ProxySQL 3.1.10 Release Notes

Release date: 2026-07-31
Release commit: f5f1e148e

ProxySQL 3.1.10 is a maintenance and feature release for the Innovative Tier
(the Stable core plus FFTO and TSDB). Its headline change is pass-through
authentication for MySQL — an Innovative-tier / AI-MCP-tier feature that is
enabled in this tier but gated off on the 3.0.x Stable build. It also carries the
core changes shared with 3.0.10 (below): per-hostgroup query timeouts, time-based
purging of the query-digest stats, actionable feedback on LOAD ... VARIABLES TO RUNTIME, PostgreSQL Unix-socket support, AWS RDS Blue/Green monitoring,
complete configuration round-tripping, frontend COM_PING metrics, and a round
of prepared-statement, PostgreSQL protocol, compressed-packet, and backend-shunning
correctness fixes. There are no FFTO- or TSDB-specific code changes in this cycle,
so both subsystems behave identically to 3.1.9.

Release commit: f5f1e148e

Highlights

Pass-through authentication (MySQL, opt-in, Phase 1) — Innovative/AI-MCP tier
only: authenticate clients through ProxySQL using a credential only the backend
knows; learned during the caching_sha2_password full-auth exchange, cached in
memory, and gated behind rate-limiting, TLS, and an allowlist. Off by default;
enable-able in 3.1.x/4.0.x but not on the 3.0.x Stable build (#5810, #5945).
Per-hostgroup query timeouts: default_query_timeout in
mysql_hostgroup_attributes.hostgroup_settings, precedence per-rule >
per-hostgroup > global (#5772).
Time-based PURGE of stats_mysql_query_digest by last-seen timestamp
(#4920, closes #4543).
Actionable feedback on config loads: LOAD ... VARIABLES TO RUNTIME now
reports Records / Updated / Rejected / Unknown in the OK packet (#5857, fixes
#1288).
PostgreSQL Unix-domain-socket backends (port=0) (#5844, closes #5837).
AWS RDS Blue/Green monitoring: topology-aware writer/reader switchover,
green-hostgroup discovery, DNS pinning, connection draining, rollback cleanup,
and cluster-synchronized configuration (#5861).
Complete configuration round-tripping for firewall and fast-routing tables,
server SSL parameters, and PostgreSQL hostgroup attributes (#5922, closes
#3468).
Frontend COM_PING metrics: Com_frontend_ping in stats_mysql_global
and Prometheus (#5948).
Correctness fixes: cross-hostgroup prepared-statement corruption (#5895),
PostgreSQL mixed Bind result-format corruption (#5878), Bind with one format
and zero parameters (#5899), zlib compressed-packet length validation
(396c742f7, GHSA-fvch-fpgq-pwfx), and expired-password backend shunning
(#5847).
Portability & packaging: jemalloc page-size auto-detect for 16 KB/64 KB
platforms (#5822) and generic Linux .tar.gz builds (#569).
FFTO / TSDB: no changes this cycle; behavior is unchanged from 3.1.9. (FFTO
remains opt-in in the 3.1.x tier.)

Innovative-tier feature: pass-through authentication (#5810)

Pass-through authentication lets a MySQL client authenticate through ProxySQL
without a pre-provisioned password in mysql_users: during the
caching_sha2_password full-auth exchange ProxySQL borrows the client's cleartext
password, probes a backend with it, and — on success — caches the learned
credential in memory. It is opt-in and off by default, controlled by the
mysql-passthrough_* globals, and adds stats_mysql_passthrough_auth_cache /
stats_mysql_passthrough_auth_metrics, PROXYSQL FLUSH PASSTHROUGH_AUTH_CACHE,
per-user/per-IP lockout, TLS gating, and a username_pattern allowlist.

This is an Innovative-tier (3.1.x) / AI-MCP-tier (4.0.x) feature: it is
enable-able on these builds, but gated off on the Stable 3.0.x build, where
mysql-passthrough_auth_enabled is forced to false at
LOAD MYSQL VARIABLES TO RUNTIME. See the Pass-Through Authentication User
Manual and Reference Manual for full configuration details.

