taosdata/TDengine ver-3.4.2.2

3.4.2.2

on GitHub

Release date: 2026-07-22

1. Highlights

• Federated query: External data sources can be queried through virtual tables, and a stream task can run a federated query. MySQL, PostgreSQL, and InfluxDB v3 are supported. The feature is off by default.
• Query: Window functions and the OVER clause, aggregate DISTINCT, windows aligned to calendar time units, multi-column state windows, and TEXT / FILE inline data sources are added.
• Timezone: A connection-level timezone is added, with IANA timezones and daylight saving time.
• Virtual tables: A virtual super table can inherit another. Ordinary columns and tag columns of a virtual child table can reference other tables.
• Stream processing: ROLLUP BY summarizes by tag hierarchy. true_for of an event window can set the start condition and the end condition separately.
• Connections and security: The C, Go, Python, and Node.js WebSocket connectors support taosAdapter high availability. Several memory-safety issues that could crash taosd are fixed.

2. Features

2.1 Federated query and virtual tables

• Federated query based on virtual tables is supported. External data sources are MySQL, PostgreSQL, and InfluxDB v3. Both the client and the server federatedQueryEnable must be on before use. The default is off. See Federated Query.
• A stream task can run a federated query.
• A virtual super table can inherit another virtual super table. See Virtual Supertable Inheritance.
• An ordinary column of a virtual child table can reference another virtual child table.
• A tag column of a virtual child table can reference a physical child table and another virtual child table.

2.2 SQL and query

• Window functions and the OVER clause are supported. See Window Functions.
• Aggregate functions support DISTINCT, for example COUNT(DISTINCT col).
• TEXT and FILE inline data sources are added. Row values or a CSV file can be used directly in FROM without creating a table, and they can take part in SELECT, JOIN, UNION, and INSERT INTO SELECT. See TEXT Inline Data Source and FILE CSV Data Source.
• Windows split by calendar time units are added. A window aligns to a local calendar boundary: calendar day, week, month, quarter, or year. The quarter unit q is added. See INTERVAL Queries.
• A connection-level timezone is added, with IANA timezone names and daylight saving time. See Timezone.
• A state window supports several state columns. See State Window.
• An external window supports FILL. See External Window.
• A window query can use original columns, tag columns, scalar functions, and variable-row functions.
• A window query can use CSUM, DIFF, DERIVATIVE, MAVG, STATECOUNT, STATEDURATION, LAG, LEAD, and FILL_FORWARD, together with INTERVAL + FILL (NULL / NONE / VALUE / NULL_F / VALUE_F).
• REGEXP_EXTRACT is added. See REGEXP_EXTRACT.
• SLEEP is added to simulate a timeout in tests.
• GREATEST / LEAST can skip NULL through ignoreNullInGreatest. The default does not skip NULL.
• DIFF, CSUM, MAVG, STATECOUNT, LAG, LEAD, FILL_FORWARD, and UNIQUE can run when there is no time column.

2.3 Stream processing

• A stream trigger adds ROLLUP BY tag_name, which summarizes by tag hierarchy. See Trigger Grouping.
• true_for of an event window can set the start condition and the end condition separately.
• SHOW STREAMS can name a database and match stream names with LIKE.

2.4 Metadata and cluster operations

• Metadata updates of super tables, child tables, and virtual tables support transactions.
• CPU affinity binding is supported and is off by default. See CPU Affinity.
• A specified vnode can be turned off temporarily at runtime.
• taosd -r adds --vnode to name the vnode to repair.
• The data-repair tool adds a copy-repair mode.
• snapshotRateLimit is added. It limits the snapshot-send bandwidth of each dnode. The default is 0, which means no limit.
• retryOnOverloadBaseInterval and retryOnOverloadTimeout control client retry when the server is overloaded. The defaults are 1000 milliseconds and 60000 milliseconds.

2.5 Connectors

• The C, Go, Python, and Node.js WebSocket connectors support taosAdapter high availability. The client parameter is adapterHa, default false.

2.6 taosX

• Data can be exported as Parquet files.
• DataOut can export data to Kafka.
• An OPC UA data source can collect alarms and events (Alarm & Events).
• Specified tables can be backed up and restored.

2.7 Platform support

• Windows supports MQTT subscription.
• Windows supports UDF.

2.8 Tools

• taosdump can export the statement that created a stream.

