Plus an identity and an audit trail for every person and agent, guaranteed CPU for critical workloads, and the 2 a.m. question answered in one query. Built for the teams who run CockroachDB under payments and ledgers.
Count the hours your database took from you last year. Not the hours it ran. The hours it asked for.
The change advisory board that signed off on two major upgrades, and the weekend rehearsals before each one. The architecture review on keeping two data centers active-active. The security audit that ended on one uncomfortable question: what happens to traffic we encrypt today, once someone can decrypt it tomorrow? And the page at 2 a.m., when three engineers spent an hour joining internal tables to find the one statement blocking everything else.
None of that work made the database better. It just kept it running.
CockroachDB 26.4 is about giving those hours back. One upgrade a year instead of two. Two data centers that both take writes. Post-quantum TLS, so the audit question has an answer. The 2 a.m. question, who is blocking whom, answered by a single SQL query. And as AI agents start connecting alongside your people, every connection gets an identity and a trail, not a shared password.
It is available today on select CockroachDB Cloud clusters, with self-hosted binaries following in about two weeks. Here is what matters most, and why.
1. Upgrade once a year, not twice
Starting with 26.4, you can upgrade directly from one year’s .4 release to the next: from 26.4 to 27.4, then 27.4 to 28.4, without stopping at the releases in between.
Think about a payments team whose change advisory board approves production changes a few times a year. Every major upgrade means a change request, a rehearsal in staging, a maintenance window and an on-call rotation. Until now, staying current meant doing that for every regular release, twice a year. With skip-level upgrades, it is one planned upgrade a year, on your calendar.
Good to know: skip-level upgrades are GA for self-hosted, Standard and Advanced. To reach 26.4 you still upgrade through 26.2 first. Support windows and LTS eligibility for .2 releases are unchanged.
2. Stay up through a data center loss, and recover faster
Many regulated teams run two data centers, not three. In 26.4, that topology gets the same first-class treatment as a multi-region cluster.
Active-active across two data centers (GA). With logical data replication in transactional mode, both data centers take writes, and multi-statement transactions replicate between them atomically. Failed transactions go to a dead letter queue, so replication keeps moving instead of pausing.
Read while you restore (Preview). Online restore now serves reads while the restore is still running, so applications come back sooner and recovery time drops. Fast online restores also work from encrypted backups taken on 26.4 or later, and a new setting makes direct-download restore the default when the backup supports it.
RPO you can alert on. A new metric reports the time since your latest restorable recovery point for each backup schedule.
Replication that keeps moving. Logical data replication in transactional mode can send failed transactions to a dead letter queue and keep replicating, instead of pausing.
3. Identity for people and agents, and post-quantum encryption
Humans log off. Agents do not. As AI agents start opening their own connections to production databases, trust cannot be a shared password anymore. It has to be an identity, a credential that expires, and a trail of everything done with it. 26.4 builds all three into the cluster, and encrypts every connection for the post-quantum era.
Identity, not passwords
Passwordless sign-in (GA). OIDC now supports PKCE, and the
cockroach sql CLIcan sign in through your identity provider with an OAuth browser login. Credentials come from your provider and expire on its schedule, not in a config file.Workload identity mapped to SQL users (GA). With
security.client_cert.san_required.enabledon, CockroachDB maps the X.509 Subject Alternative Name on a client certificate to a SQL user. Services and agents can authenticate with workload identities, such as SPIFFE IDs issued by SPIRE, instead of shared secrets.Turn off root login (GA). A startup flag disallows root login, so no person or agent signs in with the most powerful account.
A trail for every action (GA). Table-level audit logging records who touched which table and when, whether that was a person, a service or an agent.
Encryption and safer defaults
Post-quantum TLS (GA). CockroachDB supports post-quantum cryptographic algorithms for TLS, on both client-to-node and node-to-node connections. Teams worried about harvest-now, decrypt-later attacks can act today.
Secrets stay out of diagnostics. Sensitive cluster settings, passwords passed as bound parameters, and credentials embedded in backup, restore, import and changefeed URIs are now redacted from debug zips, logs, event logs and statement bundles.
External storage needs explicit permission. Backups, restores, imports, changefeeds and replication that rely on a node’s implicit cloud credentials now require an explicit privilege, so access to your buckets is granted on purpose, not by default.
Current certificates. 26.4 is built with Go 1.26.10, which no longer trusts the eMudhra intermediate certificates that were recently compromised.
Before you upgrade: several of these changes tighten defaults. If you use SAN-based client certificate authentication, external storage with implicit credentials, or LEAKPROOF functions, review the breaking changes in the release notes first.
