66781af659cdc12104a5013de7bb110b21d5d  proxysql-4.0.8-1-opensuse16.aarch64.rpm
a9e89d29eb05fca6d0b04a1fb7fa99fe1fee82663b6cc830174ffac8324464ac  proxysql-4.0.8-1-opensuse16.x86_64.rpm
cd48c831b71b50aacd66a7cfd9a32550c92f28427bc16e3dcc8bebb1c1ebfa32  proxysql_4...

ProxySQL 3.1.8 Release Notes

Release date: 2026-04-25

ProxySQL 3.1.8 is a maintenance release for the Innovative Tier, incorporating all improvements from ProxySQL 3.0.8. This version is built using PROXYSQL31=1, which enables the Fast Forward Traffic Observer (FFTO) and Time-Series Database (TSDB) subsystems.

Release commit: 6ef036a00c6f1dbcf3f27fe7f6e07f3211d7d6f8

Highlights (Innovative Tier)

• Inherits All 3.0.8 Improvements: MySQL session-variable tracking (#5166), PostgreSQL Cluster Sync (#5297), per-server PgSQL backend SSL (#5583), PgSQL backend SSL keylog (#5567), mid-transaction backend-death recovery (#5654, #5659), mysql-zstd_compression_level (#5637), mysql-resolution_family (#5554), and the caching_sha2_password hex-rounds authentication fix.
• FFTO Stays Opt-In in 3.1.x: FFTO remains disabled by default in 3.1.x (introduced in 3.1.7 for stability). Administrators who wish to use FFTO must explicitly enable it via mysql-enable_ffto / pgsql-enable_ffto. FFTO continues to be enabled by default in 4.0.x.
• TSDB Behavior Unchanged: No user-visible TSDB changes this cycle; the lib-wide warning cleanup and lint sweep also touch TSDB compile-time hygiene without altering behavior.
• No Rust Toolchain Required: Removal of the vendored sqlite-rembed extension (the only consumer of rustc/cargo) means PROXYSQL31=1 builds no longer require the Rust toolchain.
• Innovative-Tier Package Coverage: The new on-demand package pipeline produces proxysql-3.1.8-* RPMs / DEBs for 13 distros × 2 architectures and proxysql-3.1.8-<sha>-macos-<arch>.tar.gz tarballs for macOS.

New Features (3.1.x)

This release does not add 3.1.x-specific features beyond what is inherited from 3.0.8. FFTO and TSDB behavior is unchanged from 3.1.7 except for cross-cutting code-quality improvements (warning cleanup, lint pass, deprecated-API migration) that also apply to those subsystems.

Features Inherited from v3.0.8 (Stable Tier)

ProxySQL 3.1.8 includes all features, bug fixes, and improvements from the v3.0.8 release, including:

• MySQL Session-Variable Tracking — new mysql-session_track_system_variables mode (DISABLED / OPTIONAL / ENFORCED) with backend-driven variable sync and per-server backoff (#5166).
• PostgreSQL Cluster Sync — peer-to-peer sync for PgSQL admin tables with runtime checksums and save-to-disk (#5297).
• Per-Server PgSQL Backend SSL — new pgsql_servers_ssl_params admin table mirroring mysql_servers_ssl_params (#5583).
• PgSQL Backend SSL Keylog — NSS-format keylog for PgSQL backends via libpq PQsetSSLKeyLogCallback patch (#5567).
• PgSQL Mid-Transaction Backend-Death Recovery — pgsql-preserve_client_on_broken_backend_in_tx (default true) keeps client sessions alive across mid-tx backend death, with new pgsql_tx_poisoned_* counters (#5654, #5659).
• PgSQL Monitor: Scheduler Clamp on Interval Change — runtime interval changes take effect immediately (#5614).
• PgSQL CopyCmdMatcher — fast-reject + comment-tolerant regex (#5596).
• GTID Ranged Updates — internal Gtid_Interval/GTID_Set rework + I3/I4 wire-message parsing (#5224, #5557).
• MySQL mysql-zstd_compression_level — decoupled from zlib, range 1–22 default 3 (#5637).
• MySQL mysql-resolution_family — deterministic IPv4/IPv6 backend hostname resolution (#5554).
• Greeting Capabilities Restored — upper-word capability bits re-advertised in the MySQL greeting.
• Authentication: caching_sha2_password rounds parsed as hex; CACHING_SHA2_PASSWORD() accepts an optional rounds argument (#5640).
• Bug Fixes: MySQL 9.x charset handling in validate_charset; GR Monitor first-iteration probe; GTID range validation; GTID parser NULL check after strchr; PgSQL MD5 → EVP migration.
• Build & Platform: macOS build support (#5664); no Rust toolchain required after sqlite-rembed removal (#5616); 156 on-demand Linux package workflows + 6 macOS workflows landing in a single canonical draft release (#5662, #5666, #5668, #5671); ASAN unit-test coverage (#5618).
• Code Quality: lint and static-analysis sweep across ~100+ files (#5594).

For a detailed list of these core improvements, please refer to the ProxySQL 3.0.8 Release Notes.

Contributors

ProxySQL is a community-driven project, and we are grateful to all the contributors who helped make this release possible. A special thank you to:

• @wazir-ahmed for MySQL session-variable tracking (#5166), GTID range parsing and unit tests, the GTID strchr NULL-check, and ENFORCED-mode capability preservation.
• @rahim-kanji for PostgreSQL Cluster Sync (#5297), the mid-transaction backend-death recovery (#5654, #5659), per-server PgSQL SSL parameters (#5583), PgSQL backend SSL keylog (#5567), the CopyCmdMatcher improvements (#5596), the PgSQL Monitor scheduler clamp (#5614), and the MD5→EVP migration.
• @proton-lisandro-pin for the initial GTID interval refactor that made ranged updates possible (#5224).
• @mirostauder for continued build system and distribution-support work.

We also thank everyone who reported bugs, tested experimental features, and provided feedback during this release cycle.

Hashes

The release commit is: 6ef036a00c6f1dbcf3f27fe7f6e07f3211d7d6f8

SHA256s:

058ccc6436e5bb388580b24ab106828284f8a8fa157eb284ea0232f29719206d  proxysql-3.1.8-1-almalinux10-clang.x86_64.rpm
163e24ed799e0f26c850f101dca029d64296192909aae6c6017dbea1768d82d7  proxysql-3.1.8-1-almalinux10.aarch64.rpm
c0b008b878e767944818afa05f2a16f7a5f043f0d7270826289e1ae289487406  proxysql-3.1.8-1-almalinux10.x86_64.rpm
9d42edbc9d3418c23a5aacb90349432f785fcf63537bed438f4c593357cc0c8a  proxysql-3.1.8-1-almalinux8-clang.x86_64.rpm
4a3b647e62085d6a63eb648a72aa466a6b82a3b6aead2db5b49d4bbd427ecde8  proxysql-3.1.8-1-almalinux8.aarch64.rpm
647341fa6e70f7481a365eda5aaafa603f9724719e5d8fc0aceffeb92a28da28  proxysql-3.1.8-1-almalinux8.x86_64.rpm
543d02cbb6392873cd3c3c848d6b30e035179f692aef4a60f698a6f2f91226a4  proxysql-3.1.8-1-almalinux9-clang.x86_64.rpm
d7c728ad9bea130caf08868ab09bff008380d77a7902a1cda3f5cb41d99b3798  proxysql-3.1.8-1-almalinux9.aarch64.rpm
24b8093b906aabc69ea3ac6b8f19ab3137c98bb3226b93f77b33f1ffb0b73dca  proxysql-3.1.8-1-almalinux9.x86_64.rpm
2c5d115bc0385b6c3c8fa53b7493e5967d58148f9ae868238d8cccb84beabad8  proxysql-3.1.8-1-centos10-clang.x86_64.rpm
576adc8db956e6b2dba17601464ee100670a52326d1f01683f12582c11aa9a39  proxysql-3.1.8-1-centos10.aarch64.rpm
d44265f44174f494979d9f3f7ad1df002d86682a91209309c98475da2e212285  proxysql-3.1.8-1-centos10.x86_64.rpm
bce76388616dea5cd6f9734f7a926b1e6ab462cdfae33efb911f8ebf47316278  proxysql-3.1.8-1-centos9-clang.x86_64.rpm
8b5f272789ec1a42cfbb5838040051682d57a7a5fef49ef8b612ae4aac29aafd  proxysql-3.1.8-1-centos9.aarch64.rpm
355baa0fc797a6b7613fdb170252c4ca3f5ad6f1b6614bdc8524ed49ccf6be4c  proxysql-3.1.8-1-centos9.x86_64.rpm
87208d5d268bed23ae6f7eb229040b6dc90505a960e6b81fe56e67c665adf7fa  proxysql-3.1.8-1-dbg-almalinux10.x86_64.rpm
3d8d3ff68f0b855ebd8af9eeffab852ad79c29838d3db435a97f5ca47675aa8d  proxysql-3.1.8-1-dbg-almalinux8.x86_64.rpm
ebca720f48120de7a1d8ec1db881da614db6f0978844c8611ad343faf99fe637  proxysql-3.1.8-1-dbg-almalinux9.x86_64.rpm
b0ca5a93ae20ba46d33e8c6ef546aefc51d22f1b5f22ce3e72ba24b02b10f3ed  proxysql-3.1.8-1-dbg-centos10.x86_64.rpm
00f315283ec9cfd1978e9f9a9eabc41d60c5636aa4bcef1894d0c4fac90a0be5  proxysql-3.1.8-1-dbg-centos9.x86_64.rpm
911cb3feb67528aac95c766bd1ecaddec85efc4b3b246ceef84d48f5474e8052  proxysql-3.1.8-1-dbg-fedora42.x86_64.rpm
785ddfb47524ef729f7d5cc0d3194d169b28f6f70f8457f30a507853b7e7b998  proxysql-3.1.8-1-dbg-fedora43.x86_64.rpm
9cdc4805278f2312951f377ba70b47d3e000c879777a47932ab028c7094f6b50  proxysql-3.1.8-1-dbg-opensuse15.x86_64.rpm
9decea44cbfd0797d57f8622f7b78fb740bafb0995cdafeae78dafdce71d740b  proxysql-3.1.8-1-dbg-opensuse16.x86_64.rpm
5f47f387ea13406d5c47316d334fffc282084594e5056309c9d029e7ee92bd48  proxysql-3.1.8-1-fedora42-clang.x86_64.rpm
5bfada6a8254650a338b750eb9ee6d133af5689cccf381465231a0b693aad22d  proxysql-3.1.8-1-fedora42.aarch64.rpm
38ab361ab961328547ebc5adb9df97269bb43b5259057de893421a52d80a7779  proxysql-3.1.8-1-fedora42.x86_64.rpm
bcdc8f3ff516f37aa3e84b32985df27937779f56aea9a950fd5fafe1e011b118  proxysql-3.1.8-1-fedora43-clang.x86_64.rpm
59681cacc802b4bcd685b06289d6696836e3f6c212c5ce0843e18f919995ea01  proxysql-3.1.8-1-fedora43.aarch64.rpm
cd9bb2057061016d0f7fbfc2d36ef9c2531ac70f56a5453ae019397bd85e4e59  proxysql-3.1.8-1-fedora43.x86_64.rpm
52726d434507df2a01efc7f6a91e3db184ab4a722c0e1794a6237cdadec84c74  proxysql-3.1.8-1-opensuse15-clang.x86_64.rpm
b71d1667017ed4e0e0c68b01ff6db9ee2f0ed9105dfa83c7fbcdf888b46ba956  proxysql-3.1.8-1-opensuse15.aarch64.rpm
4f0a77c08e9eced6f4b88e73d19145e10c2819e3fa0852a90861a08fe8bca41e  proxysql-3.1.8-1-opensuse15.x86_64.rpm
8f637c6d7680a3a2e577cdf45f2521873b5e488080514716c6101f02179c2ff3  proxysql-3.1.8-1-opensuse16-clang.x86_64.rpm
56e92b09e8f8ffda6e99e61facb8ca3947c6416509561a8da07ef927d9006f58  proxysql-3.1.8-1-opensuse16.aarch64.rpm
438565a0f287cb9bb79ed7e138fe85820abe911d9190de4539a3a0002109ab0d  proxysql-3.1.8-1-opensuse16.x86_64.rpm
9fb0a0b010cf86706843124e5ae4b51253afb6c95bf2ad5e88f04103d119a3da  proxysql_3.1.8-dbg-debian12_amd64.deb
57693c86cbbd57d56e650f593105d59ee42eaaf8d4e78a530e6db20b02998fe0  proxysql_3.1.8-dbg-debian13_amd64.deb
41aa53822d69eb174d676dc56bf0cb176aa9845144cd37677b12c23ea4ecc9a8  proxysql_3.1.8-dbg-ubuntu22_amd64.deb
768fc38f747db3a5f7f98e54347b77a9ea340f79c065c2bb5f553ff0c967d53a  proxysql_3.1.8-dbg-ubuntu24_amd64.deb
53ae782d5d5be06409614bb6441eea4014ca2547a3d2e414632ba12d3b3b13d5  proxysql_3.1.8-debian12-clang_amd64.deb
b7b817a06607cae4348dde50e51c7f842a085f3816e9ec9e3e28478dd182190f  proxysql_3.1.8-debian12_amd64.deb
829ade8f9ceb712624babfd3da671f932cb75cb748eb904a6a6fe5bcca94af13  proxysql_3.1.8-debian12_arm64.deb
85a25ffbdea01564deef061a0500f48a10adb0f151eab3ebb6a3f00c5200e5fd  proxysql_3.1.8-debian1...

