ProxySQL 4.0.10 Release Notes

Release date: 2026-07-31
Release commit: f5f1e148e

ProxySQL 4.0.10 is a maintenance and feature release for the AI/MCP Tier,
incorporating all improvements from ProxySQL 3.1.10 and 3.0.10. It carries the
pass-through authentication feature for MySQL (an Innovative/AI-MCP-tier
feature, opt-in and off by default — enable-able here but gated off on the 3.0.x
Stable build); the headline 4.0-specific work is a round of X Protocol
(mysqlx) plugin fixes — correct backend authentication, TLS-aware capability
negotiation, and several soak/shutdown-stability bugs. FFTO remains enabled by
default in the 4.0.x tier. The shared core also adds AWS RDS Blue/Green
monitoring, complete configuration round-tripping, frontend COM_PING metrics,
and compressed-packet and PostgreSQL protocol hardening; the GenAI/MCP subsystem
is unchanged this cycle.

Release commit: f5f1e148e

Highlights (AI/MCP Tier)

• Pass-through authentication (Innovative/AI-MCP tier): enabled in the 4.0.x
  build (gated off on the 3.0.x Stable build); opt-in and off by default (#5810,
  #5945).
• All 3.1.10 / 3.0.10 core improvements included: per-hostgroup query timeouts
  (#5772), time-based query-digest purge (#4920), LOAD ... VARIABLES feedback
  (#5857), PostgreSQL Unix-socket support (#5844), and the cross-hostgroup
  prepared-statement, PostgreSQL Bind-format, and expired-password fixes (#5895,
  #5878, #5847).
• AWS RDS Blue/Green monitoring (#5861), full configuration round-tripping
  (#5922), and frontend COM_PING metrics (#5948) are included in all tiers.
• Security and protocol hardening: compressed MySQL packet length validation
  (396c742f7, GHSA-fvch-fpgq-pwfx) and PostgreSQL Bind handling for one format
  with zero parameters (#5899).
• X Protocol (mysqlx) plugin fixes: correct X Protocol backend auth with
  end-to-end tests, backend capability gate aligned with TLS posture, and three
  soak-blocking bugs (auth shapes, hostname DNS, mapped password) resolved, plus
  clean shutdown under soak.
• FFTO enabled by default (4.0.x): full traffic observability out of the box.
  (FFTO is opt-in in 3.1.x.)
• Per-tier tarballs: the new generic-Linux .tar.gz pipeline (#569) builds a
  dedicated v4.0 tarball alongside the v3.0 and v3.1 tarballs.
• GenAI / MCP: no code changes this cycle; behavior unchanged from 4.0.8.

New Features & Fixes (4.0-specific)

X Protocol (mysqlx) plugin

The mysqlx plugin (the MySQL X Protocol front end, built and packaged only in
the v4.0 tier) received a focused stability pass this cycle:

• Correct X Protocol backend authentication with new end-to-end tests and a
  dedicated CI workflow (CI-mysqlx).
• Backend CapabilitiesSet gate aligned with TLS posture, with the unit test
  synced to match.
• Three soak-blocking bugs fixed — auth shapes, hostname DNS resolution, and
  mapped-password handling — that previously stalled the soak workload.
• Clean shutdown under soak — fixed a soak shutdown hang (#5926) and an admin
  shutdown path (#5916); session and backend-X setup handling hardened.
• Diagnostics — all fprintf(stderr, …) calls replaced with
  proxy_info / proxy_error / proxy_warning so plugin output flows through the
  standard error log.
• Build correctness — the plugin build is serialized so vendored protobuf
  finishes before the plugin .so links, and the vendored protobuf / zstd /
  lz4 static libraries are built and installed so the shared-object link
  resolves.
• Packaging build cleanup (#5975) — v4.0 packaging containers no longer
  install protobuf at runtime, and container build failures propagate correctly.

GenAI / MCP

No code changes in this cycle; the GenAI/MCP/RAG subsystem behaves identically to
4.0.8. As of the earlier plugin carve-out, all GenAI code lives in
plugins/genai/ and is built by PROXYSQL40=1 (there is no separate
PROXYSQLGENAI flag).

Features inherited from v3.1.10 (Innovative Tier)

ProxySQL 4.0.10 includes all features from the v3.1.10 (Innovative) release:

• Pass-through authentication for MySQL (#5810) — the Innovative/AI-MCP-tier
  feature, enabled in the 4.0.x build (gated off on the 3.0.x Stable build);
  opt-in and off by default. mysql-passthrough_* globals,
  stats_mysql_passthrough_auth_cache / stats_mysql_passthrough_auth_metrics,
  PROXYSQL FLUSH PASSTHROUGH_AUTH_CACHE, per-user/per-IP lockout, TLS gating, and
  a username_pattern allowlist. See the Pass-Through Authentication User Manual
  and Reference Manual.
• FFTO: enabled by default in 4.0.x (opt-in in 3.1.x); no code changes this
  cycle.
• TSDB: no code changes this cycle; behavior unchanged.

