bytebase

🔔 Notable Changes

• Export Center and data-export approval flow deprecated — The standalone Export Center and the separate data-export approval flow are deprecated; data export is handled through the just-in-time data-export approval flow in the SQL Editor.

• 7 low-signal SELECT-only SQL review rules removed — These rules only ever fired on SELECT, and served no purpose in the DDL/DML change-review workflow. Stored review policies are cleaned automatically on upgrade, so existing configurations keep working. See Change Details.

• Terraform provider 3.20.0 required — Upgrade the Bytebase server first, then move to provider 3.20.0. It covers this release's breaking changes: EXPORT_DATA deprecated in the approval flow; announcement level deprecated in favor of theme; the workspace maximum request-expiration field renamed; and environment and issue-label colors moved to the color protocol message. It also adds Vault token_type support and fixes review-config state-diff and webhook-URL-in-state handling. Remove the seven deleted SQL review rule types from your review configs. See Change Details.

🚀 Features

• Access requests always use the maximum expiration cap — Requesting access no longer lets a user pick a longer window than the workspace allows; the request duration is bounded by the configured maximum. The workspace setting is renamed accordingly. See Change Details

• Custom theme for SQL Editor and announcements — Choose the SQL Editor color theme or define your own from Settings. Workspace announcements get the same treatment, with configurable background and text colors, replacing the deprecated announcement level.

• Workspace announcement theme — The announcement level field is deprecated; announcements now take an explicit theme with configurable background and text colors.

• Self-hosted — GCP Cloud SQL IAM authentication for the external PostgreSQL metadata database. On GKE with Workload Identity, the metadata database connects to Cloud SQL via IAM authentication with no static password, with Helm chart and high-availability documentation.

🎄 Enhancements

• Plan detail — Consolidated plan-lifecycle actions in the header, which now shows the plan's primary "what's next" action (or current status) at every stage; relative times reveal their absolute timestamp on hover across the app; plus editing targets beside the title, adding a change from the changes tab strip, a consolidated review-activity timeline, the matched approval-flow title on the AIO page, and skipped-task reasons.

• SQL parsing — Improved Omni parser compatibility across multiple SQL engines, covering SQL Review, schema workflows, statement splitting, completion, and execution. For MariaDB specifically, the SQL Editor no longer flags valid MariaDB-only syntax as errors: sequences and NEXT VALUE FOR, RETURNING on INSERT/REPLACE/DELETE, system-versioned and application-time-period tables, parenthesized row constructors, and UUID/INET types.

• Vault — The HashiCorp Vault external-secret integration adds a token_type field: the token can be provided as PLAIN, ENVIRONMENT (environment variable), or FILE.

🐞 Bug Fixes

• GitOps — Fix release checks not populating risk levels, which made high-risk statements such as DROP TABLE show None in the GitHub Action check output.

• Custom OAuth2 SSO — Fix userinfo lookup failing against Oracle Cloud Infrastructure (OCI) IAM Identity Domains, which surfaced as a misleading JSON parse error.

• Fix the "Manually select" database picker freezing the browser on large deployments, by loading one page on open with a "Load more" affordance instead of draining every page at once.

• Fix the workspace title being uneditable on the setup page, and a missing project-scope feature check when listing database groups.

• MySQL/MariaDB — Fix schema sync over-fetching foreign-key and trigger metadata across databases, and use the MariaDB-native CHECK_CONSTRAINTS query.

• gh-ost — Trim a trailing semicolon so the attempt-instant-DDL path stays valid.

📃 Change Details

Access Request Expiration

Access requests are now bounded by the workspace maximum expiration, and the workspace setting field is renamed.

| Change | Before | After |
| --- | --- | --- |
| Workspace setting field | maximum_role_expiration_in_seconds | maximum_request_expiration_in_seconds |
| Behavior | Requesters could set an expiration independent of the cap | Request duration is capped at the workspace maximum |

The existing value is carried to the new field automatically on upgrade.

Removed SQL Review Rules

These 7 SELECT-only review rules are removed:

| Removed rule |
| --- |
| STATEMENT_SELECT_FULL_TABLE_SCAN |
| STATEMENT_QUERY_MINIMUM_PLAN_LEVEL |
| STATEMENT_DISALLOW_USING_FILESORT |
| STATEMENT_DISALLOW_USING_TEMPORARY |
| STATEMENT_MAXIMUM_JOIN_TABLE_COUNT |
| STATEMENT_JOIN_STRICT_COLUMN_ATTRS |
| STATEMENT_MAXIMUM_LIMIT_VALUE |

Stored review policies are cleaned automatically on upgrade, so existing configurations continue to load. Rules that also cover DML or VIEW statements are intentionally kept.

Terraform Impact

Move to terraform-provider-bytebase 3.20.0 after upgrading the server.

| Change | Type | Action |
| --- | --- | --- |
| EXPORT_DATA approval source deprecated | Breaking | Remove EXPORT_DATA from approval-flow config; use the JIT data-export flow |
| Announcement level → theme | Breaking | Replace level with theme (background / text) under workspace_profile.announcement |
| Maximum request-expiration field renamed | Breaking | Rename maximum_role_expiration_in_seconds to maximum_request_expiration_in_seconds in workspace_profile |
| Environment and issue-label colors moved to color protocol message | Breaking | Update color values to the new color message representation |
| Vault token_type | Feature | Optionally set PLAIN, ENVIRONMENT, or FILE in data_sources.external_secret |
| Review-config state diff / webhook URL in state | Fix | No action required |
| Seven SQL review rules removed | Breaking | Remove the removed rule types (e.g. STATEMENT_MAXIMUM_LIMIT_VALUE) from your review config |

https://github.com/bytebase/bytebase/compare/3.19.1...3.20.0

Before upgrading: 1) Back up the metadata — in-place downgrade is not supported. 2) Do not run multiple containers on the same data directory. 3) Terraform users: upgrade Bytebase server first, then apply the new Terraform config.