This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+5 more
Affected surfaces
ReleasePort's take
Moderate signalReleasePort v0.30.0 mandates delivering the source password out of band to mydumper instead of passing it on argv.
Why it matters: Never transmit passwords via command‑line arguments; doing so exposes them to process listings and logs, violating security best practices.
Summary
AI summaryDeliver source password out of band to mydumper, never on argv.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Never pass source password on argv; deliver out of band. Never pass source password on argv; deliver out of band. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Security | High |
Close EnsurePartitionKey check‑then‑write race using S3 conditional put in BYOS module. Close EnsurePartitionKey check‑then‑write race using S3 conditional put in BYOS module. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Security | Medium |
Guard dump command against destroying the output tree. Guard dump command against destroying the output tree. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Security | Medium |
Exempt loopback peers from global login‑failure gating in console module. Exempt loopback peers from global login‑failure gating in console module. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Breaking | High |
Hard‑fail the whole batch when a PK value would overflow pk_values in indexer component. Hard‑fail the whole batch when a PK value would overflow pk_values in indexer component. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Feature | Medium |
Version bumped to 0.30.0. Version bumped to 0.30.0. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Feature | Medium |
Make supervised source‑stream TLS configurable via console settings. Make supervised source‑stream TLS configurable via console settings. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Feature | Medium |
Add RDS‑aware binlog retention checks and server‑id collision detection in doctor diagnostics. Add RDS‑aware binlog retention checks and server‑id collision detection in doctor diagnostics. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Feature | Low |
Parse giant rows and reject compressed dumps with guidance in baseline parsing. Parse giant rows and reject compressed dumps with guidance in baseline parsing. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Feature | Low |
Load cross‑schema FK children by parent schema in cascade resolution. Load cross‑schema FK children by parent schema in cascade resolution. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Feature | Low |
Surface S3 setup/verification failures in `init --format json` output. Surface S3 setup/verification failures in `init --format json` output. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Feature | Low |
Index MariaDB compressed row events instead of skipping them in parser engine. Index MariaDB compressed row events instead of skipping them in parser engine. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Performance | Low |
Fetch archived table once per resolve_pk batch instead of per pk_hash. Fetch archived table once per resolve_pk batch instead of per pk_hash. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Performance | Low |
Share one region‑pinned DuckDB session across reconcile --deep footer probes in archive module. Share one region‑pinned DuckDB session across reconcile --deep footer probes in archive module. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Performance | Low |
Stream S3 uploads through the multipart Uploader in archive module. Stream S3 uploads through the multipart Uploader in archive module. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Performance | Low |
Implement per‑root visited/emitted graph walk; select FK snapshot at delete time in cascade engine. Implement per‑root visited/emitted graph walk; select FK snapshot at delete time in cascade engine. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Medium |
