Heimdall Database Proxy Versions

• Avoid calling getAutoCommit on each connection once per minute for logging to avoid a deadlock situation with long transactions or queries for the heartbeats.
• Exit if not possible to bind to the health check port, to allow a clean restart.

• Updated Tomcat dependency to resolve CVE-2025-31651.
• Updated the health check binding code to exit if it can’t successfully bind the port, to avoid a race condition where the proxy would come online, but not respond to health checks.
• Related to the health check binding code, the CF template has been updated to better detect failed nodes and actually restart them vs just remove them from being used.

• Resolved issue ZDI-CAN-24755, reported by Trend Micro on a possible XSS attack involving unsanitized usernames in UI elements.
• Optimized TLS handling to avoid copying data more than needed while encrypting.
• Updated tomcat version to avoid a new CVE.

• Now detects if an RDS cluster is in the “failing-over” state, and delays updating the config until it transitions to another state, to avoid multiple re-configurations in a short time.
• Improved logging further to help with debugging failover events.

• Resolved issue with configuration fingerprint incrementing before the config was updated during failover events.
• Removed unnecessary logging of rate limiter events.

• Adjusted an internal lock in the manager to avoid a deadlock situation if the manager runs out of heap space.
• Adjusted logging during RDS failover events.

No proxy level behaviors are adjusted in this patch build.

• Included a new api endpoint /api/endpoints to provide a list of api endpoints, and the permission levels needed to access each one, for the purpose of auditing any changes that may impact security.
• Added a VDB option for “disableSetReadOnly”, which if set to true, will bypass attempts to set connections to read-only, to avoid overhead and issues when application frameworks set this option when it really isn’t needed.

• Added portal wizard to simplify configuring all the portal related configuration items.
• Removed privateKeyPassword field when exporting configuration files for log purposes.
• Added documentation for using HA Proxy for load balancing.
• Improved Postgres protocol compatibility for Node.js for types that are transmitted as text, but flagged as a binary value (such as integer types, date and timestamps).
• Improved connection logging to help track state of a front-side connection in relation to transactions.
• Removed checks for the AWS cloud if an ARN is configured for load balancing, to resolve failover issues if the account can't be detected.
• Added a workaround flag for parsing sp_executeSQL calls on SQL Server, to avoid parameter issues (rare).
• Allowed configuring JMX authentication using a secrets manager.
• Improved Mysql read/write vs. read/only transaction flag state management.

• Resolved issue where the account ID/Instance ID didn't show on the admin page.
• Resolved issue with autoscaling mode where the active node was not displaying properly when redirecting based on public (vs. private) IP in AWS.
• Resolved issue with modules being left from older builds on upgrade when no VDB was defined yet.