diff --git a/debian/README.source.md b/debian/README.source.md
index 74dbf7cea96..e9aaf7be213 100644
--- a/debian/README.source.md
+++ b/debian/README.source.md
@@ -497,26 +497,31 @@ repositories one needs to run:
 
     docker run -it -v ${PWD}:/build -w /build debian:sid bash
     apt update
-    apt install --yes python3-junit.xml python3-debian apt-file
-    curl -O https://salsa.debian.org/salsa-ci-team/pipeline/-/raw/master/images/scripts/check_for_missing_breaks_replaces.py
-    chmod +x check_for_missing_breaks_replaces.py
-    apt install --no-install-recommends --yes gpg gpg-agent dirmngr ca-certificates curl debian-archive-keyring
-    curl -sS https://mariadb.org/mariadb_release_signing_key.asc -o /etc/apt/trusted.gpg.d/mariadb.asc
-    gpg --list-keys # Initialize default keyring
-    gpg --no-default-keyring --keyring gnupg-ring:/etc/apt/trusted.gpg.d/mariadb.gpg --keyserver hkps://keyserver.ubuntu.com:443 --recv-keys 871920D1991BC93C 3B4FE6ACC0B21F32 CBF8D6FD518E17E1 7638D0442B90D010 8C718D3B5072E1F5 9334A25F8507EFA5 CBCB082A1BB943DB 467B942D3A79BD29 B7B3B788A8D3785C
-    chmod 644 /etc/apt/trusted.gpg.d/mariadb.gpg
+    apt install --yes devscripts python3-junit.xml apt-file
+    cat > /etc/apt/apt.conf.d/99ignore-keys <<EOF
+    APT::Get::AllowUnauthenticated "true";
+    Acquire::AllowInsecureRepositories "true";
+    Acquire::AllowDowngradeToInsecureRepositories "true";
+    Acquire::Check-Valid-Until "false";
+    Acquire::Check-Date "false";
+    EOF
     cat > /etc/apt/sources.list.d/mariadb.list <<EOF
     deb http://deb.debian.org/debian trixie main
     deb http://deb.debian.org/debian bookworm main
     deb http://deb.debian.org/debian bullseye main
-    deb http://deb.debian.org/debian buster main
+    deb http://archive.debian.org/debian buster main
     deb http://archive.debian.org/debian stretch main
-    deb [trusted=yes] http://archive.debian.org/debian jessie main
+    deb http://archive.debian.org/debian jessie main
+    deb http://archive.ubuntu.com/ubuntu/ plucky main restricted universe multiverse
+    deb http://archive.ubuntu.com/ubuntu/ oracular main restricted universe multiverse
+    deb http://archive.ubuntu.com/ubuntu/ noble main restricted universe multiverse
     deb http://archive.ubuntu.com/ubuntu/ jammy main restricted universe multiverse
     deb http://archive.ubuntu.com/ubuntu/ focal main restricted universe multiverse
     deb http://archive.ubuntu.com/ubuntu/ bionic main restricted universe multiverse
     deb http://archive.ubuntu.com/ubuntu/ xenial main restricted universe multiverse
     deb http://archive.ubuntu.com/ubuntu/ trusty main restricted universe multiverse
+    deb https://archive.mariadb.org/mariadb-11.8/repo/debian bookworm main
+    deb https://archive.mariadb.org/mariadb-11.7/repo/debian bookworm main
     deb https://archive.mariadb.org/mariadb-11.6/repo/debian bookworm main
     deb https://archive.mariadb.org/mariadb-11.5/repo/debian bookworm main
     deb https://archive.mariadb.org/mariadb-11.4/repo/debian bookworm main
@@ -535,10 +540,17 @@ repositories one needs to run:
     deb https://archive.mariadb.org/mariadb-10.3/repo/debian buster main
     deb https://archive.mariadb.org/mariadb-10.2/repo/debian buster main
     deb https://archive.mariadb.org/mariadb-10.1/repo/debian stretch main
-    deb [trusted=yes] https://archive.mariadb.org/mariadb-10.0/repo/debian jessie main
-    deb [trusted=yes] https://archive.mariadb.org/mariadb-5.5/repo/debian wheezy main
+    deb https://archive.mariadb.org/mariadb-10.0/repo/debian jessie main
+    deb https://archive.mariadb.org/mariadb-5.5/repo/debian wheezy main
+    deb https://repo.mysql.com/apt/ubuntu/ noble mysql-8.4-lts
+    deb https://repo.mysql.com/apt/ubuntu/ noble mysql-8.0
     deb https://repo.mysql.com/apt/ubuntu/ jammy mysql-8.0
     deb https://repo.mysql.com/apt/ubuntu/ focal mysql-8.0
+    deb https://repo.mysql.com/apt/debian/ bookworm mysql-innovation
+    deb https://repo.mysql.com/apt/debian/ bookworm mysql-8.4-lts
+    deb https://repo.mysql.com/apt/debian/ bookworm mysql-8.0
+    deb https://repo.mysql.com/apt/debian/ bullseye mysql-8.4-lts
+    deb https://repo.mysql.com/apt/debian/ bullseye mysql-8.0
     deb https://repo.mysql.com/apt/debian/ buster mysql-8.0
     deb https://repo.mysql.com/apt/debian/ buster mysql-5.7
     deb https://repo.mysql.com/apt/debian/ buster mysql-5.6
@@ -553,7 +565,7 @@ repositories one needs to run:
     deb https://repo.percona.com/apt/ wheezy main
     EOF
     apt-file update
-    ./check_for_missing_breaks_replaces.py --changes-file mariadb_*.changes --debug
+    deb-check-file-conflicts --debug --changes-file mariadb_*_amd64.changes
 
