Oracle Release Notes

ADDM Extension

AI Vector Search: Scalar Quantized IVF Indexes

Asynchronous Cross-Region Replication for Globally Distributed Databases Deployed with Raft Replication

Automatic Session State Restoration for DRCP and PRCP Implicit Pooling

BAR_CHART Function

DBMS_AI_GRAPHRAG PL/SQL Package

Data Type Override for Iceberg Tables

Extend Select AI Translate for Google, AWS, and Azure Translation Services

Iceberg Table Properties

Iceberg Update and Delete

Included Columns Support for Distributed HNSW Indexes

Incremental Schema Inference for the JSON-to-Duality Migrator

Incremental Snapshots Support for Distributed HNSW Indexes

MLE WebAssembly Modules and JavaScript WebAssembly API

Mixed SELECT * and other columns/expressions

Multi-Vector Search with HNSW Indexes

Notification Directives

Oracle ODBC Driver Support for Application Continuity and Transparent Application Continuity

Prefetch Implicit Results with Top-Level Procedure Execution

Product Quantized HNSW Indexes

Promotion of Sessionless Transaction to XA Transaction

Runtime Staleness Detection and Fast Refresh for Materialized Views Containing External Tables

SELECT FOR UPDATE with Row Limit

Select AI Support for NL to Graph Queries

Select AI Supports Specifying Custom LLM via Private Endpoint in Customer-Hosted Environment

Simplified Macros

Streaming Windowing Table Functions

Support for AC/TAC in Precompilers Using Session Pool

Transparent Sharding in OCI Session Pools

Witness Replica

ezTLS

This page describes the features and behavior changes that are new in Release Update 19.33.

New Features

Update the Oracle Wallet Created by the Cloud Backup Module Installer

The cloud backup module installers for OCI, OCI Classic, and Microsoft Azure now support the -updateWalletNoValidate parameter, which updates the cloud storage account credentials stored in the Oracle wallet.

If you change your cloud storage account credentials, update the existing Oracle wallet by rerunning the installer with the wallet directory location along with -updateWalletNoValidate. The installer updates the wallet without validating the host connection. Ensure that the host and bucket identify the intended cloud storage target.

You can update the Oracle wallet without requiring a successful connection to the target host, which helps avoid connection-validation failures.

Behavior Changes

Release Update 19.33 introduces the behavior changes described below. Review each item before applying the Release Update (RU). Most changes affect behavior only when the relevant feature is in use. Where applicable, test application, administrative, audit, and connectivity workflows in a non-production environment before rollout.

CREATE INDEX Requires VPD Bypass Authorization for Protected UDF Arguments

Behavior change: Oracle Database rejects a supported functional-index CREATE INDEX statement when its user-defined function (UDF) arguments are protected by VPD and lack bypass authorization. Affected administrators can use the existing VPD bypass privilege or revise the index expression to create the index.

This change enforces the required VPD bypass authorization when you create a functional index.

Mandatory Unified Auditing of Direct SYS DML on Audit Trail Tables

Behavior change: Supported direct DML operations by SYS on SYS.AUD$ and SYS.FGA_LOG$ generate ORA$MANDATORY unified audit records.

This change enables security administrators to detect direct changes to traditional and fine-grained audit trail data in the UNIFIED_AUDIT_TRAIL view.

New Permission Requirements for Oracle ASM File Group Operations

Behavior change: Moving a file group to a new quota group now requires only the SYSASM privilege. File group template usage now requires an Oracle ASM File Access Control check. Moving a file between file groups now requires an Oracle ASM File Access Control check.

The new permission requirements provide enhanced security, as well as quota management.

Secure Authentication for Persistent RMAN Channel Configuration

Behavior change: You must now use a secure external authentication method, such as Oracle wallets or secure external password store for configuring a persistent channel because RMAN does not allow passwords in the connection string of the CONFIGURE CHANNEL command.

Using a secure external authentication method enhances security and reduces the risk of passwords being exposed in the control file as part of RMAN persistent channel configuration.

SYS.KUBSAGT Requires Explicit EXECUTE Privilege

Behavior change: Public access to the SYS.KUBSAGT PL/SQL package has been removed as part of a security-related behavior change. Hadoop cluster database users that require this package must be granted the EXECUTE privilege explicitly; otherwise, dependent Hadoop operations may fail with insufficient-privilege or package-access errors. A database administrator can grant the privilege by running GRANT EXECUTE ON SYS.KUBSAGT TO <HADOOP_USER>;.

Restricting access to explicitly authorized users improves database security and provides administrators with finer-grained control over access to SYS.KUBSAGT and related Hadoop operations.

Unified Auditing Mandatory Auditing for SYS Authorization Metadata

Behavior change: Unified Auditing now writes ORA$MANDATORY audit records for direct INSERT, UPDATE, and DELETE operations on SYS.OBJAUTH$, SYS.CODEAUTH$, SYS.USERAUTH$, SYS.CDB_LOCAL_ADMINAUTH$, and SYS.ADMINAUTH$.

This change strengthens audit coverage of authorization and privilege metadata changes, enabling security administrators to detect direct changes to these sensitive dictionary tables in the Unified Audit Trail.

