diff --git a/mysql-test/main/subselect4.result b/mysql-test/main/subselect4.result
index df21b90b18b..4452c456022 100644
--- a/mysql-test/main/subselect4.result
+++ b/mysql-test/main/subselect4.result
@@ -2786,6 +2786,67 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 set names default;
 set @@in_predicate_conversion_threshold= @save_in_predicate_conversion_threshold;
 DROP TABLE t1,t2;
+#
+# MDEV-24925: Server crashes in Item_subselect::init_expr_cache_tracker
+#
+CREATE TABLE t1 (id INT PRIMARY KEY);
+INSERT INTO t1 VALUES (1),(2);
+SELECT
+1 IN (
+SELECT
+(SELECT COUNT(id)
+FROM t1
+WHERE t1_outer.id <> id
+) AS f
+FROM
+t1 AS t1_outer
+GROUP BY f
+);
+1 IN (
+SELECT
+(SELECT COUNT(id)
+FROM t1
+WHERE t1_outer.id <> id
+) AS f
+FROM
+t1 AS t1_outer
+GROUP BY f
+)
+1
+SELECT
+1 IN (
+SELECT
+(SELECT COUNT(id)
+FROM t1
+WHERE t1_outer.id <> id
+) AS f
+FROM
+t1 AS t1_outer
+GROUP BY 1
+);
+1 IN (
+SELECT
+(SELECT COUNT(id)
+FROM t1
+WHERE t1_outer.id <> id
+) AS f
+FROM
+t1 AS t1_outer
+GROUP BY 1
+)
+1
+DROP TABLE t1;
+#
+#  MDEV-24898: Server crashes in st_select_lex::next_select / Item_subselect::is_expensive
+#  (Testcase)
+#
+CREATE TABLE t1 (a INT);
+INSERT INTO t1 VALUES (1),(2);
+CREATE TABLE t2 (b INT);
+INSERT INTO t2 VALUES (3),(4);
+SELECT 1 IN (SELECT (SELECT a FROM t1) AS x FROM t2 GROUP BY x);
+ERROR 21000: Subquery returns more than 1 row
+drop table t1,t2;
 # End of 10.3 tests
 #
 # MDEV-19134: EXISTS() slower if ORDER BY is defined
diff --git a/mysql-test/main/subselect4.test b/mysql-test/main/subselect4.test
index c173289eb19..a2dfc48ffe2 100644
--- a/mysql-test/main/subselect4.test
+++ b/mysql-test/main/subselect4.test
@@ -2308,6 +2308,51 @@ set names default;
 set @@in_predicate_conversion_threshold= @save_in_predicate_conversion_threshold;
 DROP TABLE t1,t2;
 
+--echo #
+--echo # MDEV-24925: Server crashes in Item_subselect::init_expr_cache_tracker
+--echo #
+CREATE TABLE t1 (id INT PRIMARY KEY);
+INSERT INTO t1 VALUES (1),(2);
+
+SELECT
+  1 IN (
+    SELECT
+      (SELECT COUNT(id)
+       FROM t1
+       WHERE t1_outer.id <> id
+       ) AS f
+    FROM
+      t1 AS t1_outer
+    GROUP BY f
+  );
+
+SELECT
+  1 IN (
+    SELECT
+      (SELECT COUNT(id)
+       FROM t1
+       WHERE t1_outer.id <> id
+       ) AS f
+    FROM
+      t1 AS t1_outer
+    GROUP BY 1
+  );
+
+DROP TABLE t1;
+
+--echo #
+--echo #  MDEV-24898: Server crashes in st_select_lex::next_select / Item_subselect::is_expensive
+--echo #  (Testcase)
+--echo #
+CREATE TABLE t1 (a INT);
+INSERT INTO t1 VALUES (1),(2); # Optional, fails either way
+CREATE TABLE t2 (b INT);
+INSERT INTO t2 VALUES (3),(4); # Optional, fails either way
+
+--error ER_SUBQUERY_NO_1_ROW
+SELECT 1 IN (SELECT (SELECT a FROM t1) AS x FROM t2 GROUP BY x);
+drop table t1,t2;
+
 --echo # End of 10.3 tests
 