 ## Check reverse dependencies
 
diff --git a/debian/changelog b/debian/changelog
index 22c690b155b..8b2c2c81653 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,53 @@
+mariadb (1:11.8.2-1) unstable; urgency=medium
+
+  * New upstream version 11.8.2, which also announces the 11.8 series now
+    ready for general availability (GA) with security releases for 5 years.
+    This release includes fixes for several defects as noted at
+    https://mariadb.com/kb/en/mariadb-11-8-2-release-notes/ as well
+    the following security issues (Closes: #1100437, #1105976):
+    - CVE-2023-52969
+    - CVE-2023-52970
+    - CVE-2023-52971
+    - CVE-2025-30693
+    - CVE-2025-30722
+  * Drop all RocksDB patches now upstream due to update to version 6.29fb
+  * Drop PCRE2 10.45 compatibility patch obsoleted by upstream test change
+  * Update configuration traces to include new upstream system variables:
+    - innodb-buffer-pool-size-auto-min (default: 0)
+    - innodb-buffer-pool-size-max (default: 0)
+    - innodb-log-checkpoint-now (default: FALSE)
+  * Also update configuration traces to match that in 11.8.2 the variables
+    innodb-buffer-pool-chunk-size and innodb-log-spin-wait-delay are advertised
+    as deprecated.
+  * Disable new unreliable test main.mysql-interactive
+  * Add Breaks/Replaces for files moved around in src:mysql-8.4 (LP: #2110378)
+  * Update mariadb-server.NEWS with information about MariaDB 11.8 and
+  * best practices for creating app user and allowing remote connections
+  * Add patch to improve output from mariadb-secure-installation
+
+ -- Otto Kekäläinen <otto@debian.org>  Sun, 08 Jun 2025 11:19:07 +0300
+
+mariadb (1:11.8.1-5) unstable; urgency=medium
+
+  [ Otto Kekäläinen ]
+  * Disable additional tests that failed on sparc64 (MDEV-36670)
+  * Have all server plugins depend on mariadb-server-core (Closes: #1039702)
+  * Make plugin dependencies on mariadbd on strictly versioned
+    (Closes: #1057708)
+  * Remove redundant BSD license comment in debian/copyright
+  * Remove unnecessary arch from dh_installinit rule
+  * Make COMPILATION_COMMENT and MYSQL_SERVER_SUFFIX more useful
+  * Several improvements to Salsa CI, Lintian overrides and other quality
+    assurance for Debian 13 "Trixie"
+
+  [ Jing Luo ]
+  * d/upstream/metadata: change github url protocol from git to https
+  * d/copyright: remove old FSF address
+  * d/copyright: move "On Debian systems..." to comment stanza
+  * d/copyright: misc fixes, remove the full text of BSD-3 and Artistic
+
+ -- Otto Kekäläinen <otto@debian.org>  Mon, 26 May 2025 09:23:46 -0700
+
 mariadb (1:11.8.1-4) unstable; urgency=medium
 
