Releases: bytebase/bytebase
Release 3.17.0
🔔 Notable Changes
-
Unified Plan lifecycle view — the Plan detail page shows the full lifecycle of a database change, giving developers one place to follow a change from draft to deployment.
- The three phases of a database change — change, review, deploy — are shown in sections, allowing developers to edit change, view approval result, and execute deployment in this single page.
- Issue page is now dedicated primarily for review and approval. Developers will need to go to the plan page to edit changes and create a rollout when needed.
-
API breaking changes — Worksheet API moves to project scope (
/v1/projects/{id}/worksheets),ListDatabasesnow requires workspace ID (/v1/workspaces/{id}/databases),branding_logomoves from workspace profile setting to workspace message,GRANT_REQUESTissue type renamed toROLE_GRANT,UpdateSubscriptionAPI deprecated in favor ofUploadLicense, and classification description and level description fields removed with level type changed from string to number. See Change Details. -
CEL filter syntax change — Substring-search filters now use
contains()instead ofmatches()across plan, database, instance, project, group, user, service account, workload identity, query history, access grant, and database metadata table filters. See Change Details. -
Read-only data source consolidation — Each instance now allows at most one read-only data source. If more than one is configured, only the first is kept after migration; extra read-only data sources are removed.
-
Remove Pro plan 20-user seat cap — Pro plan no longer has a user limit.
-
Terraform provider — Updated for 3.17.0 API breaking changes. Supports get, create, update, and list identity providers. See Migration Guide.
🚀 Features
-
High Availability (HA) — Support licensed multi-replica deployments backed by a shared external PostgreSQL metadata database. Active replicas are tracked via heartbeats, and background runners coordinate safely across replicas.
-
Page Agent — Add an in-app AI assistant with tool-calling, threaded resumable conversations, DOM-aware autocomplete, and token usage tracking.
-
Issue Approved webhook event — Support a new webhook event type for issue approval, with redesigned Slack message format.
-
MCP
query_databasetool — Add a new MCP tool for executing SQL queries against managed databases with automatic database resolution. -
CosmosDB — Support local emulator connection and dynamic data masking for all 13 query feature areas.
🎄 Enhancements
-
Support executing stored procedures (
CALL/EXEC) in SQL Editor by classifying stored procedure execution as DML. -
Support issue type filter in advanced search (Database Change, Role Grant, Database Export, Access Grant).
-
Replace data classification file upload with an inline JSON editor and enhance the data classification editor.
-
Support masking exemption by classification level, and redesign masking exemption list page.
-
Redesign data export creation UI.
-
Migrate the frontend from Vue to React across all major pages including settings, projects, databases, instances, plans, issues, and audit logs.
-
Upgrade SQL parsing engine for PostgreSQL, MySQL, MongoDB, and CosmosDB from ANTLR to omni parser, improving SQL syntax coverage, consistency across SQL review / schema diff / auto-completion, and error message quality.
-
Add configurable
--timeoutflag forbytebase-actionfor large SQL checks. -
Expose
--enable-json-loggingflag in the Helm chart for structured log output.
🐞 Bug Fixes
-
Fix false schema diff noise caused by PostgreSQL trigger ordering and CRLF / whitespace normalization.
-
Fix SQL editor metadata sync retry flood.
-
Fix OAuth discovery to return usable URLs in self-hosted mode.
-
Fix stale debounced query reverts in advanced search.
-
Fix gh-ost directives in migration-based GitOps workflow.
-
PostgreSQL — Fix CRLF line endings causing query truncation in SQL splitter, schema load failure by excluding aggregates from function sync, array subscript handling in column reference normalization, whitespace between LIMIT and FOR UPDATE clause, and nested SELECTs in wrapper statements and CTEs for SQL review.
-
MySQL — Fix unqualified SET columns in prior backup for UPDATE JOIN, missing
multiStatementsparam in IAM auth DSN, and role sync for anonymous users. -
TiDB — Remove non-transaction statement handling.
-
Oracle — Strip trailing null bytes from schema definitions.
