curl --proto '=https' --tlsv1.2 -LsSf https://github.com/tursodatabase/turso/releases/download/v0.8.4-pre.3/turso_cli-installer.sh | sh

powershell -ExecutionPolicy Bypass -c "irm https://github.com/tursodatabase/turso/releases/download/v0.8.4-pre.3/turso_cli-installer.ps1 | iex"

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo tursodatabase/turso

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

• [33d4e6c73a] - (SEMVER-MINOR) child_process: add subprocess.timedOut (Marco) #66639
• [edc7ec4a77] - (SEMVER-MINOR) crypto: make X.509 inspection guards explicit (Filip Skokan) #67245
• [0882e9729b] - (SEMVER-MINOR) crypto: add X.509 generation with CSR support (Filip Skokan) #67245
• [2360d3860e] - (SEMVER-MINOR) dns: coalesce identical concurrent lookup() requests (Orgad Shaneh) #62599
• [dc4aa75983] - doc: add efekrskl to collaborators (Efe Karasakal) #67376
• [9695304ab8] - doc: add Philipp Dunkel to contributors (Philipp Dunkel) #67378
• [41db1f7b6b] - doc: add christianaurichzm to collaborators (Christian Aurich Zanettini Martins) #67377
• [6b8a90d41d] - (SEMVER-MINOR) http: batch body spans per parser execute (Guilherme Araújo) #67187
• [8ffcb3ee55] - (SEMVER-MINOR) sea: generate a compile cache for the VFS modules (Matteo Collina) #66768
• [2bbcfa0718] - (SEMVER-MINOR) worker: preload streams into startup snapshot (Matteo Collina) #66311

