ProxySQL 4.0.11 Release Notes

Release date: 2026-08-27

ProxySQL 4.0.11 is the Plugin Chassis / AI-tier release. It contains every
Stable 3.0.11 and Innovative 3.1.11 change, and adds a concentrated reliability
update for the GenAI plugin, MCP endpoints, RAG and vector tooling, runtime
configuration reloads, and the shared TSDB metrics store.

This release is primarily about making the plugin ecosystem predictable under
real operational pressure. Fresh installations receive a complete set of MCP
and GenAI defaults, existing installations keep their configured values, live
reloads coordinate with active tool calls, and shutdown waits for plugin client
threads before unloading shared state. Authentication and readiness checks now
follow the same MCP endpoint contract, while statistics and metric discovery no
longer race with configuration or TSDB activity.

Why upgrade

• A fresh plugin database receives every missing mcp-* and genai-* default,
  so valid settings such as mcp-enabled can be changed immediately.
• Existing operator values are preserved during startup seeding and runtime
  reload; defaults fill gaps rather than resetting the configuration.
• MCP endpoints consistently require their configured bearer token, including
  health/readiness probes used by automation.
• LOAD MCP VARIABLES TO RUNTIME and LOAD GENAI VARIABLES TO RUNTIME replace
  shared dependencies safely while Admin, status, query-hook, MCP AI, and RAG
  work may be active.
• Plugin teardown drains client threads before destroying their modules,
  reducing shutdown and unload races.
• TSDB metric discovery, ingestion, and downsampling use synchronized access to
  the shared SQLite connection and tolerate transient locks.

Before upgrading

• mcp-enabled remains disabled by default. Startup creates missing rows but
  does not silently enable the listener or overwrite an existing value.
• Review all endpoint authentication variables before enabling MCP. An endpoint
  whose corresponding mcp-*_endpoint_auth value is empty refuses requests;
  this is a fail-closed security policy, not an anonymous mode.
• Readiness clients must send the same bearer authentication required by the
  endpoint they probe. Update external health checks that previously assumed an
  unauthenticated request.
• Runtime reloads are safer, but they are still configuration changes. Validate
  the values in global_variables, load the intended variable family, and
  verify the runtime view before persisting to disk.
• ProxySQL 4.0.11 inherits the 3.1 authentication changes. In particular, an
  existing mysql_users.attributes value of "require_x509": true is enforced
  in this tier even though Stable 3.0.x ignores it.

Complete defaults without destroying operator configuration

The GenAI plugin reads its settings from main.global_variables. On a fresh or
partially upgraded database, missing canonical rows could leave the plugin only
partly initialized: a valid SET mcp-enabled=true might be rejected because the
runtime did not know the variable, or the runtime projection could contain an
incomplete configuration.

ProxySQL 4.0.11 collects the canonical defaults from the MCP and GenAI runtime
handlers and transactionally inserts only the rows that are missing. Existing
values win. If seeding fails, the transaction rolls back rather than leaving a
half-populated configuration. The complete MCP set is then validated and
published as one runtime snapshot, so readers do not observe a mixture of old
and new values.

Operators can inspect the stored configuration before and after an upgrade with:

SELECT variable_name, variable_value
FROM global_variables
WHERE variable_name LIKE 'mcp-%'
   OR variable_name LIKE 'genai-%'
ORDER BY variable_name;

The same preservation rule applies to the LLM cache setting and other GenAI
runtime values: reloads use the operator's current configuration rather than
reverting a working value to an internal default. (#6107)

Runtime reloads coordinate with active consumers

MCP, RAG, AI tools, query hooks, status collection, and Admin commands share
runtime objects. Replacing those objects while another thread was still using
them could expose stale pointers, mismatched variables, or an inconsistent
combination of old and new dependencies.

The reload path now quiesces shared consumers before replacing their runtime
dependencies. It republishes a complete variable snapshot, refreshes the RAG
and AI tool dependencies, and only then resumes normal work. This applies to
the standard Admin commands:

LOAD MCP VARIABLES TO RUNTIME;
LOAD GENAI VARIABLES TO RUNTIME;

The corresponding FROM DISK, FROM CONFIG, and save-to-memory flows use the
same ownership boundaries, so configuration round-tripping no longer leaves the
running plugin with stale values. The listener is recreated only when relevant
settings such as enablement, port, or TLS mode require it; otherwise the active
server is retained. (#6107)

Safer MCP authentication and health checks

Each MCP endpoint has a corresponding bearer-authentication variable. ProxySQL
now applies that contract consistently to real tool calls, test clients, and
readiness checks. If a token is empty, the endpoint refuses the request and logs
which mcp-<endpoint>_endpoint_auth setting must be configured. This avoids the
ambiguous state where an enabled endpoint appears healthy but is unintentionally
unauthenticated.

For operators, the practical change is that monitoring must behave like a real
client: use HTTPS verification as configured, supply the correct bearer token,
and honor bounded request timeouts. A readiness failure can now indicate missing
authentication rather than a dead listener, so health-check diagnostics should
retain the HTTP response and ProxySQL log message. (#6107)

Predictable plugin shutdown and live operation

Plugin unload and process shutdown now drain client threads before module
destruction. Shared AI/RAG bridges are detached in an ordered sequence, and MCP
workers stop using a dependency before it is replaced or freed. This prevents a
late client, status query, or query hook from observing a partially destroyed
runtime.

The PostgreSQL processlist snapshot exposed to MCP is now bounded, avoiding an
unlimited copy when a busy proxy has many frontend sessions. Discovery-schema
resources are released on all relevant paths, closing leaks that became visible
during long-running sanitizer tests. Statistics tests and runtime counters no
longer depend on execution order or mutable state left by a previous operation.
(#6107)

TSDB and metric discovery no longer race

Metric ingestion, MCP/GenAI discovery, statistics queries, and hourly
downsampling all touch the TSDB SQLite database. Previously, these callers could
use the shared connection concurrently. A transient SQLITE_BUSY, discovery
request, or hour rollover could therefore interfere with another operation and,
in the worst case, terminate ProxySQL.

Access is now serialized with the same pthread-backed lock across every shared
caller, including REST metric discovery. Hour rollover and downsampling happen
inside that coordinated lifecycle, and a temporary SQLite lock is handled
without aborting the daemon. The result is especially important for deployments
where monitoring systems query discovery endpoints while metrics are being
written continuously. (#6004, #6107)

Innovative-tier capabilities included in 4.0.11

Because the 4.0 tier includes the 3.1 feature set, it also receives the complete
Innovative 3.1.11 authentication and observability update:

• non-TLS caching_sha2_password full authentication for clients that request
  ProxySQL's RSA public key or pin it locally, with validated key generation and
  rotation-safe snapshots (#6017, #6032);
• frontend MariaDB client_ed25519 authentication, including
  COM_CHANGE_USER, plus backend ed25519 support when a cleartext upstream
  credential is available (#6033);
• per-user {"require_x509": true} frontend certificate policy, enforced before
  password or row-backed pass-through authentication (#6028);
• independent Admin/Stats and frontend credential scopes, allowing the same
  username to carry different credentials on different interfaces (#5993);
• accurate MySQL and PostgreSQL FFTO accounting for deprecated EOF, multi-result
  responses, prepared-statement fetches, and pipelined extended queries (#6047,
  #6021).

Stable improvements included in 4.0.11

ProxySQL 4.0.11 also carries every Stable 3.0.11 improvement, including:

• opt-in literal MySQL user-variable tracking and replay across multiplexed
  backends (#6043);
• opt-in endpoint-wide GTID learning from successful OK packets (#6035);
• hardened authentication response bounds and OpenSSL handshake randomness
  (#5998, #6104);
• safe --idle-threads shutdown and single-flight soft-TTL cache refreshes
  (#6087, #6015);
• MySQL/Admin/SQLite3 compatibility fixes and visible client connection
  attributes (#5994, #6079, #6076, #5978, #6077);
• cleanup of the temporary PostgreSQL termination connection and the PostgreSQL
  user-synchronization Scheduler sample (#6130, #6045);
• portable Linux tarballs with bundled OpenSSL and FreeBSD portability work
  (#6105, #6030).

Release commit: 7c91137a465454dfc1a62b56f8c188c1ce59c130

SHA256s:

62919209cda56eb115005ed1cf4471ada886377d7a38d3559be372db5c134807  proxysql-4.0.11-1-almalinux10-clang.x86_64.rpm
b979805037d75481b284ab61bf1173135c5d51fc73424062edc9786e73ca75d0  proxysql-4.0.11-1-almalinux10.aarch64.rpm
e6b97047b640929a4280849563bcca31d435f3c3bcc1cebd822aac9515ff4220  proxysql-4.0.11-1-almalinux10.x86_64.rpm
9ac4fc56b102ef532a34e797c5517b002335400455efa2c00e906d52361037db  proxysql-4.0.11-1-almalinux9-clang.x86_64.rpm
8a0dcc86615bce5bbb4c5688d95bc709ea05c3262bedc3e247fbe30d3d572a38  proxysql-4.0.11-1-almalinux9.aarch64.rpm
431e21cdf5509375874d62d71b3e314692e99e49679a6bb4386d6fcd5e0c35d2...

ProxySQL 3.1.11 Release Notes

Release date: 2026-08-27

ProxySQL 3.1.11 is the Innovative-tier release. It contains every Stable-tier
fix in 3.0.11 and adds authentication capabilities for modern MySQL and MariaDB
clients, per-user certificate policy, independent Admin credentials, and more
accurate Fast Forward Traffic Observer (FFTO) statistics. It also improves the
reliability of the time-series database used for metrics.

The authentication work is the most visible part of this release. ProxySQL can
now complete non-TLS caching_sha2_password full authentication through the
MySQL RSA protocol, accept MariaDB client_ed25519 credentials at the frontend,
and require a verified client certificate for selected users. These features
are opt-in; existing password and TLS deployments continue to work as before.

Why upgrade

• Oracle MySQL clients using --get-server-public-key or a pinned
  --server-public-key-path can complete caching_sha2_password full
  authentication through ProxySQL without a frontend TLS connection.
• MariaDB clients can authenticate to ProxySQL with client_ed25519, including
  during COM_CHANGE_USER.
• Individual mysql_users rows can require a verified frontend certificate,
  independently of password or authentication-plugin choice.
• Admin/Stats credentials and frontend database users can safely share a
  username without overwriting one another in the runtime authentication map.
• FFTO now understands modern MySQL result framing, multi-result responses,
  prepared-statement cursor fetches, and pipelined PostgreSQL completion.
• TSDB collection and rollover no longer race through one shared SQLite
  connection or terminate ProxySQL on a transient database lock.

Before upgrading

• Review mysql_users.attributes for "require_x509": true. Stable 3.0.x does
  not recognize that key, while 3.1.11 enforces it. A row prepared in advance
  will therefore begin requiring frontend TLS and a verified client certificate
  after moving to the Innovative tier.
• RSA authentication protects the password exchange, not the rest of the MySQL
  session. TLS remains the recommended choice when the entire connection must
  be confidential and authenticated.
• If you configure explicit RSA key files, validate ownership, permissions, and
  rotation procedures before loading them. Invalid keys are rejected atomically
  and do not replace the active key snapshot.
• Frontend ed25519 can authenticate from a stored $ED$ public-key credential.
  A backend connection still needs a cleartext password; ProxySQL cannot derive
  that password from an $ED$ public key.
• FFTO remains opt-in. Its buffer limits continue to protect memory: an
  over-limit payload bypasses observation for that session rather than blocking
  Fast Forward traffic.

RSA full authentication for caching_sha2_password

Before this release, ProxySQL could complete caching_sha2_password full
authentication over TLS, but a non-TLS client following MySQL's RSA exchange
could not authenticate. This affected two common Oracle client modes:

• --get-server-public-key, where the client asks ProxySQL for its public key;
• --server-public-key-path, where the client already trusts a pinned key and
  sends the encrypted password immediately.

ProxySQL 3.1.11 implements both paths. Operators control the key manager with:

• mysql-caching_sha2_password_auto_generate_rsa_keys;
• mysql-caching_sha2_password_private_key_path;
• mysql-caching_sha2_password_public_key_path.

For example, automatic key management can be selected in the Admin interface
and then loaded with the other MySQL variables:

UPDATE global_variables
SET variable_value = 'true'
WHERE variable_name =
      'mysql-caching_sha2_password_auto_generate_rsa_keys';

LOAD MYSQL VARIABLES TO RUNTIME;

Generated keys are RSA-2048. Explicit private keys must be unencrypted PKCS#8,
public keys must use the SPKI form, and the pair is checked for matching type,
size, structure, and public/private material. Relative paths are confined below
ProxySQL's data directory; private-file ownership and mode are checked, and
publication is symlink-safe and atomic.

