TDengine 3.4.3.9 Release Notes

Release date: 2026-11-02

Release type	Recommended for
Monthly release	Users of federated query, stream processing, virtual tables, taosX OPC DA, or Kepware ingestion

1. Highlights

• Federated query: Linux can query SQL Server and Oracle. Windows can query SQL Server, MySQL, PostgreSQL, and InfluxDB. External tables and virtual-table external sources can use these data sources.
• Neuron: taosExplorer can write data collected by Neuron or NeuronEX into TDengine through eKuiper, and complete onboarding, refresh, and monitoring on the Data Collection Agents page.
• Kepware: taosExplorer and taosX can connect to Kepware Server 7.1, scan OPC UA points, and ingest them by subscription or polling into a selected database.
• Security fixes: Malformed metadata, WAL, query, stream, subscription, and sync input that could crash taosd or cross a buffer is rejected.

2. Features

2.1 Query, stream processing, and federated query

• Federated query can register on-premises SQL Server 2019 and 2022 as an external source and query its tables and views. On Linux it can also register Oracle. On Windows it can register MySQL, PostgreSQL, InfluxDB, and SQL Server. External tables and virtual-table external sources support these types. See Federated Query.
• A stream can use a virtual table that references SQL Server columns, and mix those columns with local columns. A short reference and an explicit database or schema reference identify the same remote table. Completed window results are kept after a reference is rebound.
• The new aggregate function BIT_DURATION measures how long an integer or boolean point stays in a masked bit state. It can be used in windows and stream processing. Available from v3.4.3.7. See BIT_DURATION.
• SHOW CREATE TABLE, SHOW CREATE STABLE, SHOW CREATE VTABLE, and SHOW CREATE RSMA accept FULL. With FULL, the complete statement is returned as a BLOB and is no longer truncated at 65535 bytes. Without FULL, the result is still a truncated VARCHAR. See SHOW CREATE.
• Every stream notification event includes triggerTableName. For PARTITION BY tbname it is the trigger child-table name without a database prefix. A virtual child table uses the virtual child-table name. Otherwise the value is an empty string. See Notification Mechanism in Stream Processing.

2.2 Subscription, ingestion, and taosExplorer

• Table and database subscriptions accept msg.consume.start.ts. Only rows whose primary timestamp is at or after that Unix time in milliseconds are consumed. The default is 0, which does not filter. Column subscriptions are unchanged. See msg.consume.start.ts.
• An OPC DA point task accepts a PI-compatible quality mode and a digital-state value map. Migration tools can rebuild a PI archive on a PI server, then replay and map the points onto existing TDengine tables through OPC DA. See OPC DA.
• taosExplorer can write data collected by Neuron or NeuronEX into TDengine through eKuiper, and complete onboarding, refresh, and monitoring under Data In on the Data Collection Agents page. See Neuron.
• taosExplorer and taosX can connect to Kepware Server 7.1. They can scan OPC UA points, choose subscription or polling, and write the points into a selected database. Onboarding can also be completed at install time. See Kepware.
• After a taosX node fails, the Agent confirms that the previous task has exited before the taking-over node starts the same task. A stale start, stop, or cancel cannot take the task back. If the exit cannot be confirmed, takeover fails and two copies do not run at once.
• The self-hosted taosExplorer SQL editor can set the frontend timeout for the current execution. The default is 60 seconds, and the range is 1 to 3600 seconds. A request timeout shows a yellow warning and does not cancel a query that is still running on the server.

2.3 Client and TDgpt

• The native client can record connections, SQL, STMT, and schemaless calls at the public API boundary. workloadRecord defaults to 0 and is read only when the client starts. Set it to 1 and restart that client to start recording. workloadRecordDir defaults to workload under the log directory. workloadRecordBufferSize defaults to 256 MB, with a range of 16 to 4096. If disk writes fall behind, that client's business threads block. taosreplay is built from source on Linux only and is not included in the installation package.
• TDgpt adds principal component analysis (PCA), partial least squares (PLS), and KMeans, DBSCAN, and GMM clustering. The clustering interfaces can be called through REST only, not through SQL.

