[2026.10.7] release: libdb 2026.10.7.2 (LTS patch)

build_android/Android.mk

@@ -1,6 +1,6 @@
 # DO NOT EDIT: automatically built by dist/s_android.
 # Makefile for building a drop-in replacement of SQLite using
-# libdb 2026.10.7.1 (October 22, 2026)
+# libdb 2026.10.7.2 (November 3, 2026)
 ###################################################################
 LOCAL_PATH := $(call my-dir)
 include $(CLEAR_VARS)

build_android/jdbc/jni/Android.mk

@@ -1,6 +1,6 @@
 # DO NOT EDIT: automatically built by dist/s_android.
 # Makefile for building Android.JDBC for DBSQL
-# libdb 2026.10.7.1 (October 22, 2026)
+# libdb 2026.10.7.2 (November 3, 2026)
 #
 # This Makefile will generate 3 files:
 #   1. Static libdb_sql library. An internal library and users don't

dist/RELEASE

@@ -8,7 +8,7 @@
 # Format: YYYY.0M  (append .MICRO for a same-month re-release, e.g. 2026.09.1).
 # Bump YYYY.0M for the month you cut the release; MICRO for follow-ups.
 # ---------------------------------------------------------------------------
-DB_CALVER="2026.10.7.1"
+DB_CALVER="2026.10.7.2"
 
 # ---------------------------------------------------------------------------
 # FORMAT / ABI COMPATIBILITY LEVEL -- FROZEN at 5.3.37, do NOT bump for a
@@ -30,7 +30,7 @@ DB_VERSION_FULL="$DB_VERSION_FAMILY.$DB_VERSION_RELEASE.$DB_VERSION_MAJOR.$DB_VE
 
 DB_VERSION_UNIQUE_NAME=`printf "_%d%03d" $DB_VERSION_MAJOR $DB_VERSION_MINOR`
 
-DB_RELEASE_DATE="October 22, 2026"
+DB_RELEASE_DATE="November 3, 2026"
 # User-facing string leads with the CalVer identity; the frozen 5.3.37 is kept
 # as the parenthesised format/ABI compatibility level so tools that parse it
 # and existing environments still see a stable compat number.

dist/configure

@@ -3596,11 +3596,11 @@ DB_VERSION_MINOR="0"
 
 DB_VERSION_PATCH="9"
 
-DB_CALVER="2026.10.7.1"
+DB_CALVER="2026.10.7.2"
 
-DB_VERSION_STRING='"libdb 2026.10.7.1 (October 22, 2026)"'
+DB_VERSION_STRING='"libdb 2026.10.7.2 (November 3, 2026)"'
 
-DB_VERSION_FULL_STRING='"libdb 2026.10.7.1 (October 22, 2026)"'
+DB_VERSION_FULL_STRING='"libdb 2026.10.7.2 (November 3, 2026)"'
 
 
 # Process all options before using them.

dist/meson.build

@@ -331,8 +331,8 @@ cdata.set('SIZEOF_CHAR_P', cc.sizeof('void *'))
 # Package strings.
 cdata.set_quoted('PACKAGE_NAME', 'Berkeley DB')
 cdata.set_quoted('PACKAGE_TARNAME', 'db')
-cdata.set_quoted('PACKAGE_VERSION', '2026.10.7.1')
-cdata.set_quoted('PACKAGE_STRING', 'libdb 2026.10.7.1')
+cdata.set_quoted('PACKAGE_VERSION', '2026.10.7.2')
+cdata.set_quoted('PACKAGE_STRING', 'libdb 2026.10.7.2')
 cdata.set_quoted('PACKAGE_BUGREPORT', '')
 cdata.set_quoted('PACKAGE_URL', '')
 cdata.set_quoted('LT_OBJDIR', '.libs/')