• [81d2321054] - benchmark: add URLSearchParams iterator consumers benchmark (Kevin Gibbons) #66837
• [04b4552a77] - Revert "benchmark: add URLSearchParams iterator consumers benchmark" (Antoine du Hamel) #66837
• [3ac0b42fb6] - benchmark: add URLSearchParams iterator consumers benchmark (Kevin Gibbons) #66837
• [cdef4ac92b] - benchmark: merge crc32c into crc32 zlib benchmark (Trivikram Kamat) #67004
• [faf48bfc07] - buffer: limit UTF-8 fast calls to safe one-byte strings (Robert Nagy) #67136
• [b7aab20d60] - build: separate host and target Rust artifacts in cross builds (Yuya Inoue) #66823
• [829afea634] - build: refresh markdown lint dependencies on lockfile changes (Yuya Inoue) #67185
• [d9292c4a93] - build: sync Torque outputs with V8 (Filip Skokan) #67238
• [9fca7e78bd] - build: use a single producer for shared generated files (Yuya Inoue) #66804
• [5848a08450] - build: sort the ICU source lists (Shelley Vohr) #67206
• [0e1891a0e2] - build: set V8_DISABLE_PRESERVE_MOST (Joyee Cheung) #67093
• [9c57966fb6] - build: error on incompatible dtls configure flags (Antoine du Hamel) #66947
• [0487449970] - build: fix overriding node_path in GN build (David Babenko-Sanders) #66805
• [c617a93aa9] - build: remove unused FIPS export condition (Filip Skokan) #67005
• [823549f0da] - build,win: minify pgo training build (Stefan Stojanovic) #67214
• [2f89ed5fde] - child_process: inherit a reassigned process.env (Caleb Everett) #66883
• [33d4e6c73a] - (SEMVER-MINOR) child_process: add subprocess.timedOut (Marco) #66639
• [42933d1749] - crypto: remove the FIPS provider name check (Filip Skokan) #67358
• [edc7ec4a77] - (SEMVER-MINOR) crypto: make X.509 inspection guards explicit (Filip Skokan) #67245
• [0882e9729b] - (SEMVER-MINOR) crypto: add X.509 generation with CSR support (Filip Skokan) #67245
• [d02681572b] - crypto: fix ncrypto provider behavior (Brad Anderson) #67039
• [0c4d131adf] - crypto: prevent stale OpenSSL errors (Matteo Collina) #67225
• [33d28a1fed] - crypto: reuse HMAC contexts in createHmac() (Yagiz Nizipli) #67109
• [b9248dc829] - crypto: skip clearing empty OpenSSL error queues (Yagiz Nizipli) #67109
• [216f1238cd] - crypto: cache digests for synchronous operations (Yagiz Nizipli) #67109
• [5991efaf17] - crypto: skip DH checks for recognized groups (Filip Skokan) #67071
• [7b8589b5b0] - crypto: add X509Certificate inspection getters (Filip Skokan) #67082
• [ab5da00e5d] - crypto: reject immutable random fill buffers (Filip Skokan) #66944
• [1d297add9e] - crypto: preserve errors during X.509 issuer checks (Filip Skokan) #66898
• [5409ed48c9] - crypto,tls: clone X.509 chains across isolates (Filip Skokan) #66898
• [988d73f171] - deps: update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038
• [cb3be3e9b5] - deps: update nghttp2 to 1.71.0 (Node.js GitHub Bot) #67331
• [2539d1cb3f] - deps: update ngtcp2 to 1.26.0 (Node.js GitHub Bot) #67257
• [64cdd369d3] - deps: patch V8 to 15.6.75.50 (Node.js GitHub Bot) #67335
• [866be801c1] - deps: update simdjson to 5.1.1 (Node.js GitHub Bot) #67332
• [0c0d945a18] - deps: update undici to 8.12.4 (Node.js GitHub Bot) #67272
• [4cc7d1bea6] - deps: upgrade npm to 12.2.2 (npm team) #67265
• [0c0d3ee663] - deps: V8: cherry-pick c38986131c02 (Joyee Cheung) #67093
• [efd0b5af1a] - deps: load amaro from dist/internal.js (Geoffrey Booth) #66144
• [51ce159d04] - deps: update amaro to 1.3.0 (Node.js GitHub Bot) #66144
• [38da2b9ad9] - deps: update perfetto to 59.1 (Node.js GitHub Bot) #67171
• [c32c7e8d87] - deps: update simdjson to 5.1.0 (Node.js GitHub Bot) #67172
• [be9989a092] - deps: patch V8 to 15.6.75.33 (Node.js GitHub Bot) #67174
• [2360d3860e] - (SEMVER-MINOR) dns: coalesce identical concurrent lookup() requests (Orgad Shaneh) #62599
• [402682ed79] - doc: update readable.read() for v26 one-chunk behaviour (Fuma) #67341
• [dc4aa75983] - doc: add efekrskl to collaborators (Efe Karasakal) #67376
• [9695304ab8] - doc: add Philipp Dunkel to contributors (Philipp Dunkel) #67378
• [41db1f7b6b] - doc: add christianaurichzm to collaborators (Christian Aurich Zanettini Martins) #67377
• [ffed2aa208] - doc: fix process import in test runner workerId example (Daijiro Wachi) #67316
• [c685695fae] - doc: clarify process.loadEnvFile variable precedence (manjit singh) #67276
• [02f6efa9ed] - doc: fix security pre-alert template (Antoine du Hamel) #67240
• [96384231d5] - doc: fix execFile/execFileSync shell option docs (Paul Bouchon) #64437
• [ce1da53916] - doc: document C++ formatting in the pull request guide (Yuya Inoue) #67205
• [05902663d1] - doc: describe how the permission model grants the entrypoint (Rafael Gonzaga) #67038
• [3f12612157] - doc: correct DEP0199 runtime deprecation listing (Mike McCready) #67167
• [f5f18c704f] - doc: add LIEF to the dependency list (Yuya Inoue) #67165
• [6cffd6a9fd] - doc: ffi rename OS/400 -> IBM i (Abdirahim Musse) #67144
• [d3cf7a8b04] - doc: list CVE-2026-106072 in v24 changelog (inoway46) #66984
• [a806217855] - doc: list CVE-2026-106072 in v22 changelog (inoway46) #66984
• [5a5870066d] - doc: remove CI lockdown steps from security releases (Ulises Gascón) #67116
• [24d18ef520] - doc: clarify that V8 major upgrade uses stable release (Joyee Cheung) #67106
• [1cb68c9730] - doc: note linear history rule on branch-off (Rafael Gonzaga) #67057
• [7a3c6c564a] - doc: remove outdated platform note for --watch-path (yuki motokane) #66749
• [12a857a938] - doc: fix sqlite tagged template examples (Donghoon Kang) #66920
• [8570dfe348] - ffi: reject multi-argument buffer fast trampolines (Trivikram Kamat) #67046
• [a1bdd2dbbd] - ffi: reject signature conflicts from getFunctions getters (Trivikram Kamat) #67194
• [e64878bd2b] - ffi: support function calls from pointers (Damiano Mazzella) #66458
• [730e55a0f7] - ffi: make Fast API functions collectable (Trivikram Kamat) #67177