3. Enhancements

3.1 Query

• information_schema.ins_tables filtered by table_name with equality or IN uses the table-name index instead of scanning every table in the vnode.
• Querying information_schema.ins_tags by table name reads that child table's tags directly. Equality filters on database, super table, and table name are applied before the scan, so a database with many child tables no longer walks all metadata. (#35778)
• When a query of information_schema.ins_databases does not request ntables, taosd no longer scans every vgroup to count tables. The columns and the ntables values are unchanged.
• Creating or querying a virtual table with a very large number of columns resolves column references by column id, so SQL analysis no longer scans every column repeatedly.
• A virtual super-table query uses less client memory to hold column and tag references.
• Query and stream processing walk node lists in order. With many nodes, the cost grows linearly with the node count.
• Single-table SUM, AVG, and COUNT on a tag, and INTERVAL queries partitioned by tags, run faster.
• A super-table INTERVAL query that also has LIMIT can use the INTERVAL_LIMIT() hint to stop scanning after the windows it needs. The hint takes no parameters and does nothing unless it is written in the statement. See INTERVAL_LIMIT.
• Most BLOB column queries are faster. A qualifying count(blob) uses the block-level pre-aggregation again. Some medium-length SELECT BLOB queries can be slower, and they use more memory.
• A super-table last_row query grouped by child table starts returning rows before the cache scan finishes, so a query over many child tables returns sooner. (#35795)
• A query that does not include a BLOB column no longer checks the BLOB length of every row. (#35745)
• With DEBUG logging enabled, scalar calculation no longer writes a debug log for every column argument, and JOIN is no longer slowed by those logs. (#35775)
• A grouped last() query no longer keeps a stale null flag on a reused scan block. Reader timing logs for each query are DEBUG instead of INFO. (#35737)
• Query-plan decoding reuses a parsed timezone handle and no longer reloads timezone data for the same process. (#35781)
• When an interval query uses only the table name or a single tag as its group key, each scan block keeps one copy of that key instead of copying it into every row. Query results stay the same.
• Federated query is now tested with PostgreSQL 18.6. Supported versions remain 14 and later. See External Database Versions.

3.2 Stream processing and XNode

• When a stream reads calculation data from an external table, the time range follows the time expression in the calculation statement. A window join trims only the side that references those time columns. A due PERIOD window is no longer skipped by idle throttling.
• A stream that uses an explicit SLIDING and IGNORE_NODATA_TRIGGER no longer creates an empty window for every step of a long gap. Window results are unchanged, and other groups are no longer held back by that gap. (#35785)
• After an XNode failure or an Agent reconnect, Agent tasks that should keep running are recovered automatically.
• xnodeDsnProtection, xnodeDsnPublicKeyFile, and xnodedDsnPrivateKeyFile can be changed with SQL. The values are saved and take effect after taosd restarts. xnodeDsnProtection is a global parameter, default 0. Change it with ALTER ALL DNODES. A change on a single dnode fails. The two key paths are local parameters and are changed with ALTER DNODE. The private-key paths of taosExplorer and taosX are still set in their own configuration files.

3.3 Client and taosExplorer

• libtaos.so no longer depends on libtaosnative.so. A client that uses only WebSocket can load the library by itself.
• taosExplorer no longer bundles the user manual. The Chinese and English manuals are installed separately. If the manual for a language is not installed, the help entry opens the official website instead of returning 404.
• taosX data-source plugins are installed separately. A host without the plugin cannot run that data-source task. taosExplorer still lists the data source and names the missing plugin and package.
• The taosExplorer browser tab uses the same favicon as the official documentation.