📃 Change Details
API Breaking Changes
1. Worksheet API moves to project scope:
| Method | Before | After |
|---|---|---|
| List | /v1/worksheets |
/v1/{parent=projects/*}/worksheets |
| Get | /v1/{name=worksheets/*} |
/v1/{name=projects/*/worksheets/*} |
| Create | /v1/worksheets |
/v1/{parent=projects/*}/worksheets |
| Update | /v1/{worksheet.name=worksheets/*} |
/v1/{worksheet.name=projects/*/worksheets/*} |
| Delete | /v1/{name=worksheets/*} |
/v1/{name=projects/*/worksheets/*} |
2. APIs that no longer accept workspaces/- (must use workspaces/{id}):
| Service | Affected Operations |
|---|---|
| DatabaseService | ListDatabases |
3. Other breaking changes:
| Change | Affected Routes | Details |
|---|---|---|
| Branding logo | GET/PATCH /v1/workspaces/{id} |
branding_logo removed from workspace profile setting; use logo field on workspace message |
| Issue type enum | POST /v1/{parent=projects/*}/issues, GET /v1/{parent=projects/*}/issues, POST /v1/{parent=projects/*}/issues:search |
GRANT_REQUEST renamed to ROLE_GRANT |
| Subscription API | PATCH /v1/subscription |
Deprecated; use PATCH /v1/subscription/license (UploadLicense) |
| Data source ID | POST /v1/{name=instances/*/databases/*}:query, POST /v1/{name=instances/*/databases/*}:export |
data_source_id auto-resolved server-side; at most one read-only data source per instance (extra removed during migration) |
| Classification level | GET/PATCH /v1/settings/{name}, POST /v1/queryHistories:search |
Level type changed from string to int; description field removed |
CEL Filter Syntax Change
Substring-search CEL filters now use contains() instead of matches(). Existing clients that send filters such as title.matches("..."), name.matches("..."), resource_id.matches("..."), email.matches("..."), host.matches("..."), port.matches("..."), statement.matches("..."), query.matches("..."), or table.matches("...") must switch to the corresponding contains() form.
This applies to plan, database, instance, project, group, user, service account, workload identity, query history, access grant, and database metadata table filters.
Before upgrading: 1) Back up the metadata — in-place downgrade is not supported. 2) Do not run multiple containers on the same data directory. 3) Terraform users: upgrade Bytebase server first, then apply the new Terraform config.
Release 3.16.1
🎄 Enhancements
-
Change issue approval status label from "Done" to "Approved" for clarity.
-
Add fast-follow refresh mode so rollout status updates more quickly after user actions.
-
CosmosDB — Support more query syntax in SQL editor.
🐞 Bug Fixes
-
Fix internal error after login caused by InputOtp null check regression.
-
Fix popover dismissing when interacting with label selector during plan/issue creation.
-
Fix invalid issue type filter in Export Center.
-
Fix webhook detail page broken by UUID resource_id migration.
-
Harden 3.16 upgrade migration scripts to be idempotent and handle edge cases.
-
PostgreSQL — Fix schema dump incorrectly including pg_bitmapindex system schema.
Before upgrading: 1) Back up the metadata — in-place downgrade is not supported. 2) Do not run multiple containers on the same data directory. 3) Terraform users: upgrade Bytebase server first, then apply the new Terraform config.
Release 3.16.0
🔔 Notable Changes
-
Workspace API breaking changes - Policy API:
/v1/policies→/v1/workspaces/{id}/policies. All workspace-scoped APIs now require explicit workspace ID instead of/v1/workspaces/-. See change details at the bottom. -
User API breaking changes - Decouple identity types and migrate Service Accounts and Workload Identities into separate data models. The unified User API no longer handles these identity types;
User.user_typeandUserTypeenum are removed. See change details at the bottom. -
Legacy service account email migration - Legacy emails with
{name}@service.bytebase.comand{name}@{project}.service.bytebase.comare auto-migrated. Use the dedicated Service Account and Workload Identity services introduced in 3.15.0. -
Resource ID migration - Several API resource IDs migrate from sequential integers to opaque UUID strings (revision, changelog, issue comment, project webhook). Previously bookmarked integer IDs will no longer work. See change details at the bottom.
-
Non-release database migrations now run in parallel; only release-based migrations remain sequential per database.
-
Terraform provider 3.16.1 required - Covers workspace policy API changes, UserType removal, resource ID migration, and JIT approval flow. See Migration Guide
🚀 Features
-
Just-In-Time (JIT) Data Access - Users without database access can request approval to execute a specific read-only query. Enable JIT in project settings and configure approval rules with the new
REQUEST_ACCESSsource type. Once approved, the grant is scoped to that query and auto-expires after the configured duration. -
Add GitOps landing page with guided setup for workload identity selection and CI/CD YAML generation.
