Oracle has formed a new branch of the MySQL DBMS with version 9.3.0. Builds of MySQL Community Server 9.3.0 are prepared for all major distributions of Linux, FreeBSD, macOS, and Windows. As part of the new release model implemented in 2023, MySQL 9.3 is classified under the 'Innovation' branches. Innovation branches are recommended for those who want earlier access to new functionality, are published every three months, and are only supported until the publication of the next significant release (for instance, after the release of branch 9.3, support for branch 9.2 ceases). In the summer, an LTS release 9.4 is planned, recommended for deployments that require predictability and long-term preservation of unchanged behavior. Following the LTS branch, a new Innovation branch will be formed — MySQL 10.0.
Key changes in MySQL 9.3:
- The mysqldump utility has gained the '--users' option for creating logical dumps with information about all accounts, output via the SQL expressions 'CREATE USER' and 'GRANT'. The option '--add-drop-user' is provided to insert the 'DROP USER' statement before 'CREATE USER', while for selectively including specific users in the dump, the options '--include-user=user@host' and '--exclude-user=user@host' can be specified multiple times.
- In the MLE (Multilingual Engine Component), which allows the use of languages other than SQL in stored procedures and functions, support for JavaScript has been improved. A 'DECIMAL' type has been implemented for stored procedures written in JavaScript, which can be used for input and return arguments. By default, for safety, the MySQL DECIMAL type is converted to the JavaScript type 'String', but this behavior can be overridden with the command 'SELECT mle_set_session_state('{"decimal_type":"Number"}')', after which the JavaScript type 'Number' will be used. Type conversion to DECIMAL is supported for JavaScript values with Boolean, Number, String, and BigInt types.
- Support for setting localization parameters has been added to stored procedures in JavaScript, utilizing the JavaScript API Intl. For example, to determine the current locale, the property 'Intl.DateTimeFormat().resolvedOptions().locale' can be used, and for overriding the locale — the method 'toLocaleString()'.
- The capabilities for managing JavaScript libraries have been expanded: expressions like ‘ALTER PROCEDURE’ and ‘ALTER FUNCTION’ can now be used to change the list of imported libraries. The expression ‘ALTER LIBRARY’ has been added for adding, deleting, or modifying the SQL comment for a library. The expression ‘SHOW LIBRARY STATUS’ has been implemented to obtain information about the library.
- Support for dynamic loading of JavaScript libraries has been added. To dynamically import a library, the keyword ‘await’ should be used, for example, ‘let module = await import(‘/db1/lib_${object_type}’)’.
- Query optimizations using quantified comparison operators have been expanded. In addition to supporting the operators ‘=ANY’ and ‘ALL’ for subquery optimization, the new version adds support for the operators ‘>ANY’, ‘>=ANY’, ‘<ANY’, ‘ALL’, ‘>=ALL’, ‘<ALL’, and ‘<=ALL’.
- The ‘version_tokens’ plugin, previously declared deprecated, has been removed.
- Setting the value 0 in the system variable replica_parallel_workers is prohibited.
- 28 vulnerabilities have been resolved, of which 26 can be exploited remotely with access to submit queries to the database management system. The six most serious issues have a severity level of 6.5 and are related to vulnerabilities in the InnoDB engine, parser, and optimizer. Less severe vulnerabilities affect mysqldump, InnoDB, optimizer, DDL, UDF, parser, and the replication system.
Source: opennet.ru