   * Disable main.mysqld--help-aria test that failed on nearly every
diff --git a/debian/control b/debian/control
index 06525750f52..ee294505e3e 100644
--- a/debian/control
+++ b/debian/control
@@ -239,11 +239,13 @@ Breaks:
  mariadb-server-core-10.4,
  mariadb-server-core-10.5,
  mariadb-server-core-10.6,
+ mysql-client-core (<< 9.9~),
  mysql-client-core-5.5,
  mysql-client-core-5.6,
  mysql-client-core-5.7,
  mysql-client-core-8.0,
  mysql-cluster-community-client-plugins,
+ mysql-server-core (<< 9.9~),
  mysql-server-core-5.5,
  mysql-server-core-5.6,
  mysql-server-core-5.7,
@@ -271,11 +273,13 @@ Replaces:
  mariadb-server-core-10.4,
  mariadb-server-core-10.5,
  mariadb-server-core-10.6,
+ mysql-client-core (<< 9.9~),
  mysql-client-core-5.5,
  mysql-client-core-5.6,
  mysql-client-core-5.7,
  mysql-client-core-8.0,
  mysql-cluster-community-client-plugins,
+ mysql-server-core (<< 9.9~),
  mysql-server-core-5.5,
  mysql-server-core-5.6,
  mysql-server-core-5.7,
@@ -343,8 +347,10 @@ Breaks:
  mysql-client-5.6,
  mysql-client-5.7,
  mysql-client-8.0,
+ mysql-client-core (<< 9.9~),
  mysql-server-5.5,
  mysql-server-5.7,
+ mysql-server-core (<< 9.9~),
  mysql-server-core-8.0,
  percona-server-server-5.6,
  percona-xtradb-cluster-server-5.6,
@@ -379,8 +385,10 @@ Replaces:
  mysql-client-5.6,
  mysql-client-5.7,
  mysql-client-8.0,
+ mysql-client-core (<< 9.9~),
  mysql-server-5.5,
  mysql-server-5.7,
+ mysql-server-core (<< 9.9~),
  mysql-server-core-8.0,
  mytop,
  percona-server-server-5.6,
@@ -414,7 +422,9 @@ Breaks:
  mariadb-server-10.5 (<< 1:10.11),
  mariadb-server-core (<< 1:11.0.0),
  mysql-client (<< 5.0.51),
+ mysql-client-core (<< 9.9~),
  mysql-server-5.5,
+ mysql-server-core (<< 9.9~),
 Replaces:
  mariadb-client (<< 1:11.0.0),
  mariadb-client-core (<< 1:11.0.0),
@@ -422,7 +432,9 @@ Replaces:
  mariadb-server-10.5 (<< 1:10.11),
  mariadb-server-core (<< 1:11.0.0),
  mysql-client (<< 5.0.51),
+ mysql-client-core (<< 9.9~),
  mysql-server-5.5,
+ mysql-server-core (<< 9.9~),
 Conflicts:
  mariadb-client-10.0,
  mariadb-client-10.1,
@@ -527,6 +539,7 @@ Breaks:
  mariadb-server-core-5.5,
  mysql-client-5.5,
  mysql-client-5.6,
+ mysql-server-core (<< 9.9~),
  mysql-server-core-5.5,
  mysql-server-core-5.6,
  mysql-server-core-5.7,
@@ -557,6 +570,7 @@ Replaces:
  mysql-client-5.6,
  mysql-client-5.7,
  mysql-client-8.0,
+ mysql-server-core (<< 9.9~),
  mysql-server-core-5.5,
  mysql-server-core-5.6,
  mysql-server-core-5.7,
@@ -643,11 +657,14 @@ Breaks:
  mariadb-tokudb-engine-5.5,
  mysql-client-5.5,
  mysql-client-5.7,
+ mysql-client-core (<< 9.9~),
  mysql-client-core-8.0,
+ mysql-server (<< 9.9~),
  mysql-server-5.5,
  mysql-server-5.6,
  mysql-server-5.7,
  mysql-server-8.0,
+ mysql-server-core (<< 9.9~),
 Replaces:
  handlersocket-mysql-5.5,
  mariadb-galera-server,
@@ -666,11 +683,14 @@ Replaces:
  mariadb-tokudb-engine-5.5,