dist/meson/db_subs.json

@@ -4,9 +4,9 @@
   "DB_VERSION_MAJOR": "2026",
   "DB_VERSION_MINOR": "0",
   "DB_VERSION_PATCH": "9",
-  "DB_CALVER": "2026.10.7.1",
-  "DB_VERSION_STRING": "\"libdb 2026.10.7.1 (October 22, 2026)\"",
-  "DB_VERSION_FULL_STRING": "\"libdb 2026.10.7.1 (October 22, 2026)\"",
+  "DB_CALVER": "2026.10.7.2",
+  "DB_VERSION_STRING": "\"libdb 2026.10.7.2 (November 3, 2026)\"",
+  "DB_VERSION_FULL_STRING": "\"libdb 2026.10.7.2 (November 3, 2026)\"",
   "DB_VERSION_UNIQUE_NAME": "",
   "DB_CONST": "",
   "DB_PROTO1": "",

docs_src/_data/releases.toml

@@ -14,6 +14,7 @@
 historical = ["v5.3.28", "v4.6.21-SSI"]
 
 [notes]
+"v2026.10.7.2" = "<strong>LTS patch release</strong> of the 2026.10.7 line, fixes only, formats unchanged: <code>DB_TXN_SERIALIZABLE</code> could <strong>commit a write skew</strong> (three missed conflicts, now caught), recovery of many prepared transactions ran <strong>out of lockers</strong> with lockers free on other stripes, and an equal-key put over a deleted key or an all-deleted duplicate set <strong>kept the deleted key&#39;s bytes</strong> under a non-identity <code>bt_compare</code>"
 "v2026.10.7.1" = "<strong>LTS patch release</strong> of the 2026.10.7 line, fixes only, formats unchanged: a reverse cursor walk (<code>DB_PREV</code>) could <strong>silently skip live records</strong> next to deleted ones (a strict-aliasing miscompile, seen with clang on aarch64), <code>DB_TRUNCATE</code> with a subdatabase name <strong>destroyed the whole file</strong> (now refused with <code>EINVAL</code>), and a lock-order inversion when discarding a written file from the cache, which a debug build reported as a panic"
 "v2026.10.7" = "<strong>First LTS release</strong>: the 2026.10.x line freezes the region, database and log formats, the soname and the ABI. On macOS arm64 the hybrid mutex is selected again (region format changes there only; see the 2026.10.7 upgrade note); every other platform is byte-identical to 2026.10.6"
 "v2026.10.6" = "<strong>BREAKING: the environment region format changes</strong> (recover, remove the regions, restart). RFC 0015 scalability work and the AArch64 hybrid mutex, which fixes the FreeBSD/Linux arm64 multi-process limitation (B3)"

docs_src/guides/upgrading/_meta.toml

@@ -9,6 +9,7 @@ order = [
   "moreinfo",
   "introduction",
   "upgrade_process",
+  "upgrade_2026_10_7_2",
   "upgrade_2026_10_7_1",
   "upgrade_2026_10_7",
   "upgrade_2026_10_6",

