# 1.4. 3.2.x Branch

## 1.4.1. Version 3.2.3

### 1.4.1.1. Features and Enhancements

- #4529: In Javascript process manager, use a database tag in addition to a ddoc ID to quickly find processes. This should improve performance.

- #4509, #4405: Make remsh work with quoted cookie values.

- Fix for CVE-2023-26268.

## 1.4.2. Version 3.2.2

### 1.4.2.1. Bugfixes

- Fix for CVE-2022-24706. This is a security release for a critical vulnerability.

- #3963: Optimize compaction and doc updates for conflicted documents on Erlang versions higher than 21.

- #3852: Add support for SpiderMonkey 91esr.

## 1.4.3. Version 3.2.1

### 1.4.3.1. Features and Enhancements

- #3746: `couch_icu_driver` collation driver has been removed. ICU collation functionality is consolidated in the single `couch_ejson_compare` module. View performance might slightly increase as there are less corner cases when the C collation driver fails and falls back to Erlang.

- #3787: Update sequences generated from DB info and `_changes?since=now&limit=0` now contain shard uuids as part of their internal, opaque, representation. As a result, there should be less chance of experiencing changes feed rewinds with these sequences.

- #3798: ICU driver and collator algorithm versions are returned in the `_node/{node-name}/_versions` result.

- #3801: Users with the `_metrics` role can now read `_prometheus` metrics.

### 1.4.3.2. Bugfixes

- #3780: Avoid changes feed rewinds after shard moves.

- #3779, #3785: Prevent deleted view file cleanup from crashing when database is deleted while the cleanup process is running.

- #3789: Fix `badarith` 500 errors when `[fabric] request_timeout` is set to `infinity`.

- #3786: Fix off-by-one `limit` error for `_all_dbs`. Also, the auto-injected shard `_dbs` design doc is removed and replaced with an Erlang module.

- #3788: Minimize changes feeds rewinds when a node is down.

- #3807: Enable `custodian` application reporting. Previously, `custodian` was accidentally left disabled as it used a hard-coded shards db name different than `_dbs`.

- #3805: Cluster setup correctly syncs admin passwords and uses the new (since 3.2.0) `[chttpd_auth]` config section instead of the previous `[couch_httpd_auth]` section.

- #3810: Local development `dev/run` script now uses the `[chttpd_auth]` section in `local.ini` instead of `[couch_httpd_auth]`.

- #3773: Fix reduce view collation results for unicode equivalent keys.

## 1.4.4. Version 3.2.0

### 1.4.4.1. Features and Enhancements

- #3364: CouchDB’s replicator now implements a Fair Share replication scheduler. Rather than using a round-robin scheduling mechanism, this update allows specifying the relative priority of jobs via different `_replicator` databases. More information is available in the _replicator DB docs.

- #3166: Allow custom JWT claims for roles, via the `[jwt_auth] roles_claim_name` config setting.

- #3296, #3312: CouchDB now includes `weatherreport` and its dependency `custodian`, a diagnostic app forked from Basho’s `riaknostic` tool. More documentation is available in the Cluster Troubleshooting section.

- #2911, #3298, #3425: CouchDB now returns the version of SpiderMonkey to administrators in the `GET /_node/{node-name}/_versions` response.

- #3303: CouchDB now treats a `408` response received by the replicator similar to any `5xx` error (by retrying, as opposed to a permanent error). CouchDB will never return a `408`, but some reverse proxies in front of CouchDB may return this code.

- #3322: `_session` now accepts gzip encoding.

- #3254: The new `$keyMapMatch` operator allows Mango to query on the keys of a map. It is similar to the `$elemMatch` operator, but instead of operating on the elements of array, it operates on the keys of a map.

- #3336: Developers now have access to a `.devcontainer` configuration for the 3.x version of CouchDB, right in the source code repository.

- #3347: The default maximum attachment size has been reduced from `infinity` to 1 GiB.

- #3361: Compaction process suspension now appears in the `active_tasks` output, allowing administrators to verify that the `strict_window` value is being respected.

- #3378: The `[admins]` section and the `[replicator] password` are now redacted from all logs. In addition, #3380 removes user credentials, user documents and design documents from logfiles as much as possible. Further, #3489 no longer logs all of the messages received by a terminated internal Erlang process.