 --echo #
diff --git a/mysql-test/suite/innodb/r/default_row_format_alter.result b/mysql-test/suite/innodb/r/default_row_format_alter.result
index 363954c1a6c..fa5adb32fb0 100644
--- a/mysql-test/suite/innodb/r/default_row_format_alter.result
+++ b/mysql-test/suite/innodb/r/default_row_format_alter.result
@@ -83,6 +83,16 @@ Name	Engine	Version	Row_format	Rows	Avg_row_length	Data_length	Max_data_length	I
 t1	InnoDB	#	Compact	#	#	#	#	#	#	NULL	#	#	NULL	latin1_swedish_ci	NULL			0	N
 DROP TABLE t1;
 #
+# MDEV-24758 heap-use-after-poison in innobase_add_instant_try/rec_copy
+#
+CREATE TABLE t1 (pk INT PRIMARY KEY) CHARACTER SET utf8 ENGINE=InnoDB;
+INSERT INTO t1 VALUES (1);
+SET GLOBAL innodb_default_row_format = REDUNDANT;
+ALTER TABLE t1 ADD a CHAR(8) DEFAULT '';
+DROP TABLE t1;
+SET GLOBAL innodb_default_row_format = @row_format;
+# End of 10.3 tests
+#
 # MDEV-23295 Assertion fields[i].same(instant.fields[i]) failed
 #
 SET GLOBAL innodb_default_row_format = @row_format;
@@ -104,4 +114,5 @@ SELECT ROW_FORMAT FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME='t1';
 ROW_FORMAT
 Dynamic
 DROP TABLE t1;
+# End of 10.4 tests
 SET GLOBAL innodb_default_row_format = @row_format;
diff --git a/mysql-test/suite/innodb/t/default_row_format_alter.test b/mysql-test/suite/innodb/t/default_row_format_alter.test
index 1f0b0d56bc4..7cd4d672858 100644
--- a/mysql-test/suite/innodb/t/default_row_format_alter.test
+++ b/mysql-test/suite/innodb/t/default_row_format_alter.test
@@ -96,6 +96,19 @@ ALTER TABLE t1 DROP INDEX k1;
 SHOW TABLE STATUS LIKE 't1';
 DROP TABLE t1;
 
+--echo #
+--echo # MDEV-24758 heap-use-after-poison in innobase_add_instant_try/rec_copy
+--echo #
+
+CREATE TABLE t1 (pk INT PRIMARY KEY) CHARACTER SET utf8 ENGINE=InnoDB;
+INSERT INTO t1 VALUES (1);
+SET GLOBAL innodb_default_row_format = REDUNDANT;
+ALTER TABLE t1 ADD a CHAR(8) DEFAULT '';
+DROP TABLE t1;
+SET GLOBAL innodb_default_row_format = @row_format;
+
+--echo # End of 10.3 tests
+
 --echo #
 --echo # MDEV-23295 Assertion fields[i].same(instant.fields[i]) failed
 --echo #
@@ -116,4 +129,6 @@ ALTER TABLE t1 DROP b;
 SELECT ROW_FORMAT FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME='t1';
 DROP TABLE t1;
 
