Merge branch '12.3 release' into 12.3

2026-10-23 18:49:29 +03:00 · 2026-05-28 10:21:35 +02:00
parent 840a043531 9f98f82b14
commit 8ffeb81e2b
721 changed files with 20618 additions and 9691 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -31,6 +31,7 @@ Docs/INFO_BIN
 Docs/INFO_SRC
 Makefile
 TAGS
+all_plugins/
 mariadb-plugin-columnstore.install.generated
 Testing/
 tmp/
@@ -60,8 +61,11 @@ extra/comp_err
 extra/innochecksum
 extra/jemalloc/build/
 extra/jemalloc/tmp/
+extra/generate_option_list
 extra/mariabackup/mariabackup
 extra/mariabackup/mbstream
+extra/mariadb-migrate-config-file
+extra/mariadbd_options.h
 extra/my_print_defaults
 extra/mysql_waitpid
 extra/mysqld_safe_helper
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -509,7 +509,6 @@ ADD_SUBDIRECTORY(vio)
 ADD_SUBDIRECTORY(mysys)
 ADD_SUBDIRECTORY(mysys_ssl)
 ADD_SUBDIRECTORY(client)
-ADD_SUBDIRECTORY(extra)
 ADD_SUBDIRECTORY(libservices)
 ADD_SUBDIRECTORY(sql/share)

@@ -535,6 +534,8 @@ IF(NOT WITHOUT_SERVER)
  ENDIF()
 ENDIF()

+ADD_SUBDIRECTORY(extra)
+
 IF(UNIX)
  ADD_SUBDIRECTORY(man)
 ENDIF()
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -8,15 +8,15 @@ MariaDB Server has a vibrant community contributing in a wide range of areas. Th
 -   [maria-developers mailing list](https://lists.mariadb.org/postorius/lists/developers.lists.mariadb.org/)
 -   [maria-discuss mailing list](https://lists.mariadb.org/postorius/lists/discuss.lists.mariadb.org/)
 -   [maria-docs mailing list](https://lists.mariadb.org/postorius/lists/docs.lists.mariadb.org/)
-   The MariaDB Foundation and MariaDB Corporation have a presence on Reddit, Twitter and Facebook. See the  [social media page](https://mariadb.com/docs/general-resources/community/joining-the-community).
+-   The MariaDB Foundation and MariaDB Corporation have a presence on Reddit, Twitter and Facebook. See the [social media page](https://mariadb.com/docs/general-resources/community/joining-the-community).

 ### Help document MariaDB
----
-   Contribute towards [documenting MariaDB Server](https://mariadb.com/docs/general-resources/about/readme/contributing-documentation)  and its ecosystem by adding new content or improving existing content.
-   [Translate](https://mariadb.com/docs/general-resources/about/readme/contributing-documentation)  existing documentation.
+---
+-   Contribute towards [documenting MariaDB Server](https://mariadb.com/docs/general-resources/about/readme/contributing-documentation) and its ecosystem by adding new content or improving existing content.
+-   [Translate](https://mariadb.com/docs/general-resources/about/readme/contributing-documentation) existing documentation.

 ### Help develop MariaDB
-----
+---
 -   Fix bugs or develop new features
 -   Review code contributions
 -   Test bug fixes and features
@@ -34,10 +34,10 @@ You’re very welcome to support MariaDB Server as an individual, or talk your c
 ---
 -   Attend an event
    -   [Events and Conferences page](https://mariadb.org/events/)
-    -   [mariadb.meetup.com](http://mariadb.meetup.com/)
+    -   [mariadb.meetup.com](https://mariadb.meetup.com/)

 ### Live Q&A for beginner contributors
----
+---
 MariaDB has a dedicated time each week when we answer new contributor questions live on Zulip.
 From 8:00 to 10:00 UTC on Mondays, and 10:00 to 12:00 UTC on Thursdays, anyone can ask any questions they’d like,
 and a live developer will be available to assist.
--- a/2
+++ b/2
@@ -1,4 +1,4 @@
 MYSQL_VERSION_MAJOR=12
 MYSQL_VERSION_MINOR=3
 MYSQL_VERSION_PATCH=2
-SERVER_MATURITY=gamma
+SERVER_MATURITY=stable
--- a/client/mysql.cc
+++ b/client/mysql.cc
@@ -1171,8 +1171,9 @@ static void print_tab_data(MYSQL_RES *result);
 static void print_table_data_vertically(MYSQL_RES *result);
 static void print_warnings(void);
 static void print_last_query_cost(void);
-static void end_timer(ulonglong start_time, char *buff);
-static void nice_time(double sec,char *buff,bool part_second);
+static void end_timer(ulonglong start_time, char *buff, size_t buff_size);
+static void nice_time(double sec, char *buff, size_t buff_size,
+                      bool part_second);
 extern "C" sig_handler mysql_end(int sig) __attribute__ ((noreturn));
 extern "C" sig_handler handle_sigint(int sig);
 #if defined(HAVE_TERMIOS_H) && defined(GWINSZ_IN_SYS_IOCTL)
@@ -1442,18 +1443,20 @@ int main(int argc,char *argv[])
      histfile=my_strdup(PSI_NOT_INSTRUMENTED, histfile, MYF(MY_WME));
    else if ((home= getenv("HOME")))
    {
+      size_t histfile_size=
+        strlen(home) + strlen("/.mysql_history") + 2;
      histfile=(char*) my_malloc(PSI_NOT_INSTRUMENTED,
-            strlen(home) + strlen("/.mariadb_history")+2, MYF(MY_WME));
+            histfile_size, MYF(MY_WME));
      if (histfile)
      {
-        sprintf(histfile,"%s/.mariadb_history", home);
+        snprintf(histfile, histfile_size, "%s/.mariadb_history", home);
        if (my_access(histfile, F_OK))
        {
          /* no .mariadb_history, look for historical name and use if present */
-          sprintf(histfile,"%s/.mysql_history", home);
+          snprintf(histfile, histfile_size, "%s/.mysql_history", home);
          /* and go back to original if not found */
          if (my_access(histfile, F_OK))
-            sprintf(histfile,"%s/.mariadb_history", home);
+            snprintf(histfile, histfile_size, "%s/.mariadb_history", home);
        }
        char link_name[FN_REFLEN];
        if (my_readlink(link_name, histfile, 0) == 0 &&
@@ -1499,7 +1502,7 @@ int main(int argc,char *argv[])

 #endif

-  sprintf(buff, "%s",
+  snprintf(buff, sizeof(buff), "%s",
 	  "Type 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n");
  put_info(buff,INFO_INFO);
  status.exit_status= read_and_execute(!status.batch);
@@ -1670,7 +1673,7 @@ bool kill_query(const char *reason)
    interrupted_query= 2;

  /* kill_buffer is always big enough because max length of %lu is 15 */
-  sprintf(kill_buffer, "KILL %s%lu",
+  snprintf(kill_buffer, sizeof(kill_buffer), "KILL %s%lu",
          (interrupted_query == 1) ? "QUERY " : "",
          mysql_thread_id(&mysql));
  if (verbose)
@@ -2734,7 +2737,7 @@ static bool add_line(String &buffer, char *line, size_t line_length,
      }
      else
      {
-	sprintf(buff,"Unknown command '\\%c'.",inchar);
+	snprintf(buff, sizeof(buff), "Unknown command '\\%c'.", inchar);
 	if (put_info(buff,INFO_ERROR) > 0)
 	  DBUG_RETURN(1);
 	*out++='\\';
@@ -3263,7 +3266,7 @@ You can turn off this feature to get a quicker startup with -A\n\n");
      j=0;
      while ((sql_field=mysql_fetch_field(fields)))
      {
-	sprintf(buf,"%.64s.%.64s",table_row[0],sql_field->name);
+	snprintf(buf, sizeof(buf), "%.64s.%.64s",table_row[0], sql_field->name);
 	field_names[i][j] = strdup_root(&hash_mem_root,buf);
 	add_word(&ht,field_names[i][j]);
 	field_names[i][num_fields+j] = strdup_root(&hash_mem_root,
@@ -3707,7 +3710,7 @@ static int com_go(String *buffer, char *)

    report_progress_end();
    if (verbose >= 3 || !opt_silent)
-      end_timer(timer, time_buff);
+      end_timer(timer, time_buff, sizeof(time_buff));
    else
      time_buff[0]= '\0';

@@ -3743,9 +3746,9 @@ static int com_go(String *buffer, char *)
 	  print_tab_data(result);
 	else
 	  print_table_data(result);
-	sprintf(buff,"%ld %s in set",
-		(long) mysql_num_rows(result),
-		(long) mysql_num_rows(result) == 1 ? "row" : "rows");
+	snprintf(buff, sizeof(buff), "%llu %s in set",
+		(unsigned long long) mysql_num_rows(result),
+		mysql_num_rows(result) == 1 ? "row" : "rows");
 	end_pager();
        if (mysql_errno(&mysql))
        {
@@ -3758,9 +3761,9 @@ static int com_go(String *buffer, char *)
    else if (mysql_affected_rows(&mysql) == ~(ulonglong) 0)
      strmov(buff,"Query OK");
    else
-      sprintf(buff,"Query OK, %ld %s affected",
-	      (long) mysql_affected_rows(&mysql),
-	      (long) mysql_affected_rows(&mysql) == 1 ? "row" : "rows");
+      snprintf(buff, sizeof(buff), "Query OK, %llu %s affected",
+	      (unsigned long long) mysql_affected_rows(&mysql),
+	      mysql_affected_rows(&mysql) == 1 ? "row" : "rows");

    pos=strend(buff);
    if ((warnings= mysql_warning_count(&mysql)))
@@ -3938,7 +3941,7 @@ static char *fieldflags2str(uint f) {
  ff2s_check_flag(ON_UPDATE_NOW);
 #undef ff2s_check_flag
  if (f)
-    sprintf(s, " unknows=0x%04x", f);
+    snprintf(s, sizeof(buf) - (size_t)(s - buf), " unknown=0x%04x", f);
  return buf;
 }

@@ -4689,8 +4692,10 @@ com_edit(String *buffer,char *)
  strxmov(buff,editor," ",filename,NullS);
  if ((error= system(buff)))
  {
-    char errmsg[100];
-    sprintf(errmsg, "Command '%.40s' failed", buff);
+#define EDITOR_FAIL_MSG "Command '%.40s' failed"
+    char errmsg[sizeof(EDITOR_FAIL_MSG) - 1 + 40];
+    snprintf(errmsg, sizeof(errmsg), EDITOR_FAIL_MSG, buff);
+#undef EDITOR_FAIL_MSG
    put_info(errmsg, INFO_ERROR, 0, NullS);
    goto err;
  }
@@ -4836,9 +4841,9 @@ static int com_connect(String *buffer, char *line)

  if (connected)
  {
-    sprintf(buff,"Connection id:    %lu",mysql_thread_id(&mysql));
+    snprintf(buff, sizeof(buff), "Connection id:    %lu",mysql_thread_id(&mysql));
    put_info(buff,INFO_INFO);
-    sprintf(buff,"Current database: %.128s\n",
+    snprintf(buff, sizeof(buff), "Current database: %.128s\n",
 	    current_db ? current_db : "*** NONE ***");
    put_info(buff,INFO_INFO);
  }
@@ -5190,7 +5195,7 @@ sql_real_connect(char *host,char *database,char *user,char *password,
  if (safe_updates)
  {
    char init_command[100];
-    sprintf(init_command,
+    snprintf(init_command, sizeof(init_command),
 	    "SET SQL_SAFE_UPDATES=1,SQL_SELECT_LIMIT=%lu,MAX_JOIN_SIZE=%lu",
 	    select_limit,max_join_size);
    mysql_options(&mysql, MYSQL_INIT_COMMAND, init_command);
@@ -5386,7 +5391,7 @@ static int com_status(String *, char *)
    tee_fprintf(stdout, "%.*s\t\t\t", (int) (pos-status_str), status_str);
    if ((status_str= str2int(pos,10,0,LONG_MAX,(long*) &sec)))
    {
-      nice_time((double) sec,buff,0);
+      nice_time((double) sec,buff, sizeof(buff),0);
      tee_puts(buff, stdout);			/* print nice time */
      while (*status_str == ' ')
        status_str++;  /* to next info */
@@ -5605,8 +5610,10 @@ void tee_putc(int c, FILE *file)

  len("4294967296 days, 23 hours, 59 minutes, 60.000 seconds")  ->  53
 */
-static void nice_time(double sec, char *buff, bool part_second)
+static void nice_time(double sec, char *buff, size_t buff_size,
+                      bool part_second)
 {
+  char *buff_end= buff + buff_size;
  ulong tmp;
  if (sec >= 3600.0*24)
  {
@@ -5630,21 +5637,23 @@ static void nice_time(double sec, char *buff, bool part_second)
    buff=strmov(buff," min ");
  }
  if (part_second)
-    sprintf(buff,"%.3f sec",sec);
+    snprintf(buff, buff_end - buff, "%.3f sec", sec);
  else
-    sprintf(buff,"%d sec",(int) sec);
+    snprintf(buff, buff_end - buff, "%d sec", (int) sec);
 }


-static void end_timer(ulonglong start_time, char *buff)
+static void end_timer(ulonglong start_time, char *buff, size_t buff_size)
 {
  double sec;

+  if (buff_size < 4)
+    return;
  buff[0]=' ';
  buff[1]='(';
  sec= (microsecond_interval_timer() - start_time) / (double) (1000 * 1000);
-  nice_time(sec, buff + 2, 1);
-  strmov(strend(buff),")");
+  nice_time(sec, buff + 2, buff_size - 2, 1);
+  snprintf(strend(buff), buff_size - (strend(buff) - buff), ")");
 }

 static const char *construct_prompt()
--- a/client/mysql_upgrade.c
+++ b/client/mysql_upgrade.c
@@ -511,7 +511,7 @@ static int run_tool(char *tool_path, DYNAMIC_STRING *ds_res, ...)
 static void find_tool(char *tool_executable_name, const char *tool_name, 
                      const char *self_name)
 {
-  char *last_fn_libchar;
+  const char *last_fn_libchar;
  DYNAMIC_STRING ds_tmp;
  DBUG_ENTER("find_tool");
  DBUG_PRINT("enter", ("progname: %s", my_progname));
--- a/client/mysqladmin.cc
+++ b/client/mysqladmin.cc
@@ -1367,7 +1367,7 @@ static int drop_db(MYSQL *mysql, const char *db)
      return -1;
    }
  }
-  snprintf(name_buff,sizeof(name_buff), "drop database `%.*s`",FN_REFLEN,db);
+  snprintf(name_buff, sizeof(name_buff), "drop database `%.*s`",FN_REFLEN,db);
  if (mysql_query(mysql,name_buff))
  {
    my_printf_error(0, "DROP DATABASE %s failed;\nerror: '%s'", error_flags,
--- a/client/mysqlbinlog.cc
+++ b/client/mysqlbinlog.cc
@@ -332,13 +332,14 @@ class Load_log_processor
    @retval -1 Error (can't find new filename).
    @retval >=0 Found file.
  */
-  File create_unique_file(char *filename, char *file_name_end, size_t file_name_end_size)
+  File create_unique_file(char *filename, char *file_name_end,
+                          size_t buf_remaining)
    {
      File res;
      /* If we have to try more than 1000 times, something is seriously wrong */
      for (uint version= 0; version<1000; version++)
      {
-	snprintf(file_name_end, file_name_end_size,"-%x",version);
+	snprintf(file_name_end, buf_remaining, "-%x", version);
 	if ((res= my_create(filename,0,
 			    O_CREAT|O_EXCL|O_BINARY|O_WRONLY,MYF(0)))!=-1)
 	  return res;
@@ -460,9 +461,12 @@ Exit_status Load_log_processor::process_first_event(const char *bname,
  ptr= fname + target_dir_name_len;
  memcpy(ptr,bname,blen);
  ptr+= blen;
-  ptr+= snprintf(ptr, full_len - (ptr - fname), "-%x", file_id);
+  //ptr points to fname (with the size = full_len) + target_dir_name_len
+  //so the rest of fname has size full_len - target_dir_name_len
+  ptr+= snprintf(ptr, full_len - target_dir_name_len, "-%x", file_id);

-  if ((file= create_unique_file(fname,ptr,full_len - (ptr - fname))) < 0)
+  if ((file= create_unique_file(fname, ptr,
+                                full_len - (size_t) (ptr - fname))) < 0)
  {
    error("Could not construct local filename %s%s.",
          target_dir_name,bname);
@@ -1326,8 +1330,7 @@ Exit_status process_event(PRINT_EVENT_INFO *print_event_info, Log_event *ev,
            exit(1);
          }

-          memset(tmp_sql, 0, sizeof(tmp_sql));
-          sprintf(tmp_sql, " "
+          snprintf(tmp_sql, sizeof(tmp_sql), " "
                  "SELECT Group_concat(cols) "
                  "FROM   (SELECT 'op_type char(1)' cols "
                  "  UNION ALL "
@@ -1373,13 +1376,11 @@ Exit_status process_event(PRINT_EVENT_INFO *print_event_info, Log_event *ev,
            }
            else
            {
-              memset(tmp_sql, 0, sizeof(tmp_sql));
-              sprintf(tmp_sql, "__%s", map->get_table_name());
+              snprintf(tmp_sql, sizeof(tmp_sql), "__%s", map->get_table_name());
              ev->set_flashback_review_tablename(tmp_sql);
            }
-            memset(tmp_sql, 0, sizeof(tmp_sql));
-            tmp_sql_offset= sprintf(tmp_sql, "CREATE TABLE IF NOT EXISTS");
-            tmp_sql_offset+= sprintf(tmp_sql + tmp_sql_offset, " `%s`.`%s` (%s) %s",
+            tmp_sql_offset= snprintf(tmp_sql, sizeof(tmp_sql), "CREATE TABLE IF NOT EXISTS");
+            tmp_sql_offset+= snprintf(tmp_sql + tmp_sql_offset, sizeof(tmp_sql) - (uint) tmp_sql_offset, " `%s`.`%s` (%s) %s",
                                     ev->get_flashback_review_dbname(),
                                     ev->get_flashback_review_tablename(),
                                     row[0],
@@ -1403,7 +1404,7 @@ Exit_status process_event(PRINT_EVENT_INFO *print_event_info, Log_event *ev,
          else
          {
            memset(tmp_str, 0, sizeof(tmp_str));
-            sprintf(tmp_str, "__%s", map->get_table_name());
+            snprintf(tmp_str, sizeof(tmp_str), "__%s", map->get_table_name());
            ev->set_flashback_review_tablename(tmp_str);
          }
        }
@@ -2659,8 +2660,8 @@ static Exit_status check_master_version()
      rpl_gtid *start_gtid= &start_gtids[gtid_idx];

      snprintf(buf, sizeof(buf), "%u-%u-%llu",
-              start_gtid->domain_id, start_gtid->server_id,
-              start_gtid->seq_no);
+               start_gtid->domain_id, start_gtid->server_id,
+               start_gtid->seq_no);
      query_str.append(buf, strlen(buf));
      if (gtid_idx < n_start_gtids - 1)
        query_str.append(',');
--- a/client/mysqlcheck.c
+++ b/client/mysqlcheck.c
@@ -984,7 +984,7 @@ static int handle_request_for_tables(char *tables, size_t length,
    DBUG_ASSERT(strlen(op)+strlen(tables)+strlen(options)+8+1 <= query_size);

    /* No backticks here as we added them before */
-    query_length= sprintf(query, "%s%s%s %s", op,
+    query_length= snprintf(query, query_size, "%s%s%s %s", op,
                          tab_view, tables, options);
    table_name= tables;
  }
@@ -1013,7 +1013,7 @@ static int handle_request_for_tables(char *tables, size_t length,
  print_result();
  if (opt_flush_tables)
  {
-    query_length= sprintf(query, "FLUSH TABLES %s", table_name);
+    query_length= snprintf(query, query_size, "FLUSH TABLES %s", table_name);
    if (mysql_real_query(sock, query, (ulong)query_length))
    {
      DBerror(sock, query);
--- a/client/mysqldump.cc
+++ b/client/mysqldump.cc
@@ -134,6 +134,8 @@ static my_bool  verbose= 0, opt_no_create_info= 0, opt_no_data= 0, opt_no_data_m
                opt_alltspcs=0, opt_notspcs= 0, opt_logging,
                opt_header=0, opt_update_history= 0,
                opt_drop_trigger= 0, opt_dump_history= 0, opt_wildcards= 0;
+static my_bool opt_galera_info= 0;
+
 #define OPT_SYSTEM_ALL 1
 #define OPT_SYSTEM_USERS 2
 #define OPT_SYSTEM_PLUGINS 4
@@ -626,6 +628,9 @@ static struct my_option my_long_options[] =
  {"default_auth", 0, "Default authentication client-side plugin to use.",
   &opt_default_auth, &opt_default_auth, 0,
   GET_STR, REQUIRED_ARG, 0, 0, 0, 0, 0, 0},
+  {"galera-info", 0, "Include galera info at the end of dump.",
+   &opt_galera_info, &opt_galera_info, 0, GET_BOOL,
+   NO_ARG, 0, 0, 0, 0, 0, 0},
  {0, 0, 0, 0, 0, 0, GET_NO_ARG, NO_ARG, 0, 0, 0, 0, 0, 0}
 };

@@ -679,6 +684,7 @@ static inline int cmp_table(const char *a, const char *b)
  return my_strcasecmp_latin1(a, b);
 }

+static int dump_galera_info(MYSQL *mysql_con);

 /*
  Print the supplied message if in verbose mode
@@ -878,7 +884,7 @@ static void write_footer(FILE *sql_file)
    if (opt_dump_date)
    {
      char time_str[20];
-      get_date(time_str, GETDATE_DATE_TIME, 0);
+      get_date(time_str, sizeof(time_str), GETDATE_DATE_TIME, 0);
      print_comment(sql_file, 0, "-- Dump completed on %s\n", time_str);
    }
    else
@@ -6365,7 +6371,8 @@ const char fmt_gtid_pos[]= "%sSET GLOBAL gtid_slave_pos='%s';\n";

 static int do_show_master_status(MYSQL *mysql_con, int consistent_binlog_pos,
                                 int have_mariadb_gtid, int use_gtid,
-                                 char *set_gtid_pos, size_t set_gtid_pos_size)
+                                 char *set_gtid_pos,
+                                 size_t set_gtid_pos_size)
 {
  MYSQL_ROW row;
  MYSQL_RES *UNINIT_VAR(master);
@@ -6441,7 +6448,7 @@ static int do_show_master_status(MYSQL *mysql_con, int consistent_binlog_pos,
                    "later in the file.\n");
    }
    snprintf(set_gtid_pos, set_gtid_pos_size, fmt_gtid_pos,
-            (!use_gtid ? "-- " : comment_prefix), gtid_pos);
+             (!use_gtid ? "-- " : comment_prefix), gtid_pos);
  }

  /* SHOW MASTER STATUS reports file and position */
@@ -6531,7 +6538,7 @@ static int add_slave_statements(void)
 }

 static int do_show_slave_status(MYSQL *mysql_con, int have_mariadb_gtid,
-                                int use_gtid, char* set_gtid_pos,
+                                int use_gtid, char *set_gtid_pos,
                                size_t set_gtid_pos_size)
 {
  MYSQL_RES *UNINIT_VAR(slave);
@@ -6577,8 +6584,8 @@ static int do_show_slave_status(MYSQL *mysql_con, int have_mariadb_gtid,
                  "\n-- A corresponding to the below dump-slave "
                  "CHANGE-MASTER settings to the slave gtid state is printed "
                  "later in the file.\n");
-    snprintf(set_gtid_pos, set_gtid_pos_size,
-             fmt_gtid_pos, gtid_comment_prefix, gtid_pos);
+    snprintf(set_gtid_pos, set_gtid_pos_size, fmt_gtid_pos,
+             gtid_comment_prefix, gtid_pos);
  }
  if (use_gtid)
    print_comment(md_result_file, 0,
@@ -6654,8 +6661,7 @@ static int do_start_slave_sql(MYSQL *mysql_con)
      {
        char query[160];
        if (multi_source)
-          snprintf(query, sizeof(query),
-                   "START SLAVE '%.80s' SQL_THREAD", row[0]);
+          snprintf(query, sizeof(query), "START SLAVE '%.80s' SQL_THREAD", row[0]);
        else
          strmov(query, "START SLAVE SQL_THREAD");