ProxySQL 3.0.8 Release Notes

Release date: 2026-04-25

ProxySQL 3.0.8 is a maintenance and feature release for the Stable Tier. It introduces two large new subsystems — MySQL session-variable tracking and PostgreSQL Cluster Sync — together with significant PostgreSQL improvements (per-server backend SSL parameters, backend-side SSL keylog, mid-transaction backend-death recovery, monitor scheduling fixes), MySQL protocol/auth fixes (zstd compression level decoupling, caching_sha2_password hex-rounds, MySQL 9.x charset handling), GTID wire-protocol enhancements, and a comprehensive code-quality and packaging modernization. macOS now compiles cleanly for development use.

Release commit: 6ef036a00c6f1dbcf3f27fe7f6e07f3211d7d6f8

Highlights

• MySQL Session-Variable Tracking: New mysql-session_track_system_variables mode (DISABLED / OPTIONAL / ENFORCED) lets ProxySQL stay aligned with backend-driven session-variable changes (system variables and state_change notifications) and route around servers that reject the configured set via per-server backoff (#5166).
• PostgreSQL Cluster Sync: First-class peer-to-peer cluster synchronization for the PgSQL admin surface — pgsql_query_rules, pgsql_servers (v2 + runtime), pgsql_users, pgsql_variables, and the new pgsql_servers_ssl_params — with runtime checksums, optional save-to-disk, and dedicated admin controls (#5297).
• Per-Server PgSQL Backend SSL: New admin table pgsql_servers_ssl_params brings per-backend CA / client cert+key / cipher / TLS protocol range / CRL configuration to PostgreSQL backends, closing the long-standing parity gap with mysql_servers_ssl_params (#5583).
• PgSQL Backend SSL Keylog: NSS-format keylog support, previously available for MySQL backends, is extended to PostgreSQL backends via a libpq patch (PQsetSSLKeyLogCallback). Existing admin-ssl_keylog_file now covers PgSQL backends transparently (#5567).
• PgSQL Mid-Transaction Backend-Death Recovery: When a PgSQL backend dies inside a transaction, ProxySQL now keeps the client session open, surfaces SQLSTATE 25P02 (in_failed_sql_transaction), and lets the application recover with ROLLBACK instead of having its connection torn down. Gated by pgsql-preserve_client_on_broken_backend_in_tx (default true) (#5654, #5659).
• Configurable MySQL zstd Compression Level: New mysql-zstd_compression_level variable (range 1–22, default 3) decouples zstd from mysql-protocol_compression_level, removing the v3.0.7 confusion where a single variable spanned two algorithms with very different level semantics (#5637).
• MySQL DNS Resolution Family: New mysql-resolution_family variable (system / ipv4 / ipv6, default system) makes backend hostname resolution deterministic on dual-stack hosts (#5554).
• Authentication: caching_sha2_password rounds field is now parsed as hexadecimal per the MySQL spec — fixes auth failure for accounts with rounds ≥ 10000.
• Greeting Capabilities Restored: Upper-word capability bits dropped by an earlier refactor are re-advertised in the MySQL greeting, restoring negotiation with clients that depend on those bits.
• macOS Build Support: ProxySQL now compiles cleanly on macOS (Apple Silicon and Intel) for development use; new on-demand CI-build-macos-* workflows produce per-tier tarballs (#5664).
• Packaging Pipeline: 156 on-demand per-distro × per-tier × per-variant Linux package workflows + 6 macOS workflows, all converging on a single canonical draft release per SHA via a race-tolerant find-or-create flow (#5662, #5666, #5668, #5671).

New Features

MySQL Session-Variable Tracking (#5166)

ProxySQL has long supported session-variable tracking by parsing SET statements and reapplying the captured values on backend swaps (the MySQL_Set_Stmt_Parser path). That approach is correct only for variable changes that flow through statements ProxySQL can parse; values changed by stored procedures, triggers, or anything that emits OK-packet session-state notifications without a matching parsed SET would drift between client and backend. This release enhances the existing mechanism by additionally tracking variables at the protocol level — enabling and consuming the MySQL server's own session_track_system_variables and session_track_state_change notifications — so the proxy stays correct in cases the parser cannot see.

The new mode-driven mechanism:

• New variable: mysql-session_track_system_variables — modes:
  • DISABLED (default) — preserves existing behavior; the hot-path read is gated so disabled deployments pay no overhead.
  • OPTIONAL — ProxySQL configures session_track_system_variables and session_track_state_change on backends, captures change notifications from OK packets, and reconciles client-side and server-side variable maps. If a backend rejects the configured set, ProxySQL marks that server with a per-server backoff (session_track_backoff_until) so subsequent connection attempts skip it for a window.
  • ENFORCED — same behavior as OPTIONAL, but additionally the client-side handshake preserves the EOF capability bit (and other capability advertising) so clients negotiating on those bits keep working through the proxy. This corrects an interaction discovered when enforcement is enabled.
• Variable changes that previously could only be propagated via MySQL_Set_Stmt_Parser are now also captured via backend notifications.
• Observability: misconfiguration and runtime backoff transitions are emitted via proxy_debug for diagnosis.
• Together with the new mode, the legacy field MySrvC::server_backoff_time was renamed to session_track_backoff_until to reflect its scope.

GTID Ranged Updates

A two-phase change to ProxySQL's GTID handling, coordinated with proxysql_mysqlbinlog:

• Phase 1 — Internal GTID model rework (#5224, #5557): gtid_interval_t is replaced by a proper Gtid_Interval / GTID_Set class hierarchy. Adding a new GTID to a GTID_Set now de-dupes and compacts overlapping intervals automatically, and intervals can be compared and merged. Internal-only refactor — no behavior change to ProxySQL on its own.
• Phase 2 — Wire-protocol ranged updates (96f1b414, 9f6751f, 23c153f, dca01d4, a95acd0): adds parsing for new I3= (single trxid range with UUID) and I4= (range without UUID) message types from proxysql_mysqlbinlog. Unknown message types now disconnect the binlog reader rather than silently parsing partial state. Updates GTID_Set formatting and includes unit tests for the wire parser (I1/I2/I3/I4) and for TrxId_Interval.
• Prepared-Statement min_gtid Preservation (0e5fd66): the min_gtid annotation on prepared statements is now preserved in first_comment_parsing mode so GTID-aware read-after-write routing works for prepared-statement traffic.