• [89db5c3e4c] - ffi: define function pointer property as own data property (Trivikram Kamat) #67170
• [7a24b2b9fc] - ffi: keep DynamicLibrary alive while callbacks are registered (Trivikram Kamat) #66842
• [883c6a68f2] - ffi: reject arguments after callback in registerCallback (Trivikram Kamat) #66997
• [1f63811af7] - ffi: accept -0 for int32 and uint32 arguments (Trivikram Kamat) #67035
• [78227c9a35] - ffi: free libuv error message on failed dlopen (Trivikram Kamat) #67007
• [0c5be929a5] - fs: keep readFile abortable on non-regular files (Christian Aurich Zanettini Martins) #66940
• [b9cdb3dbab] - fs: resolve symlinks before parent components (Jason Zhang) #65457
• [a30f200093] - fs: fix cpSync() abort when dest is a dangling symlink (Yohannes Desta) #67142
• [2d7c6c1983] - fs: fix readFileSync utf8 overflow on short reads (Christian Aurich Zanettini Martins) #66939
• [94c0e06803] - fs: do not swallow exceptions thrown by completion callbacks (Marco) #66308
• [b25b4960e0] - http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001
• [6c5b08e1fc] - http: never execute llhttp re-entrantly (Matteo Collina) nodejs-private/node-private#1021
• [6c9747ff7b] - http: emit 'drain' after flushing coalesced chunks (junyup0503) #66782
• [6b8a90d41d] - (SEMVER-MINOR) http: batch body spans per parser execute (Guilherme Araújo) #67187
• [a947ae418e] - http2: retain streams during pending writes (Matteo Collina) nodejs-private/node-private#1040
• [e766c3db0e] - http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) nodejs-private/node-private#1000
• [46fd313a45] - http2: retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017
• [0eebafb726] - http2: release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026
• [be2898b11f] - http2: avoid overflowing ALTSVC buffers (Matteo Collina) nodejs-private/node-private#1035
• [e1ae779fec] - http2: preserve multiple content-encoding values (Yuya Inoue) #67184
• [91a070d1d7] - http2: handle errors on compat push response streams (Matteo Collina) #67053
• [8d45d5b69e] - http2: exclude queued data from response memory checks (Yuya Inoue) #67114
• [ed688a4662] - http2: release queued data memory on stream cancellation (Yuya Inoue) #67113
• [0002058aa2] - http2: clear the session timeout before marking it destroyed (Huang-404-Q) #66886
• [69cca8726f] - https: isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036
• [70d664a745] - inspector: fix out-of-bounds read in ws frame decoding (nashit hayat) #64618
• [1cc7ddc89f] - lib: replace Kahan summation with MathSumPrecise (Livia Medeiros) #67222
• [605b1f9c69] - lib: place value before done in iterator results (Kevin Gibbons) #66837
• [6ad44ecc50] - meta: bump rtCamp/action-slack-notify from 2.4.0 to 2.4.1 (dependabot[bot]) #67190
• [57ab9a4363] - meta: bump step-security/harden-runner from 2.21.1 to 2.22.3 (dependabot[bot]) #67191
• [044da7e905] - meta: bump cachix/install-nix-action from 31.11.1 to 31.11.3 (dependabot[bot]) #67019
• [3f639bd72c] - meta: bump ossf/scorecard-action from 2.4.4 to 2.5.0 (dependabot[bot]) #67020
• [5889278d22] - meta: bump actions/setup-python from 7.0.0 to 7.1.0 (dependabot[bot]) #67021
• [5757587d8e] - meta: bump actions/setup-node from 7.0.0 to 7.1.0 (dependabot[bot]) #67032
• [ed4fe08c01] - meta: bump actions/download-artifact from 8.0.1 to 8.0.2 (dependabot[bot]) #67018
• [481145443e] - meta: bump actions/upload-artifact from 7.0.1 to 7.0.2 (dependabot[bot]) #67024
• [dc4ef78fe3] - meta: bump github/codeql-action/init from 4.38.2 to 4.39.1 (dependabot[bot]) #67028
• [9b434b2f52] - module: avoid reparsing package.json in esm format detection (Gürgün Dayıoğlu) #66982
• [1eb7ba8575] - module: cache compiled WebAssembly modules in the compile cache (Guy Bedford) #66191
• [8cbc539c37] - net,tls: fix session reuse with provided sockets (Harjoth Khara) #64430
• [f2c56a628f] - node-api: fix crash on TSFN finalization reentrance at shutdown (Chengzhong Wu) #65967
• [5e1dad2e15] - permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967
• [debf2daff1] - permission: prefer --permission over audit mode (Rafael Gonzaga) #67036
• [236355a392] - querystring: precompute Latin-1 escapes (Roberto Bianchi) #66756
• [ab9d401b4d] - quic: retain readers for readable streams (Dustin) #66407
• [d51e377a61] - quic: fix crypto error classification (Efe Karasakal) #66968
• [09718032b7] - quic: fix internal error code conversion (Efe Karasakal) #66967
• [26a8d53b92] - sea: mount the SEA VFS in workers at layer 0 (Manjeet Singh) #67239
• [8ffcb3ee55] - (SEMVER-MINOR) sea: generate a compile cache for the VFS modules (Matteo Collina) #66768
• [1774391f3e] - sqlite: add ReadOptionalString helper (Guilherme Araújo) #67042
• [0b223c67ec] - sqlite: use 64-bit result APIs for UDF return values (Guilherme Araújo) #67089
• [9c381d00b3] - sqlite: cache the SQLTagStore constructor template (Guilherme Araújo) #66912
• [c38a50365c] - sqlite: settle BackupJob through a single exit point (Guilherme Araújo) #66912
• [2ec332989b] - sqlite: use DeleteFnPtr for all SQLite handles (Guilherme Araújo) #66912
• [5bc98ec49d] - sqlite: track statements in the Statement constructor (Guilherme Araújo) #66912
• [464ab31405] - src: do not enable the inspector during snapshot building (Joyee Cheung) #67154
• [48428365fc] - src: make crypto backend checks explicit (Filip Skokan) #67056
• [9d86291e8b] - stream: trim webstreams sink wrappers and BYOB transfers (Matteo Collina) #66702
• [58eb15cd6b] - stream: fix pipeTo assert when writer is released during microtask (Qingyu Wang) #63733
• [c05a97a625] - stream: reject writes during WritableStream close (Matteo Collina) #67058
• [101e729044] - stream: keep async context of fromWeb writes (Matteo Collina) #67055
• [caa48a3302] - stream: keep async context of pipeTo watchers (Matteo Collina) #67052