-
Elasticsearch & MongoDB - Support dynamic data masking. Masking is configured per-collection through the Catalog using
objectSchema(not the column-based configuration used by relational databases). Global masking rules and masking exemption are not supported for document databases at this time.
🎄 Enhancements
-
Redesign issue list with streamlined layout and improved information density. Support sorting by created/updated time, all approval status options (Checking, Pending, Approved, Rejected, Skipped) in advanced search filter, and more prominent approval status in issue detail.
-
Standardize timestamp display to relative time with absolute time tooltip.
-
Redesign Create Instance page as a full-page layout.
-
Support access-token authentication for Bytebase Action, enabling CI/CD pipelines to authenticate to Bytebase via workload identity federation.
-
Add pre-execution drift validation that detects schema changes before executing stale tasks.
-
Support copying the entire query result in SQL Editor.
-
Update default AI model placeholders to current-generation models (GPT-4o, Gemini 2.5 Flash, Claude Sonnet 4).
-
MongoDB & Elasticsearch - Preview query results in document view or table view. Live syntax checking and auto-complete in SQL Editor.
-
BigQuery & Spanner - Support Workload Identity Federation credentials for non-GCP hosted Bytebase.
-
Oracle - Add ROW STORE COMPRESS syntax support.
-
PostgreSQL - Support
search_pathresolution via current user in schema -
PostgreSQL & Oracle - Improve schema sync accuracy.
🐞 Bug Fixes
-
Fix issues incorrectly moved to DONE by migration 3.14/0034.
-
Skip databases without environments during task creation.
-
Classify CALL/EXEC stored procedure statements as DML to allow execution in SQL Editor.
-
MariaDB - Fix SQL review plan check not blocking rollout on ERROR-level violations.
-
MSSQL - Fix error messages missing line number when rolling out multiple statements.
-
Oracle - Fix UTF-8 encoding issues in comment fields during schema sync.
-
TiDB - Fix DROP INDEX IF EXISTS walk-through, CHECK_CONSTRAINTS query compatibility for TiDB < 7.4.0, and SQL export resource extraction.
3.15.1...3.16.0
Warning 1): Bytebase does not support in-place downgrade. Make sure to back up your metadata before upgrading. 2) Never run multiple containers on the same data directory. Stop and remove the old one first to avoid corruption.
📃 Change Details
Workspace API Breaking Changes
1. Policy API path changes (workspace-level policies only):
| Method | Before | After |
|---|---|---|
| Get | /v1/{name=policies/*} |
/v1/{name=workspaces/*/policies/*} |
| List | /v1/policies |
/v1/{parent=workspaces/*}/policies |
| Create | /v1/policies |
/v1/{parent=workspaces/*}/policies |
| Update | /v1/{policy.name=policies/*} |
/v1/{policy.name=workspaces/*/policies/*} |
| Delete | /v1/{name=policies/*} |
/v1/{name=workspaces/*/policies/*} |
Environment, instance, and database-level policy bindings are unchanged.
2. APIs that no longer accept workspaces/- (must use workspaces/{id}):
| Service | Affected Operations |
|---|---|
| ServiceAccountService | CreateServiceAccount, ListServiceAccounts |
| WorkloadIdentityService | CreateWorkloadIdentity, ListWorkloadIdentities |
| DatabaseService | ListDatabases |
| WorkspaceService | GetIamPolicy, SetIamPolicy |
User API Breaking Changes
| Change | Details |
|---|---|
User.user_type field removed |
Reserved field 5. Use dedicated Service Account / Workload Identity services. |
UserType enum removed |
Deleted from user_service.proto. |
WorkloadIdentityConfig moved |
From User message to workload_identity_service.proto. |
ActuatorInfo.user_stats removed |
Replaced with int32 activated_user_count. |
CreateUser behavior |
Only creates end users. Service accounts / workload identities must use their dedicated services. |
ListUsers behavior |
Only returns end users. |
Resource ID Migration
Resource IDs in the following API resource names change from sequential integers to UUID strings:
| Resource | Resource Name Pattern | ID Format Change |
|---|---|---|
| Revision | instances/{id}/databases/{db}/revisions/{id} |
integer → UUID |
| Changelog | instances/{id}/databases/{db}/changelogs/{id} |
integer → UUID |
| Issue Comment | projects/{id}/issues/{uid}/issueComments/{id} |
integer → UUID |
| Project Webhook | projects/{id}/webhooks/{id} |
integer → UUID |
Existing records receive randomly generated UUIDs during migration. Any previously bookmarked or cached integer IDs will stop working.