PostgreSQL Cluster Sync (#5297)

PostgreSQL gains its own peer-to-peer cluster-sync implementation, bringing PgSQL configuration to parity with MySQL cluster sync:

• Synchronized tables: pgsql_query_rules, pgsql_servers (both runtime and v2 layouts), pgsql_users, pgsql_variables, plus the new pgsql_servers_ssl_params.
• Runtime checksums for each module, with admin-visible diff/sync counters.
• Save-to-disk: synced peer state can be persisted via the same admin pipeline used for MySQL.
• Decoupled controls: PostgreSQL checksum/sync controls are independent of MySQL — disabling MySQL checksums no longer suppresses PgSQL diff propagation.
• Admin controls: new runtime/admin keys to view/toggle the PgSQL checksum, expose diffs-before-sync counters, and toggle save-to-disk behavior.
• Validator: integer validator added for PgSQL variables.
• Internally, the implementation uses a unified data-driven pull framework (a single get_peer_to_sync_variables_module() replaces the per-module functions) and an RAII memory-management framework, so the PgSQL sync paths share architecture with the MySQL ones.

Per-Server PostgreSQL Backend SSL Parameters (#5583)

New admin table pgsql_servers_ssl_params, mirroring mysql_servers_ssl_params:

• Schema keyed by (hostname, port, username) with an empty-username fallback row.
• Per-row columns: ssl_ca, ssl_cert, ssl_key, ssl_capath, ssl_crl, ssl_crlpath, ssl_cipher, ssl_protocol_version_range, comment.
• ssl_protocol_version_range accepts a range (TLSv1.2-TLSv1.3) or a single pin (TLSv1.3); ProxySQL maps it to libpq's ssl_min_protocol_version / ssl_max_protocol_version.
• Eliminates the previous limitation that all PgSQL backends shared the global pgsql-ssl_p2s_* settings, which made heterogeneous PgSQL fleets, per-tenant mTLS, and per-server CRLs impractical.
• Fully integrated into the PgSQL admin → runtime → connection → monitor pipeline.

PostgreSQL Backend SSL Keylog (#5567)

NSS-format keylog support is extended from MySQL backends to PostgreSQL backends:

• A small libpq patch adds PQsetSSLKeyLogCallback() (mirroring libpq's existing PQsslKeyPassHook pattern) and hooks it via SSL_CTX_set_keylog_callback() for every new SSL context.
• ProxySQL registers its existing keylog writer with libpq once at startup; this single registration covers all PgSQL backend connection paths (regular sessions, kill-query, monitor, query-tool, static harvester).
• No new admin variables — the existing admin-ssl_keylog_file covers PgSQL backends automatically. Operators can decrypt PgSQL backend traffic with Wireshark/tshark via the same workflow already used for MySQL.

PostgreSQL Mid-Transaction Backend-Death Recovery (#5654, #5659)

Two cooperating changes:

• Bug fix (#5654): when a PgSQL backend connection broke mid-transaction, ProxySQL would silently replay the failed statement on a fresh backend running it as autocommit. The client's next COMMIT then landed on a connection...

ProxySQL 4.0.7 Release Notes

Release date: 2026-04-07

ProxySQL 4.0.7 is a maintenance release for the AI/MCP Tier, incorporating all improvements from ProxySQL 3.1.7 and 3.0.7 while adding MCP stack refinements and expanded AI-driven testing infrastructure. This version is built using PROXYSQLGENAI=1 (which implies PROXYSQL31=1) and requires the Rust toolchain.

Release commit: d7a26b79e936557e2d198148ce6d09111210d651

Highlights (AI/MCP Tier)

• MCP Bearer Token Fix: Fixed MCP Bearer token authentication test to align with case-insensitive token comparison as specified in the MCP specification.
• AI Testing Infrastructure: Migrated AI-specific TAP tests to the unified CI infrastructure pattern, enabling automated testing of AI/MCP features alongside core proxy functionality.
• FFTO Enabled by Default: FFTO remains enabled by default in 4.0.x, providing full traffic observability out of the box including the new error recording capabilities.

New Features (4.0.x)

MCP Stack Refinements

MCP Bearer Token Authentication (6d6015a)
Fixed the MCP Bearer token test to properly validate case-insensitive token comparison as defined in the MCP specification. The authentication middleware now correctly accepts tokens regardless of case, improving compatibility with various MCP client implementations.

AI Testing Infrastructure

Unified CI Migration (0b9806c, 2f8e63c)
Migrated the AI-specific TAP test group to the unified CI infrastructure pattern. This consolidates AI/MCP test execution with the core ProxySQL test pipeline, enabling parallel execution, better resource utilization, and consistent test reporting across all product tiers.

Features Inherited from v3.1.7 (Innovative Tier)

ProxySQL 4.0.7 includes all features from the v3.1.7 (Innovative) release, including:

• FFTO Error Recording: MySQL and PostgreSQL errors from fast-forwarded traffic are now captured in stats_mysql_errors and stats_pgsql_errors (#5539).
• FFTO Default Behavior: FFTO remains enabled by default in 4.0.x, providing full traffic observability without additional configuration (#5539).
• Comprehensive FFTO E2E Tests: Full E2E test coverage for FFTO across MySQL and PostgreSQL protocols (#5516, #5517).
• TSDB Improvements: Fixed TSDB test infrastructure for Docker-based CI environments.

Features Inherited from v3.0.7 (Stable Tier)

ProxySQL 4.0.7 includes all features from the v3.0.7 (Stable) release, including:

• Protocol Safety: Hardened MySQL protocol handling for COM_CHANGE_USER, HandshakeResponse, and PROXY protocol v1 (#5556).
• zstd Compression: Native zstd compression support for the MySQL protocol.
• TLS Observability: stats_tls_certificates table and stats_proxysql_global table for TLS certificate tracking and global metrics.
• SHOW WARNINGS Fix: Correct warning_count handling for statements with inline comments (#5306).
• REST API: Configuration-based route loading and hardened config handling.
• Security: Admin credential redaction in logs and Dependabot alert remediation.

For a detailed list of these core improvements, please refer to the ProxySQL 3.0.7 Release Notes.

Contributors

ProxySQL is a community-driven project, and we are grateful to all the contributors who helped make this release possible. A special thank you to:

• @rahim-kanji for PostgreSQL protocol hardening and FFTO error recording.
• @YujiHatakeyama for the SHOW WARNINGS fix with inline comments (#5306).

We also thank everyone who reported bugs, tested experimental features, and provided feedback during this release cycle.

Hashes

The release commit is: d7a26b79e936557e2d198148ce6d09111210d651

SHA256s:

4264b5337e8458e515e07449311264b8fa882fca7bb1c1aadcb581b9efdc6da7  proxysql-4.0.7-1-almalinux10-clang.x86_64.rpm
fcdc9a6e5a0e981e9d5d688df581a3f39955fffb8bb3c1bdc25e80ae77f25f0c  proxysql-4.0.7-1-almalinux10.aarch64.rpm
af910bf2e8b3fdc227ff92bfd8ba266cd7e1449c8d53ea2d2cc2763b1221b9a1  proxysql-4.0.7-1-almalinux10.x86_64.rpm
51bf20cf86115876c4236f61a2f4ee94fff54815f4f2e5f2c389059e92d59066  proxysql-4.0.7-1-almalinux8-clang.x86_64.rpm
64e47c962f2a9a1567221e7ecc79cb1c1ea471fd21d2ed83b121a615256323c7  proxysql-4.0.7-1-almalinux9-clang.x86_64.rpm
7a4fc60303c23de4779bda32e0988d389a77738590149b8f9768df073dca3bf6  proxysql-4.0.7-1-almalinux9.aarch64.rpm
f3b9d39951d697915f8cbd08d8c39425225f8a597e0db082442602ba9d0c2126  proxysql-4.0.7-1-almalinux9.x86_64.rpm
d4614dbef3dec54a858e7471dfcd8a8fef55b5897a6c33e2e7b3529f3287fec3  proxysql-4.0.7-1-centos10-clang.x86_64.rpm
82b57d545811ebe586ab9240cf8d5a10a426ee9fd23e4e47008d351484a350a7  proxysql-4.0.7-1-centos10.aarch64.rpm
6311cefd66a2eb9066f2ad605a60add28bca09abb94ded4cb69c32b18c1e27f5  proxysql-4.0.7-1-centos10.x86_64.rpm
20621cae5bd763fa5a238a5eb11d1ebc9a2d4bdd6401030057ea86ad4edcd51b  proxysql-4.0.7-1-centos9-clang.x86_64.rpm
b6c8d29185411ccf0d46a3309083518fe0117ddab788c3b10d46929da48b72f8  proxysql-4.0.7-1-centos9.aarch64.rpm
6ff1cb6cb2cae0b06da8f3b9f83e63d337823efaaf7b267fdbc852e8bfd5cead  proxysql-4.0.7-1-centos9.x86_64.rpm
51600c5735d7bb52b84abc5152958914d63c8351809247d0d1bd1e93671dd533  proxysql-4.0.7-1-dbg-almalinux10.x86_64.rpm
62895d89740a30579dfdcee635832e69417876461236824c6b301fff5c2ad129  proxysql-4.0.7-1-dbg-almalinux9.x86_64.rpm
8063bbb3490e0c80c8d266354e35cabdaf86992deec073c6a6749e4a73ce98e6  proxysql-4.0.7-1-dbg-centos10.x86_64.rpm
38b1bb362d1e9bc1bee025b1fa2889c6c524621b02d4a8981511628174fdcca0  proxysql-4.0.7-1-dbg-centos9.x86_64.rpm
e800e72884cc423e68f6aa860417ba8047fd5a642ac137645f18788e62309745  proxysql-4.0.7-1-dbg-fedora42.x86_64.rpm
990df208a52c97db48cfc8d6a39273f61904595ef36abaae9bb7278d5408c513  proxysql-4.0.7-1-dbg-fedora43.x86_64.rpm
1dfc93bb4d52d188d28edd6c789e4482194e543e249b82c853ace0ffa9d72af2  proxysql-4.0.7-1-dbg-opensuse16.x86_64.rpm
d04132d549c9cfa8bb8f3f4e9c2f7145c8bd33d36fb2298ce272aec64c0a466a  proxysql-4.0.7-1-fedora42-clang.x86_64.rpm
890e84c29a07b14f11387985dcc8d91187766f903dd7547deec117efa6e44309  proxysql-4.0.7-1-fedora42.aarch64.rpm
64ce653887b6b4fa4159c11cbc3a05497acdce25c044e73c6bbf0ef044158efd  proxysql-4.0.7-1-fedora42.x86_64.rpm
bff173f87d594f112a158e8ee01c9df90723abd75534cdb9ccdca16b995810ef  proxysql-4.0.7-1-fedora43-clang.x86_64.rpm
caec5a4e6f516f033027ed7c62028a74aa2daa40e50bf9f46906e444cceb0a72  proxysql-4.0.7-1-fedora43.aarch64.rpm
09f1b0e98ab76709305bf90704eafbed73bc2f5f33e9f3f1dea2155142224919  proxysql-4.0.7-1-fedora43.x86_64.rpm
1a010b0285ad96040758ff1f2d0bd15373234def76c6bc612055529ed6adb9bf  proxysql-4.0.7-1-opensuse16-clang.x86_64.rpm
eb4164cd6241ee02bc799d6a845c020397e457b47c9ae68356ed98c96401e2c7  proxysql-4.0.7-1-opensuse16.aarch64.rpm
7e5edc8d0538bd58e19cd012bcb16d29033ea412e00736908afa6bd8ac035eb7  proxysql-4.0.7-1-opensuse16.x86_64.rpm
7e33ddbb15a9b4a4832170792eacce0e6697dcef5e37d72ab781085074942f76  proxysql_4.0.7-dbg-debian12_amd64.deb
a9d3b12d20da7e7d6005679eec63bc250ee0f51cf657fe373cdb042499810511  proxysql_4.0.7-dbg-debian13_amd64.deb
25a8631f52311be9139aed0e2139e69fc3a627946eb065c43e0126e3a16e43bf  proxysql_4.0.7-dbg-ubuntu22_amd64.deb
0eb92be467238cb7d6ec25d129a84db630caddbcd5a77443ee8109e82501de43  proxysql_4.0.7-dbg-ubuntu24_amd64.deb
b1696fdfe0c2738a2d6c68585c468112d64de4cfe76ad28d8b2426fb66cbbf22  proxysql_4.0.7-debian12-clang_amd64.deb
f3691e585668a23e8e779437259673f28566a0af2738e3d32834a3a659b8ab98  proxysql_4.0.7-debian12_amd64.deb
3cbcfc9f9a0180adfb98a9af57057306bef379aa2a2d58773eda661888d67af1  proxysql_4.0.7-debian12_arm64.deb
51784a2edad6bc43b65a385750da1d7389141a46de2036bd02eac3c084d295fe  proxysql_4.0.7-debian13-clang_amd64.deb
27c2dd1ad4b1870d7364da1efe8d5b5cc55e5a92f180e06ffd3b161f37629966  proxysql_4.0.7-debian13_amd64.deb
75a8e7016dca8630104dbd034a0bf5ff7ca25f661a7b6ab1ac4a1ad4b917ce9e  proxysql_4.0.7-debian13_arm64.deb
700b508c99b0c0300fa42810ad4acccc55f36bb7b4e265675be7d488e18b823a  proxysql_4.0.7-ubuntu22-clang_amd64.deb
4f26f5c54e4584acc2bb4b543771c2176508b045a0dafcc2633485bd037a6c42  proxysql_4.0.7-ubuntu22_amd64.deb
8b358e4d3eca7f5386819f1d8c28daa87a82b70ab30dbc6e93d7b91116940876  proxysql_4.0.7-ubuntu22_arm64.deb
f475238914909dd14348906a2e3e9e7e5cdf2db1e1c61c9890b112a434e1b57f  proxysql_4.0.7-ubuntu24-clang_amd64.deb
db2349db86c479ac0909951ebcacbc6f8c6af22c224db2af262620175d2f685e  proxysql_4.0.7-ubuntu24_amd64.deb
a4713ef9600e9c15dc7078a79b8ca4ccdd2455cdd564bec909047cb8224ea5c6  proxysql_4.0.7-ubuntu24_arm64.deb

