Skip to content

bytebase

v3.19.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 6h GitOps
βœ“ No known CVEs patched
Read the diff β†’ Tool health β†’ What is this tool? β†’
This release patches 1 known CVE

Topics

ci-cd data-masking data-security database-access dbeaver security
+13 more
flyway gitops liquibase mongodb mysql oracle pam postgresql schema-migrations snowflake sql-client sqlserver tidb

Affected surfaces

auth

Summary

AI summary

Updates 🐞 Bug Fixes, πŸ”” Notable Changes, and πŸŽ„ Enhancements across a mixed release.

Full changelog

πŸ”” Notable Changes

  • Just-in-time data export - Users can now request just-in-time data export access in the SQL editor and go through the approval workflow to export. Your existing data-export approval rules are migrated to the just-in-time approval flow. Please review and update the ordering of migrated rules according to the instruction on top of the Custom Approval page. See Details.

  • Terraform - Just-in-time data export flows through REQUEST_ACCESS approval, please add data-export rules (request.data_export == true) under the REQUEST_ACCESS source in your Terraform configuration - otherwise the next terraform apply will drop the auto-backfilled rules and JIT exports skip approval.

  • Active VCS user tracking for GitOps β€” Non-bot PR/MR authors seen by bytebase-release workflows on GitHub, GitLab, and Bitbucket now count as active VCS users over a 90-day window and are enforced against the license user limit. Track usage and download the user list as CSV from the Subscription page.

  • bytebase-action enforces the version compatibility window β€” bytebase-action check and bytebase-action rollout now fail with an error (previously a warning) when the action version is too far from the server version. Pin your CI to a compatible action version, or use the cloud tag on Bytebase Cloud. See Change Details.

πŸŽ„ Enhancements

  • MySQL β€” Improve gh-ost prerequisite validation messages by distinguishing inaccessible binlog status, disabled binary logging, missing replication privileges, unsupported binlog format, and validation query failures.

  • SQL Editor β€” Saving an untitled worksheet now prompts for a title, and searching the result panel indicates when nothing matches.

🐞 Bug Fixes

  • SQL Editor β€” Fixed query execution and admin mode being blocked when opening the editor from a database page, along with several smaller UI fixes. Local editor state is now scoped per workspace on Bytebase Cloud.

  • Restore the custom expiration time option when granting project roles, honoring the workspace maximum role expiration cap.

  • Fix AI assistant compatibility with GPT-5-style models by omitting unsupported request parameters.

  • Fix hosted MCP clients (claude.ai web, ChatGPT, VS Code for the Web) being rejected during OAuth dynamic client registration on self-hosted instances. Callbacks are pinned to exact vendor hosts, so arbitrary https:// redirects remain blocked.

  • Self-hosted (Helm) β€” Chart 1.1.3 restores bytebase.version as the single image knob; non-Azure deployments no longer silently resolve to the latest image.

  • Spanner β€” Fix SQL Editor queries failing with "disallowed query type" in normal mode.

  • Doris/StarRocks β€” Fix window functions inside a CTE body failing to parse in the SQL Editor.

  • TiDB β€” Fix prior-backup rollback for alias-target multi-table DELETE, cyclic view references crashing query analysis, and advisor line numbers for statements separated by blank lines.

πŸ“ƒ Change Details

bytebase-action Compatibility Window

bytebase-action check and bytebase-action rollout now fail with an error when the action/CLI version falls outside the supported compatibility window of the target Bytebase server (previously a warning).

| Deployment | Compatibility requirement |
| --- | --- |
| Bytebase Cloud | Dated action versions (cloud-YYYYMMDD) within the last 7 days; use the cloud action tag to stay current |
| Self-hosted | Same major version, within a 2-minor-version window of the server |

| Version relationship | Behavior |
| --- | --- |
| Exact match | Success log |
| Within window, mismatched | Warn and continue (unchanged) |
| Outside window | Error β€” command exits non-zero (new) |

Action required: pin your CI to an action version within the window of your server version (self-hosted), or use the cloud tag (Cloud).

https://github.com/bytebase/bytebase/compare/3.18.1...3.19.0

Before upgrading: 1) Back up the metadata β€” in-place downgrade is not supported. 2) Do not run multiple containers on the same data directory. 3) Terraform users: upgrade Bytebase server first, then apply the new Terraform config.

Breaking Changes

  • Terraform configurations must add data‑export rules (request.data_export == true) under REQUEST_ACCESS; otherwise auto‑backfilled rules are dropped on terraform apply.
  • bytebase-action check/rollout now fail with an error when the action version is outside the server's compatibility window (previously a warning).
  • Self‑hosted Helm chart 1.1.3 restores bytebase.version as the sole image selector; deployments no longer silently resolve to latest.

Security Fixes

  • Hosted MCP clients (claude.ai web, ChatGPT, VS Code for the Web) no longer get rejected during OAuth dynamic client registration on self‑hosted instances; callbacks remain pinned to exact vendor hosts.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track bytebase

Get notified when new releases ship.

Sign up free

About bytebase

World's most advanced database DevSecOps solution for Developer, Security, DBA and Platform Engineering teams. The GitHub/GitLab for database DevSecOps.

All releases β†’

Related context

Related tools

Earlier breaking changes

  • v3.18.1 The `--demo` server flag has been removed.
  • v3.18.0 API: Issue.ApprovalStatus moved to top-level ApprovalStatus enum
  • v3.18.0 API: require_2fa renamed to require_mfa in WorkspaceProfileSetting
  • v3.18.0 Terraform provider 3.18.0 required; adds sensitive fields and header blocks
  • v3.18.0 API: plan_spec_update renamed to plan_update with restructured payload

Beta — feedback welcome: [email protected]