Each authentication exchange retains one immutable key snapshot. This matters
during rotation: a client cannot receive the old public key and then have its
ciphertext decrypted with a newly loaded private key. Malformed ciphertext and
incorrect passwords fail normally, and recovered cleartext credentials are
cleansed and excluded from logs and internal-session output. (#6017, #6032)

MariaDB ed25519 authentication on both sides of ProxySQL

ProxySQL 3.1.11 supports MariaDB's client_ed25519 / auth_ed25519 protocol for
frontend clients. A valid $ED$ public-key credential in mysql_users can be
used for initial login and COM_CHANGE_USER; ProxySQL issues the normal MySQL
Auth Switch request and verifies the client's Ed25519 signature.

Backend client_ed25519 support is shared with the Stable tier. The important
operational distinction is credential material: frontend verification needs the
stored public key, while authenticating ProxySQL itself to MariaDB needs the
user's cleartext password. A public-key-only $ED$ frontend row is therefore
not sufficient for an upstream backend login. Deployments using the same
identity on both sides must retain a usable backend credential. (#6033)

Per-user frontend X.509 policy

The new require_x509 attribute lets operators require a valid client
certificate for a selected MySQL user while leaving the policy unchanged for
other users. A simple row can be configured as follows (merge the key into any
existing attributes rather than discarding them):

UPDATE mysql_users
SET attributes = '{"require_x509": true}'
WHERE username = 'payments_app';

LOAD MYSQL USERS TO RUNTIME;

require_x509: true is additive to normal authentication. The connection must
use frontend TLS, present a peer certificate, pass certificate-chain
verification (X509_V_OK), and then satisfy the user's password/authentication
plugin. The frontend certificate is not forwarded to a backend.

The certificate evidence is captured once for the physical connection and is
also checked during COM_CHANGE_USER, which cannot renegotiate TLS. The policy
runs before row-backed pass-through authentication probes or cache activity, so
an unverified client is rejected before ProxySQL handles a cleartext credential.
Malformed attributes and non-boolean values fail closed. Existing SPIFFE policy
continues to use its stricter identity rules. (#6028)

Admin and Stats credentials no longer collide with frontend users

In earlier releases, admin-admin_credentials, admin-stats_credentials, and
mysql_users shared one frontend credential map. If an Admin account and an
application account had the same username but different passwords, loading one
could overwrite or delete the other. The documented workaround was to keep
those namespaces disjoint.

The Innovative tier now gives Admin/Stats identities their own credential
scope. A username can exist on the Admin port and in mysql_users with different
passwords, and updating admin-admin_credentials no longer removes the matching
frontend row from runtime. Session-aware lookup applies the correct scope for
MySQL and PostgreSQL Admin/Stats connections while leaving Stable 3.0 behavior
unchanged. This is intentionally tier-gated because resolving a formerly
colliding name into two independent identities is a compatibility change.
(#5993)

FFTO understands complete modern result flows

Fast Forward mode minimizes processing by acting as a protocol-aware pipe, but
that also means normal query processing cannot populate digest statistics.
FFTO passively observes the decrypted protocol stream so Fast Forward sessions
can still contribute query text/digest, latency, rows-sent, affected-row, and
error information.

The MySQL observer now frames resultsets correctly when
CLIENT_DEPRECATE_EOF is negotiated, accumulates multi-result responses until
the final result, understands prepared-statement binary rows, and treats
COM_STMT_FETCH cursor batches as part of the right statement. The PostgreSQL
observer uses the same state-machine approach for simple and extended query
flows. Malformed or over-limit traffic bypasses observation safely rather than
changing the forwarded data. (#6047)

Operators can enable observation independently by protocol:

UPDATE global_variables
SET variable_value = 'true'
WHERE variable_name = 'mysql-ffto_enabled';
LOAD MYSQL VARIABLES TO RUNTIME;

UPDATE global_variables
SET variable_value = 'true'
WHERE variable_name = 'pgsql-ffto_enabled';
LOAD PGSQL VARIABLES TO RUNTIME;

For PostgreSQL extended-query pipelines, ReadyForQuery no longer finalizes an
observed command before its response terminator. This prevents a rapid Sync
or pipelined sequence from attributing completion and counters to the wrong
query. (#6021)

TSDB collection and rollover reliability

The TSDB paths used by metric ingestion, discovery, and downsampling share a
SQLite connection. Concurrent access could previously surface SQLITE_BUSY or
interleave discovery and rollover work; in the worst case, a temporary lock
terminated the daemon.

ProxySQL now serializes access to that shared connection, including REST/GenAI
metric discovery, and coordinates the hourly downsampling rollover. A transient
SQLite lock is handled as an operational condition rather than a fatal error.
This is especially relevant to installations that query metrics while collection
and downsampling are active. (#6004, #6107)

Stable improvements included in 3.1.11

ProxySQL 3.1.11 also includes the complete Stable 3.0.11 maintenance set:

• opt-in literal MySQL user-variable tracking and replay across pooled backends
  (#6043);
• opt-in endpoint-wide GTID learning from successful OK packets (#6035);
• safe --idle-threads shutdown and single-fl...

ProxySQL 3.0.11 Release Notes

Release date: 2026-08-27

ProxySQL 3.0.11 is a Stable-tier maintenance release focused on safer MySQL
multiplexing, more dependable causal reads, stronger authentication handling,
and predictable operation during shutdown and cache refreshes. It also improves
compatibility with common administration clients and makes the generic Linux
tarballs genuinely portable across supported distributions.

Most changes are transparent after an upgrade. The two main behavioral
features—literal MySQL user-variable tracking and GTID learning from OK
packets—are deliberately disabled by default, so operators can evaluate and
enable them independently.

Why upgrade

• Applications that use simple @user_variables can remain multiplexable
  without losing their session state when a different pooled backend is chosen.
• min_gtid routing can learn GTIDs returned by ordinary writes, including
  deployments where the same MySQL endpoint appears in writer and reader
  hostgroups.
• Malformed authentication packets can no longer drive fixed-width reads past
  the supplied response, and handshake randomness now comes from OpenSSL.
• ProxySQL shuts down safely with --idle-threads, rather than risking a NULL
  dereference or a worker/idle-thread use-after-free.
• Concurrent clients crossing a query-cache soft TTL now elect one refresher;
  the other clients continue using the still-valid cached value.
• Generic Linux tarballs include their OpenSSL runtime and are smoke-tested on
  multiple distributions and architectures before upload.

Before upgrading

• mysql-user_variable_tracking remains 0 by default. Mode 1 also requires
  either mysql-set_parser_algorithm=3 or
  mysql-query_processor_parser=1; ProxySQL does not enable a parser for you.
• mysql-update_gtid_from_ok remains disabled by default. It consumes only a
  GTID that MySQL actually returns in a successful OK packet; ProxySQL does not
  infer a GTID or turn on session_track_gtids on the application's behalf.
• The supported tarball entry point is now bin/proxysql. Scripts that bypass
  the launcher and invoke the internal binary directly will not receive the
  bundled OpenSSL library path.
• Frontend RSA full authentication for caching_sha2_password, per-user X.509
  policy, and frontend MariaDB ed25519 authentication are 3.1/4.0 features.
  Stable 3.0.11 does include MariaDB ed25519 support for backend connections.

Literal MySQL user variables can remain multiplexable

Many database clients attach request metadata to a session with statements
such as:

SET @browser_lang = 'en-US',
    @browser_timezone = 'GMT+2',
    @request_id = 4815162342;

Historically, ProxySQL had to treat user-variable activity conservatively and
bind the session to a hostgroup. That protects correctness, but it also gives up
connection reuse even when the values are simple literals that ProxySQL could
safely preserve.

ProxySQL 3.0.11 adds the opt-in mysql-user_variable_tracking mode. When mode
1 is active, ProxySQL records supported literal assignments only after the
backend accepts the complete SET. If a later query is assigned a different
pooled connection, ProxySQL first replays the missing or changed values on that
backend and then sends the application query. A backend whose materialized map
already matches the frontend session is preferred, avoiding unnecessary replay.

An operator can enable the feature through the ParserSQL SET parser with:

UPDATE global_variables
SET variable_value = '1'
WHERE variable_name = 'mysql-user_variable_tracking';

UPDATE global_variables
SET variable_value = '3'
WHERE variable_name = 'mysql-set_parser_algorithm';

LOAD MYSQL VARIABLES TO RUNTIME;

The feature is intentionally not a general SQL evaluator. It accepts complete,
text-protocol SET statements whose targets are all user variables and whose
values are strings, numbers, hexadecimal/bit literals, or NULL. Expressions,
functions, variable references, prepared statements, mixed system/user-variable
assignments, malformed input, and hidden writes from stored programs retain the
existing safe fallback. With the default
mysql-set_query_lock_on_hostgroup=1, that fallback locks the hostgroup.

Tracking is bounded to 128 names and 64 KiB of stored replay text per frontend
or backend connection. A statement is handled atomically: one unsupported value
or a limit violation makes the whole statement fall back, and a backend error
commits none of its assignments. Replay failures stop the pending client query
and retire the backend instead of executing with incorrect state. Resets,
COM_CHANGE_USER, reconnects, and disconnects clear the appropriate state.

Five counters in stats_mysql_global and Prometheus report tracked assignments,
replay commands and failures, and unsupported/limit fallbacks. Internal-session
diagnostics expose only counts, stored bytes, and a keyed aggregate fingerprint;
variable names and values are deliberately not disclosed. See
doc/mysql-user-variable-tracking.md for the complete syntax and lifecycle
contract. (#6043)

More complete GTID knowledge for causal reads

min_gtid routing depends on ProxySQL knowing which endpoints have executed a
transaction. The binlog reader remains the primary active source of that
knowledge, but it can leave a visibility gap when the same server is represented
in more than one hostgroup—for example, a write reaches an endpoint through a
writer hostgroup while a later causal read evaluates that endpoint through a
reader hostgroup.

With mysql-update_gtid_from_ok=true, ProxySQL also records a GTID that is
already present in a successful backend OK packet. The state is attached to the
hostname/port endpoint and is therefore visible across its hostgroup entries.
An OK packet without a GTID changes nothing, failed statements change nothing,
and an active binlog reader keeps its existing authoritative behavior.

This is useful when the application or server already negotiates GTID session
tracking and the deployment wants the returned transaction identity to inform a
subsequent min_gtid read. It is not a substitute for enabling GTID reporting
at the MySQL session level, and it does not guess based on routing or timing.
(#6035)

Authentication and credential handling

This release closes several edge cases in authentication paths that are both
security-sensitive and difficult to diagnose operationally:

• Fixed-width native-password and caching-SHA2 comparisons now first prove that
  the client supplied enough allocated bytes. A deliberately short response can
  no longer cause a 20- or 32-byte read beyond its buffer. The validation still
  accepts legitimate native-password responses whose final byte is NUL, avoiding
  intermittent false denials. (#5998)
• MySQL and PostgreSQL handshake material now uses OpenSSL RAND_bytes. A random
  source failure aborts that handshake cleanly rather than continuing with weak
  or incomplete material. Related timestamp, credential-cleanup, and bounded
  formatting paths were hardened at the same time. (#6104)
• Monitor credentials now work when
  mysql-default_authentication_plugin=caching_sha2_password. Generated
  CACHING_SHA2_PASSWORD() salts use a delimiter-safe alphabet; explicitly
  supplied salts must be exactly 20 bytes and cannot contain NUL. These checks
  prevent credentials from being accepted and then parsed differently when
  stored in admin-admin_credentials or admin-stats_credentials. (#5990,
  #5993, #5999)
• Backend connections can use MariaDB's client_ed25519 plugin when ProxySQL has
  the cleartext password needed to authenticate upstream. Frontend ed25519
  policy remains an Innovative-tier capability. (#6033)

Better compatibility and diagnostics

Several changes remove friction with real clients without weakening the Admin
interface:

• Admin accepts SET @@session.autocommit = ON|OFF and the scoped
  NET_READ_TIMEOUT / NET_WRITE_TIMEOUT assignments sent by current MySQL
  connectors and mysqldump. They are treated as harmless connection setup
  rather than being passed to SQLite and rejected. (#5994, #6079)
• SELECT CONNECTION_ID() on the SQLite3 server now returns the ProxySQL
  session identifier even when the client negotiated deprecated-EOF behavior.
  (#6076)
• Fast-forward connections using a Unix-socket backend keep compression enabled
  when the frontend requested it. (#5978)
• MySQL CLIENT_CONNECT_ATTRS are retained and exposed under
  client.connect_attrs in stats_mysql_processlist.extended_info. Operators
  can correlate a live connection with client-supplied attributes such as
  connector name, program name, or workload metadata; malformed attribute
  blocks are rejected safely. (#6077)
• Textual true and false values for
  mysql-session_idle_show_processlist are synchronized correctly, so the
  processlist no longer hides or exposes idle sessions because a string was
  interpreted as a numeric boolean. (#6031)

PostgreSQL operational fixes

When ProxySQL executes pg_terminate_backend() on behalf of a kill operation,
it opens a temporary PostgreSQL connection for that request. The connection is
now explicitly closed afterward, preventing repeated termination operations
from leaking backend connections. (#6130)

The release also includes an operator-owned Scheduler sample for synchronizing
approved PostgreSQL login verifiers into pgsql_users. The sample validates its
input, uses a constrained source function and allow-listed role, and protects
the synchronization configuration's file permissions. It is intended as a
controlled starting point for deployments that keep PostgreSQL credentials in
an external source of truth, not as an automatically enabled feature. (#6045)

Shutdown and cache reliability

With --idle-threads, worker and idle threads can reference one another while
leaving their run loops. The old shutdown path cou...

