Tarantool Files

Date: 2026-10-23 Tag: 3.7.2

Overview

Tarantool 3.x is the recommended release series. Users of Tarantool 2.11 are encouraged to update to the latest 3.x release.

This release introduces 1 improvement and resolves 54 bugs since 3.7.1.

[Breaking change] Creation of a non-sandboxed function now requires the execute privilege on universe. Previously, having create privilege on func and write privilege on space _func was enough. Since this is a fix for a possible privilege escalation, it is submitted without the usual compatibility switch (ghs-164).

Please consider the full list of user-visible changes below.

Compatibility

Tarantool 2.x and 3.x are compatible in the binary data layout, client-server protocol, and replication protocol. It means upgrade may be performed with zero downtime for read requests and the order-of-network-lag downtime for write requests.

Please follow the upgrade procedure to plan your update actions.

Users of Tarantool 2.x may be interested in the compat options that allow to imitate some 2.x behavior. This allows to perform application code update step-by-step, not all-at-once.

Functionality added or changed

Core

• Added a new box.cfg.read_only value: 'unless_bootstrap'. An instance configured this way becomes writable only if it has bootstrapped the replica set on the current startup and stays read-only if it has recovered from a local snapshot or has joined an already bootstrapped replica set. The mode is resolved atomically during the initial box.cfg() call, so the instance never goes through a transient writable state. The value may be set only during the initial box.cfg() call (gh-12970).

Although this change brings a new feature rather than a bugfix, it was decided to backport it anyway, because the new option value is used by the config module to fix a serious double-leader bug with 'supervised' failover. More details below in the "Config" section and in the gh-12970 issue.

Bugs fixed

Core

• [Breaking change] Fixed missing privilege verification. Creation of a non-sandboxed function now requires the execute privilege on universe (ghs-164).
• Fixed a bug where Tarantool could hang at startup when application threads were configured (gh-12936).
• Fixed a crash on calling box.ctl.wal_sync() before box.cfg{}. Now it raises an ER_UNCONFIGURED error in this case (gh-12556).
• box.cfg() called with a non-table argument now fails with a clear cfg should be a table error instead of a confusing internal one (gh-13145).
• Deprecated box.cfg options set via TT_* environment variables are now translated to their replacement options, and the translation no longer silently overrides an explicitly provided value of a replacement option (gh-13144).
• Fixed a bug where a redundant deprecation warning about replication_connect_quorum was logged when bootstrap_strategy was explicitly set to 'legacy' in the same box.cfg() call (gh-12933).
• Fixed a bug where Tarantool crashed when application threads concurrently handled access denial errors (gh-13293).
• Fixed a macOS backtrace crash when an image has no symbol for a frame (gh-13330).
• Reject oversized Unix socket paths instead of connecting to a truncated path (gh-13330).
• Fixed memory leaks in CSV parsers and memtx bitset indexes on macOS (gh-13330, gh-1215).
• Fixed crashes due to Lua stack leaks in net.box reconnects, Lua triggers, numeric configuration reads, quorum formula evaluation, and others (gh-11061).
• Fixed a crash on update with delete by JSON path with terminal key when the deleted key in tuple had non-optimal encoding (gh-13027)
• Fixed the owner check on space alter (tarantool/security#173).
• Fixed a crash on fallback from IPROTO_AUTH override handler (gh-13291).
• Fixed a crash on fallback from IPROTO_UNKNOWN override handler (gh-13320).
• Deletion from _func_index now requires the drop privilege on the space (tarantool/security#176).
• Fixed an out-of-bounds read when a np or pp iterator was requested with a key that has more parts than the index (gh-13286).
• Fixed a bug where on_replace triggers received the original request type when a before_replace trigger changed the operation. They now receive the type of the operation actually applied and written to WAL (gh-13416).
• Fixed crashes in triggers during WAL recovery and replication of transactions containing NOP statements. Transaction iterators now skip all NOPs (gh-13163).

Memtx

• Fixed a bug where an iterator over a multikey or functional index, after the index was modified concurrently, returned some entries of the tuple it was paused on twice or skipped them (gh-13410).
• Fixed a use-after-free in a transaction that used select with the offset option concurrently with a replace that was rolled back later, with MVCC enabled (gh-13411).
• Fixed a crash on a write to a space with a functional index whose row was deleted from _func_index, with MVCC enabled (gh-13477).
• Fixed a crash on continuing a reverse iterator with MVCC enabled after the tuple it pointed to was removed from the index, e.g. because its transaction was aborted (gh-13403).
• Fixed a crash after a failed replace in a space with a functional index whose function raised an error for the replaced tuple (gh-13481).
• Fixed an out-of-bounds read on a delete of a tuple missing from a bitset index being built in the background, which could delete another tuple from the index (gh-13487).
• Fixed a use-after-free in a transaction that used select with the offset option on a functional index concurrently with an update of the indexed tuple, with MVCC enabled (gh-13497).