Fail loud when any event cannot be reversed during recovery. Fail loud when any event cannot be reversed during recovery. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Refuse position‑mode resume if saved binlog position exceeds uint32. Refuse position‑mode resume if saved binlog position exceeds uint32. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Count archive‑only hours as gaps when --no-archive is used. Count archive‑only hours as gaps when --no-archive is used. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Pin rendering GUCs on capture and baseline sessions; fold‑validated type matrix. Pin rendering GUCs on capture and baseline sessions; fold‑validated type matrix. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Record TRUNCATE statements as schema_changes audit markers. Record TRUNCATE statements as schema_changes audit markers. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Refuse publications with row filter or column list, failing loudly. Refuse publications with row filter or column list, failing loudly. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Reject column‑qualified WHERE when table's PK cannot be verified. Reject column‑qualified WHERE when table's PK cannot be verified. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Checkpoint a safe boundary in position mode, never mid‑statement. Checkpoint a safe boundary in position mode, never mid‑statement. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Escalate resume when a source rebuild is undetectable in position mode. Escalate resume when a source rebuild is undetectable in position mode. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Retry must re‑convert a truncated Parquet instead of skipping it in baseline processing. Retry must re‑convert a truncated Parquet instead of skipping it in baseline processing. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Count permanent two‑sink losses in BYOS agent and escalate on drop. Count permanent two‑sink losses in BYOS agent and escalate on drop. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Warn and meter statement‑format DML instead of dropping it silently in capture component. Warn and meter statement‑format DML instead of dropping it silently in capture component. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Buffer generator output in EmitSQL to prevent dangling FK‑disable on refusals in cascade logic. Buffer generator output in EmitSQL to prevent dangling FK‑disable on refusals in cascade logic. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Flag child‑side FK‑column DDL skew when zero victims are scanned in cascade processing. Flag child‑side FK‑column DDL skew when zero victims are scanned in cascade processing. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Reject trailing garbage in ParseRetain instead of silently truncating in CLI parsing. Reject trailing garbage in ParseRetain instead of silently truncating in CLI parsing. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Keep newest events when --limit truncates the recover window in bintrail‑mcp tool. Keep newest events when --limit truncates the recover window in bintrail‑mcp tool. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Fix recover/preview truncation order issues in console UI. Fix recover/preview truncation order issues in console UI. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Set Options.ProfileActive under a named profile and refuse unknown profiles in console options handling. Set Options.ProfileActive under a named profile and refuse unknown profiles in console options handling. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Honor context in source checks and flag binlog_row_value_options=PARTIAL_JSON in doctor validation. Honor context in source checks and flag binlog_row_value_options=PARTIAL_JSON in doctor validation. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Coerce SET bitmask to uint64 and take snapshot_id allocation under FOR UPDATE in metadata service. Coerce SET bitmask to uint64 and take snapshot_id allocation under FOR UPDATE in metadata service. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Fail loudly on stale‑snapshot row skips during file‑index processing in parser module. Fail loudly on stale‑snapshot row skips during file‑index processing in parser module. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