- #3421, #3500: CouchDB now supports SpiderMonkey 78 and 86.

- #3422: CouchDB now supports Erlang/OTP 23 and `error_logger` reports for Erlang/OTP >= 21.

- #3566: CouchDB now also supports Erlang/OTP 24.

- #3571: CouchDB no longer supports Erlang/OTP 19.

- #3643: Contribute a custom Erlang network protocol to CouchDB, users can specify nodes to use TCP or TLS.

- #3472, #3473, #3609: Migrate some config options from `[httpd]` to `[chttpd]`, migrate some from `[couch_httpd_auth]` to `[chttpd_auth]`, and comment all out in the `default.ini`.

  - Config options moved from `[httpd]` to `[chttpd]`: `allow_jsonp`, `changes_timeout`, `config_whitelist`, `enable_cors`, `secure_rewrites`, `x_forwarded_host`, `x_forwarded_proto`, `x_forwarded_ssl`, `enable_xframe_options`, `max_http_request_size`.

  - Config options moved from `[couch_httpd_auth]` to `[chttpd_auth]`: `authentication_redirect`, `timeout`, `auth_cache_size`, `allow_persistent_cookies`, `iterations`, `min_iterations`, `max_iterations`, `password_scheme`, `proxy_use_secret`, `public_fields`, `secret`, `users_db_public`, `x_auth_roles`, `x_auth_token`, `x_auth_username`, `cookie_domain`, `same_site`

- #3586: We added a new way of specifying basic auth credentials which can include various characters previously not allowed to be included in the url info part of endpoint urls.

- #3483: We added a way of specifying requirements for new user passwords using a list of regular expressions.

- #3506, #3416, #3377: CouchDB now provides a Prometheus compatible endpoint at `GET /_node/{node-name}/_prometheus`. A configuration option allows for scraping via a different port (17986) that does not require authentication, if desired. More information is available at the Prometheus API endpoint summary.

- #3697, COUCHDB-883 (JIRA): As an opt-in policy, CouchDB can now stop encoding the plus sign `+` in non-query parts of URLs, in compliance with the original CouchDB standards. The opt-in is via the `[chttpd] decode_plus_to_space = true` setting. In CouchDB 4.x, this is going to be an opt-out policy.

- #3724: CouchDB now has new CSP settings for attachments and show/list functions. This deprecates the old `[csp] enable` and `[csp] header_value` settings, replacing them with the new `[csp] utils_enable` and `[csp] utils_header_value` settings respectively. In addition, new settings for `attachments_enable`, `attachments_header_value`, `showlist_enable` and `showlist_header_value` now are available. Documentation is in the `default.ini` file.

- #3734, #3733: Users with databases that have low `q` and `n` values would often receive the `No DB shards could be opened` error when the cluster is overloaded, due to a hard-coded 100ms timeout. CouchDB now calculates a more reasonable timeout, based on the number of shards and the overall maximum fabric request timeout limit, using a geometric series.

### 1.4.4.2. Performance

- #3337: Developer nodes now start faster when using the `dev/run` script.

- #3366: The monolithic `couch_server` process has been sharded for performance. Previously, as a single `gen_server`, the process would have a finite throughput that, in busy clusters, is easily breached – causing a sizeable backlog in the message queue, ultimately leading to failure and errors. No more! The aggregate message queue info is still available in the `_system` output. ( #3370 )

- #3208: CouchDB now uses the latest ibrowse 4.4.2 client for the replicator.

- #3600, #3047, #3019: The default `slack` channel for smoosh auto-compaction has been increased to a more reasonable value, reducing load on systems that would have normally been idle in CouchDB 2.x (where no auto-compaction daemon exists).

- #3711: Changes feeds may no longer rewind after shard moves, assuming the node and range specified by the changes feed nonce can still match an existing node’s shard.

### 1.4.4.3. Bugfixes

- Complete retirement of the JavaScript test suite - replaced by Elixir. Hooray!

- #3165: Allow configurability of JWT claims that require a value. Also fixes #3232. Further, #3392 no longer validates claims provided that CouchDB does not require.

- #3160, #3161: The `run_queue` statistic now returns valid information even when using Erlang BEAM dirty CPU and IO queues.