+--echo # End of 10.4 tests
+
 SET GLOBAL innodb_default_row_format = @row_format;
diff --git a/mysql-test/suite/rpl/r/rpl_semi_sync_slave_compressed_protocol.result b/mysql-test/suite/rpl/r/rpl_semi_sync_slave_compressed_protocol.result
new file mode 100644
index 00000000000..b0fe083f928
--- /dev/null
+++ b/mysql-test/suite/rpl/r/rpl_semi_sync_slave_compressed_protocol.result
@@ -0,0 +1,19 @@
+include/master-slave.inc
+[connection master]
+SET @@GLOBAL.rpl_semi_sync_master_enabled = 1;
+connection slave;
+include/stop_slave.inc
+SET @@GLOBAL.rpl_semi_sync_slave_enabled = 1;
+include/start_slave.inc
+connection master;
+CREATE TABLE t1 (i INT);
+DROP TABLE t1;
+include/rpl_sync.inc
+include/assert_grep.inc [Check that there is no 'Read semi-sync reply magic number error' in error log.]
+connection master;
+SET @@GLOBAL. rpl_semi_sync_master_enabled = $sav_enabled_master;
+connection slave;
+include/stop_slave.inc
+SET @@GLOBAL. rpl_semi_sync_slave_enabled = $sav_enabled_slave;
+include/start_slave.inc
+include/rpl_end.inc
diff --git a/mysql-test/suite/rpl/t/rpl_semi_sync_slave_compressed_protocol-slave.opt b/mysql-test/suite/rpl/t/rpl_semi_sync_slave_compressed_protocol-slave.opt
new file mode 100644
index 00000000000..a1b687d691e
--- /dev/null
+++ b/mysql-test/suite/rpl/t/rpl_semi_sync_slave_compressed_protocol-slave.opt
@@ -0,0 +1 @@
+--slave_compressed_protocol
diff --git a/mysql-test/suite/rpl/t/rpl_semi_sync_slave_compressed_protocol.test b/mysql-test/suite/rpl/t/rpl_semi_sync_slave_compressed_protocol.test
new file mode 100644
index 00000000000..bc05bec2a96
--- /dev/null
+++ b/mysql-test/suite/rpl/t/rpl_semi_sync_slave_compressed_protocol.test
@@ -0,0 +1,55 @@
+################################################################################
+# Bug#26027024 SLAVE_COMPRESSED_PROTOCOL DOESN'T WORK WITH SEMI-SYNC
+# REPLICATION IN MYSQL-5.7
+#
+# Steps to reproduce:
+#  1) Set slave_compressed_protocol ON on Slave.
+#  2) Do some sample work on Master
+#  3) After the work is synced on Slave, check that there is no error
+#     (Read semi-sync reply magic number error) on Slave.
+#  4) Cleanup
+################################################################################
+# Test is independent of Binlog format. One of the three formats is enough
+# for testing. Choosing 'Row' format.
+--source include/have_binlog_format_row.inc
+--source include/master-slave.inc
+
+--let $sav_enabled_master=`SELECT @@GLOBAL.rpl_semi_sync_master_enabled `
+SET @@GLOBAL.rpl_semi_sync_master_enabled = 1;
+
+--connection slave
+source include/stop_slave.inc;
+--let $sav_enabled_slave=`SELECT @@GLOBAL.rpl_semi_sync_slave_enabled `
+SET @@GLOBAL.rpl_semi_sync_slave_enabled = 1;
+source include/start_slave.inc;
+
+--connection master
+# Do some sample work on Master with slave_compressed_protocol ON.
+# (slave_compressed_protocol is set to ON in -slave.opt file of this test.)
+CREATE TABLE t1 (i INT);
+DROP TABLE t1;
+
+# Make sure sync is done, so that next 'assert' step can be executed without
+# any issues.
+--source include/rpl_sync.inc
+
+# Without the fix, the test would have generated few
+# errors in the error log. With the fix, test will
+# pass without any errors in the error log.
+--let $assert_text= Check that there is no 'Read semi-sync reply magic number error' in error log.
+--let $assert_select=Read semi-sync reply magic number error
+--let $assert_file= $MYSQLTEST_VARDIR/log/mysqld.1.err
+--let $assert_count= 0
+--let $assert_only_after = CURRENT_TEST:rpl.rpl_semi_sync_slave_compressed_protocol.test
+--source include/assert_grep.inc
+
+--connection master
+--evalp SET @@GLOBAL. rpl_semi_sync_master_enabled = $sav_enabled_master
+
+--connection slave
+source include/stop_slave.inc;
+--evalp SET @@GLOBAL. rpl_semi_sync_slave_enabled = $sav_enabled_slave
+source include/start_slave.inc;
+
+# Cleanup
+--source include/rpl_end.inc
diff --git a/mysql-test/suite/sql_sequence/concurrent_create.result b/mysql-test/suite/sql_sequence/concurrent_create.result
index 7e68195f7e0..2473abef37d 100644
--- a/mysql-test/suite/sql_sequence/concurrent_create.result
+++ b/mysql-test/suite/sql_sequence/concurrent_create.result
@@ -31,3 +31,16 @@ connection con1;
 disconnect con1;
 connection default;
 DROP TABLE s1,s2;
+CREATE TABLE t1 (a INT) ENGINE=InnoDB;
+START TRANSACTION WITH CONSISTENT SNAPSHOT;
+connect  con1,localhost,root,,test;
+CREATE SEQUENCE s1 ENGINE=InnoDB;
+FLUSH TABLES;
+disconnect con1;
+connection default;
+SELECT NEXTVAL(s1);
+NEXTVAL(s1)
+1
+COMMIT;
+DROP TABLE t1;
+DROP SEQUENCE s1;
diff --git a/mysql-test/suite/sql_sequence/concurrent_create.test b/mysql-test/suite/sql_sequence/concurrent_create.test
index d6a57ff7d50..b27a6d3bdb9 100644
--- a/mysql-test/suite/sql_sequence/concurrent_create.test
+++ b/mysql-test/suite/sql_sequence/concurrent_create.test
@@ -56,3 +56,22 @@ FLUSH TABLES;
 --connection default
 