4. Fixes

4.1 Severe issues

• The InfluxDB connector can exit before its read thread starts. The migration task is reported as successful, but no data is written. Affected versions: all versions. (#35729)
• A group-window stream can still emit an empty aggregate when a group has no valid input on a vgroup. The output order is wrong, and the stream enters Failed. Affected versions: v3.4.2.9 through v3.4.2.14. (#35786)
• Allocating a free TDB page rewrites the page before the rollback log is written. After an unexpected restart the free-page chain can be corrupted, and the next allocation exits on an illegal page number. Upgrading does not repair a TDB file that is already damaged. Such a file can still appear as an oversized file or an illegal page number. Affected versions: all versions. (#35767)
• After an encrypted backup fills one encrypted block, the buffer length is not cleared, so later writes can repeat old data and restore then reports Invalid message. Affected versions: v3.4.3.3 through v3.4.3.4. (#35769)
• v3.4.3.5 rejects stream checkpoints written by v3.4.3.0 through v3.4.3.4, reports Invalid message, and the stream enters Failed. This release can read those checkpoints again. Affected versions: v3.4.3.5. (#35749)
• A virtual-table stream crashes taosd during history calculation when a condition compares a column that the filter has made empty. Affected versions: v3.3.0 and later. (#35762)
• A client crashes when a virtual super table aggregates by source-table tags and the time condition can be pushed down. Affected versions: v3.4.0 and later. (#35794)
• When a stream task is destroyed, the data cache is freed before the iterator that still uses it, so taosd touches freed memory during shutdown. Affected versions: v3.3.8 and later. (#35783)
• A stream that uses %%trows crashes taosd out of bounds when a window contains a variable-length column and the row order differs from the write order. Affected versions: v3.3.8 and later. (#35784)
• taosX OPC UA collection does not close the session after a subscription failure, a reconnect, or task exit. Sessions accumulate, later connections are refused, and the task cannot start again. Affected versions: all versions. (#35752)
• Repeatedly querying information_schema.ins_tables by UID over a short time to obtain virtual child-table names can exhaust taosd resources. Affected versions: all versions. (#35751)
• The outer filter of a state-window stream is applied before results are written. Windows that do not match are no longer emitted. At the end of history backfill, a trailing window that has not reached TRUE_FOR no longer triggers calculation. Affected versions: v3.3.7 and later. (#35790)
• After a stream is dropped and recreated with the same name, a stale deployment action no longer keeps the deployment state. Unfinished management state is also released when deployment fails or a runner task is undeployed, so taosd memory no longer keeps growing for this reason. Affected versions: v3.3.7 and later. (#35782)
• During a slow taosd startup, the stream heartbeat is no longer sent before the message callbacks are registered, so startup no longer crashes on that path. Affected versions: v3.3.7 and later. (#35741)
• A taosKeeper report no longer crashes taosd when a monitor metric label contains a comma, equals sign, quote, or brace. Those characters are replaced with underscores when the label is written. Affected versions: v3.3.7 and later. (#35758)
• A virtual-table stream with PRE_FILTER and referenced TAGs no longer prunes every source table. Before the fix the stream could stay RUNNING and produce no output. Affected versions: v3.3.8 and later. (#35760)
• A virtual-table stream no longer retries the virtual-table patch until the trigger is stuck on Invalid parameters after a virtual table changes at runtime. Affected versions: v3.3.8 and later. (#35763)
• A virtual-table stream with NODELAY_CREATE_SUBTABLE no longer stops on Retry needed or Internal error when initialization responses arrive out of order. Output child tables are still created early. Affected versions: v3.3.8 and later. (#35764)
• After a stream restarts or is redeployed, it no longer reports WAL log does not exist repeatedly and stays without output when the requested WAL has been reclaimed. It continues from the WAL that is still retained. Affected versions: v3.3.7 and later. (#35757)
• After real-time progress has advanced and the automatic recalculation queue is empty, a later delete with no further writes no longer leaves delete recalculation pending, so the result table no longer misses those rows. Affected versions: v3.4.2 and later. (#35788)
• After taosX OPC exits abnormally and restarts, a blocked metric report or OPC DA initial connection no longer leaves the task running with no data written. Affected versions: v3.4.2 and later. (#35753)
• A stream that reads a data column added directly on a virtual child table could miss the column reference and return an empty or NULL result. Dropping an unused owned source no longer fails calculations on inherited columns. Affected versions: v3.4.3 and later. (#35756)
• A stream that uses a virtual table as its source no longer stops grouping when a referenced TAG is empty, shorter than the type header, or a fixed-length TAG is NULL, so the result table can keep producing rows. Affected versions: v3.4.3 and later. (#35747)

4.2 Query and virtual tables

• After parsing ALTER on a virtual-table SERIES, the alias, external source name, and tag condition are no longer leaked. Repeating the statement no longer keeps consuming client memory. (#35791)
• A virtual-table query with ORDER BY ts and LIMIT pushes down the sort direction and the row limit, instead of scanning every row and then sorting the full result. (#35761)
• When a virtual-table column is narrower than its source column, UNION and UNION ALL use the wider column and no longer report invalid input. (#35793)
• Casting DECIMAL to VARCHAR, BINARY, or BLOB no longer reads past the buffer when the target width cannot hold the full text. (#35750)
• After SQL Server stops, a federated query fails at the configured connect_timeout_ms and is no longer held by the driver's internal retries. A normal connection is unchanged. (#35733)
• When Arrow is built from source on a non-Windows platform, the bundled Thrift uses the project's OpenSSL 3.1.3, so a macOS build no longer picks an incompatible OpenSSL 4. (#35797)
• The user manual now states that FIRST and LAST take a non-primary timestamp along the valid timeline, and are not equivalent to ORDER BY ... LIMIT 1 on the argument column. (#35765)
• The user manual now states that when a user and a role hold the same kind of privilege, the user privilege is used. If the user has none, the privilege of the role with the later update time is used. (#35766)
• An ordinary inner join whose inputs are already ordered by the primary timestamp, with an extra equality on a column or tag, defaults to Merge Join again instead of Hash Join. The result set is unchanged. (#35746)

