CockroachDB 20.2.7 checks changefeed access on the target tables
Changefeed privilege checks stop extending to unrelated descriptors. The same update removes custom type names from diagnostics and corrects several schema-aware inspection paths.
A table can refer to a custom type without making that type another table to read. CockroachDB 20.2.7 corrects a changefeed permission check that crossed that distinction. The check previously required SELECT on every descriptor associated with a target table, including its database and custom types. It now checks SELECT on the target tables themselves.
The release index dates 20.2.7 to March 29. Its release notes available that day explain the permission correction under issue 61661. The change narrows an incorrectly broad check without removing the target-table permission requirement.
I prefer access rules that correspond to the operation being authorized. A changefeed's table target provides a clear place to check reading privileges. Walking every related descriptor and applying the same privilege requirement makes the result depend on metadata relationships that are not themselves the requested read.
Descriptors are not interchangeable authorization targets
The original behavior combined several kinds of database metadata into one permission test. The release notes explicitly name the database and custom types as descriptors that received the extra SELECT check. That matters for a table whose definition includes a user-defined type.
After the fix, the presence of that type no longer adds the same mistaken SELECT prerequisite to changefeed validation. The relevant table permission still applies. Describing the change as bypassing authorization would therefore be inaccurate, since it corrects which objects receive the check.
This is a useful distinction for least-privilege configurations. If an operation rejects an appropriately authorized table reader because of an unrelated descriptor check, expanding privileges can hide the implementation error. Correcting the check allows the authorization decision to match its documented target more closely.
The release notes do not claim a new privilege model for all changefeed operations. They identify a particular overly broad SELECT test. Keeping the explanation at that scope avoids implying that every other requirement or permission has changed.
Type names leave diagnostic reports
A separate change removes custom type names from telemetry and crash reports sent to Cockroach Labs. The notes identify this as issue 61645. It concerns the information leaving the cluster through diagnostics, independently of changefeed authorization.
A type name belongs to a user's schema vocabulary. Even without the contents of a table, that vocabulary can reveal information the user did not intend to include in diagnostic data. Removing names reduces that particular disclosure while leaving the broader existence of diagnostics unchanged.
The release makes no claim that this one change removes every schema identifier from every report. Its explicit scope is custom type names in telemetry and crash reporting. An operator assessing outgoing information needs that exact scope.
These two changes both concern metadata, but they act at different boundaries. One controls whether an operation is allowed to read table changes. The other controls whether a kind of schema name appears in reports sent to the vendor.
I find both corrections relevant to a database intended to carry application data across machines. Metadata needs its own treatment. A descriptor used internally for execution does not automatically belong in every privilege check or diagnostic payload.
Inspection must preserve schema identity
The same release repairs several paths that did not handle user-defined schemas correctly. In pg_indexes, the indexdef column previously reported an index as belonging to public. It now reports the actual user-defined schema where necessary.
The target column of crdb_internal.zones also receives a schema-aware naming fix. Previously, it did not properly account for user-defined schemas. These corrections matter when a person uses inspection results to identify an object or explain its configuration.
Another fix allows EXPLAIN with OPT and ENV options to work for queries referencing tables in user-defined schemas. A separate correction makes pg_type_is_visible handle user-defined types correctly. Together, these entries describe specific gaps in the database's handling of object identity outside its simplest namespace arrangement.
Accurate inspection output is part of operating a SQL-compatible database. A command can return a plausible object name while still omitting the schema distinction needed to interpret it. The release notes identify which outputs now preserve that information.
Session defaults become easier to set
Version 20.2.7 adds public cluster settings for default statement and idle-in-transaction timeouts. It also makes sql.defaults.idle_in_session_timeout public. These settings concern the defaults supplied to sessions.
The update separately repairs SHOW output for the two idle timeout settings. They had incorrectly displayed the statement_timeout value. A control and its observation therefore needed different fixes, since setting a value and accurately reporting it are separate behaviors.
The release remains a maintenance update, with these changes documented relative to 20.2.6. Its most direct permission change is narrowly stated, requiring SELECT on changefeed target tables without applying that same requirement to every associated descriptor. The accompanying diagnostic and inspection fixes likewise treat schema metadata according to the operation using it.