Features inherited from v3.0.10 (Stable Tier)

ProxySQL 4.0.10 includes all features, bug fixes, and improvements from the
v3.0.10 release, including:

• Per-hostgroup query timeouts (#5772) — default_query_timeout hostgroup
  attribute; precedence per-rule > per-hostgroup > global.
• Time-based PURGE of stats_mysql_query_digest (#4920, closes #4543).
• Visible feedback for rejected variables on LOAD ... VARIABLES TO RUNTIME
  (#5857, fixes #1288).
• PostgreSQL Unix-domain-socket backends (#5844, closes #5837).
• AWS RDS Blue/Green monitoring (#5861) — topology-aware writer/reader
  switchover, green-hostgroup discovery, DNS pinning, connection draining, and
  rollback cleanup.
• Full configuration round-tripping (#5922, closes #3468) — firewall and
  fast-routing tables, server SSL parameters, and PostgreSQL hostgroup attributes
  survive config export and import.
• Frontend COM_PING metrics (#5948) — Com_frontend_ping in
  stats_mysql_global and Prometheus.
• version field in PROXYSQL INTERNAL SESSION (#5877, implements #5859).
• Admin connect-setup robustness — strip leading SQL comments, accept
  SET LOCK_WAIT_TIMEOUT (#5826, #5786).
• Richer protocol-violation diagnostics (#5936).
• Bug fixes: cross-hostgroup STMT_EXECUTE dangling-bind corruption (#5895,
  #5883); PostgreSQL heterogeneous Bind result formats now fail loud (#5878,
  #5866); PostgreSQL Bind with one format and zero parameters (#5899); zlib
  compressed-packet length validation (396c742f7, GHSA-fvch-fpgq-pwfx);
  expired password (1862) no longer shuns the backend (#5847, #5846); monitor
  schema port-default cleanup (#5850); and richer unhealthy-connection
  diagnostics (#5946).
• Build & Packaging: generic Linux .tar.gz binaries (#569); portable
  jemalloc page-size detection (#5822, fixes #4863, #3252); ParserSQL v1.0.10
  (#5915); cpp-dotenv v1.1.0 (#5875).
• Testing & CI: macOS (Darwin) TAP build support (#5933); vendored
  replication/shunning suite (#5872, #5876, #5888, #5923); MySQL 9.x GR workflows
  and report_host fix (#5880, #5909); AWS RDS BGD simulator and lifecycle
  coverage (#5861); PostgreSQL zero-parameter Bind regression coverage (#5899,
  #5955); pass-through pool-reuse regression coverage (#5944); and
  Codecov/cluster-workflow validation (#5954, #5963, #5966).

For detailed descriptions of these core improvements, see the ProxySQL 3.0.10
Release Notes.

Package coverage note

As in prior 4.0.x cycles, the GenAI tier depends on C++17 features unavailable on
older toolchains (libstdc++ on AlmaLinux 8, libc++ on openSUSE Leap 15), so
4.0.x packages are not produced for those distributions. Use a newer distribution
(AlmaLinux 9+, Fedora 42+, Debian 12+, Ubuntu 22.04+, openSUSE Leap 16) for the
AI/MCP tier. (Confirm the exact 4.0.10 package matrix at release time.)

Contributors

Thanks to everyone who contributed to this release, including @renecannao,
@wazir-ahmed, @rahim-kanji, @burnison, @takaidohigasi, @shabih-paystack,
@anthonyryan1, @fogelito, @Zhao73, and @mirostauder.

Packages

Alongside the usual .deb and .rpm packages, this release ships generic Linux
tarballs — proxysql-4.0.10-linux-amd64.tar.gz and
proxysql-4.0.10-linux-arm64.tar.gz — each with a .sha256 checksum and a
detached .asc GPG signature made with the ProxySQL release key
(653F85BB38256DF8A96206C3E8CA2E8D8217C97E).

Three platforms are intentionally not included in this release:

• AlmaLinux 8 — the platform cannot satisfy the OpenSSL 3 requirement that
  ProxySQL 3.x depends on.
• openSUSE 15 — its toolchain cannot compile the current GenAI code
  (std::regex::multiline), so no openSUSE 15 packages are built for this tier.
• openSUSE 16, aarch64 only — its post-build verification failed in CI.
  The x86_64 openSUSE 16 packages are unaffected and are included.

Hashes

The release commit is: f5f1e148e.