• [6c7ff35f61] - test: fix X.509 generation with OpenSSL 4.1 FIPS (Filip Skokan) #67409
• [b0251889a8] - test: update WPT for WebCryptoAPI to e87deca336 (Node.js GitHub Bot) #67330
• [7667a8fd5b] - test: deflake test-runner-mock-timers-scheduler (Yuya Inoue) #67296
• [d6b8579deb] - test: deflake test-worker-eventlooputil (Matteo Collina) #67260
• [030c9536ab] - test: skip readFileSync pipe test without proc io (Jay) #67242
• [7b5b6fb2a3] - test: fix test-config-json-schema with --openssl-use-def-ca-store (Antoine du Hamel) #67200
• [8163152f5d] - test: use experimental flags in wpt tests (Aviv Keller) #67258
• [e858561f1a] - test: use valid PBKDF2 inputs in domain test (Filip Skokan) #67250
• [8ed89aad0b] - test: cover crypto digest and HMAC caches (Yagiz Nizipli) #67109
• [a7569c8d1b] - test: extend http2 cancellation coverage (fatih) #66784
• [04ffe27e00] - test: fix cluster dgram 1 test on macos (gegham1) #66986
• [df0f575044] - test: convert forEach to for of test-buffer-inheritance file (Antonio Duran) #67121
• [cbffa1a8d4] - test: replace for each with for of (Sergio Calderon) #67122
• [ed3bb858bd] - test: use spawnSyncAndAssert in nested async stack overflow test (Antonio Duran) #67123
• [6a561240f9] - test: convert .forEach to for...of (Jan Peer Stöcklmair) #67124
• [c89556683c] - test: convert .forEach to for...of in test-net-write-arguments.js (Emmanuel Florencio Trujillo) #67125
• [9e459f31c5] - test: convert for each to for of in test/parallel/test-net-server-close (Raymundo Lopez Santiago) #67127
• [2f799303ab] - test: use for...of in test-require-resolve-invalid-paths (Raul Garcia) #67128
• [10d1485965] - test: deflake test-worker-message-port-transfer-filehandle-fd0 (Christian Aurich Zanettini Martins) #66980
• [569ef753f4] - test: remove duplicate common imports (Livia Medeiros) #67088
• [bdbe9862ba] - test: add test for concurrent first use of OpenSSL (Christian Aurich Zanettini Martins) #66966
• [a04eeff08c] - test: use registerHooks() over module.register() (Geoffrey Booth) #67074
• [b08c226c6a] - test: update test426-fixtures to fae1fa49815813088c433e8486e330e8d953a44 (Node.js GitHub Bot) #66815
• [f1cb89b976] - tls: fix remotely reachable TLS server crash (Tim Perry) nodejs-private/node-private#1018
• [3fa5ee2923] - tls: disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030
• [1ddeffb2f8] - tls: don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#1030
• [7686e25c3b] - tls: don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#1030
• [ed11b570d5] - tls: apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020
• [40764cfdbe] - tls: reject hostnames with forbidden code points (Matteo Collina) #67254
• [754b3884c8] - tls: test the SPKI blocklist with a fixture key (Ulises Gascón) #66949
• [22ba5857c6] - tls,http: prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#1021
• [524341e94f] - tools: restore FIPS testing with default OpenSSL (Filip Skokan) #67248
• [6b6745a6f0] - tools: aggregate Nix changes in a table (Antoine du Hamel) #67348
• [ab1e78530c] - tools: update nixpkgs pins (Node.js GitHub Bot) #67334
• [576eef4d80] - tools: use vendored trust store in shell.nix (Antoine du Hamel) #67318
• [ace3168084] - tools: use ubuntu-latest for public lint-js-and-md jobs (Yuya Inoue) #66409
• [edb6ab2fcc] - tools: warn when undici WPT report is missing (Filip Skokan) #67229
• [1686e8a99f] - tools: require value before done in iterator results (Kevin Gibbons) #66837
• [ae76a8be70] - tools: bump the eslint group in /tools/eslint with 2 updates (dependabot[bot]) #67189
• [ffac5539af] - tools: bump nixpkgs pins (Node.js GitHub Bot) #67173
• [2c2f6960dd] - tools: avoid rewriting same-version OpenSSL updates (Filip Skokan) #66999
• [356b720a46] - tools: remove node.gyp and node.gypi from v8.nix requisites (Antoine du Hamel) #66955
• [2f2d9c8d97] - tools: fix number comparison if Nix diff viewer (Antoine du Hamel) #66904
• [ead445d544] - tools: bump the eslint group in /tools/eslint with 5 updates (dependabot[bot]) #67025
• [9b99178707] - tools: bump piscina from 5.2.0 to 5.3.2 in /tools/doc (dependabot[bot]) #67026
• [5b8a2e0937] - tools: bump undici from 6.28.0 to 6.29.1 in /tools/doc (dependabot[bot]) #67027
• [b6e024af18] - tools: update gyp-next to 0.22.4 (Node.js GitHub Bot) #66988
• [908e3cd6ca] - tools: do not lint GYP JS files (Antoine du Hamel) #66988
• [2632ab72f3] - typings: fix internal type resolution (Seongeun Lee) #66512
• [2e27c83dd2] - typings: share Sign and Verify handle methods (Seongeun Lee) #66499
• [e2bf68811e] - url: use indexed appends in search params getAll (Roberto Bianchi) #66872
• [555bcfbbae] - util: use internal hexSlice directly in util.inspect() (Livia Medeiros) #66974
• [ec1e1e32d8] - v8: support X509Certificate serialization (Filip Skokan) #67083
• [dfb6dba9e3] - vfs: do not reuse the path of a loaded memfd image (Philipp Dunkel) #67068
• [6d44119d95] - vfs: place value before done in iterator result (LiviaMedeiros) #67231
• [76147a47c4] - vfs: forward the watchFile listener through RealFSProvider (Trivikram Kamat) #66224
• [819d9fdce6] - watch: track all dependencies of an owner (Christian Aurich Zanettini Martins) #66139
• [2bbcfa0718] - (SEMVER-MINOR) worker: preload streams into startup snapshot (Matteo Collina) #66311
• [d5a5280451] - zlib: handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037
• [bf7bef4025] - zlib: avoid an extra empty zstd frame (Marco) #66161
• [0ddc6b787f] - zlib: restart format detection when resetting Unzip (Marco) #66169
• [209fb77c48] - zlib: grow the output buffer of large async one-shot calls (Yagiz Nizipli) #66863
• [86f2e27dff] - zlib: finish async convenience calls in one write (Yagiz Nizipli) #66863
• [997d0d6990] - zlib: skip the stream in sync convenience calls without options (Yagiz Nizipli) #66864

