Tarantool Files

Date: 2026-10-23 Tag: 3.8.2

Overview

Tarantool 3.x is the recommended release series. Users of Tarantool 2.11 are encouraged to update to the latest 3.x release.

This release resolves 45 bugs since 3.8.1.

[Breaking change] Creation of a non-sandboxed function now requires the execute privilege on universe. Previously, having create privilege on func and write privilege on space _func was enough. Since this is a fix for a possible privilege escalation, it is submitted without the usual compatibility switch (ghs-164).

Please consider the full list of user-visible changes below.

Compatibility

Tarantool 2.x and 3.x are compatible in the binary data layout, client-server protocol, and replication protocol. It means upgrade may be performed with zero downtime for read requests and the order-of-network-lag downtime for write requests.

Please follow the upgrade procedure to plan your update actions.

Users of Tarantool 2.x may be interested in the compat options that allow to imitate some 2.x behavior. This allows to perform application code update step-by-step, not all-at-once.

Bugs fixed

Core

• [Breaking change] Fixed missing privilege verification. Creation of a non-sandboxed function now requires the execute privilege on universe (ghs-164).
• box.cfg() called with a non-table argument now fails with a clear cfg should be a table error instead of a confusing internal one (gh-13145).
• Deprecated box.cfg options set via TT_* environment variables are now translated to their replacement options, and the translation no longer silently overrides an explicitly provided value of a replacement option (gh-13144).
• Fixed a bug where a redundant deprecation warning about replication_connect_quorum was logged when bootstrap_strategy was explicitly set to 'legacy' in the same box.cfg() call (gh-12933).
• Fixed a bug where Tarantool crashed when application threads concurrently handled access denial errors (gh-13293).
• Fixed a macOS backtrace crash when an image has no symbol for a frame (gh-13330).
• Fixed native thread stack bounds supplied to ASan on macOS (gh-13330).
• Fixed application thread startup failures caused by concurrent module path lookup on macOS, and a crash in fio.dirname() when the directory part of a path is at least 1024 bytes long (gh-13130).
• Reject oversized Unix socket paths instead of connecting to a truncated path (gh-13330).
• Fixed crashes due to Lua stack leaks in net.box reconnects, Lua triggers, numeric configuration reads, quorum formula evaluation, and others (gh-11061).
• Fixed memory leaks in CSV parsers and memtx bitset indexes on macOS (gh-13330, gh-1215).
• Fixed the owner check on space alter (tarantool/security#173).
• Fixed a crash on fallback from IPROTO_AUTH override handler (gh-13291).
• Fixed a crash on fallback from IPROTO_UNKNOWN override handler (gh-13320).
• Deletion from _func_index now requires the drop privilege on the space (tarantool/security#176).
• Fixed an out-of-bounds read when a np or pp iterator was requested with a key that has more parts than the index (gh-13286).
• Fixed a bug where on_replace triggers received the original request type when a before_replace trigger changed the operation. They now receive the type of the operation actually applied and written to WAL (gh-13416).
• Fixed crashes in triggers during WAL recovery and replication of transactions containing NOP statements. Transaction iterators now skip all NOPs (gh-13163).

Memtx

• Fixed a bug where an iterator over a multikey or functional index, after the index was modified concurrently, returned some entries of the tuple it was paused on twice or skipped them (gh-13410).
• Fixed a use-after-free in a transaction that used select with the offset option concurrently with a replace that was rolled back later, with MVCC enabled (gh-13411).
• Fixed a crash on a write to a space with a functional index whose row was deleted from _func_index, with MVCC enabled (gh-13477).
• Fixed a crash on continuing a reverse iterator with MVCC enabled after the tuple it pointed to was removed from the index, e.g. because its transaction was aborted (gh-13403).
• Fixed a crash after a failed replace in a space with a functional index whose function raised an error for the replaced tuple (gh-13481).
• Fixed an out-of-bounds read on a delete of a tuple missing from a bitset index being built in the background, which could delete another tuple from the index (gh-13487).
• Fixed a use-after-free in a transaction that used select with the offset option on a functional index concurrently with an update of the indexed tuple, with MVCC enabled (gh-13497).