  mysql-client-5.5,
  mysql-client-5.7,
+ mysql-client-core (<< 9.9~),
  mysql-client-core-8.0,
+ mysql-server (<< 9.9~),
  mysql-server-5.5,
  mysql-server-5.6,
  mysql-server-5.7,
  mysql-server-8.0,
+ mysql-server-core (<< 9.9~),
  percona-server-server-5.6,
  percona-xtradb-cluster-server-5.6,
  percona-xtradb-cluster-server-5.7,
@@ -696,12 +716,14 @@ Breaks:
  mariadb-server-core (<< 1:11.0.0),
  mysql-server-5.5,
  mysql-server-5.7,
+ mysql-server-core (<< 9.9~),
 Replaces:
  mariadb-server (<< 1:11.0.0),
  mariadb-server-10.5 (<< 1:10.11),
  mariadb-server-core (<< 1:11.0.0),
  mysql-server-5.5,
  mysql-server-5.7,
+ mysql-server-core (<< 9.9~),
 Conflicts:
  mariadb-server-10.0,
  mariadb-server-10.1,
@@ -792,7 +814,7 @@ Package: mariadb-plugin-connect
 Architecture: any
 Depends:
  libxml2,
- mariadb-server (= ${server:Version}),
+ mariadb-server-core (= ${server:Version}),
  unixodbc,
  ${misc:Depends},
  ${shlibs:Depends},
@@ -840,7 +862,7 @@ Description: Connect storage engine JDBC interface for MariaDB server
 Package: mariadb-plugin-s3
 Architecture: any
 Depends:
- mariadb-server (= ${server:Version}),
+ mariadb-server-core (= ${server:Version}),
  ${misc:Depends},
  ${shlibs:Depends},
 Description: Amazon S3 archival storage engine for MariaDB
@@ -851,7 +873,7 @@ Description: Amazon S3 archival storage engine for MariaDB
 Package: mariadb-plugin-rocksdb
 Architecture: amd64 arm64 loong64 mips64el ppc64el riscv64
 Depends:
- mariadb-server (= ${server:Version}),
+ mariadb-server-core (= ${server:Version}),
  python3:any,
  rocksdb-tools,
  ${misc:Depends},
@@ -873,7 +895,7 @@ Package: mariadb-plugin-oqgraph
 Architecture: any
 Depends:
  libjudydebian1,
- mariadb-server (= ${server:Version}),
+ mariadb-server-core (= ${server:Version}),
  ${misc:Depends},
  ${shlibs:Depends},
 Conflicts:
@@ -897,7 +919,7 @@ Description: OQGraph storage engine for MariaDB server
 Package: mariadb-plugin-mroonga
 Architecture: any-alpha any-amd64 any-arm any-arm64 any-i386 any-ia64 any-mips64el any-mips64r6el any-mipsel any-mipsr6el any-nios2 any-powerpcel any-ppc64el any-sh3 any-sh4
 Depends:
- mariadb-server (= ${server:Version}),
+ mariadb-server-core (= ${server:Version}),
  ${misc:Depends},
  ${shlibs:Depends},
 Breaks:
@@ -914,7 +936,7 @@ Description: Mroonga storage engine for MariaDB server
 Package: mariadb-plugin-spider
 Architecture: any
 Depends:
- mariadb-server (= ${server:Version}),
+ mariadb-server-core (= ${server:Version}),
  ${misc:Depends},
  ${shlibs:Depends},
 Breaks:
@@ -933,7 +955,7 @@ Package: mariadb-plugin-gssapi-server
 Architecture: any
 Depends:
  libgssapi-krb5-2,
- mariadb-server,
+ mariadb-server-core (= ${server:Version}),
  ${misc:Depends},
  ${shlibs:Depends},
 Breaks:
@@ -971,7 +993,7 @@ Package: mariadb-plugin-cracklib-password-check
 Architecture: any
 Depends:
  libcrack2 (>= 2.9.0),
