gburd · Nov 5, 2026 · Nov 4, 2026 · Nov 4, 2026 · Nov 4, 2026 · Nov 5, 2026
diff --git a/build_android/Android.mk b/build_android/Android.mk
@@ -1,6 +1,6 @@
 # DO NOT EDIT: automatically built by dist/s_android.
 # Makefile for building a drop-in replacement of SQLite using
-# libdb 2026.10.7.2 (November 3, 2026)
+# libdb 2026.10.7.3 (November 4, 2026)
 ###################################################################
 LOCAL_PATH := $(call my-dir)
 include $(CLEAR_VARS)

diff --git a/build_android/db.h b/build_android/db.h
diff --git a/build_android/jdbc/jni/Android.mk b/build_android/jdbc/jni/Android.mk
@@ -1,6 +1,6 @@
 # DO NOT EDIT: automatically built by dist/s_android.
 # Makefile for building Android.JDBC for DBSQL
-# libdb 2026.10.7.2 (November 3, 2026)
+# libdb 2026.10.7.3 (November 4, 2026)
 #
 # This Makefile will generate 3 files:
 #   1. Static libdb_sql library. An internal library and users don't

diff --git a/build_windows/db.h b/build_windows/db.h
diff --git a/dist/RELEASE b/dist/RELEASE
@@ -8,7 +8,7 @@
 # Format: YYYY.0M  (append .MICRO for a same-month re-release, e.g. 2026.09.1).
 # Bump YYYY.0M for the month you cut the release; MICRO for follow-ups.
 # ---------------------------------------------------------------------------
-DB_CALVER="2026.10.7.2"
+DB_CALVER="2026.10.7.3"
 
 # ---------------------------------------------------------------------------
 # FORMAT / ABI COMPATIBILITY LEVEL -- FROZEN at 5.3.37, do NOT bump for a
@@ -30,7 +30,7 @@ DB_VERSION_FULL="$DB_VERSION_FAMILY.$DB_VERSION_RELEASE.$DB_VERSION_MAJOR.$DB_VE
 
 DB_VERSION_UNIQUE_NAME=`printf "_%d%03d" $DB_VERSION_MAJOR $DB_VERSION_MINOR`
 
-DB_RELEASE_DATE="November 3, 2026"
+DB_RELEASE_DATE="November 4, 2026"
 # User-facing string leads with the CalVer identity; the frozen 5.3.37 is kept
 # as the parenthesised format/ABI compatibility level so tools that parse it
 # and existing environments still see a stable compat number.

diff --git a/dist/configure b/dist/configure
@@ -3596,11 +3596,11 @@ DB_VERSION_MINOR="0"
 
 DB_VERSION_PATCH="9"
 
-DB_CALVER="2026.10.7.2"
+DB_CALVER="2026.10.7.3"
 
-DB_VERSION_STRING='"libdb 2026.10.7.2 (November 3, 2026)"'
+DB_VERSION_STRING='"libdb 2026.10.7.3 (November 4, 2026)"'
 
-DB_VERSION_FULL_STRING='"libdb 2026.10.7.2 (November 3, 2026)"'
+DB_VERSION_FULL_STRING='"libdb 2026.10.7.3 (November 4, 2026)"'
 
 
 # Process all options before using them.

diff --git a/dist/meson.build b/dist/meson.build
@@ -331,8 +331,8 @@ cdata.set('SIZEOF_CHAR_P', cc.sizeof('void *'))
 # Package strings.
 cdata.set_quoted('PACKAGE_NAME', 'Berkeley DB')
 cdata.set_quoted('PACKAGE_TARNAME', 'db')
-cdata.set_quoted('PACKAGE_VERSION', '2026.10.7.2')
-cdata.set_quoted('PACKAGE_STRING', 'libdb 2026.10.7.2')
+cdata.set_quoted('PACKAGE_VERSION', '2026.10.7.3')
+cdata.set_quoted('PACKAGE_STRING', 'libdb 2026.10.7.3')
 cdata.set_quoted('PACKAGE_BUGREPORT', '')
 cdata.set_quoted('PACKAGE_URL', '')
 cdata.set_quoted('LT_OBJDIR', '.libs/')