docs_src/guides/upgrading/upgrade_2026_10_7_2.md

@@ -0,0 +1,42 @@
+---
+title: "Upgrading to libdb 2026.10.7.2"
+api-name: "Upgrading to libdb 2026.10.7.2"
+---
+## Upgrading to libdb 2026.10.7.2
+
+libdb 2026.10.7.2 is the second patch release of the 2026.10.7 long-term support (LTS) line. It contains bug fixes only.
+
+**No upgrade procedure is needed.** The shared-memory region format, the database and log formats, the soname and the public ABI are the same as 2026.10.7 and 2026.10.7.1 on every platform. An environment created by either opens with 2026.10.7.2 and the other way round, and processes from all three releases can share one environment. Install it in place of 2026.10.7.1.
+
+### Build signatures
+
+The signature depends on the platform and the configure options. On each
+platform below, 2026.10.7, 2026.10.7.1 and 2026.10.7.2 built the same way print
+the same value.
+
+| Platform (default `configure`) | 2026.10.7.1 | 2026.10.7.2 |
+| --- | --- | --- |
+| Linux x86_64 (Debian 12, gcc) | `0x841f4ea8` | `0x841f4ea8` |
+| FreeBSD aarch64 (14.5, clang) | `0x56a06689` | `0x56a06689` |
+| FreeBSD x86_64, macOS arm64, Windows | unchanged | unchanged |
+
+### What it fixes
+
+**`DB_TXN_SERIALIZABLE` committed write skews.** Serializable snapshot isolation (SSI) is meant to abort one of two transactions that each read what the other writes. It missed three cases, so both transactions committed a history that no serial order produces:
+
+- On a B-tree with more than one level, a transaction that write-locked a page dropped its own read marker on that page, even when it had read a different record there. A later writer of that page then saw no reader.
+- A writer that had to wait behind another writer on the same page, or that re-acquired or upgraded a lock it already held, never checked the page's read markers.
+- A reader that read a page after a writer had already locked it and checked the page was never seen by that writer, because a read marker never blocks and so never prompts a second check.
+
+Each is fixed: a transaction keeps its own markers, every way a write lock is granted checks the markers, and a reader now records the conflict with the writers already holding the page. Measured with the Adya cycle checker (`test/isolation/test_ssi_cycle`) at several records per leaf, 40 seeds each, 2026.10.7.1 committed a non-serializable history in 4 of 40 runs at 2 threads, 23 of 40 at 16 threads (B-tree) and 16 of 40 at 16 threads (Hash). 2026.10.7.2 commits none, at the same throughput. If you use `DB_TXN_SERIALIZABLE`, upgrade.
+
+**Recovery of many prepared transactions ran out of lockers.** Recovery creates one locker per prepared transaction. Since 2026.10.5 each of the 64 locker stripes has its own free list, and a stripe that ran dry could not borrow an idle locker from another stripe once the total reached `lk_max_lockers`. Recovery then failed with `BDB2055 Lock table is out of available locker entries` and panicked, even with lockers free elsewhere. A dry stripe now takes a free locker from another stripe before it gives up. The TCL test `recd015` (10,000 prepared transactions) failed on 2026.10.5 through 2026.10.7.1 and passes again.
+
+**An equal-key put over a deleted key kept the deleted key's bytes.** In a B-tree whose `bt_compare` treats different byte strings as equal (for example a case-insensitive comparison, `"abc"` equal to `"ABC"`), a put of `"ABC"` over a deleted `"abc"` that a cursor still referenced brought the pair back under the old bytes, `"abc"`. The stored key depended on whether an unrelated cursor happened to be open. The same happened to a duplicate set whose members were all deleted while a cursor referenced one of them. In SQL this showed up as a `COLLATE NOCASE` index or a WITHOUT ROWID primary key keeping the old spelling after an `UPDATE`. The put now stores the new key's bytes. For a duplicate set the set's one shared key is rewritten in place, so every member and every cursor sees the new spelling, and `DB->verify` passes. One case is unchanged: a duplicate set whose shared key is long enough to be stored on an overflow page keeps the old bytes. The set stays valid; see `test/KNOWN-ISSUES.md`.
+
+Each fix has a regression test that fails on 2026.10.7.1 and passes on 2026.10.7.2: `test/isolation/ssi_multiread_skew.c`, `test/isolation/test_ssi_cycle.c` and `test/isolation/ssi_livelock.c` (the isolation tier), `test/db/run_lock_stripe_exhaustion.sh`, `test/db/run_r1_revive.sh`, `test/db/run_r2_dup_revive.sh` and `test/db/run_r2_fuzz.sh`.
+
+### Also in this release
+
+- `run_qam_extent_vrfy` allows 600 seconds instead of 180. GitHub's Ubuntu 26.04 runner image needs about 181 seconds for its 775 extent-file syncs.
+- A recno duplicate tree is descended with the recno internal-page macro, not the btree one.