Release 3.15.1
🎄 Enhancements
-
Add SQL Editor Read User role for read-only SQL Editor access (SELECT, EXPLAIN, INFO — no DDL/DML).
-
Enforce
bb.issues.updatepermission requirement to edit issues, even for issue creators.
🐞 Bug Fixes
-
Fix DDL/DML error modal not showing.
-
Fix REST API
GetSchemaStringendpoint returning parse error. -
Fix SQL Editor double-click-drag word selection in reverse direction.
-
PostgreSQL — Fix schema dump losing overloaded functions and missing quotes for CamelCase columns in index/constraint DDL.
Warning 1): Bytebase does not support in-place downgrade. Make sure to back up your metadata before upgrading. 2) Never run multiple containers on the same data directory. Stop and remove the old one first to avoid corruption.
Release 3.15.0
🔔 Project-level Service Accounts & Workload Identities
We introduce project-level Service Accounts and Workload Identities in addition to the existing workspace-level scope. This enables project-scoped machine identities to follow least privilege and reduce automation blast radius, while clearly separating machine identities from users and aligning them with the resource hierarchy.
-
UI & scope changes
- Workspace Members page now has separate tabs for Users&Groups, Service Accounts, and Workload Identities.
- Service accounts and workload identities can now be created at both workspace and project levels, governed by their respective IAM policies.
- Project-level identities are scoped to a single project to enable isolated automation.
- The account selector for role assignment now supports users, groups, service accounts, and workload identities. Service accounts and workload identities require entering the full email address.
-
Breaking changes (API / Terraform users)
- Machine identities are managed via dedicated APIs (
ServiceAccountService,WorkloadIdentityService) instead of the User API. - IAM member prefixes updated:
user:{email}→serviceAccount:{email}/workloadIdentity:{email} - Workspace-level Service Account and Workload Identity APIs now require explicit parent
workspaces/-instead of an empty string.
Affected APIs:CreateServiceAccount,ListServiceAccounts,CreateWorkloadIdentity,ListWorkloadIdentities.
Endpoint change:
/v1/serviceAccounts→/v1/workspaces/-/serviceAccounts - Terraform users must update IAM member prefixes and use the new service account/workload identity resources. Latest provider documentation
- Machine identities are managed via dedicated APIs (
🔔 Other Notable Changes
-
DDL and DML execution control update
- Environment condition is added to
bb.sql.ddlandbb.sql.dmlrole grants as a replacement for thedisallow_ddlanddisallow_dmlenvironment policy. The environment condition is only available when granting roles at the project level for a specific project. Roles granted at the workspace level (which apply to all projects) do not have the environment condition option. - Each project-level IAM Policy (i.e. role grant) has a single environment condition that applies to both
bb.sql.ddlandbb.sql.dmlpermissions together. This means you cannot allow DDL but disallow DML (or vice versa) within the same role. If you need different environment restrictions for DDL and DML, the recommended practice is to create 2 separate roles — one withbb.sql.ddland one withbb.sql.dml— each with its own environment condition. disallow_ddlanddisallow_dmlare automatically migrated to be reflected in role grants in an OR manner — if for a specific environment, eitherdisallow_ddlordisallow_dmlis set to OFF, this environment condition will be configured for the role withbb.sql.ddlorbb.sql.dmlpermission. This could lead to breaking changes to DDL and DML control if yourdisallow_ddlanddisallow_dmlsettings differ across environment policies. Please review after upgrading and follow the recommended practice to configure your role grants.- Add
bb.sql.ddlandbb.sql.dmlpermissions to the SQL Editor User and Project Owner role. - For Terraform users, update the environment policy and your role grants accordingly. Latest provider documentation
- Environment condition is added to
-
SQL Editor settings consolidation & policy updates
- Add a dedicated SQL Editor section under Workspace Settings > General, consolidating data export, data copying, admin data source access, max result size, max result rows, and max query time.
- Max result rows can also be configured at the project level.