Vinyl

• Fixed Vinyl metadata log (vylog) corruption during recovery, which could cause box.snapshot() to fail with the Invalid VYLOG file error and prevent the instance from restarting (gh-13448).

Replication

• Fixed a debug-build crash that could happen when a quorum of acks was collected for a synchronous transaction while a PROMOTE or DEMOTE was being written to the journal (gh-13066).
• Fixed an out-of-bounds write triggered by a replication peer sending an IPROTO_RAFT message whose vote contains an ID outside the valid replica ID range.
• Fixed a bug where a replica's garbage collection consumer retained outdated WAL files after reconnecting to an upstream with a newer vclock (gh-13068).

Raft

• Fixed a bug where an old leader could rejoin with a new one while having mismatched data, and this would remain undetected. This could happen when synchronous transactions are rolled back due to a timeout (gh-13085).
• Fixed a bug where a synchronous transaction, temporarily blocked because the synchronous transaction queue was full (replication.synchro_queue_max_size was reached), during a leader change or a timeout (replication.synchro_timeout) could be rolled back, but then appear again and even be committed (locally after a restart or on another node) (gh-13095).
• Fixed a bug where box.ctl.promote() could hang indefinitely on a read-only instance, even if the election was won and the synchronous transaction queue was claimed successfully (gh-10040).
• Fixed a bug where box.cfg() on a freshly bootstrapped instance with election_mode set to 'candidate' or 'manual' could sometimes return with the instance in a read-only state for some time afterwards, even when no read-only mode was explicitly configured (gh-12972).

LuaJIT

Patches from the vanilla LuaJIT trunk were backported (gh-12880). The following issues were fixed as part of this activity:

• Fixed stack overflow relimit handling.
• Fixed container of packed bitfield.
• Fixed fp:seek() with the string argument.
• Fixed tobit conversions for aarch64 in the VM.
• Fixed pointer difference operation on 64-bit platforms.

Lua

• Preserve subsecond file timestamps in fio.stat(), fio.lstat(), and file:stat() on macOS (gh-13330).

Http client

• Fixed an infinite loop when an HTTP response has an incomplete header section (gh-5937).

SQL

• Fixed assertions that occurred due to insertion of an incorrect trigger definition into _trigger or insertion of an incorrect view definition into _space (gh-13067).
• A named bind variable must now always begin with #, :, or @ followed by a letter or a non-digit identifier character (variants such as @number are no longer supported). A numeric bind variable must begin with $ followed by a number (variants such as $name are no longer supported). An anonymous bind variable is denoted by ? followed by a non-numeric, non-alphabetic character (gh-13012).
• Fixed a bug where an unquoted SQL identifier whose uppercase form is longer than the original (for example, some Unicode letters) produced an unterminated name from partly uninitialized memory (gh-13160).
• Fixed a memory leak in the ALTER TABLE ADD CONSTRAINT CHECK and ALTER TABLE ADD CONSTRAINT FOREIGN KEY statements (gh-13106).

Config

• Fixed repeated calls to an application role's stop() callback after the role is removed from configuration (gh-13014).

Iproto

• Fixed a crash caused by IPROTO_EXECUTE and IPROTO_PREPARE requests containing SQL fields with unexpected MessagePack types (ghs-174).
• Fixed the decoding of SQL request keys encoded using a non-optimal, multibyte MessagePack integer representation (ghs-174).
• Fixed a bug where an oversized packet length caused a large input buffer allocation before the packet size was validated when no payload bytes were received (ghs-177).

Msgpack

• Fixed a stack overflow when unpacking MsgPack input with deeply nested values containing arrays and maps (ghs-165).