Announcing ProxySQL 3.0.10, 3.1.10, and 4.0.10
ProxySQL 3.0.10, 3.1.10, and 4.0.10 are available today. All three are built from the same source commit and differ only in which tier’s features are compiled in. 3.0.10 is the Stable Tier, and what we recommend for production. 3.1.10, the Innovative Tier, is that core plus FFTO, TSDB, and (new this cycle) pass-through authentication. 4.0.10, the AI/MCP Tier, is everything in 3.1.10 plus the plugin chassis, the X Protocol front end, and the GenAI/MCP subsystem; after being held last cycle, it is back on cadence.
The tiers accumulate rather than diverge, and which tier a new feature lands in is decided per feature — pass-through authentication is the example this cycle, and it is why the Innovative Tier is no longer just “Stable plus FFTO and TSDB”.
Upgrade if you use compression
This release fixes GHSA-fvch-fpgq-pwfx. ProxySQL’s zlib decompression path did not check that the number of bytes it actually produced matched the length the packet declared, which meant uninitialized trailing memory could be parsed as MySQL packets and reach a client. If you accept client connections with compression enabled, this is the reason to upgrade now rather than at your leisure.
Our thanks to Tristan Madani of Talence Security, who reported the issue responsibly and gave us the time to fix it properly.
The rest of the release, briefly
AWS RDS Blue/Green deployments. ProxySQL can now watch mysql.rds_topology
and follow a Multi-AZ blue/green switchover as it happens — discovering the green
hostgroups, pinning green addresses, draining connections off the old writer, and
cleaning up correctly whether the switchover completes or is rolled back. This is
the change we expect the most people to feel, because the alternative has always
been a maintenance window.
Query timeouts that follow the traffic. A hostgroup can now carry its own
default_query_timeout. Previously a non-global timeout meant writing a query
rule and pinning it to a user or a pattern; now the analytics replicas can have a
generous timeout and the OLTP writers a strict one, decided by where the query
lands rather than by who sent it.
Your configuration finally round-trips. SAVE CONFIG and
LOAD ... FROM CONFIG now preserve firewall tables, fast-routing tables, server
SSL parameters, and PostgreSQL hostgroup attributes. Exporting a running
instance and reloading it elsewhere no longer silently drops those sections —
this closes an old issue.
Pass-through authentication, the Innovative and AI/MCP tier addition
mentioned above, lets clients authenticate through ProxySQL with a password only
the backend knows — removing the step where someone exports credentials into
mysql_users before the proxy can serve traffic. It is opt-in and off by
default. The code ships in 3.0.10 too, but is deliberately gated off there: on a
Stable build, enabling it is refused at load time.
There is more in the notes: PostgreSQL Unix-socket backends and stricter
extended-protocol handling, a prepared-statement corruption fix that only bit
sessions spanning two hostgroups, expired passwords no longer shunning a healthy
backend, Com_frontend_ping in Prometheus, and a jemalloc fix that lets ProxySQL
start on 16 KB and 64 KB page platforms such as Apple Silicon and Graviton.
Getting it
The 3.0.x Stable Tier is published to repo.proxysql.com for APT and RPM as
usual; 3.1.x and 4.0.x are on GitHub releases. All three tiers now also ship
generic Linux .tar.gz builds for amd64 and arm64, each with a checksum and
a detached GPG signature, for hosts where a distribution package is the wrong
shape.
Two platforms changed: AlmaLinux 8 is no longer built for any tier, since ProxySQL 3.x needs OpenSSL 3, and openSUSE Leap 15 is not built for 4.0.x.
Coming up
Several of these changes deserve more than a paragraph, so we will follow up with dedicated posts on riding out an RDS Blue/Green switchover, per-hostgroup query timeouts, pass-through authentication, and keeping the query digest useful on a long-running instance.
Thanks
Thank you to @wazir-ahmed, @burnison, @rahim-kanji, @takaidohigasi, @shabih-paystack, @anthonyryan1, @fogelito, and @Zhao73 for the code in this release, and to @seikath and everyone who filed the issues behind these fixes.