DataSourceQueryPolicyis merged intoQueryDataPolicyand deprecated (auto-migrated).- For Terraform users, update
bytebase_policyconfiguration. Latest provider documentation
-
Role & permission adjustments
- Add
bb.taskRuns.createpermission to the Project Owner role. - Remove
bb.rollouts.createpermission from the Project Developer role (use Project Releaser or Project Owner). - Allow managing project IAM policy without the Project Owner role.
- Add
-
Online migration configuration change
- Move gh-ost configuration from Plan spec to SQL directive in sheet content (
-- gh-ost = { ... }). - Remove
enable_ghostandghost_flagsfromChangeDatabaseConfigin the Plan API.
- Move gh-ost configuration from Plan spec to SQL directive in sheet content (
-
Execution & validation improvements
- Skip DML dry-run checks when DDL statements are present to reduce false positives. Primarily applied to SQL Review rule
Validate the executability of DML statements.
- Skip DML dry-run checks when DDL statements are present to reduce false positives. Primarily applied to SQL Review rule
-
Cleanup & removals
- Remove the Archived page (archived projects and instances now appear directly in the dashboard).
- Remove
auto_enable_backupandskip_backup_errorsfrom project settings. - Deprecate the legacy issue page and route.
🚀 Features
-
MongoDB
- Use native driver for queries by default, with fallback to
mongosh. - SQL Editor now supports auto-complete, current statement highlighting, and syntax checking.
- Support statement-type access control in SQL Editor, allowing administrators to control Read and Write permissions.
- Use native driver for queries by default, with fallback to
-
Elasticsearch
- Support statement-type access control in SQL Editor, allowing administrators to control Read and Write permissions.
🎄 Enhancements
- SQL Editor query results support multi-select via Cmd/Ctrl + Click for rows and columns. Copied data now includes column names.
- Improve the SQL Editor database connection panel layout.
- Normalize Unicode emails to prevent creating accounts with visually identical but technically different addresses.
🐞 Bug Fixes
- Fix access token refresh on SQL Editor LSP websocket reconnection.
- Fix incorrect Learn More link for online migration.
- Google Cloud SQL - Fix IAM authentication while creating instances in Bytebase Cloud.
- PostgreSQL - Support Common Table Expressions (CTE) in backup statement execution.
Warning 1): Bytebase does not support in-place downgrade. Make sure to back up your metadata before upgrading. 2) Never run multiple containers on the same data directory. Stop and remove the old one first to avoid corruption.
Release 3.14.1
🎄 Enhancements
- Improve result masking performance for queries spanning multiple databases, and enhance masking coverage.
- Show rollout link whenever plan has a rollout, regardless of issue status.
- Google Cloud SQL — Support IAM authentication for connections.
- Azure SCIM — Enhance SCIM PATCH API and fix SCIM sync issues.
🐞 Bug Fixes
- Fix database group SQL checks bypassed issue.
- Fix export data issues: add task actions (Run/Retry, Skip, Cancel) and fix skip/download functionality.
- Fix page table showing errors from corrupted localStorage page size.
- Fix minor issues for IM integration: direct messaging not working for new installation and settings page not showing configured data.
- Fix missing users and approvers in some webhook notifications.
- Fix nested transaction patterns that could cause deadlocks under high concurrency.
Warning 1): Bytebase does not support in-place downgrade. Make sure to back up your metadata before upgrading. 2) Never run multiple containers on the same data directory. Stop and remove the old one first to avoid corruption.
Release 3.14.0
🔔 Notable Changes
-
Redesign the database CI/CD workflow to align with industry practices (GitHub, GitLab) by clearly separating CI (review) and CD (deployment) phases:
- Issue page now displays plan changes directly - no more context switching between tabs.
- Rollout is now a standalone deployment page, clearly separating review from execution.
- Rollout UI now supports release-based tasks — showing per-file execution status, command duration, and release info in task items.
- Rollout creation: previously rollout is created at the same time when issue is created, but now it's creation is decoupled from issue creation, with 2 creation modes: 1) automatic creation, if issue is approved AND SQL review check pass; 2) user can manually create in other cases (most common case, issue approved BUT review not passed, and there should be an action button).
- As a result of mode 2, project releaser might need to create rollout manually before executing rollout, so
bb.rollouts.createpermission is added to project releaser role. All custom roles for rollout initiation are advised to be assignedbb.rollouts.createpermission. This permission only controls who can create a rollout; it does not bypass approval requirements or task execution.