📦 Download Binaries from https://openobserve.ai/downloads

• fix: refuse cross-tenant writes through function update and remote destination nodes [v1.2] by @Subhra264 in https://github.com/openobserve/openobserve/pull/16403
• fix(fleet): fleet delete counts, console and pipeline map fixes, CPU profile labels [v1.2] by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16436
• fix(oncall): link the coverage-gap email to the team schedule [v1.2] by @Subhra264 in https://github.com/openobserve/openobserve/pull/16473
• fix(oncall): polish the On-Call UI, add Beta tags [v1.2] by @Subhra264 in https://github.com/openobserve/openobserve/pull/16474
• fix(ingester): size memtable buckets and file limits from the memtable budget [v1.2] by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16523
• fix(overview): skip the anomaly request when the build has anomaly detection off [v1.2] by @haohuaijin in https://github.com/openobserve/openobserve/pull/16669
• fix(v1.2.0): backport rc2 fixes #16470 #16419 #16420 #16515 #16643 by @Loaki07 in https://github.com/openobserve/openobserve/pull/16692
• fix(traces): scope the service graph to the trace streams the user may read [v1.2] by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16707
• fix(alerts): incident RCA and alert group fixes from #16554 and #16606 [v1.2] by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16714
• fix(alerts): composite retry, scheduler delay and firing-state fixes from #16635 #16649 #16664 [v1.2] by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16715
• fix(v1.2.0): backport cluster scheduling and ingester persistence fixes by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16718
• fix(alerts): scope a cross-folder alert list to the folders the user may list [v1.2] by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16728
• fix(search): histogram timezone, bucket origin and UTC-only cache fixes [v1.2] by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16730
• fix(short-url): backport URL normalization to branch-v1.2.0 (#16637) by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16731
• fix(promql): stop a query that overlaps a WAL-to-storage move from missing or double-counting samples [v1.2] by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16732
• fix(search): backport fully covered histogram cache buckets to v1.2.0 (#16644) by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16734
• fix(search): keep the prefix delta of an ascending LIMIT query in the single result cache (v1.2.0) by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16735
• fix(synthetics): show readable response times and fit list cells to column width [v1.2] by @omkarK06 in https://github.com/openobserve/openobserve/pull/16722
• fix(ui): show the full lock badge on the header AI button [v1.2] by @nikhilsaikethe in https://github.com/openobserve/openobserve/pull/16742
• fix(pipelines): backport Associate Stream type fix to v1.2.0 (#16318) by @neha00290 in https://github.com/openobserve/openobserve/pull/16744
• fix(openapi): type responses and close spec gaps [v1.2] by @007harshmahajan in https://github.com/openobserve/openobserve/pull/16746
• fix(license): backport licence-gating fixes from #16444–#16447 [v1.2] by @pr1sm8 in https://github.com/openobserve/openobserve/pull/16752
• fix(rum): mask replay text in the cloud console RUM (#16676) by @bjp232004 in https://github.com/openobserve/openobserve/pull/16754
• fix(rum): stop offering JS source map upload for iOS and Android errors [v1.2.0] by @bjp232004 in https://github.com/openobserve/openobserve/pull/16756
• fix(datetime): close the picker when a relative time is picked [v1.2.0] by @bjp232004 in https://github.com/openobserve/openobserve/pull/16758
• fix(rum): fix session link NaN, heatmap snapshot, trace duration, widen button and analytics header [v1.2.0] by @bjp232004 in https://github.com/openobserve/openobserve/pull/16759
• fix(k8s): cluster dropdown, readable dependency map, namespace grouping and table sizing [v1.2.0] by @bjp232004 in https://github.com/openobserve/openobserve/pull/16760
• fix(v1.2.0): backport unsuitable training data as a data state (#16499) by @Loaki07 in https://github.com/openobserve/openobserve/pull/16769
• fix: cherry pick changes from main by Subhra by @YashodhanJoshi1 in https://github.com/openobserve/openobserve/pull/16774
• fix(compactor): cap how many sorted chains one metrics merge opens [v1.2] by @haohuaijin in https://github.com/openobserve/openobserve/pull/16775
• fix: ent build by @YashodhanJoshi1 in https://github.com/openobserve/openobserve/pull/16784

Full Changelog: https://github.com/openobserve/openobserve/compare/v1.2.0-rc1...v1.2.0-rc2

This is the third Release Candidate of Redis 8.12 in Redis Open Source.

Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use.

• #16127 A TLS session could be resumed on another listener (client port vs. cluster bus), or after tls-auth-clients or tls-expected-peer-name changed, without the checks of the new settings

• #16135 New commands: ZMOVE, BZMOVE, ZMOVEMEMBER to atomically move members between sorted sets - from either end, by score range, or by name - with COUNT batching and NX/XX destination conditions
• #15907 SLOWLOG GET now reports the CPU time of each slow command (a new 8th field), to tell commands that ran slowly apart from commands that were starved of CPU; New configuration parameter: off-cpu-tracking

• #16105 RedisModule_GetUsedMemoryRatioEstimate - like RedisModule_GetUsedMemoryRatio, but can be called from module threads without holding the GIL