diff --git a/dist/meson/db_subs.json b/dist/meson/db_subs.json
@@ -4,9 +4,9 @@
   "DB_VERSION_MAJOR": "2026",
   "DB_VERSION_MINOR": "0",
   "DB_VERSION_PATCH": "9",
-  "DB_CALVER": "2026.10.7.2",
-  "DB_VERSION_STRING": "\"libdb 2026.10.7.2 (November 3, 2026)\"",
-  "DB_VERSION_FULL_STRING": "\"libdb 2026.10.7.2 (November 3, 2026)\"",
+  "DB_CALVER": "2026.10.7.3",
+  "DB_VERSION_STRING": "\"libdb 2026.10.7.3 (November 4, 2026)\"",
+  "DB_VERSION_FULL_STRING": "\"libdb 2026.10.7.3 (November 4, 2026)\"",
   "DB_VERSION_UNIQUE_NAME": "",
   "DB_CONST": "",
   "DB_PROTO1": "",

diff --git a/docs_src/_data/releases.toml b/docs_src/_data/releases.toml
@@ -14,6 +14,7 @@
 historical = ["v5.3.28", "v4.6.21-SSI"]
 
 [notes]
+"v2026.10.7.3" = "<strong>LTS patch release</strong> of the 2026.10.7 line, fixes only, formats unchanged: a replication election could <strong>choose a site with older data</strong> when two candidates&#39; logs ended at the same position, losing transactions acknowledged as durable; a corrupt compressed B-tree record could <strong>crash the reader</strong> (unchecked length fields); and an SSI abort no longer prints BDB3010"
 "v2026.10.7.2" = "<strong>LTS patch release</strong> of the 2026.10.7 line, fixes only, formats unchanged: <code>DB_TXN_SERIALIZABLE</code> could <strong>commit a write skew</strong> (three missed conflicts, now caught), recovery of many prepared transactions ran <strong>out of lockers</strong> with lockers free on other stripes, and an equal-key put over a deleted key or an all-deleted duplicate set <strong>kept the deleted key&#39;s bytes</strong> under a non-identity <code>bt_compare</code>"
 "v2026.10.7.1" = "<strong>LTS patch release</strong> of the 2026.10.7 line, fixes only, formats unchanged: a reverse cursor walk (<code>DB_PREV</code>) could <strong>silently skip live records</strong> next to deleted ones (a strict-aliasing miscompile, seen with clang on aarch64), <code>DB_TRUNCATE</code> with a subdatabase name <strong>destroyed the whole file</strong> (now refused with <code>EINVAL</code>), and a lock-order inversion when discarding a written file from the cache, which a debug build reported as a panic"
 "v2026.10.7" = "<strong>First LTS release</strong>: the 2026.10.x line freezes the region, database and log formats, the soname and the ABI. On macOS arm64 the hybrid mutex is selected again (region format changes there only; see the 2026.10.7 upgrade note); every other platform is byte-identical to 2026.10.6"

diff --git a/docs_src/guides/upgrading/_meta.toml b/docs_src/guides/upgrading/_meta.toml
@@ -9,6 +9,7 @@ order = [
   "moreinfo",
   "introduction",
   "upgrade_process",
+  "upgrade_2026_10_7_3",
   "upgrade_2026_10_7_2",
   "upgrade_2026_10_7_1",
   "upgrade_2026_10_7",