ProxySQL 3.1.7 Release Notes

Release date: 2026-04-07

ProxySQL 3.1.7 is a maintenance release for the Innovative Tier, incorporating all improvements from ProxySQL 3.0.7 while adding significant enhancements to the Fast Forward Traffic Observer (FFTO) and Time-Series Database (TSDB) subsystems. This version is built using PROXYSQL31=1.

Release commit: d7a26b79e936557e2d198148ce6d09111210d651

Highlights (Innovative Tier)

• FFTO Error Recording: FFTO now records MySQL and PostgreSQL errors from fast-forwarded traffic into stats_mysql_errors and stats_pgsql_errors, providing full error visibility for previously invisible traffic.
• FFTO Default Changed: FFTO is now disabled by default in 3.1.x for stability, with opt-in activation. It remains enabled by default in 4.0.x.
• Comprehensive FFTO Testing: Added extensive E2E tests for FFTO covering MySQL and PostgreSQL protocols, including pipelining, transactions, error handling, and large result sets.
• TSDB Test Fixes: Fixed TSDB TAP tests for Docker-based CI infrastructure reliability.

New Features (3.1.x)

FFTO Error Recording

MySQL Fast-Forward Error Visibility (c3df4ee, #5539)
FFTO now captures and records MySQL errors that occur during fast-forwarded sessions into the existing stats_mysql_errors table. This includes a new mysql_parse_err_packet() helper that identifies error packets in the MySQL wire protocol stream, enabling administrators to monitor and alert on errors in fast-forwarded traffic that was previously invisible to ProxySQL's statistics subsystem.

PostgreSQL Fast-Forward Error Visibility (c6f442b, #5539)
Similarly, PostgreSQL errors from fast-forwarded sessions are now recorded in stats_pgsql_errors. The pgsql_parse_error_response() helper parses PostgreSQL ErrorResponse messages to extract error severity, code, and message fields. Both helpers include comprehensive unit tests validating correct parsing across protocol versions.

FFTO Default Behavior Change

FFTO Disabled by Default in 3.1.x (61fc7a1, #5539)
FFTO is now disabled by default in the 3.1.x Innovative Tier. Administrators who wish to use FFTO must explicitly enable it via the mysql-enable_ffto or pgsql-enable_ffto variables. This change prioritizes stability for the broader user base while keeping FFTO available for users who need deep traffic observability. FFTO remains enabled by default in 4.0.x.

FFTO E2E Testing

Comprehensive FFTO E2E Test Suite (#5516, #5517)
Added a comprehensive suite of E2E TAP tests for FFTO covering both MySQL and PostgreSQL protocols:

• MySQL FFTO Tests (#5516): Concurrent sessions, transaction patterns, mixed text/binary protocol, large queries, bypass recovery, and session isolation.
• PostgreSQL FFTO Tests (#5517): Extended query pipelining, statement/portal management, mixed simple + extended protocol, concurrent sessions, error handling, CommandComplete tag varieties, and large result sets.

These tests validate FFTO's correctness across a wide range of protocol interactions and edge cases.

TSDB Improvements

TSDB Test Infrastructure (ca40936, 809878c)
Fixed TSDB TAP tests to work correctly in Docker-based CI environments, ensuring reliable test execution across different infrastructure configurations.

Features Inherited from v3.0.7 (Stable Tier)

ProxySQL 3.1.7 includes all features, bug fixes, and improvements from the v3.0.7 release, including:

• Protocol Safety: Hardened MySQL protocol handling for COM_CHANGE_USER, HandshakeResponse, and PROXY protocol v1 (#5556).
• zstd Compression: Native zstd compression support for the MySQL protocol.
• TLS Observability: stats_tls_certificates table and stats_proxysql_global table for TLS certificate tracking and global metrics.
• SHOW WARNINGS Fix: Correct warning_count handling for statements with inline comments (#5306).
• REST API: Configuration-based route loading and hardened config handling.
• Security: Admin credential redaction in logs and Dependabot alert remediation.

For a detailed list of these core improvements, please refer to the ProxySQL 3.0.7 Release Notes.

Contributors

ProxySQL is a community-driven project, and we are grateful to all the contributors who helped make this release possible. A special thank you to:

• @rahim-kanji for PostgreSQL protocol hardening and FFTO error recording.
• @YujiHatakeyama for the SHOW WARNINGS fix with inline comments (#5306).

We also thank everyone who reported bugs, tested experimental features, and provided feedback during this release cycle.

Hashes

The release commit is: d7a26b79e936557e2d198148ce6d09111210d651

SHA256s:

a0af6f0f306c3621b95e0e160bdebd8feeccd934f13ad95af675ff56c00b8f1b  proxysql-3.1.7-1-almalinux10-clang.x86_64.rpm
a3a9424e3dae9f6d92c1566230898a573eca97ee6871d2537114be2c66ccc28a  proxysql-3.1.7-1-almalinux10.aarch64.rpm
c25772b9e2eff169d234867e0d51e65ad77a11c352237d63a2386a315e764460  proxysql-3.1.7-1-almalinux10.x86_64.rpm
a8ce2154ce5ee302e6d022fcc0860f61f4a7d4a974602a0c9032e89ae744d78a  proxysql-3.1.7-1-almalinux8-clang.x86_64.rpm
31a7dbdee5bfcf816e3d7f7c3632dd90297c7cc9591c4740d0dcf87ee2b0f47c  proxysql-3.1.7-1-almalinux8.aarch64.rpm
fbcf29c98a3fe4f5c1501f48f5d13b32efae89a14859c4710697daaa5e585995  proxysql-3.1.7-1-almalinux8.x86_64.rpm
cd9026c618a7a724fcc275e755314bfbba791947c95ecdb276a2ba74e1ccd1fa  proxysql-3.1.7-1-almalinux9-clang.x86_64.rpm
4f9f253563b54b6badbfb539f02ee6be5444fb27c41d495a14c336a7b47072a3  proxysql-3.1.7-1-almalinux9.aarch64.rpm
e3356b054b93e428071b111a3521dbf3df9f4b1476887227d9e90215d600c8cd  proxysql-3.1.7-1-almalinux9.x86_64.rpm
28d29cb1b523c15c8421272aff2431eb5482bef2a19c5bddbdac9a9d77636c5c  proxysql-3.1.7-1-centos10-clang.x86_64.rpm
1b801050025bd27b6232bc56fa612aed986de2f2b1a24b4dc69f98f01e398e7c  proxysql-3.1.7-1-centos10.aarch64.rpm
7249c9692b84044ce886e60e2b0c71bdd057711dd3e2f2e42118b42d51b63835  proxysql-3.1.7-1-centos10.x86_64.rpm
2f6f13b7d384b4f2afa15f0206f60d27116417235a7455120afefaf93ff4e946  proxysql-3.1.7-1-centos9-clang.x86_64.rpm
fbf9fa1cff16fe65c7ba626b4a4a415c8ee559d1cd1cbc5bdffe1bd7063ab82d  proxysql-3.1.7-1-centos9.aarch64.rpm
d347db13c61ef2d9becc36bd30f0f119397856b6c8285d1f16eb64521a5d72bb  proxysql-3.1.7-1-centos9.x86_64.rpm
b248ec72b815e17e9ea65bd9d29032ea31de35319f7a9e6d505c12366b0dede8  proxysql-3.1.7-1-dbg-almalinux10.x86_64.rpm
421ae3404310817b599ed166b8c14b868f6cd72789fcc74aa0a4dc92ece64143  proxysql-3.1.7-1-dbg-almalinux8.x86_64.rpm
5d8b71206ed3b821347570437269f2b11019e8efc5b41f5ab88a3a94168ed598  proxysql-3.1.7-1-dbg-almalinux9.x86_64.rpm
6d6293b1a22abac6e6935c8a4f42840cc4f7e49ceaacf013554b8d378d07a73f  proxysql-3.1.7-1-dbg-centos10.x86_64.rpm
510679212aa282ec5d3ecc91ecbe5aed4df3df2be829c28b0a2ce1da309df278  proxysql-3.1.7-1-dbg-centos9.x86_64.rpm
e230b06f230d6b18dee8e9e9e009ce6f5c58a8bd3f5efe3b8ed548c31b01abf6  proxysql-3.1.7-1-dbg-fedora42.x86_64.rpm
b9eec0b2e67d2bfa4eec910c0432741d4abf40ba549e1c70620801bb4b58c313  proxysql-3.1.7-1-dbg-fedora43.x86_64.rpm
c3ff57776554bae96e3bfe2eb45f5f25d7a060c13dbf7823acc3ab0ae839af01  proxysql-3.1.7-1-dbg-opensuse15.x86_64.rpm
482d1674c2ebd74f0cacb2c11828a9b794f23b97270d77022073f7ae2284ca3b  proxysql-3.1.7-1-dbg-opensuse16.x86_64.rpm
caccd15ee6a013d50c795fe7cad8047db5592889cd1c0e6a846f280e4d829759  proxysql-3.1.7-1-fedora42-clang.x86_64.rpm
cc930ea283897d4b4bef03e6290c69c161153354ab957fabd25abf9a23eb9bba  proxysql-3.1.7-1-fedora42.aarch64.rpm
54ed72cc4b6711c5e5eeb192cf0027c64fe7ecb5899b15fba04a728ce4549005  proxysql-3.1.7-1-fedora42.x86_64.rpm
ccf66387dc5c02d23bd6c028eaae4c5287889565864ba84e2f0afb5c6ea4adb6  proxysql-3.1.7-1-fedora43-clang.x86_64.rpm
b96167a68b274f719c612694e99bcf347da057d42b2c9ffb32e55960c823acd6  proxysql-3.1.7-1-fedora43.aarch64.rpm
5564910dcb214b9c529b26a3ed6dea89a1daa1f014089296e2f2316c3d20e7c5  proxysql-3.1.7-1-fedora43.x86_64.rpm
7ee746ca1507f45494c8337342d1613256e5c08c4bd3acc42869ce9771d5a838  proxysql-3.1.7-1-opensuse15-clang.x86_64.rpm
e4f866502d0e9ec5cc163cd1ee3b3eccf63bcf0dde673c2aee9d534251813002  proxysql-3.1.7-1-opensuse15.aarch64.rpm
1b0c3f51fa117932da1f6ab9d6817327b084c4d0bfd9402175faf5c0b7120221  proxysql-3.1.7-1-opensuse15.x86_64.rpm
4974679c66d9a196cb3382b5b8e9ffba2f1e0fae03921209b370316e52cdb610  proxysql-3.1.7-1-opensuse16-clang.x86_64.rpm
2ace970e6082be18fb6cc9cd071c5b9b6a36aa3707a03f5edfbbf22d59fcaa37  proxysql-3.1.7-1-opensuse16.aarch64.rpm
fa3b85822c5fba61a40d70fec43e051a9d9859dc9e440b5bf24a7b0a43f2040e  proxysql-3.1.7-1-opensuse16.x86_64.rpm
e8e8144d33e06f92b7f6961ce2825c3d4685901104c625a01bbc59535b99e628  proxysql_3.1.7-dbg-debian12_amd64.deb
4c2f084e01a8e23f9e9ad18fe0f7947a3760048c6efbeb1e7955481404d83bc0  proxysql_3.1.7-dbg-debian13_amd64.deb
320cb917195a817ea1bd93aecdc8fbd874918792458ddc1aa20c0196b2c45dcd  proxysql_3.1.7-dbg-ubuntu22_amd64.deb
edef73ab021e02a3149575475679a271f35a5698ebb4d2c078cfe8e93104c2ec  proxysql_3.1.7-dbg-ubuntu24_amd64.deb
5df9a11473a12a7c339f3dbfde144c2a3c45e4d646809e4b401533eb20ae9c9f  proxysql_3.1.7-debian12-clang_amd64.deb
22e281551b72162ea2f68ac4fc97b05c30ef51e4f8855093fda8b756a102b1e6  proxysql_3.1.7-debian12_amd64.deb
8aaec78a44d05f7fbc0b731954346fceac1551048d1d13093658a88c185b341b  proxysql_3.1.7-debian12_arm64.deb
9f23f6fcec35ed672329781bfa925d592650b60abe2eea2d92a256505100e6e5  proxysql_3.1.7-debian13-clang_amd64.deb
1dd7e8d2ae6195902c00498f5518581ab35d5afaa437919c4b7db1b952878ae6  proxysql_3.1.7-debian13_amd64.deb
b9a98ddf5c773c0ca2c792fb3ca6a29b9b0cbd82e28aaab8cb3bb9b8c698aa92  proxysql_3.1.7-debian13_arm64.deb
97e1ffb0c1709184cae3356057b15f4892bb9817f3362ac863f685fdb0d02cca  proxysql_3.1.7-ubuntu22-clang_amd64.deb
fc28984f62d0047f1ad27c299ed96e6122f5d868009ae85ef52bfa6376b574bc  proxysql_3.1.7-ubuntu22_amd64.deb
9102e5efba9c9d19bba02f3d8dcadd11c4b89bdabb56a062d3e3d47d5f66...

ProxySQL 3.0.7 Release Notes

Release date: 2026-04-07

This release of ProxySQL 3.0.7 is a maintenance and security hardening release focusing on protocol safety, observability improvements, and build system modernization. It introduces MySQL protocol zstd compression support, TLS certificate tracking, REST API configuration enhancements, and critical protocol hardening against malformed packets.

Release commit: d7a26b79e936557e2d198148ce6d09111210d651

Highlights

• Protocol Safety: Hardened MySQL protocol handling with validation for COM_CHANGE_USER, HandshakeResponse, and PROXY protocol v1 packet fields to prevent crashes from malformed inputs.
• MySQL zstd Compression: Added native zstd compression support for the MySQL protocol, enabling more efficient network utilization for high-throughput workloads.
• TLS Observability: Introduced stats_tls_certificates table and stats_proxysql_global table for real-time TLS certificate tracking and global proxy metrics.
• Security: Redacted admin credentials in logging output and fixed all 48 Dependabot alerts in test dependencies.
• Critical Bug Fix: Fixed a crash when COM_BINLOG_DUMP was received with idle backends from other hostgroups.
• SHOW WARNINGS Fix: Fixed incorrect warning_count when SHOW WARNINGS statements contained inline comments.

Enhancements & Fixes

Security & Protocol Hardening

COM_BINLOG_DUMP Crash Fix (b2f4b4f, #5556)
Fixed a critical crash that occurred when COM_BINLOG_DUMP was received while idle backends from other hostgroups were connected. The connection handler now correctly validates backend state before processing binlog dump requests, preventing segmentation faults in multi-hostgroup deployments.

COM_CHANGE_USER Packet Validation (c9f627a)
Added bounds checking for COM_CHANGE_USER packets to prevent out-of-bounds reads when processing malformed authentication change requests. This hardening prevents potential crashes when clients send truncated or corrupted packets.

HandshakeResponse String Field Validation (3d9a6e7)
Added validation of string fields in HandshakeResponse packets during the MySQL handshake. Malformed packets with invalid string terminators or truncated fields are now rejected cleanly instead of causing undefined behavior.

PROXY Protocol v1 Address Overflow Fix (010b053)
Fixed a buffer overflow in the PROXY protocol v1 address parsing that could occur with malformed source/destination address fields. The parser now properly validates address field lengths before copying into internal buffers.

COM_STMT_SEND_LONG_DATA Short Packet Handling (151169d)
Fixed improper handling of COM_STMT_SEND_LONG_DATA packets that were shorter than expected. The protocol handler now validates minimum packet length before processing, preventing incorrect parameter data from being sent to backend servers.

Security

Admin Credential Redaction (b4cd4a1)
Admin credentials are now redacted in logging output when set via administrative commands. This prevents sensitive authentication data from appearing in log files, improving compliance with security audit requirements.

Dependabot Alert Remediation (0441d50)
Resolved all 48 Dependabot security alerts by bumping Python test dependencies to their latest secure versions. This eliminates known vulnerabilities in the development and testing infrastructure.

MySQL Protocol Enhancements

zstd Compression Support (ec44a15, 33e125e, 3f1b0a1)
Added native zstd compression support for the MySQL protocol. This provides an alternative to zlib compression with significantly better compression ratios and lower CPU overhead, particularly beneficial for high-throughput workloads over WAN connections. The zstd library is statically linked to ensure consistent behavior across platforms.

SHOW WARNINGS with Inline Comments (049ea8c, #5306)
Fixed an issue where SHOW WARNINGS statements containing inline comments incorrectly incremented warning_count. The query processor now uses digest_text to determine whether a statement is a SHOW WARNINGS query, preventing false warning increments when comments are present.

Digest Text Fallback (8b0c7be)
Added a fallback mechanism to use the raw query text when digest_text is unavailable. This ensures that query routing and statistics collection continue to function correctly even when the query digest cannot be computed.