@@ -7754,12 +7760,14 @@ int main(int argc, char **argv)

  if (opt_master_data && do_show_master_status(mysql, consistent_binlog_pos,
                                               have_mariadb_gtid,
-                                               opt_use_gtid, master_set_gtid_pos,
+                                               opt_use_gtid,
+                                               master_set_gtid_pos,
                                               sizeof(master_set_gtid_pos)))
    goto err;
  if (opt_slave_data && do_show_slave_status(mysql,
                                             have_mariadb_gtid,
-                                             opt_use_gtid, slave_set_gtid_pos,
+                                             opt_use_gtid,
+                                             slave_set_gtid_pos,
                                             sizeof(slave_set_gtid_pos)))
    goto err;
  if (opt_single_transaction && do_unlock_tables(mysql)) /* unlock but no commit! */
@@ -7848,6 +7856,8 @@ int main(int argc, char **argv)
  if (opt_slave_data && slave_set_gtid_pos[0])
    do_print_set_gtid_slave_pos(slave_set_gtid_pos, FALSE);

+  if (opt_galera_info && dump_galera_info(mysql)) goto err;
+
  /* add 'START SLAVE' to end of dump */
  if (opt_slave_apply && add_slave_statements())
    goto err;
@@ -7887,3 +7897,46 @@ err:

  return(first_error);
 } /* main */
+
+static int dump_galera_info(MYSQL *mysql_con)
+{
+  MYSQL_RES *wsrep_on_res;
+  MYSQL_ROW wsrep_on_row;
+  my_bool wsrep_on = FALSE;
+  char *wsrep_on_val = NULL;
+
+  // Galera information exists only if this node is part of cluster
+  if (mysql_query_with_error_report(mysql_con, &wsrep_on_res,
+                                    "SHOW VARIABLES LIKE 'wsrep_on'"))
+    return 1;
+
+  wsrep_on_row = mysql_fetch_row(wsrep_on_res);
+  wsrep_on_val = wsrep_on_row ? (char *)wsrep_on_row[1] : NULL;
+  wsrep_on = (wsrep_on_val && strcmp(wsrep_on_val, "OFF")) ? TRUE : FALSE;
+  mysql_free_result(wsrep_on_res);
+
+  if (wsrep_on)
+  {
+    MYSQL_RES *wsrep_checkpoint_res;
+    MYSQL_ROW wsrep_checkpoint_row;
+    char *wsrep_checkpoint_val = NULL;
+
+    if (mysql_query_with_error_report(mysql_con, &wsrep_checkpoint_res,
+                                      "SHOW STATUS LIKE 'wsrep_checkpoint_position'"))
+      return 1;
+
+    wsrep_checkpoint_row = mysql_fetch_row(wsrep_checkpoint_res);
+    wsrep_checkpoint_val = wsrep_checkpoint_row ? (char *)wsrep_checkpoint_row[1] : NULL;
+
+    if (wsrep_checkpoint_val)
+    {
+      fprintf(md_result_file,
+              "SET GLOBAL wsrep_start_position = '%s';\n",
+              wsrep_checkpoint_val);
+
+    }
+    mysql_free_result(wsrep_checkpoint_res);
+  }
+
+  return 0;
+}
--- a/client/mysqltest.cc
+++ b/client/mysqltest.cc
@@ -1544,12 +1544,12 @@ void do_eval(DYNAMIC_STRING *query_eval, const char *query,
      }
      else
      {
-	if (!(v= var_get(p, &p, 0, 0)))
+        if (!(v= var_get(p, &p, 0, 0)) || !v->str_val)
        {
          report_or_die( "Bad variable in eval");
          DBUG_VOID_RETURN;
        }
-	dynstr_append_mem(query_eval, v->str_val, v->str_val_len);
+        dynstr_append_mem(query_eval, v->str_val, v->str_val_len);
      }
      break;
    case '\\':
@@ -2158,15 +2158,16 @@ void log_msg(const char *fmt, ...)
  SYNOPSIS
  cat_file
  ds - pointer to dynamic string where to add the files content
-  filename - name of the file to read
-
+  filename  - name of the file to read
+  max_lines - number of lines to print. 0 == all
 */

-int cat_file(DYNAMIC_STRING* ds, const char* filename)
+int cat_file(DYNAMIC_STRING* ds, const char* filename, uint max_lines)
 {
  int fd;
  size_t len;
  char *buff;
+  uint line= 0;                             // Enough for mtr

  if ((fd= my_open(filename, O_RDONLY, MYF(0))) < 0)
    return 1;
@@ -2183,28 +2184,35 @@ int cat_file(DYNAMIC_STRING* ds, const char* filename)
  len= my_read(fd, (uchar*)buff, len, MYF(0));
  my_close(fd, MYF(0));

+  if (!max_lines)
+    max_lines= 10000;                           // Enough for mtr
+
+  char *p= buff, *start= buff, *end=buff+len;
+  while (p < end && line < max_lines)
  {
-    char *p= buff, *start= buff,*end=buff+len;
-    while (p < end)
+    /* Convert cr/lf to lf */
+    if (*p == '\r' && p+1 < end && *(p+1)== '\n')
    {
-      /* Convert cr/lf to lf */
-      if (*p == '\r' && p+1 < end && *(p+1)== '\n')
-      {
-        /* Add fake newline instead of cr and output the line */
-        *p= '\n';
-        p++; /* Step past the "fake" newline */
-        *p= 0;
-        replace_dynstr_append_mem(ds, start, p-start);
-        p++; /* Step past the "fake" newline */
-        start= p;
-      }
-      else
-        p++;
+      /* Add fake newline instead of cr and output the line */
+      *p= '\n';
+      p++; /* Step past the "fake" newline */
+      *p= 0;
+      replace_dynstr_append_mem(ds, start, p-start);
+      p++; /* Step past the "fake" newline */
+      start= p;
+      line++;
+    }
+    else
+    {
+      if (*p == '\n')
+        line++;
+      p++;
    }
-    /* Output any chars that migh be left */
-    *p= 0;
-    replace_dynstr_append_mem(ds, start, p-start);
  }
+  /* Output any chars that migh be left */
+  *p= 0;
+  replace_dynstr_append_mem(ds, start, p-start);
+
  my_free(buff);
  return 0;
 }
@@ -2451,11 +2459,11 @@ void show_diff(DYNAMIC_STRING* ds,
    dynstr_append_mem(&ds_tmp, STRING_WITH_LEN(" --- "));
    dynstr_append_mem(&ds_tmp, filename1, strlen(filename1));
    dynstr_append_mem(&ds_tmp, STRING_WITH_LEN(" >>>\n"));
-    cat_file(&ds_tmp, filename1);
+    cat_file(&ds_tmp, filename1, 0);
    dynstr_append_mem(&ds_tmp, STRING_WITH_LEN("<<<\n --- "));
    dynstr_append_mem(&ds_tmp, filename1, strlen(filename1));
    dynstr_append_mem(&ds_tmp, STRING_WITH_LEN(" >>>\n"));
-    cat_file(&ds_tmp, filename2);
+    cat_file(&ds_tmp, filename2, 0);
    dynstr_append_mem(&ds_tmp, STRING_WITH_LEN("<<<<\n"));
  }

@@ -2921,7 +2929,7 @@ VAR* var_get(const char *var_name, const char **var_name_end, my_bool raw,

  if (!raw && v->int_dirty)
  {
-    sprintf(v->str_val, "%d", v->int_val);
+    snprintf(v->str_val, v->alloced_len, "%d", v->int_val);
    v->int_dirty= false;
    v->str_val_len = strlen(v->str_val);
  }
@@ -2983,7 +2991,7 @@ void var_set(const char *var_name, const char *var_name_end,
  {
    if (v->int_dirty)
    {
-      sprintf(v->str_val, "%d", v->int_val);
+      snprintf(v->str_val, v->alloced_len, "%d", v->int_val);
      v->int_dirty=false;
      v->str_val_len= strlen(v->str_val);
    }
@@ -4859,9 +4867,11 @@ void do_append_file(struct st_command *command)
 void do_cat_file(struct st_command *command)
 {
  int error;
-  static DYNAMIC_STRING ds_filename;
+  static DYNAMIC_STRING ds_filename, ds_lines;
+  uint lines= 0;
  const struct command_arg cat_file_args[] = {
-    { "filename", ARG_STRING, TRUE, &ds_filename, "File to read from" }
+    { "filename", ARG_STRING, TRUE, &ds_filename, "File to read from" },
+    { "lines", ARG_STRING, FALSE, &ds_lines, "Number of lines to print"}
  };
  DBUG_ENTER("do_cat_file");

@@ -4873,9 +4883,13 @@ void do_cat_file(struct st_command *command)

  DBUG_PRINT("info", ("Reading from, file: %s", ds_filename.str));

-  error= cat_file(&ds_res, ds_filename.str);
+  if (ds_lines.length)
+    lines= atoi(ds_lines.str);
+
+  error= cat_file(&ds_res, ds_filename.str, lines);
  handle_command_error(command, error, my_errno);
  dynstr_free(&ds_filename);
+  dynstr_free(&ds_lines);
  DBUG_VOID_RETURN;
 }

@@ -5289,7 +5303,8 @@ void do_sync_with_master2(struct st_command *command, long offset,
  if (!master_pos.file[0])
    die("Calling 'sync_with_master' without calling 'save_master_pos'");

-  sprintf(query_buf, "select master_pos_wait('%s', %ld, %d, '%s')",
+  snprintf(query_buf, sizeof(query_buf),
+          "select master_pos_wait('%s', %ld, %d, '%s')",
          master_pos.file, master_pos.pos + offset, timeout,
          connection_name);

@@ -6198,9 +6213,9 @@ static int cmp_decimal(const My_string &a, const My_string &b)
  size_t b_len= b.length();

  // Skip leading whitespace
-  while (a_len > 0 && isspace(*a_ptr))
+  while (a_len > 0 && my_isspace(charset_info, *a_ptr))
    a_ptr++, a_len--;
-  while (b_len > 0 && isspace(*b_ptr))
+  while (b_len > 0 && my_isspace(charset_info, *b_ptr))
    b_ptr++, b_len--;

  // Handle empty strings (treat as 0)
@@ -6222,8 +6237,8 @@ static int cmp_decimal(const My_string &a, const My_string &b)

  // Find actual numeric length (digits only)
  size_t a_digits= 0, b_digits= 0;
-  for (size_t i= 0; i < a_len && isdigit(a_ptr[i]); i++) a_digits++;
-  for (size_t i= 0; i < b_len && isdigit(b_ptr[i]); i++) b_digits++;
+  for (size_t i= 0; i < a_len && my_isdigit(charset_info, a_ptr[i]); i++) a_digits++;
+  for (size_t i= 0; i < b_len && my_isdigit(charset_info, b_ptr[i]); i++) b_digits++;

  // Handle zero cases after removing leading zeros
  bool a_is_zero= (a_digits == 0);
@@ -9324,8 +9339,9 @@ void do_block(enum block_cmd cmd, struct st_command* command)

  /* Parse and evaluate test expression */
  expr_start= strchr(p, '(');
-  if (!expr_start++)
+  if (!expr_start)
    die("missing '(' in %s", cmd_name);
+  expr_start++;

  while (my_isspace(charset_info, *expr_start))
    expr_start++;
@@ -10935,7 +10951,7 @@ void append_info(DYNAMIC_STRING *ds, ulonglong affected_rows,
                 const char *info)
 {
  char buf[40], buff2[21];
-  size_t len= sprintf(buf,"affected rows: %s\n", llstr(affected_rows, buff2));
+  size_t len= snprintf(buf, sizeof(buf), "affected rows: %s\n", llstr(affected_rows, buff2));
  dynstr_append_mem(ds, buf, len);
  if (info)
  {
@@ -13343,7 +13359,7 @@ int main(int argc, char **argv)
      case Q_DIFF_FILES: do_diff_files(command); break;
      case Q_SEND_QUIT: do_send_quit(command); break;
      case Q_CHANGE_USER: do_change_user(command); break;
-      case Q_CAT_FILE: do_cat_file(command); break;
+      case Q_CAT_FILE: do_cat_file(command); command_executed++; break;
      case Q_COPY_FILE: do_copy_file(command); break;
      case Q_MOVE_FILE: do_move_file(command); break;
      case Q_CHMOD_FILE: do_chmod_file(command); break;
--- a/cmake/build_configurations/mysql_release.cmake
+++ b/cmake/build_configurations/mysql_release.cmake
@@ -171,152 +171,3 @@ IF(UNIX)
    ENDIF()
  ENDIF()
 ENDIF()
-
-# Compiler options
-IF(UNIX)  
-
-  # Default GCC flags
-  IF(CMAKE_C_COMPILER_ID STREQUAL "GNU")
-    SET(COMMON_C_FLAGS               "-g -fno-omit-frame-pointer -fno-strict-aliasing  -Wno-uninitialized")
-    STRING(APPEND CMAKE_C_FLAGS_DEBUG          " ${COMMON_C_FLAGS}")
-    STRING(APPEND CMAKE_C_FLAGS_RELEASE        " ${COMMON_C_FLAGS}")
-    STRING(APPEND CMAKE_C_FLAGS_RELWITHDEBINFO " ${COMMON_C_FLAGS}")
-    # MariaDB uses -O3 for release builds
-    STRING(REGEX REPLACE "-O2" "-O3" CMAKE_C_FLAGS_RELEASE "${CMAKE_C_FLAGS_RELEASE}")
-    STRING(REGEX REPLACE "-O2" "-O3" CMAKE_C_FLAGS_RELWITHDEBINFO "${CMAKE_C_FLAGS_RELWITHDEBINFO}")
-  ENDIF()
-  IF(CMAKE_CXX_COMPILER_ID STREQUAL "GNU")
-    SET(COMMON_CXX_FLAGS               "-g -fno-omit-frame-pointer -fno-strict-aliasing -Wno-uninitialized")
-    STRING(APPEND CMAKE_CXX_FLAGS_DEBUG          " ${COMMON_CXX_FLAGS}")
-    STRING(APPEND CMAKE_CXX_FLAGS_RELEASE        " ${COMMON_CXX_FLAGS}")
-    STRING(APPEND CMAKE_CXX_FLAGS_RELWITHDEBINFO " ${COMMON_CXX_FLAGS}")
-    # MariaDB uses -O3 for release builds
-    STRING(REGEX REPLACE "-O2" "-O3" CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE}")
-    STRING(REGEX REPLACE "-O2" "-O3" CMAKE_CXX_FLAGS_RELWITHDEBINFO "${CMAKE_CXX_FLAGS_RELWITHDEBINFO}")
-  ENDIF()
-
-  # IBM Z flags
-  IF(CMAKE_SYSTEM_PROCESSOR MATCHES "s390x")
-    IF(RPM MATCHES "(rhel|centos)6" OR RPM MATCHES "(suse|sles)11")
-      SET(z_flags "-funroll-loops -march=z9-109 -mtune=z10")
-    ELSEIF(RPM MATCHES "(rhel|centos)7" OR RPM MATCHES "(suse|sles)12")
-      SET(z_flags "-funroll-loops -march=z196 -mtune=zEC12")
-    ELSE()
-      SET(z_flags "")
-    ENDIF()
-
-    IF(CMAKE_C_COMPILER_ID STREQUAL "GNU")
-      STRING(APPEND CMAKE_C_FLAGS_RELEASE " ${z_flags}")
-      STRING(APPEND CMAKE_C_FLAGS_RELWITHDEBINFO " ${z_flags}")
-    ENDIF()
-    IF(CMAKE_CXX_COMPILER_ID STREQUAL "GNU")
-      STRING(APPEND CMAKE_CXX_FLAGS_RELEASE " ${z_flags}")
-      STRING(APPEND CMAKE_CXX_FLAGS_RELWITHDEBINFO " ${z_flags}")
-    ENDIF()
-    UNSET(z_flags)
-  ENDIF()
-
-  # HPUX flags
-  IF(CMAKE_SYSTEM_NAME MATCHES "HP-UX")
-    IF(CMAKE_C_COMPILER_ID MATCHES "HP")
-      IF(CMAKE_SYSTEM_PROCESSOR MATCHES "ia64")
-        SET(COMMON_C_FLAGS                 "+DSitanium2 -mt -AC99")
-        SET(COMMON_CXX_FLAGS               "+DSitanium2 -mt -Aa")
-        STRING(APPEND CMAKE_C_FLAGS_DEBUG      " +O0 -g ${COMMON_C_FLAGS}")
-        STRING(APPEND CMAKE_CXX_FLAGS_DEBUG    " +O0 -g ${COMMON_CXX_FLAGS}")
-        STRING(APPEND CMAKE_C_FLAGS_RELEASE    " +O0 -g ${COMMON_C_FLAGS}")
-        STRING(APPEND CMAKE_CXX_FLAGS_RELEASE  " +O0 -g ${COMMON_CXX_FLAGS}")
-        # We have seen compiler bugs with optimisation and -g, so disabled for now
-        STRING(APPEND CMAKE_C_FLAGS_RELEASE    " +O2 ${COMMON_C_FLAGS}")
-        STRING(APPEND CMAKE_CXX_FLAGS_RELEASE  " +O2 ${COMMON_CXX_FLAGS}")
-      ENDIF()
-    ENDIF()
-    SET(WITH_SSL no)
-  ENDIF()
-
-  # Linux flags
-  IF(CMAKE_SYSTEM_NAME MATCHES "Linux")
-    IF(CMAKE_C_COMPILER_ID MATCHES "Intel")
-      SET(COMMON_C_FLAGS                 "-static-intel -static-libgcc -g -mp -restrict")
-      SET(COMMON_CXX_FLAGS               "-static-intel -static-libgcc -g -mp -restrict -fno-exceptions")
-      IF(CMAKE_SYSTEM_PROCESSOR MATCHES "ia64")
-        SET(COMMON_C_FLAGS               "${COMMON_C_FLAGS} -no-ftz -no-prefetch")
-        SET(COMMON_CXX_FLAGS             "${COMMON_CXX_FLAGS} -no-ftz -no-prefetch")
-      ENDIF()
-      STRING(APPEND CMAKE_C_FLAGS_DEBUG   " ${COMMON_C_FLAGS}")
-      STRING(APPEND CMAKE_CXX_FLAGS_DEBUG " ${COMMON_CXX_FLAGS}")
-      STRING(APPEND CMAKE_C_FLAGS_RELEASE " -unroll2 -ip ${COMMON_C_FLAGS}")
-      STRING(APPEND CMAKE_CXX_FLAGS_RELEASE " -unroll2 -ip ${COMMON_CXX_FLAGS}")
-      STRING(APPEND CMAKE_C_FLAGS_RELWITHDEBINFO " -unroll2 -ip ${COMMON_C_FLAGS}")
-      STRING(APPEND CMAKE_CXX_FLAGS_RELWITHDEBINFO " -unroll2 -ip ${COMMON_CXX_FLAGS}")
-
-      # MariaDB uses -O3 for release builds.
-      STRING(REGEX REPLACE "-O2" "-O3" CMAKE_C_FLAGS_RELEASE "${CMAKE_C_FLAGS_RELEASE}")
-      STRING(REGEX REPLACE "-O2" "-O3" CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE}")
-      STRING(REGEX REPLACE "-O2" "-O3" CMAKE_C_FLAGS_RELWITHDEBINFO "${CMAKE_C_FLAGS_RELWITHDEBINFO}")
-      STRING(REGEX REPLACE "-O2" "-O3" CMAKE_CXX_FLAGS_RELWITHDEBINFO "${CMAKE_CXX_FLAGS_RELWITHDEBINFO}")
-      SET(WITH_SSL no)
-    ENDIF()
-  ENDIF()
-
-  # Default Clang flags
-  IF(CMAKE_C_COMPILER_ID MATCHES "Clang")
-    SET(COMMON_C_FLAGS               "-g -fno-omit-frame-pointer -fno-strict-aliasing -Wno-parentheses-equality -Wno-string-plus-int")
-    STRING(APPEND CMAKE_C_FLAGS_DEBUG          " ${COMMON_C_FLAGS}")
-    STRING(APPEND CMAKE_C_FLAGS_RELEASE        " ${COMMON_C_FLAGS}")
-    STRING(APPEND CMAKE_C_FLAGS_RELWITHDEBINFO " ${COMMON_C_FLAGS}")
-    # MariaDB uses -O3 for release builds.
-    STRING(REGEX REPLACE "-O2" "-O3" CMAKE_C_FLAGS_RELEASE "${CMAKE_C_FLAGS_RELEASE}")
-    STRING(REGEX REPLACE "-O2" "-O3" CMAKE_C_FLAGS_RELWITHDEBINFO "${CMAKE_C_FLAGS_RELWITHDEBINFO}")
-  ENDIF()
-  IF(CMAKE_CXX_COMPILER_ID MATCHES "Clang")
-    SET(COMMON_CXX_FLAGS               "-g -fno-omit-frame-pointer -fno-strict-aliasing -Wno-parentheses-equality -Wno-string-plus-int")
-    STRING(APPEND CMAKE_CXX_FLAGS_DEBUG          " ${COMMON_CXX_FLAGS}")
-    STRING(APPEND CMAKE_CXX_FLAGS_RELEASE        " ${COMMON_CXX_FLAGS}")
-    STRING(APPEND CMAKE_CXX_FLAGS_RELWITHDEBINFO " ${COMMON_CXX_FLAGS}")
-    # MariaDB uses -O3 for release builds.
-    STRING(REGEX REPLACE "-O2" "-O3" CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE}")
-    STRING(REGEX REPLACE "-O2" "-O3" CMAKE_CXX_FLAGS_RELWITHDEBINFO "${CMAKE_CXX_FLAGS_RELWITHDEBINFO}")
-  ENDIF()
-
-  # Solaris flags
-  IF(CMAKE_SYSTEM_NAME MATCHES "SunOS")
-    IF(CMAKE_SYSTEM_VERSION VERSION_GREATER "5.9")
-      # Link mysqld with mtmalloc on Solaris 10 and later
-      SET(WITH_MYSQLD_LDFLAGS "-lmtmalloc" CACHE STRING "")
-    ENDIF()
-    IF(CMAKE_C_COMPILER_ID MATCHES "SunPro")
-      IF(CMAKE_SYSTEM_PROCESSOR MATCHES "i386")
-        SET(COMMON_C_FLAGS                   "-g -mt -fsimple=1 -ftrap=%none -nofstore -xbuiltin=%all -xlibmil -xlibmopt -xtarget=generic")
-        SET(COMMON_CXX_FLAGS                 "-g0 -mt -fsimple=1 -ftrap=%none -nofstore -xbuiltin=%all -features=no%except -xlibmil -xlibmopt -xtarget=generic")
-        STRING(APPEND CMAKE_C_FLAGS_DEBUG    " -xO1 ${COMMON_C_FLAGS}")
-        STRING(APPEND CMAKE_CXX_FLAGS_DEBUG  " -xO1 ${COMMON_CXX_FLAGS}")
-        IF(32BIT)
-          STRING(APPEND CMAKE_C_FLAGS_RELEASE          " -xO2 ${COMMON_C_FLAGS}")
-          STRING(APPEND CMAKE_CXX_FLAGS_RELEASE        " -xO2 ${COMMON_CXX_FLAGS}")
-          STRING(APPEND CMAKE_C_FLAGS_RELWITHDEBINFO   " -xO2 ${COMMON_C_FLAGS}")
-          STRING(APPEND CMAKE_CXX_FLAGS_RELWITHDEBINFO " -xO2 ${COMMON_CXX_FLAGS}")
-        ELSEIF(64BIT)
-          STRING(APPEND CMAKE_C_FLAGS_RELEASE          " -xO3 ${COMMON_C_FLAGS}")
-          STRING(APPEND CMAKE_CXX_FLAGS_RELEASE        " -xO3 ${COMMON_CXX_FLAGS}")
-          STRING(APPEND CMAKE_C_FLAGS_RELWITHDEBINFO   " -xO3 ${COMMON_C_FLAGS}")
-          STRING(APPEND CMAKE_CXX_FLAGS_RELWITHDEBINFO " -xO3 ${COMMON_CXX_FLAGS}")
-        ENDIF()
-      ELSE()
-        # Assume !x86 is SPARC
-        SET(COMMON_C_FLAGS                 "-g -Xa -xstrconst -mt")
-        SET(COMMON_CXX_FLAGS               "-g0 -noex -mt")
-        IF(32BIT)
-          STRING(APPEND COMMON_C_FLAGS   " -xarch=sparc")
-          STRING(APPEND COMMON_CXX_FLAGS " -xarch=sparc")
-        ENDIF()
-        STRING(APPEND CMAKE_C_FLAGS_DEBUG            " ${COMMON_C_FLAGS}")
-        STRING(APPEND CMAKE_CXX_FLAGS_DEBUG          " ${COMMON_CXX_FLAGS}")
-        STRING(APPEND CMAKE_C_FLAGS_RELEASE          " -xO3 ${COMMON_C_FLAGS}")
-        STRING(APPEND CMAKE_CXX_FLAGS_RELEASE        " -xO3 ${COMMON_CXX_FLAGS}")
-        STRING(APPEND CMAKE_C_FLAGS_RELWITHDEBINFO   " -xO3 ${COMMON_C_FLAGS}")
-        STRING(APPEND CMAKE_CXX_FLAGS_RELWITHDEBINFO " -xO3 ${COMMON_CXX_FLAGS}")
-      ENDIF()
-    ENDIF()
-  ENDIF()
-ENDIF()
--- a/cmake/build_depends.cmake
+++ b/cmake/build_depends.cmake
@@ -39,7 +39,9 @@ IF(RPM)
      SET(BUILD_DEPS ${BUILD_DEPS} ${${V}_DEP})
    ENDIF()
  ENDFOREACH()
-  IF (BUILD_DEPS)
+  get_property(_extra_rpm_buildrequires GLOBAL PROPERTY RPM_EXTRA_BUILDREQUIRES)
+  IF (BUILD_DEPS OR _extra_rpm_buildrequires)
+    LIST(APPEND BUILD_DEPS ${_extra_rpm_buildrequires})
    LIST(REMOVE_DUPLICATES BUILD_DEPS)
    STRING(REPLACE ";" " " CPACK_RPM_BUILDREQUIRES "${BUILD_DEPS}")
  ENDIF()
--- a/cmake/cpack_rpm.cmake
+++ b/cmake/cpack_rpm.cmake
@@ -232,10 +232,6 @@ SETA(CPACK_RPM_client_PACKAGE_REQUIRES