Changes in MySQL 9.7.4 (2026-10-20)

Audit Log Notes

• Fixed an issue relating to Audit Log filter UDF error-message formatting. (Bug #39472337)

Compilation Notes

• MySQL CMake configuration could fail with newer Cyrus SASL versions when plugins present in older library releases were unavailable. Plugin files are now copied on a best-effort basis, permitting builds with both older and newer plugin sets. (Bug #39964171)

Component Notes

• Fixed an issue relating to concurrent operations during deinitialization of the connection_control component. (Bug #39564040)

Connection Management Notes

• Fixed an issue relating to failed-authentication tracking and delays by the connection_control component. (Bug #39564049)

InnoDB Notes

• InnoDB: A previous InnoDB deadlock fix made row-size estimates more accurate for B-tree operations, but also made CREATE TABLE and ALTER TABLE validation stricter. As a result, some table definitions accepted by earlier MySQL LTS releases were unexpectedly rejected or produced warnings, disrupting existing applications. As of this release, the legacy validation behavior is preserved for most DDL operations while retaining the accurate estimate where it is needed to prevent B-tree deadlocks. ALTER TABLE ... ALGORITHM=INSTANT continues to use the stricter calculation to safely handle large default values. Our thanks to Paweł Olchawa and the team at Percona, and Meng-Hsiu Chiang and the team at Amazon for their contribution. (Bug #120323, Bug #39249507)

  References: See also: Bug #39129182.

• When the external MeCab parser failed during deferred FULLTEXT tokenization, a base row could be committed without complete token postings, causing searches to miss the row. Parser failures now produce a client warning, including for autocommit statements. Errors were returned similar to the following:

  Mecab: parse() failed: too long sentence..
  

  (Bug #39838534)

• After an exported table was modified, its tablespace discarded, and an older exported image imported, point lookups could return rows or values from the discarded tablespace generation. Stale Adaptive Hash Index entries are now treated as misses so lookups fall back to normal B-tree traversal. (Bug #39661793)

• After ALTER TABLE ... IMPORT TABLESPACE failed, stale pages from the discarded tablespace could later trigger an assertion during eviction. Failed-import cleanup now preserves the index space identifier required to remove stale Adaptive Hash Index entries. Errors were returned similar to the following:

  [ERROR] [MY-013183] [InnoDB] Assertion failure: btr0sea.cc:1082: block->page.id.space() == index->space
  

  (Bug #39661792)

• Fixed an issue relating to null input supplied to the InnoDB redo-log consumer UDF. (Bug #39632565)

  References: See also: Bug #34085310, Bug #36004840.

• Fixed an issue relating to SHOW CREATE output for short non-SQL stored-program or library bodies. (Bug #39361183)

• Fixed an issue relating to validation of index pages during transportable tablespace import. (Bug #39295605)

• Fixed an issue relating to parser nesting for InnoDB full-text Boolean Mode expressions. (Bug #39234789)

• Fixed an issue relating to concurrent COPY ALTER operations. Our thanks to George Ma and the team at Alibaba for the contribution. (Bug #39134921)

• Fixed an issue relating to renaming columns used by self-referencing InnoDB foreign keys. (Bug #39091341)

• If InnoDB page reorganization produced a size mismatch, InnoDB could continue using the reorganized page without recording the corresponding redo. A later insert followed by a server crash could consequently cause recovery failure or page corruption. The mismatch is now treated as fatal rather than allowing inconsistent redo state to continue. (Bug #116574, Bug #37258813)

MySQL Programs Notes

• Fixed an issue relating to mysqldump processing of server-provided table identifiers. (Bug #39905165)
• Fixed an issue relating to mysqldump validation of server-provided result, identifier, database, and table metadata. (Bug #39832176, Bug #39832186, Bug #39832202)

Optimizer Notes

• Microsoft Windows: Fixed an issue relating to formatting unusually long query identifiers. (Bug #39883066)
• Fixed an issue relating to column-identifier validation for histogram operations. (Bug #39882926)
• Fixed an issue relating to argument-length validation for windowed BIT_OR() and BIT_AND(). (Bug #39882731)
• Fixed an issue relating to range handling during group index skip scans. (Bug #39867741)
• Fixed an issue relating to repeated correlated outer-field references in nested queries. (Bug #39603658)
• Fixed an issue relating to optimizer handling of IN predicates. (Bug #39603649)
• Fixed an issue relating to optimization of nested subquery expressions used with IN or NOT IN. (Bug #39603575)
• Fixed an issue relating to multi-join plans. (Bug #39197517)
• With the hypergraph optimizer enabled, single-table UPDATE or DELETE statements using ORDER BY and a subquery converted to a hash semijoin or antijoin could modify the wrong rows. An update through a view with CHECK OPTION could also use incorrect rows or fail when required row identifiers were not preserved. (Bug #121038, Bug #39822725)
• With optimizer_switch set to index_merge_union=off, an index-merge plan for disjunctive conditions could omit a disjunct and return incomplete results. For example, a query expected to return four rows instead returned: Empty set (0.00 sec). Our thanks to Kun Qin for the contribution. (Bug #114885, Bug #36584358)

Packaging Notes

• The bundled libevent library was upgraded from 2.1.11 to 2.1.13. (Bug #40007263)

• Installing commercial MySQL packages on EL10 aarch64 could fail because client programs and manual pages conflicted with files supplied by mariadb11.8. Package metadata now declares additional obsoletes to resolve these conflicts. Errors were returned similar to the following:

  Error: Transaction test error: file /usr/bin/mysql conflicts between attempted installs of mariadb11.8 and mysql-commercial-client
  

  (Bug #39758376)

• The bundled TIRPC library was upgraded to version 1.3.7. (Bug #39703871)