- #3162: Makefiles updated to include local configs & clean configs when running `make devclean`.

- #3195: The `max_document_size` parameter now has a clearer explanation in `default.ini`.

- #3207, #2536: Improve the `INSTALL.Unix.md` file.

- #3212: Base and extra headers are properly combined when making replicator requests that contain duplicate headers.

- #3201: When using a POST with request body to pass parameters to a view-like request, the boolean parameters are accepting only JSON strings, but not booleans. Now, CouchDB accepts `true` and `false` for the `stable` parameter, in addition to `"true"` and `"false"`. comment in

- #1988: Attachment operations `PUT /db/doc` and `POST /db` now perform consistent attachment name validation.

- #3249: Documents with lots of conflicts no longer blow up couchjs if the user calls `_changes` with a JS filter and with `style=all_docs`.

- #3144: Respawning compaction jobs to catch up with intervening changes are now handled correctly by the smoosh monitor.

- #3252: CouchDB now exports the `couch_util:json_decode/2` function to support maps instead of the default data structure.

- #3255, #2558: View files that have incorrect `db_headers` now reset the index forcing a rebuild.

- #3271: Attachments that are stored uncompressed but later replicated to nodes that compress the attachment no longer fail an internal md5 check that would break eventual consistency between nodes.

- #3277: `req_body` requests that have `req_body` set already now properly return the field without parsing.

- #3279: Some default headers were missing from some responses in replication, including `X-CouchDB-Body-Time` and `X-Couch-Request-ID`.

- #3329, #2962: CouchDB no longer returns broken couchjs processes to the internal viewserver process pool.

- #3340, #1943: `PUTs` of `multipart/related` attachments now support a `Transfer-Encoding` value of `chunked`. Hooray!

- #2858, #3359: The cluster setup wizard no longer fails when a request to `/` is not made before a request to `finish_cluster`.

- #3368: Changing the `max_dbs_open` configuration setting correctly ensures that each new `couch_server_X` property receives `1/num_servers()` of it.

- #3373: Requests to `{db}/_changes` with a custom filter no longer result in a fabric request timeout if the request body is not available to additional cluster nodes, resulting in a more descriptive exit message and proper JSON object validation in the payload.

- #3409: The internal `chttpd_external:json_req_obj/2` function now reads the cached `peer` before falling back to a socket read operation.

- #3335, #3617, #3708: The `COUCHDB_FAUXTON_DOCROOT` environment variable is now introduced to allow its explicit overriding at startup.

- #3471: http clients should no longer receive stacktraces unexpectedly.

- #3491: libicu tests no longer fail on older OS releases such as CentOS 6 and 7.

- #3541: Usernames and passwords can now contain @ and not break the CouchDB replicator.

- #3545: The `dreyfus_index_manager` process now supports offheap message queues.

- #3551: The replication worker pool now properly cleans up worker processes as they are done via the `worker_trap_exits = false` setting.

- #3633, #3631: All code paths for creating databases now fully respect db creation options, including partitioning options.

- #3424, #3362: When using `latest=true` and an old revision with conflicting children as rev is specified, CouchDB no longer returns an `"error": "case_clause"` response.

- #3673: Non-existent attachments now return a `404` when the attachment is missing.

- #3698: The `dev/run` development script now allows clusters where `n > 5`.

- #3700: The `maybe_close` message is now sent to the correct internal process.

- #3183: The smoosh operator guide now recommends to use the `rpc:multicall` function.

- #3712: Including a payload within a `DELETE` operation no longer hangs the next request made to the same mochiweb acceptor.

- #3715: For clusters with databases where `n > [cluster] n`, attachments chunks are longer dropped on quorum writes.

- #3507: If a file is truncated underneath CouchDB, CouchDB will now log the filename if it finds this situation with a `file_truncate_error`.

- #3739: Shards with large purge sequences no longer fail to split in a shard splitting job.

- #3754: Always return views meta info when `limit=0` and `sorted=true`.

- #3757: Properly sort `descending=true` view results with a `keys` list.

- #3763: Stabilize view row sorting order when they are merged by the coordinator.

### 1.4.4.4. Other

- Donuts for everyone! Er, not really - thank you for reading the 3.2 release notes.