 SETA(CPACK_RPM_common_PACKAGE_CONFLICTS
  "MariaDB-server < 10.6.1")
-SETA(CPACK_RPM_common_PACKAGE_OBSOLETES
-  "mysql-common")
-SETA(CPACK_RPM_common_PACKAGE_PROVIDES
-  "mysql-common")

 SETA(CPACK_RPM_devel_PACKAGE_OBSOLETES
  "MySQL-devel")
--- a/cmake/libutils.cmake
+++ b/cmake/libutils.cmake
@@ -212,11 +212,7 @@ MACRO(MERGE_STATIC_LIBS TARGET OUTPUT_NAME LIBS_TO_MERGE)
    ELSE()
      # Generic Unix, Cygwin or MinGW. In post-build step, call
      # script, that uses a MRI script to append static archives.
-      IF(CMAKE_VERSION VERSION_LESS "3.0")
-        SET(MRI_SCRIPT "${CMAKE_CURRENT_BINARY_DIR}/${TARGET}.mri")
-      ELSE()
-        SET(MRI_SCRIPT "${CMAKE_CURRENT_BINARY_DIR}/${TARGET}-$<CONFIG>.mri")
-      ENDIF()
+      SET(MRI_SCRIPT "${CMAKE_CURRENT_BINARY_DIR}/${TARGET}.mri")
      SET(MRI_SCRIPT_TPL "${MRI_SCRIPT}.tpl")

      SET(SCRIPT_CONTENTS "CREATE $<TARGET_FILE:${TARGET}>\n")
--- a/cmake/make_dist.cmake.in
+++ b/cmake/make_dist.cmake.in
@@ -46,30 +46,13 @@ IF(GIT_EXECUTABLE)
    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
    RESULT_VARIABLE RESULT
  )
-  IF(NOT RESULT EQUAL 0)
-    SET(GIT_EXECUTABLE)
+  IF(RESULT EQUAL 0)
+    EXECUTE_PROCESS(
+      COMMAND "${GIT_EXECUTABLE}" submodule foreach --recursive "${GIT_EXECUTABLE} checkout-index --all --prefix=${PACKAGE_DIR}/$displaypath/"
+      WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
+      RESULT_VARIABLE RESULT
+    )
  ENDIF()
-  EXECUTE_PROCESS(
-    COMMAND "${GIT_EXECUTABLE}" submodule foreach "${GIT_EXECUTABLE} checkout-index --all --prefix=${PACKAGE_DIR}/$path/"
-    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
-    RESULT_VARIABLE RESULT
-  )
-  IF(NOT RESULT EQUAL 0)
-    SET(GIT_EXECUTABLE)
-  ENDIF()
-  EXECUTE_PROCESS(
-    COMMAND "${GIT_EXECUTABLE}" submodule foreach "${GIT_EXECUTABLE} checkout-index --all --prefix=${PACKAGE_DIR}/wsrep-lib/$path/"
-    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/wsrep-lib
-    RESULT_VARIABLE RESULT
-  )
-  IF(NOT RESULT EQUAL 0)
-    SET(GIT_EXECUTABLE)
-  ENDIF()
-  EXECUTE_PROCESS(
-    COMMAND "${GIT_EXECUTABLE}" submodule foreach "${GIT_EXECUTABLE} checkout-index --all --prefix=${PACKAGE_DIR}/storage/columnstore/columnstore/$path/"
-    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/storage/columnstore/columnstore
-    RESULT_VARIABLE RESULT
-  )
  IF(NOT RESULT EQUAL 0)
    SET(GIT_EXECUTABLE)
  ENDIF()
--- a/cmake/pcre.cmake
+++ b/cmake/pcre.cmake
@@ -94,8 +94,13 @@ MACRO (CHECK_PCRE)
      PKG_CHECK_MODULES(PCRE libpcre2-8)
      # in case pkg-config or libpcre2-8.pc is not installed:
      CHECK_LIBRARY_EXISTS(pcre2-8 pcre2_match_8 "${PCRE_LIBRARY_DIRS}" HAVE_PCRE2_MATCH_8)
+      find_path(PCRE2_INCLUDE_DIR NAMES pcre2.h)
+      MESSAGE_ONCE(PCRE2_H "Looking for include file pcre2.h: ${PCRE2_INCLUDE_DIR}")
+      IF (PCRE2_INCLUDE_DIR)
+        SET(PCRE_INCLUDE_DIRS ${PCRE2_INCLUDE_DIR})
+      ENDIF()
    ENDIF()
-    IF(NOT HAVE_PCRE2_MATCH_8 OR WITH_PCRE STREQUAL "bundled")
+    IF(NOT HAVE_PCRE2_MATCH_8 OR NOT PCRE_INCLUDE_DIRS OR WITH_PCRE STREQUAL "bundled")
      IF (WITH_PCRE STREQUAL "system")
        MESSAGE(FATAL_ERROR "system pcre2-8 library is not found or unusable")
      ENDIF()
--- a/cmake/plugin.cmake
+++ b/cmake/plugin.cmake
@@ -108,6 +108,17 @@ MACRO(MYSQL_ADD_PLUGIN)
    MESSAGE(FATAL_ERROR "Invalid value for PLUGIN_${plugin}")
  ENDIF()

+  # Validate that the requested build mode is compatible with what the
+  # plugin actually supports. STATIC_ONLY plugins cannot be built as
+  # dynamic modules, and MODULE_ONLY plugins cannot be linked statically.
+  IF(PLUGIN_${plugin} STREQUAL "DYNAMIC" AND ARG_STATIC_ONLY)
+    MESSAGE(FATAL_ERROR "Plugin ${plugin} is STATIC_ONLY and cannot be built"
+      " with -DPLUGIN_${plugin}=DYNAMIC. Remove this option or use STATIC.")
+  ELSEIF(PLUGIN_${plugin} STREQUAL "STATIC" AND ARG_MODULE_ONLY)
+    MESSAGE(FATAL_ERROR "Plugin ${plugin} is MODULE_ONLY and cannot be built"
+      " with -DPLUGIN_${plugin}=STATIC. Remove this option or use DYNAMIC.")
+  ENDIF()
+
  IF(ARG_STORAGE_ENGINE)
    SET(with_var "WITH_${plugin}_STORAGE_ENGINE" )
  ELSE()
@@ -289,6 +300,11 @@ MACRO(MYSQL_ADD_PLUGIN)
    IF(ARG_CONFIG AND INSTALL_SYSCONF2DIR)
      INSTALL(FILES ${ARG_CONFIG} COMPONENT ${ARG_COMPONENT} DESTINATION ${INSTALL_SYSCONF2DIR})
    ENDIF()
+    IF(NOT ARG_CLIENT)
+      GET_PROPERTY(my_list GLOBAL PROPERTY SERVER_DYNAMIC_PLUGINS)
+      LIST(APPEND my_list ${target})
+      SET_PROPERTY(GLOBAL PROPERTY SERVER_DYNAMIC_PLUGINS "${my_list}")
+    ENDIF()
  ENDIF()

  GET_FILENAME_COMPONENT(subpath ${CMAKE_CURRENT_SOURCE_DIR} NAME)
--- a/dbug/dbug.c
+++ b/dbug/dbug.c
@@ -221,6 +221,9 @@ static BOOLEAN init_done= FALSE; /* Set to TRUE when initialization done */
 static struct settings init_settings;
 static const char *db_process= 0;/* Pointer to process name; argv[0] */
 my_bool _dbug_on_= TRUE;	 /* FALSE if no debugging at all */
+static char * command_line= 0; /* copy of controls */
+#define FREE_COMMAND_LINE do{ free(command_line); command_line= 0; }while(0)
+

 typedef struct _db_code_state_ {
  const char *process;          /* Pointer to process name; usually argv[0] */
@@ -900,10 +903,17 @@ int _db_is_pushed_()
 void _db_set_init_(const char *control)
 {
  CODE_STATE tmp_cs;
+  FREE_COMMAND_LINE;
+  command_line= strdup(control);
+  if (unlikely(!command_line))
+  {
+    /* We can not return error so just return */
+    return;
+  }
  bzero((uchar*) &tmp_cs, sizeof(tmp_cs));
  tmp_cs.stack= &init_settings;
  tmp_cs.process= db_process ? db_process : "dbug";
-  DbugParse(&tmp_cs, control);
+  DbugParse(&tmp_cs, command_line);
 }

 /*
@@ -1689,6 +1699,8 @@ void _db_end_()
  pthread_mutex_destroy(&THR_LOCK_dbug);
  init_done= 0;
  _dbug_on_= 0;
+  /* see Writable() */
+  FREE_COMMAND_LINE;
 }


@@ -2159,7 +2171,11 @@ static BOOLEAN Writable(const char *pathname)
  }
  else
  {
-    lastslash= strrchr(pathname, '/');
+    /*
+      It is safe because we made duplicate of the string
+      in _db_set_init_() and freed in _db_end_()
+    */
+    lastslash= (char *)strrchr(pathname, '/');
    if (lastslash != NULL)
      *lastslash= '\0';
    else
--- a/debian/additions/debian-start
+++ b/debian/additions/debian-start
@@ -26,16 +26,10 @@ MARIADB="/usr/bin/mariadb --defaults-extra-file=/etc/mysql/debian.cnf"
 MYADMIN="/usr/bin/mariadb-admin --defaults-extra-file=/etc/mysql/debian.cnf"
 # Don't run full mariadb-upgrade on every server restart, use --version-check to do it only once
 MYUPGRADE="/usr/bin/mariadb-upgrade --defaults-extra-file=/etc/mysql/debian.cnf --version-check --silent"
-MYCHECK_SUBJECT="WARNING: mariadb-check has found corrupt tables"
-MYCHECK_RCPT="${MYCHECK_RCPT:-root}"
-
-## Checking for corrupt, not cleanly closed (only for MyISAM and Aria engines) and upgrade needing tables.

 # The following commands should be run when the server is up but in background
 # where they do not block the server start and in one shell instance so that
 # they run sequentially. They are supposed not to echo anything to stdout.
-# If you want to disable the check for crashed tables comment
-# "check_for_crashed_tables" out.
 # (There may be no output to stdout inside the background process!)

 # Need to ignore SIGHUP, as otherwise a SIGHUP can sometimes abort the upgrade
@@ -44,7 +38,6 @@ trap "" SIGHUP
 (
  upgrade_system_tables_if_necessary;
  check_root_accounts;
-  check_for_crashed_tables;
 ) >&2 &

 exit 0
--- a/debian/additions/debian-start.inc.sh
+++ b/debian/additions/debian-start.inc.sh
@@ -3,62 +3,6 @@
 # This file is included by /etc/mysql/debian-start
 #

-## Is there MyISAM or Aria unclosed tables.
-# - Requires the server to be up.
-# - Is supposed to run silently in background.
-function check_for_crashed_tables() {
-  set -e
-  set -u
-
-  # But do it in the background to not stall the boot process.
-  logger -p daemon.info -i -t"$0" "Triggering myisam-recover for all MyISAM tables and aria-recover for all Aria tables"
-
-  # Checking for $? is unreliable so the size of the output is checked.
-  # Some table handlers like HEAP do not support CHECK TABLE.
-  tempfile=$(mktemp)
-
-  # We have to use xargs in this case, because a for loop barfs on the
-  # spaces in the thing to be looped over.
-
-  # If a crashed table is encountered, the "mariadb" command will return with a status different from 0
-  #
-  # The first query will generate lines like.
-  #   select count(*) into @discard from 'mysql'.'db'
-  # The second line will load all tables without printing any actual results,
-  # but may show warnings and definitely is expected to have some error and
-  # exit code if crashed tables are encountered.
-  #
-  # Note that inside single quotes must be quoted with '\'' (to be outside of single quotes).
-  set +e
-  # The $MARIADB is intentionally used to expand into a command and arguments
-  # shellcheck disable=SC2086
-  echo '
-    SELECT CONCAT("select count(*) into @discard from '\''", TABLE_SCHEMA, "'\''.'\''", TABLE_NAME, "'\''")
-    FROM information_schema.TABLES WHERE TABLE_SCHEMA<>"INFORMATION_SCHEMA" AND TABLE_SCHEMA<>"PERFORMANCE_SCHEMA"
-    AND (ENGINE="MyISAM" OR ENGINE="Aria")
-    ' | \
-    LC_ALL=C $MARIADB --skip-column-names --batch | \
-    xargs --no-run-if-empty -i $MARIADB --skip-column-names --silent --batch --force -e "{}" &> "${tempfile}"
-  set -e
-
-  if [ -s "$tempfile" ]
-  then
-    (
-      /bin/echo -e "\n" \
-        "Improperly closed tables are also reported if clients are accessing\n" \
-        "the tables *now*. A list of current connections is below.\n";
-        $MYADMIN processlist status
-    ) >> "${tempfile}"
-    # Check for presence as a dependency on mailx would require an MTA.
-    if [ -x /usr/bin/mailx ]
-    then
-      mailx -e -s"$MYCHECK_SUBJECT" "$MYCHECK_RCPT" < "$tempfile"
-    fi
-    (echo "$MYCHECK_SUBJECT"; cat "${tempfile}") | logger -p daemon.warn -i -t"$0"
-  fi
-  rm "${tempfile}"
-}
-
 ## Check for tables needing an upgrade.
 # - Requires the server to be up.
 # - Is supposed to run silently in background.
--- a/debian/autobake-deb.sh
+++ b/debian/autobake-deb.sh
@@ -19,6 +19,9 @@ export DEB_BUILD_OPTIONS="nocheck $DEB_BUILD_OPTIONS"
 # shellcheck source=/dev/null
 source ./VERSION

+architecture=$(dpkg-architecture -q DEB_BUILD_ARCH)
+uname_machine=$(uname -m)
+
 # Look up distro-version specific stuff
 #
 # Always keep the actual packaging as up-to-date as possible following the latest
@@ -62,8 +65,13 @@ remove_package_notes()
  sed -e '/package.notes/d' -i debian/rules debian/control
 }

-architecture=$(dpkg-architecture -q DEB_BUILD_ARCH)
-uname_machine=$(uname -m)
+remove_columnstore_boost_deps()
+{
+  # libboost-dev still needed for oqgraph
+  # The rest, atomic, chrono, regex, filesystem, thread
+  # are columnstore, and it insists on 1.88+
+  sed -e '/libboost-[^d]/d' -i debian/control
+}

 # Parse release name and number from Linux standard base release
 # Example:
@@ -109,7 +117,10 @@ in
      remove_uring
    fi
    ;&
-  "trixie"|"forky"|"duke"|"sid")
+  "trixie")
+    remove_columnstore_boost_deps
+    ;&
+  "forky"|"duke"|"sid")
    # The default packaging should always target Debian Sid, so in this case
    # there is intentionally no customizations whatsoever.
    ;;
@@ -128,7 +139,10 @@ in
      replace_uring_with_aio
    fi
    ;&
-  "noble"|"oracular"|"plucky"|"questing"|"resolute")
+  "noble"|"oracular"|"plucky")
+    remove_columnstore_boost_deps
+    ;&
+  "questing"|"resolute")
    # mariadb-plugin-rocksdb s390x not supported by us (yet)
    # ubuntu doesn't support mips64el yet, so keep this just
    # in case something changes.
--- a/debian/control
+++ b/debian/control
@@ -15,7 +15,6 @@ Build-Depends:
 libaio-dev [linux-any],
 libboost-atomic-dev [amd64 arm64],
 libboost-chrono-dev [amd64 arm64],
- libboost-date-time-dev [amd64 arm64],
 libboost-dev,
 libboost-filesystem-dev [amd64 arm64],
 libboost-regex-dev [amd64 arm64],
@@ -809,7 +808,6 @@ Description: MariaDB database core server files
 Package: mariadb-server
 Architecture: any
 Suggests:
- mailx,
 mariadb-test,
 netcat-openbsd,
 Recommends:
--- a/debian/mariadb-client-core.install
+++ b/debian/mariadb-client-core.install
@@ -1,6 +1,7 @@
 usr/bin/mariadb
 usr/bin/mariadb-check
 usr/bin/my_print_defaults
+usr/bin/mariadb-migrate-config-file
 usr/share/man/man1/mariadb-check.1
 usr/share/man/man1/mariadb.1
 usr/share/man/man1/my_print_defaults.1
--- a/debian/mariadb-test-data.install
+++ b/debian/mariadb-test-data.install
@@ -1,3 +1,4 @@
+usr/lib/mysql/plugin/test_pam_modules
 usr/share/mariadb/mariadb-test/collections
 usr/share/mariadb/mariadb-test/include
 usr/share/mariadb/mariadb-test/main
--- a/extra/CMakeLists.txt
+++ b/extra/CMakeLists.txt
@@ -13,7 +13,7 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1335 USA

-INCLUDE_DIRECTORIES(${CMAKE_SOURCE_DIR}/include ${ZLIB_INCLUDE_DIRS})
+INCLUDE_DIRECTORIES(${CMAKE_SOURCE_DIR}/include ${ZLIB_INCLUDE_DIRS} ${PCRE_INCLUDE_DIRS})

 # Default install component for the files is Server here
 SET(MYSQL_INSTALL_COMPONENT Server)
@@ -46,6 +46,70 @@ ADD_CUSTOM_TARGET(GenError
                  DEPENDS
                  ${CMAKE_BINARY_DIR}/include/mysqld_error.h.tmp)

+# this approach doesn't work with cross-compiing (runs mariadbd)
+# and doesn't work with ASAN, because LSAN complains about RocksDB (MDEV-36345).
+IF(NOT CMAKE_CROSSCOMPILING AND NOT WITH_ASAN AND TARGET mariadbd)
+  ADD_EXECUTABLE(generate_option_list generate_option_list.cc)
+  TARGET_LINK_LIBRARIES(generate_option_list mysys pcre2-8)
+  TARGET_INCLUDE_DIRECTORIES(generate_option_list PRIVATE ${PCRE_INCLUDE_DIRS})
+  GET_PROPERTY(dynamic_plugins GLOBAL PROPERTY SERVER_DYNAMIC_PLUGINS)
+  GET_PROPERTY(is_multi_config GLOBAL PROPERTY GENERATOR_IS_MULTI_CONFIG)
+  IF(is_multi_config)
+    SET(my_plugin_dir "${CMAKE_BINARY_DIR}/all_plugins/$<CONFIG>")
+  ELSE()
+    SET(my_plugin_dir "${CMAKE_BINARY_DIR}/all_plugins")
+  ENDIF()
+
+  SET(populate_plugin_dir)
+  SET(plugin_load)
+  LIST(APPEND populate_plugin_dir
+    COMMAND ${CMAKE_COMMAND} -E rm -rf "${my_plugin_dir}"
+    COMMAND ${CMAKE_COMMAND} -E make_directory "${my_plugin_dir}"
+  )
+  FOREACH(target ${dynamic_plugins})
+    LIST(APPEND plugin_load "$<TARGET_FILE_NAME:${target}>")
+     IF(WIN32)
+       SET(maybe_create_hardlink  || ${CMAKE_COMMAND} -E create_hardlink
+          $<TARGET_FILE:${target}>
+          "${my_plugin_dir}/$<TARGET_FILE_NAME:${target}>")
+     ENDIF()
+     LIST(APPEND populate_plugin_dir
+     COMMAND ${CMAKE_COMMAND} -E create_symlink
+     $<TARGET_FILE:${target}>
+     "${my_plugin_dir}/$<TARGET_FILE_NAME:${target}>"
+     ${maybe_create_hardlink})
+  ENDFOREACH()
+
+  IF(NOT plugin_load)
+    SET(plugin_load " ")
+  ENDIF()
+
+  STRING(REPLACE ";" ":" escaped_plugin_load "${plugin_load}")
+  SET(genhdr ${CMAKE_BINARY_DIR}/extra/mariadbd_options.h)
+  ADD_CUSTOM_COMMAND(OUTPUT ${genhdr}
+   # COMMAND ${CMAKE_COMMAND} -E echo "Executing ${populate_plugin_dir}"
+   ${populate_plugin_dir}
+   #COMMAND ${CMAKE_COMMAND} -E echo "Executing generate_option_list $<TARGET_FILE:mariadbd> ${my_plugin_dir} ${escaped_plugin_load} ${genhdr}"
+   COMMAND generate_option_list "$<TARGET_FILE:mariadbd>" "${my_plugin_dir}" "${escaped_plugin_load}" "${genhdr}"
+   COMMAND_EXPAND_LISTS
+ )
+
+ ADD_CUSTOM_TARGET(gen_mariadbd_options_h
+   DEPENDS ${genhdr}
+
+ )
+
+ MYSQL_ADD_EXECUTABLE(mariadb-migrate-config-file
+   mariadb_migrate_config_file.c
+   ${genhdr}
+   COMPONENT Client)
+
+ # Make sure consumers cannot compile before the header exists:
+  SET_SOURCE_FILES_PROPERTIES("${genhdr}" PROPERTIES GENERATED TRUE)
+  TARGET_LINK_LIBRARIES(mariadb-migrate-config-file PRIVATE mysys)
+  TARGET_INCLUDE_DIRECTORIES(mariadb-migrate-config-file PRIVATE ${CMAKE_CURRENT_BINARY_DIR})
+ENDIF()
+
 MYSQL_ADD_EXECUTABLE(my_print_defaults my_print_defaults.c COMPONENT Client)
 TARGET_LINK_LIBRARIES(my_print_defaults  mysys)

