MaxScale 25.10.0 Release Notes

MaxScale 25.10.0 is a Stable (GA) release of MariaDB MaxScale 25.10, released on 2025-10-22

Release date: 22 Oct 2025

Release 25.10.0 is a GA release.

This document describes the changes in release 25.10, when compared to release 25.01.

For any problems you encounter, please consider submitting a bug report on our Jira.

Changed Features

Dropped Features

The global settings query_retry and query_retry_timeout, as well as the monitor settings backend_write_timeout and backend_read_timeout have been removed. The settings are still recognized but any configured values are ignored.

Deprecated Features

The global settings event.authentication_failure.facility and event.authentication_failure.level have been deprecated and renamed to event_authentication_failure_facility and event_authentication_failure_level respectively.

The monitor setting backend_connect_timeout has been deprecated. Use backend_timeout instead.

New Features

MXS-5627 Add auto_failback_switchover to MariaDB Monitor

Restores the old primary server to primary status once it rejoins the cluster after failover. See monitor documentation for more information.

MXS-5592 Add redirect command to MariaDB Monitor

Manually alters replication topology.

MXS-5574 Export Otel metrics from MaxScale

MaxScale can now send metrics to an OpenTelemetry Collector. Telemetry configuration

MXS-5565 Galera Monitor bootstrap command

The Galera monitor can now bootstrap itself from an existing Galera cluster. Please see the Galera Monitor documentation for more information.

MXS-5538 Add list-backups command to MariaDB Monitor

Lists available backups in the backup storage.

MXS-5524 Use new SESSION AUTHORIZATION feature from 12.0

If MaxScale is used with MariaDB 12.0 and the service user has the required grants to switch users, the backend authentication will be done with the service user credentials and the new SET SESSION AUTHORIZATION command is used to switch the user account to the one that the client is requesting. This makes the authentication between MaxScale and MariaDB very flexible and allows it to use an efficient, secure and fast authentication mechanism like ed25519 or PARSEC while still supporting all possible authentication mechanisms between the client and MaxScale.

To disable this feature, add use_service_credentials=false to the server section.

MXS-5503 Copy new server from existing server

When creating a server using maxctrl it is now possible to copy all nonspecified settings from an existing server.

maxctrl create server --copy server1 server2 address=127.0.0.1 port=3001

MXS-5495 Improve backup operation progress tracking

MariaDB Monitor backup operation status can be shown in detail with the fetch-cmd-status command.

MXS-5459 Test backup operation prerequisites

MariaDB Monitor backup commands (rebuild-server, create-backup, restore-from-backup) now support key-value arguments. The commands also support the dry-run-option, which checks if MaxScale configuration and servers support the commands.

MXS-5456 Read maxctrl section from maxscale.cnf if present

If there is a [maxctrl] section in the MaxScale configuration file, maxctrl will read settings from there if it's readable. This makes it easier to enable encryption and to define the credentials that are used to access MaxScale.

MXS-5418 Add configuration option for assigning the initial server state

With the initial_status setting, the initial state of all servers can be set to either down, up, read or write. This allows manual assignment of server states for special cases where monitoring is either not needed or doesn't produce the expected result.

MXS-5393 Simplified way for issuing module commands

The first value in the maxctrl call command can now also be the name of an object in MaxScale instead of the module name. This makes it much more convenient to call the module command of the correct object.

For example, maxctrl call command mariadbmon switchover My-Monitor can now be done with maxctrl call command My-Monitor switchover.

MXS-5367 Support zstd protocol compression

MaxScale now supports the newer zstd as well as the older zlib compression at the protocol level. Unlike MariaDB and MySQL, which have a fixed compression threshold of 50 bytes, MaxScale can be customized to compress at a custom threshold with the mariadbprotocol.compression_threshold setting to reduce the CPU cost for small payloads.

To disable support for the protocol level compression, set mariadbprotocol.compression=none in the listeners.

MXS-5360 Enable implicit creation of filters

A filter that does not have any configuration settings can be directory used in the configuration section of a service, without a configuration section of its own. See the filter documentation for more information.

MXS-5354 Filter for controlling what statements are allowed

The readonly implicit filter can be used for preventing writes to a server.

MXS-5346 Property support [create|drop|list] indexes

The NoSQL protocol now supports the use of indexes. See NoSQL indexes for more information.

MXS-5333 Support MariaDB multi-authentication

MaxScale now supports the use of multiple authentication plugins for both client and backend authentication. The set of supported plugins can be configured with the authenticator setting in the listeners. For example to enable both traditional mysql_native_password and the newer PARSEC authentication, use authenticator=mariadbauth,parsecauth in the listeners.

MXS-5330 Add database firewall

MaxScale now contains a database firewall that first learns what statements are allowed and then rejects statements that are not allowed.

MXS-5328 Galera cluster discovery

Added discover-replicas and bootstrap commands to Galera Monitor. bootstrap populates an empty monitor. discover-replicas finds new servers to add to the monitor and optionally removes disconnected servers.

MXS-5327 Replication cluster discovery

Added scan-topology, discover-replicas and bootstrap commands to MariaDB Monitor. scan-topology is mainly useful in checking if all servers in the replication cluster are monitored. bootstrap populates an empty monitor. discover-replicas finds new servers to add to the monitor and optionally removes disconnected servers.

MXS-5240 React to redirect_url from backends

MaxScale will rename the redirect_url server variable change in the response from a server to mxs_rdir_url before the packet is returned to clients. This is to prevent someone from inadvertently bypassing MaxScale by doing a SET GLOBAL redirect_url through MaxScale. Redirecting clients away from MaxScale, should be done via maxctrl alter service ... redirect_url=<URL>.