• #16098 A replica that fell behind by more than its output buffer soft limit was disconnected even when repl-backlog-size was larger
• #16176 Keys could be lost during atomic slot migration when the destination rejected a command (e.g. -NOREPLICAS due to min-replicas-to-write)
• #16210 Set members could be expired incorrectly on the destination during atomic slot migration
• #16096 MSETEX with repeated EX or PX options was propagated to replicas and the AOF as an invalid command, losing the keys
• #16175 Commands could be replayed twice on AOF load when an AOF rewrite started after an AOF write error (e.g. disk full)
• #15955 XADD entries with IDMP could be lost on AOF replay or on a lagging replica, and XIDMPRECORD could crash a lagging replica
• #15930 Consumers created by XCLAIM or XAUTOCLAIM that claimed no entries were not propagated to replicas or the AOF
• #16121 Some key updates could apply the value or TTL to a different key while the keyspace was being resized
• #16042 Redis could crash with io-threads > 1 when running module commands that use getkeys-api or getchannels-api
• #16165 Redis could crash when a module read a sorted set emptied by ZPOPMIN/ZPOPMAX from its keyspace notification
• #16125 ZRANGESTORE with the same source and destination key could cause a use-after-free when key-memory-histograms or cluster-slot-stats-enabled is enabled
• #16167 ZRANGESTORE could create a sorted set with a broken score order when the source was a listpack loaded from an unordered payload
• #16164 A sorted set restored without sanitize-dump-payload could store a duplicate member twice after its conversion to the B+tree encoding
• #16146 A malformed RESTORE payload or RDB file could corrupt memory (only with modules that register key metadata classes)
• #16142 CONFIG GET and CONFIG REWRITE dropped the n, o and c flags of notify-keyspace-events when A was set, so these events stopped after a restart
• #16120 DELEX honored lazyfree-lazy-server-del instead of lazyfree-lazy-user-del
• #16203 Lua scripts with very deep string patterns could exhaust the stack; such patterns now fail with pattern too complex
• #16233 Redis could crash when using preload-file with AOF and a working directory of 1024 bytes or longer
• #16062 On FreeBSD, the bundled jemalloc took over libc's malloc hooks, which could crash multi-threaded tools (e.g. redis-benchmark --threads) and deadlock after fork()
• #16117 redis-cli could generate excessive help entries from a COMMAND reply with extreme arity values
• #15823 redis-cli --keystats printed empty statistics when no keys were found

• #15622 SORT and SORT_RO no longer convert listpack-encoded sorted sets to B+tree, which increased their memory usage (also on read-only replicas)
• #16163 ZADD that converts a sorted set to B+tree no longer leaves an oversized member index, which wasted memory and slowed ZSCAN
• #16069 Client memory (tot-mem, mem_clients_normal, maxmemory-clients) now includes the names of watched keys and of Pub/Sub channels and patterns
• #16126 Faster ZRANGESTORE for large REV rank ranges
• #16156 Faster ZRANDMEMBER with a large positive count on B+tree sorted sets
• #15420 Faster SRANDMEMBER with a positive count on hashtable-encoded sets
• #15901 Faster HEXPIRE and HSETEX updates of field expiration on listpack-encoded hashes

📦 Download Binaries from https://openobserve.ai/downloads

• fix: refuse cross-tenant writes through function update and remote destination nodes [v1.2] by @Subhra264 in https://github.com/openobserve/openobserve/pull/16403
• fix(fleet): fleet delete counts, console and pipeline map fixes, CPU profile labels [v1.2] by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16436
• fix(oncall): link the coverage-gap email to the team schedule [v1.2] by @Subhra264 in https://github.com/openobserve/openobserve/pull/16473
• fix(oncall): polish the On-Call UI, add Beta tags [v1.2] by @Subhra264 in https://github.com/openobserve/openobserve/pull/16474
• fix(ingester): size memtable buckets and file limits from the memtable budget [v1.2] by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16523
• fix(overview): skip the anomaly request when the build has anomaly detection off [v1.2] by @haohuaijin in https://github.com/openobserve/openobserve/pull/16669
• fix(v1.2.0): backport rc2 fixes #16470 #16419 #16420 #16515 #16643 by @Loaki07 in https://github.com/openobserve/openobserve/pull/16692
• fix(traces): scope the service graph to the trace streams the user may read [v1.2] by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16707
• fix(alerts): incident RCA and alert group fixes from #16554 and #16606 [v1.2] by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16714
• fix(alerts): composite retry, scheduler delay and firing-state fixes from #16635 #16649 #16664 [v1.2] by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16715
• fix(v1.2.0): backport cluster scheduling and ingester persistence fixes by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16718
• fix(alerts): scope a cross-folder alert list to the folders the user may list [v1.2] by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16728
• fix(search): histogram timezone, bucket origin and UTC-only cache fixes [v1.2] by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16730
• fix(short-url): backport URL normalization to branch-v1.2.0 (#16637) by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16731
• fix(promql): stop a query that overlaps a WAL-to-storage move from missing or double-counting samples [v1.2] by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16732
• fix(search): backport fully covered histogram cache buckets to v1.2.0 (#16644) by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16734
• fix(search): keep the prefix delta of an ascending LIMIT query in the single result cache (v1.2.0) by @hengfeiyang in https://github.com/openobserve/openobserve/pull/16735
• fix(synthetics): show readable response times and fit list cells to column width [v1.2] by @omkarK06 in https://github.com/openobserve/openobserve/pull/16722
• fix(ui): show the full lock badge on the header AI button [v1.2] by @nikhilsaikethe in https://github.com/openobserve/openobserve/pull/16742
• fix(pipelines): backport Associate Stream type fix to v1.2.0 (#16318) by @neha00290 in https://github.com/openobserve/openobserve/pull/16744
• fix(openapi): type responses and close spec gaps [v1.2] by @007harshmahajan in https://github.com/openobserve/openobserve/pull/16746
• fix(license): backport licence-gating fixes from #16444–#16447 [v1.2] by @pr1sm8 in https://github.com/openobserve/openobserve/pull/16752
• fix(rum): mask replay text in the cloud console RUM (#16676) by @bjp232004 in https://github.com/openobserve/openobserve/pull/16754
• fix(rum): stop offering JS source map upload for iOS and Android errors [v1.2.0] by @bjp232004 in https://github.com/openobserve/openobserve/pull/16756
• fix(datetime): close the picker when a relative time is picked [v1.2.0] by @bjp232004 in https://github.com/openobserve/openobserve/pull/16758
• fix(rum): fix session link NaN, heatmap snapshot, trace duration, widen button and analytics header [v1.2.0] by @bjp232004 in https://github.com/openobserve/openobserve/pull/16759
• fix(k8s): cluster dropdown, readable dependency map, namespace grouping and table sizing [v1.2.0] by @bjp232004 in https://github.com/openobserve/openobserve/pull/16760
• fix(v1.2.0): backport unsuitable training data as a data state (#16499) by @Loaki07 in https://github.com/openobserve/openobserve/pull/16769
• fix: cherry pick changes from main by Subhra by @YashodhanJoshi1 in https://github.com/openobserve/openobserve/pull/16774
• fix(compactor): cap how many sorted chains one metrics merge opens [v1.2] by @haohuaijin in https://github.com/openobserve/openobserve/pull/16775