meson.build

@@ -12,7 +12,7 @@
 #   meson test -C build --suite tiers   # isolation + lock-matrix tiers
 
 project('libdb', 'c',
-  version: '2026.10.7.1',
+  version: '2026.10.7.2',
   # Sleepycat, matching LICENSE (byte-identical to Oracle's) and README.md.
   # This field previously named a copyleft licence that this fork
   # deliberately excludes: README.md explains that Berkeley DB releases from

test/audit/QUAL-2026.10.7.2-freebsd-aarch64.txt

@@ -0,0 +1,50 @@
+# v2026.10.7.2 qualification: freebsd-aarch64 (FreeBSD 14.5-STABLE arm64)
+base: defea6df Merge pull request #221 from berkeleydb/backport/2026.10.7/fixes-1
+cand: 1943cc9b release: libdb 2026.10.7.2 (LTS patch)
+
+## L1 region signature (default configure)
+  base: 0x56a06689
+  cand: 0x56a06689
+  L1 PASS
+
+## L2 soname, exported symbols, .text, handle sizes
+  base soname: libdb-2026.0.so
+  base exported symbols:     1848
+  base .text: 1061308
+  cand soname: libdb-2026.0.so
+  cand exported symbols:     1848
+  cand .text: 1064460
+  symbols removed:        0  added:        0
+  handle_sizes (cand): run_handle_sizes.sh: PASS
+
+## L3 fixed bugs: base / release (each test from the candidate tree, run against both libraries)
+  run_r1_revive: FAIL / PASS
+  run_r2_dup_revive: FAIL / PASS
+  run_r2_fuzz: PASS / PASS
+  run_lock_stripe_exhaustion: FAIL / PASS
+  isolation tier (incl. ssi_cycle_btree, ssi_multiread_skew, ssi_livelock): base rc=1 / release rc=0
+    base failing cells: 
+    cand failing cells: 
+
+## gate 1 test/db tier (release, diagnostic)
+  cand rel: rc=1 pass=35 skip=4 fail=1
+    run_qam_extent_vrfy.sh: FAIL (rc=124)
+  cand diag: rc=1 pass=35 skip=4 fail=1
+    run_qam_extent_vrfy.sh: FAIL (rc=124)
+
+## gate 8 soak (SSI changes SIREAD marker lifetime)
+  soak rc=0: 5 workload(s) run, 0 unexpected outcome(s)
+
+## done 2026-11-04T00:16:30Z
+
+## gate 1 rerun, run_qam_extent_vrfy TIMEOUT=1200 (see QUAL-2026.10.7.2.md)
+  cand rel (qam TIMEOUT=1200): rc=0 pass=37 skip=4 fail=0
+    run_u9_serializable.sh: SKIP no javac on this host
+    run_u8_backup_config.sh: SKIP no javac on this host
+    run_mvcc_mtx_doublefree.sh: SKIP failchk reclaimed no mutexes (0 BDB2017 lines), so the F6 scenario was never constructed -- this run proves nothing either way
+    run_meson_autoconf_parity.sh: SKIP no meson on this host
+  cand diag (qam TIMEOUT=1200): rc=0 pass=37 skip=4 fail=0
+    run_u9_serializable.sh: SKIP no javac on this host
+    run_u8_backup_config.sh: SKIP no javac on this host
+    run_mvcc_mtx_doublefree.sh: SKIP failchk reclaimed no mutexes (0 BDB2017 lines), so the F6 scenario was never constructed -- this run proves nothing either way
+    run_meson_autoconf_parity.sh: SKIP no meson on this host