Vinyl

• In some cases, vinyl deferred UPSERT field constraint checks until a read or a compaction. A violating UPSERT could then be skipped without returning an error to the client. Constraints are now validated at UPSERT time when update operations may modify constrained columns, matching Memtx behavior (gh-12404).
• Fixed Vinyl metadata log (vylog) corruption during recovery, which could cause box.snapshot() to fail with the Invalid VYLOG file error and prevent the instance from restarting (gh-13448).

Replication

• Fixed an ordering bug in WAL batching that could make a joining replica miss rows written by the master (gh-11028).
• Fixed a debug-build crash that could happen when a quorum of acks was collected for a synchronous transaction while a PROMOTE or DEMOTE was being written to the journal (gh-13066).
• Fixed an out-of-bounds write triggered by a replication peer sending an IPROTO_RAFT message whose vote contains an ID outside the valid replica ID range.
• Fixed a bug where a replica's garbage collection consumer retained outdated WAL files after reconnecting to an upstream with a newer vclock (gh-13068).

Raft

• Fixed a bug where an old leader could rejoin with a new one while having mismatched data, and this would remain undetected. This could happen when synchronous transactions are rolled back due to a timeout (gh-13085).
• Fixed a bug where a synchronous transaction, temporarily blocked because the synchronous transaction queue was full (replication.synchro_queue_max_size was reached), during a leader change or a timeout (replication.synchro_timeout) could be rolled back, but then appear again and even be committed (locally after a restart or on another node) (gh-13095).
• Fixed a bug where box.ctl.promote() could hang indefinitely on a read-only instance, even if the election was won and the synchronous transaction queue was claimed successfully (gh-10040).
• Fixed a bug where box.cfg() on a freshly bootstrapped instance with election_mode set to 'candidate' or 'manual' could sometimes return with the instance in a read-only state for some time afterwards, even when no read-only mode was explicitly configured (gh-12972).

LuaJIT

Patches from the vanilla LuaJIT trunk were backported (gh-12880). The following issues were fixed as part of this activity:

• Fixed stack overflow relimit handling.
• Fixed container of packed bitfield.
• Fixed fp:seek() with the string argument.
• Fixed tobit conversions for aarch64 in the VM.
• Fixed pointer difference operation on 64-bit platforms.

Lua

• Fixed the error in the JSON encoder when an encoded key in the map has __serialize metamethod (gh-12726).
• Preserve subsecond file timestamps in fio.stat(), fio.lstat(), and file:stat() on macOS (gh-13330).

Http client

• Fixed a regression of authorization on an HTTP proxy or a target HTTP(S) host using the Basic algorithm (gh-12805).
• Fixed an infinite loop when an HTTP response has an incomplete header section (gh-5937).

SQL

• Fixed an inability to set both the sort order and the AUTOINCREMENT property on columns in a PRIMARY KEY table constraint at the same time (gh-12968).
• Fixed a bug where the foreign field ID for a field foreign key was lost after executing an ALTER TABLE ADD COLUMN statement (gh-13010).
• Fixed assertions that occurred due to insertion of an incorrect trigger definition into _trigger or insertion of an incorrect view definition into _space (gh-13067).
• A named bind variable must now always begin with #, :, or @ followed by a letter or a non-digit identifier character (variants such as @number are no longer supported). A numeric bind variable must begin with $ followed by a number (variants such as $name are no longer supported). An anonymous bind variable is denoted by ? followed by a non-numeric, non-alphabetic character (gh-13012).
• Fixed a bug where an unquoted SQL identifier whose uppercase form is longer than the original (for example, some Unicode letters) produced an unterminated name from partly uninitialized memory (gh-13160).
• Fixed a memory leak in the ALTER TABLE ADD CONSTRAINT CHECK and ALTER TABLE ADD CONSTRAINT FOREIGN KEY statements (gh-13106).
• Added permission checks when dropping a trigger in SQL. Now only users with 'alter' privileges on a table can drop triggers for that table (ghs-163).

Config

• This is the bugfix that needs the unless_bootstrap feature described above. Fixed a bug where an instance rebootstrapped with an empty data directory could start in the RW mode alongside an already appointed leader with replication.failover = supervised and replication.bootstrap_strategy = auto, if the instance had the lexicographically minimal name in the replicaset. The bootstrap leader candidate now starts with box.cfg.read_only = 'unless_bootstrap', so a rejoined instance never goes through a writable state at all (gh-12970).
• Fixed repeated calls to an application role's stop() callback after the role is removed from configuration (gh-13014).

Iproto

• Fixed a crash caused by IPROTO_EXECUTE and IPROTO_PREPARE requests containing SQL fields with unexpected MessagePack types (ghs-174).
• Fixed the decoding of SQL request keys encoded using a non-optimal, multibyte MessagePack integer representation (ghs-174).
• Fixed a bug where an oversized packet length caused a large input buffer allocation before the packet size was validated when no payload bytes were received (ghs-177).

Msgpack

• Fixed a stack overflow when unpacking MsgPack input with deeply nested values containing arrays and maps (ghs-165).