--- a/extra/generate_option_list.cc
+++ b/extra/generate_option_list.cc
@@ -0,0 +1,346 @@
+/* Copyright (c) 2024, Väinö Mäkelä
+   With some small changes by Michael Widenius
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; version 2 of the License.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1335
+   USA */
+
+#include <my_global.h>
+#include <my_sys.h>
+#include <my_dir.h>
+#include <algorithm>
+#include <cstdio>
+#include <fstream>
+#include <iostream>
+#include <map>
+#include <set>
+#include <sstream>
+#include <vector>
+#define PCRE2_STATIC 1 /* Important on Windows */
+#include "pcre2.h"
+
+struct parsed
+{
+  std::set<std::string> options;
+  std::map<std::string, std::vector<std::string>> enums;
+  std::map<std::string, std::vector<std::string>> sets;
+};
+
+#if defined(__has_feature)
+#  if __has_feature(memory_sanitizer)
+     __attribute__((no_sanitize("memory"))) /* we may run with uninstrumented std::string */
+#  endif
+#endif
+
+std::string read_output(FILE *f)
+{
+  char buf[4096];
+  size_t read_bytes;
+  std::string output;
+  do
+  {
+    read_bytes= std::fread(buf, 1, sizeof buf, f);
+    output.append(buf, read_bytes);
+  } while (read_bytes > 0);
+  return output;
+}
+
+
+#if defined(__has_feature)
+#  if __has_feature(memory_sanitizer)
+     __attribute__((no_sanitize("memory"))) /* we may run with uninstrumented std::string */
+#  endif
+#endif
+
+
+std::string call_mariadbd(const char *mariadbd_path, const char *plugin_dir, const char *plugin_load)
+{
+  std::string output;
+  std::ostringstream command;
+#ifdef _WIN32
+  command << "\"";
+#endif
+  command << "\"" << mariadbd_path << "\"";
+  command << " --no-defaults"
+             " --silent-startup"
+             " --plugin-maturity=unknown"
+             " --plugin-dir=";
+  command << plugin_dir << "";
+  if (plugin_load[0] != ' ' || !plugin_load[0])
+  {
+    command << " \"--plugin-load=";
+    command << plugin_load;
+    command << "\"";
+  }
+  command << " --verbose"
+             " --help";
+#ifdef _WIN32
+  command << "\"";
+#endif
+  std::cout << "Executing command: " << command.str() << '\n';
+  FILE *f= my_popen(command.str().c_str(), "r");
+  if (!f)
+  {
+    perror("failed to read mariadbd output");
+    my_pclose(f);
+    exit(1);
+  }
+  output= read_output(f);
+  my_pclose(f);
+  return output;
+}
+
+std::string remove_paretheses(std::string &str)
+{
+  std::string result;
+  bool in_parens= false;
+  for (auto it= str.begin(); it != str.end(); ++it)
+  {
+    if (*it == '(')
+    {
+      in_parens= true;
+    }
+    else if (in_parens && *it == ')')
+    {
+      in_parens= false;
+    }
+    else if (!in_parens)
+    {
+      result.push_back(*it);
+    }
+  }
+  return result;
+}
+
+std::vector<std::string> split_list(std::string &str)
+{
+  std::vector<std::string> result;
+  std::string current;
+  std::string parens_removed= remove_paretheses(str);
+  bool seen_dot= false;
+
+  for (auto it= parens_removed.begin(); it != parens_removed.end(); ++it)
+  {
+    switch (*it) {
+    case ' ':
+    case '\t':
+    case '\n':
+    case '\r':
+    case ',':
+      seen_dot= false;
+      if (!current.empty())
+        result.push_back(current);
+      current.clear();
+      break;
+    case '.':
+      seen_dot= true;
+      break;
+    default:
+      if (seen_dot)
+        current.push_back('.');
+      current.push_back(*it);
+    }
+  }
+  if (!current.empty())
+    result.push_back(current);
+  return result;
+}
+
+std::string capture_group(std::string &str, PCRE2_SIZE *ovector, int group)
+{
+  return str.substr(ovector[2 * group],
+                    ovector[2 * group + 1] - ovector[2 * group]);
+}
+
+
+/*
+  Ignore some special mariadb options from using enum/set
+*/
+
+bool ignore_option(std::string *option)
+{
+  /*
+    wsrep_provider must not be threated as an enum as in mariadbd --help is both
+    a string and an enum.
+  */
+  if (!strcmp(option->c_str(), "wsrep_provider"))
+    return 1;                                   // Ignore
+  return 0;
+}
+
+
+struct parsed parse_output(std::string &output)
+{
+  struct parsed result= {};
+  const char *pattern=
+      "# Consider all lines that start with '  --' or '  -x, --'as options.\n"
+      "^\\ \\ (?:-.,\\ )?--([^\\ =\\[]+)\n"
+      "(?:\n"
+      "  # Check for possible enum or set values until we hit\n"
+      "  # '  -' at the start of a line. This won't work for\n"
+      "  # the last option but should work for most ones.\n"
+      "  (?:(?<!^\\ \\ -).)*\n"
+      "  (?:(?:One\\s+of:(.*?))|(?:Any\\s+combination\\s+of:(.*?)))\n"
+      "  # Sets end with \"  Use 'ALL'...\"\n"
+      "  (?=^\\ \\ (?:-|Use))\n"
+      ")?";
+  pcre2_match_data *match_data;
+  PCRE2_SIZE *ovector;
+  PCRE2_SIZE offset= 0;
+  int errornumber;
+  PCRE2_SIZE erroroffset;
+  pcre2_code *re=
+      pcre2_compile((PCRE2_SPTR8) pattern, PCRE2_ZERO_TERMINATED,
+                    PCRE2_EXTENDED | PCRE2_MULTILINE | PCRE2_DOTALL,
+                    &errornumber, &erroroffset, nullptr);
+  if (!re)
+  {
+    PCRE2_UCHAR buffer[256];
+    pcre2_get_error_message(errornumber, buffer, sizeof(buffer));
+    std::cerr << "PCRE2 compilation failed at offset " << erroroffset << ": "
+              << buffer << '\n';
+    exit(1);
+  }
+
+  match_data= pcre2_match_data_create_from_pattern(re, nullptr);
+  ovector= pcre2_get_ovector_pointer(match_data);
+
+  for (;;)
+  {
+    std::string option;
+    std::string enum_part;
+    std::string set_part;
+    std::vector<std::string> enum_options;
+    std::vector<std::string> set_options;
+    int rc= pcre2_match(re, (PCRE2_SPTR8) output.c_str(), output.length(),
+                        offset, 0, match_data, nullptr);
+    if (rc == PCRE2_ERROR_NOMATCH)
+    {
+      break;
+    }
+    if (rc < 0)
+    {
+      std::cerr << "Matching error " << rc << '\n';
+      exit(1);
+    }
+
+    offset= ovector[1];
+    option= capture_group(output, ovector, 1);
+    std::replace(option.begin(), option.end(), '-', '_');
+    if (rc > 2 && ovector[2 * 2] != PCRE2_UNSET)
+    {
+      enum_part= capture_group(output, ovector, 2);
+      enum_options= split_list(enum_part);
+    }
+    if (rc > 3 && ovector[2 * 3] != PCRE2_UNSET)
+    {
+      set_part= capture_group(output, ovector, 3);
+      set_options= split_list(set_part);
+    }
+
+    result.options.insert(option);
+    if (ignore_option(&option))
+      continue;
+
+    if (!enum_options.empty())
+    {
+      result.enums.emplace(option, enum_options);
+    }
+    if (!set_options.empty())
+    {
+      result.sets.emplace(option, set_options);
+    }
+  }
+
+  pcre2_match_data_free(match_data);
+  pcre2_code_free(re);
+  return result;
+}
+
+void write_typelibs(std::ostream &out,
+                    std::map<std::string, std::vector<std::string>> &map)
+{
+  for (auto option= map.begin(); option != map.end(); ++option)
+  {
+    const std::string &option_name= (*option).first;
+    const std::vector<std::string> &values= (*option).second;
+    out << "\nstatic const char *valid_" << option_name << "_values[] = {\n";
+    for (auto value= values.begin(); value != values.end(); ++value)
+    {
+      out << "\"" << *value << "\",\n";
+    }
+    out << "0\n};\n";
+    out << "static TYPELIB valid_" << option_name << "_values_typelib = {\n"
+        << "array_elements(valid_" << option_name << "_values)-1,\n"
+        << "\"\", valid_" << option_name << "_values, 0, 0};\n";
+  }
+}
+
+void write_typelib_map(std::ostream &out, std::string name,
+                       std::map<std::string, std::vector<std::string>> &map)
+{
+  out << "\nstatic const char *mariadbd_" << name << "_options[] = {\n";
+  for (auto option= map.begin(); option != map.end(); ++option)
+  {
+    out << "\"" << (*option).first << "\",\n";
+  }
+  out << "};\n"
+      << "\nstatic TYPELIB *mariadbd_" << name << "_typelibs[] = {\n";
+  for (auto option= map.begin(); option != map.end(); ++option)
+  {
+    out << "&valid_" << (*option).first << "_values_typelib,\n";
+  }
+  out << "};\n";
+}
+
+void write_output(const char *path, struct parsed &parsed_output)
+{
+  std::ofstream out(path);
+  out << "/* Automatically generated by generate_option_list */\n\n";
+  out << "#ifndef _mariadbd_options_h\n";
+  out << "#define _mariadbd_options_h\n";
+  out << "static const char *mariadbd_valid_options[]= {\n";
+  for (auto option= parsed_output.options.begin();
+       option != parsed_output.options.end(); ++option)
+  {
+    out << '\"' << *option << "\",\n";
+  }
+  out << "};\n";
+
+  write_typelibs(out, parsed_output.enums);
+  write_typelib_map(out, "enum", parsed_output.enums);
+
+  write_typelibs(out, parsed_output.sets);
+  write_typelib_map(out, "set", parsed_output.sets);
+
+  out << "#endif /* _mariadbd_options_h */\n";
+}
+
+int main(int argc, const char *argv[])
+{
+  std::string mariadbd_output;
+  struct parsed parsed_output;
+
+  if (argc != 5)
+  {
+    std::cerr << "usage: " << argv[0] << " <mariadbd_path> <plugin_dir> <plugin_list> <output_path>\n";
+    return 1;
+  }
+  MY_INIT(argv[0]);
+  mariadbd_output= call_mariadbd(argv[1], argv[2], argv[3]);
+  parsed_output= parse_output(mariadbd_output);
+  write_output(argv[4], parsed_output);
+
+  my_end(0);
+  exit(0);
+}
--- a/extra/mariabackup/backup_copy.cc
+++ b/extra/mariabackup/backup_copy.cc
@@ -1976,6 +1976,14 @@ decrypt_decompress_file(const char *filepath, uint thread_n)

 		msg(thread_n,"%s\n", message.str().c_str());

+                /* all valid *.qp files are table-name-safe */
+                for (const char *s=filepath; *s; s++)
+                  if (!isalnum(*s) && !strchr("-.@/_#", *s))
+                  {
+                    msg(thread_n,"Error: invalid file name\n");
+                    return(false);
+                  }
+
 	 	if (system(cmd.str().c_str()) != 0) {
 	 		return(false);
 	 	}
--- a/extra/mariabackup/common.h
+++ b/extra/mariabackup/common.h
@@ -54,7 +54,7 @@ static inline int vasprintf(char **strp, const char *fmt, va_list args)
  {
    return -1;
  }
-  vsprintf(*strp, fmt, args);
+  vsnprintf(*strp, len + 1, fmt, args);
  return len;
 }

--- a/extra/mariabackup/xbcloud.cc
+++ b/extra/mariabackup/xbcloud.cc
@@ -490,7 +490,7 @@ static char *hex_md5(const unsigned char *hash, char *out)
 	int i;

 	for (i = 0, p = out; i < hash_len; i++, p+=2) {
-		sprintf(p, "%02x", hash[i]);
+		snprintf(p, 3, "%02x", hash[i]);
 	}

 	return out;
@@ -548,6 +548,7 @@ swift_temp_auth(const char *auth_url, swift_auth_info *info)
 	CURLcode res;
 	long http_code;
 	char *hdr_buf = NULL;
+	size_t hdr_buf_size = 0;
 	struct curl_slist *slist = NULL;

 	if (opt_swift_user == NULL) {
@@ -564,18 +565,19 @@ swift_temp_auth(const char *auth_url, swift_auth_info *info)

 	if (curl != NULL) {

-		hdr_buf = (char *)(calloc(14 + max(strlen(opt_swift_user),
-						   strlen(opt_swift_key)), 1));
+		hdr_buf_size = 14 + max(strlen(opt_swift_user),
+					strlen(opt_swift_key));
+		hdr_buf = (char *)(calloc(hdr_buf_size, 1));

 		if (!hdr_buf) {
 			res = CURLE_FAILED_INIT;
 			goto cleanup;
 		}

-		sprintf(hdr_buf, "X-Auth-User: %s", opt_swift_user);
+		snprintf(hdr_buf, hdr_buf_size, "X-Auth-User: %s", opt_swift_user);
 		slist = curl_slist_append(slist, hdr_buf);

-		sprintf(hdr_buf, "X-Auth-Key: %s", opt_swift_key);
+		snprintf(hdr_buf, hdr_buf_size, "X-Auth-Key: %s", opt_swift_key);
 		slist = curl_slist_append(slist, hdr_buf);

 		curl_easy_setopt(curl, CURLOPT_VERBOSE, opt_verbose);
--- a/extra/mariabackup/xbstream.cc
+++ b/extra/mariabackup/xbstream.cc
@@ -313,6 +313,11 @@ file_entry_new(extract_ctxt_t *ctxt, const char *path, uint pathlen,
 	file_entry_t	*entry;
 	ds_file_t	*file;

+        if (*path == '.' || *path == '/' || strstr(path, "/../")) {
+		msg("%s: invalid filename %s", my_progname, path);
+                return NULL;
+        }
+
 	entry = (file_entry_t *) my_malloc(PSI_NOT_INSTRUMENTED, sizeof(file_entry_t),
 					   MYF(MY_WME | MY_ZEROFILL));
 	if (entry == NULL) {
--- a/extra/mariabackup/xtrabackup.cc
+++ b/extra/mariabackup/xtrabackup.cc
@@ -406,6 +406,7 @@ char *opt_defaults_group;
 char *opt_socket;
 uint opt_port;
 char *opt_log_bin;
+char *opt_login_path;

 const char *query_type_names[] = { "ALL", "UPDATE", "SELECT", NullS};

@@ -1855,6 +1856,11 @@ struct my_option xb_client_options[]= {
     &opt_log_innodb_page_corruption, &opt_log_innodb_page_corruption, 0,
     GET_BOOL, NO_ARG, 0, 0, 0, 0, 0, 0},

+    {"login-path", 0, 0, &opt_login_path, &opt_login_path, 0,
+      GET_STR, REQUIRED_ARG, 0, 0, 0, 0, 0, 0},
+    {"apply-log", 0, 0, &xtrabackup_prepare, &xtrabackup_prepare,
+      0, GET_BOOL, NO_ARG, 0, 0, 0, 0, 0, 0},
+
 #define MYSQL_CLIENT
 #include "sslopt-longopts.h"
 #undef MYSQL_CLIENT
@@ -4197,13 +4203,15 @@ next_file:

 	strcpy(info->name, ent->d_name);

+	size_t full_path_size= strlen(dirname) + strlen(ent->d_name) + 10;
 	full_path = static_cast<char*>(
-		ut_malloc_nokey(strlen(dirname) + strlen(ent->d_name) + 10));
+		ut_malloc_nokey(full_path_size));
 	if (!full_path) {
 		return -1;
 	}

-	sprintf(full_path, "%s/%s", dirname, ent->d_name);
+	snprintf(full_path, full_path_size,
+		 "%s/%s", dirname, ent->d_name);

 	ret = stat(full_path, &statinfo);

@@ -5005,15 +5013,15 @@ bool Backup_datasinks::backup_low()
 	if (xtrabackup_extra_lsndir) {
 		char	filename[FN_REFLEN];

-		sprintf(filename, "%s/%s", xtrabackup_extra_lsndir,
-			MB_METADATA_FILENAME);
+		snprintf(filename,  sizeof(filename), "%s/%s",
+			 xtrabackup_extra_lsndir, MB_METADATA_FILENAME);
 		if (!xtrabackup_write_metadata(filename)) {
 			msg("Error: failed to write metadata "
 			    "to '%s'.", filename);
 			return false;
 		}
-		sprintf(filename, "%s/%s", xtrabackup_extra_lsndir,
-			MB_INFO);
+		snprintf(filename, sizeof(filename), "%s/%s",
+			 xtrabackup_extra_lsndir, MB_INFO);
 		if (!write_xtrabackup_info(m_data,
 		                           mysql_connection, filename, false, false)) {
 			msg("Error: failed to write info "
@@ -7010,7 +7018,7 @@ error:
        if (xtrabackup_incremental)
        {
          char inc_filename[FN_REFLEN];
-          sprintf(inc_filename, "%s/%s", xtrabackup_incremental_dir,
+          snprintf(inc_filename, sizeof(inc_filename), "%s/%s", xtrabackup_incremental_dir,
                  MB_CORRUPTED_PAGES_FILE);
          corrupted_pages.read_from_file(inc_filename);
        }
@@ -7079,14 +7087,14 @@ error:
 			metadata_last_lsn = incremental_last_lsn;
 		}

-		sprintf(filename, "%s/%s", xtrabackup_target_dir, MB_METADATA_FILENAME);
+		snprintf(filename, sizeof(filename), "%s/%s", xtrabackup_target_dir, MB_METADATA_FILENAME);
 		if (!xtrabackup_write_metadata(filename)) {

 			msg("mariabackup: Error: failed to write metadata "
 			    "to '%s'", filename);
 			ok = false;
 		} else if (xtrabackup_extra_lsndir) {
-			sprintf(filename, "%s/%s", xtrabackup_extra_lsndir, MB_METADATA_FILENAME);
+			snprintf(filename, sizeof(filename), "%s/%s", xtrabackup_extra_lsndir, MB_METADATA_FILENAME);
 			if (!xtrabackup_write_metadata(filename)) {
 				msg("mariabackup: Error: failed to write "
 				    "metadata to '%s'", filename);
@@ -7363,6 +7371,13 @@ void setup_error_messages()
 	  die("could not initialize error messages");
 }

+
+my_bool xb_early_options(const struct my_option *opt, const char *argument,
+                         const char *)
+{
+  return 0;
+}
+
 /** Handle mariabackup options. The options are handled with the following
 order:

@@ -7423,7 +7438,6 @@ void handle_options(int argc, char **argv, char ***argv_server,
        mysqld_args.push_back(argv[0]);
        mariabackup_args.push_back(argv[0]);

-        /* scan options for group and config file to load defaults from */
        for (i= 1; i < argc; i++)
        {
          char *optend= strcend(argv[i], '=');
@@ -7435,41 +7449,45 @@ void handle_options(int argc, char **argv, char ***argv_server,
          }
          else
            mariabackup_args.push_back(argv[i]);
-
-          if (strncmp(argv[i], "--defaults-group", optend - argv[i]) == 0)
-          {
-            defaults_group= optend + 1;
-            server_default_groups.push_back(defaults_group);
-          }
-          else if (strncmp(argv[i], "--login-path", optend - argv[i]) == 0)
-          {
-            append_defaults_group(optend + 1, xb_client_default_groups,
-                                  array_elements(xb_client_default_groups));
-          }
-          else if (!strncmp(argv[i], "--prepare", optend - argv[i]))
-          {
-            prepare= true;
-          }
-          else if (!strncmp(argv[i], "--apply-log", optend - argv[i]))
-          {
-            prepare= true;
-          }
-          else if (!strncmp(argv[i], "--incremental-dir", optend - argv[i]) &&
-                   *optend)
-          {
-            target_dir= optend + 1;
-          }
-          else if (!strncmp(argv[i], "--target-dir", optend - argv[i]) &&
-                   *optend && !target_dir)
-          {
-            target_dir= optend + 1;
-          }
-          else if (!*optend && argv[i][0] != '-' && !target_dir)
-          {
-            target_dir= argv[i];
-          }
        }

+        mariabackup_args.push_back(nullptr);
+        *argv_client= *argv_server= *argv_backup= &mariabackup_args[0];
+        int argc_backup= static_cast<int>(mariabackup_args.size() - 1);
+        int argc_client= argc_backup;
+        int argc_server= argc_backup;
+
+        auto early_args= mariabackup_args;
+        char **argv_early= &early_args[0];
+        int argc_early= argc_backup;
+
+	/* We want xtrabackup to ignore unknown options, because it only
+	recognizes a small subset of server variables */
+	my_getopt_skip_unknown = TRUE;
+
+        handle_options(&argc_early, &argv_early, xb_server_options,
+                                     xb_early_options);
+        argv_early--; argc_early++;
+        handle_options(&argc_early, &argv_early, xb_client_options,
+                                     xb_early_options);
+
+        if (defaults_group)
+          server_default_groups.push_back(defaults_group);
+
+        if (xtrabackup_prepare)
+          prepare= true;
+
+        if (opt_login_path)
+          append_defaults_group(opt_login_path, xb_client_default_groups,
+                                array_elements(xb_client_default_groups));
+
+        if (xtrabackup_incremental_dir)
+          target_dir= xtrabackup_incremental_dir;
+        else if (xtrabackup_target_dir !=  xtrabackup_real_target_dir)
+          target_dir= xtrabackup_target_dir;
+        else if (argc_early > 0)
+            target_dir= argv_early[0];
+
        server_default_groups.push_back(NULL);
 	snprintf(conf_file, sizeof(conf_file), "my");

@@ -7487,12 +7505,6 @@ void handle_options(int argc, char **argv, char ***argv_server,
 			}
 	}

-        mariabackup_args.push_back(nullptr);
-        *argv_client= *argv_server= *argv_backup= &mariabackup_args[0];
-        int argc_backup= static_cast<int>(mariabackup_args.size() - 1);
-        int argc_client= argc_backup;
-        int argc_server= argc_backup;
-
        /* 1) Load server groups and process server options, ignore unknown
         options */

@@ -7508,10 +7520,6 @@ void handle_options(int argc, char **argv, char ***argv_server,
 		"# This MySQL options file was generated by XtraBackup.\n"
 		"[" << defaults_group << "]\n";

-	/* We want xtrabackup to ignore unknown options, because it only
-	recognizes a small subset of server variables */
-	my_getopt_skip_unknown = TRUE;
-
 	/* Reset u_max_value for all options, as we don't want the
 	--maximum-... modifier to set the actual option values */
 	for (my_option *optp= xb_server_options; optp->name; optp++) {
--- a/extra/mariadb_migrate_config_file.c
+++ b/extra/mariadb_migrate_config_file.c
--- a/extra/readline/display.c
+++ b/extra/readline/display.c
@@ -2285,7 +2285,7 @@ redraw_prompt (t)
 void
 _rl_redisplay_after_sigwinch ()
 {
-  char *t;
+  const char *t;