4.3 Stream processing and virtual tables

• An EVENT_WINDOW with a single start condition and TRUE_FOR also sends a historical OPEN notification when the window is still open at the end of the history scan but the duration is already satisfied. (#35771)
• In an explicit transaction, after CREATE STREAM creates an output super table or a NODELAY normal table, the current transaction can see that table once the statement returns successfully. (#35780)
• After a virtual-table column is rebound, a stream redeploy that does not finish within 60 seconds no longer retries forever. It returns a definite error and the stream enters Failed. A redeploy that finishes within 60 seconds is unchanged. (#35792)
• When a stream uses only some columns of a virtual table, rebinding an unused column no longer adds a calculation reader and causes an unnecessary retry. Rebinding a column that is used in the calculation or in WHERE still deploys a reader when needed. (#35755)
• A stream whose source is a virtual super table no longer asks mnode for the database route again while resolving tag references, and no longer expands unused column references. (#35754)
• After a virtual-table stream is created without FILL_HISTORY, the trigger thread no longer stays at full CPU because it immediately sets up the history context and matches every virtual table in each group. (#35768)
• The handle of an external pull request for a stream is released when the response is dropped, so that path no longer leaks memory. (#35787)
• A failed decode of a super-table heartbeat response or table metadata releases the partially decoded data, so this error path no longer leaks memory. (#35796)

4.4 Storage, cluster, and subscription

• With multiple disks mounted at level 0, WAL retention and rollback delete WAL files on the non-primary mount. Those files no longer keep the disk usage growing. (#35726)
• If BALANCE VGROUP LEADER cannot add a vgroup to the balance transaction, it records that vgroup, the database, and the reason. (#35727)
• Restoring a vnode from a snapshot, including REDISTRIBUTE VGROUP, chooses the storage level from the file time and KEEP instead of writing every file to level 0. (#35777)
• SPLIT VGROUP on a vgroup_id that does not exist reports that the vgroup is missing instead of returning success. (#35772)
• After SPLIT on a double-replica database with an arbitrator, SHOW ARBGROUPS drops the source vgroup's arbgroup and creates one for each of the two resulting vgroups. (#35774)
• Arbitrator assignment of a vnode leader always checks the member token. force can no longer skip the check, and a request that fails the check cannot make the vnode an assigned leader. (#35748)
• A super-table subscription with ONLY META or WITH META filters child tables by the WHERE condition in the metadata snapshot. When a child-table name is specified, create-table events for every child table are no longer pushed to the consumer. (#35730)
• A consumer that does not set session.timeout.ms now uses 45 seconds instead of 12 seconds. A delayed heartbeat no longer removes the consumer from the group for that reason. (#35773)
• When an unsubscribe overlaps a rebalance commit, a stale rebalance result no longer sets the consumer back to ready. A topic that was just unsubscribed can be deleted immediately. (#35789)
• With monitor protocol logging enabled, taosd estimates the number of lines in a multi-line JSON payload from its size, and log files rotate and compress according to numOfLogLines. (#35776)
• If a log file is writable but its mode cannot be changed to 0666, taosd and taos no longer fail to start. They keep the existing mode and emit a warning. (#35779)

4.5 Write, client, taosX, and taosExplorer

• A C/C++ client no longer leaks memory when writing with STMT2 parameter binding. On a fixed table without interlace, the next successful write after an execution error still keeps the bound fixed tags. (#35728)
• A schemaless create of an existing super table can no longer change the type of an existing column or tag, shrink its width, or drop it. A variable-length type can still be widened. taosX likewise cannot change a type or shrink a width, but cross-cluster replication can still drop a column or tag. (#35738)
• taosdump backups now use SHOW CREATE ... FULL. A virtual table with many columns is no longer omitted because the statement was truncated. Import no longer fails with Row length exceeds max length for that reason. (#35743, #35744)
• On Windows, the ready probe for xnoded when creating or restarting an XNODE waits up to 3 seconds instead of 100 milliseconds. An xnoded that has already started is no longer treated as unreachable and stopped. (#35735)
• On Windows, taosd, taosAdapter, taosKeeper, taosX, and taosExplorer restart automatically after an abnormal exit, at 10, 30, 90, 180, and 300 seconds, at most five times, and then stop restarting. (#35734)
• When taosdump imports AVRO, the schema pre-check no longer reports a table that was just created as missing. A failed database creation stops the rest of the import, and child-table creation shows progress. (#35742)
• The Rust WebSocket documentation example no longer panics on a zero-capacity buffer assertion when creating a database with tokio 1.54 or later. (#35732)
• A task run through a taosX Agent no longer stays queued after a start failure while the Agent is disconnected. It starts automatically after the Agent connects again. (#35759)
• In taosExplorer, an empty point list for a pSpace data source shows an error instead of an empty popup. On Chrome and Edge 86, the metrics dialog after a task starts no longer shifts off the page and can be scrolled. (#35739)
• A TDgpt model no longer stays in started, with the load API returning 500, after a container restart or a killed worker. State is reconciled from live processes and installed files at startup and before each request. (#35736)
• A fixed-length OPC DA string keeps only the content before the first NUL by default, and no longer writes the NUL or the characters after it into TDengine. OPC UA is unchanged. The raw data dump still keeps the full value from before truncation. (#35731)
• taosX no longer queries the target database KEEP and precision before every write batch. The same task reuses the previous result while the cache is valid, for 1 hour by default. (#35740)

5. Security

5.1 Vulnerability fixes

See Security Advisories.