- mariadb-server (= ${server:Version}),
+ mariadb-server-core (= ${server:Version}),
  ${misc:Depends},
  ${shlibs:Depends},
 Description: CrackLib Password Validation Plugin for MariaDB server
@@ -984,7 +1006,7 @@ Description: CrackLib Password Validation Plugin for MariaDB server
 Package: mariadb-plugin-hashicorp-key-management
 Architecture: any
 Depends:
- mariadb-server,
+ mariadb-server-core (= ${server:Version}),
  ${misc:Depends},
  ${shlibs:Depends},
 Description: Hashicorp Key Management plugin for MariaDB
@@ -994,7 +1016,7 @@ Description: Hashicorp Key Management plugin for MariaDB
 Package: mariadb-plugin-provider-bzip2
 Architecture: any
 Depends:
- mariadb-server (>= 1:10.11.1-1),
+ mariadb-server-core (= ${server:Version}),
  ${misc:Depends},
  ${shlibs:Depends},
 Description: BZip2 compression support in the server and storage engines
@@ -1009,7 +1031,7 @@ Description: BZip2 compression support in the server and storage engines
 Package: mariadb-plugin-provider-lz4
 Architecture: any
 Depends:
- mariadb-server (>= 1:10.11.1-1),
+ mariadb-server-core (= ${server:Version}),
  ${misc:Depends},
  ${shlibs:Depends},
 Description: LZ4 compression support in the server and storage engines
@@ -1024,7 +1046,7 @@ Description: LZ4 compression support in the server and storage engines
 Package: mariadb-plugin-provider-lzma
 Architecture: any
 Depends:
- mariadb-server (>= 1:10.11.1-1),
+ mariadb-server-core (= ${server:Version}),
  ${misc:Depends},
  ${shlibs:Depends},
 Description: LZMA compression support in the server and storage engines
@@ -1039,7 +1061,7 @@ Description: LZMA compression support in the server and storage engines
 Package: mariadb-plugin-provider-lzo
 Architecture: any
 Depends:
- mariadb-server (>= 1:10.11.1-1),
+ mariadb-server-core (= ${server:Version}),
  ${misc:Depends},
  ${shlibs:Depends},
 Description: LZO compression support in the server and storage engines
@@ -1054,7 +1076,7 @@ Description: LZO compression support in the server and storage engines
 Package: mariadb-plugin-provider-snappy
 Architecture: any
 Depends:
- mariadb-server (>= 1:10.11.1-1),
+ mariadb-server-core (= ${server:Version}),
  ${misc:Depends},
  ${shlibs:Depends},
 Description: Snappy compression support in the server and storage engines
@@ -1083,6 +1105,7 @@ Breaks:
  mysql-client-5.5,
  mysql-server-5.5,
  mysql-server-5.7,
+ mysql-server-core (<< 9.9~),
  mysql-server-core-8.0,
  mysql-testsuite,
  mysql-testsuite-5.5,
@@ -1099,6 +1122,7 @@ Replaces:
  mysql-client-5.5,
  mysql-server-5.5,
  mysql-server-5.7,
+ mysql-server-core (<< 9.9~),
  mysql-server-core-8.0,
  mysql-testsuite,
  mysql-testsuite-5.5,
diff --git a/debian/copyright b/debian/copyright
index ac27dfc8d3d..96383545aef 100644
--- a/debian/copyright
+++ b/debian/copyright
@@ -295,10 +295,13 @@ Copyright: 1979-2009 MySQL AB
            2011 Kentoku SHIBA
 License: GPL-2
 