3. Enhancements

3.1 Query

• INTERP interpolation queries are faster.
• A subquery ordered by the primary-key column runs more efficiently.
• While scanning a subquery, the intersection of the subquery time range and the outer query time range is used, so less data is scanned.
• A subquery, UNION ALL, and a multi-level nested query automatically choose a TIMESTAMP column in the result set as the timeline column.
• Metadata fetch and parse of a federated query are improved.

3.2 Stream processing

• COUNT_WINDOW(N, 1) supports historical recalculation.
• Stream processing supports cross-table references and tag references on virtual tables.
• Aggregate queries on a virtual super table run more efficiently.
• Stream startup is faster when the group count is between 500,000 and 1,000,000.

3.3 Storage and cluster

• A multi-replica snapshot transfers files on demand, so recovery is faster.
• After serverPort changes, the internal port used by data subscription is updated automatically.
• The error is clearer when creating a TSMA fails because there is no snode.
• RPC transport options on Windows are adjusted for higher performance.

3.4 Tools

• taosdump backup speed, restore speed, and backup-file compression ratio are higher. An old backup file can be restored by the new version.
• The prompt is clearer when the password entered with taosdump -p is wrong.
• taosExplorer handles batch CSV upload and database import better.
• taosExplorer shows database objects in a tree more clearly.

3.5 taosX

• While ingesting pspace, a long point name can be split on / into child tags. The original long-name tag is kept, and a name variable is provided.
• Synchronizing InfluxDB data is faster in a high-cardinality scenario.

4. Fixes

4.1 Severe issues

The following issues made the service unavailable or returned wrong data.

• Scanning information_schema.ins_tags and resolving a virtual-table tag reference deadlocked taosd. Affected versions: v3.4.2.0 and v3.4.2.1.
• A query entered an infinite loop when the start time of INTERVAL AUTO was INT_MAX. Affected versions: v3.3.5.0 through v3.4.1.17. The syntax was introduced in v3.3.5.0. It is fixed from v3.4.1.18 and from v3.4.2.0.
• taosd crashed when stream processing failed to initialize the table list. Affected versions: v3.3.7.0 through v3.4.1.17.
• Compressing or decompressing a single row crashed the process. Affected versions: v3.4.1.16 and earlier.
• Binding and executing again after an asynchronous STMT write reported an error crashed the process. Affected versions: v3.3.3.0 through v3.4.1.16. The v3.3.6 patches from v3.3.6.53 onward are fixed.
• On Windows, concurrent queries that used temporary files collided on file names, read the wrong data, and crashed. Affected versions: v3.4.1.17 and earlier.
• A scheduled incremental backup in taosX occasionally missed data. Affected versions: all versions. The v3.3.6 patches from v3.3.6.52 onward, the v3.4.1 patches from v3.4.1.15 onward, and versions from v3.4.2.0 onward are fixed.
• While taosX consumed Kafka for historical backfill, data earlier than the keep1 window was dropped. Affected versions: all versions. The v3.3.6 patches from v3.3.6.54 onward, the v3.4.1 patches from v3.4.1.19 onward, and versions from v3.4.2.1 onward are fixed.
• After a taosX worker thread exited, resources were not released, and the XNode eventually became unavailable. Affected versions: from v3.4.0.0 until the fix in this release.
• User tokens were not synchronized in time among a three-replica mnode. A newly created XNode failed authentication and stayed offline. Affected versions: v3.3.6.49 and later versions in that series, all of v3.4.0, v3.4.1.0 through v3.4.1.18, and v3.4.2.0 and v3.4.2.1. v3.3.7 has no user token.
• After the IP allowlist was turned on at runtime, the dnode's own FQDN was not on the list, so cluster nodes could not log in. Affected versions: v3.1.1.46 through v3.4.1.14. The v3.3.6 patches from v3.3.6.52 onward are fixed.

4.2 Query

• After the underlying super-table schema changed, a virtual table reported a column-order mismatch.
• With BI mode on, LAST(), FIRST(), and LAST_ROW(*) on a virtual super table did not return the tbname column.
• LEFT ASOF JOIN together with DIFF failed when the intermediate result exceeded 65535 rows.
• Using TIMETRUNCATE in a JOIN converted timezones of the left and right tables inconsistently, so the result was wrong.
• Querying information_schema.ins_tables, the group key such as stable_name was empty when COUNT was used with PARTITION BY or GROUP BY.