• The TMQ client checks field lengths and the remaining message while decoding an ask-ep response. An overlong topic, database name, or FQDN is rejected and no longer overflows the client stack. CWE-121.
• WAL recovery no longer treats a forged frame header inside a record body as a new log record, and does not adopt a forged index or truncate the log from it. An illegal record length no longer crashes taosd or stalls recovery.
• Query execution and stream processing check a data block against the planned column widths while decoding it. An illegal block returns an error. Normal query results are unchanged.
• ALTER STABLE no longer continues when the field array is empty or the lengths do not match, which avoids an mnode crash. CREATE TSMA no longer stores a query syntax tree that would later be read as the wrong type. SHOW STABLES no longer writes past a stack buffer while joining rollup function names. A stream pull request that lacks runtime information no longer crashes taosd.
• CREATE STREAM rejects a client calculation plan whose node type is wrong or that lacks a required child node, and rejects a request that lacks a name, database, or table name. DROP XNODE JOB and REBALANCE XNODE JOB reject a WHERE condition that is null or missing an operand. A nested batch metadata request is rejected, and a batch shorter than the message header is no longer written. CWE-674. Querying information_schema.ins_dnode_variables no longer uses an illegal system-table type index.
• When a super table is created, the length of a fixed-width column must fall in the range allowed for that type. An illegal length is rejected and is no longer written as an out-of-range column width into subscription and stream blocks.
• snode checks the length, runtime parameters, and task type of stream checkpoint, fetch, calc, and drop messages, and rejects malformed input.
• Query metadata and EXPLAIN messages are checked for length, counts, and pointers before use. SHOW CREATE output has additional bounds checks. A backup falls back to another statement builder when the create statement exceeds the buffer.
• When mnode applies a committed metadata record, it checks the record header length and type. A length that is out of range, or a direct write that bypasses the transaction, is rejected. Subscription metadata decoding checks string lengths and entry counts, so overlong content from a peer no longer overflows the mnode heap.
• In the community edition, GRANT or a role change no longer uses an uninitialized user object. User and session administration checks privileges, so an unauthorized user can no longer set a TOTP secret, end another user's session, or change a role.
• SHOW VARIABLES no longer returns sensitive configuration such as the object-storage access string, including for a user who can view configuration. In the community edition, security and audit configuration is masked. An unauthenticated connection can no longer fetch the full global configuration. Configuration sync inside the cluster still uses the real values.
• Temporary files written by a query use a random name, exclusive create, and owner-only permissions, and no longer follow a symlink planted in tempDir. CWE-59.
• The Grafana data-source plugin upgrades kin-openapi from 0.144.0 to 0.149.0. The upgrade fixes CVE-2026-100347 (GHSA-fh4f-47mf-f2gj), CVE-2026-100348 (GHSA-mh7x-f8wq-4jhx), CVE-2026-100351 (GHSA-23vg-4cjm-66q5), CVE-2026-100352 (GHSA-rj39-cv6w-8wv7), CVE-2026-100353 (GHSA-vrcc-3ch7-hppw), and CVE-2026-100354 (GHSA-g8cf-rcjf-c8cf).
• The JDBCDemo example upgrades jackson-databind from 2.18.9 to 2.18.10 and fixes CVE-2026-83557 (GHSA-gx83-3vf8-gh7j). Server behavior is unchanged.
• Creating or altering a vnode checks the upper and lower bounds of the replica count and the learner count, and rejects a vgroup configuration that names an unregistered dnode. An out-of-range request is rejected and no longer overflows the stack. TD-SEC-2026-034, GHSA-c6c6-fm4m-fj5w. A CVE has not been assigned. The security advisories page does not yet have this entry.
• A dnode rejects invalid management messages and forged responses. Configuration outside the dynamic range is no longer applied.