Core changes (shared with 3.0.10)

ProxySQL 3.1.10 includes every feature, bug fix, and improvement from ProxySQL
3.0.10. In brief:

New Features

Per-hostgroup query timeouts (#5772) — default_query_timeout hostgroup
attribute for MySQL and PostgreSQL.
AWS RDS Blue/Green monitoring (#5861) — topology-aware switchover,
green-hostgroup discovery, DNS pinning, connection draining, and rollback
cleanup.
Full configuration round-tripping (#5922, closes #3468) — firewall and
fast-routing tables, server SSL parameters, and PostgreSQL hostgroup
attributes now survive config export and import.
Frontend COM_PING metrics (#5948) — Com_frontend_ping in
stats_mysql_global and Prometheus.
Time-based purge of stats_mysql_query_digest (#4920, closes #4543).
Visible feedback for rejected variables on LOAD ... VARIABLES TO RUNTIME
(#5857, fixes #1288).
PostgreSQL Unix-domain-socket backends (#5844, closes #5837).
version field in PROXYSQL INTERNAL SESSION (#5877, implements #5859).
Admin connect-setup robustness — strip leading SQL comments, accept
SET LOCK_WAIT_TIMEOUT (#5826, #5786).
Richer protocol-violation diagnostics — user / hostgroup / connection id in
the log (#5936).

Bug Fixes

MySQL compressed-packet information disclosure (396c742f7,
GHSA-fvch-fpgq-pwfx) — zlib output must match the packet's declared length.
PostgreSQL Bind with zero parameters (#5899) — one format for zero
parameters is accepted, while other mismatches return a protocol violation.
Cross-hostgroup STMT_EXECUTE dangling-bind corruption (#5895, fixes #5883).
PostgreSQL heterogeneous Bind result formats now fail loud instead of
silently corrupting data (#5878, fixes #5866).
Unhealthy-connection diagnostics (#5946) now include the frontend user,
hostgroup, and backend connection id in close warnings.
Expired password (1862) no longer shuns the backend (#5847, see #5846).
Monitor schema: unreachable port defaults dropped (#5850).

Dependencies, Build & Packaging

Generic Linux .tar.gz binaries, one tarball per tier (#569, #5881, #5892,
#5898, #5911).
Portable jemalloc page-size detection (#5822, fixes #4863, #3252).
ParserSQL v1.0.10 (#5915) and cpp-dotenv v1.1.0 (#5875).
Packaging build pipeline cleanup (#5975) removes runtime protobuf
installation where required and propagates container build failures through the
packaging target.

Testing & CI

macOS (Darwin) TAP build support (#5933); vendored replication/shunning suite
(#5872, #5876, #5888, #5923); MySQL 9.x GR workflows and report_host fix
(#5880, #5909); ParserSQL SET-parser test ports (#5893); coverage/CI hardening
(#5843, #5858, #5870, #5914, #5917, #5867, #5920); post-draft pass-through
pool-reuse regression coverage (#5944); AWS RDS BGD simulator and lifecycle
coverage (#5861); and Codecov/cluster-workflow validation (#5954, #5963,
#5966).

For the full descriptions of these core changes, see the ProxySQL 3.0.10 Release
Notes.

Innovative-Tier subsystems

FFTO (Fast Forward Traffic Observer): no code changes this cycle; behavior
unchanged from 3.1.9. FFTO remains opt-in in the 3.1.x tier.
TSDB: no code changes this cycle; behavior unchanged from 3.1.9.

Contributors

Thanks to everyone who contributed to this release, including @renecannao,
@wazir-ahmed, @rahim-kanji, @burnison, @takaidohigasi, @shabih-paystack,
@anthonyryan1, @fogelito, @Zhao73, and @mirostauder.

Packages

Alongside the usual .deb and .rpm packages, this release ships generic Linux
tarballs — proxysql-3.1.10-linux-amd64.tar.gz and
proxysql-3.1.10-linux-arm64.tar.gz — each with a .sha256 checksum and a
detached .asc GPG signature made with the ProxySQL release key
(653F85BB38256DF8A96206C3E8CA2E8D8217C97E).

AlmaLinux 8 packages are intentionally not included: the platform cannot
satisfy the OpenSSL 3 requirement that ProxySQL 3.x depends on.

Hashes

The release commit is: f5f1e148e.

SHA256s:

65ee2f7e86172a67f1dc282daea049f531b6144970c9fa7bb51d5f9df65004b2  proxysql-3.1.10-1-almalinux10-clang.x86_64.rpm
3889307df783ab46cd6fdfcc1bb9b049431cf2aacea734db24e65197e0c6a94d  proxysql-3.1.10-1-almalinux10.aarch64.rpm
deb705a7e65653dbabab122b28cf9b737f1e0a9f1f0b491781b6d57aa304b988  proxysql-3.1.10-1-almalinux10.x86_64.rpm
d9033ff10a9509428229b8b56c764ee2ce133227877790df0b9196eedb08dd39  proxysql-3.1.10-1-almalinux9-clang.x86_64.rpm
fa4b73b87d1917a459a24e4ecf9613e8c8427e98bd885f07f84d9e6b348ab40c  proxysql-3.1.10-1-almalinux9.aarch64.rpm
fdd27053dfbd3617999dd102779cf0c1d91d3ab1eaedd1cc57d16da6adc76c5a  proxysql-3.1.10-1-almalinux9.x86_64.rpm
f6c1435311e35e1cce0605ce7ddf9366e5aeedd6f5f44758de2e8cd2d23fd8ff  proxysql-3.1.10-1-centos10-clang.x86_64.rpm
a46096f271b82640d10ee82372e4077e377ba9a33d78a607f843a09865ae5e96  proxysql-3.1.10-1-centos10.aarch64.rpm
f082909541bae76c156ea96b37b996e31ce0738ce4dbd8ef1dfa2ec2cff15509  proxysql-3.1.10-1-centos10.x86_64.rpm
24b418d26ce08f4d30ff52fde420a3cc50320ea697eb38190a285151d19275f5  proxysql-3.1.10-1-centos9-clang.x86_64.rpm
b804075909b492dd6d4ea2b122322fe6cf6f0d2f128b0e2d7abf2122374689de  proxysql-3.1.10-1-centos9.aarch64.rpm
5fa54a8ba37044dc4e90954b2e1c7cdf6d042090ccac6e438f4c327130756a8c  proxysql-3.1.10-1-centos9.x86_64.rpm
256f2e7cbe58bd00da0be345bb451791524d6eac658253347e27a6223d4183c6  proxysql-3.1.10-1-dbg-almalinux10.x86_64.rpm
414c08b47cf76997dd8db8b1e42ae742086f7bef7fa760840085f0473b232973  proxysql-3.1.10-1-dbg-almalinux9.x86_64.rpm
53eb78a09cb9c19d6a0fe060f034e629b48de4747d3afd9f57d0555166773076  proxysql-3.1.10-1-dbg-centos10.x86_64.rpm
95c8ca52fd693b35cc1d87e805b57b78fec423285b23d1c824564c7a6bdd2e1f  proxysql-3.1.10-1-dbg-centos9.x86_64.rpm
a8989b731cb65e8d1a8d775f46b502c9c18cd26356f14fe0381fe48db97d8b0d  proxysql-3.1.10-1-dbg-fedora42.x86_64.rpm
420d9dff30369b3c81b85b04ed6fb2166ea6b2c835229d723af1cb300b0f3bba  proxysql-3.1.10-1-dbg-fedora43.x86_64.rpm
afa1804a2a0886a127f8a93a1a54e300c8121312757470ffb9fb7492f83d3f53  proxysql-3.1.10-1-dbg-fedora44.x86_64.rpm
f3bde87f846dafecc065e472aebd5d46a81d35fc5f472315823acc38bc93ba73  proxysql-3.1.10-1-dbg-opensuse15.x86_64.rpm
f91471d4cacd2d4eda23cb32b42cdf63b49ee73d91172a80b16942b8f635f01f  proxysql-3.1.10-1-dbg-opensuse16.x86_64.rpm
838573b58dc99d96ee8718eacff80188a1f42b5470b882fd4f85e68f1b45454f  proxysql-3.1.10-1-fedora42-clang.x86_64.rpm
dbf28c0e13412cab2ae8ea37b18d8317e53839a00aa9be0269df429efb6cf5e7  proxysql-3.1.10-1-fedora42.aarch64.rpm
15c5e53b1a9ed0537c91c5e4ed576fdd4070f2e09184970be2349a95d6011c70  proxysql-3.1.10-1-fedora42.x86_64.rpm
67c1daaf7a669922f1061ccea75aa5f2d0e525853990366d673a804ca342b76f  proxysql-3.1.10-1-fedora43-clang.x86_64.rpm
ae8e4319876a585be304ac33605b24a696ac6b50c7d023c00ae364a619b1bb09  proxysql-3.1.10-1-fedora43.aarch64.rpm
44c7f03a9a03a0ff14917cf5d63ecc40f75b84ce2901400afcf5b797aa04a23e  proxysql-3.1.10-1-fedora43.x86_64.rpm
954ee123f5b83ca36dc09cbbce136e28b141112cac686c270275a469cb7c8f60  proxysql-3.1.10-1-fedora44-clang.x86_64.rpm
a9cf60507ec34fca0bab014ba45b8a83fea69426006b2961242c75c7ef52bd5d  proxysql-3.1.10-1-fedora44.aarch64.rpm
