# MaxScale 25.10.0 Release Notes

**Release date:** 22 Oct 2025

Release 25.10.0 is a GA release.

This document describes the changes in release 25.10, when compared to release 25.01.

For any problems you encounter, please consider submitting a bug report on [our Jira](https://jira.mariadb.org/projects/MXS).

## Changed Features

## Dropped Features

The global settings `query_retry` and `query_retry_timeout`, as well as the monitor settings `backend_write_timeout` and `backend_read_timeout` have been removed. The settings are still recognized but any configured values are ignored.

## Deprecated Features

The global settings `event.authentication_failure.facility` and `event.authentication_failure.level` have been deprecated and renamed to `event_authentication_failure_facility` and `event_authentication_failure_level` respectively.

The monitor setting `backend_connect_timeout` has been deprecated. Use `backend_timeout` instead.

## New Features

### [MXS-5627](https://jira.mariadb.org/browse/MXS-5627) Add auto\_failback\_switchover to MariaDB Monitor

Restores the old primary server to primary status once it rejoins the cluster after failover. See [monitor documentation](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/reference/maxscale-monitors/mariadb-monitor#auto_failback_switchover) for more information.

### [MXS-5592](https://jira.mariadb.org/browse/MXS-5592) Add redirect command to MariaDB Monitor

Manually alters replication topology.

### [MXS-5574](https://jira.mariadb.org/browse/MXS-5574) Export Otel metrics from MaxScale

MaxScale can now send metrics to an OpenTelemetry Collector. [Telemetry configuration](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/maxscale-management/deployment/installation-and-configuration/maxscale-configuration-guide#telemetry)

### [MXS-5565](https://jira.mariadb.org/browse/MXS-5565) Galera Monitor bootstrap command

The Galera monitor can now bootstrap itself from an existing Galera cluster. Please see the Galera Monitor [documentation](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/reference/maxscale-monitors/galera-monitor#bootstrap) for more information.

### [MXS-5538](https://jira.mariadb.org/browse/MXS-5538) Add list-backups command to MariaDB Monitor

Lists available backups in the backup storage.

### [MXS-5524](https://jira.mariadb.org/browse/MXS-5524) Use new SESSION AUTHORIZATION feature from 12.0

If MaxScale is used with MariaDB 12.0 and the service user has the required grants to switch users, the backend authentication will be done with the service user credentials and the new `SET SESSION AUTHORIZATION` command is used to switch the user account to the one that the client is requesting. This makes the authentication between MaxScale and MariaDB very flexible and allows it to use an efficient, secure and fast authentication mechanism like ed25519 or PARSEC while still supporting all possible authentication mechanisms between the client and MaxScale.

To disable this feature, add `use_service_credentials=false` to the server section.

### [MXS-5503](https://jira.mariadb.org/browse/MXS-5503) Copy new server from existing server

When creating a server using `maxctrl` it is now possible to copy all nonspecified settings from an existing server.

```
maxctrl create server --copy server1 server2 address=127.0.0.1 port=3001
```

### [MXS-5495](https://jira.mariadb.org/browse/MXS-5495) Improve backup operation progress tracking

MariaDB Monitor backup operation status can be shown in detail with the [fetch-cmd-status](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/reference/maxscale-monitors/mariadb-monitor#fetch-cmd-status) command.

### [MXS-5459](https://jira.mariadb.org/browse/MXS-5459) Test backup operation prerequisites

MariaDB Monitor [backup commands](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/reference/maxscale-monitors/mariadb-monitor#backup-operations) (rebuild-server, create-backup, restore-from-backup) now support key-value arguments. The commands also support the *dry-run*-option, which checks if MaxScale configuration and servers support the commands.

### [MXS-5456](https://jira.mariadb.org/browse/MXS-5456) Read maxctrl section from maxscale.cnf if present

If there is a `[maxctrl]` section in the MaxScale configuration file, `maxctrl` will read settings from there if it's readable. This makes it easier to enable encryption and to define the credentials that are used to access MaxScale.

### [MXS-5418](https://jira.mariadb.org/browse/MXS-5418) Add configuration option for assigning the initial server state

With the `initial_status` setting, the initial state of all servers can be set to either `down`, `up`, `read` or `write`. This allows manual assignment of server states for special cases where monitoring is either not needed or doesn't produce the expected result.

