From eaac8daa0b710d6bf4f565de0925d6c16b47caaf Mon Sep 17 00:00:00 2001 From: qiancai Date: Wed, 2 Sep 2026 15:53:31 +0800 Subject: [PATCH 1/7] Update release-8.5.8.md --- releases/release-8.5.8.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/releases/release-8.5.8.md b/releases/release-8.5.8.md index 5e05241eaa091..d4326e0d1c127 100644 --- a/releases/release-8.5.8.md +++ b/releases/release-8.5.8.md @@ -21,6 +21,7 @@ Quick access: [Quick start](https://docs.pingcap.com/tidb/v8.5/quick-start-with- + TiCDC + - Upgrade TiDB, `golang.org/x/crypto`, AWS SDK, and other dependencies to mitigate known vulnerabilities in TiCDC [#12775](https://github.com/pingcap/tiflow/issues/12775) [#5827](https://github.com/pingcap/ticdc/issues/5827) [#5693](https://github.com/pingcap/ticdc/issues/5693) [#5445](https://github.com/pingcap/ticdc/issues/5445) @[asddongmen](https://github.com/asddongmen) @[wk989898](https://github.com/wk989898) - Improve TiCDC changefeed scan performance when delete events are ignored, reducing unnecessary DML decoding during historical catch-up for delete-heavy workloads [#5430](https://github.com/pingcap/ticdc/issues/5430) @[asddongmen](https://github.com/asddongmen) - Improve TiCDC event service stability and throughput under memory pressure by introducing an adaptive scan window algorithm, reducing dispatcher starvation and reset events in DDL or sync point scenarios [#4172](https://github.com/pingcap/ticdc/issues/4172) @[asddongmen](https://github.com/asddongmen) - Improve TiCDC Kafka Sink verification to make it more lightweight and complete by avoiding startup-only work during verification, checking encoder dependencies such as Schema Registry for existing topics, and validating `replication-factor` only when TiCDC needs to create a topic [#5618](https://github.com/pingcap/ticdc/issues/5618) [#5720](https://github.com/pingcap/ticdc/issues/5720) @[3AceShowHand](https://github.com/3AceShowHand) @@ -51,6 +52,7 @@ Quick access: [Quick start](https://docs.pingcap.com/tidb/v8.5/quick-start-with- + TiKV + - Fix potential vulnerabilities in TiKV by upgrading Rust dependencies [#19931](https://github.com/tikv/tikv/issues/19931) @[hbisheng](https://github.com/hbisheng) - Fix the issue that TiKV performs unnecessary slow-log message formatting for fast Raftstore message batches, causing additional CPU overhead [#19861](https://github.com/tikv/tikv/issues/19861) @[pingyu](https://github.com/pingyu) - Fix the issue that TiKV might panic when its coprocessor evaluates pushed-down `LIKE` expressions that involve malformed UTF-8 input or patterns, `BIT` values, or certain collations [#66597](https://github.com/pingcap/tidb/issues/66597) [#67082](https://github.com/pingcap/tidb/issues/67082) [#19811](https://github.com/tikv/tikv/issues/19811) @[jebter](https://github.com/jebter) - Fix the issue that TiKV might generate inconsistent MVCC state during external SST ingestion when ingestion races with foreground writes, which might cause a panic in transaction status checks [#19891](https://github.com/tikv/tikv/issues/19891) @[gengliqi](https://github.com/gengliqi) @@ -85,8 +87,13 @@ Quick access: [Quick start](https://docs.pingcap.com/tidb/v8.5/quick-start-with- - Fix the issue that BR log backup leaves stale GC safepoints after a log backup task is stopped, which might affect cleanup and safepoint management [#19832](https://github.com/tikv/tikv/issues/19832) @[Leavrth](https://github.com/Leavrth) - Fix the issue that BR cannot update the SST download rate limit correctly when multiple restore tasks run concurrently, which might cause one task's limit change not to take effect [#19454](https://github.com/tikv/tikv/issues/19454) @[Leavrth](https://github.com/Leavrth) + + DM + + - Fix known security vulnerabilities in DM by upgrading the OpenTelemetry and `kin-openapi` dependencies [#12637](https://github.com/pingcap/tiflow/issues/12637) @[GMHDBJD](https://github.com/GMHDBJD) + + TiCDC + - Fix the issue that the TiCDC Grafana dashboard does not display build information correctly [#5649](https://github.com/pingcap/ticdc/issues/5649) @[lidezhu](https://github.com/lidezhu) - Fix the issue that TiCDC might create duplicate dispatchers during maintainer failover, causing downstream write conflicts [#5083](https://github.com/pingcap/ticdc/issues/5083) @[hongyunyan](https://github.com/hongyunyan) - Fix the issue that TiCDC might produce inconsistent data between upstream and downstream after a Kafka controller failure [#5437](https://github.com/pingcap/ticdc/issues/5437) @[3AceShowHand](https://github.com/3AceShowHand) - Fix the issue that changefeeds might disappear after upgrading TiCDC when existing changefeed ID metadata uses the legacy `namespace` field instead of `keyspace` in JSON [#4079](https://github.com/pingcap/ticdc/issues/4079) @[wlwilliamx](https://github.com/wlwilliamx) From b9dedab4893431505ab3d5102f7b9fd825833a07 Mon Sep 17 00:00:00 2001 From: Grace Cai Date: Wed, 2 Sep 2026 15:58:57 +0800 Subject: [PATCH 2/7] Update releases/release-8.5.8.md --- releases/release-8.5.8.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/releases/release-8.5.8.md b/releases/release-8.5.8.md index d4326e0d1c127..db85c991ad3d1 100644 --- a/releases/release-8.5.8.md +++ b/releases/release-8.5.8.md @@ -89,7 +89,7 @@ Quick access: [Quick start](https://docs.pingcap.com/tidb/v8.5/quick-start-with- + DM - - Fix known security vulnerabilities in DM by upgrading the OpenTelemetry and `kin-openapi` dependencies [#12637](https://github.com/pingcap/tiflow/issues/12637) @[GMHDBJD](https://github.com/GMHDBJD) + - Fix potential vulnerabilities in DM by upgrading the OpenTelemetry and `kin-openapi` dependencies [#12637](https://github.com/pingcap/tiflow/issues/12637) @[GMHDBJD](https://github.com/GMHDBJD) + TiCDC From 3b02449a5df47f5f7c22fe546f440284c02899f2 Mon Sep 17 00:00:00 2001 From: Grace Cai Date: Wed, 2 Sep 2026 16:15:43 +0800 Subject: [PATCH 3/7] Update releases/release-8.5.8.md --- releases/release-8.5.8.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/releases/release-8.5.8.md b/releases/release-8.5.8.md index db85c991ad3d1..e24d7f148a878 100644 --- a/releases/release-8.5.8.md +++ b/releases/release-8.5.8.md @@ -21,7 +21,7 @@ Quick access: [Quick start](https://docs.pingcap.com/tidb/v8.5/quick-start-with- + TiCDC - - Upgrade TiDB, `golang.org/x/crypto`, AWS SDK, and other dependencies to mitigate known vulnerabilities in TiCDC [#12775](https://github.com/pingcap/tiflow/issues/12775) [#5827](https://github.com/pingcap/ticdc/issues/5827) [#5693](https://github.com/pingcap/ticdc/issues/5693) [#5445](https://github.com/pingcap/ticdc/issues/5445) @[asddongmen](https://github.com/asddongmen) @[wk989898](https://github.com/wk989898) + - Upgrade TiDB, `golang.org/x/crypto`, AWS SDK, and other dependencies to mitigate known security vulnerabilities in TiCDC [#12775](https://github.com/pingcap/tiflow/issues/12775) [#5827](https://github.com/pingcap/ticdc/issues/5827) [#5693](https://github.com/pingcap/ticdc/issues/5693) [#5445](https://github.com/pingcap/ticdc/issues/5445) @[asddongmen](https://github.com/asddongmen) @[wk989898](https://github.com/wk989898) - Improve TiCDC changefeed scan performance when delete events are ignored, reducing unnecessary DML decoding during historical catch-up for delete-heavy workloads [#5430](https://github.com/pingcap/ticdc/issues/5430) @[asddongmen](https://github.com/asddongmen) - Improve TiCDC event service stability and throughput under memory pressure by introducing an adaptive scan window algorithm, reducing dispatcher starvation and reset events in DDL or sync point scenarios [#4172](https://github.com/pingcap/ticdc/issues/4172) @[asddongmen](https://github.com/asddongmen) - Improve TiCDC Kafka Sink verification to make it more lightweight and complete by avoiding startup-only work during verification, checking encoder dependencies such as Schema Registry for existing topics, and validating `replication-factor` only when TiCDC needs to create a topic [#5618](https://github.com/pingcap/ticdc/issues/5618) [#5720](https://github.com/pingcap/ticdc/issues/5720) @[3AceShowHand](https://github.com/3AceShowHand) From 0dc540c068f330d77f74d8600d61a3697a352e0f Mon Sep 17 00:00:00 2001 From: Grace Cai Date: Wed, 2 Sep 2026 16:16:27 +0800 Subject: [PATCH 4/7] Update releases/release-8.5.8.md --- releases/release-8.5.8.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/releases/release-8.5.8.md b/releases/release-8.5.8.md index e24d7f148a878..9ffaa4fd4f611 100644 --- a/releases/release-8.5.8.md +++ b/releases/release-8.5.8.md @@ -52,7 +52,7 @@ Quick access: [Quick start](https://docs.pingcap.com/tidb/v8.5/quick-start-with- + TiKV - - Fix potential vulnerabilities in TiKV by upgrading Rust dependencies [#19931](https://github.com/tikv/tikv/issues/19931) @[hbisheng](https://github.com/hbisheng) + - Fix potential security vulnerabilities in TiKV by upgrading Rust dependencies [#19931](https://github.com/tikv/tikv/issues/19931) @[hbisheng](https://github.com/hbisheng) - Fix the issue that TiKV performs unnecessary slow-log message formatting for fast Raftstore message batches, causing additional CPU overhead [#19861](https://github.com/tikv/tikv/issues/19861) @[pingyu](https://github.com/pingyu) - Fix the issue that TiKV might panic when its coprocessor evaluates pushed-down `LIKE` expressions that involve malformed UTF-8 input or patterns, `BIT` values, or certain collations [#66597](https://github.com/pingcap/tidb/issues/66597) [#67082](https://github.com/pingcap/tidb/issues/67082) [#19811](https://github.com/tikv/tikv/issues/19811) @[jebter](https://github.com/jebter) - Fix the issue that TiKV might generate inconsistent MVCC state during external SST ingestion when ingestion races with foreground writes, which might cause a panic in transaction status checks [#19891](https://github.com/tikv/tikv/issues/19891) @[gengliqi](https://github.com/gengliqi) From b66bf8cfb4d14b75d56741c018820d1f9695bc41 Mon Sep 17 00:00:00 2001 From: Grace Cai Date: Wed, 2 Sep 2026 16:19:54 +0800 Subject: [PATCH 5/7] remove #5649 as confirmed by lidezhu --- releases/release-8.5.8.md | 1 - 1 file changed, 1 deletion(-) diff --git a/releases/release-8.5.8.md b/releases/release-8.5.8.md index 9ffaa4fd4f611..9c55635eb5824 100644 --- a/releases/release-8.5.8.md +++ b/releases/release-8.5.8.md @@ -93,7 +93,6 @@ Quick access: [Quick start](https://docs.pingcap.com/tidb/v8.5/quick-start-with- + TiCDC - - Fix the issue that the TiCDC Grafana dashboard does not display build information correctly [#5649](https://github.com/pingcap/ticdc/issues/5649) @[lidezhu](https://github.com/lidezhu) - Fix the issue that TiCDC might create duplicate dispatchers during maintainer failover, causing downstream write conflicts [#5083](https://github.com/pingcap/ticdc/issues/5083) @[hongyunyan](https://github.com/hongyunyan) - Fix the issue that TiCDC might produce inconsistent data between upstream and downstream after a Kafka controller failure [#5437](https://github.com/pingcap/ticdc/issues/5437) @[3AceShowHand](https://github.com/3AceShowHand) - Fix the issue that changefeeds might disappear after upgrading TiCDC when existing changefeed ID metadata uses the legacy `namespace` field instead of `keyspace` in JSON [#4079](https://github.com/pingcap/ticdc/issues/4079) @[wlwilliamx](https://github.com/wlwilliamx) From 31d8652f256199b83de6490dee7c52270dd04633 Mon Sep 17 00:00:00 2001 From: qiancai Date: Thu, 3 Sep 2026 15:22:34 +0800 Subject: [PATCH 6/7] release-8.5: reorder dependency security fixes --- releases/release-8.5.8.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/releases/release-8.5.8.md b/releases/release-8.5.8.md index 9c55635eb5824..178a60dc3ca68 100644 --- a/releases/release-8.5.8.md +++ b/releases/release-8.5.8.md @@ -21,12 +21,12 @@ Quick access: [Quick start](https://docs.pingcap.com/tidb/v8.5/quick-start-with- + TiCDC - - Upgrade TiDB, `golang.org/x/crypto`, AWS SDK, and other dependencies to mitigate known security vulnerabilities in TiCDC [#12775](https://github.com/pingcap/tiflow/issues/12775) [#5827](https://github.com/pingcap/ticdc/issues/5827) [#5693](https://github.com/pingcap/ticdc/issues/5693) [#5445](https://github.com/pingcap/ticdc/issues/5445) @[asddongmen](https://github.com/asddongmen) @[wk989898](https://github.com/wk989898) - Improve TiCDC changefeed scan performance when delete events are ignored, reducing unnecessary DML decoding during historical catch-up for delete-heavy workloads [#5430](https://github.com/pingcap/ticdc/issues/5430) @[asddongmen](https://github.com/asddongmen) - Improve TiCDC event service stability and throughput under memory pressure by introducing an adaptive scan window algorithm, reducing dispatcher starvation and reset events in DDL or sync point scenarios [#4172](https://github.com/pingcap/ticdc/issues/4172) @[asddongmen](https://github.com/asddongmen) - Improve TiCDC Kafka Sink verification to make it more lightweight and complete by avoiding startup-only work during verification, checking encoder dependencies such as Schema Registry for existing topics, and validating `replication-factor` only when TiCDC needs to create a topic [#5618](https://github.com/pingcap/ticdc/issues/5618) [#5720](https://github.com/pingcap/ticdc/issues/5720) @[3AceShowHand](https://github.com/3AceShowHand) - Reduce external storage client and connection usage for TiCDC Kafka Sinks with Claim-Check enabled by sharing a single `ClaimCheck` instance among all Encoders in the same Sink [#5719](https://github.com/pingcap/ticdc/issues/5719) @[3AceShowHand](https://github.com/3AceShowHand) - Simplify and unify TiCDC Kafka Sink error handling by standardizing the classification and wrapping of configuration, Admin API, and producer errors, making retry classification and troubleshooting easier [#5790](https://github.com/pingcap/ticdc/issues/5790) @[3AceShowHand](https://github.com/3AceShowHand) + - Upgrade TiDB, `golang.org/x/crypto`, AWS SDK, and other dependencies to mitigate known security vulnerabilities in TiCDC [#12775](https://github.com/pingcap/tiflow/issues/12775) [#5827](https://github.com/pingcap/ticdc/issues/5827) [#5693](https://github.com/pingcap/ticdc/issues/5693) [#5445](https://github.com/pingcap/ticdc/issues/5445) @[asddongmen](https://github.com/asddongmen) @[wk989898](https://github.com/wk989898) ## Bug fixes @@ -52,7 +52,6 @@ Quick access: [Quick start](https://docs.pingcap.com/tidb/v8.5/quick-start-with- + TiKV - - Fix potential security vulnerabilities in TiKV by upgrading Rust dependencies [#19931](https://github.com/tikv/tikv/issues/19931) @[hbisheng](https://github.com/hbisheng) - Fix the issue