MXS-5238 Connection redirection: add redirect_url parameter

MaxScale now has a redirect_url configuration setting using which clients can be redirected away from MaxScale.

MXS-5230 Add a way to configure preference of servers

Using the new preferred_labels it is possible to affect the server selection order in ReadConnRoute.

MXS-5220 Allow customization of fields in maxctrl list commands

With the --fields flag the output of maxctrl can be customized. For instance:

maxctrl list servers --fields=server,connections,active-operations,gtid

MXS-5195 Verify REQUIRE (X509|ISSUER|SUBJECT|CIPHER) on maxscale side

MaxScale now enforces the REQUIRE (X509|ISSUER|SUBJECT|CIPHER) clauses on user definitions. Please see the server tls_options documentation for more information.

MXS-5180 Add role support to monitors and services

Monitors and service will activate the configured role when logging in. See monitor and service settings for more information.

MXS-5177 Introduce a new core_file variable in MaxScale

By default, MaxScale no longer generates a core file when it crashes. Please see core_file for more information.

MXS-5170 Add setting to control servers participating in cooperative monitoring

servers_no_cooperative_monitoring_locks excludes listed servers from cooperative monitoring.

MXS-5149 Include actual line content in parse error message

When configuration file parsing fails in an early phase, the actual offending line will now be logged in the error message to make it easier to pinpoint the problem.

MXS-5145 Clarify log messages regarding lost server locks

MXS-5130 Support for PARSEC auth plugin from MDEV-32618

MaxScale now supports PARSEC authentication.

MXS-5015 Separate read-write/read-only and master/slave

In the output of maxctrl list server, the state of a server and reason for the state are now separated. The state of a server is shown as Read, Write, Up or Down, possibly augmented with Maintenance or Draining|Drained, while the reason for the state is shown in the next column. For instance, in a Primary/Replica cluster, the reason for the state Read may be Primary, read_only, indicating that although the server is the primary, it has read_only turned on, so it cannot be used for writing.

MXS-5013 Reset router diagnostics statistics

Using maxctrl, it is now possible to clear both server and service statistics.

$ maxctrl clear statistics MyService
$ maxctrl clear statistics Server1

MXS-4951 Support server side ephemeral certificates

MaxScale can connect to a MariaDB Server that is using a self-signed certificate and verify the certificate. See TLS/SSL encryption for more information.

MXS-4950 Support client side ephemeral certificates

MaxScale can generate a self-signed certificate and a supporting client can verify it. See TLS/SSL encryption for more information.

MXS-4899 Make it possible to dump the query classifier cache to a file

Using maxctrl it is now possible to dump the content of the query classifier cache to a file. The cache can be dumped as json, as pretty formatted json and as json lines, i.e. as json objects separated by a newline.

$ maxctrl create qc_dump --format=json /tmp
/tmp/qc_dump-2024-09-23_13-00-30.json

MXS-4892 MaxScale should warn about inconsistencies in the configuration file

• At startup, if there are filters that are not used by any service, or servers that are not referred to by any service or monitor, a warning will be logged.

MXS-4754 Add replication information to maxctrl list servers

The maxctrl list servers command now also has a customizable field for replication lag information. To use it, add replication-lag to the list in the --fields option.

MXS-4699 Add global setting require_secure_transport

The global setting require_secure_transport forces encryption to be configured everywhere.

MXS-4636 Mechanism for throttling of write queries based on replica lag

A new feature in the readwritesplit router that synchronizes committed transactions on one or more replicas by waiting for the transaction to be replicated. It has two modes of operation: the soft mode synchronizes the transactions but proceeds normally if a synchronization timeout occurs and the hard mode which will close the client session if synchronization times out. The sync_transaction_max_lag setting can be used to adjust when the throttling takes place and sync_transaction_timeout controls the maximum amount of lag that the client applications will experience.

This feature can be used to limit the amount of replication lag that the cluster will see. It also provides a way to have fully synchronous replication with MariaDB with stronger durability guarantees than is possible with semi-synchronous replication.

MXS-4371 Improve REST-API Access Control

The MaxScale GUI and REST-API now use role based access control to restrict the operations that users can do. The admin and basic roles both retain their old behavior of the former being allowed to do anything and the latter being only able to perform read-only operations. The new editor role has the ability to also modify objects but it lacks the ability to create, modify or delete users and roles. The new sql role is only allowed to access the query API and the Workspace in the GUI.

User-defined roles can also be added with the maxctrl create role command. The permissions that the roles have are admin for creating users, edit for creating, modifying and destroying objects, view for viewing information about objects and MaxScale itself and sql for accessing the SQL query API.

MXS-4137 Run SQL commands on primary and replica whenever status changes

Run custom SQL on a server when it gains a primary or replica role. See here and here for more information.

MXS-4102 Support for passphrase protected certificate keys

It is now possible to use passphrase protected certificate keys. Please see ssl_passphrase and admin_ssl_passphrase for more information.

MaxGUI

Numerous additions have been added and improvements made to MaxGUI. The most notable ones are listed here:

• MXS-5421 Highlight changed parameters

• MXS-5204 Query Editor: Add UI for creating and altering users

• MXS-4641 Backup operations UI

Bug fixes

Known Issues and Limitations

There are some limitations and known issues within this version of MaxScale. For more information, please refer to the Limitations document.

Packaging

RPM and Debian packages are provided for the supported Linux distributions.

Packages can be downloaded here.

_{This page is: Copyright © 2025 MariaDB. All rights reserved.}