a50690341eb276d009117824ba004fa13ad61b946b23b7088fa360197aa4d186  proxysql-3.1.10-1-fedora44.x86_64.rpm
0a320ba1b297fb6433a20079ac7b58ca93ee8852f665146bf4e2153584c3bb23  proxysql-3.1.10-1-opensuse15-clang.x86_64.rpm
f078eb45db9fa4011bf91abf3f42c5a418e3910e3c3b70152a2f31f1225e95f3  proxysql-3.1.10-1-opensuse15.aarch64.rpm
a6edb4b3a019c237e1a891214a25ab6f8b00a45863a2d0a035885b440f33c18e  proxysql-3.1.10-1-opensuse15.x86_64.rpm
606153b985b22cc1f442796a52939be8fc384e63db949939dab870c9afe69a2b  proxysql-3.1.10-1-opensuse16-clang.x86_64.rpm
1b53ed32836c026ed63c0d1775e16a7b8d1205565c04cb74f397ff7d2f009ddb  proxysql-3.1.10-1-opensuse16.aarch64.rpm
44b4a65e3691dabeca3eaf3dd78ba4b4622558b92446e24ae326d2ebb844f784  proxysql-3.1.10-1-opensuse16.x86_64.rpm
2470da2bc57d25e40b47831d1ff898e1fa125d0dff5080a214f9a8bbe7ff0e79  proxysql-3.1.10-linux-amd64.tar.gz
98ecee1fd6de3e6ef881c23e902599bda60a791de4621f501b8b32b915d1463f  proxysql-3.1.10-linux-amd64.tar.gz.asc
22327189f45210692836197ee264350636178669e2dde4210d2170a14fde8dae  proxysql-3.1.10-linux-amd64.tar.gz.sha256
00c999b25b010f2e3f651c8391f0ede569e94d847936be1814ff8031d9570f2c  proxysql-3.1.10-linux-arm64.tar.gz
305e2ae9df0cf771bfaa908d0abd54d2d52e23b5b66c01491aa8608c01f5e0c6  proxysql-3.1.10-linux-arm64.tar.gz.asc
783da9cd650a96051e6155e6f82f162b10a3ce3b364bb27d0e8974ba97233611  proxysql-3.1.10-linux-arm64.tar.gz.sha256
3dda7fb054b0526ae50959b07507acd3b810fba89c5556c745c99861904ab0f1  proxysql-3.1.10.id-hash
903de4147ad117a224325e1c2f7eeee60b511cc790439725b6838d94d3069fe1  proxysql_3.1.10-dbg-debian12_amd64.deb
f0e42e389fd688e3724dadc61f09e5aecd16712051429a52745ffa12f93caf14  proxysql_3.1.10-dbg-debian13_amd64.deb
83ea011be1d4cbb8ceacb2b51b4bca136707e61c4759edb10609c9e80cc0cdbf  proxysql_3.1.10-dbg-ubuntu22_amd64.deb
d1e97ef3ac45714e8a8f82080df1c417a283959a6dd479117db1efa700f2a092  proxysql_3.1.10-dbg-ubuntu24_amd64.deb
1ccc3fb7391999a2b16827a4b94bf4d6f3cf9facaa4371109a5adc9ae1313a5c  proxysql_3.1.10-debian12-clang_amd64.deb
ba3173581da4b6914419b6085a896d30711e26b3377813c512c1e1cba5d8eeb7  proxysql_3.1.10-debian12_amd64.deb
51ff7d689b433d55f120dcb10c112da51877325c0cda3bbc3de804c604b1caa3  proxysql_3.1.10-debian12_arm64.deb
3f1b1ba56e4da9e0a705a065fde4918ced80b65ae7ac29a3ea567cd8d175543a  proxysql_3.1.10-debian13-clang_amd64.deb
1565a3ff9cd7e354d1d874fdb28ec7e67d98aa9dc2d77b9408e574d2ad0f95a5  proxysql_3.1.10-debian13_amd64.deb
7bf7e9f4c05f0ac7ab4457639a2aecca0ab85f1009011ccaa7d5f30630b746a6  proxysql_3.1.10-debian13_arm64.deb
3d2c7b6b2c19fc7fe9d19b60912d146dcabcd82c0acaf9744b502767ffcddc06  proxysql_3.1.10-ubuntu22-clang_amd64.deb
ea61e571d1dc5d4eaf4cfff54d22112ed948510b6f32cbe669071eab17ce990a  proxysql_3.1.10-ubuntu22_amd64.deb
499531f8defebe33c5853e5180d63c4219cf756162d2e9d6df465b86695f97c1  proxysql_3.1.10-ubuntu22_arm64.deb
6ec767e03b7f872fd69c75d536d708452b6fa30c8525a5683150722dfb2feb8c  proxysql_3.1.10-ubuntu24-clang_amd64.deb
2ea47b74e2a5b62e98105d38e122e9bbeba69d86cf0622ce162b71c7c8a973d6  proxysql_3.1.10-ubuntu24_amd64.deb
54c11b70a9b2b7c607705ce871ca6c3fe8cbf1a5bb3e3ca1f8f382f2e8714a0c  proxysql_3.1.10-ubuntu24_arm64.deb

sysown/proxysql v3.1.10 on GitHub