TLS & Certificate Management

TLS Certificate Tracking (4f88740, 2e552b8, 0357862)
Introduced a new stats_tls_certificates table that provides real-time visibility into loaded TLS certificates, including subject, issuer, validity dates, and cipher suite information. This enables administrators to monitor certificate expiration and detect configuration issues. Also fixed memory leaks in SSL/TLS certificate tracking and improved certificate loading reliability.

stats_proxysql_global Table (e274862, efedd93)
Introduced stats_proxysql_global as a dedicated table for global proxy metrics, moving TLS-related metrics out of stats_mysql_global. This separation eliminates metric ambiguity in dual-protocol (MySQL + PostgreSQL) environments and provides a cleaner observability interface. The table was renamed from the initial stats_global to stats_proxysql_global to avoid substring collision issues in the admin query parser.

REST API Improvements

REST API Route Loading from Config (8d358cb, bbcc67b, 04c5e58)
REST API routes can now be loaded from configuration aliases, enabling declarative route setup without manual SQL commands. REST API configuration values are now properly escaped during insertion, and the configuration handling has been hardened to prevent malformed config entries.

Monitoring & Diagnostics

Listener Conflict Detection (1dace93, 8e37bba, eac20e5)
Added validation for conflicting listener ports at startup. ProxySQL now detects and reports port conflicts before entering the main event loop, preventing silent failures and providing clear error messages during configuration. Includes Doxygen documentation for the listener validation logic.

Build & Platform Support

FreeBSD Build Compatibility (c5ebab5)
Fixed build issues on FreeBSD, ensuring compilation succeeds with FreeBSD's system headers and toolchain.

macOS Compilation Fixes (88be144, a538532)
Resolved compilation issues on macOS (Darwin), including missing type definitions and header conflicts. ProxySQL can now be compiled on macOS for development and testing purposes.

zstd Static Linking (3f1b0a1, df97ae9)
Added the zstd compression library as a statically linked dependency, ensuring consistent compression behavior across all supported platforms without requiring external library installation.

Improvements

• Timeout Validation: Fixed timeout_ms validation and improved consistency in write path section naming (c3564ca).
• Unit Test Infrastructure: Added comprehensive unit tests for monitor health decisions, backend variable sync, and protocol utilities (59654e4, ead2331, 24db561).
• CI Infrastructure: Migrated test infrastructure to support multi-group parallel execution with Docker-based containers for improved reliability and reproducibility.
• Memory Safety: Fixed stale connection state tracking issues reported during multi-threaded testing scenarios.

Contributors

ProxySQL is a community-driven project, and we are grateful to all the contributors who helped make this release possible. A special thank you to:

• @rahim-kanji for PostgreSQL protocol hardening.
• @YujiHatakeyama for the SHOW WARNINGS fix with inline comments (#5306).

We also thank everyone who reported bugs, tested experimental features, and provided feedback during this release cycle.

Hashes

The release commit is: d7a26b79e936557e2d198148ce6d09111210d651

SHA256s:

760637e7b1516e1bc8cfa7fbb6f92d0f5397b35d318365c4e1ad6105492a3276  proxysql-3.0.7-1-almalinux10-clang.x86_64.rpm
0f69636b6607e4007ee9c23dbd40424f707592f376591f5d60ddf9b168663f34  proxysql-3.0.7-1-almalinux10.aarch64.rpm
805d28053ac16ac1e7a82c7e6d50759ad863550ab21f22e37ad7f685e46efdaf  proxysql-3.0.7-1-almalinux10.x86_64.rpm
8bc0d51dc67e2d7deb0aa98349b6bbc7422648e10ceaecd2082d641919be4eff  proxysql-3.0.7-1-almalinux8-clang.x86_64.rpm
027fcf076a0a25ec0c2c14c224c67fc6761d4ef75339a82b2504c76f430b6704  proxysql-3.0.7-1-almalinux8.aarch64.rpm
14532b9ae70a56b96b96089602c8b21ac6a8e56f5e9ffd4e4ba94b2895baff8b  proxysql-3.0.7-1-almalinux8.x86_64.rpm
1ef1cee303960a73b2fcb8b17ebaf7b694e72c67ec5522d795d33f549c899677  proxysql-3.0.7-1-almalinux9-clang.x86_64.rpm
4c664cc7eed8369bfc1ff8e121ad8381c4facb7a59ca76052dea9c322ed4178e  proxysql-3.0.7-1-almalinux9.aarch64.rpm
51dd97c54e97b816834e2c2bb7c25867ccfc004e46fd4f42fbe45f1b6a911aed  proxysql-3.0.7-1-almalinux9.x86_64.rpm
db35429c33d014a3a3037f28a941f0a503e6adff65cb657e1378d18245d297db  proxysql-3.0.7-1-centos10-clang.x86_64.rpm
b182134db5493fd2ca157a25db67c7467fa4cc8b7e4140ca014de43a62cc32d3  proxysql-3.0.7-1-centos10.aarch64.rpm
c860494564a74aa2878bd4e3836ab052c6afe09ff2a42a5a6e26a3264475aa7c  proxysql-3.0.7-1-centos10.x86_64.rpm
b483c7f32b5a4a5385424b10587548aa99236ac7b2a0fed0c85d3ca0b2cfd732  proxysql-3.0.7-1-centos9-clang.x86_64.rpm
f256e39628dfb259f14531f4ed8b4d4c86e953c8be2eb139165fd82be73d045c  proxysql-3.0.7-1-centos9.aarch64.rpm
0d0b694989b4931e2f1cc38e71b2ed2bd728287057d730eee193212fd73b677f  proxysql-3.0.7-1-centos9.x86_64.rpm
7342d6ee15a1d45914dcb06f1ccb145f8aa68b3a9a11fa65ba0510620252b699  proxysql-3.0.7-1-dbg-almalinux10.x86_64.rpm
45025ed74c454929527c264747a1d6efc8da8208c40a5fbec1460ee79238b134  proxysql-3.0.7-1-dbg-almalinux8.x86_64.rpm
2d526d0cb3057f9bcf3f51f805b860b5fce202d40a5c217d160197ae71d7938c  proxysql-3.0.7-1-dbg-almalinux9.x86_64.rpm
1eb62c55385...

ProxySQL 4.0.6 Release Notes

Release date: 2026-03-10

ProxySQL 4.0.6 is the first release of the AI/MCP Tier, introducing experimental generative AI and agentic features directly into the database proxy. It incorporates all improvements from ProxySQL 3.1.6 while adding a native Generative AI Module, a Model Context Protocol (MCP) stack, and an Anomaly Detection subsystem. This version is built using PROXYSQLGENAI=1 and requires the Rust toolchain.

Release commit: 3803f11077f21510b2b43ea7168abf91b54b739e

Highlights (AI/MCP Tier)

• Generative AI Integration: Native bridge to large language models (LLMs) with support for query analysis, routing, and translation.
• Model Context Protocol (MCP): A full MCP server implementation, allowing ProxySQL to act as a data source and tool provider for AI agents.
• RAG (Retrieval-Augmented Generation): High-performance vector ingestion and similarity search subsystem using sqlite-vec.
• Intelligent Anomaly Detection: AI-driven threat detection that identifies abnormal query patterns and potential security risks using semantic analysis.
• AI-Assisted Database Discovery: Automated schema exploration and question learning to help AI agents understand complex database structures.

New Features (4.0.x)

Generative AI & LLM Bridge

Native LLM Connectivity (ae4200d, #5339, #5423)
ProxySQL 4.0.6 introduces a native bridge to interact with external LLMs (e.g., OpenAI, Anthropic, or local models). This includes a generic provider interface, allowing administrators to configure API keys and model parameters via genai_variables. The bridge supports asynchronous LLM calls, ensuring that proxy performance is not blocked during AI processing.

Semantic Query Translation (NL2SQL) (a7dac5e, #5339)
An experimental "Natural Language to SQL" (NL2SQL) converter has been implemented, enabling ProxySQL to translate human-readable descriptions into valid database queries. This is integrated directly into the MySQL_Session handler, allowing for transparent query interception and translation.

Model Context Protocol (MCP) Stack

Native MCP Server (c8a6048d, #5312, #5339)
Implemented a comprehensive MCP server stack that supports both HTTP/HTTPS and stdio transports. This allows ProxySQL to seamlessly integrate with AI agent environments like Claude Code or Cursor. ProxySQL can now expose database schemas, query tools, and diagnostic information as standardized MCP tools.

Multi-Agent Database Discovery (aed042b, #5339)
A sophisticated multi-agent discovery system that uses specialized AI agents (e.g., Security, Metadata) to explore and document database structures. The system generates a comprehensive "Question Catalog" and "Discovery Report," providing AI agents with the necessary context to interact with the database effectively.

Retrieval-Augmented Generation (RAG)

Vector Embedding & Similarity Search (bcefd09, #5423, #5318)
The RAG subsystem provides high-performance storage and retrieval for vector embeddings. Integrated with sqlite-vec, it allows ProxySQL to perform fast semantic similarity searches across database artifacts. This is used to provide context-rich data to LLMs during agentic workflows.

Advanced RAG Ingestion Pipeline (79ee743, #5334, #5330)
The rag_ingest tool has been rewritten to use the MySQL protocol, allowing for high-performance ingestion of documents and data directly into ProxySQL's internal storage. It supports incremental syncing with watermark tracking and detailed logging for auditing.

Intelligent Anomaly Detection

Semantic Threat Identification (52a70b0, #5339)
The new Anomaly Detection subsystem uses AI-driven analysis to identify suspicious query patterns that traditional rule-based systems might miss. It can detect abnormal query structures, potential SQL injection attempts, and unauthorized access patterns by comparing query fingerprints against a database of known threat vectors using semantic similarity.

Features Inherited from v3.1.6 (Innovative Tier)

ProxySQL 4.0.6 includes all features from the v3.1.6 (Innovative) and v3.0.6 (Stable) releases, including:

• Innovative Tier Features: TSDB for historical metrics and FFTO for fast-forward traffic visibility (#5383, #5410).
• Core Stability: All security fixes and protocol hardening from the Stable Tier (#5348, #5429).
• Cross-Platform Support: Full macOS and Fedora 43 compatibility (#5308, #5329).

For a detailed list of these core improvements, please refer to the ProxySQL 3.0.6 Release Notes.