Full Changelog: https://github.com/openobserve/openobserve/compare/v1.2.0-rc1...v1.2.0-rc2

Experimental browser SDK from master. Optimized and ASan browser validation passed. Validation: https://github.com/fluent/fluent-bit/actions/runs/43090831114 Download the archive, verify its checksum, and deploy the complete SDK on your application origin. HTTPS and COOP/COEP are required. This is not a production support promise.

This is a security release.

• (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
• (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
• (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
• (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
• (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
• (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
• (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
• (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
• (CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
• (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
• (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
• (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
• (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
• (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
• (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
• (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
• (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
• (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
• deps: update brotli to 1.2.1 (Node.js GitHub Bot)
• deps: update llhttp to 9.4.4 (Antoine du Hamel)
• deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
• deps: update undici to 8.12.4 (Node.js GitHub Bot)

• [7b777661f5] - build: respect OpenSSL's configured API level (Filip Skokan) #66953
• [4518c7501f] - crypto: fix builds with older OpenSSL 3.0 (Filip Skokan) #66931
• [94b73673b8] - deps: brotli: cherry-pick e230f474b87 (liujiahui) #61003
• [e315236158] - deps: update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038
• [8e714f7daa] - deps: update undici to 8.12.4 (Node.js GitHub Bot) #67272
• [af48b1a4d5] - deps: update brotli to 1.2.1 (Node.js GitHub Bot) #66990
• [60316405bb] - deps: update undici to 8.12.3 (Node.js GitHub Bot) #66993
• [89b17baef4] - deps: update sqlite to 3.54.1 (Node.js GitHub Bot) #66816
• [d14db811c7] - http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001
• [9183db64fe] - http2: retain streams during pending writes (Matteo Collina) nodejs-private/node-private#1040
• [62ae278a23] - http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) nodejs-private/node-private#1000
• [7df134e2ce] - http2: retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017
• [0ff0cf6749] - http2: release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026
• [a84a01ddb8] - http2: avoid overflowing ALTSVC buffers (Matteo Collina) nodejs-private/node-private#1035
• [3fc67dc056] - http2: detect streams abandoned by nghttp2 (Matteo Collina) #66641
• [df4011dafe] - http2: guard against null write request on cancelled stream (Matteo Collina) #67252
• [fa61009dc1] - https: isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036
• [40d3d8ddca] - permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967
• [6c85b8e371] - tls: fix remotely reachable TLS server crash (Tim Perry) nodejs-private/node-private#1018
• [a8d6286949] - tls: disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030
• [e750e1fa02] - tls: don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#1030
• [97b1357f08] - tls: don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#1030
• [66e72ec604] - tls: apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020
• [940cae5c33] - tls,http: prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#1021
• [8232390dd8] - tools: use vendored trust store in shell.nix (Antoine du Hamel) #67318
• [6c223db6e2] - zlib: handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037

This is a security release.

• (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
• (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
• (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
• (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
• (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
• (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
• (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
• (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
• (CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
• (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
• (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
• (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
• (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
• (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
• (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
• (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
• (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
• (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
• deps: update brotli to 1.2.1 (Node.js GitHub Bot)
• deps: update llhttp to 9.4.4 (Antoine du Hamel)
• deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
• deps: update undici to 7.30.2 (Node.js GitHub Bot)

• [4c12b8a775] - build: respect OpenSSL's configured API level (Filip Skokan) #66953
• [5654932a7d] - crypto: fix builds with older OpenSSL 3.0 (Filip Skokan) #66931
• [e88009c61c] - deps: brotli: cherry-pick e230f474b87 (liujiahui) #61003
• [92e8d82e0e] - deps: update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038
• [4164b5c2b4] - deps: update brotli to 1.2.1 (Node.js GitHub Bot) #66990
• [4fec855b1d] - deps: update sqlite to 3.54.1 (Node.js GitHub Bot) #66816
• [17c9eb75f3] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #66663
• [57ebbdc275] - deps: update undici to 7.30.2 (Node.js GitHub Bot) #67273
• [8749030ae5] - http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001
• [8e100ac90a] - http2: retain streams during pending writes (Matteo Collina) nodejs-private/node-private#1040
• [03f040685b] - http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) nodejs-private/node-private#1000
• [7be19aa614] - http2: retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017
• [ff8938913b] - http2: release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026
• [ae9ab37d62] - http2: avoid overflowing ALTSVC buffers (Matteo Collina) nodejs-private/node-private#1035
• [a081fd3a3e] - http2: detect streams abandoned by nghttp2 (Matteo Collina) #66641
• [22f4367981] - http2: guard against null write request on cancelled stream (Matteo Collina) #67252
• [4f60230182] - https: isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036
• [fdbc6ab7ac] - permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967
• [d13a284de6] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986
• [c3485f2417] - tls: fix remotely reachable TLS server crash (Tim Perry) nodejs-private/node-private#1018
• [599ca08e28] - tls: disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030
• [981d2defc6] - tls: don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#1030
• [799abe55cb] - tls: don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#1030
• [45e3b1637a] - tls: apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020
• [25d487e3da] - tls,http: prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#1021
• [e14e27b8d3] - zlib: handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037

This is a security release.