ProxySQL 4.0.10 Release Notes

Release date: 2026-07-31
Release commit: f5f1e148e

ProxySQL 4.0.10 is a maintenance and feature release for the AI/MCP Tier,
incorporating all improvements from ProxySQL 3.1.10 and 3.0.10. It carries the
pass-through authentication feature for MySQL (an Innovative/AI-MCP-tier
feature, opt-in and off by default — enable-able here but gated off on the 3.0.x
Stable build); the headline 4.0-specific work is a round of X Protocol
(mysqlx) plugin fixes — correct backend authentication, TLS-aware capability
negotiation, and several soak/shutdown-stability bugs. FFTO remains enabled by
default in the 4.0.x tier. The shared core also adds AWS RDS Blue/Green
monitoring, complete configuration round-tripping, frontend COM_PING metrics,
and compressed-packet and PostgreSQL protocol hardening; the GenAI/MCP subsystem
is unchanged this cycle.

Release commit: f5f1e148e

Highlights (AI/MCP Tier)

• Pass-through authentication (Innovative/AI-MCP tier): enabled in the 4.0.x
  build (gated off on the 3.0.x Stable build); opt-in and off by default (#5810,
  #5945).
• All 3.1.10 / 3.0.10 core improvements included: per-hostgroup query timeouts
  (#5772), time-based query-digest purge (#4920), LOAD ... VARIABLES feedback
  (#5857), PostgreSQL Unix-socket support (#5844), and the cross-hostgroup
  prepared-statement, PostgreSQL Bind-format, and expired-password fixes (#5895,
  #5878, #5847).
• AWS RDS Blue/Green monitoring (#5861), full configuration round-tripping
  (#5922), and frontend COM_PING metrics (#5948) are included in all tiers.
• Security and protocol hardening: compressed MySQL packet length validation
  (396c742f7, GHSA-fvch-fpgq-pwfx) and PostgreSQL Bind handling for one format
  with zero parameters (#5899).
• X Protocol (mysqlx) plugin fixes: correct X Protocol backend auth with
  end-to-end tests, backend capability gate aligned with TLS posture, and three
  soak-blocking bugs (auth shapes, hostname DNS, mapped password) resolved, plus
  clean shutdown under soak.
• FFTO enabled by default (4.0.x): full traffic observability out of the box.
  (FFTO is opt-in in 3.1.x.)
• Per-tier tarballs: the new generic-Linux .tar.gz pipeline (#569) builds a
  dedicated v4.0 tarball alongside the v3.0 and v3.1 tarballs.
• GenAI / MCP: no code changes this cycle; behavior unchanged from 4.0.8.

New Features & Fixes (4.0-specific)

X Protocol (mysqlx) plugin

The mysqlx plugin (the MySQL X Protocol front end, built and packaged only in
the v4.0 tier) received a focused stability pass this cycle:

• Correct X Protocol backend authentication with new end-to-end tests and a
  dedicated CI workflow (CI-mysqlx).
• Backend CapabilitiesSet gate aligned with TLS posture, with the unit test
  synced to match.
• Three soak-blocking bugs fixed — auth shapes, hostname DNS resolution, and
  mapped-password handling — that previously stalled the soak workload.
• Clean shutdown under soak — fixed a soak shutdown hang (#5926) and an admin
  shutdown path (#5916); session and backend-X setup handling hardened.
• Diagnostics — all fprintf(stderr, …) calls replaced with
  proxy_info / proxy_error / proxy_warning so plugin output flows through the
  standard error log.
• Build correctness — the plugin build is serialized so vendored protobuf
  finishes before the plugin .so links, and the vendored protobuf / zstd /
  lz4 static libraries are built and installed so the shared-object link
  resolves.
• Packaging build cleanup (#5975) — v4.0 packaging containers no longer
  install protobuf at runtime, and container build failures propagate correctly.

GenAI / MCP

No code changes in this cycle; the GenAI/MCP/RAG subsystem behaves identically to
4.0.8. As of the earlier plugin carve-out, all GenAI code lives in
plugins/genai/ and is built by PROXYSQL40=1 (there is no separate
PROXYSQLGENAI flag).

Features inherited from v3.1.10 (Innovative Tier)

ProxySQL 4.0.10 includes all features from the v3.1.10 (Innovative) release:

• Pass-through authentication for MySQL (#5810) — the Innovative/AI-MCP-tier
  feature, enabled in the 4.0.x build (gated off on the 3.0.x Stable build);
  opt-in and off by default. mysql-passthrough_* globals,
  stats_mysql_passthrough_auth_cache / stats_mysql_passthrough_auth_metrics,
  PROXYSQL FLUSH PASSTHROUGH_AUTH_CACHE, per-user/per-IP lockout, TLS gating, and
  a username_pattern allowlist. See the Pass-Through Authentication User Manual
  and Reference Manual.
• FFTO: enabled by default in 4.0.x (opt-in in 3.1.x); no code changes this
  cycle.
• TSDB: no code changes this cycle; behavior unchanged.

Features inherited from v3.0.10 (Stable Tier)

ProxySQL 4.0.10 includes all features, bug fixes, and improvements from the
v3.0.10 release, including:

• Per-hostgroup query timeouts (#5772) — default_query_timeout hostgroup
  attribute; precedence per-rule > per-hostgroup > global.
• Time-based PURGE of stats_mysql_query_digest (#4920, closes #4543).
• Visible feedback for rejected variables on LOAD ... VARIABLES TO RUNTIME
  (#5857, fixes #1288).
• PostgreSQL Unix-domain-socket backends (#5844, closes #5837).
• AWS RDS Blue/Green monitoring (#5861) — topology-aware writer/reader
  switchover, green-hostgroup discovery, DNS pinning, connection draining, and
  rollback cleanup.
• Full configuration round-tripping (#5922, closes #3468) — firewall and
  fast-routing tables, server SSL parameters, and PostgreSQL hostgroup attributes
  survive config export and import.
• Frontend COM_PING metrics (#5948) — Com_frontend_ping in
  stats_mysql_global and Prometheus.
• version field in PROXYSQL INTERNAL SESSION (#5877, implements #5859).
• Admin connect-setup robustness — strip leading SQL comments, accept
  SET LOCK_WAIT_TIMEOUT (#5826, #5786).
• Richer protocol-violation diagnostics (#5936).
• Bug fixes: cross-hostgroup STMT_EXECUTE dangling-bind corruption (#5895,
  #5883); PostgreSQL heterogeneous Bind result formats now fail loud (#5878,
  #5866); PostgreSQL Bind with one format and zero parameters (#5899); zlib
  compressed-packet length validation (396c742f7, GHSA-fvch-fpgq-pwfx);
  expired password (1862) no longer shuns the backend (#5847, #5846); monitor
  schema port-default cleanup (#5850); and richer unhealthy-connection
  diagnostics (#5946).
• Build & Packaging: generic Linux .tar.gz binaries (#569); portable
  jemalloc page-size detection (#5822, fixes #4863, #3252); ParserSQL v1.0.10
  (#5915); cpp-dotenv v1.1.0 (#5875).
• Testing & CI: macOS (Darwin) TAP build support (#5933); vendored
  replication/shunning suite (#5872, #5876, #5888, #5923); MySQL 9.x GR workflows
  and report_host fix (#5880, #5909); AWS RDS BGD simulator and lifecycle
  coverage (#5861); PostgreSQL zero-parameter Bind regression coverage (#5899,
  #5955); pass-through pool-reuse regression coverage (#5944); and
  Codecov/cluster-workflow validation (#5954, #5963, #5966).

For detailed descriptions of these core improvements, see the ProxySQL 3.0.10
Release Notes.

Package coverage note

As in prior 4.0.x cycles, the GenAI tier depends on C++17 features unavailable on
older toolchains (libstdc++ on AlmaLinux 8, libc++ on openSUSE Leap 15), so
4.0.x packages are not produced for those distributions. Use a newer distribution
(AlmaLinux 9+, Fedora 42+, Debian 12+, Ubuntu 22.04+, openSUSE Leap 16) for the
AI/MCP tier. (Confirm the exact 4.0.10 package matrix at release time.)

Contributors

Thanks to everyone who contributed to this release, including @renecannao,
@wazir-ahmed, @rahim-kanji, @burnison, @takaidohigasi, @shabih-paystack,
@anthonyryan1, @fogelito and @Zhao73.

Packages

Alongside the usual .deb and .rpm packages, this release ships generic Linux
tarballs — proxysql-4.0.10-linux-amd64.tar.gz and
proxysql-4.0.10-linux-arm64.tar.gz — each with a .sha256 checksum and a
detached .asc GPG signature made with the ProxySQL release key
(653F85BB38256DF8A96206C3E8CA2E8D8217C97E).

Three platforms are intentionally not included in this release:

• AlmaLinux 8 — the platform cannot satisfy the OpenSSL 3 requirement that
  ProxySQL 3.x depends on.
• openSUSE 15 — its toolchain cannot compile the current GenAI code
  (std::regex::multiline), so no openSUSE 15 packages are built for this tier.
• openSUSE 16, aarch64 only — its post-build verification failed in CI.
  The x86_64 openSUSE 16 packages are unaffected and are included.

Hashes

The release commit is: f5f1e148e.

SHA256s:

b08ff32ec67ae043a16d5cb83449a3f4a54812c91e1970053b1bf87e91c21652  proxysql-4.0.10-1-almalinux10-clang.x86_64.rpm
d5ab7eb35eb8845242c499c9bf2207713668c157ffa9866c81c853aa969a446c  proxysql-4.0.10-1-almalinux10.aarch64.rpm
2dad2409fdf09a3e64d6661fd3af8703238f0b7bef121faae85db57c5b6503d8  proxysql-4.0.10-1-almalinux10.x86_64.rpm
c95c61aef60d6d6fb90af13e98237a59b6aeb776defe9f4beeaa615fc340b398  proxysql-4.0.10-1-almalinux9-clang.x86_64.rpm
0e6a91ca8ca721da6eaf4c8c6359d0ef7119e5007810adda252467429d7ca4ac  proxysql-4.0.10-1-almalinux9.aarch64.rpm
4831f16b6c77f7f61681fb6eb019829a5263085a516ad0d8502fdc28598a35d5  proxysql-4.0.10-1-almalinux9.x86_64.rpm
8de4232e4d99aa512810a6a8ec6662309d5582535e95f43907876d3f5883fc90  proxysql-4.0.10-1-centos10-clang.x86_64.rpm
0e4c02b00cc485b5c0e162bc923a2ee5bbe9f184b1385070f75eb2b4aa3ee99c  proxysql-4.0.10-1-centos10.aarch64.rpm
758d9b429e25a9c83c1810d298afc6e2d944131d6490eaaf5b512e964ef5cb82  proxysql-4.0.10-1-centos10.x86_64.rpm
7eae4a73f71a2ee923e6a7db7f944e2414be163f28ef2988efbf2a0892dba5b5  proxysql-4.0.10-1-cento...

ProxySQL 3.1.10 Release Notes

Release date: 2026-07-31
Release commit: f5f1e148e

ProxySQL 3.1.10 is a maintenance and feature release for the Innovative Tier
(the Stable core plus FFTO and TSDB). Its headline change is pass-through
authentication for MySQL — an Innovative-tier / AI-MCP-tier feature that is
enabled in this tier but gated off on the 3.0.x Stable build. It also carries the
core changes shared with 3.0.10 (below): per-hostgroup query timeouts, time-based
purging of the query-digest stats, actionable feedback on LOAD ... VARIABLES TO RUNTIME, PostgreSQL Unix-socket support, AWS RDS Blue/Green monitoring,
complete configuration round-tripping, frontend COM_PING metrics, and a round
of prepared-statement, PostgreSQL protocol, compressed-packet, and backend-shunning
correctness fixes. There are no FFTO- or TSDB-specific code changes in this cycle,
so both subsystems behave identically to 3.1.9.