• Sync timeout and election-timeout messages are no longer accepted from the network. An unauthenticated peer can no longer force a new election with those messages, or write a Raft log. A vote request that claims to come from the node itself, or from the current leader in the same term, is dropped. A leader counts a replica only up to the log it actually sent, so a forged acknowledgement can no longer invent a quorum. Assigning an arbitrator-group leader requires a privilege check. Once a node has a recorded machine id, a status heartbeat must carry the same id.
• An append-entries frame, a snapshot send, and a snapshot reply must contain the full header before any field is read. The declared data length also cannot exceed the bytes left in the frame. A truncated or oversized frame is rejected and no longer causes an out-of-bounds read. These are follow-up fixes for GHSA-q86r-32wm-qwpg and GHSA-xg67-9f8r-64v5. The security advisories page does not yet have separate headings for them.
• Decoding a transaction raw record checks field lengths with an unsigned range, so an oversized length no longer wraps, makes mnode allocate a huge buffer, and crashes.
• Creating a super table requires precision and scale for DECIMAL and DECIMAL64 columns. A column without them is rejected, so querying information_schema.ins_columns no longer crashes mnode for that reason.
• A JSON tag index rejects an overlong column name. A filter result shared by a nested condition is released only once.
• The client checks server-declared column widths, compressed lengths, and batch message lengths before copying them, and disconnects with an error when a length exceeds the limit instead of writing past its local buffer. Tags, rows, and columns are checked against their actual length before use.
• Scalar functions, aggregate functions, and UDFs use tighter length and buffer checks. Scalar AES_ENCRYPT now uses the full 16-byte initialization vector. AES_DECRYPT requires legacy to read CBC ciphertext written by SELECT before the correction. See AES_DECRYPT.
• The Python WebSocket connector upgrades rkyv from 0.8.16 to 0.8.18, fixing RUSTSEC-2026-0233, RUSTSEC-2026-0234, and RUSTSEC-2026-0235. rustls is upgraded from 0.23.45 to 0.23.46 and rustls-webpki from 0.103.14 to 0.103.16, fixing RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, RUSTSEC-2026-0349, and RUSTSEC-2026-0382. pyo3 is upgraded from 0.17.3 to 0.29.3, fixing RUSTSEC-2026-0177 (GHSA-chgr-c6px-7xpp) and RUSTSEC-2025-0020 (GHSA-pph8-gcv7-4qj5). tokio is upgraded from 1.43.1 to 1.53.3. Installing this connector requires Python 3.8 or later.
• The Rust connector upgrades rustls-webpki from 0.103.14 to 0.103.16, fixing RUSTSEC-2026-0382. event-listener is upgraded from 5.4.0 to 5.4.2, fixing RUSTSEC-2026-0221.
• TDgpt upgrades keras to 3.15.0 on Python 3.11 and later, and to 3.12.3 on earlier Python. Version 3.12.3 fixes CVE-2026-12479 (GHSA-gh82-f9x8-5frx), CVE-2026-12480 (GHSA-26c4-7vv6-867j), CVE-2026-12481 (GHSA-5gwj-m78q-7pq3), CVE-2026-12482 (GHSA-58hv-7753-xmfq), CVE-2026-12484 (GHSA-v2w2-w228-c444), and CVE-2026-9335 (GHSA-m8wh-29wm-52mv). Version 3.15.0 also fixes CVE-2026-1462 (GHSA-4f3f-g24h-fr8m) and CVE-2026-12570 (GHSA-74m6-m3xx-3vmj). The time-series foundation-model dependency upgrades pyarrow to 23.0.1, fixing CVE-2026-25087 (GHSA-rgxp-2hwp-jwgg).
• taosX upgrades anyhow from 1.0.102 to 1.0.103 (RUSTSEC-2026-0190), event-listener 5.4.1 to 5.4.2 (RUSTSEC-2026-0221), tokio from 1.52.1 to 1.53.3 (RUSTSEC-2026-0386), libz-sys from 1.1.28 to 1.1.31 (RUSTSEC-2026-0418), and zstd-sys from 2.0.16 to 2.1.2 (RUSTSEC-2026-0403). These advisories have no CVE or GHSA identifier. (#35770)
• The taosX OpenTSDB plugin upgrades Netty from 4.1.118.Final to 4.1.137.Final, fixing CVE-2026-75595. The InfluxDB plugin upgrades bcprov-jdk18on from 1.83 to 1.85, fixing CVE-2025-14813 (GHSA-574f-3g2m-x479).
• The Python connector upgrades certifi from 2026.2.25 to 2026.10.19, and upgrades urllib3 used on Python 3.10 and later from 2.7.0 to 2.8.0. The same lockfile still keeps urllib3 2.0.7. This covers GHSA-6q48-6c7w-9gw2, CVE-2026-114134, PYSEC-2026-4175, PYSEC-2026-4176, and PYSEC-2026-4177.
• taos-insight upgrades dompurify from 3.4.16 to 3.4.17, fixing GHSA-cg2g-xh64-v4q7.