SHA256s:

b08ff32ec67ae043a16d5cb83449a3f4a54812c91e1970053b1bf87e91c21652  proxysql-4.0.10-1-almalinux10-clang.x86_64.rpm
d5ab7eb35eb8845242c499c9bf2207713668c157ffa9866c81c853aa969a446c  proxysql-4.0.10-1-almalinux10.aarch64.rpm
2dad2409fdf09a3e64d6661fd3af8703238f0b7bef121faae85db57c5b6503d8  proxysql-4.0.10-1-almalinux10.x86_64.rpm
c95c61aef60d6d6fb90af13e98237a59b6aeb776defe9f4beeaa615fc340b398  proxysql-4.0.10-1-almalinux9-clang.x86_64.rpm
0e6a91ca8ca721da6eaf4c8c6359d0ef7119e5007810adda252467429d7ca4ac  proxysql-4.0.10-1-almalinux9.aarch64.rpm
4831f16b6c77f7f61681fb6eb019829a5263085a516ad0d8502fdc28598a35d5  proxysql-4.0.10-1-almalinux9.x86_64.rpm
8de4232e4d99aa512810a6a8ec6662309d5582535e95f43907876d3f5883fc90  proxysql-4.0.10-1-centos10-clang.x86_64.rpm
0e4c02b00cc485b5c0e162bc923a2ee5bbe9f184b1385070f75eb2b4aa3ee99c  proxysql-4.0.10-1-centos10.aarch64.rpm
758d9b429e25a9c83c1810d298afc6e2d944131d6490eaaf5b512e964ef5cb82  proxysql-4.0.10-1-centos10.x86_64.rpm
7eae4a73f71a2ee923e6a7db7f944e2414be163f28ef2988efbf2a0892dba5b5  proxysql-4.0.10-1-centos9-clang.x86_64.rpm
0a950c89d99a2c88fe6f0c625721436e4c903f74683225bd65b79c34509de4fa  proxysql-4.0.10-1-centos9.aarch64.rpm
9960e0ab616c89e5aec1e1c02082b404571b1b7ca0e3e7da3db0540b65b6bec4  proxysql-4.0.10-1-centos9.x86_64.rpm
e9292ff6b34a6295ede893cc3ecd538f9012f55a187e97b8bb0588f58b00042a  proxysql-4.0.10-1-dbg-almalinux10.x86_64.rpm
0df1d8fd152653bcf4c37836b98b5e14fa14989880562a78a3bb73ae7adbc43c  proxysql-4.0.10-1-dbg-almalinux9.x86_64.rpm
99a83ca098cff0dc71fc60915f1daacc41ebb786ff5712fd7e1a70772ac6cc16  proxysql-4.0.10-1-dbg-centos10.x86_64.rpm
b823040d54b446845c7dfc76d4c86e5847169b58fe5408881f26012f791a6409  proxysql-4.0.10-1-dbg-centos9.x86_64.rpm
d3a0f55526a6c7c84f69036ed4e969f535d968f646a6fb5bba62c22a8ff7970f  proxysql-4.0.10-1-dbg-fedora42.x86_64.rpm
436084c5ec8b0b4a34f0f9e034b4f1e7f1a4facf650b3037de4d47f288111e29  proxysql-4.0.10-1-dbg-fedora43.x86_64.rpm
7d7c6a4eab054532f3974d92037519613db661bf06a0af1724251e67ea92bcb4  proxysql-4.0.10-1-dbg-fedora44.x86_64.rpm
4b4c6e638fe94c6843388d74a33e9b98dafaece1b916a93a0ce808a1ae76a4e5  proxysql-4.0.10-1-dbg-opensuse16.x86_64.rpm
65f39e739bc9537a9381807704efb0e9f8c73bedd2ae1ba9cc64e243b0f3458e  proxysql-4.0.10-1-fedora42-clang.x86_64.rpm
1f91028dd56006c51c78634ac9cbe431b0cbe223f21de956e4c208540e2d2e4a  proxysql-4.0.10-1-fedora42.aarch64.rpm
9614d84d69d2a5a47337488e1b065c4476f4cc678135db90aa3a8c18df8de572  proxysql-4.0.10-1-fedora42.x86_64.rpm
ed7da7f5b7e3839f417cefbbae81d8babb55c2830589ad3da4f53bdda118d634  proxysql-4.0.10-1-fedora43-clang.x86_64.rpm
552e969ef86b5f8e7f2a0190516b9a87b56b8ae2384d0e779af5c2996412011a  proxysql-4.0.10-1-fedora43.aarch64.rpm
802b5afdc8aad1f9b59390672522083b2cd108c33a20e83656a8512e2cc3b952  proxysql-4.0.10-1-fedora43.x86_64.rpm