Release commit: f5f1e148e

Highlights

• Pass-through authentication (MySQL, opt-in, Phase 1) — Innovative/AI-MCP tier
  only: authenticate clients through ProxySQL using a credential only the backend
  knows; learned during the caching_sha2_password full-auth exchange, cached in
  memory, and gated behind rate-limiting, TLS, and an allowlist. Off by default;
  enable-able in 3.1.x/4.0.x but not on the 3.0.x Stable build (#5810, #5945).
• Per-hostgroup query timeouts: default_query_timeout in
  mysql_hostgroup_attributes.hostgroup_settings, precedence per-rule >
  per-hostgroup > global (#5772).
• Time-based PURGE of stats_mysql_query_digest by last-seen timestamp
  (#4920, closes #4543).
• Actionable feedback on config loads: LOAD ... VARIABLES TO RUNTIME now
  reports Records / Updated / Rejected / Unknown in the OK packet (#5857, fixes
  #1288).
• PostgreSQL Unix-domain-socket backends (port=0) (#5844, closes #5837).
• AWS RDS Blue/Green monitoring: topology-aware writer/reader switchover,
  green-hostgroup discovery, DNS pinning, connection draining, rollback cleanup,
  and cluster-synchronized configuration (#5861).
• Complete configuration round-tripping for firewall and fast-routing tables,
  server SSL parameters, and PostgreSQL hostgroup attributes (#5922, closes
  #3468).
• Frontend COM_PING metrics: Com_frontend_ping in stats_mysql_global
  and Prometheus (#5948).
• Correctness fixes: cross-hostgroup prepared-statement corruption (#5895),
  PostgreSQL mixed Bind result-format corruption (#5878), Bind with one format
  and zero parameters (#5899), zlib compressed-packet length validation
  (396c742f7, GHSA-fvch-fpgq-pwfx), and expired-password backend shunning
  (#5847).
• Portability & packaging: jemalloc page-size auto-detect for 16 KB/64 KB
  platforms (#5822) and generic Linux .tar.gz builds (#569).
• FFTO / TSDB: no changes this cycle; behavior is unchanged from 3.1.9. (FFTO
  remains opt-in in the 3.1.x tier.)

Innovative-tier feature: pass-through authentication (#5810)

Pass-through authentication lets a MySQL client authenticate through ProxySQL
without a pre-provisioned password in mysql_users: during the
caching_sha2_password full-auth exchange ProxySQL borrows the client's cleartext
password, probes a backend with it, and — on success — caches the learned
credential in memory. It is opt-in and off by default, controlled by the
mysql-passthrough_* globals, and adds stats_mysql_passthrough_auth_cache /
stats_mysql_passthrough_auth_metrics, PROXYSQL FLUSH PASSTHROUGH_AUTH_CACHE,
per-user/per-IP lockout, TLS gating, and a username_pattern allowlist.

This is an Innovative-tier (3.1.x) / AI-MCP-tier (4.0.x) feature: it is
enable-able on these builds, but gated off on the Stable 3.0.x build, where
mysql-passthrough_auth_enabled is forced to false at
LOAD MYSQL VARIABLES TO RUNTIME. See the Pass-Through Authentication User
Manual and Reference Manual for full configuration details.

Core changes (shared with 3.0.10)

ProxySQL 3.1.10 includes every feature, bug fix, and improvement from ProxySQL
3.0.10. In brief:

New Features

• Per-hostgroup query timeouts (#5772) — default_query_timeout hostgroup
  attribute for MySQL and PostgreSQL.
• AWS RDS Blue/Green monitoring (#5861) — topology-aware switchover,
  green-hostgroup discovery, DNS pinning, connection draining, and rollback
  cleanup.
• Full configuration round-tripping (#5922, closes #3468) — firewall and
  fast-routing tables, server SSL parameters, and PostgreSQL hostgroup
  attributes now survive config export and import.
• Frontend COM_PING metrics (#5948) — Com_frontend_ping in
  stats_mysql_global and Prometheus.
• Time-based purge of stats_mysql_query_digest (#4920, closes #4543).
• Visible feedback for rejected variables on LOAD ... VARIABLES TO RUNTIME
  (#5857, fixes #1288).
• PostgreSQL Unix-domain-socket backends (#5844, closes #5837).
• version field in PROXYSQL INTERNAL SESSION (#5877, implements #5859).
• Admin connect-setup robustness — strip leading SQL comments, accept
  SET LOCK_WAIT_TIMEOUT (#5826, #5786).
• Richer protocol-violation diagnostics — user / hostgroup / connection id in
  the log (#5936).

Bug Fixes

• MySQL compressed-packet information disclosure (396c742f7,
  GHSA-fvch-fpgq-pwfx) — zlib output must match the packet's declared length.
• PostgreSQL Bind with zero parameters (#5899) — one format for zero
  parameters is accepted, while other mismatches return a protocol violation.
• Cross-hostgroup STMT_EXECUTE dangling-bind corruption (#5895, fixes #5883).
• PostgreSQL heterogeneous Bind result formats now fail loud instead of
  silently corrupting data (#5878, fixes #5866).
• Unhealthy-connection diagnostics (#5946) now include the frontend user,
  hostgroup, and backend connection id in close warnings.
• Expired password (1862) no longer shuns the backend (#5847, see #5846).
• Monitor schema: unreachable port defaults dropped (#5850).

Dependencies, Build & Packaging

• Generic Linux .tar.gz binaries, one tarball per tier (#569, #5881, #5892,
  #5898, #5911).
• Portable jemalloc page-size detection (#5822, fixes #4863, #3252).
• ParserSQL v1.0.10 (#5915) and cpp-dotenv v1.1.0 (#5875).
• Packaging build pipeline cleanup (#5975) removes runtime protobuf
  installation where required and propagates container build failures through the
  packaging target.

Testing & CI

• macOS (Darwin) TAP build support (#5933); vendored replication/shunning suite
  (#5872, #5876, #5888, #5923); MySQL 9.x GR workflows and report_host fix
  (#5880, #5909); ParserSQL SET-parser test ports (#5893); coverage/CI hardening
  (#5843, #5858, #5870, #5914, #5917, #5867, #5920); post-draft pass-through
  pool-reuse regression coverage (#5944); AWS RDS BGD simulator and lifecycle
  coverage (#5861); and Codecov/cluster-workflow validation (#5954, #5963,
  #5966).

For the full descriptions of these core changes, see the ProxySQL 3.0.10 Release
Notes.

Innovative-Tier subsystems

• FFTO (Fast Forward Traffic Observer): no code changes this cycle; behavior
  unchanged from 3.1.9. FFTO remains opt-in in the 3.1.x tier.
• TSDB: no code changes this cycle; behavior unchanged from 3.1.9.

Contributors

Thanks to everyone who contributed to this release, including @renecannao,
@wazir-ahmed, @rahim-kanji, @burnison, @takaidohigasi, @shabih-paystack,
@anthonyryan1, @fogelito, and @Zhao73 .

Packages

Alongside the usual .deb and .rpm packages, this release ships generic Linux
tarballs — proxysql-3.1.10-linux-amd64.tar.gz and
proxysql-3.1.10-linux-arm64.tar.gz — each with a .sha256 checksum and a
detached .asc GPG signature made with the ProxySQL release key
(653F85BB38256DF8A96206C3E8CA2E8D8217C97E).

AlmaLinux 8 packages are intentionally not included: the platform cannot
satisfy the OpenSSL 3 requirement that ProxySQL 3.x depends on.

Hashes

The release commit is: f5f1e148e.

SHA256s:

65ee2f7e86172a67f1dc282daea049f531b6144970c9fa7bb51d5f9df65004b2  proxysql-3.1.10-1-almalinux10-clang.x86_64.rpm
3889307df783ab46cd6fdfcc1bb9b049431cf2aacea734db24e65197e0c6a94d  proxysql-3.1.10-1-almalinux10.aarch64.rpm
deb705a7e65653dbabab122b28cf9b737f1e0a9f1f0b491781b6d57aa304b988  proxysql-3.1.10-1-almalinux10.x86_64.rpm
d9033ff10a9509428229b8b56c764ee2ce133227877790df0b9196eedb08dd39  proxysql-3.1.10-1-almalinux9-clang.x86_64.rpm
fa4b73b87d1917a459a24e4ecf9613e8c8427e98bd885f07f84d9e6b348ab40c  proxysql-3.1.10-1-almalinux9.aarch64.rpm
fdd27053dfbd3617999dd102779cf0c1d91d3ab1eaedd1cc57d16da6adc76c5a  proxysql-3.1.10-1-almalinux9.x86_64.rpm
f6c1435311e35e1cce0605ce7ddf9366e5aeedd6f5f44758de2e8cd2d23fd8ff  proxysql-3.1.10-1-centos10-clang.x86_64.rpm
a46096f271b82640d10ee82372e4077e377ba9a33d78a607f843a09865ae5e96  proxysql-3.1.10-1-centos10.aarch64.rpm
f082909541bae76c156ea96b37b996e31ce0738ce4dbd8ef1dfa2ec2cff15509  proxysql-3.1.10-1-centos10.x86_64.rpm
24b418d26ce08f4d30ff52fde420a3cc50320ea697eb38190a285151d19275f5  proxysql-3.1.10-1-centos9-clang.x86_64.rpm
b804075909b492dd6d4ea2b122322fe6cf6f0d2f128b0e2d7abf2122374689de  proxysql-3.1.10-1-centos9.aarch64.rpm
5fa54a8ba37044dc4e90954b2e1c7cdf6d042090ccac6e438f4c327130756a8c  proxysql-3.1.10-1-centos9.x86_64.rpm
256f2e7cbe58bd00da0be345bb451791524d6eac658253347e27a6223d4183c6  proxysql-3.1.10-1-dbg-almalinux10.x86_64.rpm
414c08b47cf76997dd8db8b1e42ae742086f7bef7fa760840085f0473b232973  proxysql-3.1.10-1-dbg-almalinux9.x86_64.rpm
53eb78a09cb9c19d6a0fe060f034e629b48de4747d3afd9f57d0555166773076  proxysql-3.1.10-1-dbg-centos10.x86_64.rpm
95c8ca52fd693b35cc1d87e805b57b78fec423285b23d1c824564...

ProxySQL 3.0.10 Release Notes

Release date: 2026-07-31
Release commit: f5f1e148e
Covers all changes on the v3.0 branch since v3.0.9 (428 commits / 57 PRs,
plus the direct security fix 396c742f7).

ProxySQL 3.0.10 is a maintenance and feature release for the Stable Tier. Its
headline changes are per-hostgroup query timeouts, time-based purging of the
query-digest stats, visible feedback for rejected variables on
LOAD ... VARIABLES TO RUNTIME, PostgreSQL Unix-socket support, AWS RDS
Blue/Green monitoring, and complete configuration round-tripping, together
with correctness fixes for cross-hostgroup prepared statements,
PostgreSQL extended-protocol result formats, compressed MySQL packets, and
backend shunning on expired passwords — plus frontend COM_PING metrics,
generic Linux .tar.gz builds, a portable jemalloc page-size fix, and a broad
testing/CI hardening pass.

Note on pass-through authentication. The pass-through authentication feature
introduced this cycle (#5810, #5945) is an Innovative-tier / AI-MCP-tier feature and
is documented in the 3.1.10 / 4.0.10 release notes. Its code is present in the
3.0.10 Stable build, but it cannot be enabled on the Stable tier: setting
mysql-passthrough_auth_enabled=true is refused and forced back to false at
LOAD MYSQL VARIABLES TO RUNTIME. Use a 3.1.x or 4.0.x build to enable it.

Release commit: f5f1e148e

Highlights

• Per-hostgroup query timeouts: a new default_query_timeout attribute in
  mysql_hostgroup_attributes.hostgroup_settings sets a constant-time query
  timeout per hostgroup, with precedence per-rule > per-hostgroup > global
  (#5772).
• Time-based PURGE of stats_mysql_query_digest: prune digest rows by
  last-seen timestamp instead of wiping the whole table (#4920, closes #4543).
• Actionable feedback on config loads: LOAD MYSQL/PGSQL/ADMIN/... VARIABLES TO RUNTIME now reports Records: N Updated: X Rejected: Y Unknown: Z in the OK
  packet instead of a silent Query OK (#5857, fixes #1288).
• PostgreSQL Unix-domain-socket backends: pgsql_servers rows with port=0
  now connect over the socket path in hostname (#5844, closes #5837).
• AWS RDS Blue/Green monitoring: monitor mysql.rds_topology, manage writer
  and reader switchover state, support explicit and automatically discovered
  green hostgroups, pin green addresses, drain connections, and handle
  completion or rollback (#5861).
• Complete configuration round-tripping: SAVE CONFIG, SELECT CONFIG FILE,
  and LOAD ... FROM CONFIG now preserve firewall and fast-routing tables,
  server SSL parameters, and PostgreSQL hostgroup attributes (#5922, closes
  #3468).
• Frontend COM_PING metrics: Com_frontend_ping is exposed through
  stats_mysql_global and the Prometheus metrics surface (#5948).
• Correctness fixes for a cross-hostgroup prepared-statement memory bug that
  corrupted result rows (#5895), silent PostgreSQL data corruption on mixed Bind
  result formats (#5878), PostgreSQL Bind messages with one format and zero
  parameters (#5899), compressed MySQL packets with a mismatched zlib length
  (396c742f7, GHSA-fvch-fpgq-pwfx), and unwarranted backend shunning when a
  user's password is expired (#5847).
• Portability: jemalloc no longer crashes at startup on 16 KB/64 KB page
  platforms (Apple Silicon, AWS Graviton, ppc64le) (#5822), and ProxySQL now
  publishes generic Linux .tar.gz binaries in addition to RPM/DEB (#569).