-Files: include/maria.h include/myisamchk.h
+Files: include/maria.h
+ include/myisamchk.h
+ include/my_rnd.h
+ include/thr_timer.h
 Copyright: 2006-2008 MySQL AB
  2008-2009 Sun Microsystems, Inc
- 2009, 2013, Monty Program Ab
+ 2009, 2013, 2014 Monty Program Ab
 License: GPL-2+
 
 Files: plugin/auth_pam/testing/pam_mariadb_mtr.c
@@ -377,7 +380,7 @@ License: unlimited-free-doc
 Files: mysql-test/lib/mtr_misc.pl
  mysql-test/lib/My/SafeProcess.pm
 Copyright: 2004, 2007, 2011, Oracle and/or its affiliates
-License: LGPL
+License: LGPL-2
 
 Files:
  storage/myisam/ft_update.c
@@ -437,7 +440,7 @@ License: GPL-2+
 Files: sql-bench/*.sh
 Copyright: 2009 Sun Microsystems, Inc
            2000-2007 MySQL AB
-License: LGPL
+License: LGPL-2
 
 Files: client/completion_hash.h
  scripts/mysqlaccess.sh
@@ -446,7 +449,11 @@ Files: client/completion_hash.h
  storage/myisam/ftbench/ft-test-run.sh
  storage/myisam/mi_test_all.sh
  strings/ctype-uca.c
+ strings/ctype-uca.h
+ strings/ctype-uca1400.h
+ strings/ctype-uca-scanner_next.inl
  strings/ctype-ucs2.c
+ strings/ctype-unidata.c
  strings/ctype-utf8.c
  support-files/MacOSX/postflight.sh
  support-files/MacOSX/preflight.sh
@@ -462,7 +469,8 @@ Files: client/completion_hash.h
 Copyright: 2000-2013 Oracle and/or its affiliates
            2000-2007 MySQL AB
            2009 Sun Microsystems Inc
-License: LGPL
+           2009, 2018, 2020-2021, MariaDB
+License: LGPL-2
 
 Files: BUILD/util.sh
 Copyright: 2010 Kristian Nielsen and Monty Program AB
@@ -493,7 +501,14 @@ Files: strings/ctype-bin.c
 Copyright:
  2000,2002,2005-2011 Oracle and/or its affiliates
  tommy@valley.ne.jp
-License: LGPL
+License: LGPL-2
+
+Files: scripts/galera_new_cluster.sh
+ storage/connect/inihandl.cpp
+Copyright: 1993 Miguel de Icaza
+ 1996 Alexandre Julliard
+ MariaDB Foundation
+License: LGPL-2.1+
 
 Files: scripts/mysqld_safe.sh
  support-files/mysql-multi.server.sh
@@ -505,67 +520,12 @@ Files: storage/innobase/include/pars0grm.h storage/innobase/pars/pars0grm.cc
 Copyright: 1995-2009 Innobase Oy.
  1984,1989-1990,2000-2004 Free Software Foundation Inc.
 License: GPL-2+-with-bison-exception
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2, or (at your option)
- any later version.
- .
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- GNU General Public License for more details.
- .
- You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 51 Franklin Street, Fifth Floor,
- Boston, MA 02110-1301, USA.
- .
- As a special exception, you may create a larger work that contains
- part or all of the Bison parser skeleton and distribute that work
- under terms of your choice, so long as that work isn't itself a
- parser generator using the skeleton or a modified version thereof
- as a parser skeleton.  Alternatively, if you modify or redistribute
- the parser skeleton itself, you may (at your option) remove this
- special exception, which will cause the skeleton and the resulting
- Bison output files to be licensed under the GNU General Public
- License without this special exception.
- .
- This special exception was added by the Free Software Foundation in
- version 2.2 of Bison.
 
 Files: storage/innobase/fts/fts0pars.cc
  storage/innobase/include/fts0pars.h
 Copyright: 1984, 1989-1990, 2000-2006  Free Software Foundation, Inc.
 License: GPL-3+-with-bison-exception
 
-License: GPL-3+-with-bison-exception
- This program is free software: you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation, either version 3 of the License, or
- (at your option) any later version.
- .
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- GNU General Public License for more details.
- .
- You should have received a copy of the GNU General Public License
- along with this program.  If not, see <https://www.gnu.org/licenses/>.
- .
- As a special exception, you may create a larger work that contains
- part or all of the Bison parser skeleton and distribute that work
- under terms of your choice, so long as that work isn't itself a
- parser generator using the skeleton or a modified version thereof
- as a parser skeleton.  Alternatively, if you modify or redistribute
- the parser skeleton itself, you may (at your option) remove this
- special exception, which will cause the skeleton and the resulting
- Bison output files to be licensed under the GNU General Public
- License without this special exception.
- .
- This special exception was added by the Free Software Foundation in
- version 2.2 of Bison.
-
-
 Files: include/t_ctype.h
  strings/t_ctype.h
 Copyright: 2000 MySQL AB
@@ -639,13 +599,15 @@ License: GPL-2
 Files: strings/dtoa.c
 Copyright: 2007-2012 Oracle and/or its affiliates.
  1991,2000-2001 Lucent Technologies
-License: LGPL
+ 2017, 2020, MariaDB Corporation
+License: LGPL-2
 
 Files: scripts/mysqldumpslow.sh
 Copyright:
  2000-2002,2005-2008 MySQL AB
  2008-2009 Sun Microsystems Inc
-License: LGPL
+ 2000, 2017, Oracle and/or its affiliates
+License: LGPL-2
 
