Release 3.24.0

Request and approve access through MCP

In Read-write mode, an agent connected through MCP can now take an access request from start to finish. The mode does not grant permissions: an agent can do only what the signed-in user can do in Bytebase, and the project's approval rules still apply.

• Request just-in-time access for a statement, and see which result columns are masked and why.
• Approve or reject issues and access requests, toggle a project's just-in-time access, and grant or revoke masking exemptions, each only after the user confirms it in their MCP client.
• To stop agents from approving, switch the policy to Read-only.

Notable changes

• SQL Server and Oracle TLS — The TLS section now takes effect for these engines. To keep existing connections working, the upgrade turns Verify server certificate off on SQL Server and TLS mode off on Oracle; add the server's CA certificate to turn them back on.
• Oracle — Connection attempts time out after 10 seconds instead of about two minutes. Set CONNECTION TIMEOUT under Extra Parameters if an instance needs longer.

Features

• Setup wizard for new workspaces — Name the workspace, choose what to do first, create a project with the sample instance or your own database, and set up your team, in four screens.
• Admin recovery without downtime — Re-enable password sign-in or reset a user's password while self-hosted Bytebase keeps running, from a script or job.
• BigQuery SQL review — SQL review now supports BigQuery, starting with the rules Enforce the presence of "WHERE" condition in UPDATE/DELETE statements and Restrict the SQL file size.

Enhancements

• AI assistant — Chats are grouped by workspace and project, and the window tells you right away if AI is not configured yet.
• Access grants — Long statements fold to two lines with Show more, and a disabled Export button explains why.
• Self-hosted — Container images ship updated CA bundles that reject certificates issued through the compromised eMudhra intermediates.

Upgrade notes

• HA mode — Stop every replica before starting 3.24.0; rolling upgrades are not supported for this version.
• Terraform — A configuration with verify_tls_certificate = true on a SQL Server data source, or use_ssl = true on an Oracle data source, turns the setting back on at the next terraform apply. Make sure the certificate verifies first, or set the field to false.