• Rebuilding MySQL source RPMs on minimal EL8 or EL9 systems could fail because required dependencies were omitted from mysql.spec.in. Our thanks to Simon Mudd for the contribution. (Bug #120895, Bug #39894524)

Performance Schema Notes

• After an asynchronous replica restarted, its I/O and SQL threads could appear in INFORMATION_SCHEMA.PROCESSLIST but remain absent from performance_schema.processlist until replication was stopped and restarted. Foreground system threads with process-list IDs are now retained, and an empty user name is represented as system user. (Bug #36042255, Bug #113202)

Replication Notes

• Fixed an issue relating to Group Replication message-decoding limits. (Bug #39905199)
• Fixed an issue relating to sender validation for Group Replication messages. (Bug #39851456)
• Fixed an issue relating to Group Replication UDF lifecycle handling during plugin unloading. (Bug #39838541)
• Fixed an issue relating to Group Replication recovery-state validation. (Bug #39832216)
• Under certain circumstances, after recovery from a network partition, a group could lose quorum and remain in a reconnection loop that blocked writes after networking stabilized. Connection delegation now uses a single nonblocking publication attempt, allowing normal reconnection handling to retry. Errors were returned similar to the following: MY-013781: "Error sending connection delegation command" (Bug #39767762)
• Fixed an issue relating to error handling while mysqlbinlog rewrites events. (Bug #39659682)
• Fixed an issue relating to Group Replication peer-address handling. (Bug #39654054)
• Fixed an issue relating to validation by asynchronous_connection_failover_add_managed(). (Bug #39603374)
• The GTID for an XA COMMIT or XA ROLLBACK could become visible before XA RECOVER stopped listing the completed XID. XA RECOVER now hides the finalized transaction before the GTID is externalized. (Bug #36505659)
• After XA PREPARE made its GTID visible in gtid_executed, XA RECOVER could still omit the prepared XID. The XID is now made visible before the GTID state is updated, so waiting for the GTID guarantees that another session can observe the prepared transaction. (Bug #35872823)
• Replaying a CTAS binary log through mysqlbinlog into a server with binary logging disabled could fail instead of restoring the logged tables and rows because an additional transaction produced an invalid transaction boundary. Parser-started CTAS transactions are now suppressed for binlog-applier threads. Our thanks to Venkatesh Duggirala and the team at Google for the contribution. (Bug #120757, Bug #39743645)
• On a binlogless replica using relay-log recovery, parallel replication, and commit-order preservation, replicated FLUSH PRIVILEGES statements could leave gaps in mysql.gtid_executed. After restart, the replica could request already-applied transactions, resulting in duplicate errors or failure when the source had purged the required binary logs. Errors were returned similar to the following: Cannot replicate because the source purged required binary logs. Replicate the missing transactions from elsewhere, or provision a new replica from backup (Bug #115613, Bug #36849620)
• After a replica worker applied a rewritten statement, SHOW PROCESSLIST and performance_schema.threads could continue displaying the completed statement while the worker was idle. Query-event cleanup now clears the displayed state. Our thanks to Marcelo Altmann for the contribution. (Bug #99200, Bug #31140932)

Security Notes

• Fixed an issue relating to server-supplied RSA public-key handling during client-side SHA-2 authentication. (Bug #39883040)
• Fixed an issue relating to runtime key-type validation by keyring UDFs. (Bug #39838747)
• Fixed an issue relating to client parsing of WebAuthn assertion challenge packets. (Bug #39740347)
• Fixed an issue relating to nullable numeric arguments supplied to audit_api_message_emit_udf(). (Bug #39633136)

SQL Syntax Notes

• ALTER TABLE ... EXCHANGE PARTITION could move rows that violated the destination table's CHECK constraints or exchange tables whose generated columns used different expressions. Rows are now checked in both directions, including when WITHOUT VALIDATION skips partition-bound checks, and mismatched generated-column definitions are rejected. Errors were returned similar to the following: ERROR 3819 (HY000): Check constraint 't_swap_chk_1' is violated. (Bug #120206, Bug #39634208)

X Plugin Notes

• Fixed an issue relating to arguments supplied to MySQL X Plugin UDFs. (Bug #39839185)

Functionality Added or Changed

• Important Change: MySQL Server now supports a four-part release identity in the form MAJOR.MINOR.PATCH.UPDATE, with an empty update component represented as zero. The complete version is available through VERSION_WITH_UPDATE(), the read-only global version_with_update variable, mysqld --version-with-update, and new client-library APIs:

  SELECT VERSION_WITH_UPDATE();
  SELECT @@version_with_update;
  mysqld --version-with-update
  

  Existing interfaces, including VERSION(), version, the classic handshake, numeric version IDs, and existing C APIs, retain three-part compatibility semantics. mysql_upgrade_history records exact update transitions without changing upgrade compatibility decisions.

  See mysql_upgrade_history File for more information. (Bug #40013285, WL #17318)

Bugs Fixed

• Microsoft Windows: Fixed an issue relating to client console output handling. (Bug #39472263)

• Fixed an issue relating to CDATA validation by LOAD XML. (Bug #39938954)

• Fixed an issue relating to stack-depth handling for nested ROW expressions during statement preparation. (Bug #39925442)

• Fixed an issue relating to account host matching. (Bug #39911722)

• Fixed an issue relating to parser resource controls for complex statements containing common table expressions. (Bug #39905175)

• Fixed an issue relating to mysqlbinlog handling of user-variable events. (Bug #39905157)

  References: See also: Bug #29028491.