-
Update Project Webhook events. Please review the documentation for the current list of supported events to ensure your listeners remain compatible.
-
Improve permission guards and access control:
- Stop hiding UI elements when users lack permissions and show a no permission alert instead. Allow users with
bb.issues.createpermission to request Project roles directly from the UI. - Allow Project Owners to disable the self-service role request workflow in Project Settings.
- Introduce more granular permission management:
- Add new policy permissions:
bb.policies.getMaskingRulePolicybb.policies.updateMaskingRulePolicybb.policies.createMaskingRulePolicybb.policies.deleteMaskingRulePolicybb.policies.getMaskingExemptionPolicybb.policies.updateMaskingExemptionPolicybb.policies.createMaskingExemptionPolicybb.policies.deleteMaskingExemptionPolicy
- Add new settings permissions:
bb.settings.getEnvironmentbb.settings.setEnvironmentbb.settings.getWorkspaceProfilebb.settings.setWorkspaceProfile
- Permission assignments are updated accordingly:
- The Workspace Admin and DBA receive all these new permissions.
- The Project Owner receives the new policy permissions.
- The Workspace Member receives
bb.settings.getEnvironmentandbb.settings.getWorkspaceProfile.
- Add new policy permissions:
- Tighten Workspace Members permissions:
- Revoke
bb.settings.get,bb.settings.list,bb.projects.list. - If Workspace Members should not access the user list, create a custom role and revoke
bb.users.listandbb.users.get.
- Revoke
- Stop hiding UI elements when users lack permissions and show a no permission alert instead. Allow users with
-
Redesign the Database Changelog and Revision pages.
-
Remove Schema Drift Detection feature:
- Remove
driftedfield fromDatabase messageinv1/database_service.proto. - Remove
driftedfilter option fromListDatabasesAPI (previously supporteddrifted == truefilter). - Remove
dump_versionfield fromChangelogPayloadin store proto.
- Remove
-
Update core APIs
CreateSheet,CreatePlan,CreateRollout, andCreateRelease, please refer to the latest API documentation for updated request/response definitions. -
Remove
auto_resolve_issueandallow_modify_statementfrom Project Settings. -
Remove
maximum_connectionsfrom Instance Settings and useParallel tasks per rolloutin Project Settings instead. -
Unify
TRUNCATE_TABLEandTRUNCATEinto a singleTRUNCATEstatement type for Custom Approval CEL expressions. -
Update Terraform provider:
- Remove
allow_modify_statementandauto_resolve_issuefrom the project resource. - Remove
auto_resolve_issuefrom the workspace_profile setting resource. - Remove
maximum_connectionsfrom the instance resource. - The
notification_typesin the project webhook are changed toISSUE_CREATED,ISSUE_APPROVAL_REQUESTED,ISSUE_SENT_BACK,PIPELINE_FAILEDandPIPELINE_COMPLETED. - Support configure
allow_request_role,data_classification_config_id,enforce_sql_review,force_issue_labels,issue_labels,labels,require_issue_approval,require_plan_check_no_errorfor the project resource.
- Remove
-
Releases are now identified by
release_id(e.g.,my-release-RC00) with automatic train/RC iteration numbering. Thetitle,digestfields are removed from the Release API, and UpdateRelease returnsUNIMPLEMENTED. For Terraform, updatebytebase_releaseresource if usingtitleordigestfields.
🚀 Features
- Add refresh token support (previously only access tokens were supported).
- Allow configuring Access token duration and Refresh token duration (previously the sign-in frequency setting).
- Allow setting
No approval requiredin approval rules when configured conditions are met. - Support Workload Identity with GitLab.
🎄 Enhancements
- Add list sorting for projects, instances, and databases.
- Grant Exemption supports CEL expressions and includes a database selector.
- PostgreSQL - Support ENUM value additions via
ALTER TYPE ... ADD VALUEin schema sync. - MySQL - Prettify generated DDL statements.
🐞 Bug Fixes
- Fix AI setting cache modification issues.
- PostgreSQL – Fix cyclic foreign key dependency handling in schema diff.
- TiDB – Fix DML dry run handling for BATCH syntax.
- PostgreSQL – Fix using identifiers as SELECT target field aliases.
- Oracle – Fix SQL Review incorrectly flagging GRANT / REVOKE as reserved keywords.