New Features

Pass-through authentication (#5810) also landed on the v3.0 branch this
cycle but is gated to the Innovative (3.1.x) and AI/MCP (4.0.x) tiers — it cannot
be enabled on the Stable 3.0.x build (see the note above). It is described in
full in the 3.1.10 / 4.0.10 release notes.

Per-hostgroup query timeouts (#5772)

A new default_query_timeout pseudo-attribute in the
mysql_hostgroup_attributes.hostgroup_settings JSON column sets a per-hostgroup
query timeout in constant time, without pinning a query rule to a specific user.

INSERT INTO mysql_hostgroup_attributes (hostgroup_id, hostgroup_settings)
VALUES (100, '{"default_query_timeout": 8000}');
LOAD MYSQL SERVERS TO RUNTIME;

Precedence is per-rule mysql_query_rules.timeout > per-hostgroup
default_query_timeout > global mysql-default_query_timeout. The attribute is
validated and range-checked; an invalid or unset value falls back to the global
default. The same mechanism applies to the PostgreSQL hostgroup path.

AWS RDS Blue/Green deployment monitoring (#5861)

ProxySQL now monitors Amazon RDS Multi-AZ DB instance Blue/Green deployments
through mysql.rds_topology. The monitor maps blue and green writer/reader
hostgroups, supports explicit green hostgroups and automatic discovery, probes
the promoted writer directly, pins resolved green addresses, drains affected
connections, and handles completed switchovers, cancellation, rollback, and
topology cleanup. Configuration and runtime state are represented by the
mysql_aws_rds_bgd_hostgroups tables and participate in cluster synchronization.
The release also includes a simulator, TAP coverage, and unit tests for the
deployment lifecycle.

Full configuration round-tripping (#5922, closes #3468)

Configuration export and import now round-trip MySQL and PostgreSQL fast-routing
rules, firewall tables, server SSL parameters, and PostgreSQL hostgroup
attributes through SAVE CONFIG, SELECT CONFIG, SELECT INTO OUTFILE, and
the corresponding LOAD ... FROM CONFIG commands. Writers tolerate missing
optional sub-tables, so a partial or older Admin schema does not make the whole
configuration export fail.

Frontend COM_PING metrics (#5948)

Each frontend COM_PING received while a MySQL session is idle increments
Com_frontend_ping in stats_mysql_global and the corresponding
proxysql_com_frontend_ping_total Prometheus metric, making driver health-check
rates visible without inferring them from SELECT 1 traffic.

Time-based purge of stats_mysql_query_digest (#4920, closes #4543)

The PURGE command for the query-digest stats now accepts a last-seen timestamp,
so operators can prune only digests not seen since a given time instead of
clearing the entire table. The purge logic is unified across the synchronous and
asynchronous paths, and monotonic-to-realtime clock conversion helpers were added
to support it.

Visible feedback for rejected variables on config load (#5857, fixes #1288)

Previously, LOAD MYSQL VARIABLES TO RUNTIME (and the PGSQL, ADMIN,
SQLITESERVER, CLICKHOUSE, LDAP, and TSDB equivalents) silently dropped rows
whose value failed module-side validation, returning only Query OK, 0 rows affected. The OK packet's info field now carries a
Records: N Updated: X Rejected: Y Unknown: Z summary — e.g.
Records: 184 Updated: 181 Rejected: 2 Unknown: 1 — naming exactly how many
variables were accepted, rejected, or unknown. Existing log lines and
reset/delete semantics are unchanged.

PostgreSQL Unix-domain-socket backends (#5844, closes #5837)

When a pgsql_servers row has port=0, its hostname is treated as a
Unix-domain-socket directory path. libpq rejects port=0 outright, so ProxySQL
now omits the port= field from the conninfo string at the three sites that
build it (client connect, backend kill, and the PgSQL monitor).

PROXYSQL INTERNAL SESSION reports the build version (#5877, implements #5859)

The JSON returned by PROXYSQL INTERNAL SESSION now includes a version field
(for both the MySQL and PostgreSQL protocols), sourced from PROXYSQL_VERSION, so
a session dump can be correlated with the exact build that produced it. The key is
purely additive.

Admin connect-setup robustness (#5826, #5786)

The admin interface's connect-setup accept-blocks now strip leading whitespace and
/* … */ block comments before matching, so clients that prepend SQL tracing
comments to every statement — SQLCommenter, the Datadog Agent's mysql
integration, Sequelize, Hibernate — no longer fail admin-port connection setup
with near "SET": syntax error. SET LOCK_WAIT_TIMEOUT is also now accepted in
the connect-setup block.

Richer diagnostics on protocol violations (#5936)

When a client sends packets out of order, the "Unexpected packet" / "Unexpected
COM_QUIT" error log now includes the front-end username, hostgroup id, and
connection id, so the offending client can be correlated with the subsequent
KILL CONNECTION line.

Unhealthy-connection diagnostics (#5946)

Warnings emitted when ProxySQL closes an unhealthy or fast-forward client now
include the frontend username, current hostgroup, and backend connection id,
making the client, route, and backend session identifiable from the log entry.

Bug Fixes (Core ProxySQL)

• MySQL compressed-packet information disclosure (396c742f7,
  GHSA-fvch-fpgq-pwfx): the zlib decompression path now verifies that the number
  of bytes produced exactly matches the length declared by the packet before
  parsing the buffer, preventing uninitialized trailing memory from being
  interpreted as MySQL packets.
• PostgreSQL Bind with zero parameters (#5899): a Bind message containing
  one parameter format and no parameters is now accepted according to the
  PostgreSQL protocol; other format-count mismatches return a protocol-violation
  error.
• Dangling STMT_EXECUTE bind buffers across a hostgroup split (#5895, fixes
  #5883): stmt_execute_metadata_t.binds[i].buffer aliases packet/long-data
  memory that is freed after each execute. Only the MYSQL_TYPE_TIME-family
  buffers were being nulled, leaving the other parameter buffers dangling. Wh...

ProxySQL 3.1.9 Release Notes

Release date: 2026-06-04

ProxySQL 3.1.9 is a maintenance and feature release for the Innovative Tier
(the Stable core plus FFTO and TSDB). It carries the same core changes as 3.0.9
(below), plus a TSDB dashboard fix. Its
headline change is a new backend-pool session scheduler that keeps tail
latency in check when the connection pool is saturated. Alongside it, this
release introduces an optional, AST-based SQL parser engine (ParserSQL,
disabled by default), a major round of PostgreSQL work (an independent DNS
cache, much faster SCRAM-SHA-256 authentication, and several digest/startup
correctness fixes), MySQL/MariaDB protocol and charset fixes, AWS Aurora
replica autopurge, a long-standing query-routing bug fix, and a broad sweep of
dependency, build, and packaging hardening (GCC 16, new distros, signed-package
compatibility).

Release commit: 7ddb3dc01

Highlights

• Security: two critical CVEs fixed — a PROXY-Protocol-v1 source-IP spoof
  that bypassed client_addr ACLs (CVE-2026-48772) and a pre-auth heap overflow
  in first-packet handling (CVE-2026-48773). Upgrading is strongly recommended;
  see Security.
• Backend-pool session scheduler: a new per-thread session-partitioning pass
  that engages only under pool contention, cutting average and tail latency and
  preventing the oldest connection-waiters from being starved to timeout (#5819,
  #5825).
• ParserSQL (optional, off by default): a new vendored AST SQL parser that
  can drive query-digest generation, command-type classification, and SET
  parsing for both MySQL and PostgreSQL. Opt-in via mysql-set_parser_algorithm=3
  or mysql-query_processor_parser=1 (and the pgsql- equivalents); the legacy
  parser remains the default (#5736).
• Independent PostgreSQL DNS cache: PgSQL backends now resolve through their
  own DNS cache, removing a synchronous getaddrinfo stall inside libpq that
  could trip the watchdog when a resolver was degraded (#5806).
• Faster PostgreSQL SCRAM-SHA-256 authentication: caching the OpenSSL digest
  and SCRAM verifier roughly doubles connection throughput on SCRAM-heavy
  workloads, reaching parity with PgBouncer (#5689).
• AWS Aurora replica autopurge and a monitor race-condition fix (#5760).
• TSDB dashboard fixed: the embedded dashboard is now served from the REST
  API port so its metric queries resolve same-origin (#5775).
• Correctness fixes for query-rule fast routing, MariaDB collations,
  PostgreSQL query digests, and a large-packet double-free that could
  crash the proxy (#5763, #5807, #5764, #5808).

Security

This release fixes two critical, remotely-triggerable vulnerabilities. All
users on 3.0.8 and earlier should upgrade.

CVE-2026-48772 — PROXY-Protocol-v1 UNKNOWN source-IP spoofing

Critical · CVSS 10.0 · CWE-348/863 · GHSA-gw94-85m2-x8v2

When ProxySQL is configured to accept the PROXY protocol (v1), a header using the
UNKNOWN transport could still carry address fields, which ProxySQL parsed as
the client's source IP. A client able to speak the PROXY protocol to ProxySQL
could therefore present an arbitrary source address and bypass
mysql_query_rules.client_addr access-control rules. ProxySQL now rejects
address fields in UNKNOWN frames (commits 1d2e080a, 3ad60f68, with
regression tests). Affects 2.0.0–3.0.8; fixed in the 3.0.9 / 3.1.9 / 4.0.9 builds. Reported by
@addcontent.

CVE-2026-48773 — Pre-auth heap overflow in first-packet handling

Critical · CVSS 9.8 · CWE-787 · GHSA-58ww-865x-grpr

An unauthenticated client could trigger a heap buffer overflow in the
first-packet handling of both the MySQL and PostgreSQL data streams. ProxySQL now
bounds the first-packet recv() on both protocols (commit 1cb2ecc1, with the
oversize_first_pkt-t regression test). Affects 2.0.18–3.0.8; fixed in the 3.0.9 / 3.1.9 / 4.0.9 builds.
Reported by @kamil-sawicki.

New Features

Backend-pool session scheduler (#5819, #5825)

Under heavy connection-pool contention — many client sessions competing for a
small backend pool — ProxySQL's per-thread session loop could spend its time
re-examining sessions that had no work to do, and could keep serving newer
pool-waiters ahead of older ones. This release adds a session-partitioning pass
to Base_Thread (shared by both the MySQL and PostgreSQL threads) that, on each
outer iteration, groups sessions into running / waiting-on-pool / idle bands so
that a connection released at the end of one session's query is handed to a
waiting session within the same iteration.

The pass is gated: it only engages when the pool is actually under pressure,
detected from the ratio of failed get_MyConn_from_pool() acquisitions with a
short hysteresis and a minimum-attempts floor so that low-volume noise does not
trip it. When contention is detected, the longest-waiting session in the
CONNECTING_SERVER band is promoted to be served first, so the session closest
to hitting connect_timeout_server_max is the one that gets the next freed
connection instead of being starved to an abort. A 1-in-N local
connection-cache change removes the per-thread connection hoarding that
previously caused a throughput cliff at higher thread counts. On a sustained
4 KB-row, TLS workload this moved a single worker from ~1,303 to ~1,487 tps
(384 ms → 336 ms average latency) and scaled cleanly with thread count. The
behavior is automatic; there is nothing to configure.

ParserSQL: optional AST SQL parser engine (#5736)

ProxySQL now vendors ParserSQL (1.0.9) as a static library and wires it in
through an adapter that can provide three things: query-digest generation,
command-type classification, and SET-statement parsing, for both the MySQL and
PostgreSQL dialects. It is disabled by default — the existing parser remains
in charge — and is enabled per protocol through two runtime variables:
set_parser_algorithm=3 switches only SET parsing to ParserSQL (conservative),
while query_processor_parser=1 routes digest, command-type, and SET through
it (full mode). The parser runs as per-thread state on the query hot path (no
locks, O(1) arena reset) and preserves SpookyHash digesting for backward
compatibility. This cycle also extended the engine's PostgreSQL SET handling to
cover the SET TIME ZONE alias and multi-value lists such as
SET search_path TO "$user", public (#5805).