• Fixed an issue relating to path restrictions during component loading. (Bug #39905086)

• Fixed an issue relating to XML value parsing. (Bug #39905057)

• Fixed an issue relating to validation of binary JSON values. (Bug #39872033)

• Fixed an issue relating to uninstalling component_telemetry. (Bug #39839041)

• Fixed an issue relating to argument validation by mysql_query_attribute_string(). (Bug #39838999)

• Fixed an issue relating to raw remote file handling by mysqlbinlog. (Bug #39832258)

  References: See also: Bug #39068649.

• Fixed an issue relating to multifactor-authentication request handling in the client library. (Bug #39832236)

• Fixed an issue relating to binary log row-event processing. (Bug #39784720)

• Fixed an issue relating to client-library validation of temporal values in prepared-statement result rows. (Bug #39740351)

• Fixed an issue relating to InnoDB full-text cache monitoring. (Bug #39729888)

• Fixed an issue relating to argument evaluation by ST_BUFFER_STRATEGY(). (Bug #39679888)

• Fixed an issue relating to WebAuthn client assertion generation. (Bug #39665344)

• Fixed an issue relating to memory handling during server initialization. (Bug #39659472)

• Fixed an issue relating to validation of clone storage locators. (Bug #39633821)

• Fixed an issue relating to spatial data conversion. (Bug #39616304)

• Fixed an issue relating to stack use during JSON path evaluation. (Bug #39616228)

  References: See also: Bug #23106330.

• Fixed an issue relating to client authentication packet validation. (Bug #39603366)

• Fixed an issue relating to replication protocol packet validation. (Bug #39603354)

• Fixed an issue relating to Classic Protocol temporal-value validation. (Bug #39603337, Bug #39603346)

• Fixed an issue relating to updates of InnoDB tables containing many indexed virtual columns. (Bug #39593341)

• Fixed an issue relating to InnoDB online DDL conversion handling. Our thanks to George Ma and the team at Alibaba for the contribution. (Bug #39362553)

• Fixed an issue relating to IndexMerge query processing. (Bug #39147848)

• Fixed an issue relating to InnoDB foreign-key rollback handling. (Bug #39147834)

• Fixed an issue relating to InnoDB memory allocation calculations. Our thanks to Hongyu Qiao and the team at Tencent for the contribution. (Bug #39123849)

• Fixed an issue relating to duplicate-key reporting during parallel InnoDB DDL. (Bug #38987922)

• Fixed an issue relating to memory use and cancellation handling for JSON_ARRAYAGG() workloads. (Bug #38973857)

• After a global privilege was granted and partially revoked for a schema, a subsequent GRANT for the same account could fail with ERROR 3901. Errors were returned similar to the following:

  ERROR 3901 (HY000): 'GRANT' privilege for database 'sys' exists both as partial revoke and mysql.db simultaneously. It could mean that the 'mysql' schema is corrupted.
  

  (Bug #38921524)

• Fixed an issue relating to corruption handling by ibd2sdi. (Bug #38810796)

• Fixed an issue relating to InnoDB rollback for full-text indexed tables. (Bug #38547442)

• Fixed an issue relating to table-rebuild DDL processing. (Bug #38305379)

• Large JSON_ARRAYAGG() window frames could become progressively slower and remain in the executing state after KILL QUERY. Materialization now avoids unnecessary JSON-value copying, and buffered processing responds promptly to cancellation. (Bug #37878680)

  References: See also: Bug #38973857.

• Fixed an issue relating to InnoDB tablespace import after crash recovery. Our thanks to Chong Lee and the team at Alibaba for the contribution. (Bug #37380231)

• Fixed an issue relating to InnoDB reads using older transaction views after tablespace import. (Bug #36999166)

• Fixed an issue relating to ROLLUP query execution. (Bug #35763384)

This page describes the features and behavior changes that are new in Release Update 19.32.

Behavior Changes

Release Update 19.32 introduces the behavior changes described below. Review each item before applying the Release Update (RU). Most changes affect behavior only when the relevant feature is in use. Where applicable, test application, administrative, audit, and connectivity workflows in a non-production environment before rollout.

BFILENAME Queries Excluded from the Database Result Cache

Behavior change: SQL statements that contain the BFILENAME function are no longer cached in the Database Result Cache and no longer display Result Cache information in their execution plans.

This change keeps execution plans accurate and prevents unsupported caching behavior for queries that reference external files, improving predictability and operational confidence.

Correct Audit Object Association for VPD/RLS-protected Objects

Behavior change: Audit records for access to objects protected by Oracle Virtual Private Database (VPD) or Fine-Grained Auditing (FGA) are now associated with the correct object.

Audit records and object-level policy evaluation remain accurate for queries protected by Oracle Virtual Private Database. This improvement helps administrators maintain accurate audit traceability and supports compliance reporting.

View documentation:

• Auditing of Oracle Virtual Private Database Predicates
• Fine-Grained Auditing on Tables or Views That Have Oracle VPD Policies

DBMS_REDEFINITION Enforcement of Database Vault Authorization

Behavior change: DBMS_REDEFINITION now enforces Database Vault checks before table redefinition operations proceed. When Database Vault is enabled, the user invoking table redefinition must now be authorized to access both the original table and any interim table used during the redefinition process.