  /* Clear the current line and put the cursor at column 0.  Make sure
     the right thing happens if we have wrapped to a new screen line. */
--- a/extra/wolfssl/wolfssl
+++ b/extra/wolfssl/wolfssl
--- a/include/my_default.h
+++ b/include/my_default.h
@@ -24,6 +24,7 @@ extern MYSQL_PLUGIN_IMPORT const char *my_defaults_extra_file;
 extern const char *my_defaults_group_suffix;
 extern MYSQL_PLUGIN_IMPORT const char *my_defaults_file;
 extern my_bool my_defaults_mark_files;
+extern my_bool my_defaults_use_original_paths;

 extern int get_defaults_options(char **argv);
 extern int my_load_defaults(const char *conf_file, const char **groups,
--- a/include/my_sys.h
+++ b/include/my_sys.h
@@ -804,11 +804,13 @@ extern char * my_path(char * to,const char *progname,
 			 const char *own_pathname_part);
 extern char * my_load_path(char * to, const char *path,
 			      const char *own_path_prefix);
+extern char *find_file_in_path(char *to,const char *name);
 extern int wild_compare(const char *str,const char *wildstr,
                        pbool str_is_pattern);
 extern my_bool array_append_string_unique(const char *str,
                                          const char **array, size_t size);
-extern void get_date(char * to,int timeflag,time_t use_time);
+extern void get_date(char * to, size_t to_len, int timeflag,
+                     time_t use_time);
 extern void soundex(CHARSET_INFO *, char * out_pntr, char * in_pntr,
                    pbool remove_garbage);
 extern int init_record_cache(RECORD_CACHE *info,size_t cachesize,File file,
@@ -907,7 +909,7 @@ extern my_bool init_dynamic_string(DYNAMIC_STRING *str, const char *init_str,
 				   size_t init_alloc,size_t alloc_increment);
 extern my_bool dynstr_append(DYNAMIC_STRING *str, const char *append);
 my_bool dynstr_append_mem(DYNAMIC_STRING *str, const char *append,
-			  size_t length);
+			  size_t length) __attribute__((nonnull(2)));
 extern my_bool dynstr_append_os_quoted(DYNAMIC_STRING *str, const char *append,
                                       ...);
 extern my_bool dynstr_append_quoted(DYNAMIC_STRING *str,
--- a/include/mysql/plugin.h
+++ b/include/mysql/plugin.h
@@ -200,7 +200,7 @@ enum enum_mysql_show_type

 enum enum_var_type
 {
-  SHOW_OPT_DEFAULT= 0, SHOW_OPT_SESSION, SHOW_OPT_GLOBAL
+  SHOW_OPT_DEFAULT= 0, SHOW_OPT_SESSION, SHOW_OPT_GLOBAL, SHOW_OPT_SESSION_NO_LOCK
 };

 struct st_mysql_show_var {
--- a/include/mysql/plugin_audit.h.pp
+++ b/include/mysql/plugin_audit.h.pp
@@ -59,7 +59,7 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
  int res1, res2;
  unsigned int d1, d2= *dlen;
  assert(*dlen >= slen);
-  assert((dst[*dlen - 1]= 1));
+  assert((dst[*dlen - 1]= 1) == 1);
  if (src < dst)
    assert(src + slen <= dst);
  else
@@ -560,7 +560,7 @@ enum enum_mysql_show_type
 };
 enum enum_var_type
 {
-  SHOW_OPT_DEFAULT= 0, SHOW_OPT_SESSION, SHOW_OPT_GLOBAL
+  SHOW_OPT_DEFAULT= 0, SHOW_OPT_SESSION, SHOW_OPT_GLOBAL, SHOW_OPT_SESSION_NO_LOCK
 };
 struct st_mysql_show_var {
  const char *name;
--- a/include/mysql/plugin_auth.h.pp
+++ b/include/mysql/plugin_auth.h.pp
@@ -59,7 +59,7 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
  int res1, res2;
  unsigned int d1, d2= *dlen;
  assert(*dlen >= slen);
-  assert((dst[*dlen - 1]= 1));
+  assert((dst[*dlen - 1]= 1) == 1);
  if (src < dst)
    assert(src + slen <= dst);
  else
@@ -560,7 +560,7 @@ enum enum_mysql_show_type
 };
 enum enum_var_type
 {
-  SHOW_OPT_DEFAULT= 0, SHOW_OPT_SESSION, SHOW_OPT_GLOBAL
+  SHOW_OPT_DEFAULT= 0, SHOW_OPT_SESSION, SHOW_OPT_GLOBAL, SHOW_OPT_SESSION_NO_LOCK
 };
 struct st_mysql_show_var {
  const char *name;
--- a/include/mysql/plugin_data_type.h.pp
+++ b/include/mysql/plugin_data_type.h.pp
@@ -59,7 +59,7 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
  int res1, res2;
  unsigned int d1, d2= *dlen;
  assert(*dlen >= slen);
-  assert((dst[*dlen - 1]= 1));
+  assert((dst[*dlen - 1]= 1) == 1);
  if (src < dst)
    assert(src + slen <= dst);
  else
@@ -560,7 +560,7 @@ enum enum_mysql_show_type
 };
 enum enum_var_type
 {
-  SHOW_OPT_DEFAULT= 0, SHOW_OPT_SESSION, SHOW_OPT_GLOBAL
+  SHOW_OPT_DEFAULT= 0, SHOW_OPT_SESSION, SHOW_OPT_GLOBAL, SHOW_OPT_SESSION_NO_LOCK
 };
 struct st_mysql_show_var {
  const char *name;
--- a/include/mysql/plugin_encryption.h.pp
+++ b/include/mysql/plugin_encryption.h.pp
@@ -59,7 +59,7 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
  int res1, res2;
  unsigned int d1, d2= *dlen;
  assert(*dlen >= slen);
-  assert((dst[*dlen - 1]= 1));
+  assert((dst[*dlen - 1]= 1) == 1);
  if (src < dst)
    assert(src + slen <= dst);
  else
@@ -560,7 +560,7 @@ enum enum_mysql_show_type
 };
 enum enum_var_type
 {
-  SHOW_OPT_DEFAULT= 0, SHOW_OPT_SESSION, SHOW_OPT_GLOBAL
+  SHOW_OPT_DEFAULT= 0, SHOW_OPT_SESSION, SHOW_OPT_GLOBAL, SHOW_OPT_SESSION_NO_LOCK
 };
 struct st_mysql_show_var {
  const char *name;
--- a/include/mysql/plugin_ftparser.h.pp
+++ b/include/mysql/plugin_ftparser.h.pp
@@ -59,7 +59,7 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
  int res1, res2;
  unsigned int d1, d2= *dlen;
  assert(*dlen >= slen);
-  assert((dst[*dlen - 1]= 1));
+  assert((dst[*dlen - 1]= 1) == 1);
  if (src < dst)
    assert(src + slen <= dst);
  else
@@ -560,7 +560,7 @@ enum enum_mysql_show_type
 };
 enum enum_var_type
 {
-  SHOW_OPT_DEFAULT= 0, SHOW_OPT_SESSION, SHOW_OPT_GLOBAL
+  SHOW_OPT_DEFAULT= 0, SHOW_OPT_SESSION, SHOW_OPT_GLOBAL, SHOW_OPT_SESSION_NO_LOCK
 };
 struct st_mysql_show_var {
  const char *name;
--- a/include/mysql/plugin_function.h.pp
+++ b/include/mysql/plugin_function.h.pp
@@ -59,7 +59,7 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
  int res1, res2;
  unsigned int d1, d2= *dlen;
  assert(*dlen >= slen);
-  assert((dst[*dlen - 1]= 1));
+  assert((dst[*dlen - 1]= 1) == 1);
  if (src < dst)
    assert(src + slen <= dst);
  else
@@ -560,7 +560,7 @@ enum enum_mysql_show_type
 };
 enum enum_var_type
 {
-  SHOW_OPT_DEFAULT= 0, SHOW_OPT_SESSION, SHOW_OPT_GLOBAL
+  SHOW_OPT_DEFAULT= 0, SHOW_OPT_SESSION, SHOW_OPT_GLOBAL, SHOW_OPT_SESSION_NO_LOCK
 };
 struct st_mysql_show_var {
  const char *name;
--- a/include/mysql/plugin_password_validation.h.pp
+++ b/include/mysql/plugin_password_validation.h.pp
@@ -59,7 +59,7 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,
  int res1, res2;
  unsigned int d1, d2= *dlen;
  assert(*dlen >= slen);
-  assert((dst[*dlen - 1]= 1));
+  assert((dst[*dlen - 1]= 1) == 1);
  if (src < dst)
    assert(src + slen <= dst);
  else
@@ -560,7 +560,7 @@ enum enum_mysql_show_type
 };
 enum enum_var_type
 {
-  SHOW_OPT_DEFAULT= 0, SHOW_OPT_SESSION, SHOW_OPT_GLOBAL
+  SHOW_OPT_DEFAULT= 0, SHOW_OPT_SESSION, SHOW_OPT_GLOBAL, SHOW_OPT_SESSION_NO_LOCK
 };
 struct st_mysql_show_var {
  const char *name;
--- a/include/mysql/service_encryption.h
+++ b/include/mysql/service_encryption.h
@@ -121,7 +121,7 @@ static inline int encryption_crypt(const unsigned char* src, unsigned int slen,

  // Verify dlen is initialized properly. See MDEV-30389
  assert(*dlen >= slen);
-  assert((dst[*dlen - 1]= 1));
+  assert((dst[*dlen - 1]= 1) == 1);
  // Verify buffers do not overlap
  if (src < dst)
    assert(src + slen <= dst);
--- a/include/mysql_com.h
+++ b/include/mysql_com.h
@@ -446,6 +446,7 @@ typedef struct st_vio Vio;
 #define MAX_INT_WIDTH           10      /* Max width for a LONG w.o. sign */
 #define MAX_BIGINT_WIDTH        20      /* Max width for a LONGLONG */
 #define MAX_CHAR_WIDTH		255	/* Max length for a CHAR column */
+#define MYSQL_UDF_MAX_RESULT_LENGTH 255 /* Max length for a UDF result */
 #define MAX_BLOB_WIDTH		16777216	/* Default width for blob */

 typedef struct st_net {
--- a/include/mysql_version.h.in
+++ b/include/mysql_version.h.in
@@ -14,7 +14,9 @@
 #define MYSQL_SERVER_VERSION		"@VERSION@-MariaDB"
 #define MYSQL_BASE_VERSION		"mysqld-@MYSQL_BASE_VERSION@"
 #define MARIADB_BASE_VERSION		"mariadb-@MYSQL_BASE_VERSION@"
+#define MARIADB_MAJOR_VERSION		"mariadb-@MAJOR_VERSION@"
 #define MARIADBD_BASE_VERSION		"mariadbd-@MYSQL_BASE_VERSION@"
+#define MARIADBD_MAJOR_VERSION		"mariadbd-@MAJOR_VERSION@"
 #define MYSQL_SERVER_SUFFIX_DEF		"@MYSQL_SERVER_SUFFIX@"
 #define FRM_VER				@DOT_FRM_VERSION@
 #define MYSQL_VERSION_ID		@MYSQL_VERSION_ID@
--- a/include/mysqld_default_groups.h
+++ b/include/mysqld_default_groups.h
@@ -1,7 +1,7 @@
 const char *load_default_groups[]= {
 "mysqld", "server", MYSQL_BASE_VERSION,
-"mariadb", MARIADB_BASE_VERSION,
-"mariadbd", MARIADBD_BASE_VERSION,
+"mariadb", MARIADB_BASE_VERSION, MARIADB_MAJOR_VERSION,
+"mariadbd", MARIADBD_BASE_VERSION, MARIADBD_MAJOR_VERSION,
 "client-server",
 #ifdef WITH_WSREP
 "galera",
--- a/include/password.h
+++ b/include/password.h
@@ -16,6 +16,19 @@
 #ifndef PASSWORD_INCLUDED
 #define PASSWORD_INCLUDED

+/*
+  SCRAMBLE_LENGTH_323 and SCRAMBLED_PASSWORD_CHAR_LENGTH_323 may
+  already be defined via mysql_com.h. Define them here as well so
+  that translation units which do not include mysql_com.h (e.g.
+  mariadb-install-db via libmariadb headers) can still use them.
+*/
+#ifndef SCRAMBLE_LENGTH_323
+#define SCRAMBLE_LENGTH_323 8
+#endif
+#ifndef SCRAMBLED_PASSWORD_CHAR_LENGTH_323
+#define SCRAMBLED_PASSWORD_CHAR_LENGTH_323 (SCRAMBLE_LENGTH_323 * 2)
+#endif
+
 C_MODE_START

 void my_make_scrambled_password_323(char *to, const char *password,
--- a/include/violite.h
+++ b/include/violite.h
@@ -141,11 +141,6 @@ int vio_getnameinfo(const struct sockaddr *sa,
                    int flags);

 #ifdef HAVE_OPENSSL
-/* apple deprecated openssl in MacOSX Lion */
-#ifdef __APPLE__
-#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
-#endif
-
 #define HEADER_DES_LOCL_H dummy_something
 #define YASSL_MYSQL_COMPATIBLE
 #ifndef YASSL_PREFIX
--- a/2
+++ b/2
--- a/libmysqld/CMakeLists.txt
+++ b/libmysqld/CMakeLists.txt
@@ -180,7 +180,7 @@ ENDIF()
 IF(TARGET libfmt)
  ADD_DEPENDENCIES(sql_embedded libfmt)
 ENDIF()
-TARGET_LINK_LIBRARIES(sql_embedded LINK_PRIVATE tpool ${CRC32_LIBRARY})
+TARGET_LINK_LIBRARIES(sql_embedded LINK_PRIVATE tpool ${CRC32_LIBRARY} pcre2-8)

 # On Windows, static embedded server library is called mysqlserver.lib
 # On Unix, it is libmysqld.a
--- a/mariadb-plugin-columnstore.install.generated
+++ b/mariadb-plugin-columnstore.install.generated
@@ -1 +0,0 @@
-#File is generated by ColumnstoreLibrary.cmake, do not edit
--- a/mysql-test/CMakeLists.txt
+++ b/mysql-test/CMakeLists.txt
@@ -16,6 +16,11 @@

 INSTALL_MYSQL_TEST("." "")

+IF (NOT CMAKE_REAL_SOURCE_DIR)
+  get_filename_component(CMAKE_REAL_SOURCE_DIR "${CMAKE_SOURCE_DIR}" REALPATH)
+  get_filename_component(CMAKE_REAL_BINARY_DIR "${CMAKE_BINARY_DIR}" REALPATH)
+ENDIF()
+
 IF(NOT ${CMAKE_SOURCE_DIR} STREQUAL ${CMAKE_BINARY_DIR})
  # Enable running mtr from build directory
  CONFIGURE_FILE(
--- a/mysql-test/include/varchar.inc
+++ b/mysql-test/include/varchar.inc
@@ -86,11 +86,8 @@ explain select count(*) from t1 where v between 'a' and 'a ';
 --replace_column 9 #
 explain select count(*) from t1 where v between 'a' and 'a ' and v between 'a  ' and 'b\n';

-# Which duplicate entry triggers error is not deterministic.
--replace_regex /Duplicate entry '[^']+' for key/Duplicate entry '{ ' for key/
 --error ER_DUP_ENTRY
 alter table t1 add unique(v);
-show warnings;
 alter table t1 add key(v);
 select concat('*',v,'*',c,'*',t,'*') as qq from t1 where v='a';
 --replace_column 6 # 9 # 10 #
--- a/mysql-test/lib/My/SafeProcess/safe_process_win.cc
+++ b/mysql-test/lib/My/SafeProcess/safe_process_win.cc
@@ -181,7 +181,7 @@ int main(int argc, const char** argv )
  PROCESS_INFORMATION process_info= {0};
  BOOL nocore= FALSE;

-  sprintf(safe_process_name, "safe_process[%lu]", pid);
+  snprintf(safe_process_name, sizeof(safe_process_name), "safe_process[%lu]", pid);

  /* Create an event for the signal handler */
  if ((shutdown_event=
--- a/mysql-test/lib/generate-ssl-certs.sh
+++ b/mysql-test/lib/generate-ssl-certs.sh
@@ -30,8 +30,8 @@ openssl rsa -aes256 -in server-key.pem -out encrypted-server-key.pem -passout fi
 # sign the server certificate with CA certificate
 openssl ca -keyfile cakey.pem -days 7300 -batch -cert cacert.pem -policy policy_anything -out server-cert.pem -in demoCA/server-req.pem

-# server certificate with different validity period (MDEV-16266)
-openssl req -newkey rsa:4096 -keyout server-new-key.pem -out demoCA/server-new-req.pem -days 7301 -nodes -subj '/CN=server-new/C=FI/ST=Helsinki/L=Helsinki/O=MariaDB'
+# server certificate with different validity period (MDEV-16266) and unsafe for shell interpolation (MDEV-39413)
+openssl req -newkey rsa:4096 -keyout server-new-key.pem -out demoCA/server-new-req.pem -days 7301 -nodes -subj /CN="'\`touch A\`'"'-"`touch B`"/C=FI/ST=Helsinki/L=Helsinki/O=MariaDB'
 openssl rsa -in server-new-key.pem -out server-new-key.pem
 openssl ca -keyfile cakey.pem -days 7301 -batch -cert cacert.pem -policy policy_anything -out server-new-cert.pem -in demoCA/server-new-req.pem

--- a/mysql-test/lib/mtr_cases.pm
+++ b/mysql-test/lib/mtr_cases.pm
@@ -1116,7 +1116,7 @@ sub get_tags_from_file($$) {
  $file_to_tags{$file}= $tags;
  $file_to_master_opts{$file}= $master_opts;
  $file_to_slave_opts{$file}= $slave_opts;
-  $file_combinations{$file}= [ ::uniq(@combinations) ];
+  $file_combinations{$file}= [ sort ::uniq(@combinations) ];
  $file_in_overlay{$file} = 1 if $in_overlay;

  return @{$tags};
--- a/mysql-test/main/alter_table.result
+++ b/mysql-test/main/alter_table.result
@@ -3098,6 +3098,29 @@ alter table t1 drop constraint t1_fk_t2_id, drop t2_id, drop t2_id;
 ERROR 42000: Can't DROP COLUMN `t2_id`; check that it exists
 drop table t1, t2;
 #
+# MDEV-34951: InnoDB index corruption when renaming key name with same letter to upper case.
+#
+CREATE TABLE t (a INT, b INT, KEY(a), KEY(b)) ENGINE=INNODB;
+ALTER TABLE t RENAME KEY b TO B;
+SELECT * FROM t;
+a	b
+DROP TABLE t;
+CREATE TABLE t (c INT UNIQUE) ENGINE=InnoDB;
+ALTER TABLE t RENAME KEY c TO C;
+SELECT * FROM t;
+c
+DROP TABLE t;
+CREATE TABLE t (c POINT GENERATED ALWAYS AS (POINT(1,1)) UNIQUE) ENGINE=InnoDB;
+ALTER TABLE t RENAME KEY c to C;
+INSERT INTO t VALUES (1);
+ERROR 22003: Cannot get geometry object from data you send to the GEOMETRY field
+DROP TABLE t;
+CREATE TABLE t (c POINT GENERATED ALWAYS AS (POINT(1,1)) UNIQUE) ENGINE=InnoDB;
+ALTER TABLE t RENAME KEY c to C;
+INSERT INTO t VALUES (1,1);
+ERROR 21S01: Column count doesn't match value count at row 1
+DROP TABLE t;
+#
 # MDEV-29001 DROP DEFAULT makes SHOW CREATE non-idempotent
 #
 SET @save_sql_mode=@@sql_mode;
--- a/mysql-test/main/alter_table.test
+++ b/mysql-test/main/alter_table.test
@@ -2395,6 +2395,32 @@ create table t1(id int primary key, t2_id int, constraint t1_fk_t2_id foreign ke
 alter table t1 drop constraint t1_fk_t2_id, drop t2_id, drop t2_id;
 drop table t1, t2;

+--echo #
+--echo # MDEV-34951: InnoDB index corruption when renaming key name with same letter to upper case.
+--echo #
+
+CREATE TABLE t (a INT, b INT, KEY(a), KEY(b)) ENGINE=INNODB;
+ALTER TABLE t RENAME KEY b TO B;
+SELECT * FROM t;
+DROP TABLE t;
+
+CREATE TABLE t (c INT UNIQUE) ENGINE=InnoDB;
+ALTER TABLE t RENAME KEY c TO C;
+SELECT * FROM t;
+DROP TABLE t;
+
+CREATE TABLE t (c POINT GENERATED ALWAYS AS (POINT(1,1)) UNIQUE) ENGINE=InnoDB;
+ALTER TABLE t RENAME KEY c to C;
+--error ER_CANT_CREATE_GEOMETRY_OBJECT
+INSERT INTO t VALUES (1);
+DROP TABLE t;
+
+CREATE TABLE t (c POINT GENERATED ALWAYS AS (POINT(1,1)) UNIQUE) ENGINE=InnoDB;
+ALTER TABLE t RENAME KEY c to C;
+--error ER_WRONG_VALUE_COUNT_ON_ROW
+INSERT INTO t VALUES (1,1);
+DROP TABLE t;
+
 --echo #
 --echo # MDEV-29001 DROP DEFAULT makes SHOW CREATE non-idempotent
 --echo #
--- a/mysql-test/main/alter_table_errors.result
+++ b/mysql-test/main/alter_table_errors.result
@@ -41,3 +41,16 @@ insert into t1 values ('x','foo');
 ERROR 22007: Incorrect integer value: 'x' for column `test`.`t1`.`a` at row 1
 drop temporary table t1;
 # End of 10.2 tests
+#
+# MDEV-23507 Wrong duplicate key value printed in ER_DUP_ENTRY
+#
+create table t1 (a int) engine=myisam;
+insert into t1 values (8);
+insert into t1 select seq from seq_1_to_100;
+alter table t1 add unique (a);
+ERROR 23000: Duplicate entry '8' for key 'a'
+alter table t1 engine=aria;
+alter table t1 add unique (a);
+ERROR 23000: Duplicate entry '8' for key 'a'
+drop table t1;
+# End of 10.11 tests
--- a/mysql-test/main/alter_table_errors.test
+++ b/mysql-test/main/alter_table_errors.test
@@ -1,4 +1,5 @@
 --source include/have_innodb.inc
+--source include/have_sequence.inc

 --echo #
 --echo # MDEV-16110 ALTER with ALGORITHM=INPLACE breaks temporary table with virtual columns
@@ -32,3 +33,18 @@ insert into t1 values ('x','foo');
 drop temporary table t1;