Independent PostgreSQL DNS cache (#5806, fixes #5768)

The PostgreSQL side now owns a DNS cache that mirrors the MySQL one — its own
cache instance, resolver loop, and counters — so admin changes to one protocol's
cache no longer affect the other. On a cache hit, PgSQL_Connection passes
hostaddr=<ip> to libpq, so PQconnectStart() no longer blocks synchronously
inside getaddrinfo when the resolver is slow or broken. That synchronous stall
was the root cause behind the watchdog asserts reported in #5768. Three new
counters — PgSQL_Monitor_dns_cache_queried, _lookup_success, and
_record_updated — are exposed in stats_pgsql_global.

Faster PostgreSQL SCRAM-SHA-256 authentication (#5689)

On OpenSSL 3.x, EVP_sha256() performs a global, lock-contended EVP_MD_fetch()
on every call — roughly 4,096 redundant fetches per SCRAM PBKDF2 derivation, and
the dominant cost (~58% of CPU) on SCRAM-heavy PostgreSQL workloads. ProxySQL now
fetches the SHA-256 digest once and reuses it, and caches the derived SCRAM
verifier for plaintext-password accounts so repeat connections skip PBKDF2
entirely. In a serial connect/disconnect benchmark over SCRAM-SHA-256 + TLS this
raised throughput from ~137 to ~229 connections/sec — parity with PgBouncer.

AWS Aurora replica autopurge (#5760)

Aurora replicas that disappear from REPLICA_HOST_STATUS are now removed from
mysql_servers once they have been missing for the configured
autopurge_missing_checks threshold, instead of lingering as stale entries. The
change also fixes a monitor race condition in the Aurora discovery path.

Galera wsrep session variables and MariaDB SET STATEMENT ... FOR (#5708, closes #5686)

wsrep_trx_fragment_size and wsrep_trx_fragment_unit are now tracked
session variables, captured on SET and synchronized to backend connections like
the existing wsrep_sync_wait. ProxySQL also recognizes MariaDB's
SET STATEMENT var=val ... FOR <statement> syntax and forwards it without locking
the session to a hostgroup — previously this syntax was unrecognized and could
lock the session, surfacing as error 9006 on a later query bound to a different
hostgroup.

MySQL greeting advertises CLIENT_PLUGIN_AUTH_LENENC_CLIENT_DATA (#5744, closes #4760)

ProxySQL already parsed length-encoded client auth data but never advertised the
corresponding capability bit, so stricter clients such as Boost.MySQL refused to
connect. The flag is now set in the server greeting.

TSDB dashboard served from the REST API port (#5775, fixes #5684)

The embedded TSDB dashboard issues relative-URL fetch() calls to /api/tsdb/*,
but it was served from admin-web_port (default 6080) while those endpoints live
on admin-restapi_port (default 6070), so every request 404'd and the dashboard
showed "Error loading metrics". The dashboard is now served from the REST API
port, making its requests same-origin with the API they call — no CORS, no
configuration changes.

Bug Fixes (Core ProxySQL)

• Large-packet COM_STMT_EXECUTE double-free / SIGSEGV (#5808, fixes #5639):
  an oversized binary prepared-statement packet that tripped
  mysql-max_allowed_packet could free the same buffer twice in
  handler_WCD_SS_MCQ_qpo_LargePacket(). With jemalloc this silently corrupted
  the allocator and crashed intermittently under load; the handler now detects
  the aliased buffer and frees it once.
• MariaDB collation regression (#5807, fixes #5790): a MySQL-9.x charset fix
  ...

ProxySQL 3.0.9 Release Notes

Release date: 2026-06-04

ProxySQL 3.0.9 is a maintenance and feature release for the Stable Tier. Its
headline change is a new backend-pool session scheduler that keeps tail
latency in check when the connection pool is saturated. Alongside it, this
release introduces an optional, AST-based SQL parser engine (ParserSQL,
disabled by default), a major round of PostgreSQL work (an independent DNS
cache, much faster SCRAM-SHA-256 authentication, and several digest/startup
correctness fixes), MySQL/MariaDB protocol and charset fixes, AWS Aurora
replica autopurge, a long-standing query-routing bug fix, and a broad sweep of
dependency, build, and packaging hardening (GCC 16, new distros, signed-package
compatibility).

Release commit: 7ddb3dc01

Highlights

• Security: two critical CVEs fixed — a PROXY-Protocol-v1 source-IP spoof
  that bypassed client_addr ACLs (CVE-2026-48772) and a pre-auth heap overflow
  in first-packet handling (CVE-2026-48773). Upgrading is strongly recommended;
  see Security.
• Backend-pool session scheduler: a new per-thread session-partitioning pass
  that engages only under pool contention, cutting average and tail latency and
  preventing the oldest connection-waiters from being starved to timeout (#5819,
  #5825).
• ParserSQL (optional, off by default): a new vendored AST SQL parser that
  can drive query-digest generation, command-type classification, and SET
  parsing for both MySQL and PostgreSQL. Opt-in via mysql-set_parser_algorithm=3
  or mysql-query_processor_parser=1 (and the pgsql- equivalents); the legacy
  parser remains the default (#5736).
• Independent PostgreSQL DNS cache: PgSQL backends now resolve through their
  own DNS cache, removing a synchronous getaddrinfo stall inside libpq that
  could trip the watchdog when a resolver was degraded (#5806).
• Faster PostgreSQL SCRAM-SHA-256 authentication: caching the OpenSSL digest
  and SCRAM verifier roughly doubles connection throughput on SCRAM-heavy
  workloads, reaching parity with PgBouncer (#5689).
• AWS Aurora replica autopurge and a monitor race-condition fix (#5760).
• Correctness fixes for query-rule fast routing, MariaDB collations,
  PostgreSQL query digests, and a large-packet double-free that could
  crash the proxy (#5763, #5807, #5764, #5808).

Security

This release fixes two critical, remotely-triggerable vulnerabilities. All
users on 3.0.8 and earlier should upgrade.

CVE-2026-48772 — PROXY-Protocol-v1 UNKNOWN source-IP spoofing

Critical · CVSS 10.0 · CWE-348/863 · GHSA-gw94-85m2-x8v2

When ProxySQL is configured to accept the PROXY protocol (v1), a header using the
UNKNOWN transport could still carry address fields, which ProxySQL parsed as
the client's source IP. A client able to speak the PROXY protocol to ProxySQL
could therefore present an arbitrary source address and bypass
mysql_query_rules.client_addr access-control rules. ProxySQL now rejects
address fields in UNKNOWN frames (commits 1d2e080a, 3ad60f68, with
regression tests). Affects 2.0.0–3.0.8; fixed in the 3.0.9 / 3.1.9 / 4.0.9 builds. Reported by
@addcontent.

CVE-2026-48773 — Pre-auth heap overflow in first-packet handling

Critical · CVSS 9.8 · CWE-787 · GHSA-58ww-865x-grpr

An unauthenticated client could trigger a heap buffer overflow in the
first-packet handling of both the MySQL and PostgreSQL data streams. ProxySQL now
bounds the first-packet recv() on both protocols (commit 1cb2ecc1, with the
oversize_first_pkt-t regression test). Affects 2.0.18–3.0.8; fixed in the 3.0.9 / 3.1.9 / 4.0.9 builds.
Reported by @kamil-sawicki.

New Features

Backend-pool session scheduler (#5819, #5825)

Under heavy connection-pool contention — many client sessions competing for a
small backend pool — ProxySQL's per-thread session loop could spend its time
re-examining sessions that had no work to do, and could keep serving newer
pool-waiters ahead of older ones. This release adds a session-partitioning pass
to Base_Thread (shared by both the MySQL and PostgreSQL threads) that, on each
outer iteration, groups sessions into running / waiting-on-pool / idle bands so
that a connection released at the end of one session's query is handed to a
waiting session within the same iteration.

The pass is gated: it only engages when the pool is actually under pressure,
detected from the ratio of failed get_MyConn_from_pool() acquisitions with a
short hysteresis and a minimum-attempts floor so that low-volume noise does not
trip it. When contention is detected, the longest-waiting session in the
CONNECTING_SERVER band is promoted to be served first, so the session closest
to hitting connect_timeout_server_max is the one that gets the next freed
connection instead of being starved to an abort. A 1-in-N local
connection-cache change removes the per-thread connection hoarding that
previously caused a throughput cliff at higher thread counts. On a sustained
4 KB-row, TLS workload this moved a single worker from ~1,303 to ~1,487 tps
(384 ms → 336 ms average latency) and scaled cleanly with thread count. The
behavior is automatic; there is nothing to configure.

ParserSQL: optional AST SQL parser engine (#5736)

ProxySQL now vendors ParserSQL (1.0.9) as a static library and wires it in
through an adapter that can provide three things: query-digest generation,
command-type classification, and SET-statement parsing, for both the MySQL and
PostgreSQL dialects. It is disabled by default — the existing parser remains
in charge — and is enabled per protocol through two runtime variables:
set_parser_algorithm=3 switches only SET parsing to ParserSQL (conservative),
while query_processor_parser=1 routes digest, command-type, and SET through
it (full mode). The parser runs as per-thread state on the query hot path (no
locks, O(1) arena reset) and preserves SpookyHash digesting for backward
compatibility. This cycle also extended the engine's PostgreSQL SET handling to
cover the SET TIME ZONE alias and multi-value lists such as
SET search_path TO "$user", public (#5805).

Independent PostgreSQL DNS cache (#5806, fixes #5768)

The PostgreSQL side now owns a DNS cache that mirrors the MySQL one — its own
cache instance, resolver loop, and counters — so admin changes to one protocol's
cache no longer affect the other. On a cache hit, PgSQL_Connection passes
hostaddr=<ip> to libpq, so PQconnectStart() no longer blocks synchronously
inside getaddrinfo when the resolver is slow or broken. That synchronous stall
was the root cause behind the watchdog asserts reported in #5768. Three new
counters — PgSQL_Monitor_dns_cache_queried, _lookup_success, and
_record_updated — are exposed in stats_pgsql_global.

Faster PostgreSQL SCRAM-SHA-256 authentication (#5689)

On OpenSSL 3.x, EVP_sha256() performs a global, lock-contended EVP_MD_fetch()
on every call — roughly 4,096 redundant fetches per SCRAM PBKDF2 derivation, and
the dominant cost (~58% of CPU) on SCRAM-heavy PostgreSQL workloads. ProxySQL now
fetches the SHA-256 digest once and reuses it, and caches the derived SCRAM
verifier for plaintext-password accounts so repeat connections skip PBKDF2
entirely. In a serial connect/disconnect benchmark over SCRAM-SHA-256 + TLS this
raised throughput from ~137 to ~229 connections/sec — parity with PgBouncer.

AWS Aurora replica autopurge (#5760)

Aurora replicas that disappear from REPLICA_HOST_STATUS are now removed from
mysql_servers once they have been missing for the configured
autopurge_missing_checks threshold, instead of lingering as stale entries. The
change also fixes a monitor race condition in the Aurora discovery path.

Galera wsrep session variables and MariaDB SET STATEMENT ... FOR (#5708, closes #5686)

wsrep_trx_fragment_size and wsrep_trx_fragment_unit are now tracked
session variables, captured on SET and synchronized to backend connections like
the existing wsrep_sync_wait. ProxySQL also recognizes MariaDB's
SET STATEMENT var=val ... FOR <statement> syntax and forwards it without locking
the session to a hostgroup — previously this syntax was unrecognized and could
lock the session, surfacing as error 9006 on a later query bound to a different
hostgroup.

MySQL greeting advertises CLIENT_PLUGIN_AUTH_LENENC_CLIENT_DATA (#5744, closes #4760)

ProxySQL already parsed length-encoded client auth data but never advertised the
corresponding capability bit, so stricter clients such as Boost.MySQL refused to
connect. The flag is now set in the server greeting.

Bug Fixes (Core ProxySQL)

• Large-packet COM_STMT_EXECUTE double-free / SIGSEGV (#5808, fixes #5639):
  an oversized binary prepared-statement packet that tripped
  mysql-max_allowed_packet could free the same buffer twice in
  handler_WCD_SS_MCQ_qpo_LargePacket(). With jemalloc this silently corrupted
  the allocator and crashed intermittently under load; the handler now detects
  the aliased buffer and frees it once.
• MariaDB collation regression (#5807, fixes #5790): a MySQL-9.x charset fix
  inadvertently made ProxySQL treat MariaDB 10.x/11.x as MySQL ≥ 8 and forward
  SET NAMES utf8mb4 COLLATE utf8mb4_0900_ai_ci unmodified, failing with
  ERROR 1273: Unknown collation. MariaDB is now detected explicitly. The same
  PR repairs sibling version-detection sites, including two in MySQL_Monitor
  that broke health checks against MySQL 9.x Galera/PXC.
• Query rule apply=1 could bypass fast routing (#5763, closes #5620): when
  no mysql_query_rules rule matched but the last-iterated rule happened to have
  apply=1, mysql_query_rules_fast_routing was skipped, sending traffic to the
  default_hostgroup (or failing with ERROR 9001). The matcher no longer leaks
  the last-iterated rule past a non-match.
• __PostgreSQL...