4.3 Stream processing

• An event notification failed to send when INTO was not used.
• When one trigger produced several windows, a scalar subquery used with a window pseudo column produced no output.
• The WHERE filter of a notification was judged incorrectly, so the pushed result did not match expectations.
• After a fill_history threshold was configured, writing data earlier than the threshold into an empty table still triggered historical backfill.

4.4 Writes and connectors

• A parameter-bound STMT execution of a SELECT with INTERVAL blocked.
• A schemaless write reported Invalid schema version.
• An ODBC write failure returned no error message.
• An illegal NCHAR written through TMQ or a raw block was not checked, and a later column filter on an ordinary table failed.

4.5 Data subscription

• After a child-table tag was changed or a child table was dropped, the subscription filter result was wrong. Historical writes of a dropped child table in the WAL can be parsed normally.

4.6 taosX

• A dual-active task stopped abnormally when it met an empty connection.
• Backup to S3 or restore from S3 failed.
• A failed backup task could not be deleted.
• After a backup task was configured successfully, it did not appear in taosExplorer.
• During data migration, a different tag order between the source database and the target database caused a write error.
• When a Kafka data source configured several transform rules, a wrong sequence number left some fields empty.
• The Dataset Filter configuration of PI Connector was abnormal.
• The CSV downloaded by PI Connector was wrong when points were filtered by element.
• PI Connector treated Int16 as Int32.

4.7 taosExplorer

• An ordinary table could not be displayed.
• User grants still used the old privilege syntax, so a grant statement reported an error.
• The scrollbar on a table page could not be dragged.

5. Security

5.1 Vulnerability fixes

See the security advisories.

• GHSA-vxcq-cqrc-f8j3: a double-free during SQL parsing can crash taosd. Affected versions: v3.2.3.8 through v3.4.1.14.
• GHSA-v8cj-fw82-9jjf: a use-after-free or double-free during subquery processing can crash taosd. Affected versions: v3.4.1.0 through v3.4.1.14.
• GHSA-f8pf-77fh-53wv: a double-free during projection can crash taosd. Affected versions: v3.0.0.0 through v3.4.1.14.
• CVE-2025-58050: the PCRE2 dependency has a security vulnerability and has been upgraded to 10.47. Affected versions: v3.4.1.17 and earlier. The PCRE2 bundled with those versions is 10.45 or lower.
• Privilege checks failed during automatic table creation, so a user could create a child table without privilege. Affected versions: v3.4.1.14 and earlier. The v3.3.6 patches from v3.3.6.52 onward are fixed.
• A crafted RPC message could cause a denial of service. Message-length checks are stronger. Affected versions: v3.4.1.14 and earlier.
• A key update took effect only on the mnode leader. Other nodes still used the old key. Affected versions: v3.4.1.16 and earlier.

5.2 Hardening

• RPC communication adds authentication so the content is not sent in clear text.
• After a password change, connections established with the old password are closed.
• Temporary files spilled by a query are stored encrypted.
• UDF file-path checks are stronger.
• String-terminator checks are stronger.

6. Upgrade notes

6.1 Upgrade path

• Source versions that support a direct upgrade: v3.3.7 and later
• Rolling upgrade: supported, from v3.4.2.0 through v3.4.2.2
• Downgrade or rollback: supported, from v3.4.2.0 through v3.4.2.2
• Minimum matching client and connector version: v3.4.2.0

6.2 Behavior changes

• RPC communication adds authentication so the content is not sent in clear text. A client and a server from an earlier version cannot communicate.
• After a password change, connections established with the old password are closed, and later requests return an authentication failure. An application that uses a connection pool must update the configuration after the password change and rebuild the pool.
• When an ordinary user writes a table that does not exist and has no wildcard privilege, the error changes from Permission denied or the target object does not exist to Table does not exist. An application that branches on the error text or error code needs to be adjusted.
• A connection-level timezone is added. The precedence is SQL parameter, connection, then global configuration. When no connection-level setting is made, server-side calculation still falls back to the server global timezone. From this release, reading an ordinary column uses the connection timezone.
• Temporary files spilled by a query are stored encrypted. Queries with a large result have a slight performance impact.
• The output of USE on macOS changes to Database changed., matching Linux. A script that parses taos shell output needs to follow the new output.
• ignoreNullInGreatest controls whether GREATEST / LEAST skips NULL. The default is 0: if any argument is NULL, the result is NULL, so existing query results do not change. Set it to 1 to skip NULL.