5.2 Hardening

• The transport layer checks unauthenticated messages more strictly and rejects a malformed endpoint set, an overlong telemetry address, a cross-connection task release, and an illegal message type.
• Before mnode forwards monitor statistics, it confirms that the claimed user exists and rejects illegal JSON.
• Stream heartbeat task types and states are checked against the enum range before they are written to logs and SHOW results. Assigning a worker thread by consumer group no longer uses an index that can be negative.

6. Upgrade notes

6.1 Upgrade path

• Versions that can upgrade directly: v3.3.7 and later.
• Rolling upgrade: supported, from v3.4.3.0 through v3.4.3.8.
• Downgrade or rollback: supported, from v3.4.3.0 through v3.4.3.8.
• Minimum client and connector version: v3.4.3.0.

6.2 Behavior changes

• A consumer that does not set session.timeout.ms now uses 45 seconds. The previous default was 12 seconds.
• A super-table subscription with ONLY META or WITH META sends metadata create-table events only for child tables that match WHERE. Filtering by name no longer sends a create-table event for every child table.
• SHOW VARIABLES no longer returns the object-storage access string, including for a user who could view that configuration before. In the community edition, security and audit configuration is masked. An unauthenticated connection can no longer fetch the full global configuration.
• In the community edition, an unauthorized user can no longer set a TOTP secret, end another user's session, or change a role.
• After a virtual-table column is rebound, a redeploy that is still unfinished after 60 seconds puts the stream into Failed instead of retrying forever. Drop the stream on that virtual super table and create it again. A redeploy that finishes within 60 seconds is unchanged.
• Every stream notification event now includes triggerTableName. A consumer that rejects unknown JSON fields must accept this field.
• An EVENT_WINDOW with a single start condition and TRUE_FOR sends a historical OPEN notification that it did not send before, when the window is still open at the end of the history scan but the duration is already satisfied.
• Snapshot restore and REDISTRIBUTE VGROUP choose the storage level from the file time and KEEP, instead of writing every file to level 0.
• On Windows, taosd, taosAdapter, taosKeeper, taosX, and taosExplorer restart automatically after an abnormal exit, at most five times.
• Some medium-length SELECT BLOB queries can be slower and use more memory. A qualifying count(blob) is faster. Results are unchanged.
• The taosX main package no longer includes data-source plugins. Install the plugin for each data source before use. taosExplorer still lists every data source and warns when the selected plugin is not installed. A task can run on an Agent that has that plugin installed.
• To open a local manual in taosExplorer, install the Chinese or English manual package separately. If only one language is installed, the help entry for the other language opens the official website.
• When a taosX Agent task is taken over by another taosX node, the Agent waits for the old task to exit. If the exit cannot be confirmed, takeover fails and two copies do not run at once. This check is present after the Agent is upgraded.
• connect_timeout_ms now limits the whole SQL Server connection wait. When the server is stopped, the query fails at that timeout instead of waiting for the driver's default retry interval.
• Session timezone rules used by a query are cached after the first load in the process and are not read from the system timezone data again. After the system tzdata is upgraded while the process is running, restart taosd and the client application for the new rules to take effect.
• A schemaless write to an existing super table cannot change the type of an existing column or tag, shrink its width, or drop a column or tag. A variable-length type can still be widened. taosX cross-cluster replication can still drop a column or tag.
• SPLIT VGROUP on a vgroup that does not exist returns an error instead of success.
• Scalar AES_ENCRYPT now uses the full 16-byte initialization vector. To read CBC ciphertext saved before the correction by SELECT or INSERT INTO ... SELECT, AES_DECRYPT needs the original key, the original 16-byte IV, and legacy. ECB ciphertext, ciphertext from INSERT ... VALUES, and ciphertext written after the correction still use the original two-argument or three-argument call. An initialization vector that is not 16 bytes returns a parameter error.
• taosdump backups now run SHOW CREATE with FULL. A create statement longer than 65535 bytes is written in full.
• The minimum Python version for installing taos-ws-py changes from Python 3.7 to Python 3.8. The Python API signatures are unchanged.
• Commas, equals signs, quotes, and braces in monitor metric label values are written as underscores. Other characters are unchanged.
• xnodeDsnProtection, xnodeDsnPublicKeyFile, and xnodedDsnPrivateKeyFile can now be changed with SQL. The change is saved and takes effect after taosd restarts. xnodeDsnProtection defaults to 0.
• An ordinary inner join whose inputs are already ordered by the primary timestamp, with an extra equality on a column or tag, defaults to Merge Join again. The result set is unchanged. Without ORDER BY, the row order can differ from the previous Hash Join.
• An OPC DA string is truncated at the first NUL before it is written. A standalone plugin keeps the full string when truncate_at_nul = false is set in [collect.da]. A task managed by taosX uses the data-source parameter truncate_at_nul=false. Restart the task after the change. An unset value or true keeps truncation. OPC UA is unchanged.
• taosX caches the target database KEEP and precision for 3600 seconds by default. Until the cache expires, a change to KEEP or precision does not apply to later writes.

6.3 Configuration changes

The client adds three recording parameters. taosX adds one cache interval, and OPC DA adds one string-truncation parameter.