 DROP TABLE s1,s2;
+
+#
+# MDEV-24545 Sequence created by one connection remains invisible to another
+#
+CREATE TABLE t1 (a INT) ENGINE=InnoDB;
+START TRANSACTION WITH CONSISTENT SNAPSHOT;
+
+--connect (con1,localhost,root,,test)
+CREATE SEQUENCE s1 ENGINE=InnoDB;
+FLUSH TABLES;
+--disconnect con1
+
+--connection default
+SELECT NEXTVAL(s1);
+COMMIT;
+
+# Cleanup
+DROP TABLE t1;
+DROP SEQUENCE s1;
diff --git a/sql/semisync_master_ack_receiver.cc b/sql/semisync_master_ack_receiver.cc
index e189fc5f631..b24d6452480 100644
--- a/sql/semisync_master_ack_receiver.cc
+++ b/sql/semisync_master_ack_receiver.cc
@@ -267,6 +267,11 @@ void Ack_receiver::run()
 
         net_clear(&net, 0);
         net.vio= &slave->vio;
+        /*
+          Set compress flag. This is needed to support
+          Slave_compress_protocol flag enabled Slaves
+        */
+        net.compress= slave->thd->net.compress;
 
         len= my_net_read(&net);
         if (likely(len != packet_error))
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index 44d15327ec1..52abaf29d05 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -660,7 +660,16 @@ void remove_redundant_subquery_clauses(st_select_lex *subq_select_lex)
   {
     for (ORDER *ord= subq_select_lex->group_list.first; ord; ord= ord->next)
     {
-      (*ord->item)->walk(&Item::eliminate_subselect_processor, FALSE, NULL);
+      /*
+        Do not remove the item if it is used in select list and then referred
+        from GROUP BY clause by its name or number. Example:
+
+          select (select ... ) as SUBQ ...  group by SUBQ
+
+        Here SUBQ cannot be removed.
+      */
+      if (!ord->in_field_list)
+        (*ord->item)->walk(&Item::eliminate_subselect_processor, FALSE, NULL);
     }
     subq_select_lex->join->group_list= NULL;
     subq_select_lex->group_list.empty();
diff --git a/storage/innobase/row/row0merge.cc b/storage/innobase/row/row0merge.cc
index a798cfcc7a9..475424b2155 100644
--- a/storage/innobase/row/row0merge.cc
+++ b/storage/innobase/row/row0merge.cc
@@ -4473,7 +4473,7 @@ row_merge_is_index_usable(
 	}
 
 	return(!index->is_corrupted()
-	       && (index->table->is_temporary()
+	       && (index->table->is_temporary() || index->table->no_rollback()
 		   || index->trx_id == 0
 		   || !trx->read_view.is_open()
 		   || trx->read_view.changes_visible(
diff --git a/support-files/mariadb.service.in b/support-files/mariadb.service.in
index 3dc6f0fbc71..ca9262dd211 100644
--- a/support-files/mariadb.service.in
+++ b/support-files/mariadb.service.in
@@ -145,7 +145,7 @@ TimeoutStopSec=900
 ##
 
 # Number of files limit. previously [mysqld_safe] open-files-limit
-LimitNOFILE=16384
+LimitNOFILE=32768
 
 # Maximium core size. previously [mysqld_safe] core-file-size
 # LimitCore=
diff --git a/support-files/mariadb@.service.in b/support-files/mariadb@.service.in
index f4f0cd8c7f2..af99f0f3c5a 100644
--- a/support-files/mariadb@.service.in
+++ b/support-files/mariadb@.service.in
@@ -268,7 +268,7 @@ Group=mysql
 ##
 
 # Number of files limit. previously [mysqld_safe] open-files-limit
-LimitNOFILE=16384
+LimitNOFILE=32768
 
 # Maximium core size. previously [mysqld_safe] core-file-size
 # LimitCore=