diff --git a/docs_src/guides/upgrading/upgrade_2026_10_7_3.md b/docs_src/guides/upgrading/upgrade_2026_10_7_3.md
@@ -0,0 +1,44 @@
+---
+title: "Upgrading to libdb 2026.10.7.3"
+api-name: "Upgrading to libdb 2026.10.7.3"
+---
+## Upgrading to libdb 2026.10.7.3
+
+libdb 2026.10.7.3 is the third patch release of the 2026.10.7 long-term support (LTS) line. It contains bug fixes only.
+
+**No upgrade procedure is needed.** The shared-memory region format, the database and log formats, the soname and the public ABI are the same as 2026.10.7, 2026.10.7.1 and 2026.10.7.2 on every platform. An environment created by any of them opens with 2026.10.7.3 and the other way round, and processes from all four releases can share one environment. Install it in place of 2026.10.7.2.
+
+In a replication group that mixes 2026.10.7.3 with earlier releases, see the election fix below.
+
+### Build signatures
+
+The signature depends on the platform and the configure options. On each
+platform below, 2026.10.7 through 2026.10.7.3 built the same way print the
+same value.
+
+| Platform (default `configure`) | 2026.10.7.2 | 2026.10.7.3 |
+| --- | --- | --- |
+| Linux x86_64 (Debian 12, gcc) | `0x841f4ea8` | `0x841f4ea8` |
+| FreeBSD aarch64 (14.5, clang) | `0x56a06689` | `0x56a06689` |
+| FreeBSD x86_64, macOS arm64, Windows | unchanged | unchanged |
+
+### What it fixes
+
+**A replication election could choose a site with older data.** Each site ranks the votes it receives to pick a winner. The ranking was meant to prefer the site with the newest data, but its last rule, used when two sites' logs end at the same position, ignored which generation of data each site held. Two candidates with logs ending at the same position but different data generations were ranked by whichever vote arrived last. If a majority of sites counted the older site's vote last, that site won, and the site with newer data rolled back its log to match on its next sync, losing transactions it had already acknowledged as durable. The first vote counted was also handled separately, so ties could resolve differently from site to site. The ranking is now one fixed order, applied to every vote the same way: sites that can be elected, then non-zero priority, then newest data generation, then log position, priority, the random tiebreaker and the site's ID. It no longer depends on arrival order, and it never ranks older data above newer.
+
+This needs two candidates whose logs end at exactly the same position, so it is rare. The conditions were reproduced on real sites; that a network delivers the votes in the losing order is argued, not shown end to end. `test/db/run_rep_cmpvote_order.sh` runs the vote values captured from those sites through every arrival order. It fails on 2026.10.7.2 and passes on 2026.10.7.3.
+
+During a rolling upgrade, old and new sites rank the affected ties differently, so in that case an election may need an extra round before the sites agree. It cannot produce two masters. Finish the upgrade promptly.
+
+**A corrupt compressed B-tree record could crash the reader.** A B-tree opened with `DB->set_bt_compress` stores records in a compressed form that includes length fields. The decoder trusted those lengths, and a page comes from disk:
+
+- it read each length field before checking that the bytes were there, so a truncated record read past its end;
+- it added two lengths without checking for overflow, so a large enough value wrapped around, passed every size check, and made it copy about 4 GB;
+- the first record in each group had its length used with no check at all, so one corrupted byte in the file crashed a plain `DB->get`.
+
+Each length is now checked before it is read or used, and a bad record returns `EINVAL`. Only B-trees with compression enabled, in builds configured with `--enable-compression`, are affected. `test/db/run_bt_decompress_bounds.sh` has five cases, including a real database with one length byte corrupted on disk. All five crash on 2026.10.7.2 and pass on 2026.10.7.3.
+
+### Also in this release
+
+- An SSI transaction that aborted with `DB_SNAPSHOT_CONFLICT` or `DB_SNAPSHOT_UNSAFE` while upgrading a page for writing also printed `BDB3010 error getting a page for writing`. The abort was correct and nothing was lost. The message is gone; the return codes are unchanged.
+- In a build configured with `--enable-diagnostic`, the lock-order checker reported a deadlock, and panicked the environment, when a thread held a latch in one environment and took the same-numbered latch in another. A replication application whose send callback writes to a second environment hit it, as did every replication election test. Latches in different environments are no longer compared. Release builds do not include the checker.
diff --git a/meson.build b/meson.build
@@ -12,7 +12,7 @@
 #   meson test -C build --suite tiers   # isolation + lock-matrix tiers
 
 project('libdb', 'c',
-  version: '2026.10.7.2',
+  version: '2026.10.7.3',
   # Sleepycat, matching LICENSE (byte-identical to Oracle's) and README.md.
   # This field previously named a copyleft licence that this fork
   # deliberately excludes: README.md explains that Berkeley DB releases from