This change applies to the following entry points in DBMS_REDEFINITION:

• CAN_REDEF_TABLE
• START_REDEF_TABLE
• REDEF_TABLE
• ROLLBACK
• FINISH_REDEF_TABLE

The update checks Database Vault Realm, Command Rule, and Ops Control protections before allowing data movement between tables. If the user is not authorized under Database Vault, the operation is blocked and an appropriate error is returned. It prevents unauthorized use of table redefinition to move data out of Database Vault-protected tables or to alter protected table metadata without Database Vault authorization.

Expanded Default Password Detection in DBA_USERS_WITH_DEFPWD

Behavior change: Supported DBA_USERS_WITH_DEFPWD queries now return additional default password account findings and associated product labels for SYS, SYSTEM, and ADMIN account combinations.

This feature gives administrators a more complete view of default password risks and the related product context for remediation.

View Documentation

orapki cert display Command Shows Additional Certificate Attributes

Behavior change: The orapki cert display -cert command has been enhanced to display public key information along with existing certificate details. Specify the -complete and -details options with orapki cert display -cert to display the additional attributes in the command output.

This feature lets you verify certificate strength directly from the orapki utility, which makes security validation and certificate hardening easier without needing a separate tool.

View Documentation

orapki wallet p11_verify Reports Native Failure

Behavior change: The orapki wallet p11_verify command now reports an error when native PKCS#11 verification fails instead of allowing the failure to go undetected or be reported unclearly.

This feature makes PKCS#11 wallet verification failures visible, so you can identify and troubleshoot verification issues more quickly. Clearer error reporting reduces confusion during wallet validation.

View Documentation

Scheduler Single Named Destination Privilege Enforcement

Behavior change: Scheduler privilege validation has been updated for jobs that use a single named destination. When you enable or run one of these jobs, Scheduler validates that the job owner has the required privileges. CREATE ANY JOB authorizes the use of single named destinations in another user’s schema. For SYS-owned single named destinations, the job owner must have ALTER privilege on the destination object.

This update improves security by ensuring that jobs can be enabled or run against protected SYS single named Scheduler destinations only when the job owner has the required object-level privileges. Existing behavior for non-SYS single named destinations is unchanged.

View Documentation

Security Hardening of Database Vault Authorization on Scheduler Jobs

Behavior change: Before this release, CREATE, DROP, ALTER, ENABLE, and DISABLE operations performed through the DBMS_SCHEDULER APIs on certain Database Vault realm-protected objects might not have been enforced correctly. This update strengthens the internal realm authorization checks to ensure that Database Vault policies are applied consistently. As a result, operations that previously succeeded may now fail with ORA-01031: insufficient privileges when performed on realm-protected objects without the required realm authorization. In such cases, customers must grant the appropriate users the necessary authorization for the corresponding Database Vault realm.

View Documentation

Security Hardening on XS$NULL

Behavior change: Real Application Security (RAS) application users can no longer grant or revoke ON USER privileges for XS$NULL. If these operations are required, they must be performed by a sufficiently privileged database administrator, such as a user with the GRANT ANY OBJECT PRIVILEGE system privilege.

Unified Auditing for FLASHBACK_TRANSACTION_QUERY Privilege Use

Behavior change: Unified auditing now records the use of the SELECT ANY TRANSACTION privilege when accessing FLASHBACK_TRANSACTION_QUERY.

This feature provides administrators with more complete audit visibility for privileged access to historical transaction data.

View Documentation

New Features

Next-Generation Cryptographic Provider Announcement

Oracle Database 19c now supports a next-generation cryptographic provider based on OpenSSL (next-generation provider), in addition to the existing Dell BSAFE Crypto-C Micro Edition Suite, or MES (legacy provider).

This dual-provider architecture enables the following capabilities:

• TLS 1.3 protocol support
• FIPS 140-3 compliance (via OpenSSL 3.5.x FIPS provider)
• Post-Quantum Cryptography (PQC) algorithms for key exchange (ML-KEM) and digital signatures (ML-DSA)
• Hybrid key exchange groups that combine classic and post-quantum algorithms for quantum-resistant session establishment

The legacy provider remains the default. To switch to the next-generation provider, run the set_crypto_provider.py script and restart the database instance and Oracle Net listener. Only one cryptographic provider can be active at a time.

View Documentation

Behavior Changes

Release Update 19.31 introduces the behavior changes described below. Review each item before applying the Release Update (RU), particularly if you use the affected security, auditing, networking, Heterogeneous Services, blockchain/immutable-table, or file-group functionality.

Most changes affect behavior only when the relevant feature is in use. Where applicable, test application, administrative, audit, and connectivity workflows in a non-production environment before rollout.

Blockchain Table Verification

Behavior change: Blockchain-table verification can now be performed in parallel through a new PL/SQL procedure.

Parallel verification can reduce elapsed time but may increase CPU, I/O, and parallel-execution resource use while verification runs.

Review before upgrade:

• Identify scheduled or manual blockchain-table verification jobs.
• Review Resource Manager, parallel-execution limits, and maintenance windows.
• Test verification duration and system impact with representative table sizes.

View Documentation

Default NFS Version Selection with Direct NFS Client

Behavior change: The default NFS version used by Direct NFS client has changed. Previously, when no oranfstab file was present, Direct NFS defaulted to NFSv3. With this change, Direct NFS queries the system mount table (mtab) to determine the NFS version and uses that version instead.

The primary benefit is support for NFS storage servers that do not support NFSv3. This is particularly important in cloud environments, such as Oracle Autonomous AI Database, where customers cannot create an oranfstab file to explicitly configure Direct NFS to use NFSv4.