• (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
• (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
• (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
• (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
• (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
• (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
• (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
• (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
• (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
• (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
• (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
• (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
• (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
• (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
• (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
• (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
• (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
• deps: update llhttp to 9.4.4 (Antoine du Hamel)
• deps: update sqlite to 3.54.1 (Node.js GitHub Bot)

• [554fff40f0] - deps: update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038
• [6577cbf231] - deps: update sqlite to 3.54.1 (Node.js GitHub Bot) #66816
• [61d93c6086] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #66663
• [cd18f6bdff] - http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001
• [6cd7e80d68] - http2: retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017
• [9bce421783] - http2: release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026
• [30fd852c0d] - http2: detect streams abandoned by nghttp2 (Matteo Collina) #66641
• [21fb5d0348] - http2: guard against null write request on cancelled stream (Matteo Collina) #67252
• [af6fbb6564] - https: isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036
• [5c9eed3b1e] - permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967
• [5e497aec89] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986
• [06af164d09] - tls: disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030
• [209c7e4d83] - tls: don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#1030
• [05e452f075] - tls: don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#1030
• [67da864a89] - tls: apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020
• [c841c6c7f1] - tls,http: prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#1021
• [ea159e84dd] - zlib: handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037

This release includes security fixes, performance improvements, and bug fixes since 2.31.0. As part of our ongoing proactive security reviews, this release includes a larger set of security fixes than usual. We recommend that you upgrade as soon as possible.

Loader Changes For the loader changes take effect a PostgreSQL restart is required.

• #10966 Check database ownership before stopping or restarting background workers on database commands
• #10983 Run the background worker scheduler as the database owner instead of as superuser

Features

• #10864 Improve continuous aggregate refresh performance by updating the watermark once per batch
• #10878 Enable Adaptive Integer Compression (AIC) by default
• #10927 Remove user switching when allocating ids from the internal catalog sequences
• #10953 Allow database owners to start, stop, and restart background workers without superuser
• #10960 Run the telemetry job as the database owner instead of the role that installed the extension

Bugfixes

• #10075 Removing the bloom1_contains function and rejecting anonymous record arrays in bloom1_contains_any
• #10296, #10745 Fix continuous aggregate refresh skipping the last invalidated bucket for variable-sized buckets
• #10854 Correctly skip rows with conversion errors during COPY FROM ON_ERROR ignore
• #10855 Enforce REJECT_LIMIT during COPY FROM on PostgreSQL 18 and later
• #10887 Fix "repalloc called with invalid pointer" when compressing batches of more than 992 rows for certain data patterns
• #10893 Fix typo in the columnar README example
• #10902 Fix concurrent UPDATE/DELETE on hypertables silently skipping rows under READ COMMITTED
• #10919 Check schema CREATE privilege when creating a continuous aggregate
• #10925 Create chunk constraints without switching to the catalog owner
• #10961 Fix crash in decompress_chunk when the hypertable is dropped concurrently
• #10961 Fix null dereference in in-memory recompression when the compression settings are missing
• #10961 Fix stale chunk and hypertable state in compress_chunk when a concurrent decompress or compression change commits
• #10962 Reset search_path after every COMMIT in the columnstore policy
• #10964 Fix crash in cagg_validate_query when called with a SELECT INTO statement
• #10964 Fix crash in cagg_validate_query when the user lacks SELECT permission on the hypertable
• #10965 Verify the server certificate on telemetry SSL connections
• #10967 Fix crash in show_policies when called more than once in the same query
• #10968 Fix crash in add_policies and alter_policies when a drop_created_before retention policy exists on the hypertable or the continuous aggregate
• #10970 Fix ORDER BY pushdown for realtime continuous aggregates with an ORDER BY in their definition
• #10988 Report a missing policy config key as a user error instead of an internal error
• #10988 Restrict changing the config check function of a job to the job ownerwhat
• #10989 Match job procedures by OID in DDL hooks
• #10991 Fix function overload in approximate_row_count
• #10993 Require ownership of the chunk, not just of the hypertable, to do chunk operations on them

GUCs

• compression_orderby_default_function: Function to use for calculating default order_by setting for compression. Default: timescaledb.compression_orderby_default_function
• compression_segmentby_default_function: Function to use for calculating default segment_by setting for compression. Default: timescaledb.compression_segmentby_default_function

Thanks

• @JoongHyuk-Shin for fixing continuous aggregate refresh skipping the last invalidated bucket for variable-width buckets, 10419
• @manishnithinreddy for reporting the concurrent UPDATE/DELETE regression and bisecting it to 2.28.1, 10902
• @martin-omacht for reporting missing and stale buckets in a continuous aggregate with a timezone, #10296
• @owhiterabbito for reporting the compression error and analyzing the selector buffer size, #10887
• @pei711 for fixing a typo in the README, #10893
• @salmanazmat666 for reporting the continuous aggregate refresh skipping the last bucket on a variable-width bucket boundary, #10745