ProxySQL 4.0.8 Release Notes

Release date: 2026-04-25

ProxySQL 4.0.8 is a maintenance release for the AI/MCP Tier, incorporating all improvements from ProxySQL 3.1.8 and 3.0.8. The headline 4.0-specific change in this cycle is the removal of the experimental Rust-based sqlite-rembed dependency, which eliminates the Rust toolchain requirement for PROXYSQLGENAI=1 builds and trims the GenAI documentation accordingly.

Release commit: 6ef036a00c6f1dbcf3f27fe7f6e07f3211d7d6f8

Highlights (AI/MCP Tier)

• No Rust Toolchain Required: With sqlite-rembed removed, PROXYSQLGENAI=1 (and therefore PROXYSQL31=1) builds no longer require rustc / cargo. sqlite-vec (the C-only sibling) is preserved.
• FFTO Enabled by Default (4.0.x): FFTO remains enabled by default in 4.0.x, providing full traffic observability out of the box. (FFTO is opt-in in 3.1.x.)
• All 3.1.8 / 3.0.8 Improvements Included: MySQL session-variable tracking (#5166), PostgreSQL Cluster Sync (#5297), per-server PgSQL backend SSL (#5583), PgSQL backend SSL keylog (#5567), mid-transaction backend-death recovery (#5654, #5659), mysql-zstd_compression_level (#5637), mysql-resolution_family (#5554), and the caching_sha2_password hex-rounds authentication fix.
• AI/MCP-Tier Package Coverage: The new on-demand package pipeline produces proxysql-4.0.8-* RPMs / DEBs for 13 distros × 2 architectures and proxysql-4.0.8-<sha>-macos-<arch>.tar.gz tarballs for macOS.

New Features (4.0.x)

Build Simplification

Removed Vendored sqlite-rembed and Rust Toolchain Requirement (#5616, c3266dd, 57c3e3f)

The experimental sqlite-rembed-0.0.1-alpha.9 Rust extension (previously vendored under deps/sqlite3/sqlite-rembed-source/) has been removed. The extension's hook pointer was permanently NULL in the runtime, with a TODO admitting the original integration was incomplete — so the extension was never registered at runtime in any tier, stable or GENAI.

With sqlite-rembed gone, the only consumer of rustc/cargo in the tree is removed, and the Rust toolchain detection block in deps/Makefile (along with the SQLITE3_* env exports that existed solely for the cargo build) goes with it. PROXYSQLGENAI=1 builds now succeed with rustc and cargo stripped from PATH.

Documentation in doc/GENAI.md and doc/SQLite3-Server.md has been updated to remove references to sqlite-rembed. Nine rembed-only auxiliary docs/scripts (shell demos, SQL examples, integration guide, posts-embeddings setup, MCP vector embeddings plan, python processor) are also removed. sqlite-vec (the C-only sibling) is preserved unchanged and continues to be registered under #ifdef PROXYSQLGENAI.

Known Limitation: GenAI on Older Distributions

The GenAI tier relies on C++17 features (notably std::regex::multiline) that are unavailable on the libstdc++ shipping with AlmaLinux 8 and on the libc++ shipping with openSUSE Leap 15. proxysql-4.0.8-*-almalinux8* and proxysql-4.0.8-*-opensuse15* packages are therefore not produced in this cycle. Use a newer distribution (AlmaLinux 9+, Fedora 42+, Debian 12+, Ubuntu 22.04+, openSUSE Leap 16) for the GenAI tier.

Features Inherited from v3.1.8 (Innovative Tier)

ProxySQL 4.0.8 includes all features from the v3.1.8 (Innovative) release, including:

• FFTO Default Behavior: FFTO remains enabled by default in 4.0.x.
• TSDB Subsystem: Behavior unchanged this cycle (warning cleanup and lint pass only).

Features Inherited from v3.0.8 (Stable Tier)

ProxySQL 4.0.8 includes all features, bug fixes, and improvements from the v3.0.8 release, including:

• MySQL Session-Variable Tracking — new mysql-session_track_system_variables mode (DISABLED / OPTIONAL / ENFORCED) with backend-driven variable sync and per-server backoff (#5166).
• PostgreSQL Cluster Sync — peer-to-peer sync for PgSQL admin tables with runtime checksums and save-to-disk (#5297).
• Per-Server PgSQL Backend SSL — new pgsql_servers_ssl_params admin table mirroring mysql_servers_ssl_params (#5583).
• PgSQL Backend SSL Keylog — NSS-format keylog for PgSQL backends via libpq PQsetSSLKeyLogCallback patch (#5567).
• PgSQL Mid-Transaction Backend-Death Recovery — pgsql-preserve_client_on_broken_backend_in_tx (default true) keeps client sessions alive across mid-tx backend death, with new pgsql_tx_poisoned_* counters (#5654, #5659).
• PgSQL Monitor: Scheduler Clamp on Interval Change — runtime interval changes take effect immediately (#5614).
• PgSQL CopyCmdMatcher — fast-reject + comment-tolerant regex (#5596).
• GTID Ranged Updates — internal Gtid_Interval/GTID_Set rework + I3/I4 wire-message parsing (#5224, #5557).
• MySQL mysql-zstd_compression_level — decoupled from zlib, range 1–22 default 3 (#5637).
• MySQL mysql-resolution_family — deterministic IPv4/IPv6 backend hostname resolution (#5554).
• Greeting Capabilities Restored — upper-word capability bits re-advertised in the MySQL greeting.
• Authentication: caching_sha2_password rounds parsed as hex; CACHING_SHA2_PASSWORD() accepts an optional rounds argument (#5640).
• Bug Fixes: MySQL 9.x charset handling in validate_charset; GR Monitor first-iteration probe; GTID range validation; GTID parser NULL check after strchr; PgSQL MD5 → EVP migration.
• Build & Platform: macOS build support (#5664); 156 on-demand Linux package workflows + 6 macOS workflows landing in a single canonical draft release (#5662, #5666, #5668, #5671); ASAN unit-test coverage (#5618).
• Code Quality: lint and static-analysis sweep across ~100+ files (#5594).

For a detailed list of these core improvements, please refer to the ProxySQL 3.0.8 Release Notes.

Contributors

ProxySQL is a community-driven project, and we are grateful to all the contributors who helped make this release possible. A special thank you to:

• @wazir-ahmed for MySQL session-variable tracking (#5166), GTID range parsing and unit tests, TSDB / MCP stack maintenance, and the GTID strchr NULL-check.
• @rahim-kanji for PostgreSQL Cluster Sync (#5297), the mid-transaction backend-death recovery (#5654, #5659), per-server PgSQL SSL parameters (#5583), PgSQL backend SSL keylog (#5567), the CopyCmdMatcher improvements (#5596), the PgSQL Monitor scheduler clamp (#5614), and the MD5→EVP migration.
• @proton-lisandro-pin for the initial GTID interval refactor that made ranged updates possible (#5224).
• @mirostauder for continued build system and distribution-support work.

We also thank everyone who reported bugs, tested experimental features, and provided feedback during this release cycle.

Hashes

The release commit is: 6ef036a00c6f1dbcf3f27fe7f6e07f3211d7d6f8

SHA256s:

a0d752e8237d7430ce0402cc44f405167465e6d4af61f6ba5b8c553411d86caa  proxysql-4.0.8-1-almalinux10-clang.x86_64.rpm
afee23221dea2d14a1bfa70b3955d767205793ccc5e9bda0bb7063a562f183f4  proxysql-4.0.8-1-almalinux10.aarch64.rpm
a54365781a64b19404e889ddc4f9ca41c84476d05b52592b80c0c84d3b989207  proxysql-4.0.8-1-almalinux10.x86_64.rpm
0af0f13a9ffaf1327dc9f73ed9288d81a006e37c105d44d7735df3efbd1b9020  proxysql-4.0.8-1-almalinux8-clang.x86_64.rpm
e087cdd8043e22e50c4397e796288fd0bba3dae2e73e0b476966d377d20ebb2a  proxysql-4.0.8-1-almalinux9-clang.x86_64.rpm
d4b3218b69381cdf32b2a98c9d39ff254863be5222129e59b9d93f2f67fdfa51  proxysql-4.0.8-1-almalinux9.aarch64.rpm
195511daf4b6ba5a492d723e773f5f0f2480d28baa153094b16306b647624a5b  proxysql-4.0.8-1-almalinux9.x86_64.rpm
1b4de34df68be976ed845386bf59f3f21cae8a12ebdc7b9dc81d1b8608d16669  proxysql-4.0.8-1-centos10-clang.x86_64.rpm
2dd449a30e553904546a31689dc9ad567bc895b829d6523bab53c79280fe88d2  proxysql-4.0.8-1-centos10.aarch64.rpm
c00b87676efcdd14151ca6e6903d4261512042b7b59e083bd5a7a47bdec5fc17  proxysql-4.0.8-1-centos10.x86_64.rpm
a31a41ce0854da778dbbf0717d183a5c5a2f908ee2237647e361b2ce3f76f416  proxysql-4.0.8-1-centos9-clang.x86_64.rpm
35b90544d06f15843a1a2ebe173cce1512a8af674c5e397b9e2890b73e500c85  proxysql-4.0.8-1-centos9.aarch64.rpm
633904432573058dd14a406f0c34866e226fe12674702e52dd78211a5750f10b  proxysql-4.0.8-1-centos9.x86_64.rpm
6c75ad2a5dc16713f78c93220f51e28aaa232d6d048ca7f304d21fb98e20e9c9  proxysql-4.0.8-1-dbg-almalinux10.x86_64.rpm
7618f395f70e78111394413da71331ab9778d8e1feb7b556c8f5f7e96bf11a09  proxysql-4.0.8-1-dbg-almalinux9.x86_64.rpm
794eb173364a6d9f34bb8a6128e98643ec212afc548136699bc6d99034759354  proxysql-4.0.8-1-dbg-centos10.x86_64.rpm
182918b181516afd2eec4a7c7b21b87568298f5d3e8482aedb06f8106d13f0a7  proxysql-4.0.8-1-dbg-centos9.x86_64.rpm
c5f1aa0e6e34aab390734d20d7db159aaa1e5297b18e00337ebee3bea95c1fe4  proxysql-4.0.8-1-dbg-fedora42.x86_64.rpm
fa666ac3e9e55a10a10d08a1e2ce9902f26c05ba0bae5fb6b0956c5206c02486  proxysql-4.0.8-1-dbg-fedora43.x86_64.rpm
1bbc1917f9c82203e3089b3094e4b1b3111cc62c904de501d1ac06c2f3732204  proxysql-4.0.8-1-dbg-opensuse16.x86_64.rpm
75674ace4668a47a22853de405e9e4d3f2c22838ce1f1a7029ab88eb9c758b28  proxysql-4.0.8-1-fedora42-clang.x86_64.rpm
4eae9c412b5689c12fb3610d50e99157afeda9c900daffe2a833060f55ce9376  proxysql-4.0.8-1-fedora42.aarch64.rpm
b1a357dfb596eec65751403a911edf2329641ecf93552820b8f60cfa3ccacb9c  proxysql-4.0.8-1-fedora42.x86_64.rpm
e70577994e8ce44baef3d0198500641fb0b3a935b65237e19c366eaec747dedc  proxysql-4.0.8-1-fedora43-clang.x86_64.rpm
426ab9c855cbc692b796b598981c484bf8aab69db30f04e6aa9f013acc20bd0c  proxysql-4.0.8-1-fedora43.aarch64.rpm
e45b1c415e6b14fae122e7c06eb26540974c19dacde2573a01ce3628a79939f6  proxysql-4.0.8-1-fedora43.x86_64.rpm
b5aa0d57e860e1039c7bc4ff31a575d08fdca13b5a8a681c17f49f95f75badc9  proxysql-4.0.8-1-opensuse16-clang.x86_64.rpm
e7ffaa00743c32dc00bc8645f1f66781af659cdc12104a5013de7bb110b21d5d  proxysql-4.0.8-1-opensuse16.aarch64.rpm
a9e89d29eb05fca6d0b04a1fb7fa99fe1fee82663b6cc830174ffac8324464ac  proxysql-4.0.8-1-opensuse16.x86_64.rpm
cd48c831b71b50aacd66a7cfd9a32550c92f28427bc16e3dcc8bebb1c1ebfa32  proxysql_4...

ProxySQL 3.1.8 Release Notes

Release date: 2026-04-25

ProxySQL 3.1.8 is a maintenance release for the Innovative Tier, incorporating all improvements from ProxySQL 3.0.8. This version is built using PROXYSQL31=1, which enables the Fast Forward Traffic Observer (FFTO) and Time-Series Database (TSDB) subsystems.