File-Group Metadata Visibility

Behavior change: READ ANY FILE GROUP is no longer the supported mechanism for determining which file-group metadata a user can see through ALL_FILE_GROUPS.

Previously, this privilege could expose all file-group records through ALL_FILE_GROUPS. In 19.31, visibility should be granted using the appropriate SELECT privilege on the relevant metadata views. MANAGE ANY FILE GROUP continues to govern file-group management operations.

Review before upgrade:

• Identify users, roles, scripts, and tools that rely on READ ANY FILE GROUP.
• Confirm that users requiring file-group metadata have the required SELECT access.
• Test queries against ALL_FILE_GROUPS and related file-group views after patching.

View Documentation

Heterogeneous Services extproc Idle Timeout

Behavior change: The new HS_IDLE_TIMEOUT initialization parameter provides explicit control of idle timeout behavior for Heterogeneous Services external-procedure sessions.

The parameter can retain, override, or disable the timeout inherited from SQLNET.INBOUND_CONNECT_TIMEOUT. This can change when idle extproc sessions terminate.

Review before upgrade:

• Identify external procedures and applications using Heterogeneous Services.
• Check the current SQLNET.INBOUND_CONNECT_TIMEOUT setting and any history of ORA-28576 errors.
• Decide whether to set HS_IDLE_TIMEOUT; test both long-running and idle extproc workloads.

Immutable and Blockchain Table DDL and CTAS Processing

Behavior change: Existing tables can now be converted in place to immutable tables, and CREATE TABLE AS SELECT operations for blockchain tables can run in parallel.

These changes introduce additional supported DDL and can alter the resource profile and elapsed time of blockchain-table CTAS operations.

Review before upgrade:

• Review change-management controls that govern conversion of existing tables to immutable tables.
• Check automation, deployment tools, and DDL auditing for assumptions about immutable-table creation.
• Validate capacity and workload-management settings if parallel CTAS is used for blockchain tables.

View Documentation

Kerberos-Constrained Delegation for Database Links

Behavior change: Database links can operate in Microsoft Active Directory environments that enforce Kerberos constrained delegation, including newer Windows platforms where prior ticket-forwarding behavior may not be allowed.

This changes the supported authentication path for Kerberos-enabled database links and removes reliance on older Microsoft registry workarounds.

Review before upgrade:

• Identify database links that use Kerberos authentication.
• Test database-link authentication from Windows 11 and Windows Server 2025 clients or servers, where applicable.
• Review Active Directory constrained-delegation configuration and retire legacy workarounds only after validation.

View Documentation

ONS TLS Elliptic-Curve Restrictions

Behavior change: Oracle Notification Service can now exclude weak elliptic curves from TLS negotiation when DISABLE_WEAK_CURVES is enabled.

Enabling the setting changes TLS handshake behavior. Clients or peers that depend on excluded curves may no longer connect.

To enable this feature, run the following command on any cluster node from the Grid Infrastructure home:

srvctl setenv nodeapps -onsonly -env DISABLE_WEAK_CURVES='yes'

Review before enabling:

• Inventory ONS clients, peers, and monitoring tools.
• Confirm that all TLS participants support approved strong elliptic curves.
• Test ONS connectivity and failover behavior after enabling the setting.
• Coordinate the change with security and vulnerability-management teams.

View Documentation

Unified Auditing of Equivalent Real Application Security Actions

Behavior change: Audit policies for standard database user and role actions also audit the equivalent Real Application Security (RAS) actions.

For example, auditing CREATE USER also captures the corresponding RAS user-creation operation. This increases audit coverage and can increase audit-record volume.

Review before upgrade:

• Review unified audit policies that cover user or role administration.
• Anticipate additional audit records for equivalent RAS operations.
• Confirm that audit retention, reporting, SIEM ingestion, and storage capacity accommodate the additional volume.
• Update audit-review procedures if they distinguish standard SQL actions from RAS procedure calls.

View Documentation

New Features

There are no new features for Release Update 19.31.

This page describes the features and behavior changes that are new in Release Update 19.30.

Behavior Changes

Release Update 19.30 introduces the behavior changes described below. Review each item before applying the Release Update (RU). Most changes affect behavior only when the relevant feature is in use. Where applicable, test application, administrative, audit, and connectivity workflows in a non-production environment before rollout.

PRE_PAGE_SGA

Behavior change: PRE_PAGE_SGA remains a supported initialization parameter in Oracle Database 19c, Release Update 19.30. Removing its deprecated flag keeps automated duplicate and standby creation workflows from failing when the parameter is inherited from a source SPFILE.

Restoring full support for PRE_PAGE_SGA lets you keep legacy configurations in place without disrupting DBCA duplicate, Data Guard standby, or RMAN clone operations, eliminating ORA-32006 interruptions for fleets that cannot immediately drop the parameter.

View Documentation

New Features

Restricting Directory Paths for PDBs Configured Without PATH_PREFIX

A new CDB-level parameter, DIRECTORY_PREFIXES_ALLOWED, lets administrators restrict which operating system directories PDBs can reference when creating new DIRECTORY objects, even if the PDB was originally created without the PATH_PREFIX clause. When this parameter is set, any newly created DIRECTORY object in a PDB is validated to ensure its path falls under one of the approved directory prefixes. Existing DIRECTORY objects continue to function unchanged for backward compatibility. However, potentially noncompliant directory objects can be identified using DBA_DIR_PREFIX_VIOLATIONS and will appear as warnings in PDB_PLUG_IN_VIOLATIONS after a restart.