 Files: libmysqld/lib_sql.cc
 Copyright: 2000 SWsoft  company
@@ -692,6 +654,137 @@ Files: wsrep-lib/*
 Copyright: 2008-2019 Codership Oy <https://galeracluster.com/>
 License: GPL-2
 
+Files:
+ wsrep-lib/dbsim/db_client.cpp
+ wsrep-lib/dbsim/db_client.hpp
+ wsrep-lib/dbsim/db_client_service.cpp
+ wsrep-lib/dbsim/db_client_service.hpp
+ wsrep-lib/dbsim/db_client_state.hpp
+ wsrep-lib/dbsim/db_high_priority_service.cpp
+ wsrep-lib/dbsim/db_high_priority_service.hpp
+ wsrep-lib/dbsim/db_params.cpp
+ wsrep-lib/dbsim/db_params.hpp
+ wsrep-lib/dbsim/db_server.cpp
+ wsrep-lib/dbsim/db_server.hpp
+ wsrep-lib/dbsim/db_server_service.cpp
+ wsrep-lib/dbsim/db_server_service.hpp
+ wsrep-lib/dbsim/db_server_state.cpp
+ wsrep-lib/dbsim/db_server_state.hpp
+ wsrep-lib/dbsim/db_simulator.cpp
+ wsrep-lib/dbsim/db_simulator.hpp
+ wsrep-lib/dbsim/db_storage_engine.cpp
+ wsrep-lib/dbsim/db_storage_engine.hpp
+ wsrep-lib/dbsim/db_storage_service.hpp
+ wsrep-lib/dbsim/db_threads.cpp
+ wsrep-lib/dbsim/db_threads.hpp
+ wsrep-lib/dbsim/db_tls.cpp
+ wsrep-lib/dbsim/db_tls.hpp
+ wsrep-lib/dbsim/dbsim.cpp
+ wsrep-lib/include/wsrep/allowlist_service.hpp
+ wsrep-lib/include/wsrep/atomic.hpp
+ wsrep-lib/include/wsrep/buffer.hpp
+ wsrep-lib/include/wsrep/chrono.hpp
+ wsrep-lib/include/wsrep/client_id.hpp
+ wsrep-lib/include/wsrep/client_service.hpp
+ wsrep-lib/include/wsrep/client_state.hpp
+ wsrep-lib/include/wsrep/compiler.hpp
+ wsrep-lib/include/wsrep/condition_variable.hpp
+ wsrep-lib/include/wsrep/encryption_service.hpp
+ wsrep-lib/include/wsrep/event_service.hpp
+ wsrep-lib/include/wsrep/exception.hpp
+ wsrep-lib/include/wsrep/gtid.hpp
+ wsrep-lib/include/wsrep/high_priority_service.hpp
+ wsrep-lib/include/wsrep/id.hpp
+ wsrep-lib/include/wsrep/key.hpp
+ wsrep-lib/include/wsrep/lock.hpp
+ wsrep-lib/include/wsrep/logger.hpp
+ wsrep-lib/include/wsrep/mutex.hpp
+ wsrep-lib/include/wsrep/provider.hpp
+ wsrep-lib/include/wsrep/provider_options.hpp
+ wsrep-lib/include/wsrep/reporter.hpp
+ wsrep-lib/include/wsrep/seqno.hpp
+ wsrep-lib/include/wsrep/server_service.hpp
+ wsrep-lib/include/wsrep/server_state.hpp
+ wsrep-lib/include/wsrep/sr_key_set.hpp
+ wsrep-lib/include/wsrep/storage_service.hpp
+ wsrep-lib/include/wsrep/streaming_context.hpp
+ wsrep-lib/include/wsrep/thread.hpp
+ wsrep-lib/include/wsrep/thread_service.hpp
+ wsrep-lib/include/wsrep/tls_service.hpp
+ wsrep-lib/include/wsrep/transaction.hpp
+ wsrep-lib/include/wsrep/transaction_id.hpp
+ wsrep-lib/include/wsrep/version.hpp
+ wsrep-lib/include/wsrep/view.hpp
+ wsrep-lib/include/wsrep/xid.hpp
+ wsrep-lib/scripts/benchmark-provider.sh
+ wsrep-lib/scripts/benchmark-report.sh
+ wsrep-lib/scripts/stress-provider.sh
+ wsrep-lib/src/allowlist_service_v1.cpp
