openSUSE-SU-2026:22224-1

This update for rqlite fixes the following issues:

Changes in rqlite:

• Update to version 10.6.6:

  • Keep the local auto-backup file if the metadata rename fails
  • Reject local auto-backup filenames reserved for internal use
  • POST /demote and POST /promote return a JSON error body, and 404 when the target node is not in the cluster.
  • DELETE /remove returns a JSON error body.

• Includes changes from version 10.6.5:

  • Guard the inter-node backup stream handler directly against a missing backup request
  • POST /leader returns a JSON error body, and 404 when the target node is not in the cluster

• Update to version 10.6.4:

  • BACKUP_STREAM authorization failures can disclose the database and crash rqlited (boo#1286934)
  • GET /leader returns a JSON error body when there is no leader
  • Close the connection after rejecting an unauthorized inter-node backup stream request, instead of streaming the database anyway
  • Decide inter-node command authorization once, before dispatch, and close the connection after rejecting any unauthorized command

• Update to version 10.6.3:

  • Node probes honor request context and commit exactly one result
  • Make DB connections a first-class object
  • Prevent ATTACH on the query database connection

• Update to version 10.6.2:

  • Check for trailing junk in request bodies
  • Console schema view handles table names that collide with JavaScript object properties
  • Set CommitTimestamps in CDC Events Group
  • Upgrade dependencies

• Update to version 10.6.1:

  • Use constant-time comparison when comparing passwords
  • Conditionally rewrite SQL during queued writes and fix rewriting of CURRENT_TIMESTAMP and related tokens
  • More robust Leader stepdown node ID detection, reap checks, and SQL analyze start-time recording
  • CDC fixes: encode non-finite floats, always release flush waiters, and make the HTTP sink follow redirects
  • Converted _service from mode=disabled to mode=manual (legacy leftover; services are run by hand via osc service manualrun)
  • Package is not affected by CVE-2026-84445 (boo#1278793), CVE-2026-84304 (boo#1279102), CVE-2026-84303 (boo#1279253): vendored grpc is v1.84.0, above the v1.83.1/v1.83.2 fixes
  • Package is not affected by CVE-2026-89090 (boo#1280657): vendored eventstream is v1.7.20, above the v1.7.8 fix
  • Package is not affected by CVE-2026-63209 (boo#1283555): vendored klauspost/compress is v1.20.1, above the v1.18.7 fix
  • Package is not affected by CVE-2026-39821 (boo#1266544): vendored golang.org/x/net is v0.59.0, above the v0.55.0 fix

• Update to version 10.6.0:

  • API addition: error_v2 may contain numeric SQLite error codes.
  • addresses a security issue related to Authentication files. A user with no explicit permissions could be grant elevated permissions. Correctly configured users do not suffer from this issue.
  • multiple implementation changes and bug fixes
  • Display interactive cluster topology on web console.
  • Support configurable queued-writes retries
  • release addresses a gap in the role-based access permissions related to change-data-capture (CDC) handling

• Update to version 10.3.6:

  • Add query logging to database layer
  • Snapshot IDs now contain (optional) generation
  • Bump generation ID if snapshot IDs collide
  • Snapshots can be filtered by term and index
  • Add support for File Renaming and Removing with retries
  • Replace standard library with fsutil
  • Keep snapshot ordering correct regardless of clock
  • Remove snapshot name generation ID

• Update to version 10.3.5:

  • Reject alternate form of unsupported PRAGMA commands
  • Handle negative trailing logs
  • Sync access to last backup time at http layer
  • Set the "Served by" header before first backup byte
  • Set DB load response time for all formats
  • Fix HTTP logic error for queued statements
  • Minor web console fixes

• includes changes from 10.0.4:

  • Do not emit rolled-back events over CDC

• includes changes from 10.0.3:

  • Refactor busy timeout methods
  • Fix edge-case bugs detected by GPT-6 Astra
  • Switch to quay.io/minio/minio:latest for testing purposes
  • Fix removing a node with different ID, but same Raft address
  • Use correct Foreign Key setting when recovering node
  • Only dump the indexes and triggers of the selected tables
  • Detect DB changes during Request(RETURNING)
  • Snapshot Open() first checks for failed reap
  • Sync snapshot plan directory
  • Propagate WAL stat errors
  • Clean up cancelled snapshots
  • Reject incomplete snapshot headers
  • Validate restore database header
  • Only reap a sole fullsnapshot if it has zero WALs
  • Keep database dumps consistent during writes to the database
  • Roll back DB Requests on statement-prepare errors

• includes changes from 10.0.2:

  • Upgrade SQLite driver
  • Unit test reaping an installed Snapshot and streamed Snapshot combo
  • Use distinct Snapshot Namer type
  • Replace breaking-pragma regexes with ASCII prefix scanning
  • Consolidate pragma and txStatus reads onto a single connection per pool
  • Fix some magic strings in db package

• Update to version 10.3.1:

  • Consolidate SQLite driver construction
  • Plumb Term and Index through during Snapshot Restore
  • Hard exit if FSM Restore fails post database-swap

• Update to version 10.3.0:

  • Console app supports quickly querying for first 100 rows of a table
  • Rename read-only nodes to read replicas. Command-line flags unchanged
  • Bundles dependencies updated
  • Add infra for pushing OTLP metrics to an OpenTelemetry Collector
  • Add query logging at database level
  • Add CopyDir functionality to file utils.
  • Add ability to clone Snapshots, primarily for testing purposes
  • Store Index and Term in Fingerprint file and check during start-up

• Update to version 10.2.7:

  • Remove explicit database-level read-only check from the pure Query path
  • Miscellaneous Store-level fixes related to resource management and shutdown sequence
  • Don't run CRC checks twice on Snapshot when fast-restart is explicitly disabled
  • Fixes to the http package including SQL rewriting control.
  • Address potential dropped CDC event on restart
  • Various minor fixes

• includes changes from 10.2.6:

• Handle a fully-executed Reap plan, but Plan file itself not removed
• Close Snapshot streamer on error.

• includes changes from 10.2.5:

  • Perform a Quick Integrity check after reaping snapshots, not Full

• Update to version 10.2.4:

  • Fix some non-AWS S3-compatible stores

• includes changes from 10.2.3

  • Check snapshot store integrity before first actual use
  • Disable HTTP timeout for boot and restore operations via the shell
  • HTTP layer ignores ErrNoWALToSnapshot when snapshotting
  • Close Snapshot Streamer ASAP when restoring to local node