Full changelog
Changelog
- 0edfb9eb1e4a7efed7ad56fff309e555bf6037ee Bump version to 0.30.0, update changelog
- 3620462c85658ebd9d1044bdcfcb99e693afe585 agent (BYOS): count permanent two-sink losses, escalate on drop (#892)
- 99dd3018c81f208b7b84acb672cda761c3b2f189 agent: fetch archived table once per resolve_pk batch, not per pk_hash (#923)
- 6cc5e1f30c832eaf86a0349e54415fcc7b25f636 archive: share one region-pinned DuckDB session across reconcile --deep footer probes (#925)
- 0df4b45ace2373d98c94d1c00af7a0991db8f9b0 archive: stream S3 uploads through the multipart Uploader (#912)
- 30fa2512b99d71ca65f842921ea59f8af2fec21e baseline: --retry must re-convert a truncated Parquet, not skip it (#891)
- e5e46e214118b315f59b543ae5fc7272e4f4c460 baseline: parse giant rows; reject compressed dumps with guidance (#801) (#903)
- 666693ce28faec6a6ecccf7a0ea7502b16e1984d byos: close EnsurePartitionKey check-then-write race with S3 conditional put (#929)
- dfef6641fee8463af7fd3ca8e6251e87ab0f4d6e capture: warn+meter statement-format DML instead of dropping it silently (#776) (#895)
- 03864d098c12fa41731581be26592d6ab5686ab9 cascade: buffer generator output in EmitSQL so refusals leave no dangling FK-disable (#933)
- 343d50c6316509bf5cf5a268feca254e870769c5 cascade: flag child-side FK-column DDL-skew on zero-victim scans (#832) (#907)
- 3c740ce5ea59f9f6631a34b0de77221e83a43ca9 cascade: load cross-schema FK children by parent schema (#833) (#913)
- 831fef63dbed043fb4e69658652b2658b130dee6 cascade: per-root visited/emitted graph walk; FK snapshot selected at delete time (#939)
- 4c1ad7db99bfa714cafbd64d265e1cf9027b9620 cli: ParseRetain rejects trailing garbage instead of silently truncating (#817)
- 058dff1ab0c6f3126915330c270875c2a9fe5188 cli: guard dump against destroying the output tree (#809) (#908)
- 8c612aa5bf7c6477cd471fb2172f52934b3027d0 cli: surface S3 setup/verify failures in
init --format json(#887) - a583bb7b4ee6587b897f6a21521885e15fc6b28e cmd/bintrail-mcp: keep newest events when --limit truncates recover window (#991)
- dad81ebc1b3f731dbfa103fcf6c39eb957f62859 console: exempt loopback peers from the global login-failure gate (#890)
- 39c5c01aa9bdda42a7c389893aa433cc095b1e6c console: fix recover/preview truncation order (#981, #967) (#993)
- 656bdda1b2a11b13b320623e170b793c6d93b5fe console: make supervised source-stream TLS configurable (#879) (#899)
- 5ac429b61a52e28ec5288c52d3485d4900f6d7d8 console: set Options.ProfileActive under a named profile + refuse unknown profile (#897)
- c21d86f44b71b9b188cfc8872a7361b10ffc49ad doctor: RDS-aware binlog retention (#812) + server-id collision check (#819) (#888)
- 6df195d375853798e39fa6664877753f5259a7da doctor: honor ctx in source checks + flag binlog_row_value_options=PARTIAL_JSON (#813, #777) (#884)
- 8010b93c436f57ad419e526910618a002a708177 indexer: hard-fail the whole batch when a PK value would overflow pk_values (#992)
- 850bbf6faaa8c1cfd521ac150114acb7ba5f31eb metadata: coerce SET bitmask to uint64; take snapshot_id allocation under FOR UPDATE (#932)
- 64e73c1e5c9f620ab6275233ce87798f2e8e0203 parser: fail file-index loud on stale-snapshot row skips (#778) (#896)
- b628426cdb14fbbcf21ed22bf297661418e26eeb parser: index MariaDB compressed row events instead of skipping them (#520) (#930)
- 28000629424c9c19d3581e8e1ccf9d3fc48c0e04 pg: pin rendering GUCs on capture + baseline sessions; fold-validated type matrix (#593 slice D) (#920)
- 5a2e7672f12992c74c55576c5208983ae77caac0 pg: record TRUNCATE as a schema_changes audit marker (#827) (#894)
- 05e524d79443739462602c0714796cce2e9d90ef pg: refuse publications with a row filter or column list (fail loud, no silent subset) (#886)
- 606be82c508f082b13416d111e0bb1b57f4a15ab query,reconstruct,shim,verify,cascade: anchor baseline delta window on exact binlog position, not the dump timestamp (#990)
- 9111fb5e9dfb2224dbe6dbec055290c937de2f32 query,recover: re-encode single-column --pk/--pks against the escaped pk_values form (#994)
- cfdbc8842229d38786e03bbb5ba3faf32bb680b6 query: count archive-only hours as gaps under --no-archive (#906)
- b8d9911cbbe10b572c5fdb2a068437f88b68f843 query: deterministic snapshot LIMIT subset; rollover-safe binlog_file comparison in UntilPos (#937)