diff --git a/test/audit/QUAL-2026.10.7.3-freebsd-aarch64.txt b/test/audit/QUAL-2026.10.7.3-freebsd-aarch64.txt
@@ -0,0 +1,45 @@
+# v2026.10.7.3 qualification: freebsd-aarch64 (FreeBSD 14.5-STABLE arm64)
+base: 2625d8cd Merge pull request #260 from berkeleydb/release/2026.10.7.2
+cand: d12fe79e Merge remote-tracking branch 'origin/backport/2026.10.7/lock-order-per-env' into release/2026.10.7.3
+
+## L1 region signature (default configure)
+  base: 0x56a06689
+  cand: 0x56a06689
+  L1 PASS
+
+## L2 soname, exported symbols, .text, handle sizes
+  base soname: libdb-2026.0.so
+  base exported symbols:     1848
+  base .text: 1064460
+  cand soname: libdb-2026.0.so
+  cand exported symbols:     1848
+  cand .text: 1063228
+  symbols removed:        0  added:        0
+  handle_sizes (cand): run_handle_sizes.sh: PASS
+
+## L3 fixed bugs: base / release (each test from the candidate tree)
+  run_bt_decompress_bounds: FAIL / PASS
+  run_rep_cmpvote_order (fixed must PASS, pre-fix arm must FAIL, copy matches src): PASS
+  lock_order_check base: PASS (control): lk_partitions=4 completed -- the checker did not fire on a legal schedule|PASS: lk_partitions=1 completed cleanly -- the SSI branch no longer nests TXN_SYSTEM_LOCK inside a held LOCK_SYSTEM_LOCK (regression gate on that fix)|FAIL (two-env): status 0x86 -- the checker compared mutex indices across environments|FAIL: lock_order_check|
+  lock_order_check cand: PASS (control): lk_partitions=4 completed -- the checker did not fire on a legal schedule|PASS: lk_partitions=1 completed cleanly -- the SSI branch no longer nests TXN_SYSTEM_LOCK inside a held LOCK_SYSTEM_LOCK (regression gate on that fix)|PASS (two-env): latches with the same index in two environments were not reported|PASS: lock_order_check|
+  ssi_livelock BDB3010 lines over 3 runs: base 126 / release 0
+
+## gate 1 test/db tier (release, diagnostic, compression+diagnostic)
+  cand rel: rc=1 pass=39 skip=4 fail=3
+    run_qam_extent_vrfy.sh: FAIL (rc=124)
+    rep_cmpvote_order: FAIL (12)
+    pre-fix: FAILED as required (bug reproduced)
+  cand diag: rc=1 pass=39 skip=4 fail=3
+    run_qam_extent_vrfy.sh: FAIL (rc=124)
+    rep_cmpvote_order: FAIL (12)
+    pre-fix: FAILED as required (bug reproduced)
+  cand comp: rc=1 pass=39 skip=4 fail=3
+    run_qam_extent_vrfy.sh: FAIL (rc=124)
+    rep_cmpvote_order: FAIL (12)
+    pre-fix: FAILED as required (bug reproduced)
+
+## done 2026-11-04T21:17:41Z
+
+## run_qam_extent_vrfy alone, TIMEOUT=1200, base / release
+  base: run_qam_extent_vrfy.sh: PASS in 600 s
+  cand: run_qam_extent_vrfy.sh: PASS in 601 s
diff --git a/test/audit/QUAL-2026.10.7.3-freebsd-x86_64.txt b/test/audit/QUAL-2026.10.7.3-freebsd-x86_64.txt
@@ -0,0 +1,45 @@
+# v2026.10.7.3 qualification: freebsd-x86_64 (FreeBSD 14.5-STABLE amd64)
+base: 2625d8cd Merge pull request #260 from berkeleydb/release/2026.10.7.2
+cand: d12fe79e Merge remote-tracking branch 'origin/backport/2026.10.7/lock-order-per-env' into release/2026.10.7.3
+
+## L1 region signature (default configure)
+  base: 0x56a06689
+  cand: 0x56a06689
+  L1 PASS
+
+## L2 soname, exported symbols, .text, handle sizes
+  base soname: libdb-2026.0.so
+  base exported symbols:     1848
+  base .text: 1160828
+  cand soname: libdb-2026.0.so
+  cand exported symbols:     1848
+  cand .text: 1159004
+  symbols removed:        0  added:        0
+  handle_sizes (cand): run_handle_sizes.sh: PASS
+
+## L3 fixed bugs: base / release (each test from the candidate tree)
+  run_bt_decompress_bounds: FAIL / PASS
+  run_rep_cmpvote_order (fixed must PASS, pre-fix arm must FAIL, copy matches src): PASS
+  lock_order_check base: PASS (control): lk_partitions=4 completed -- the checker did not fire on a legal schedule|PASS: lk_partitions=1 completed cleanly -- the SSI branch no longer nests TXN_SYSTEM_LOCK inside a held LOCK_SYSTEM_LOCK (regression gate on that fix)|FAIL (two-env): status 0x86 -- the checker compared mutex indices across environments|FAIL: lock_order_check|