Contributors

ProxySQL is a community-driven project, and we are grateful to all the contributors who helped make this release possible. A special thank you to:

• @rahim-kanji for the extensive work on PostgreSQL protocol hardening and meta-command support.
• @wazir-ahmed for implementing the TSDB subsystem and MCP stack.
• @JavierJF for adding PostgreSQL replication lag monitoring and improving diagnostics.
• @Gonlo2 for critical fixes in connection pool management and SSL handling.
• @mirostauder for build system improvements and Fedora 43 support.
• @evkuzin for enhancing Prometheus metric observability.
• @orbisai0security for identifying and fixing security vulnerabilities.
• @mevishalr for performance optimizations in query logging.

We also thank everyone who reported bugs, tested experimental features, and provided feedback during this release cycle.

Hashes

The release commit is: 3803f11077f21510b2b43ea7168abf91b54b739e

SHA256s:

172d9f3ad5765e93077188c33fa5137d50fbadee178d529aa405854998fd819e  proxysql-4.0.6-1-almalinux10-clang.x86_64.rpm
130ef99a81ae9dd46b158637fff4d9528b28f1539083be2e60f6959e14798440  proxysql-4.0.6-1-almalinux10.aarch64.rpm
4c8d820de55a4343b7bb25eca6bbb3e9c446b4f793a8741a084f7267618597e6  proxysql-4.0.6-1-almalinux10.x86_64.rpm
aa1d7a4c0b3d43eb0627ecc096821e9feebabafa28658b348ef2f3d0956f5944  proxysql-4.0.6-1-almalinux8-clang.x86_64.rpm
438e7c1278aa72658582b0266987825828da6cd8ea4069e685966ef781735e2d  proxysql-4.0.6-1-almalinux9-clang.x86_64.rpm
67a809a8681eb6b7391ed77260e033e7a8be6612111b6d26df9314c171b9f6b1  proxysql-4.0.6-1-almalinux9.aarch64.rpm
1a0595b210cef9a22f6bebf15cd7b7f7c05b96072904354049a5a77c596c2ba1  proxysql-4.0.6-1-almalinux9.x86_64.rpm
920441cc72f740ed1888281105c9b6a22da2a8d9a731945d7045cd8a0e60b490  proxysql-4.0.6-1-centos10-clang.x86_64.rpm
a98f262ae118c06d2dadefad662f6d69d34de15c698c1ec1ed1db6cd759e0dcf  proxysql-4.0.6-1-centos10.aarch64.rpm
47e6fce1ef3d3947c1237f229037c4c23fc7a2a5148847c2915e16c9090c8980  proxysql-4.0.6-1-centos10.x86_64.rpm
e919163f416c658ebd56138ee71518c3806a769377d631801eeb301c7ae745f4  proxysql-4.0.6-1-centos9-clang.x86_64.rpm
786b28bc3ef36e5661596a6f49c48edeba7d5eeffce8bf2724e1a07847911722  proxysql-4.0.6-1-centos9.aarch64.rpm
4fc167fd044c829286522a3d064c440b59c817c441ee56492c09e85dd3db4955  proxysql-4.0.6-1-centos9.x86_64.rpm
2a9f8bc11f203df64a03d812142da3dbcbde73d6e24a58473e9ea207bca9c1b9  proxysql-4.0.6-1-dbg-almalinux10.x86_64.rpm
698f12a01894fbe2fe4c69fa3c431f58833f4c63c22601de514e2a3d52c495db  proxysql-4.0.6-1-dbg-almalinux9.x86_64.rpm
7fd1957540c9e76cb388da9a95f7c64965b6815447303ba8cc794b3ff7485c2a  proxysql-4.0.6-1-dbg-centos10.x86_64.rpm
ca8765f43904cbd649240659543424a77fd3f9c62934b457e2527361b54c363e  proxysql-4.0.6-1-dbg-centos9.x86_64.rpm
886da3556952f482ba3dbe961a655512756e13d2cce24f8b6d5291845126a5a5  proxysql-4.0.6-1-dbg-fedora42.x86_64.rpm
9a0a148e187a2fcbb096ddb5ddbb143ff7dfd2cfb078955fc6b62fa2947c4f5a  proxysql-4.0.6-1-dbg-fedora43.x86_64.rpm
d72da5bffdd7b578c4a10b233e03fe027095dac5cecdcc54c00f0fe5114d6d1a  proxysql-4.0.6-1-dbg-opensuse16.x86_64.rpm
35c9140968f7522c77ee9c232f94edf4b6b2bf0fcdb0fabf479bf085debb6060  proxysql-4.0.6-1-fedora42-clang.x86_64.rpm
0779ba5161032caf0d325c8b95a502806fcb42289aa32e3e99e2ff7904c5a05a  proxysql-4.0.6-1-fedora42.aarch64.rpm
6fe23a756e255aa624b81f0a37b52197c3ad274da6fc402b93745b476bdda7c3  proxysql-4.0.6-1-fedora42.x86_64.rpm
acd7d0862f70989424b6fc52dc18c0c70162bd2c3a06701da1ee0c6056f40032  proxysql-4.0.6-1-fedora43-clang.x86_64.rpm
988e17bf218ed905161756dc78759f61ddc232c84a52aafb4222b077f8353b28  proxysql-4.0.6-1-fedora43.aarch64.rpm
03a43055edf37a8eb60fa74a4f9b8961696406e226fe2cfdd6ae854d69283d7f  proxysql-4.0.6-1-fedora43.x86_64.rpm
b8e3e29163b8afcd7922bb9ee080abe995394915e0806a575d38fa2de4f758d1  proxysql-4.0.6-1-opensuse16-clang.x86_64.rpm
2ef8d8354cf339403a65ffcdf513af99fd9f91b8bceebce2bebaa76f43d4f77d  proxysql-4.0.6-1-opensuse16.aarch64.rpm
f4526e8b60942ba834af6055fd9881d321afe32fcaa08412dae8bf3b42648bc6  proxysql-4.0.6-1-opensuse16.x86_64.rpm
13ccbe0d012b8f2daf699a41fbb1ead8ec52912599046ae30bee5a34a53732e8  proxysql_4.0.6-dbg-debian12_amd64.deb
0b87a40c661c36df3bb0fdacfe6ee0b221793021927f9dcf6ad12702aa3e6721  proxysql_4.0.6-dbg-debian13_amd64.deb
9affd0b80cb0f814e3bfdd1f1a6f66562fccb2f9e5fd6f3dadd289cee4a3f50c  proxysql_4.0.6-dbg-ubuntu22_amd64.deb
2566e66d1cb2274a8c8c50969b3de0b46fd7f40590f0138b4d36681ff57eceda  proxysql_4.0.6-dbg-ubuntu22_arm64.deb
532318088ad1918fe61c82e1fa049430ed5a301e5d49d22556990ea5d58253da  proxysql_4.0.6-dbg-ubuntu24_amd64.deb
e0f5d541d6fc267e1c1f3fc294deb7102b2af9d10e54cb363177e1a22b5d8bc1  proxysql_4.0.6-dbg-ubuntu24_arm64.deb
dd9a38eb50385603077edf2281894de6ffdf6a740fc5f111da87dc9a95553a40  proxysql_4.0.6-debian12-clang_amd64.deb
79b949dc784bfed8e885570ed87370782a9df232b13fa9075a4d9cdff71e2490  proxysql_4.0.6-debian12_amd64.deb
4cde82e480cdca20e6929573c7ab6377ac1d06307524ae1fffea71e5fcaca603  proxysql_4.0.6-debian12_arm64.deb
b48c23287aeb8841a13224054336d1c5df03543a570ebe25b0f72c04f8b2d2be  proxysql_4.0.6-debian13-clang_amd64.deb
08b5e7994180acd8fffc05649845d8d51c1ba42e72938cafd7afb32a6588251b  proxysql_4.0.6-debian13_amd64.deb
1583dd...

ProxySQL 3.1.6 Release Notes

Release date: 2026-03-10

ProxySQL 3.1.6 is the first release of the Innovative Tier, introducing revolutionary observability features built directly into the proxy. It incorporates all improvements from ProxySQL 3.0.6 while adding the Embedded Time-Series Database (TSDB) and the Fast Forward Traffic Observer (FFTO). This version is built using PROXYSQL31=1.

Release commit: 3803f11077f21510b2b43ea7168abf91b54b739e

Highlights (Innovative Tier)

• Embedded Time-Series Database (TSDB): A native, high-performance metric storage subsystem capable of recording historical performance data for long time.
• Fast Forward Traffic Observer (FFTO): Deep observability for traffic in fast-forward mode, allowing administrators to inspect and analyze traffic that was previously "invisible" to ProxySQL's query logging.
• Native Monitoring Dashboard: A built-in web dashboard leveraging the TSDB to provide real-time and historical performance visualization.
• Comprehensive Release Tiers: Introduction of the tier-based build system to provide clear upgrade paths for stable, innovative, and experimental features.

New Features (3.1.x)

Embedded Time-Series Database (TSDB)

Native Metric Storage (f17e999, #5383, #5426)
ProxySQL 3.1.6 introduces a native, high-performance TSDB subsystem. This subsystem automatically samples and records internal metrics, backend health status, and query execution statistics. By storing this data in an optimized and embedded SQLite-based database, ProxySQL can provide historical performance analysis without requiring external monitoring infrastructure. Configuration is managed via the new tsdb- prefixed variables.

Historical Monitoring Dashboard (c73011b, #5383)
Leveraging the TSDB, ProxySQL now includes a built-in monitoring dashboard accessible via the HTTP server. This dashboard provides visual representations of backend health, connection pool utilization, and query latency over time, allowing for rapid identification of performance trends and anomalies.

Fast Forward Traffic Observer (FFTO)

Visibility for Fast-Forwarded Traffic (3a3be5a, #5410)
In previous versions, traffic routed through ProxySQL in "fast-forward" mode (direct packet-level forwarding) bypassed the query logging and statistics gathering modules. FFTO addresses this limitation by implementing a non-blocking observer that analyzes the packet stream in real-time. This provides visibility into query patterns and execution counts even for traffic that is being forwarded with minimal overhead.