This security feature allows the CDB administrator to restrict directory object paths created or accessed from within PDBs to one or more specific operating system directories. It acts as a guardrail for the CDB by preventing PDBs that were created without the PATH_PREFIX clause from accessing or modifying sensitive operating system files or CDB$ROOT container datafiles and metadata files.

View Documentation

Select AI

Through the DBMS_CLOUD_AI package, Select AI serves as an AI gateway enabling users, developers, and applications to interact with Oracle AI Database using natural language supporting multiple generative AI use cases. Select AI provides functionality supporting natural language to SQL, including automatically generating, running, and explaining SQL, and through the DBMS_CLOUD_AI_AGENT package, providing a framework for building, managing, and running AI agents in the database. It also supports synthetic data generation and text summarization and translation. Select AI provides PL/SQL and Python APIs.

Together with the broader foundational Cloud Developer packages, they enable you to integrate AI capabilities directly from the database and support end-to-end workflows that deliver greater data insight with AI.

Select AI enables business users and developers to use a wide range of AI providers and models supporting many AI-enabled use cases and application scenarios. Select AI helps to simplify the adoption of AI in enterprises and organizations across both on-premises and cloud systems. Users get insights faster using natural language without waiting on manual SQL query generation. This can reduce IT bottlenecks and accelerate AI-enabled application development. Using Select AI, enterprises benefit from database security mechanisms and protocols.

View Documentation

This page describes the features and behavior changes that are new in Release Update 19.29.

Behavior Changes

Release Update 19.29 introduces the behavior changes described below. Review each item before applying the Release Update (RU). Most changes affect behavior only when the relevant feature is in use. Where applicable, test application, administrative, audit, and connectivity workflows in a non-production environment before rollout.

Database Vault Default Realms Upgraded to Mandatory Realms

Behavior change: The Oracle Database Vault realm has been changed from a regular realm to a mandatory realm. In addition, a new mandatory Oracle Label Security realm has been added.

These security hardening enhancements strengthen the protection of Oracle-managed Database Vault and Oracle Label Security objects and related execution paths. Mandatory realms provide stronger protection by preventing even privileged users from bypassing realm protection. These changes help preserve the integrity of Database Vault configuration, metadata, and policy enforcement.

New Features

Ability to Control Heartbeats in United Mode and Isolated Mode PDBs

You now can control the size of the batch of heartbeats that use Oracle Key Vault or OCI KMS (OCI Vault) for centralized key management.

The HEARTBEAT_BATCH_SIZE initialization parameter enables you to set the heartbeat batch size. The duration of the heartbeat period defaults to 3 seconds.

This enhancement benefits the situation where you have a very large deployment of PDBs (for example, 1000) that use Oracle Key Vault. By setting the heartbeat batch size, you can stagger the heartbeats across batches of PDBs to ensure that for each batch a heartbeat can be completed for each PDB within the batch during the heartbeat period, and also ensure that PDB keys can be reliably fetched from an Oracle Key Vault server and cached in the persistent state.

View Documentation

This page describes the features and behavior changes that are new in Release Update 19.28.

Behavior Changes

Release Update 19.28 introduces the behavior changes described below. Review each item before applying the Release Update (RU). Most changes affect behavior only when the relevant feature is in use. Where applicable, test application, administrative, audit, and connectivity workflows in a non-production environment before rollout.

Restricting Access to DBA_TAB_STAT_PREFS , CDB_TAB_STAT_PREFS , CDB_TAB_PENDING_STATS , and CDB_IND_PENDING_STATS to DBAs Only

Behavior change: The DBA_TAB_STAT_PREFS, CDB_TAB_STAT_PREFS, CDB_TAB_PENDING_STATS, and CDB_IND_PENDING_STATS views used to be accessible to everyone. Now, they are accessible to users with DBA privileges only.

This change makes these views consistent with any other views starting with the prefix DBA and CDB. Users with non-DBA privileges should only be able to access ALL_TAB_STAT_PREFS, USER_TAB_STAT_PREFS, ALL_TAB_PENDING_STATS, USER_TAB_PENDING_STATS, ALL_IND_PENDING_STATS, and USER_IND_PENDING_STATS.

New Features

DBMS_DEVELOPER PL/SQL Package

The DBMS_DEVELOPER PL/SQL package provides an efficient way for developers to retrieve metadata for database objects, such as tables, views, and indexes. In previous releases, object metadata had to be retrieved using the DBMS_METADATA package, which returned metadata in XML format or by performing queries on various data dictionary tables and views.

The DBMS_DEVELOPER package returns metadata as a CLOB containing JSON formatted text, which can be easily integrated with applications and services, such as developer tools. You can adjust the level of detail to control the amount of metadata returned, tailoring it to your application’s needs. Additionally, metadata retrieval time is significantly improved, enhancing integration with applications and services.

View Documentation

Enhancements to RADIUS Configuration

RADIUS is frequently used to provide multi-factor authentication (MFA) for Oracle Database. Oracle Database 19c now supports the RFC 6613 and 6614 guidelines for RADIUS and implements TCP over Transport Layer Security (TLS) by default. This enhancement introduces new RADIUS-related sqlnet.ora parameters to support the new standards. The enhancement also deprecates several RADIUS-related sqlnet.ora parameters that are no longer needed to support the new standards.

This update to RADIUS standards support improves security for customers using RADIUS-based authentication.