cfe558a36ffca0b338f5b6975250ee3f06945e9c8231b02892bdf60f1c2b011d  proxysql-4.0.10-1-fedora44-clang.x86_64.rpm
7b686329a13e290efb2ec5d0c4754c7d95c8468e5d1c19287ba803fb5eb2e176  proxysql-4.0.10-1-fedora44.aarch64.rpm
2eda1f6ad5aa73468539f531dd630813f1086feab5017f157543f49f68e9869e  proxysql-4.0.10-1-fedora44.x86_64.rpm
93445fc99d6174d4df55a88f7cd026e113e6005f2fcf43ed74bf6af655bd0cc3  proxysql-4.0.10-1-opensuse16-clang.x86_64.rpm
5e5de4234d74c0b9af4148c3bb666d1aa8488b19dd9a902d8f3f00064caee9fa  proxysql-4.0.10-1-opensuse16.x86_64.rpm
e67e5b0b96cef94455da9d722d848c4368b52ff1459b0a980bc566113f071410  proxysql-4.0.10-linux-amd64.tar.gz
bb5985a5c612f73d2214f6dd23b955f67c61f2351c81d4886f025d59863cf044  proxysql-4.0.10-linux-amd64.tar.gz.asc
bdf57a1e2b8d00cb6f5962e6a340f75863e6bf337caf6f5106faf44d3faedc43  proxysql-4.0.10-linux-amd64.tar.gz.sha256
9ef318027957e3f8413d8c9fdebff2796abe43fca4ebf9cbc2830115a6d71d1b  proxysql-4.0.10-linux-arm64.tar.gz
7fafa09acf409be93ef426b3bd9503dd08affbe3e9df1978fd9a67a371c762f5  proxysql-4.0.10-linux-arm64.tar.gz.asc
91c9faeea85f9b8a167484a1515e286ae73644a0488a37de374d3f88cbfbcee7  proxysql-4.0.10-linux-arm64.tar.gz.sha256
52c5689ba3a89c279f60347610e7ce08bcabf951747840a06d67c6a9a98847b7  proxysql-4.0.10.id-hash
4bed33e014a007f39688c0c3bbcc712f3c2de48a89ecf65f0507e226d6a45b8b  proxysql_4.0.10-dbg-debian12_amd64.deb
647d3b997cb619546918539fd2ebd52be37eff1fdfb80256f4e93dd17d925f48  proxysql_4.0.10-dbg-debian13_amd64.deb
1bd74e4fda8a9e145910cad71bc3b25367e25a8b5952e41931214d93534be9dd  proxysql_4.0.10-dbg-ubuntu22_amd64.deb
80b567c6fa076c7a3911a5b647a2825b2db76c2d00049e9cf4a5e41eeeb991b6  proxysql_4.0.10-dbg-ubuntu24_amd64.deb
623ef871ce87192c28ef180354c19435cdc06c271ee41461fa3e3b75d903251a  proxysql_4.0.10-debian12-clang_amd64.deb
111bdb6ca2faf59ca0a20bd68ea0cd110865b9c2239b6fafff324efc2d429e9e  proxysql_4.0.10-debian12_amd64.deb
29d3ad8a8e1f145a79a7db05809e5d249cdaa06710b2d57bacf344d189f2d02e  proxysql_4.0.10-debian12_arm64.deb
0594abaf49505a17f1cfc6963aad86f048178f85d1f924954711277fae96f9be  proxysql_4.0.10-debian13-clang_amd64.deb
36a3ef399369bf88e5da18d6ea4aec49d571276cf0a7653f6f5fe81049adf3ed  proxysql_4.0.10-debian13_amd64.deb
27af282f929780e11fe24e14b449d9b461d4179b091e07f460f98a5f12b2b5f1  proxysql_4.0.10-debian13_arm64.deb
7f9f0c87ac27c257e1a56b683c8d360d6a62e7dc318f010ee0c2478341e45e76  proxysql_4.0.10-ubuntu22-clang_amd64.deb
e63303009b89f6181edb01febfca20d2632b0e872b5038fa52cd23e3b5908964  proxysql_4.0.10-ubuntu22_amd64.deb
9586cd4538942252f23500f2f723a3b762e4e8da85aa777fb841d3dc7c9f6d43  proxysql_4.0.10-ubuntu22_arm64.deb
e0c35db5fe69716ce37d04c506c6e1269f31bcab9385f7118ea16a09700ca2e6  proxysql_4.0.10-ubuntu24-clang_amd64.deb
90ecd7e1892fc5cc1cf1cdbad4f74344e65fb8e428f45d55679c825b6fbaacf6  proxysql_4.0.10-ubuntu24_amd64.deb
8b965b857e57b2eb3bae5dad5f6e1bcddb7805f58fdab521511d195301ebdb1f  proxysql_4.0.10-ubuntu24_arm64.deb