test/audit/QUAL-2026.10.7.2-freebsd-x86_64.txt

@@ -0,0 +1,49 @@
+# v2026.10.7.2 qualification: freebsd-x86_64 (FreeBSD 14.5-STABLE amd64)
+base: defea6df Merge pull request #221 from berkeleydb/backport/2026.10.7/fixes-1
+cand: 1943cc9b release: libdb 2026.10.7.2 (LTS patch)
+
+## L1 region signature (default configure)
+  base: 0x56a06689
+  cand: 0x56a06689
+  L1 PASS
+
+## L2 soname, exported symbols, .text, handle sizes
+  base soname: libdb-2026.0.so
+  base exported symbols:     1848
+  base .text: 1156684
+  cand soname: libdb-2026.0.so
+  cand exported symbols:     1848
+  cand .text: 1160828
+  symbols removed:        0  added:        0
+  handle_sizes (cand): run_handle_sizes.sh: PASS
+
+## L3 fixed bugs: base / release (each test from the candidate tree, run against both libraries)
+  run_r1_revive: FAIL / PASS
+  run_r2_dup_revive: FAIL / PASS
+  run_r2_fuzz: PASS / PASS
+  run_lock_stripe_exhaustion: FAIL / PASS
+  isolation tier (incl. ssi_cycle_btree, ssi_multiread_skew, ssi_livelock): base rc=1 / release rc=0
+    base failing cells: 
+    cand failing cells: 
+
+## gate 1 test/db tier (release, diagnostic)
+  cand rel: rc=1 pass=35 skip=4 fail=1
+    run_qam_extent_vrfy.sh: FAIL (rc=124)
+  cand diag: rc=1 pass=35 skip=4 fail=0
+
+## gate 8 soak (SSI changes SIREAD marker lifetime)
+  soak rc=0: 5 workload(s) run, 0 unexpected outcome(s)
+
+## done 2026-11-04T00:10:25Z
+
+## gate 1 rerun, run_qam_extent_vrfy TIMEOUT=1200 (see QUAL-2026.10.7.2.md)
+  cand rel (qam TIMEOUT=1200): rc=0 pass=37 skip=4 fail=0
+    run_u9_serializable.sh: SKIP no javac on this host
+    run_u8_backup_config.sh: SKIP no javac on this host
+    run_mvcc_mtx_doublefree.sh: SKIP failchk reclaimed no mutexes (0 BDB2017 lines), so the F6 scenario was never constructed -- this run proves nothing either way
+    run_meson_autoconf_parity.sh: SKIP no meson on this host
+  cand diag (qam TIMEOUT=1200): rc=0 pass=37 skip=4 fail=0
+    run_u9_serializable.sh: SKIP no javac on this host
+    run_u8_backup_config.sh: SKIP no javac on this host
+    run_mvcc_mtx_doublefree.sh: SKIP failchk reclaimed no mutexes (0 BDB2017 lines), so the F6 scenario was never constructed -- this run proves nothing either way
+    run_meson_autoconf_parity.sh: SKIP no meson on this host

test/audit/QUAL-2026.10.7.2-linux-x86_64.txt

@@ -0,0 +1,36 @@
+# v2026.10.7.2 qualification: linux-x86_64 (Linux 6.1.0-54-cloud-amd64 x86_64)
+base: defea6df Merge pull request #221 from berkeleydb/backport/2026.10.7/fixes-1
+cand: 1943cc9b release: libdb 2026.10.7.2 (LTS patch)
+
+## L1 region signature (default configure)
+  base: 0x841f4ea8
+  cand: 0x841f4ea8
+  L1 PASS
+
+## L2 soname, exported symbols, .text, handle sizes
+  base soname: libdb-2026.0.so
+  base exported symbols: 1846
+  base .text: 1302044
+  cand soname: libdb-2026.0.so
+  cand exported symbols: 1846
+  cand .text: 1306636
+  symbols removed: 0  added: 0
+  handle_sizes (cand): run_handle_sizes.sh: PASS
+
+## L3 fixed bugs: base / release (each test from the candidate tree, run against both libraries)
+  run_r1_revive: FAIL / PASS
+  run_r2_dup_revive: FAIL / PASS
+  run_r2_fuzz: PASS / PASS
+  run_lock_stripe_exhaustion: FAIL / PASS
+  isolation tier (incl. ssi_cycle_btree, ssi_multiread_skew, ssi_livelock): base rc=1 / release rc=0
+    base failing cells: 
+    cand failing cells: 
+
+## gate 1 test/db tier (release, diagnostic)
+  cand rel: rc=0 pass=38 skip=3 fail=0
+  cand diag: rc=0 pass=38 skip=3 fail=0
+
+## gate 8 soak (SSI changes SIREAD marker lifetime)
+  soak rc=0: 5 workload(s) run, 0 unexpected outcome(s)
+
+## done 2026-11-03T23:55:33Z