### [MXS-5393](https://jira.mariadb.org/browse/MXS-5393) Simplified way for issuing module commands

The first value in the `maxctrl call command` can now also be the name of an object in MaxScale instead of the module name. This makes it much more convenient to call the module command of the correct object.

For example, `maxctrl call command mariadbmon switchover My-Monitor` can now be done with `maxctrl call command My-Monitor switchover`.

### [MXS-5367](https://jira.mariadb.org/browse/MXS-5367) Support zstd protocol compression

MaxScale now supports the newer zstd as well as the older zlib compression at the protocol level. Unlike MariaDB and MySQL, which have a fixed compression threshold of 50 bytes, MaxScale can be customized to compress at a custom threshold with the `mariadbprotocol.compression_threshold` setting to reduce the CPU cost for small payloads.

To disable support for the protocol level compression, set `mariadbprotocol.compression=none` in the listeners.

### [MXS-5360](https://jira.mariadb.org/browse/MXS-5360) Enable implicit creation of filters

A filter that does not have any configuration settings can be directory used in the configuration section of a service, without a configuration section of its own. See the [filter documentation](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/maxscale-management/deployment/installation-and-configuration/maxscale-configuration-guide#filters) for more information.

### [MXS-5354](https://jira.mariadb.org/browse/MXS-5354) Filter for controlling what statements are allowed

The [readonly](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/reference/maxscale-filters/maxscale-readonly) implicit filter can be used for preventing writes to a server.

### [MXS-5346](https://jira.mariadb.org/browse/MXS-5346) Property support \[create|drop|list] indexes

The NoSQL protocol now supports the use of indexes. See [NoSQL indexes](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/reference/maxscale-protocols/maxscale-nosql-protocol-module#indexes) for more information.

### [MXS-5333](https://jira.mariadb.org/browse/MXS-5333) Support MariaDB multi-authentication

MaxScale now supports the use of multiple authentication plugins for both client and backend authentication. The set of supported plugins can be configured with the `authenticator` setting in the listeners. For example to enable both traditional `mysql_native_password` and the newer PARSEC authentication, use `authenticator=mariadbauth,parsecauth` in the listeners.

### [MXS-5330](https://jira.mariadb.org/browse/MXS-5330) Add database firewall

MaxScale now contains a [database firewall](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/reference/maxscale-filters/maxscale-firewall-filter) that first learns what statements are allowed and then rejects statements that are not allowed.

### [MXS-5328](https://jira.mariadb.org/browse/MXS-5328) Galera cluster discovery

Added [discover-replicas](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/reference/maxscale-monitors/galera-monitor#discover-replicas) and [bootstrap](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/reference/maxscale-monitors/galera-monitor#bootstrap) commands to Galera Monitor. `bootstrap` populates an empty monitor. `discover-replicas` finds new servers to add to the monitor and optionally removes disconnected servers.

### [MXS-5327](https://jira.mariadb.org/browse/MXS-5327) Replication cluster discovery

Added [scan-topology](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/reference/maxscale-monitors/mariadb-monitor#scan-topology), [discover-replicas](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/reference/maxscale-monitors/mariadb-monitor#discover-replicas) and [bootstrap](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/reference/maxscale-monitors/mariadb-monitor#bootstrap) commands to MariaDB Monitor. `scan-topology` is mainly useful in checking if all servers in the replication cluster are monitored. `bootstrap` populates an empty monitor. `discover-replicas` finds new servers to add to the monitor and optionally removes disconnected servers.

### [MXS-5240](https://jira.mariadb.org/browse/MXS-5240) React to redirect\_url from backends

MaxScale will rename the `redirect_url` server variable change in the response from a server to `mxs_rdir_url` before the packet is returned to clients. This is to prevent someone from inadvertently bypassing MaxScale by doing a `SET GLOBAL redirect_url` through MaxScale. Redirecting clients away from MaxScale, should be done via `maxctrl alter service ... redirect_url=<URL>`.

### [MXS-5238](https://jira.mariadb.org/browse/MXS-5238) Connection redirection: add redirect\_url parameter

MaxScale now has a [redirect\_url](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/maxscale-management/deployment/installation-and-configuration/maxscale-configuration-guide#redirect_url) configuration setting using which clients can be redirected away from MaxScale.