 --echo # End of 10.2 tests
+
+--echo #
+--echo # MDEV-23507 Wrong duplicate key value printed in ER_DUP_ENTRY
+--echo #
+create table t1 (a int) engine=myisam;
+insert into t1 values (8);
+insert into t1 select seq from seq_1_to_100;
+--error ER_DUP_ENTRY
+alter table t1 add unique (a);
+alter table t1 engine=aria;
+--error ER_DUP_ENTRY
+alter table t1 add unique (a);
+drop table t1;
+
+--echo # End of 10.11 tests
--- a/mysql-test/main/analyze_format_json.result
+++ b/mysql-test/main/analyze_format_json.result
@@ -213,7 +213,7 @@ ANALYZE
            "r_filtered": 60
          },
          "buffer_type": "flat",
-          "buffer_size": "1Kb",
+          "buffer_size": "1KiB",
          "join_type": "BNL",
          "r_loops": 20,
          "r_filtered": 100,
@@ -275,7 +275,7 @@ ANALYZE
            "r_filtered": 60
          },
          "buffer_type": "flat",
-          "buffer_size": "1Kb",
+          "buffer_size": "1KiB",
          "join_type": "BNL",
          "attached_condition": "tbl1.c > tbl2.c",
          "r_loops": 20,
@@ -1247,7 +1247,7 @@ ANALYZE
            "r_filtered": 70
          },
          "buffer_type": "flat",
-          "buffer_size": "1Kb",
+          "buffer_size": "1KiB",
          "join_type": "BNL",
          "attached_condition": "t10.b = t11.b",
          "r_loops": 100,
@@ -1319,7 +1319,7 @@ ANALYZE
            "r_filtered": 70
          },
          "buffer_type": "flat",
-          "buffer_size": "3Kb",
+          "buffer_size": "3KiB",
          "join_type": "BNLH",
          "attached_condition": "t10.b = t11.b",
          "r_loops": 100,
--- a/mysql-test/main/analyze_format_json_timings.result
+++ b/mysql-test/main/analyze_format_json_timings.result
@@ -87,7 +87,7 @@ X
            "r_filtered": 20
          },
          "buffer_type": "flat",
-          "buffer_size": "18Kb",
+          "buffer_size": "18KiB",
          "join_type": "BNLH",
          "attached_condition": "t2.b = t1.b",
          "r_loops": 500,
@@ -186,7 +186,7 @@ X
            "r_filtered": 100
          },
          "buffer_type": "flat",
-          "buffer_size": "256Kb",
+          "buffer_size": "256KiB",
          "join_type": "BNLH",
          "attached_condition": "t2.a = t1.a and concat(t1.col1,t1.col2,t1.col3) = concat(t2.col1,t2.col2,t2.col3)",
          "r_loops": 1000,
--- a/mysql-test/main/empty_user_table.result
+++ b/mysql-test/main/empty_user_table.result
@@ -1,3 +1,6 @@
+#
+# MDEV-4462 mysqld gets SIGFPE when mysql.user table is empty
+#
 create table t1 as select * from mysql.global_priv;
 truncate table mysql.global_priv;
 flush privileges;
@@ -14,3 +17,14 @@ connect(localhost,u1,,test,MASTER_PORT,MASTER_SOCKET);
 connect  fail,localhost,u1;
 Got one of the listed errors
 # switching back from mysql.user to mysql.global_priv
+#
+# MDEV-39266 Stack Overflow via alloca() in Privilege Table JSON Parser
+#
+INSERT INTO mysql.global_priv (Host, User, Priv) VALUES
+('localhost', 'MDEV-39266', CONCAT(
+'{"access":0,"plugin":"mysql_native_password","authentication_string":"',
+REPEAT('X', 400000),
+'","password_last_changed":0}'));
+FLUSH PRIVILEGES;
+DROP USER `MDEV-39266`@localhost;
+# End if 10.6 tests
--- a/mysql-test/main/empty_user_table.test
+++ b/mysql-test/main/empty_user_table.test
@@ -1,9 +1,9 @@
-#
-# MDEV-4462 mysqld gets SIGFPE when mysql.user table is empty
-#
-
 source include/not_embedded.inc;

+--echo #
+--echo # MDEV-4462 mysqld gets SIGFPE when mysql.user table is empty
+--echo #
+
 create table t1 as select * from mysql.global_priv;
 truncate table mysql.global_priv;
 flush privileges;
@@ -34,3 +34,17 @@ flush privileges;
 connect (fail,localhost,u1);

 source include/switch_to_mysql_global_priv.inc;
+
+--echo #
+--echo # MDEV-39266 Stack Overflow via alloca() in Privilege Table JSON Parser
+--echo #
+
+INSERT INTO mysql.global_priv (Host, User, Priv) VALUES
+('localhost', 'MDEV-39266', CONCAT(
+  '{"access":0,"plugin":"mysql_native_password","authentication_string":"',
+  REPEAT('X', 400000),
+  '","password_last_changed":0}'));
+FLUSH PRIVILEGES;
+DROP USER `MDEV-39266`@localhost;
+
+--echo # End if 10.6 tests
--- a/mysql-test/main/case.result
+++ b/mysql-test/main/case.result
@@ -158,7 +158,7 @@ Note	1003	select coalesce(1) AS `COALESCE(1)`,coalesce(1.0) AS `COALESCE(1.0)`,c
 SHOW CREATE TABLE t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `COALESCE(1)` int(1) NOT NULL,
+  `COALESCE(1)` int(2) NOT NULL,
  `COALESCE(1.0)` decimal(2,1) NOT NULL,
  `COALESCE('a')` varchar(1) CHARACTER SET latin1 COLLATE latin1_swedish_ci NOT NULL,
  `COALESCE(1,1.0)` decimal(2,1) NOT NULL,
@@ -589,6 +589,42 @@ case 'X' when 1/0 then 1 when 'X' then 2 else 3 end
 Warnings:
 Warning	1292	Truncated incorrect DOUBLE value: 'X'
 Warning	1365	Division by 0
+#
+# MDEV-23278: Incorrect Calculation with AVG() Function
+#
+create table avg_calc_test (
+id int(11) not null auto_increment,
+name varchar(255) default null,
+primary key (id)
+) auto_increment=1 default charset=latin1;
+insert into avg_calc_test (name) values ('orange'), ('blue'), ('black'), ('orange'), ('black');
+select * from (
+select
+avg(case when name = 'orange' then 3 when name = 'blue' then 2 when name = 'black' then 1 else 0 end) as metric_val
+from avg_calc_test
+) t;
+metric_val
+2.0000
+create table t1 as
+select
+avg(case when name = 'orange' then 3 when name = 'blue' then 2 when name = 'black' then 1 else 0 end) as metric_val
+from avg_calc_test;
+select * from t1;
+metric_val
+2.0000
+create or replace table t1 as
+select
+avg(least(1,2)) as metric_val
+from avg_calc_test;
+select * from t1;
+metric_val
+1.0000
+create or replace table t1 as
+select avg(coalesce(1,2)) as metric_val from avg_calc_test;
+select * from t1;
+metric_val
+1.0000
+drop table avg_calc_test, t1;
 # End of 10.11 test
 #
 # MDEV-36716 A case expression with ROW arguments in THEN crashes
--- a/mysql-test/main/case.test
+++ b/mysql-test/main/case.test
@@ -416,6 +416,43 @@ select case 'X' when null then 1 when 'X' then 2 else 3 end;
 select case 'X' when 1/1 then 1 when 'X' then 2 else 3 end;
 select case 'X' when 1/0 then 1 when 'X' then 2 else 3 end;

+--echo #
+--echo # MDEV-23278: Incorrect Calculation with AVG() Function
+--echo #
+create table avg_calc_test (
+  id int(11) not null auto_increment,
+  name varchar(255) default null,
+  primary key (id)
+) auto_increment=1 default charset=latin1;
+insert into avg_calc_test (name) values ('orange'), ('blue'), ('black'), ('orange'), ('black');
+
+select * from (
+  select
+    avg(case when name = 'orange' then 3 when name = 'blue' then 2 when name = 'black' then 1 else 0 end) as metric_val
+  from avg_calc_test
+) t;
+
+create table t1 as
+  select
+    avg(case when name = 'orange' then 3 when name = 'blue' then 2 when name = 'black' then 1 else 0 end) as metric_val
+  from avg_calc_test;
+
+select * from t1;
+
+create or replace table t1 as
+  select
+    avg(least(1,2)) as metric_val
+  from avg_calc_test;
+
+select * from t1;
+
+create or replace table t1 as
+  select avg(coalesce(1,2)) as metric_val from avg_calc_test;
+
+select * from t1;
+
+drop table avg_calc_test, t1;
+
 --echo # End of 10.11 test

 --echo #
--- a/mysql-test/main/create.result
+++ b/mysql-test/main/create.result
@@ -2071,6 +2071,19 @@ ERROR 42000: Incorrect database name '#testone#￭￭￭￭￭￭￭￭￭￭￭
 SET NAMES DEFAULT;
 # End of 10.5 Test
 #
+# MDEV-39002: Diagnostics area assertion failure upon CREATE TABLE
+#
+CREATE TABLE t1 (a INT, b VARCHAR(8) DEFAULT (IFNULL(a,''))) CHARSET swe7;
+ERROR HY000: Illegal mix of collations (latin1_swedish_ci,NUMERIC) and (swe7_swedish_ci,COERCIBLE) for operation 'ifnull'
+# Test Item_func_case_abbreviation2 (IF, NVL2, IFNULL) with collation mismatch in DEFAULT
+CREATE TABLE t1 (a VARCHAR(8) CHARSET latin1, b VARCHAR(8) DEFAULT (IFNULL(_latin1'x', _swe7'y'))) CHARSET utf8;
+ERROR HY000: Illegal mix of collations (latin1_swedish_ci,COERCIBLE) and (swe7_swedish_ci,COERCIBLE) for operation 'ifnull'
+CREATE TABLE t1 (a VARCHAR(8) CHARSET latin1, b VARCHAR(8) DEFAULT (IF(1, _latin1'x', _swe7'y'))) CHARSET utf8;
+ERROR HY000: Illegal mix of collations (latin1_swedish_ci,COERCIBLE) and (swe7_swedish_ci,COERCIBLE) for operation 'if'
+CREATE TABLE t1 (a VARCHAR(8) CHARSET latin1, b VARCHAR(8) DEFAULT (NVL2(1, _latin1'x', _swe7'y'))) CHARSET utf8;
+ERROR HY000: Illegal mix of collations (latin1_swedish_ci,COERCIBLE) and (swe7_swedish_ci,COERCIBLE) for operation 'nvl2'
+End of 10.11 tests
+#
 # MDEV-35318 Assertion `tl->jtbm_subselect' failed in JOIN::calc_allowed_top_level_tables on 2nd execution of PS
 #
 CREATE TABLE t (a INT);
--- a/mysql-test/main/create.test
+++ b/mysql-test/main/create.test
@@ -1946,6 +1946,23 @@ SET NAMES DEFAULT;

 --echo # End of 10.5 Test

+--echo #
+--echo # MDEV-39002: Diagnostics area assertion failure upon CREATE TABLE
+--echo #
+
+--error ER_CANT_AGGREGATE_2COLLATIONS
+CREATE TABLE t1 (a INT, b VARCHAR(8) DEFAULT (IFNULL(a,''))) CHARSET swe7;
+
+--echo # Test Item_func_case_abbreviation2 (IF, NVL2, IFNULL) with collation mismatch in DEFAULT
+--error ER_CANT_AGGREGATE_2COLLATIONS
+CREATE TABLE t1 (a VARCHAR(8) CHARSET latin1, b VARCHAR(8) DEFAULT (IFNULL(_latin1'x', _swe7'y'))) CHARSET utf8;
+--error ER_CANT_AGGREGATE_2COLLATIONS
+CREATE TABLE t1 (a VARCHAR(8) CHARSET latin1, b VARCHAR(8) DEFAULT (IF(1, _latin1'x', _swe7'y'))) CHARSET utf8;
+--error ER_CANT_AGGREGATE_2COLLATIONS
+CREATE TABLE t1 (a VARCHAR(8) CHARSET latin1, b VARCHAR(8) DEFAULT (NVL2(1, _latin1'x', _swe7'y'))) CHARSET utf8;
+
+--echo End of 10.11 tests
+
 --echo #
 --echo # MDEV-35318 Assertion `tl->jtbm_subselect' failed in JOIN::calc_allowed_top_level_tables on 2nd execution of PS
 --echo #
--- a/mysql-test/main/cte_recursive.result
+++ b/mysql-test/main/cte_recursive.result
@@ -5135,7 +5135,7 @@ Warning	1264	Out of range value for column 'mid' at row 5
 show create table t2;
 Table	Create Table
 t2	CREATE TABLE `t2` (
-  `level` int(1) DEFAULT NULL,
+  `level` int(2) DEFAULT NULL,
  `id` int(11) DEFAULT NULL,
  `mid` int(11) DEFAULT NULL,
  `name` text CHARACTER SET latin1 COLLATE latin1_swedish_ci DEFAULT NULL,
@@ -5216,7 +5216,7 @@ Warning	1264	Out of range value for column 'mid' at row 5
 show create table t2;
 Table	Create Table
 t2	CREATE TABLE `t2` (
-  `level` int(1) DEFAULT NULL,
+  `level` int(2) DEFAULT NULL,
  `id` int(11) DEFAULT NULL,
  `mid` int(11) DEFAULT NULL,
  `name` text CHARACTER SET latin1 COLLATE latin1_swedish_ci DEFAULT NULL,
--- a/mysql-test/main/ctype_binary.result
+++ b/mysql-test/main/ctype_binary.result
@@ -607,7 +607,7 @@ create table t1 as select concat(least(1,2)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varbinary(1) DEFAULT NULL
+  `c1` varbinary(2) DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(greatest(1,2)));
@@ -617,7 +617,7 @@ create table t1 as select concat(greatest(1,2)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varbinary(1) DEFAULT NULL
+  `c1` varbinary(2) DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(case when 11 then 22 else 33 end));
@@ -627,7 +627,7 @@ create table t1 as select concat(case when 11 then 22 else 33 end) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varbinary(2) DEFAULT NULL
+  `c1` varbinary(3) DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(coalesce(1,2)));
@@ -637,7 +637,7 @@ create table t1 as select concat(coalesce(1,2)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varbinary(1) DEFAULT NULL
+  `c1` varbinary(2) DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat_ws(1,2,3));
@@ -1068,7 +1068,7 @@ create table t1 as select concat(ifnull(1,1)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varbinary(1) DEFAULT NULL
+  `c1` varbinary(2) DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(ifnull(1.1,1.1)));
@@ -1108,7 +1108,7 @@ create table t1 as select concat(if(1,1,1)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varbinary(1) DEFAULT NULL
+  `c1` varbinary(2) DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(nullif(1,2)));
--- a/mysql-test/main/ctype_cp1251.result
+++ b/mysql-test/main/ctype_cp1251.result
@@ -1019,7 +1019,7 @@ create table t1 as select concat(least(1,2)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET cp1251 COLLATE cp1251_general_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET cp1251 COLLATE cp1251_general_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(greatest(1,2)));
@@ -1029,7 +1029,7 @@ create table t1 as select concat(greatest(1,2)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET cp1251 COLLATE cp1251_general_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET cp1251 COLLATE cp1251_general_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(case when 11 then 22 else 33 end));
@@ -1039,7 +1039,7 @@ create table t1 as select concat(case when 11 then 22 else 33 end) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(2) CHARACTER SET cp1251 COLLATE cp1251_general_ci DEFAULT NULL
+  `c1` varchar(3) CHARACTER SET cp1251 COLLATE cp1251_general_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(coalesce(1,2)));
@@ -1049,7 +1049,7 @@ create table t1 as select concat(coalesce(1,2)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET cp1251 COLLATE cp1251_general_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET cp1251 COLLATE cp1251_general_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat_ws(1,2,3));
@@ -1480,7 +1480,7 @@ create table t1 as select concat(ifnull(1,1)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET cp1251 COLLATE cp1251_general_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET cp1251 COLLATE cp1251_general_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(ifnull(1.1,1.1)));
@@ -1520,7 +1520,7 @@ create table t1 as select concat(if(1,1,1)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET cp1251 COLLATE cp1251_general_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET cp1251 COLLATE cp1251_general_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(nullif(1,2)));
--- a/mysql-test/main/ctype_latin1.result
+++ b/mysql-test/main/ctype_latin1.result
@@ -1328,7 +1328,7 @@ create table t1 as select concat(least(1,2)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET latin1 COLLATE latin1_swedish_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET latin1 COLLATE latin1_swedish_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(greatest(1,2)));
@@ -1338,7 +1338,7 @@ create table t1 as select concat(greatest(1,2)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET latin1 COLLATE latin1_swedish_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET latin1 COLLATE latin1_swedish_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(case when 11 then 22 else 33 end));
@@ -1348,7 +1348,7 @@ create table t1 as select concat(case when 11 then 22 else 33 end) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(2) CHARACTER SET latin1 COLLATE latin1_swedish_ci DEFAULT NULL
+  `c1` varchar(3) CHARACTER SET latin1 COLLATE latin1_swedish_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(coalesce(1,2)));
@@ -1358,7 +1358,7 @@ create table t1 as select concat(coalesce(1,2)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET latin1 COLLATE latin1_swedish_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET latin1 COLLATE latin1_swedish_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat_ws(1,2,3));
@@ -1789,7 +1789,7 @@ create table t1 as select concat(ifnull(1,1)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET latin1 COLLATE latin1_swedish_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET latin1 COLLATE latin1_swedish_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(ifnull(1.1,1.1)));
@@ -1829,7 +1829,7 @@ create table t1 as select concat(if(1,1,1)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET latin1 COLLATE latin1_swedish_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET latin1 COLLATE latin1_swedish_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(nullif(1,2)));
--- a/mysql-test/main/ctype_ucs.result
+++ b/mysql-test/main/ctype_ucs.result
@@ -2210,7 +2210,7 @@ create table t1 as select concat(least(1,2)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET ucs2 COLLATE ucs2_general_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET ucs2 COLLATE ucs2_general_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(greatest(1,2)));
@@ -2220,7 +2220,7 @@ create table t1 as select concat(greatest(1,2)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET ucs2 COLLATE ucs2_general_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET ucs2 COLLATE ucs2_general_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(case when 11 then 22 else 33 end));
@@ -2230,7 +2230,7 @@ create table t1 as select concat(case when 11 then 22 else 33 end) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(2) CHARACTER SET ucs2 COLLATE ucs2_general_ci DEFAULT NULL
+  `c1` varchar(3) CHARACTER SET ucs2 COLLATE ucs2_general_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(coalesce(1,2)));
@@ -2240,7 +2240,7 @@ create table t1 as select concat(coalesce(1,2)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET ucs2 COLLATE ucs2_general_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET ucs2 COLLATE ucs2_general_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat_ws(1,2,3));
@@ -2671,7 +2671,7 @@ create table t1 as select concat(ifnull(1,1)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET ucs2 COLLATE ucs2_general_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET ucs2 COLLATE ucs2_general_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(ifnull(1.1,1.1)));
@@ -2711,7 +2711,7 @@ create table t1 as select concat(if(1,1,1)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET ucs2 COLLATE ucs2_general_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET ucs2 COLLATE ucs2_general_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(nullif(1,2)));
--- a/mysql-test/main/ctype_utf8.result
+++ b/mysql-test/main/ctype_utf8.result
@@ -2956,7 +2956,7 @@ create table t1 as select concat(least(1,2)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(greatest(1,2)));
@@ -2966,7 +2966,7 @@ create table t1 as select concat(greatest(1,2)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(case when 11 then 22 else 33 end));
@@ -2976,7 +2976,7 @@ create table t1 as select concat(case when 11 then 22 else 33 end) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(2) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci DEFAULT NULL
+  `c1` varchar(3) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(coalesce(1,2)));
@@ -2986,7 +2986,7 @@ create table t1 as select concat(coalesce(1,2)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat_ws(1,2,3));
@@ -3417,7 +3417,7 @@ create table t1 as select concat(ifnull(1,1)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(ifnull(1.1,1.1)));
@@ -3457,7 +3457,7 @@ create table t1 as select concat(if(1,1,1)) as c1;
 show create table t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
-  `c1` varchar(1) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci DEFAULT NULL
+  `c1` varchar(2) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 drop table t1;
 select hex(concat(nullif(1,2)));
--- a/mysql-test/main/ctype_utf8mb3_geeral1400_as_ci.result
+++ b/mysql-test/main/ctype_utf8mb3_geeral1400_as_ci.result
@@ -23,3 +23,17 @@ DROP TABLE t1;
 #
 # End of 11.5 tests
 #
+#
+# MDEV-35717: UBSAN: runtime error: applying zero offset to null pointer in `my_strnncoll_utf8mb3_general1400_as_ci`
+#
+CREATE TABLE t (c INT,c2 CHAR,c3 DATE,CHECK (c>0));
+ALTER TABLE t ADD INDEX (c2) USING HASH;
+DROP TABLE t;
+#
+# MDEV-39356: Server crashes when executing UPDATE ... FOR PORTION OF with a normal table
+#
+CREATE OR REPLACE TABLE t (id INT);
+UPDATE t FOR PORTION OF p FROM '2026-02-01' TO '2026-03-01'  SET id = 2;
+ERROR HY000: Period `p` is not found in table
+DROP TABLE t;
+# End of 11.8 tests
--- a/mysql-test/main/ctype_utf8mb3_geeral1400_as_ci.test
+++ b/mysql-test/main/ctype_utf8mb3_geeral1400_as_ci.test
@@ -23,3 +23,23 @@ DROP TABLE t1;
 --echo #
 --echo # End of 11.5 tests
 --echo #
+
+--echo #
+--echo # MDEV-35717: UBSAN: runtime error: applying zero offset to null pointer in `my_strnncoll_utf8mb3_general1400_as_ci`
+--echo #
+
+CREATE TABLE t (c INT,c2 CHAR,c3 DATE,CHECK (c>0));
+ALTER TABLE t ADD INDEX (c2) USING HASH;
+
+DROP TABLE t;
+
+--echo #
+--echo # MDEV-39356: Server crashes when executing UPDATE ... FOR PORTION OF with a normal table
+--echo #
+
+CREATE OR REPLACE TABLE t (id INT);
+--error ER_PERIOD_NOT_FOUND
+UPDATE t FOR PORTION OF p FROM '2026-02-01' TO '2026-03-01'  SET id = 2;
+DROP TABLE t;
+
+--echo # End of 11.8 tests
--- a/mysql-test/main/derived_cond_pushdown.result
+++ b/mysql-test/main/derived_cond_pushdown.result
@@ -3767,7 +3767,7 @@ EXPLAIN
            "attached_condition": "t2.b < 50"
          },
          "buffer_type": "flat",
-          "buffer_size": "1Kb",
+          "buffer_size": "1KiB",
          "join_type": "BNL",
          "attached_condition": "v2.a = v1.a or t2.a = v1.a"
        }
@@ -3866,7 +3866,7 @@ EXPLAIN
            "filtered": 100
          },
          "buffer_type": "incremental",
-          "buffer_size": "4Kb",
+          "buffer_size": "4KiB",
          "join_type": "BNL",
          "attached_condition": "v1.a = t2.a and v2.a = t2.a or v2.b > 13 and t2.c < 115",
          "materialized": {
@@ -3995,7 +3995,7 @@ EXPLAIN
            "attached_condition": "v2.b < 50 or v2.b = 19"
          },
          "buffer_type": "incremental",
-          "buffer_size": "4Kb",
+          "buffer_size": "4KiB",
          "join_type": "BNL",
          "attached_condition": "(v2.a = v1.a or v1.a = t2.a) and (v2.b < 50 or v2.b = 19)",
          "materialized": {
@@ -4257,7 +4257,7 @@ EXPLAIN
            "filtered": 100
          },
          "buffer_type": "flat",
-          "buffer_size": "1Kb",
+          "buffer_size": "1KiB",
          "join_type": "BNL"
        }
      }
@@ -4516,7 +4516,7 @@ EXPLAIN
            "attached_condition": "v2.max_c > 300"
          },
          "buffer_type": "incremental",
-          "buffer_size": "9Kb",
+          "buffer_size": "9KiB",
          "join_type": "BNL",
          "attached_condition": "v2.a = v1.a or v1.a = t2.a",
          "materialized": {
@@ -4887,7 +4887,7 @@ EXPLAIN
            "filtered": 100
          },
          "buffer_type": "flat",
-          "buffer_size": "4Kb",
+          "buffer_size": "4KiB",
          "join_type": "BNL"
        }
      }
@@ -6441,7 +6441,7 @@ EXPLAIN
            "attached_condition": "v_union.a = 1"
          },
          "buffer_type": "incremental",
-          "buffer_size": "4Kb",
+          "buffer_size": "4KiB",
          "join_type": "BNL",
          "attached_condition": "v_union.c > 800 or v1.max_c > 200",
          "materialized": {
@@ -8014,7 +8014,7 @@ EXPLAIN
            "filtered": 100
          },
          "buffer_type": "flat",
-          "buffer_size": "1Kb",
+          "buffer_size": "1KiB",
          "join_type": "BNL"
        }
      }
@@ -23765,4 +23765,27 @@ select * from v2 where greatest(a, default(a));
 a	count(*)
 drop view v2, v1;
 drop table t1;
+#
+# MDEV-29360 Crash when pushing condition with always false IS NULL
+#   into derived contains constant TRUE/FALSE as subformula
+#
+create table t1 (id int not null);
+insert into t1 values (0),(1),(3);
+create table t2 select * from t1;
+create table t3 select * from t1;
+select * from (select id  from t1 group by id) dt1, (select id from t2) dt2, t3
+where dt2.id = t3.id and dt1.id between 0 and (dt2.id is null);
+id	id	id
+0	0	0
+0	1	1
+0	3	3
+select * from (select id  from t1 union select id from t2) dt1,
+(select id from t2) dt2,
+t3
+where dt2.id = t3.id and dt1.id between 0 and (dt2.id is null);
+id	id	id
+0	0	0
+0	1	1
+0	3	3
+drop table t1,t2,t3;
 # End of 10.11 tests
--- a/mysql-test/main/derived_cond_pushdown.test
+++ b/mysql-test/main/derived_cond_pushdown.test
@@ -4554,4 +4554,24 @@ select * from v2 where greatest(a, default(a));
 drop view v2, v1;
 drop table t1;

