Skip to main content

​
🔔 Notable Changes

  • MCP Read-write mode: agents can now request and approve access — In Read-write mode, an agent connected through MCP can now take an access request from start to finish. The mode does not grant permissions: an agent can do only what the signed-in user can do in Bytebase, and the project’s approval rules still apply. Approvals, just-in-time settings, and masking exemptions take effect only after the user confirms them in their MCP client.
    • Request just-in-time access for a statement, including unmasked or exportable results.
    • Approve or reject issues and access requests.
    • Turn a project’s just-in-time access on or off, grant or revoke masking exemptions, and revoke access grants.
    • See which result columns are masked and why, and who can approve a request.
    • Workspaces on Read-write get these when they upgrade. To stop agents from approving, switch to Read-only. See MCP docs.
  • SQL Server and Oracle: TLS settings now take effect — Bytebase previously ignored the TLS section for these engines. It now applies it: Verify server certificate checks the certificate chain and host name, and Oracle TLS connects over TCPS without a wallet. To keep existing connections working, the upgrade turns off settings that never applied:
    • SQL Server: Verify server certificate is turned off on data sources that use TLS.
    • Oracle: TLS mode is turned off, and stored CA and client certificates are removed.
    • To turn them back on, add the server’s CA certificate in the TLS section. See Upgrade notes for Terraform.
  • Oracle: connection attempts time out after 10 seconds — Bytebase set no connect timeout for Oracle, so an address that did not answer held each connection for about two minutes, which also slowed failover to a Data Guard standby listed in SERVER. Bytebase now gives up on an address after 10 seconds; running queries are not affected. If an instance needs longer to connect, for example behind an on-demand VPN, set CONNECTION TIMEOUT under Extra Parameters to a larger number of seconds, or 0 for no limit.

​
🚀 Features

  • Setup wizard for new workspaces — A new workspace opens on four screens: name the workspace, choose what to do first, create a project with the sample instance or your own database, and set up your team. Finish creates everything at once and opens the new project’s home page with next steps for your goal.
  • Self-hosted: admin recovery without downtime — Re-enable password sign-in or reset a user’s password while Bytebase keeps running. The change applies within a minute, with no stop or restart, and recovery can run unattended from a script or job. See recovery docs.
  • BigQuery SQL review — SQL review now supports BigQuery, with two rules: Enforce the presence of “WHERE” condition in UPDATE/DELETE statements and Restrict the SQL file size.

​
🎄 Enhancements

  • AI assistant — Chats are grouped by workspace and project, each message shows its time, and the window tells you right away if AI is not configured yet.
  • The workspace member drawer shows the permissions in each role, as the project member drawer already did.
  • Access grants — Long statements fold to two lines with Show more, and a disabled Export button explains why.
  • Instance license — The license management page points to the instance detail page for instances that belong to a project.
  • Viewing the query plan of a statement approved through an access grant now requires a role with explain permission, like any other query plan.
  • A create-database plan fails if a database with that name exists in another project, including one that project dropped; a project can still reuse its own names.
  • API — ListPlans filters by release (release, has_release) and by task status (task_status), so GitOps plans can be told apart from plans created in the console.
  • Oracle — Better SQL parsing compatibility, including parenthesized queries.
  • Self-hosted — Container images ship updated CA bundles that reject certificates issued through the compromised eMudhra intermediates; the bytebase-action image moves to Debian 13.

​
🐞 Bug Fixes

  • Fix approval steps showing No reviewers when the step’s role is held only by service accounts or workload identities. The step now lists them and shows which one approved.
  • Fix approved exports not being found in SQL Editor when the statement is very long. Matching access grants is also faster.
  • Fix the project list showing short pages for users who can access only some projects.
  • PostgreSQL — Fix prior backup running a data-modifying WITH clause twice. Such a change now stops at the backup step, and the plan check warns about it beforehand.
  • PostgreSQL / Redshift / CockroachDB — Fix canceled and timed-out queries continuing to run on instances connected through an SSH tunnel.
  • TiDB — Fix EXPLAIN ANALYZE in SQL Editor demanding database-wide access when a table-level grant should do.
  • SQL Server — Fix SQL Editor returning an internal error for a newly added database before its first schema sync.
  • Self-hosted — Fix sign-in sessions failing to refresh when Bytebase is served over plain HTTP.
  • Fix masking exemptions that cover several databases failing to save, and complex exemption conditions displaying incorrectly.
  • Fix several display issues: the SQL Editor add-sheet button height, environment badges in narrow database pickers, overlapping input borders, the workspace switcher, a duplicated error when the sample instance fails, and the instance form layout.

​
Upgrade notes

  • HA mode: stop every replica before starting 3.24.0; rolling upgrades are not supported for this version. A replica still on an older version saves access grants that 3.24.0 cannot match, and those grants stop working for queries and exports. The upgrade takes longer if you have many access grants.
  • Terraform: the upgrade turns SQL Server certificate verification and Oracle TLS off. A configuration with verify_tls_certificate = true on a SQL Server data source, or use_ssl = true on an Oracle data source, turns it back on at the next terraform apply. Before applying, make sure the certificate verifies and, for Oracle, that the port serves TCPS; otherwise set the field to false.

​
⚙️ Install and Upgrade

Before upgrading: 1) Back up the metadata — in-place downgrade is not supported. 2) Do not run multiple containers on the same data directory. 3) Terraform users: upgrade Bytebase server first, then apply the new Terraform config.