- 9cae4f8cc974c7d89597a4189c5eb531c2f18bf5 read: rewrite EnsureSchema privilege errors into an actionable message (closes #958) (#985)
- 52ed30bb58ef30d9e5339c7e1608196310476b26 reconstruct: correct full-table PG remediation message (#830) (#901)
- 79398da9061c79fe168affcf31979b665b875f6e reconstruct: cut --at at the transaction boundary, not the row (#783) (#987)
- 8272c6d294eff12c56dbddefaa580eafa6a00cf0 reconstruct: fail loud on PK-changing UPDATE instead of silently duplicating/resurrecting rows (#782) (#915)
- fca602fedd58f039f29c512a31c54ac76f53a27e reconstruct: honest beta warn on single-row PostgreSQL reconstruct (#829) (#911)
- 01a5fd30b87b678a5c7732abb014481103f8f902 reconstruct: read baseline metadata from S3, refuse PG full-table with no baseline (#916) (#918)
- 3e2ec0f3225dea290abdec0549d36b9c5ec5f0fd reconstruct: refuse full-table merge on post-baseline dropped column instead of mixed-epoch NULL-fill (#931)
- 1781a0bf9bcee732b1a538eaa59af81fa69787a9 reconstruct: warn on baseline↔first-event gap in full-table path (#781) (#905)
- aeed22bbc6c258d246bb7ae435de4c559ff654b8 recover: --limit keeps the most recent events; truncated flag in JSON output (#927)
- c63bbe4e19fc353130c566e973923ff7fe23be60 recover: emit LIMIT 1 on all-columns-fallback DELETE/UPDATE so duplicate rows aren't all hit (#926)
- 9ea16008ed63d4a84f86b4c8bf0a1f01a34036b1 recover: emit ST_GeomFromWKB for GEOMETRY; refuse untyped BLOB/TEXT (#788) (#917)
- b699c275d437787ba90164946ef830dcf3d74f11 recover: fail loud when any event can't be reversed (#784) (#904)
- ba8c86d0d91338992e4d0ec9611133ad9d6aab53 recover: pin permissive sql_mode in MySQL reversal preamble (#786) (#885)
- ed268c11dbb76c9e206ff11d11afd33eb984b083 rotation: re-check partition row count before drop (archive→drop TOCTOU, #779) (#898)
- 04e0386ccbeaa9f5e99c1657827c0a0e0c38c82d security: deliver source password out of band to mydumper, never on argv (#900)
- f58bc02a6a647b61da7132d2d8faa0cb2518d84a shim/doctor: warn that the DBTRAIL_AT hint form degrades silently on a routing miss (#935)
- de35ea113401db03bc45fed2ce5de374fedce5f5 shim: client-disconnect cancellation, --query-timeout, and connection/full-table concurrency caps (#941)
- 3a4306c3b14c289c6a45444dc020ed03f2339126 shim: fail loud when full-table _snapshot baseline is configured but unusable (#914)
- 50bf8c1ba009f7a5d8527514bbfbf573e2906a3c shim: interpret MySQL escape sequences in string PK literals (#928)
- 1cd51f47238b9c8cbdbb4773b5b50f4df4c3a5f1 shim: reject column-qualified WHERE when the table's PK can't be verified (#821) (#902)
- e112691e283212d88da14989f03a78d238699fc5 status: surface stream_state read failure as continuity=unavailable (#815) (#889)
- 8a28101aa8b8facae2b1b9575a3d42706eda10c8 stream: checkpoint a safe boundary in position mode, never mid-statement (#775) (#910)
- 791a6b74c18d3335eb797f07a31ecd7cca604071 stream: escalate position-mode resume when a source rebuild is undetectable (#780) (#893)
- c44ce0dd3db11b36e1e43fefe0a645a1135f91ee stream: refuse position-mode resume when saved binlog position exceeds uint32 (#924)
- b1c8cacde2024e196e1e70e13237270c723008cd test(mariadb): full corruption-fidelity sweep against a live MariaDB 11.4 source (#620) (#989)
- ddc7c824592bc00b35735428efd915e86849f0fb verify: default mode reports never-baselined snapshot tables as inconclusive instead of going green (#934)
- 6216e3bd874435650c1131196882527c6c94a258 verify: defer spatial + VECTOR types to Inconclusive, not false-MISMATCH (#793) (#883)
- 1a9484317892d13e76355adf44090152c20c0e44 verify: map ENUM/SET labels + BIT bytes on the event side; narrow the deferred-Inconclusive gate to unresolved values (#940)
- b74ecbe6c770cddf33466966ae9f03bc3470f190 verify: normalize TIME fsp padding and FLOAT/DOUBLE text rendering false-MISMATCHes (#938)
- af229c53aa687f3768ddf40bfb8a76d4d76aa48c verify: pin character_set_results=binary in checksum scan (#792) (#919)
Security Fixes
- security: deliver source password out of band to mydumper, never on argv (#900)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Dbtrail
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]