+  lock_order_check cand: PASS (control): lk_partitions=4 completed -- the checker did not fire on a legal schedule|PASS: lk_partitions=1 completed cleanly -- the SSI branch no longer nests TXN_SYSTEM_LOCK inside a held LOCK_SYSTEM_LOCK (regression gate on that fix)|PASS (two-env): latches with the same index in two environments were not reported|PASS: lock_order_check|
+  ssi_livelock BDB3010 lines over 3 runs: base 166 / release 0
+
+## gate 1 test/db tier (release, diagnostic, compression+diagnostic)
+  cand rel: rc=1 pass=39 skip=4 fail=3
+    run_qam_extent_vrfy.sh: FAIL (rc=124)
+    rep_cmpvote_order: FAIL (12)
+    pre-fix: FAILED as required (bug reproduced)
+  cand diag: rc=1 pass=39 skip=4 fail=3
+    run_qam_extent_vrfy.sh: FAIL (rc=124)
+    rep_cmpvote_order: FAIL (12)
+    pre-fix: FAILED as required (bug reproduced)
+  cand comp: rc=1 pass=39 skip=4 fail=3
+    run_qam_extent_vrfy.sh: FAIL (rc=124)
+    rep_cmpvote_order: FAIL (12)
+    pre-fix: FAILED as required (bug reproduced)
+
+## done 2026-11-04T21:16:51Z
+
+## run_qam_extent_vrfy alone, TIMEOUT=1200, base / release
+  base: run_qam_extent_vrfy.sh: PASS in 640 s
+  cand: run_qam_extent_vrfy.sh: PASS in 640 s
diff --git a/test/audit/QUAL-2026.10.7.3-linux-x86_64.txt b/test/audit/QUAL-2026.10.7.3-linux-x86_64.txt
@@ -0,0 +1,58 @@
+# v2026.10.7.3 qualification: linux-x86_64 (Linux 6.1.0-54-cloud-amd64 x86_64)
+base: 2625d8cd Merge pull request #260 from berkeleydb/release/2026.10.7.2
+cand: 43f4a560 release: libdb 2026.10.7.3 (LTS patch)
+
+## L1 region signature (default configure)
+  base: 0x841f4ea8
+  cand: 0x841f4ea8
+  L1 PASS
+
+## L2 soname, exported symbols, .text, handle sizes
+  base soname: libdb-2026.0.so
+  base exported symbols: 1846
+  base .text: 1307996
+  cand soname: libdb-2026.0.so
+  cand exported symbols: 1846
+  cand .text: 1308236
+  symbols removed: 0  added: 0
+  handle_sizes (cand): run_handle_sizes.sh: PASS
+
+## L3 fixed bugs: base / release (each test from the candidate tree)
+  run_bt_decompress_bounds: FAIL / PASS
+  run_rep_cmpvote_order (fixed must PASS, pre-fix arm must FAIL, copy matches src): PASS
+  (lock_order_check and ssi_livelock first failed to link: the dev box has liburing and the script
+   linked libdb.a without the build's LIBS.  Re-run with the build's LIBS on the same trees:)
+  lock_order_check base: PASS (control): lk_partitions=4 completed -- the checker did not fire on a legal schedule|PASS: lk_partitions=1 completed cleanly -- the SSI branch no longer nests TXN_SYSTEM_LOCK inside a held LOCK_SYSTEM_LOCK (regression gate on that fix)|FAIL (two-env): status 0x6 -- the checker compared mutex indices across environments|FAIL: lock_order_check|
+  lock_order_check cand: PASS (control): lk_partitions=4 completed -- the checker did not fire on a legal schedule|PASS: lk_partitions=1 completed cleanly -- the SSI branch no longer nests TXN_SYSTEM_LOCK inside a held LOCK_SYSTEM_LOCK (regression gate on that fix)|PASS (two-env): latches with the same index in two environments were not reported|PASS: lock_order_check|
+  ssi_livelock BDB3010 lines over 3 runs: base 0 / release 0
+
+## gate 1 test/db tier (release, diagnostic, compression+diagnostic)
+  cand rel: rc=0 pass=42 skip=3 fail=2
+    rep_cmpvote_order: FAIL (12)
+    pre-fix: FAILED as required (bug reproduced)
+  cand diag: rc=0 pass=42 skip=3 fail=2
+    rep_cmpvote_order: FAIL (12)
+    pre-fix: FAILED as required (bug reproduced)
+  cand comp: rc=0 pass=42 skip=3 fail=2
+    rep_cmpvote_order: FAIL (12)
+    pre-fix: FAILED as required (bug reproduced)
+
+## done 2026-11-04T20:40:28Z
+
+## rep election TCL, --enable-diagnostic, base / release (#269)
+== base (2625d8cd )
+rep001: FAIL
+rep002: FAIL
+rep005: FAIL
+rep020: FAIL
+rep021: FAIL
+rep026: FAIL
+rep037: FAIL
+== cand (43f4a560 )
+rep001: PASS
+rep002: PASS
+rep005: PASS
+rep020: PASS
+rep021: PASS
+rep026: PASS
+rep037: PASS