View Documentation

IF [NOT] EXISTS Syntax Support

DDL object creation, modification, and deletion now support the IF [NOT] EXISTS syntax modifiers. This enables you to control whether an error should be raised if a given object exists or does not exist.

The IF [NOT] EXISTS syntax can simplify error handling in scripts and by applications.

View Documentation

Multi-Factor Authentication for Database Authentication

You can enhance Oracle Database security by enabling multi-factor authentication for users. You can use push notifications through the Cisco Duo or Oracle Mobile Authenticator app or combine a username and password with PKI (Public Key Infrastructure) certificate-based authentication.

Multi-factor authentication is a required security requirement for many databases, especially if the database holds sensitive data.

View Documentation

Oracle Database Cloud Backup Module for Azure Blob Storage

The Oracle Database Cloud Backup Module for Azure Blob Storage enables Oracle Database to send backups to and recover from Microsoft Azure Blob Storage. This backup module is compatible with Oracle Databases deployed on-premises or on Azure cloud. Support for writing backups to Azure Blob Storage for Oracle-managed database services is not available. Database administrators can use RMAN commands, RMAN scripts, and Oracle Enterprise Manager to perform backup and recovery operations with Azure Blob Storage.

You can run Oracle Databases in many different locations, and the backup module for Azure Blob Storage provides on-premises and Azure virtual machine users with more flexibility for backup storage locations.

View Documentation

Oracle Update Advisor Support with Oracle FPP

You can leverage Oracle Update Advisor with Oracle Fleet Patching and Provisioning (Oracle FPP). Oracle Update Advisor is a software recommendation framework that analyzes the health of Oracle Database and Oracle Grid Infrastructure, provides patch recommendations, and creates fully functional gold images based on your patch maintenance policy. These gold images are downloaded automatically into the Oracle FPP Gold Image repository.

Using Oracle Fleet Patching and Provisioning in conjunction with Oracle Update Advisor greatly simplifies and streamlines the update experience. You can use the Oracle Update Advisor for both Oracle FPP Local Mode and Oracle FPP Central Server Mode.

View Documentation

Schema Annotations

Schema annotations enable you to store and retrieve metadata about database objects. These are name-value pairs or simply a name. These are free-form text fields applications can use to customize business logic or user interfaces.

Annotations help you use database objects in the same way across all applications. This simplifies development and improves data quality.

View Documentation

SQL Diagnostic Report

The SQL diagnostic package (DBMS_SQLDIAG) includes a new function called REPORT_SQL which generates a zip archive containing a deep-level HTML diagnostic report for a specified SQL statement. The report includes important diagnostic information such as a plan history, non-default database parameters, optimizer statistics history, statistics status, index details, and more. The archive will also include, where available, captured SQL Monitor reports for the SQL.

This feature makes it easier to diagnose SQL performance issues.

View Documentation

Application Identity Logon

• Array Limits for JSON-Relational Duality Views
• Cross-Table Data Grant Support
• Deletable Shared Tables for JSON-Relational Duality Views
• Intelligent Drain Timing
• Log-Buffer-Space-Based Auto Redo Prioritization
• MAA Client Readiness
• OCI API Functions to Validate and Protect Inputs
• Oracle AI Database as a Redis Server
• PDB Target Redo Generation Management
• Scalar Quantization Support for Distributed HNSW Indexes
• Setting Multi-Factor Authentication for Local Deep Sec End User
• Support for DATEADD Function
• Transport-Lag-Based Auto Redo Prioritization
• Unicode 17.0 Support
• User-Defined Identifying Keys for JSON-Relational Duality Views
• Using OCI IAM DB Token to Authenticate with Deep Data Security

This document contains release notes for the changes in MySQL 9.7.

Legal Notices

Copyright © 1997, 2026, Oracle and/or its affiliates.

License Restrictions

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software, software documentation, data (as defined in the Federal Acquisition Regulation), or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs (including any operating system, integrated software, any programs embedded, installed, or activated on delivered hardware, and modifications of such programs) and Oracle computer documentation or other Oracle data delivered to or accessed by U.S. Government end users are "commercial computer software," "commercial computer software documentation," or "limited rights data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, reproduction, duplication, release, display, disclosure, modification, preparation of derivative works, and/or adaptation of i) Oracle programs (including any operating system, integrated software, any programs embedded, installed, or activated on delivered hardware, and modifications of such programs), ii) Oracle computer documentation and/or iii) other Oracle data, is subject to the rights and limitations specified in the license contained in the applicable contract. The terms governing the U.S. Government's use of Oracle cloud services are defined by the applicable contract for such services. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Trademark Notice

Oracle, Java, MySQL, and NetSuite are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Inside are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Epyc, and the AMD logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Use of This Documentation

This documentation is NOT distributed under a GPL license. Use of this documentation is subject to the following terms:

You may create a printed copy of this documentation solely for your own personal use. Conversion to other formats is allowed as long as the actual content is not altered or edited in any way. You shall not publish or distribute this documentation in any form or on any media, except if you distribute the documentation in a manner similar to how Oracle disseminates it (that is, electronically for download on a Web site with the software) or on a CD-ROM or similar medium, provided however that the documentation is disseminated together with the software on the same medium. Any other use, such as any dissemination of printed copies or use of this documentation, in whole or in part, in another publication, requires the prior written consent from an authorized representative of Oracle. Oracle and/or its affiliates reserve any and all rights to this documentation not expressly granted above.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc .

Access to Oracle Support for Accessibility

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.