6.3 Configuration changes

6.3.1 License

6.3.2 CPU affinity

6.3.3 Federated query

6.3.4 Authentication and security

6.3.5 Overload retry

6.3.6 Synchronization

6.3.7 Other

6.3.8 Removals and changes

6.4 Keyword changes

This section lists 39 keywords. When one of these words is used as a database, table, super table, child table, column, or tag name, quote it with backticks ` regardless of case, for example `BEGIN`.

6.4.1 Window-frame clause

OVER, CURRENT, ROW, ROWS, PRECEDING, FOLLOWING, UNBOUNDED, used by window-frame syntax.

6.4.2 State-window extensions

EXTEND, ZEROTH_STATE, NO_ZEROTH, used by state-window extension and the initial-state definition.

6.4.3 Window mode

SCALAR, AGG, for a scalar window and an aggregate window.

6.4.4 Federated-query DDL

EXTERNAL, SOURCE, SOURCES, REFRESH, OPTIONS, SCHEMA, TYPE, PASSWORD.

6.4.5 Transaction control

BEGIN, COMMIT, ROLLBACK, used by explicit transaction statements.

6.4.6 Manual vnode switch

OPEN, CLOSE, used by OPEN VNODE and CLOSE VNODE.

6.4.7 Virtual-table BASE ON and SERIES

BASE, REMOVE, SERIES, used by virtual-table BASE ON and InfluxDB Series migration.

6.4.8 Security policy

SECURITY_LEVEL, SECURITY_POLICIES.

6.4.9 SHOW extensions

CPU_ALLOCATION, ORPHANS, INHERITS.

6.4.10 Other

FIRST_DAY_OF_WEEK, TEXT (inline text table), PARALLEL (ALTER DATABASE parallelism), API_TOKEN, SMALLDATA_SCAN_SORT (hint), _TROLLUP_TBCOUNT (pseudo column).

6.5 System table changes

Ten tables are added. No table is removed. Five existing tables add columns.

6.5.1 New tables

• ins_cpu_allocation: CPU allocation of threads on each dnode
• ins_ext_sources: registered external data sources (federated query)
• ins_security_policies: security-policy definitions
• ins_snap_send_vnodes: snapshot-replication progress by vnode
• ins_snap_send_filesets: snapshot-replication detail by fileset
• ins_table_fixed_distributed: table data-block distribution statistics, replacing ins_table_distributed, which has been unavailable for a long time
• ins_transactions: transaction information
• ins_transaction_logs: historical logs of finished transactions
• ins_transaction_orphans: orphan-transaction detection
• ins_vstable_inherits: virtual-super-table inheritance

6.5.2 New columns on existing tables

• ins_databases: adds sec_level, the database security level
• ins_stables: adds sec_level, the super-table security level
• ins_users and ins_users_full: add sec_levels, the security levels a user can access
• ins_virtual_child_columns: adds col_type, the type code of a virtual child-table column

6.5.3 Removed tables

None.

6.6 Dependency changes

6.7 Before you upgrade

Stream processing was redesigned after v3.3.6.0. Before upgrading from v3.3.6 or earlier to this release, the old stream objects must be removed and then rebuilt on the new version. If these steps are skipped, taosd fails to start.

Do the following in order before the upgrade:

1. Drop every stream task. DROP STREAM drops the task and does not drop result data already written. Use SHOW STREAMS first to list the tasks.
2. Drop every TSMA: DROP TSMA [db_name.]tsma_name. The TSMA result super table is dropped with the TSMA.
3. Drop every snode: DROP SNODE ON DNODE dnode_id. The snode and its replicas must be online, or the drop fails.
4. Delete the snode directories:
   • the snode directory under dataDir, by default /var/lib/taos/snode
   • the directory named by checkpointBackupDir, by default /var/lib/taos/backup/checkpoint/
5. Drop every stream result table (optional).

After the upgrade, deploy the new snodes, then recreate the streams with the new syntax.

7. Known issues

None.

8. Downloads

The package is available from the TDengine download center. Choose the platform and components for this version.

The package includes an SBOM and SHA256 checksums. They can be used to verify the package and to see which components it contains.