+--echo #
+--echo # MDEV-29360 Crash when pushing condition with always false IS NULL
+--echo #   into derived contains constant TRUE/FALSE as subformula
+--echo #
+
+create table t1 (id int not null);
+insert into t1 values (0),(1),(3);
+create table t2 select * from t1;
+create table t3 select * from t1;
+
+select * from (select id  from t1 group by id) dt1, (select id from t2) dt2, t3
+  where dt2.id = t3.id and dt1.id between 0 and (dt2.id is null);
+
+select * from (select id  from t1 union select id from t2) dt1,
+              (select id from t2) dt2,
+              t3
+  where dt2.id = t3.id and dt1.id between 0 and (dt2.id is null);
+
+drop table t1,t2,t3;
+
 --echo # End of 10.11 tests
--- a/mysql-test/main/derived_split_innodb.result
+++ b/mysql-test/main/derived_split_innodb.result
@@ -507,7 +507,7 @@ ANALYZE
                      "r_filtered": 100
                    },
                    "buffer_type": "flat",
-                    "buffer_size": "1Kb",
+                    "buffer_size": "1KiB",
                    "join_type": "BNL",
                    "attached_condition": "trigcond(t11.col1 = t10.col1)",
                    "r_loops": 500,
--- a/mysql-test/main/dyncol.result
+++ b/mysql-test/main/dyncol.result
@@ -1974,3 +1974,16 @@ var	{"jsn":"\u0000\u0005\u0000l\u0000'\u0000\u0002\u0000)\u0000\u0002\u0000+\u00
 zzz	{"jsn":"\u0000\u0009\u0000<30>\u0000C\u0000\u0002\u0000E\u0000\u0002\u0000G\u0000\u0003\u0000J\u0000\u0004\u0000N\u0000\u0005\u0000S\u0000\u0005\u0000X\u0000\u0005\u0000]\u0000\u0005\u0000b\u0000\u0005\u0000\u000Cg\u0000\u000Cj\u0000\u000Cm\u0000\u000Cp\u0000\u0005,\u0000\u0005\u001B\u0000\u0005,\u0000\u000C<30>\u0000\u0007<30>\u0000f8f9f10pic2box_cbox_gbox_kbox_vf5_id\u000244\u000244\u000232Ahttp://oss.hdb88.com/0/photo/078ee7e7c6464ab68a0483733266a52a.gif\u00080.052272$O\u001E\u0000","volume":193.6}
 drop table t1;
 # End of 10.5 tests
+#
+# MDEV-36929: COLUMN_JSON() does not free an internal dynamic string
+#
+SELECT COLUMN_JSON(1000);
+ERROR HY000: Encountered illegal format of dynamic column string
+#
+# MDEV-39581 dynamic column header missing sanity checks
+#
+SELECT COLUMN_LIST(0x040100FFFF00000300666F6F21626172);
+ERROR HY000: Encountered illegal format of dynamic column string
+SELECT COLUMN_JSON(CONCAT(0x040200020001000000000000004241, REPEAT('D', 512)));
+ERROR HY000: Encountered illegal format of dynamic column string
+# End of 10.6 tests
--- a/mysql-test/main/dyncol.test
+++ b/mysql-test/main/dyncol.test
@@ -1026,3 +1026,21 @@ select c1,column_json(d1) as not_crashing from t1 order by c1;
 drop table t1;

 --echo # End of 10.5 tests
+
+--echo #
+--echo # MDEV-36929: COLUMN_JSON() does not free an internal dynamic string
+--echo #
+--error ER_DYN_COL_WRONG_FORMAT
+SELECT COLUMN_JSON(1000);
+
+
+--echo #
+--echo # MDEV-39581 dynamic column header missing sanity checks
+--echo #
+--error ER_DYN_COL_WRONG_FORMAT
+SELECT COLUMN_LIST(0x040100FFFF00000300666F6F21626172);
+
+--error ER_DYN_COL_WRONG_FORMAT
+SELECT COLUMN_JSON(CONCAT(0x040200020001000000000000004241, REPEAT('D', 512)));
+
+--echo # End of 10.6 tests
--- a/mysql-test/main/explain_json.result
+++ b/mysql-test/main/explain_json.result
@@ -512,7 +512,7 @@ EXPLAIN
            "attached_condition": "tbl2.b < 5"
          },
          "buffer_type": "flat",
-          "buffer_size": "1Kb",
+          "buffer_size": "1KiB",
          "join_type": "BNL",
          "attached_condition": "tbl2.a = tbl1.a"
        }
@@ -861,7 +861,7 @@ EXPLAIN
            "filtered": 100
          },
          "buffer_type": "flat",
-          "buffer_size": "19Kb",
+          "buffer_size": "19KiB",
          "join_type": "BNL"
        }
      }
@@ -1175,7 +1175,7 @@ EXPLAIN
                  "filtered": 100
                },
                "buffer_type": "flat",
-                "buffer_size": "1Kb",
+                "buffer_size": "1KiB",
                "join_type": "BNL",
                "attached_condition": "tbl2.b = tbl1.b"
              }
--- a/mysql-test/main/func_equal.result
+++ b/mysql-test/main/func_equal.result
@@ -55,6 +55,16 @@ c1
 DROP TABLE t0;
 # End of 10.5 tests
 #
+# MDEV-36792: UBSAN load of null pointer and Assertion `b == &type_handler_row || b == &type_handler_null` in `Arg_comparator::set_cmp_func when using ROW()`
+#
+CREATE FUNCTION f() RETURNS ROW TYPE OF t RETURN 1;
+CREATE TABLE t (a INT);
+SELECT ROW(f(),1)=ROW(1,1) AS eq;
+ERROR HY000: Illegal parameter data types row and int for operation '='
+DROP FUNCTION f;
+DROP TABLE t;
+# End of 11.8 tests
+#
 # MDEV-36964: Infinite loop in `cmp_row_type`, SIGABRT in `Type_handler_composite::Item_update_null_value`
 #
 CREATE FUNCTION f() RETURNS ROW TYPE OF t RETURN 1;
--- a/mysql-test/main/func_equal.test
+++ b/mysql-test/main/func_equal.test
@@ -60,6 +60,19 @@ DROP TABLE t0;

 --echo # End of 10.5 tests

+--echo #
+--echo # MDEV-36792: UBSAN load of null pointer and Assertion `b == &type_handler_row || b == &type_handler_null` in `Arg_comparator::set_cmp_func when using ROW()`
+--echo #
+
+CREATE FUNCTION f() RETURNS ROW TYPE OF t RETURN 1;
+CREATE TABLE t (a INT);
+--error ER_ILLEGAL_PARAMETER_DATA_TYPES2_FOR_OPERATION
+SELECT ROW(f(),1)=ROW(1,1) AS eq;
+DROP FUNCTION f;
+DROP TABLE t;
+
+--echo # End of 11.8 tests
+
 --echo #
 --echo # MDEV-36964: Infinite loop in `cmp_row_type`, SIGABRT in `Type_handler_composite::Item_update_null_value`
 --echo #
--- a/mysql-test/main/func_gconcat.result
+++ b/mysql-test/main/func_gconcat.result
@@ -1538,3 +1538,21 @@ DROP VIEW v1;
 DROP TABLE t1;
 SET NAMES latin1;
 # End of 10.5 tests
+#
+# MDEV-39673 group_concat ignores max_allowed_packet
+#
+connect u,localhost,root;
+set group_concat_max_len=2*1024*1024*1024;
+Warnings:
+Warning	1292	Truncated incorrect group_concat_max_len value: '2147483648'
+select @@group_concat_max_len;
+@@group_concat_max_len
+1073741824
+select length(group_concat(repeat('a', @@max_allowed_packet-1), repeat('a', @@max_allowed_packet-1))) from dual;
+length(group_concat(repeat('a', @@max_allowed_packet-1), repeat('a', @@max_allowed_packet-1)))
+16777216
+Warnings:
+Warning	1260	Row 1 was cut by group_concat()
+disconnect u;
+connection default;
+# End of 10.6 tests
--- a/mysql-test/main/func_gconcat.test
+++ b/mysql-test/main/func_gconcat.test
@@ -1125,3 +1125,15 @@ DROP TABLE t1;
 SET NAMES latin1;

 --echo # End of 10.5 tests
+
+--echo #
+--echo # MDEV-39673 group_concat ignores max_allowed_packet
+--echo #
+connect u,localhost,root;
+set group_concat_max_len=2*1024*1024*1024;
+select @@group_concat_max_len;
+select length(group_concat(repeat('a', @@max_allowed_packet-1), repeat('a', @@max_allowed_packet-1))) from dual;
+disconnect u;
+connection default;
+
+--echo # End of 10.6 tests
--- a/mysql-test/main/func_hybrid_type.result
+++ b/mysql-test/main/func_hybrid_type.result
@@ -3597,7 +3597,7 @@ SHOW CREATE TABLE t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
  `c1` bigint(11) NOT NULL,
-  `c2` bigint(11) NOT NULL
+  `c2` bigint(12) NOT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
 DROP TABLE t1;
 CREATE TABLE t1 AS SELECT
@@ -3633,47 +3633,47 @@ SHOW CREATE TABLE t1;
 Table	Create Table
 t1	CREATE TABLE `t1` (
  `i1` int(1) NOT NULL,
-  `c1` int(1) NOT NULL,
+  `c1` int(2) NOT NULL,
  `i2` int(2) NOT NULL,
-  `c2` int(2) NOT NULL,
+  `c2` int(3) NOT NULL,
  `i3` int(3) NOT NULL,
-  `c3` int(3) NOT NULL,
+  `c3` int(4) NOT NULL,
  `i4` int(4) NOT NULL,
-  `c4` int(4) NOT NULL,
+  `c4` int(5) NOT NULL,
  `i5` int(5) NOT NULL,
-  `c5` int(5) NOT NULL,
+  `c5` int(6) NOT NULL,
  `i6` int(6) NOT NULL,
-  `c6` int(6) NOT NULL,
+  `c6` int(7) NOT NULL,
  `i7` int(7) NOT NULL,
-  `c7` int(7) NOT NULL,
+  `c7` int(8) NOT NULL,
  `i8` int(8) NOT NULL,
-  `c8` int(8) NOT NULL,
+  `c8` int(9) NOT NULL,
  `i9` int(9) NOT NULL,
-  `c9` int(9) NOT NULL,
+  `c9` int(10) NOT NULL,
  `2147483647` bigint(10) NOT NULL,
-  `COALESCE(2147483647)` bigint(10) NOT NULL,
+  `COALESCE(2147483647)` bigint(11) NOT NULL,
  `2147483648` bigint(10) NOT NULL,
-  `COALESCE(2147483648)` bigint(10) NOT NULL,
+  `COALESCE(2147483648)` bigint(11) NOT NULL,
  `i10` bigint(10) NOT NULL,
-  `c10` bigint(10) NOT NULL,
+  `c10` bigint(11) NOT NULL,
  `i11` bigint(11) NOT NULL,
-  `c11` bigint(11) NOT NULL,
+  `c11` bigint(12) NOT NULL,
  `i12` bigint(12) NOT NULL,
-  `c12` bigint(12) NOT NULL,
+  `c12` bigint(13) NOT NULL,
  `i13` bigint(13) NOT NULL,
-  `c13` bigint(13) NOT NULL,
+  `c13` bigint(14) NOT NULL,
  `i14` bigint(14) NOT NULL,
-  `c14` bigint(14) NOT NULL,
+  `c14` bigint(15) NOT NULL,
  `i15` bigint(15) NOT NULL,
-  `c15` bigint(15) NOT NULL,
+  `c15` bigint(16) NOT NULL,
  `i16` bigint(16) NOT NULL,
-  `c16` bigint(16) NOT NULL,
+  `c16` bigint(17) NOT NULL,
  `i17` bigint(17) NOT NULL,
-  `c17` bigint(17) NOT NULL,
+  `c17` bigint(18) NOT NULL,
  `i18` bigint(18) NOT NULL,
-  `c18` bigint(18) NOT NULL,
+  `c18` bigint(19) NOT NULL,
  `9223372036854775807` bigint(19) NOT NULL,
-  `COALESCE(9223372036854775807)` bigint(19) NOT NULL,
+  `COALESCE(9223372036854775807)` bigint(20) NOT NULL,
  `9223372036854775808` bigint(19) unsigned NOT NULL,
  `COALESCE(9223372036854775808)` bigint(19) unsigned NOT NULL,
  `i19` bigint(19) unsigned NOT NULL,
@@ -4403,7 +4403,7 @@ DROP VIEW v4;
 CREATE VIEW v5 AS SELECT COALESCE(c, COALESCE(NULL, 10), NULL) as c_col FROM (SELECT NULL AS c) AS t;
 SELECT COLUMN_NAME, IS_NULLABLE, COLUMN_TYPE FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = 'v5';
 COLUMN_NAME	IS_NULLABLE	COLUMN_TYPE
-c_col	NO	varchar(2)
+c_col	NO	varchar(3)
 DROP VIEW v5;
 CREATE TABLE t (c1 INT, c2 DOUBLE, c3 VARCHAR(5), c4 DATE);
 INSERT INTO t values (1, 2.3, 'four', '2025-05-06');
--- a/mysql-test/main/func_json.result
+++ b/mysql-test/main/func_json.result
@@ -753,9 +753,6 @@ create table t1(a double not null);
 insert into t1 values (2),(1);
 select 1 from t1 where json_extract(a,'$','$[81]');
 1
-Warnings:
-Warning	1292	Truncated incorrect BOOLEAN value: '[2]'
-Warning	1292	Truncated incorrect BOOLEAN value: '[1]'
 drop table t1;
 select json_extract('{"test":8.437e-5}','$.test');
 json_extract('{"test":8.437e-5}','$.test')
@@ -1785,6 +1782,27 @@ null<=>json_extract('1',json_object(null,'{ }',null,null),'{}')
 1
 Warnings:
 Warning	4042	Syntax error in JSON path in argument 2 to function 'json_extract' at position 1
+#
+# MDEV-39213: json range syntax crash
+#
+SELECT JSON_EXISTS(CONCAT('[', REPEAT('[', 4000), 'Y', REPEAT(']', 4000), ', 1]'), '$[100]') as ex;
+ex
+NULL
+#
+# MDEV-35548 UBSAN: runtime error: index -1 out of bounds for type 'json_path_step_t[32]'
+# (aka 'struct st_json_path_step_t[32]')
+#
+SELECT JSON_EXTRACT('{a:true}','$.a')=TRUE;
+JSON_EXTRACT('{a:true}','$.a')=TRUE
+NULL
+Warnings:
+Warning	4038	Syntax error in JSON text in argument 1 to function 'json_extract' at position 2
+SELECT JSON_EXTRACT('0E+0','$');
+JSON_EXTRACT('0E+0','$')
+0E+0
+SELECT JSON_EXISTS(CONCAT('[', REPEAT('[', 4000), 'Y', REPEAT(']', 4000), ', 1]'), '$[100]') as je;
+je
+NULL
 # End of 10.6 tests
 SELECT json_extract(t.j, '$')
 FROM (SELECT json_extract('["a",1]', '$') AS j) AS t;
@@ -2821,8 +2839,8 @@ Warning	4044	Wildcards or range in JSON path not allowed in argument 2 to functi
 #
 # MDEV-37640: Crash at String::append with json_normalize
 #
-SELECT ( WITH x AS ( WITH x AS ( SELECT 1.000000 ) SELECT ( REPEAT ( ( json_normalize ( ' 	-1' ) ) , 357 ) ) x ) SELECT x FROM x WHERE x IN ( x , x ) );
-( WITH x AS ( WITH x AS ( SELECT 1.000000 ) SELECT ( REPEAT ( ( json_normalize ( ' 	-1' ) ) , 357 ) ) x ) SELECT x FROM x WHERE x IN ( x , x ) )
+SELECT ( WITH x AS ( WITH x AS ( SELECT 1.000000 ) SELECT ( REPEAT ( ( json_normalize ( ' 	-1' ) ) , 357 ) ) x ) SELECT x FROM x WHERE x IN ( x , x ) ) x;
+x
 -1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0-1.0E0
 #
 # MDEV-37640: Crash in JSON_KEYS
@@ -2889,6 +2907,24 @@ Warning	4038	Syntax error in JSON text in argument 1 to function 'json_length' a
 SELECT JSON_VALID('{ "A": [0,] }');
 JSON_VALID('{ "A": [0,] }')
 0
+#
+# MDEV-35548 UBSAN: runtime error: index -1 out of bounds for type 'json_path_step_t[32]'
+# (aka 'struct st_json_path_step_t[32]')
+#
+SELECT JSON_EXTRACT('{a:true}','$.a')=TRUE;
+JSON_EXTRACT('{a:true}','$.a')=TRUE
+NULL
+Warnings:
+Warning	4038	Syntax error in JSON text in argument 1 to function 'json_extract' at position 2
+SELECT JSON_EXTRACT('0E+0','$');
+JSON_EXTRACT('0E+0','$')
+0E+0
+#
+# MDEV-26814: UBSAN: offset to nullptr in JSON_ARRAY_INSERT
+#
+SELECT JSON_ARRAY_INSERT (0,NULL,1) as j;
+j
+NULL
 # End of 10.11 Test
 #
 # MDEV-32007: JSON_VALUE and JSON_EXTRACT doesn't handle dash (-)
@@ -5360,7 +5396,7 @@ SET @obj1= '[1, 2, 3, 3, 3.0, "abc", true, true, {"key1":"val1" ]';
 SET @obj2= '[3.0, 3, 5, "abc", "abc", true, {"key2":"val2"}, {"key1":"val1"}, {"key1":"val2"}]';
 select json_array_intersect(@obj1, @obj2);
 json_array_intersect(@obj1, @obj2)
-NULL
+[3.0, 3, "abc", true]
 Warnings:
 Warning	4038	Syntax error in JSON text in argument 1 to function 'json_array_intersect' at position 53
 # Checking incorrect type for input
@@ -5517,7 +5553,39 @@ ERROR HY000: Invalid value for keyword properties
 select json_schema_valid('{"enum":[0]}', sformat('"{:#>200}"','0'));
 json_schema_valid('{"enum":[0]}', sformat('"{:#>200}"','0'))
 0
+#
+# MDEV-36808 json_array_intersect incorrect results after returning NULL in table scan
+#
+CREATE TABLE t1 (full text, overlap text);
+INSERT INTO t1 VALUES ('["2"]', '["2"]'), ('["2"]', '["0"]'),  ('["2"]', '["2"]');
+SELECT full, overlap, json_array_intersect(full, overlap) as jai from t1;
+full	overlap	jai
+["2"]	["2"]	["2"]
+["2"]	["0"]	NULL
+["2"]	["2"]	["2"]
+DROP TABLE t1;
 # End of 11.4 Test
+#
+# MDEV-38702 Behaviour of IF() with boolean JSON_EXTRACT as expression is wrong
+#
+SELECT JSON_TYPE(JSON_EXTRACT(x.val, '$.booleanValue')) AS json_type,
+JSON_EXTRACT(x.val, '$.booleanValue') AS value,
+IF(JSON_EXTRACT(x.val, '$.booleanValue'), 1, 0) AS value_if,
+JSON_EXTRACT(x.val, '$.booleanValue') = true AS value_eq
+FROM (SELECT '{"booleanValue": true}' AS val UNION ALL SELECT '{"booleanValue": false}' AS val ) AS x;
+json_type	value	value_if	value_eq
+BOOLEAN	true	1	1
+BOOLEAN	false	0	0
+#
+# MDEV-39135 JSON_OBJECTAGG(NULL) in decimal context
+#
+create table t0(c0 boolean);
+insert t0 values (false);
+select 1 ^ json_objectagg(NULL, 'a') from t0;
+1 ^ json_objectagg(NULL, 'a')
+NULL
+drop table t0;
+# End of 11.8 Test
 # Beginning of 12.3 Test
 #
 # MDEV-37072: Implement IS JSON predicate
--- a/mysql-test/main/func_json.test
+++ b/mysql-test/main/func_json.test
@@ -1226,6 +1226,22 @@ FROM JSON_TABLE (@data, '$[*]' COLUMNS (data text PATH '$.Data')) AS t;

 select null<=>json_extract('1',json_object(null,'{ }',null,null),'{}');

+--echo #
+--echo # MDEV-39213: json range syntax crash
+--echo #
+
+SELECT JSON_EXISTS(CONCAT('[', REPEAT('[', 4000), 'Y', REPEAT(']', 4000), ', 1]'), '$[100]') as ex;
+
+--echo #
+--echo # MDEV-35548 UBSAN: runtime error: index -1 out of bounds for type 'json_path_step_t[32]'
+--echo # (aka 'struct st_json_path_step_t[32]')
+--echo #
+
+SELECT JSON_EXTRACT('{a:true}','$.a')=TRUE;
+SELECT JSON_EXTRACT('0E+0','$');
+
+SELECT JSON_EXISTS(CONCAT('[', REPEAT('[', 4000), 'Y', REPEAT(']', 4000), ', 1]'), '$[100]') as je;
+
 --echo # End of 10.6 tests

 SELECT json_extract(t.j, '$')
@@ -2037,7 +2053,7 @@ SELECT JSON_VALUE('{"a":[1,2]}', '$.a[*]');
 --echo # MDEV-37640: Crash at String::append with json_normalize
 --echo #

-SELECT ( WITH x AS ( WITH x AS ( SELECT 1.000000 ) SELECT ( REPEAT ( ( json_normalize ( ' 	-1' ) ) , 357 ) ) x ) SELECT x FROM x WHERE x IN ( x , x ) );
+SELECT ( WITH x AS ( WITH x AS ( SELECT 1.000000 ) SELECT ( REPEAT ( ( json_normalize ( ' 	-1' ) ) , 357 ) ) x ) SELECT x FROM x WHERE x IN ( x , x ) ) x;

 --echo #
 --echo # MDEV-37640: Crash in JSON_KEYS
@@ -2069,6 +2085,20 @@ SELECT JSON_VALUE('{ "A": [5] }', '$.A[-2]');
 SELECT JSON_LENGTH('{ "A": [0,] }', '$.A');
 SELECT JSON_VALID('{ "A": [0,] }');

