Skip to content

v26.2.0-beta.1.md

Latest commit

 

History

History
71 lines (50 loc) · 7.8 KB

v26.2.0-beta.1.md

File metadata and controls

71 lines (50 loc) · 7.8 KB

v26.2.0-beta.1

Release Date: March 25, 2026

{% include releases/new-release-downloads-docker-image.md release=include.release %}

Backward-incompatible changes

  • Added the TEMPORARY database privilege, which controls whether users can create temporary tables and views. On new databases, this privilege is granted to the public role by default, matching PostgreSQL behavior. #165992
  • The cockroach encode-uri command has been merged into the cockroach convert-url command and encode-uri has been deprecated. As a result, the flags --inline, --database, --user, --password, --cluster, --certs-dir, --ca-cert, --cert, and --key have been added to convert-url. #164561
  • Statement diagnostics requests with sampling_probability and expires_at now collect up to 10 bundles (configurable via sql.stmt_diagnostics.max_bundles_per_request) instead of a single bundle. Set the cluster setting to 1 to restore single-bundle behavior. #166159

Security updates

  • The new cluster setting security.client_cert.san_required.enabled enables Subject Alternative Name (SAN) based authentication for client certificates. When enabled, CockroachDB validates client identities using SAN attributes (URIs, DNS names, or IP addresses) from X.509 certificates instead of or in addition to the certificate's Common Name field.

    Key capabilities include:

    • For privileged users (root and node): SAN identities are validated against values configured via the --root-cert-san and --node-cert-san startup flags, with automatic fallback to Distinguished Name validation when both methods are configured.

    • For database users: SAN identities are extracted from client certificates and mapped to database usernames using Host-Based Authentication (HBA) identity mapping rules, allowing a single certificate with multiple SAN entries to authenticate as different database users based on context.

    • Multiple identity attributes: A single certificate can contain multiple SAN entries (e.g., URI for service identity, DNS for hostname, IP for network location), providing flexible authentication options.

    This authentication method works across both SQL client connections and internal RPC communication between cluster nodes, ensuring consistent identity verification throughout the system. Organizations using modern certificate management systems and service identity frameworks can now leverage their existing infrastructure for database authentication without requiring certificate reissuance or CN-based naming conventions. #162583

SQL language changes

  • Rewrite-inline-hints rules can now be scoped to a specific database, and will only apply to matching statements when the current database also matches. This database can be specified with an optional third argument to information_schema.crdb_rewrite_inline_hints. #165457
  • Added support for the aclitem type and the makeaclitem and acldefault built-in functions for PostgreSQL compatibility. The existing aclexplode function, which previously always returned no rows, now correctly parses ACL strings and returns the individual privilege grants they contain. #165744
  • Introduced a new built-in function information_schema.crdb_enable_statement_hints, which can be used to enable or disable statement hints by hint ID or by statement fingerprint. #165457
  • Added the pg_get_triggerdef builtin function, which returns the CREATE TRIGGER statement for a given trigger OID. This improves PostgreSQL compatibility for databases that contain triggers. #165849
  • SHOW ALL now returns a third column, description, containing a human-readable description of each session variable. This matches the PostgreSQL behavior of SHOW ALL. #165397
  • SHOW STATEMENT HINTS now includes database and enabled columns in its output. The database column indicates which database the hint applies to, and the enabled column indicates whether the hint is active. #165712
  • The tableoid system column is now supported on virtual tables such as those in pg_catalog and information_schema. This improves compatibility with PostgreSQL tools like pg_dump that reference tableoid in their introspection queries. #165727
  • Added a workload_type column to the crdb_internal.node_active_session_history and crdb_internal.cluster_active_session_history virtual tables, as well as the corresponding information_schema views. The column exposes the type of workload being sampled, with possible values STATEMENT, JOB, SYSTEM, or UNKNOWN. #165866

Operational changes

  • Added the opt-in cluster setting server.oidc_authentication.tls_insecure_skip_verify.enabled to skip TLS certificate verification for OIDC provider connections. #164514
  • Red Hat certified CockroachDB container images are now published as multi-arch manifests supporting linux/amd64, linux/arm64, and linux/s390x. Previously only linux/amd64 was published to the Red Hat registry. #165725
  • When hash-based redaction is enabled in the logging configuration, usernames in authentication logs now produce deterministic hashes instead of being fully redacted. This lets support engineers correlate the same user across multiple log entries without revealing the actual values. #165804

Command-line changes

  • Added the --exclude-log-severities flag to cockroach debug zip that filters log entries by severity server-side. For example, --exclude-log-severities=INFO excludes all INFO-level log entries from the collected log files, which can significantly reduce zip file size for large clusters. Valid severity names are INFO, WARNING, ERROR, and FATAL. The flag accepts a comma-delimited list or can be specified multiple times. #165802
  • Added the --format option to cockroach convert-url, which allows users to specify the type of connection URL to output. Supported formats are pq, dsn, jdbc, and crdb. #164561

Bug fixes

  • Fixed a bug where temporary tables created in one session could fail to appear in pg_catalog queries from another session because the parent temporary schema could not be resolved by ID. #165395
  • Fixed a bug in the legacy schema changer where rolling back a CREATE TABLE with inline FOREIGN KEY constraints could leave orphaned foreign key back-references on the referenced table, causing descriptor validation errors. #165551