that TiKV performs unnecessary slow-log message formatting for fast Raftstore message batches, causing additional CPU overhead [#19861](https://github.com/tikv/tikv/issues/19861) @[pingyu](https://github.com/pingyu) - Fix the issue that TiKV might panic when its coprocessor evaluates pushed-down `LIKE` expressions that involve malformed UTF-8 input or patterns, `BIT` values, or certain collations [#66597](https://github.com/pingcap/tidb/issues/66597) [#67082](https://github.com/pingcap/tidb/issues/67082) [#19811](https://github.com/tikv/tikv/issues/19811) @[jebter](https://github.com/jebter) - Fix the issue that TiKV might generate inconsistent MVCC state during external SST ingestion when ingestion races with foreground writes, which might cause a panic in transaction status checks [#19891](https://github.com/tikv/tikv/issues/19891) @[gengliqi](https://github.com/gengliqi) @@ -64,6 +63,7 @@ Quick access: [Quick start](https://docs.pingcap.com/tidb/v8.5/quick-start-with- - Fix the issue that TiKV might apply unnecessary write flow control during transient RocksDB compaction spikes [#19667](https://github.com/tikv/tikv/issues/19667) @[hbisheng](https://github.com/hbisheng) - Fix the issue that TiKV might permanently block Raft connections when PD temporarily returns a store-not-found error before the target store completes registration [#19980](https://github.com/tikv/tikv/issues/19980) @[LykxSassinator](https://github.com/LykxSassinator) - Fix the issue that external SST ingestion in TiKV no longer allows foreground writes, which increases write latency during ingestion [#19954](https://github.com/tikv/tikv/issues/19954) @[gengliqi](https://github.com/gengliqi) + - Fix potential security vulnerabilities in TiKV by upgrading Rust dependencies [#19931](https://github.com/tikv/tikv/issues/19931) @[hbisheng](https://github.com/hbisheng) + PD From fd7accb12df6f1a6ae3ebc7d02538da9f5c738cc Mon Sep 17 00:00:00 2001 From: qiancai Date: Thu, 3 Sep 2026 16:27:37 +0800 Subject: [PATCH 7/7] release-8.5: add missing PD issue link --- releases/release-8.5.8.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/releases/release-8.5.8.md b/releases/release-8.5.8.md index 178a60dc3ca68..46341cad4f0db 100644 --- a/releases/release-8.5.8.md +++ b/releases/release-8.5.8.md @@ -67,7 +67,7 @@ Quick access: [Quick start](https://docs.pingcap.com/tidb/v8.5/quick-start-with- + PD - - Fix the issue that PD `/metric/query` and `/metric/query_range` might be abused for SSRF or expose upstream response details @[rleungx](https://github.com/rleungx) + - Fix the issue that PD `/metric/query` and `/metric/query_range` might be abused for SSRF or expose upstream response details [#11081](https://github.com/tikv/pd/issues/11081) @[rleungx](https://github.com/rleungx) - Fix the issue that RU tokens might be allocated unevenly among TiDB instances in the same resource group when request rates are uneven, causing high RU wait duration and increased latency on high-demand instances [#9605](https://github.com/tikv/pd/issues/9605) @[JmPotato](https://github.com/JmPotato) - Fix the issue that PD GlobalConfig gRPC APIs might access etcd keys outside the intended namespace when a client specifies an arbitrary `ConfigPath` or a path-like configuration name [#11079](https://github.com/tikv/pd/issues/11079) @[rleungx](https://github.com/rleungx) - Fix the issue that PD might establish outbound gRPC connections to caller-selected addresses supplied through `pd-forwarded-host` instead of restricting forwarding targets to the current PD leader's advertised client URLs [#11070](https://github.com/tikv/pd/issues/11070) @[rleungx](https://github.com/rleungx)