Protocol-Aware Traffic Analysis (40aff57, #5410)
FFTO is fully compatible with both MySQL and PostgreSQL protocols. It can reconstruct query boundaries, identify statement types, and record metrics such as affected_rows and rows_sent for fast-forwarded sessions. This data is exposed through new statistics tables and can be exported to external monitoring systems.

Features Inherited from v3.0.6 (Stable Tier)

ProxySQL 3.1.6 includes all features, bug fixes, and improvements from the v3.0.6 release, including:

• Security Hardening: Secure SCRAM authentication replacing strtok usage (#5348).
• PostgreSQL Meta-Commands: Support for \d, \dt, \l in the Admin interface (#5367).
• Protocol Resilience: Hardened PostgreSQL protocol handling and malformed packet validation (#5429).
• macOS Support: Full compatibility with macOS (Darwin/Apple Silicon) (#5308).
• Prometheus Labels: Protocol-specific labeling for ambiguous metrics (#5361).

For a detailed list of these core improvements, please refer to the ProxySQL 3.0.6 Release Notes.

Contributors

ProxySQL is a community-driven project, and we are grateful to all the contributors who helped make this release possible. A special thank you to:

• @rahim-kanji for the extensive work on PostgreSQL protocol hardening and meta-command support.
• @wazir-ahmed for implementing the TSDB subsystem and MCP stack.
• @JavierJF for adding PostgreSQL replication lag monitoring and improving diagnostics.
• @Gonlo2 for critical fixes in connection pool management and SSL handling.
• @mirostauder for build system improvements and Fedora 43 support.
• @evkuzin for enhancing Prometheus metric observability.
• @orbisai0security for identifying and fixing security vulnerabilities.
• @mevishalr for performance optimizations in query logging.

We also thank everyone who reported bugs, tested experimental features, and provided feedback during this release cycle.

Hashes

The release commit is: 3803f11077f21510b2b43ea7168abf91b54b739e

SHA256s:

c6dd6660abb1d326cf07105cd0b37ee88b32cacc4b7a871ff71b53d1ab7fecd6  proxysql-3.1.6-1-almalinux10-clang.x86_64.rpm
6ac343ec8c9272886dc9b8b86b099803288b0a55eb340683e37d296714f507ca  proxysql-3.1.6-1-almalinux10.aarch64.rpm
9cd37ba870f462ed8c8d267e54b222d6ad2aede0d823a2c63c256d2ffe6a380f  proxysql-3.1.6-1-almalinux10.x86_64.rpm
c43c4e942a6fccec15531897dc907d03a668b06de0e4cf887fe25fded5632924  proxysql-3.1.6-1-almalinux8-clang.x86_64.rpm
40c4df5215ad410161dd314716ad55196189fa53c43b1b919e9cdfab1caaa562  proxysql-3.1.6-1-almalinux8.aarch64.rpm
42cc70fd81cac7d697403366a33fd54f4d318bf048852bcbc0275290aca0b9ee  proxysql-3.1.6-1-almalinux8.x86_64.rpm
9017bcebf7d04c329b11890cdabd71946987811b2fc98061426dc0c25ca321e4  proxysql-3.1.6-1-almalinux9-clang.x86_64.rpm
7da8cdbe935c4b17e1793ae934b3d7caa9484e26a0911f7040091b29b9390387  proxysql-3.1.6-1-almalinux9.aarch64.rpm
90f08da700258ed7fb8270b8f09e911befcecd02c91a730c8a2f181b16791207  proxysql-3.1.6-1-almalinux9.x86_64.rpm
52c35bf716ce44d60bfbc473aa6e8180e55d57755986297e81ddd7614dae57fb  proxysql-3.1.6-1-centos10-clang.x86_64.rpm
e59c81d668fb9054d86203e381825fee02ba9df5672c57bb24928a5bdc4fb777  proxysql-3.1.6-1-centos10.aarch64.rpm
ef02c1c031ec83905b2b57f787b1185b8f05d4d6f1c846b405547dd661cc15f1  proxysql-3.1.6-1-centos10.x86_64.rpm
540c3d9b9af8becb3c40c75cff7634d51801a4e6558767f88ea5a8543733a12c  proxysql-3.1.6-1-centos9-clang.x86_64.rpm
31033db686f9fef45f6e8c75801fd717c437a7bad868fd3671abb59763c3d7ed  proxysql-3.1.6-1-centos9.aarch64.rpm
a409810f43d4f5f3bac617830d0ae94deea7f088aed52153dd08b29a412451a8  proxysql-3.1.6-1-centos9.x86_64.rpm
7d78240dd012b848a30ba0a0ee32a348a467339b4536928f48546bb5265a3865  proxysql-3.1.6-1-dbg-almalinux10.x86_64.rpm
139eaf0a5df93d8b497253cc6c546fa2bb05b5eb59724457f4e3143e0c83cb35  proxysql-3.1.6-1-dbg-almalinux8.x86_64.rpm
df14371648f1128c09e04bc24cd7169aaa271d80900c856f1266701de682b0e6  proxysql-3.1.6-1-dbg-almalinux9.x86_64.rpm
48f4324277c719b2ef7de6660c2aaadab4c0a537e96b7424afda0b648cb2f54d  proxysql-3.1.6-1-dbg-centos10.x86_64.rpm
6cd3560174a4e703fba4c675439612551da1dc71d56da5236c4a44d15022da2d  proxysql-3.1.6-1-dbg-centos9.x86_64.rpm
9f7595147c819ea8761dd4ab6a9005aaef4e0504b95e12767c8c46b0458bb3d9  proxysql-3.1.6-1-dbg-fedora42.x86_64.rpm
71260c70004542a606e95f2ab866a55898228b7564751865152ce3a2bf385aaf  proxysql-3.1.6-1-dbg-fedora43.x86_64.rpm
c5027caeadb428195a8e10c6bb88aeae5525221659eb2265039cde8cb46c418a  proxysql-3.1.6-1-dbg-opensuse15.x86_64.rpm
4c90070ef52fc92abd7b9a55f5024b208f4e6540976a7399ad25da3bd77ac968  proxysql-3.1.6-1-dbg-opensuse16.x86_64.rpm
97472c0b0410438c1941561604f5bab625f2f5668b7ce30e51a2604aa0ddd153  proxysql-3.1.6-1-fedora42-clang.x86_64.rpm
c156ce0d6f4df277a4b7123d8ad286184ba67c04709f2b044e663f0bfaeec237  proxysql-3.1.6-1-fedora42.aarch64.rpm
af1e21fd368498a484c3cb619a132b5eaf5c278a9a412cf9235509f2a3c9630b  proxysql-3.1.6-1-fedora42.x86_64.rpm
31490630cfe94588adc3816d720719fcc7519e6670df6df043245c359bdda176  proxysql-3.1.6-1-fedora43-clang.x86_64.rpm
66d0b35302a1e7f5c64dea13edfd75a22cef2350a322b1d2a160d2c6c7af8d70  proxysql-3.1.6-1-fedora43.aarch64.rpm
930c490a85264ac162b83ac006191df9e6a7bf846eeabec0e525bbf8001dc258  proxysql-3.1.6-1-fedora43.x86_64.rpm
8c57529f3bce1cc53945b1a4266919929f3b5ce72789e5df834c47363e977203  proxysql-3.1.6-1-opensuse15-clang.x86_64.rpm
f8bf88de7e2eccff13181ae1fa79122ce72853690315c55b67ed77120f65f999  proxysql-3.1.6-1-opensuse15.aarch64.rpm
63cf0ad07623d78ecfd28b836781fee7ff6e22f832f409d8b3138219a2589284  proxysql-3.1.6-1-opensuse15.x86_64.rpm
30dea4eb9dc356695752254b530b0c3e5a10467aa692b655da0565c4b4e3a9a8  proxysql-3.1.6-1-opensuse16-clang.x86_64.rpm
22799609e01d09a38d9c20a051a2a283050de4691365c41d8041e894a21646bc  proxysql-3.1.6-1-opensuse16.aarch64.rpm
5c5f2eda6c5c62ea085ebeaf6024df6f89a0bb96140ad50ac281207e212d2f46  proxysql-3.1.6-1-opensuse16.x86_64.rpm
e696c5925c7adbd6b423d06799ec5ced9753f850ac0a3ae79c0ba50917927363  proxysql_3.1.6-dbg-debian12_amd64.deb
0c1bca285893ac7cb5d338af1891653b2c6237ed589ec2d022f887323282fbb5  proxysql_3.1.6-dbg-debian13_amd64.deb
3fd6b7647b9cf4bf6205a5c091bf71211bc95a48246ba131d536c907531cec07  proxysql_3.1.6-dbg-ubuntu22_amd64.deb
3a9758bedf337dfef40279835bb0519082d644be8cbe1395c35d15bf5fcbef93  proxysql_3.1.6-dbg-ubuntu22_arm64.deb
ff70c4d5f769a7e2c7c5186e92fb63e70cc830cf0c62b58bc47c7a11fb4dff6e  proxysql_3.1.6-dbg-ubuntu24_amd64.deb
47f7325579aa4b4818fea28d352fc515857dfb148db2f0c1fbe7cdfd46bf544b  proxysql_3.1.6-dbg-ubuntu24_arm64.deb
a0258c91f5ee6f658ae8753efea11804537b85412d8eec5c2571e37c5414270f  proxysql_3.1.6-debian12-clang_amd64.deb
a771810b803975f7da64965afb6b6e4b15fb6be0e0bd28bde1475f1a6c14b85c  proxysql_3.1.6-debian12_amd64.deb
73d3a0c96662c89d5ebcd4f6fdf5c4340c9e3437583c3ad2b5eb15bf9805d78e  proxysql_3.1.6-debian12_arm64.deb
d40985a791c38225a54954cd39ef0188f244bd681042b23062931fe6f3e54bbd  proxysql_3.1.6-debian13-clang_amd64.deb
77819cca79b66ac378d32509620f1eb1552e4b2e7149a1170d86720ff518bbaf  proxysql_3.1.6-debian13_amd64.deb
dde9bd409a7f62c7e69c51a777fca2cd12d108d0a5ed5ada1dbfc1e3c48df760  proxysql_3.1.6-debian13_arm64.deb
37fa35e9bbd01206bfd1cf46c08ce7924f213e5ed2cf844ea98fad8e4f6fddaa  proxysql_...