Warning 1): Bytebase does not support in-place downgrade. Make sure to back up your metadata before upgrading. 2) Never run multiple containers on the same data directory. Stop and remove the old one first to avoid corruption.
Release 3.13.1
🎄 Enhancements
- Update SQL review template configuration.
🐞 Bug Fixes
- Fix issue label selector missing in new CI/CD layout.
- Fix rollout date filter not working.
- Fix SQL Editor horizontal scroll shortcut.
- Fix SQL review showing incorrect line numbers for multi-statement SQL.
Warning 1): Bytebase does not support in-place downgrade. Make sure to back up your metadata before upgrading. 2) Never run multiple containers on the same data directory. Stop and remove the old one first to avoid corruption.
Release 3.13.0
🔔 Notable Changes
- Consolidate DDL and DML changes so users no longer need to select them explicitly when initiating New Plan or configuring approval flow.
- Simplify approval workflows:
- Approval flows are defined directly using CEL expressions, without intermediate risk definitions.
- Risk level is automatically evaluated using a standardized assessment framework.
risk.levelis an optional CEL factor for CHANGE_DATABASE approval flows.- For non-Terraform, existing approval flows are automatically migrated.
- For Terraform, approval flows are defined via bytebase_setting (settings/WORKSPACE_APPROVAL) using approval_flow.rules.flow, and risk resources are removed.(e.g. approval_flow.tf)
- Update SQL review configuration for Terraform: (e.g. sql_review.tf)
- SQL review rules use typed payload fields (
number_payload,string_payload,string_array_payload,naming_payload, etc.). - Generic payload and comment fields are removed.
- Rule level enums migrate from
SQLReviewRuleLevel_WARNING/ERRORtoSQLReviewRule_WARNING/ERROR.
- SQL review rules use typed payload fields (
- Move rollout policy checkers from environment to project level: Require issue approval and Plan check enforcement. Project settings are checked if any checker is previously used via automatic migration.
- Migrate user identifiers: User references change from
users/{id}tousers/{email}in APIs and storage. Audit logs store user emails directly. - Rename Masking Exception to Masking Exemption:
- APIs rename
MaskingExceptiontoMaskingExemption. - The action field is removed.
memberis replaced with amemberslist.- For Terraform,
masking_exception_policyis renamed tomasking_exemption_policy.
- APIs rename
- Disallow Copy Policy now applies to Admin and DBA roles (previously exempted).
- Refine database group permissions:
- Roles with
bb.projects.getgainbb.databaseGroups.list/get. - Roles with
bb.projects.updategainbb.databaseGroups.create/update/delete. - For Terraform, please update the permissions of custom roles accordingly.
- Roles with
- Update batch task APIs: The
reasonfield is removed fromBatchRunTasksandBatchCancelTaskRuns.reasonis supported only for skip operations. - Remove Schema Template functionality.
🚀 Features
- Support MCP integration.
- Add Workload Identity as a dedicated account type for OIDC-based authentication, with GitHub Actions support.
- Support direct messages for Microsoft Teams.
🎄 Enhancements
- Improve the rollout page with a timeline view, auto-expanded task details, and collapsible task run logs with auto-refresh.
- Allow filtering in SQL Editor results to quickly locate rows.
- Allow selecting a database group to query from in the SQL Editor.
- Snowflake - Support passphrase-protected private keys.
- PostgreSQL - Add event trigger sync and SDL support.
- Trino - Support TLS/SSL.
- Doris - Improve SQL parser compatibility.
Warning 1): Bytebase does not support in-place downgrade. Make sure to back up your metadata before upgrading. 2) Never run multiple containers on the same data directory. Stop and remove the old one first to avoid corruption.
Release 3.12.2
🎄 Enhancements
- Enhance database and query permission checks.
- Improve selector performance with lazy loading for large workspaces.
- SQL Server - Add visualized EXPLAIN support in SQL Editor.
- Doris - Improve syntax compatibility.
🐞 Bug Fixes
- Prevent DML statements from being incorrectly wrapped in CTEs in SQL Editor.
- Fix popup handling for database change statements in SQL Editor.
- Improve and isolate SQL Editor state management across browser tabs.
- Format Cassandra, Spanner, and ClickHouse result data instead of showing raw protobuf.
Warning 1): Bytebase does not support in-place downgrade. Make sure to back up your metadata before upgrading. 2) Never run multiple containers on the same data directory. Stop and remove the old one first to avoid corruption.