Parameter	Purpose
msg.consume.start.ts	Table and database subscriptions consume only rows whose primary timestamp is at or after this Unix time in milliseconds. The default is 0, which does not filter. Column subscriptions ignore it.
session.timeout.ms	How long a consumer may go without a heartbeat before it is removed from the group. For a consumer that does not set it, the default is now 45 seconds. It was 12 seconds.
workloadRecord	Whether the native client records public API calls. The default is 0, which does not record. Set it to 1 and restart that client to start recording. It is read only when the client starts.
workloadRecordDir	Directory for recording files. When unset, it is workload under the log directory. Recording stays off if the directory is unavailable.
workloadRecordBufferSize	Recording buffer, in MB. The default is 256, and the range is 16 to 4096. If disk writes fall behind, that client's business threads block.
TAOSX_KEEP_PRECISION_CACHE_TTL_SECS	Seconds for which taosX caches the target database KEEP and precision. The default is 3600. Until the cache expires, a change to either value does not apply to later writes. An invalid value falls back to the default.
truncate_at_nul	Whether a fixed-length OPC DA string is truncated at the first NUL before it is written. An unset value or true truncates it. false keeps the full string. A standalone plugin sets it in [collect.da]. A taosX task sets it as a data-source parameter. Restart the task after the change. OPC UA is unchanged.

6.4 Keyword changes

No reserved keywords were added or removed.

6.5 System table changes

No system tables or columns were added, removed, or lengthened in this release.

6.6 Dependency changes

Component	Dependency	v3.4.3.0	v3.4.3.9
taosAdapter	klauspost/compress	1.18.6	1.18.7
taosAdapter	golang.org/x/crypto	0.56.0	0.57.0
taosAdapter	golang.org/x/net	0.57.0	0.60.0
taosAdapter	golang.org/x/sys	0.47.0	0.48.0
taosAdapter	golang.org/x/text	0.41.0	0.42.0
taosKeeper	golang.org/x/crypto	0.56.0	0.58.0
taosKeeper	golang.org/x/net	0.57.0	0.61.0
taosKeeper	golang.org/x/sys	0.47.0	0.49.0
taosKeeper	golang.org/x/text	0.41.0	0.43.0
Python connector	certifi	2026.2.25	2026.10.19
Python connector	urllib3	2.7.0	2.8.0
taos-ws-py	rkyv	0.8.16	0.8.18
taos-ws-py	rustls	0.23.45	0.23.46
taos-ws-py	rustls-webpki	0.103.14	0.103.16
taos-ws-py	pyo3	0.17.3	0.29.3
taos-ws-py	tokio	1.43.1	1.53.3
Rust connector	rustls	0.23.45	0.23.46
Rust connector	rustls-webpki	0.103.14	0.103.16
Rust connector	event-listener	5.4.0	5.4.2
taosX	zip	2.4.2	9.0.5
taosX	rustls	0.23.45	0.23.46
taosX	rustls-webpki	0.103.15	0.103.16
taosX	webpki-roots	1.0.7	1.0.10
taosX	anyhow	1.0.102	1.0.103
taosX	event-listener	5.4.1	5.4.2
taosX	tokio	1.52.1	1.53.3
taosX	libz-sys	1.1.28	1.1.31
taosX	zstd-sys	2.0.16+zstd.1.5.7	2.1.2+zstd.1.5.7
taosX InfluxDB plugin	netty	4.1.118.Final	4.1.101.Final
taosX InfluxDB plugin	bcprov-jdk18on	1.83	1.85
taosX OpenTSDB plugin	netty	4.1.118.Final	4.1.137.Final
taos-insight	kin-openapi	0.144.0	0.149.0
taos-insight	klauspost/compress	1.17.9	1.18.7
taos-insight	jsonschema	6.0.2	6.0.3
taos-insight	golang.org/x/net	0.58.0	0.60.0
taos-insight	golang.org/x/sys	0.47.0	0.48.0
taos-insight	golang.org/x/text	0.41.0	0.42.0
taos-insight	dompurify	3.4.13	3.4.17
taos-insight	axios	1.18.0	no longer a dependency

6.7 Before you upgrade

An upgrade from v3.3.6 cannot keep the old stream processing. If the old streams, TSMA, snode, and their data directories are not removed, taosd fails to start. See Compatibility Notes. A cluster that already rebuilt stream processing on v3.4.2.0 or later does not need to repeat those steps when rolling to this release.

When upgrading from a version before v3.4 to this release, taosX does not migrate existing tasks automatically. Before v3.4, tasks were stored in SQLite. From v3.4 on, they are stored in mnode. Export the tasks in taosExplorer before the upgrade, import them afterward, and start the tasks that should run. If the tasks were not exported before the upgrade, they do not appear in taosExplorer afterward. See Migrate Tasks When Upgrading from a Version Before v3.4 to v3.4.x. A cluster already running on v3.4.0.0 or later, with tasks stored in mnode, does not need to repeat those steps when rolling to this release.

7. Known issues

None.

8. Downloads

Packages are available from the TDengine download center. Each package includes SPDX and CycloneDX SBOMs, and a SHA256 checksum.