4. See every workload, and protect the critical ones
When latency spikes at 2 a.m., the first question is always the same: which workload, which statement, and who is blocking whom? In 26.4, more of those answers are durable, complete and queryable with SQL.
Insights that survive a restart. Statement and transaction execution insights are now persisted cluster-wide and exposed through stable information_schema views, so the record outlives a node restart and the in-memory window.
Contention you can attribute. The new information_schema.crdb_contention_activity view shows persisted lock and latch contention, with both the waiting and the blocking statement.
CPU time for every statement. SQL CPU time is now measured for every execution, not just a sample. The “no samples” gaps in SQL Activity are gone.
Richer session history by default. Active Session History samples now carry the application name, user, plan and transaction by default, so a sample points straight at the code that produced it.
Per-region charts. DB Console metrics can now break down by region, or by node, on every dashboard. A regional slowdown shows up as one line diverging from the rest.
And for the questions you used to answer by joining internal tables, there are now single views with stable columns: crdb_tables, crdb_indexes, crdb_ranges, crdb_nodes, crdb_stores and crdb_databases.
FOR ILLUSTRATIONS PURPOSE ONLY
-- Who is waiting on whom, persisted lock and latch contention and recently
SELECT * FROM information_schema.crdb_contention_activity LIMIT 10;
-- Every table, with estimated rows and effective replica settings
SELECT * FROM information_schema.crdb_tables;
Protect the workloads that matter. When a batch job and a payments service share a cluster, the payments service should never starve.
Minimum CPU guarantees. Resource Manager reserves a minimum share of CPU for a workload, so critical traffic keeps its capacity when the cluster is busy.
Resource group observability (Private Preview). See how each resource group uses the cluster, so you size guarantees from data, not guesses.
5. Routine operations that cost less
Some of the most useful changes in 26.4 make everyday jobs cheaper and safer to run.
Less CPU spent between nodes (Preview). A new lightweight RPC framework built by Cockroach Labs, replaces gRPC for node-to-node traffic and reduces cluster CPU usage. It is off by default. Once every node runs 26.4, restart each node with the
--use-new-rpcflag to turn it on.Cheaper data expiry on big tables. Row-level TTL can now find expired rows through an index on the expiration column instead of scanning the whole table. The work per run now tracks how many rows expired, not how big the table is.
Imports that stay in region.
IMPORT INTOcan run only on nodes in a chosen locality, and forREGIONAL BY TABLEtables it now defaults to the table’s home region. Less cross-region traffic, and fewer failures from out-of-region nodes.Changefeeds for governed schema registries. Avro changefeeds can now run read-only against a Confluent-compatible schema registry, for teams that do not let applications write schemas.
6. More of the PostgreSQL your app team already writes
Every release brings more of the PostgreSQL behavior developers expect, so code moves over with fewer rewrites. In 26.4:
Temporary tables and procedures that behave like PostgreSQL (Preview). Temporary tables now support ON COMMIT DELETE ROWS and ON COMMIT DROP. A late-bound PL/pgSQL stored procedure can create a table and use it later in the same IF branch, loop, block or exception handler, so the common create-then-use pattern works without restructuring.
Statement-level triggers with transition tables. Audit a bulk change once per statement, with every affected row in hand, instead of once per row:
CREATE TRIGGER audit_price_changes
AFTER UPDATE ON products
REFERENCING OLD TABLE AS old_rows NEW TABLE AS new_rows
FOR EACH STATEMENT EXECUTE FUNCTION log_price_changes();
Before and after values in one statement. RETURNING now supports OLD and NEW:
UPDATE products SET price = price * 1.1
RETURNING old.price, new.price;
And more: SQL/JSON json_object() and json_array(), the any_value() aggregate, EXPLAIN EXECUTE for prepared statements, query plans inside functions and stored procedures in EXPLAIN ANALYZE, DROP TYPE ... CASCADE, and changing a column’s type when it is part of a secondary index.
Upgrading to 26.4
Check your path. Upgrade from 26.2 to reach 26.4.
Review the breaking changes, especially the security defaults above.
Plan for statistics. The upgrade clears persisted statement and transaction statistics; collection resumes automatically.
Finalize the upgrade to turn on statement-level triggers, transition tables and the new observability views.
On CockroachDB Cloud, 26.4 is rolling out to select clusters now. Self-hosted binaries arrive in about two weeks.
Read the full release notes: What’s New in v26.4 · Upgrade guide · Release support policy