+--echo #
+--echo # MDEV-35548 UBSAN: runtime error: index -1 out of bounds for type 'json_path_step_t[32]'
+--echo # (aka 'struct st_json_path_step_t[32]')
+--echo #
+
+SELECT JSON_EXTRACT('{a:true}','$.a')=TRUE;
+SELECT JSON_EXTRACT('0E+0','$');
+
+--echo #
+--echo # MDEV-26814: UBSAN: offset to nullptr in JSON_ARRAY_INSERT
+--echo #
+
+SELECT JSON_ARRAY_INSERT (0,NULL,1) as j;
+
 --echo # End of 10.11 Test

 --echo #
@@ -4293,8 +4323,38 @@ SELECT JSON_SCHEMA_VALID('{"properties": "a_string": {"pattern": "^[5-9]$"}}}',
 --echo #
 select json_schema_valid('{"enum":[0]}', sformat('"{:#>200}"','0'));

+--echo #
+--echo # MDEV-36808 json_array_intersect incorrect results after returning NULL in table scan
+--echo #
+
+CREATE TABLE t1 (full text, overlap text);
+INSERT INTO t1 VALUES ('["2"]', '["2"]'), ('["2"]', '["0"]'),  ('["2"]', '["2"]');
+
+SELECT full, overlap, json_array_intersect(full, overlap) as jai from t1;
+
+DROP TABLE t1;
+
 --echo # End of 11.4 Test

+--echo #
+--echo # MDEV-38702 Behaviour of IF() with boolean JSON_EXTRACT as expression is wrong
+--echo #
+SELECT JSON_TYPE(JSON_EXTRACT(x.val, '$.booleanValue')) AS json_type,
+       JSON_EXTRACT(x.val, '$.booleanValue') AS value,
+       IF(JSON_EXTRACT(x.val, '$.booleanValue'), 1, 0) AS value_if,
+       JSON_EXTRACT(x.val, '$.booleanValue') = true AS value_eq
+FROM (SELECT '{"booleanValue": true}' AS val UNION ALL SELECT '{"booleanValue": false}' AS val ) AS x;
+
+--echo #
+--echo # MDEV-39135 JSON_OBJECTAGG(NULL) in decimal context
+--echo #
+create table t0(c0 boolean);
+insert t0 values (false);
+select 1 ^ json_objectagg(NULL, 'a') from t0;
+drop table t0;
+
+--echo # End of 11.8 Test
+
 --echo # Beginning of 12.3 Test

 --echo #
--- a/mysql-test/main/func_json_notembedded.result
+++ b/mysql-test/main/func_json_notembedded.result
@@ -3,7 +3,7 @@ connect u,localhost,root;
 #
 # MDEV-24909 JSON functions don't respect KILL QUERY / max_statement_time limit
 #
-set group_concat_max_len= 4294967295;
+set group_concat_max_len= 1000000000;
 set @obj=concat_ws('','{', repeat('"a":"b",', 1250000/2), '"c":"d"}');
 set @arr=concat_ws('','[', repeat('1234567,', 1250000/2), '2345678]');
 select length(@obj), length(@arr);
--- a/mysql-test/main/func_json_notembedded.test
+++ b/mysql-test/main/func_json_notembedded.test
@@ -9,7 +9,7 @@ connect u,localhost,root;
 --echo #
 --echo # MDEV-24909 JSON functions don't respect KILL QUERY / max_statement_time limit
 --echo #
-set group_concat_max_len= 4294967295;
+set group_concat_max_len= 1000000000;

 set @obj=concat_ws('','{', repeat('"a":"b",', 1250000/2), '"c":"d"}');
 set @arr=concat_ws('','[', repeat('1234567,', 1250000/2), '2345678]');
--- a/mysql-test/main/func_math.result
+++ b/mysql-test/main/func_math.result
@@ -3739,3 +3739,246 @@ cast(1 as unsigned) - cast(2 as unsigned)
 -1
 set sql_mode=default;
 # End of 10.5 tests
+#
+# MDEV-38670 Minus string is converted to -0
+#
+#
+# Constant folding
+#
+SELECT -(1e0-1e0);
+-(1e0-1e0)
+0
+SELECT -(0e0-0e0);
+-(0e0-0e0)
+0
+SELECT -(ROUND(0.4-0.4));
+-(ROUND(0.4-0.4))
+0
+SELECT -((1e0*0e0));
+-((1e0*0e0))
+0
+# Testing arithmetic operations with signed zero
+SELECT -0e1 + 0e1;
+-0e1 + 0e1
+0
+SELECT 0e1 + -0e1;
+0e1 + -0e1
+0
+SELECT -0e1 + -0e1;
+-0e1 + -0e1
+0
+SELECT -0e1 - 0e1;
+-0e1 - 0e1
+0
+SELECT  0e1 - '';
+0e1 - ''
+0
+Warnings:
+Warning	1292	Truncated incorrect DOUBLE value: ''
+SELECT -0e1/1e1;
+-0e1/1e1
+0
+SELECT -0e1/1e0;
+-0e1/1e0
+0
+SELECT 1e1 * -0e1;
+1e1 * -0e1
+0
+SELECT 0e0*-1e0;
+0e0*-1e0
+0
+SELECT -'';
+-''
+0
+Warnings:
+Warning	1292	Truncated incorrect DOUBLE value: ''
+SELECT -''/1e1;
+-''/1e1
+0
+Warnings:
+Warning	1292	Truncated incorrect DOUBLE value: ''
+SELECT ABS(-0e1);
+ABS(-0e1)
+0
+SELECT ABS(-'');
+ABS(-'')
+0
+Warnings:
+Warning	1292	Truncated incorrect DOUBLE value: ''
+SELECT -0e1 % 1e1;
+-0e1 % 1e1
+0
+SELECT -'' % 1e1;
+-'' % 1e1
+0
+Warnings:
+Warning	1292	Truncated incorrect DOUBLE value: ''
+#
+# Rounding functions must not produce negative zero
+#
+SELECT ROUND(-0.4);
+ROUND(-0.4)
+0
+SELECT ROUND(-0.1);
+ROUND(-0.1)
+0
+SELECT TRUNCATE(-0.1,0);
+TRUNCATE(-0.1,0)
+0
+SELECT CEILING(-0.1);
+CEILING(-0.1)
+0
+SELECT SIGN(ROUND(-0.4));
+SIGN(ROUND(-0.4))
+0
+SELECT SIGN(ROUND(-0.1));
+SIGN(ROUND(-0.1))
+0
+SELECT SIGN(TRUNCATE(-0.1,0));
+SIGN(TRUNCATE(-0.1,0))
+0
+SELECT SIGN(CEILING(-0.1));
+SIGN(CEILING(-0.1))
+0
+#
+# Passthrough functions must preserve signed zero
+#
+SELECT CONCAT(-'');
+CONCAT(-'')
+0
+Warnings:
+Warning	1292	Truncated incorrect DOUBLE value: ''
+SELECT CONCAT(0e1-0e1);
+CONCAT(0e1-0e1)
+0
+SELECT CONCAT(ROUND(-0.4));
+CONCAT(ROUND(-0.4))
+0
+SELECT CONCAT(TRUNCATE(-0.9,0));
+CONCAT(TRUNCATE(-0.9,0))
+0
+#
+# Aggregate functions
+#
+SELECT SUM(0e1*-1e1);
+SUM(0e1*-1e1)
+0
+SELECT AVG(0e1*-1e1);
+AVG(0e1*-1e1)
+0
+SELECT MIN(0e1*-1e1);
+MIN(0e1*-1e1)
+0
+SELECT MAX(0e1*-1e1);
+MAX(0e1*-1e1)
+0
+SELECT CONCAT(SUM(0e1*-1e1));
+CONCAT(SUM(0e1*-1e1))
+0
+SELECT CONCAT(AVG(0e1*-1e1));
+CONCAT(AVG(0e1*-1e1))
+0
+#
+# Grouping and distinct behavior
+#
+CREATE TABLE t_signed_zero (a DOUBLE);
+INSERT INTO t_signed_zero VALUES (-0e1),(0e1);
+SELECT COUNT(DISTINCT a) FROM t_signed_zero;
+COUNT(DISTINCT a)
+1
+SELECT a,COUNT(*) FROM t_signed_zero GROUP BY a;
+a	COUNT(*)
+0	2
+DROP TABLE t_signed_zero;
+# Testing comparison functions with signed zero
+SELECT CASE WHEN -0e1=0e1 THEN 1.0 ELSE 0.0 END;
+CASE WHEN -0e1=0e1 THEN 1.0 ELSE 0.0 END
+1.0
+SELECT CASE WHEN -''=0e1 THEN 1.0 ELSE 0.0 END;
+CASE WHEN -''=0e1 THEN 1.0 ELSE 0.0 END
+1.0
+Warnings:
+Warning	1292	Truncated incorrect DOUBLE value: ''
+SELECT CASE WHEN -''=-0e1 THEN 1.0 ELSE 0.0 END;
+CASE WHEN -''=-0e1 THEN 1.0 ELSE 0.0 END
+1.0
+Warnings:
+Warning	1292	Truncated incorrect DOUBLE value: ''
+SELECT CASE WHEN 0e0*-1e0=0e1 THEN 1.0 ELSE 0.0 END;
+CASE WHEN 0e0*-1e0=0e1 THEN 1.0 ELSE 0.0 END
+1.0
+CREATE TABLE t_signed_zero (a DOUBLE);
+INSERT INTO t_signed_zero VALUES (0e0*-1e0);
+SELECT CONCAT(a) FROM t_signed_zero;
+CONCAT(a)
+0
+DROP TABLE t_signed_zero;
+#
+# Temporary table materialization
+#
+SELECT CONCAT(a) FROM (SELECT 0e0*-1e0 AS a) t;
+CONCAT(a)
+0
+SELECT CONCAT(a) FROM (SELECT ROUND(-0.4) AS a) t;
+CONCAT(a)
+0
+SELECT CONCAT(a) FROM (SELECT -(1e0-1e0) AS a) t;
+CONCAT(a)
+0
+#
+# Prepared statements
+#
+PREPARE s FROM 'SELECT CONCAT(-(1e0-1e0))';
+EXECUTE s;
+CONCAT(-(1e0-1e0))
+0
+DEALLOCATE PREPARE s;
+PREPARE s FROM 'SELECT CONCAT(ROUND(-0.4))';
+EXECUTE s;
+CONCAT(ROUND(-0.4))
+0
+DEALLOCATE PREPARE s;
+#
+# CASE arithmetic mix
+#
+SELECT CONCAT(CASE WHEN 1 THEN 0e0*-1e0 END);
+CONCAT(CASE WHEN 1 THEN 0e0*-1e0 END)
+0
+SELECT CONCAT(CASE WHEN 0 THEN 1 ELSE 0e0*-1e0 END);
+CONCAT(CASE WHEN 0 THEN 1 ELSE 0e0*-1e0 END)
+0
+SELECT CONCAT(CASE WHEN 1 THEN -(1e0-1e0) END);
+CONCAT(CASE WHEN 1 THEN -(1e0-1e0) END)
+0
+#
+# UNION handling
+#
+SELECT CONCAT(0e0*-1e0)
+UNION ALL
+SELECT CONCAT(-(1e0-1e0));
+CONCAT(0e0*-1e0)
+0
+0
+SELECT CONCAT(ROUND(-0.4))
+UNION
+SELECT CONCAT(TRUNCATE(-0.1,0));
+CONCAT(ROUND(-0.4))
+0
+#
+# String conversion edge cases
+#
+SELECT SIGN(-'0');
+SIGN(-'0')
+0
+SELECT SIGN(-'0.0');
+SIGN(-'0.0')
+0
+SELECT SIGN(-'00');
+SIGN(-'00')
+0
+SELECT SIGN(-' 0 ');
+SIGN(-' 0 ')
+0
+Warnings:
+Note	1292	Truncated incorrect DOUBLE value: ' 0 '
+# End of 13 tests
--- a/mysql-test/main/func_math.test
+++ b/mysql-test/main/func_math.test
@@ -1998,3 +1998,160 @@ select cast(1 as unsigned) - cast(2 as unsigned);
 set sql_mode=default;

 --echo # End of 10.5 tests
+
+--echo #
+--echo # MDEV-38670 Minus string is converted to -0
+--echo #
+
+--source include/have_innodb.inc
+
+--echo #
+--echo # Constant folding
+--echo #
+
+SELECT -(1e0-1e0);
+SELECT -(0e0-0e0);
+SELECT -(ROUND(0.4-0.4));
+SELECT -((1e0*0e0));
+
+
+# Test arithmetic operations
+--echo # Testing arithmetic operations with signed zero
+
+SELECT -0e1 + 0e1;
+SELECT 0e1 + -0e1;
+SELECT -0e1 + -0e1;
+
+SELECT -0e1 - 0e1;
+SELECT  0e1 - '';
+SELECT -0e1/1e1;
+SELECT -0e1/1e0;
+SELECT 1e1 * -0e1;
+SELECT 0e0*-1e0;
+SELECT -'';
+SELECT -''/1e1;
+
+
+
+SELECT ABS(-0e1);
+SELECT ABS(-'');
+
+
+SELECT -0e1 % 1e1;
+SELECT -'' % 1e1;
+
+
+--echo #
+--echo # Rounding functions must not produce negative zero
+--echo #
+
+SELECT ROUND(-0.4);
+SELECT ROUND(-0.1);
+SELECT TRUNCATE(-0.1,0);
+SELECT CEILING(-0.1);
+
+SELECT SIGN(ROUND(-0.4));
+SELECT SIGN(ROUND(-0.1));
+SELECT SIGN(TRUNCATE(-0.1,0));
+SELECT SIGN(CEILING(-0.1));
+
+--echo #
+--echo # Passthrough functions must preserve signed zero
+--echo #
+
+SELECT CONCAT(-'');
+SELECT CONCAT(0e1-0e1);
+SELECT CONCAT(ROUND(-0.4));
+SELECT CONCAT(TRUNCATE(-0.9,0));
+
+--echo #
+--echo # Aggregate functions
+--echo #
+
+SELECT SUM(0e1*-1e1);
+SELECT AVG(0e1*-1e1);
+SELECT MIN(0e1*-1e1);
+SELECT MAX(0e1*-1e1);
+SELECT CONCAT(SUM(0e1*-1e1));
+SELECT CONCAT(AVG(0e1*-1e1));
+
+--echo #
+--echo # Grouping and distinct behavior
+--echo #
+
+CREATE TABLE t_signed_zero (a DOUBLE);
+INSERT INTO t_signed_zero VALUES (-0e1),(0e1);
+
+SELECT COUNT(DISTINCT a) FROM t_signed_zero;
+SELECT a,COUNT(*) FROM t_signed_zero GROUP BY a;
+
+DROP TABLE t_signed_zero;
+
+
+# Test comparison functions
+--echo # Testing comparison functions with signed zero
+
+SELECT CASE WHEN -0e1=0e1 THEN 1.0 ELSE 0.0 END;
+SELECT CASE WHEN -''=0e1 THEN 1.0 ELSE 0.0 END;
+SELECT CASE WHEN -''=-0e1 THEN 1.0 ELSE 0.0 END;
+SELECT CASE WHEN 0e0*-1e0=0e1 THEN 1.0 ELSE 0.0 END;
+
+CREATE TABLE t_signed_zero (a DOUBLE);
+
+INSERT INTO t_signed_zero VALUES (0e0*-1e0);
+SELECT CONCAT(a) FROM t_signed_zero;
+
+DROP TABLE t_signed_zero;
+
+--echo #
+--echo # Temporary table materialization
+--echo #
+
+SELECT CONCAT(a) FROM (SELECT 0e0*-1e0 AS a) t;
+SELECT CONCAT(a) FROM (SELECT ROUND(-0.4) AS a) t;
+SELECT CONCAT(a) FROM (SELECT -(1e0-1e0) AS a) t;
+
+
+--echo #
+--echo # Prepared statements
+--echo #
+
+PREPARE s FROM 'SELECT CONCAT(-(1e0-1e0))';
+EXECUTE s;
+DEALLOCATE PREPARE s;
+
+PREPARE s FROM 'SELECT CONCAT(ROUND(-0.4))';
+EXECUTE s;
+DEALLOCATE PREPARE s;
+
+--echo #
+--echo # CASE arithmetic mix
+--echo #
+
+SELECT CONCAT(CASE WHEN 1 THEN 0e0*-1e0 END);
+SELECT CONCAT(CASE WHEN 0 THEN 1 ELSE 0e0*-1e0 END);
+SELECT CONCAT(CASE WHEN 1 THEN -(1e0-1e0) END);
+
+--echo #
+--echo # UNION handling
+--echo #
+
+SELECT CONCAT(0e0*-1e0)
+UNION ALL
+SELECT CONCAT(-(1e0-1e0));
+
+SELECT CONCAT(ROUND(-0.4))
+UNION
+SELECT CONCAT(TRUNCATE(-0.1,0));
+
+
+--echo #
+--echo # String conversion edge cases
+--echo #
+
+SELECT SIGN(-'0');
+SELECT SIGN(-'0.0');
+SELECT SIGN(-'00');
+SELECT SIGN(-' 0 ');
+
+--echo # End of 13 tests
--- a/mysql-test/main/func_str.result
+++ b/mysql-test/main/func_str.result
@@ -5423,6 +5423,15 @@ x
 NULL
 Warnings:
 Warning	1301	Result of hex() was larger than max_allowed_packet (16777216) - truncated
+#
+# MDEV-32758: TRIM uses memory after freed
+#
+CREATE TABLE t0 (i DOUBLE);
+INSERT INTO t0 VALUES (1);
+SELECT LOCATE(a , 'data1-data2', a) AS c FROM (SELECT TRIM(i) AS a FROM t0 )dt;
+c
+5
+DROP TABLE t0;
 # End of 10.6 tests
 #
 # MDEV-25704 Function random_bytes
@@ -5651,6 +5660,44 @@ select cast(make_set(3, cast(c1 as binary), 0) as char) from t1;
 cast(make_set(3, cast(c1 as binary), 0) as char)
 9067,0
 drop table t1;
+#
+# MDEV-39111 The query returns an incorrect value when using LPAD and REPLACE
+#
+create table t0 (c0 decimal(10,0));
+insert into t0 values (-1453243642), (0);
+select c0 from t0
+where   (lpad('0', c0 + 1, '1') or replace(cast(false as char), false, c0))
+and not (lpad('0', c0 + 1, '1') or replace(cast(false as char), false, c0));
+c0
+drop table t0;
+#
+# MDEV-39112 The query returns incorrect results when using LPAD
+#
+create table t0 (c0 text);
+insert into t0 values ('1'),('foo');
+select c0 from t0 where lpad('123', 2-c0, c0);
+c0
+1
+foo
+Warnings:
+Warning	1292	Truncated incorrect DOUBLE value: 'foo'
+select c0 from t0 where rpad('123', 2-c0, c0);
+c0
+1
+foo
+Warnings:
+Warning	1292	Truncated incorrect DOUBLE value: 'foo'
+drop table t0;
+#
+# MDEV-39235 Incorrect result with LEFT JOIN and QUOTE
+#
+create table t1 (a int, b int);
+insert t1 values (1,1),(2,3);
+select * from t1 left join t1 t2 on (t1.a=t2.b) where quote(t2.b)>'';
+a	b	a	b
+1	1	1	1
+2	3	NULL	NULL
+drop table t1;
 # End of 10.11 tests
 #
 # MDEV-9069 extend AES_ENCRYPT() and AES_DECRYPT() to support IV and the algorithm
--- a/mysql-test/main/func_str.test
+++ b/mysql-test/main/func_str.test
@@ -2456,6 +2456,15 @@ DROP TABLE t1;
 --echo #
 select hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex(hex('\\'))))))))))))))))))))))))))))))))))))))))))))) as x;

+--echo #
+--echo # MDEV-32758: TRIM uses memory after freed
+--echo #
+CREATE TABLE t0 (i DOUBLE);
+INSERT INTO t0 VALUES (1);
+SELECT LOCATE(a , 'data1-data2', a) AS c FROM (SELECT TRIM(i) AS a FROM t0 )dt;
+
+DROP TABLE t0;
+
 --echo # End of 10.6 tests

 --echo #
@@ -2600,6 +2609,34 @@ insert into t1 values (9067);
 select cast(make_set(3, cast(c1 as binary), 0) as char) from t1;
 drop table t1;

+--echo #
+--echo # MDEV-39111 The query returns an incorrect value when using LPAD and REPLACE
+--echo #
+
+create table t0 (c0 decimal(10,0));
+insert into t0 values (-1453243642), (0);
+select c0 from t0
+where   (lpad('0', c0 + 1, '1') or replace(cast(false as char), false, c0))
+and not (lpad('0', c0 + 1, '1') or replace(cast(false as char), false, c0));
+drop table t0;
+
+--echo #
+--echo # MDEV-39112 The query returns incorrect results when using LPAD
+--echo #
+create table t0 (c0 text);
+insert into t0 values ('1'),('foo');
+select c0 from t0 where lpad('123', 2-c0, c0);
+select c0 from t0 where rpad('123', 2-c0, c0);
+drop table t0;
+
+--echo #
+--echo # MDEV-39235 Incorrect result with LEFT JOIN and QUOTE
+--echo #
+create table t1 (a int, b int);
+insert t1 values (1,1),(2,3);
+select * from t1 left join t1 t2 on (t1.a=t2.b) where quote(t2.b)>'';
+drop table t1;
+
 --echo # End of 10.11 tests

 --echo #
--- a/mysql-test/main/gis-json.result
+++ b/mysql-test/main/gis-json.result
@@ -123,3 +123,22 @@ Warning	4048	Incorrect GeoJSON format specified for st_geomfromgeojson function.
 #
 # End of 10.2 tests
 #
+#
+# MDEV-34079: ST_AsGeoJSON returns incorrect value for empty geometry
+#
+SELECT ST_AsGeoJSON(GeomFromText('GeometryCollection EMPTY'));
+ST_AsGeoJSON(GeomFromText('GeometryCollection EMPTY'))
+{"type": "GeometryCollection", "geometries": []}
+SELECT ST_AsGeoJSON(ST_DIFFERENCE(POINT(0,0), POINT(0,0)));
+ST_AsGeoJSON(ST_DIFFERENCE(POINT(0,0), POINT(0,0)))
+{"type": "GeometryCollection", "geometries": []}
+SELECT ST_AsGeoJSON(GeomFromText('MultiPoint EMPTY'));
+ST_AsGeoJSON(GeomFromText('MultiPoint EMPTY'))
+NULL
+SELECT ST_AsGeoJSON(GeomFromText('MultiLineString EMPTY'));
+ST_AsGeoJSON(GeomFromText('MultiLineString EMPTY'))
+NULL
+SELECT ST_AsGeoJSON(GeomFromText('MultiPolygon EMPTY'));
+ST_AsGeoJSON(GeomFromText('MultiPolygon EMPTY'))
+NULL
+# End of 10.11 tests
--- a/mysql-test/main/gis-json.test
+++ b/mysql-test/main/gis-json.test
@@ -58,3 +58,14 @@ SELECT ST_ASTEXT(ST_GEOMFROMGEOJSON('{"type": ["POINT"], "coINates": [0,0] }'))
 --echo #
 --echo # End of 10.2 tests
 --echo #
+--echo #
+--echo # MDEV-34079: ST_AsGeoJSON returns incorrect value for empty geometry
+--echo #
+
+SELECT ST_AsGeoJSON(GeomFromText('GeometryCollection EMPTY'));
+SELECT ST_AsGeoJSON(ST_DIFFERENCE(POINT(0,0), POINT(0,0)));
+SELECT ST_AsGeoJSON(GeomFromText('MultiPoint EMPTY'));
+SELECT ST_AsGeoJSON(GeomFromText('MultiLineString EMPTY'));
+SELECT ST_AsGeoJSON(GeomFromText('MultiPolygon EMPTY'));
+
+--echo # End of 10.11 tests
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`#File is generated by ColumnstoreLibrary.cmake, do not edit`