Release commit: 6ef036a00c6f1dbcf3f27fe7f6e07f3211d7d6f8

Highlights (Innovative Tier)

• Inherits All 3.0.8 Improvements: MySQL session-variable tracking (#5166), PostgreSQL Cluster Sync (#5297), per-server PgSQL backend SSL (#5583), PgSQL backend SSL keylog (#5567), mid-transaction backend-death recovery (#5654, #5659), mysql-zstd_compression_level (#5637), mysql-resolution_family (#5554), and the caching_sha2_password hex-rounds authentication fix.
• FFTO Stays Opt-In in 3.1.x: FFTO remains disabled by default in 3.1.x (introduced in 3.1.7 for stability). Administrators who wish to use FFTO must explicitly enable it via mysql-enable_ffto / pgsql-enable_ffto. FFTO continues to be enabled by default in 4.0.x.
• TSDB Behavior Unchanged: No user-visible TSDB changes this cycle; the lib-wide warning cleanup and lint sweep also touch TSDB compile-time hygiene without altering behavior.
• No Rust Toolchain Required: Removal of the vendored sqlite-rembed extension (the only consumer of rustc/cargo) means PROXYSQL31=1 builds no longer require the Rust toolchain.
• Innovative-Tier Package Coverage: The new on-demand package pipeline produces proxysql-3.1.8-* RPMs / DEBs for 13 distros × 2 architectures and proxysql-3.1.8-<sha>-macos-<arch>.tar.gz tarballs for macOS.

New Features (3.1.x)

This release does not add 3.1.x-specific features beyond what is inherited from 3.0.8. FFTO and TSDB behavior is unchanged from 3.1.7 except for cross-cutting code-quality improvements (warning cleanup, lint pass, deprecated-API migration) that also apply to those subsystems.

Features Inherited from v3.0.8 (Stable Tier)

ProxySQL 3.1.8 includes all features, bug fixes, and improvements from the v3.0.8 release, including:

• MySQL Session-Variable Tracking — new mysql-session_track_system_variables mode (DISABLED / OPTIONAL / ENFORCED) with backend-driven variable sync and per-server backoff (#5166).
• PostgreSQL Cluster Sync — peer-to-peer sync for PgSQL admin tables with runtime checksums and save-to-disk (#5297).
• Per-Server PgSQL Backend SSL — new pgsql_servers_ssl_params admin table mirroring mysql_servers_ssl_params (#5583).
• PgSQL Backend SSL Keylog — NSS-format keylog for PgSQL backends via libpq PQsetSSLKeyLogCallback patch (#5567).
• PgSQL Mid-Transaction Backend-Death Recovery — pgsql-preserve_client_on_broken_backend_in_tx (default true) keeps client sessions alive across mid-tx backend death, with new pgsql_tx_poisoned_* counters (#5654, #5659).
• PgSQL Monitor: Scheduler Clamp on Interval Change — runtime interval changes take effect immediately (#5614).
• PgSQL CopyCmdMatcher — fast-reject + comment-tolerant regex (#5596).
• GTID Ranged Updates — internal Gtid_Interval/GTID_Set rework + I3/I4 wire-message parsing (#5224, #5557).
• MySQL mysql-zstd_compression_level — decoupled from zlib, range 1–22 default 3 (#5637).
• MySQL mysql-resolution_family — deterministic IPv4/IPv6 backend hostname resolution (#5554).
• Greeting Capabilities Restored — upper-word capability bits re-advertised in the MySQL greeting.
• Authentication: caching_sha2_password rounds parsed as hex; CACHING_SHA2_PASSWORD() accepts an optional rounds argument (#5640).
• Bug Fixes: MySQL 9.x charset handling in validate_charset; GR Monitor first-iteration probe; GTID range validation; GTID parser NULL check after strchr; PgSQL MD5 → EVP migration.
• Build & Platform: macOS build support (#5664); no Rust toolchain required after sqlite-rembed removal (#5616); 156 on-demand Linux package workflows + 6 macOS workflows landing in a single canonical draft release (#5662, #5666, #5668, #5671); ASAN unit-test coverage (#5618).
• Code Quality: lint and static-analysis sweep across ~100+ files (#5594).

For a detailed list of these core improvements, please refer to the ProxySQL 3.0.8 Release Notes.

Contributors

ProxySQL is a community-driven project, and we are grateful to all the contributors who helped make this release possible. A special thank you to:

• @wazir-ahmed for MySQL session-variable tracking (#5166), GTID range parsing and unit tests, the GTID strchr NULL-check, and ENFORCED-mode capability preservation.
• @rahim-kanji for PostgreSQL Cluster Sync (#5297), the mid-transaction backend-death recovery (#5654, #5659), per-server PgSQL SSL parameters (#5583), PgSQL backend SSL keylog (#5567), the CopyCmdMatcher improvements (#5596), the PgSQL Monitor scheduler clamp (#5614), and the MD5→EVP migration.
• @proton-lisandro-pin for the initial GTID interval refactor that made ranged updates possible (#5224).
• @mirostauder for continued build system and distribution-support work.

We also thank everyone who reported bugs, tested experimental features, and provided feedback during this release cycle.

Hashes

The release commit is: 6ef036a00c6f1dbcf3f27fe7f6e07f3211d7d6f8

SHA256s:

058ccc6436e5bb388580b24ab106828284f8a8fa157eb284ea0232f29719206d  proxysql-3.1.8-1-almalinux10-clang.x86_64.rpm
163e24ed799e0f26c850f101dca029d64296192909aae6c6017dbea1768d82d7  proxysql-3.1.8-1-almalinux10.aarch64.rpm
c0b008b878e767944818afa05f2a16f7a5f043f0d7270826289e1ae289487406  proxysql-3.1.8-1-almalinux10.x86_64.rpm
9d42edbc9d3418c23a5aacb90349432f785fcf63537bed438f4c593357cc0c8a  proxysql-3.1.8-1-almalinux8-clang.x86_64.rpm
4a3b647e62085d6a63eb648a72aa466a6b82a3b6aead2db5b49d4bbd427ecde8  proxysql-3.1.8-1-almalinux8.aarch64.rpm
647341fa6e70f7481a365eda5aaafa603f9724719e5d8fc0aceffeb92a28da28  proxysql-3.1.8-1-almalinux8.x86_64.rpm
543d02cbb6392873cd3c3c848d6b30e035179f692aef4a60f698a6f2f91226a4  proxysql-3.1.8-1-almalinux9-clang.x86_64.rpm
d7c728ad9bea130caf08868ab09bff008380d77a7902a1cda3f5cb41d99b3798  proxysql-3.1.8-1-almalinux9.aarch64.rpm
24b8093b906aabc69ea3ac6b8f19ab3137c98bb3226b93f77b33f1ffb0b73dca  proxysql-3.1.8-1-almalinux9.x86_64.rpm
2c5d115bc0385b6c3c8fa53b7493e5967d58148f9ae868238d8cccb84beabad8  proxysql-3.1.8-1-centos10-clang.x86_64.rpm
576adc8db956e6b2dba17601464ee100670a52326d1f01683f12582c11aa9a39  proxysql-3.1.8-1-centos10.aarch64.rpm
d44265f44174f494979d9f3f7ad1df002d86682a91209309c98475da2e212285  proxysql-3.1.8-1-centos10.x86_64.rpm
bce76388616dea5cd6f9734f7a926b1e6ab462cdfae33efb911f8ebf47316278  proxysql-3.1.8-1-centos9-clang.x86_64.rpm
8b5f272789ec1a42cfbb5838040051682d57a7a5fef49ef8b612ae4aac29aafd  proxysql-3.1.8-1-centos9.aarch64.rpm
355baa0fc797a6b7613fdb170252c4ca3f5ad6f1b6614bdc8524ed49ccf6be4c  proxysql-3.1.8-1-centos9.x86_64.rpm
87208d5d268bed23ae6f7eb229040b6dc90505a960e6b81fe56e67c665adf7fa  proxysql-3.1.8-1-dbg-almalinux10.x86_64.rpm
3d8d3ff68f0b855ebd8af9eeffab852ad79c29838d3db435a97f5ca47675aa8d  proxysql-3.1.8-1-dbg-almalinux8.x86_64.rpm
ebca720f48120de7a1d8ec1db881da614db6f0978844c8611ad343faf99fe637  proxysql-3.1.8-1-dbg-almalinux9.x86_64.rpm
b0ca5a93ae20ba46d33e8c6ef546aefc51d22f1b5f22ce3e72ba24b02b10f3ed  proxysql-3.1.8-1-dbg-centos10.x86_64.rpm
00f315283ec9cfd1978e9f9a9eabc41d60c5636aa4bcef1894d0c4fac90a0be5  proxysql-3.1.8-1-dbg-centos9.x86_64.rpm
911cb3feb67528aac95c766bd1ecaddec85efc4b3b246ceef84d48f5474e8052  proxysql-3.1.8-1-dbg-fedora42.x86_64.rpm
785ddfb47524ef729f7d5cc0d3194d169b28f6f70f8457f30a507853b7e7b998  proxysql-3.1.8-1-dbg-fedora43.x86_64.rpm
9cdc4805278f2312951f377ba70b47d3e000c879777a47932ab028c7094f6b50  proxysql-3.1.8-1-dbg-opensuse15.x86_64.rpm
9decea44cbfd0797d57f8622f7b78fb740bafb0995cdafeae78dafdce71d740b  proxysql-3.1.8-1-dbg-opensuse16.x86_64.rpm
5f47f387ea13406d5c47316d334fffc282084594e5056309c9d029e7ee92bd48  proxysql-3.1.8-1-fedora42-clang.x86_64.rpm
5bfada6a8254650a338b750eb9ee6d133af5689cccf381465231a0b693aad22d  proxysql-3.1.8-1-fedora42.aarch64.rpm
38ab361ab961328547ebc5adb9df97269bb43b5259057de893421a52d80a7779  proxysql-3.1.8-1-fedora42.x86_64.rpm
bcdc8f3ff516f37aa3e84b32985df27937779f56aea9a950fd5fafe1e011b118  proxysql-3.1.8-1-fedora43-clang.x86_64.rpm
59681cacc802b4bcd685b06289d6696836e3f6c212c5ce0843e18f919995ea01  proxysql-3.1.8-1-fedora43.aarch64.rpm
cd9bb2057061016d0f7fbfc2d36ef9c2531ac70f56a5453ae019397bd85e4e59  proxysql-3.1.8-1-fedora43.x86_64.rpm
52726d434507df2a01efc7f6a91e3db184ab4a722c0e1794a6237cdadec84c74  proxysql-3.1.8-1-opensuse15-clang.x86_64.rpm
b71d1667017ed4e0e0c68b01ff6db9ee2f0ed9105dfa83c7fbcdf888b46ba956  proxysql-3.1.8-1-opensuse15.aarch64.rpm
4f0a77c08e9eced6f4b88e73d19145e10c2819e3fa0852a90861a08fe8bca41e  proxysql-3.1.8-1-opensuse15.x86_64.rpm
8f637c6d7680a3a2e577cdf45f2521873b5e488080514716c6101f02179c2ff3  proxysql-3.1.8-1-opensuse16-clang.x86_64.rpm
56e92b09e8f8ffda6e99e61facb8ca3947c6416509561a8da07ef927d9006f58  proxysql-3.1.8-1-opensuse16.aarch64.rpm
438565a0f287cb9bb79ed7e138fe85820abe911d9190de4539a3a0002109ab0d  proxysql-3.1.8-1-opensuse16.x86_64.rpm
9fb0a0b010cf86706843124e5ae4b51253afb6c95bf2ad5e88f04103d119a3da  proxysql_3.1.8-dbg-debian12_amd64.deb
57693c86cbbd57d56e650f593105d59ee42eaaf8d4e78a530e6db20b02998fe0  proxysql_3.1.8-dbg-debian13_amd64.deb
41aa53822d69eb174d676dc56bf0cb176aa9845144cd37677b12c23ea4ecc9a8  proxysql_3.1.8-dbg-ubuntu22_amd64.deb
768fc38f747db3a5f7f98e54347b77a9ea340f79c065c2bb5f553ff0c967d53a  proxysql_3.1.8-dbg-ubuntu24_amd64.deb
53ae782d5d5be06409614bb6441eea4014ca2547a3d2e414632ba12d3b3b13d5  proxysql_3.1.8-debian12-clang_amd64.deb
b7b817a06607cae4348dde50e51c7f842a085f3816e9ec9e3e28478dd182190f  proxysql_3.1.8-debian12_amd64.deb
829ade8f9ceb712624babfd3da671f932cb75cb748eb904a6a6fe5bcca94af13  proxysql_3.1.8-debian12_arm64.deb
85a25ffbdea01564deef061a0500f48a10adb0f151eab3ebb6a3f00c5200e5fd  proxysql_3.1.8-debian1...