### [MXS-5230](https://jira.mariadb.org/browse/MXS-5230) Add a way to configure preference of servers

Using the new [preferred\_labels](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/reference/maxscale-routers/maxscale-readconnroute#preferred_labels) it is possible to affect the server selection order in *ReadConnRoute*.

### [MXS-5220](https://jira.mariadb.org/browse/MXS-5220) Allow customization of fields in `maxctrl list` commands

With the `--fields` flag the output of *maxctrl* can be customized. For instance:

```
maxctrl list servers --fields=server,connections,active-operations,gtid
```

### [MXS-5195](https://jira.mariadb.org/browse/MXS-5195) Verify REQUIRE (X509|ISSUER|SUBJECT|CIPHER) on maxscale side

MaxScale now enforces the REQUIRE (X509|ISSUER|SUBJECT|CIPHER) clauses on user definitions. Please see the server [tls\_options](https://app.gitbook.com/s/SsmexDFPv2xG2OTyO5yV/reference/sql-statements/account-management-sql-statements/create-user#tls-options) documentation for more information.

### [MXS-5180](https://jira.mariadb.org/browse/MXS-5180) Add role support to monitors and services

Monitors and service will activate the configured role when logging in. See [monitor](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/reference/maxscale-monitors/common-monitor-parameters#role) and [service](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/maxscale-management/deployment/installation-and-configuration/maxscale-configuration-guide#role) settings for more information.

### [MXS-5177](https://jira.mariadb.org/browse/MXS-5177) Introduce a new core\_file variable in MaxScale

By default, MaxScale no longer generates a core file when it crashes. Please see [core\_file](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/maxscale-management/deployment/installation-and-configuration/maxscale-configuration-guide#core_file) for more information.

### [MXS-5170](https://jira.mariadb.org/browse/MXS-5170) Add setting to control servers participating in cooperative monitoring

[servers\_no\_cooperative\_monitoring\_locks](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/reference/maxscale-monitors/mariadb-monitor#servers_no_cooperative_monitoring_locks) excludes listed servers from cooperative monitoring.

### [MXS-5149](https://jira.mariadb.org/browse/MXS-5149) Include actual line content in parse error message

When configuration file parsing fails in an early phase, the actual offending line will now be logged in the error message to make it easier to pinpoint the problem.

### [MXS-5145](https://jira.mariadb.org/browse/MXS-5145) Clarify log messages regarding lost server locks

### [MXS-5130](https://jira.mariadb.org/browse/MXS-5130) Support for PARSEC auth plugin from MDEV-32618

MaxScale now supports [PARSEC](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/reference/maxscale-authenticators/maxscale-parsec-authenticator) authentication.

### [MXS-5015](https://jira.mariadb.org/browse/MXS-5015) Separate read-write/read-only and master/slave

In the output of `maxctrl list server`, the state of a server and *reason* for the state are now separated. The state of a server is shown as `Read`, `Write`, `Up` or `Down`, possibly augmented with `Maintenance` or `Draining`|`Drained`, while the *reason* for the state is shown in the next column. For instance, in a Primary/Replica cluster, the reason for the state `Read` may be `Primary, read_only`, indicating that although the server is the primary, it has `read_only` turned on, so it cannot be used for writing.

### [MXS-5013](https://jira.mariadb.org/browse/MXS-5013) Reset router diagnostics statistics

Using maxctrl, it is now possible to clear both server and service statistics.

```
$ maxctrl clear statistics MyService
$ maxctrl clear statistics Server1
```

### [MXS-4951](https://jira.mariadb.org/browse/MXS-4951) Support server side ephemeral certificates

MaxScale can connect to a MariaDB Server that is using a self-signed certificate and verify the certificate. See [TLS/SSL encryption](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/maxscale-management/deployment/installation-and-configuration/maxscale-configuration-guide#tlsssl-encryption) for more information.

### [MXS-4950](https://jira.mariadb.org/browse/MXS-4950) Support client side ephemeral certificates

MaxScale can generate a self-signed certificate and a supporting client can verify it. See [TLS/SSL encryption](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/maxscale-management/deployment/installation-and-configuration/maxscale-configuration-guide#tlsssl-encryption) for more information.

### [MXS-4899](https://jira.mariadb.org/browse/MXS-4899) Make it possible to dump the query classifier cache to a file

Using maxctrl it is now possible to dump the content of the query classifier cache to a file. The cache can be dumped as json, as pretty formatted json and as json lines, i.e. as json objects separated by a newline.

```
$ maxctrl create qc_dump --format=json /tmp
/tmp/qc_dump-2024-09-23_13-00-30.json
```

### [MXS-4892](https://jira.mariadb.org/browse/MXS-4892) MaxScale should warn about inconsistencies in the configuration file

* At startup, if there are filters that are not used by any service, or servers that are not referred to by any service or monitor, a warning will be logged.

### [MXS-4754](https://jira.mariadb.org/browse/MXS-4754) Add replication information to maxctrl list servers

The `maxctrl list servers` command now also has a customizable field for replication lag information. To use it, add `replication-lag` to the list in the `--fields` option.

### [MXS-4699](https://jira.mariadb.org/browse/MXS-4699) Add global setting require\_secure\_transport

The global setting [require\_secure\_transport](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/maxscale-management/deployment/installation-and-configuration/maxscale-configuration-guide#require_secure_transport) forces encryption to be configured everywhere.

### [MXS-4636](https://jira.mariadb.org/browse/MXS-4636) Mechanism for throttling of write queries based on replica lag

A new feature in the readwritesplit router that synchronizes committed transactions on one or more replicas by waiting for the transaction to be replicated. It has two modes of operation: the `soft` mode synchronizes the transactions but proceeds normally if a synchronization timeout occurs and the `hard` mode which will close the client session if synchronization times out. The `sync_transaction_max_lag` setting can be used to adjust when the throttling takes place and `sync_transaction_timeout` controls the maximum amount of lag that the client applications will experience.

This feature can be used to limit the amount of replication lag that the cluster will see. It also provides a way to have fully synchronous replication with MariaDB with stronger durability guarantees than is possible with semi-synchronous replication.

### [MXS-4371](https://jira.mariadb.org/browse/MXS-4371) Improve REST-API Access Control

The MaxScale GUI and REST-API now use role based access control to restrict the operations that users can do. The `admin` and `basic` roles both retain their old behavior of the former being allowed to do anything and the latter being only able to perform read-only operations. The new `editor` role has the ability to also modify objects but it lacks the ability to create, modify or delete users and roles. The new `sql` role is only allowed to access the query API and the Workspace in the GUI.

User-defined roles can also be added with the `maxctrl create role` command. The permissions that the roles have are `admin` for creating users, `edit` for creating, modifying and destroying objects, `view` for viewing information about objects and MaxScale itself and `sql` for accessing the SQL query API.

### [MXS-4137](https://jira.mariadb.org/browse/MXS-4137) Run SQL commands on primary and replica whenever status changes

Run custom SQL on a server when it gains a primary or replica role. See [here](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/reference/maxscale-monitors/common-monitor-parameters#primary_state_sql) and [here](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/reference/maxscale-monitors/common-monitor-parameters#replica_state_sql) for more information.

### [MXS-4102](https://jira.mariadb.org/browse/MXS-4102) Support for passphrase protected certificate keys

It is now possible to use passphrase protected certificate keys. Please see [ssl\_passphrase](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/maxscale-management/deployment/installation-and-configuration/maxscale-configuration-guide#ssl_passphrase) and [admin\_ssl\_passphrase](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/maxscale-management/deployment/installation-and-configuration/maxscale-configuration-guide#admin_ssl_passphrase) for more information.

### MaxGUI

Numerous additions have been added and improvements made to MaxGUI. The most notable ones are listed here:

* [MXS-5421](https://jira.mariadb.org/browse/MXS-5421) Highlight changed parameters
* [MXS-5204](https://jira.mariadb.org/browse/MXS-5204) Query Editor: Add UI for creating and altering users
* [MXS-4641](https://jira.mariadb.org/browse/MXS-4641) Backup operations UI

## Bug fixes

## Known Issues and Limitations

There are some limitations and known issues within this version of MaxScale. For more information, please refer to the [Limitations](https://app.gitbook.com/s/0pSbu5DcMSW4KwAkUcmX/maxscale-management/mariadb-maxscale-limitations-guide) document.

## Packaging

RPM and Debian packages are provided for the supported Linux distributions.

Packages can be downloaded [here](https://mariadb.com/downloads/#mariadb_platform-mariadb_maxscale).

<sub>*This page is: Copyright © 2025 MariaDB. All rights reserved.*</sub>

{% @marketo/form formid="4316" formId="4316" %}