+ wsrep-lib/src/allowlist_service_v1.hpp
+ wsrep-lib/src/client_state.cpp
+ wsrep-lib/src/config_service_v1.cpp
+ wsrep-lib/src/config_service_v1.hpp
+ wsrep-lib/src/event_service_v1.cpp
+ wsrep-lib/src/event_service_v1.hpp
+ wsrep-lib/src/exception.cpp
+ wsrep-lib/src/gtid.cpp
+ wsrep-lib/src/id.cpp
+ wsrep-lib/src/key.cpp
+ wsrep-lib/src/logger.cpp
+ wsrep-lib/src/provider.cpp
+ wsrep-lib/src/provider_options.cpp
+ wsrep-lib/src/reporter.cpp
+ wsrep-lib/src/seqno.cpp
+ wsrep-lib/src/server_state.cpp
+ wsrep-lib/src/service_helpers.hpp
+ wsrep-lib/src/sr_key_set.cpp
+ wsrep-lib/src/streaming_context.cpp
+ wsrep-lib/src/thread.cpp
+ wsrep-lib/src/thread_service_v1.cpp
+ wsrep-lib/src/thread_service_v1.hpp
+ wsrep-lib/src/tls_service_v1.cpp
+ wsrep-lib/src/tls_service_v1.hpp
+ wsrep-lib/src/transaction.cpp
+ wsrep-lib/src/uuid.cpp
+ wsrep-lib/src/uuid.hpp
+ wsrep-lib/src/view.cpp
+ wsrep-lib/src/wsrep_provider_v26.cpp
+ wsrep-lib/src/wsrep_provider_v26.hpp
+ wsrep-lib/src/xid.cpp
+ wsrep-lib/test/buffer_test.cpp
+ wsrep-lib/test/client_state_fixture.hpp
+ wsrep-lib/test/gtid_test.cpp
+ wsrep-lib/test/id_test.cpp
+ wsrep-lib/test/mock_client_state.cpp
+ wsrep-lib/test/mock_client_state.hpp
+ wsrep-lib/test/mock_high_priority_service.cpp
+ wsrep-lib/test/mock_high_priority_service.hpp
+ wsrep-lib/test/mock_provider.hpp
+ wsrep-lib/test/mock_server_state.hpp
+ wsrep-lib/test/mock_storage_service.cpp
+ wsrep-lib/test/mock_storage_service.hpp
+ wsrep-lib/test/nbo_test.cpp
+ wsrep-lib/test/reporter_test.cpp
+ wsrep-lib/test/rsu_test.cpp
+ wsrep-lib/test/server_context_test.cpp
+ wsrep-lib/test/test_utils.cpp
+ wsrep-lib/test/test_utils.hpp
+ wsrep-lib/test/toi_test.cpp
+ wsrep-lib/test/transaction_test.cpp
+ wsrep-lib/test/transaction_test_2pc.cpp
+ wsrep-lib/test/view_test.cpp
+ wsrep-lib/test/wsrep-lib_test.cpp
+ wsrep-lib/test/xid_test.cpp
+ wsrep-lib/wsrep-API/v26/wsrep_allowlist_service.h
+ wsrep-lib/wsrep-API/v26/wsrep_config_service.h
+ wsrep-lib/wsrep-API/v26/wsrep_event_service.h
+ wsrep-lib/wsrep-API/v26/wsrep_membership_service.h
+ wsrep-lib/wsrep-API/v26/wsrep_node_isolation.h
+ wsrep-lib/wsrep-API/v26/wsrep_thread_service.h
+ wsrep-lib/wsrep-API/v26/wsrep_tls_service.h
+Copyright: 2008-2019 Codership Oy <https://galeracluster.com/>
+License: GPL-2+
+
 Files: libmariadb/*
 Copyright:
  2000-2012 MySQL AB & MySQL Finland AB & TCX DataKonsult AB
@@ -701,6 +794,11 @@ Copyright:
  2014 Kristian Nielsen & MariaDB Corporation
 License: LGPL-2+
 
+Files: libmariadb/cmake/*
+Copyright: 2013-2018 MariaDB Corporation AB
+ 2010, Michael Bell <michael.bell@web.de>
+License: BSD-3-Clause
+
 Files: libmariadb/libmariadb/mariadb_dyncol.*
 Copyright:
  2011-2012 Oleksandr Byelkin
@@ -711,18 +809,14 @@ Files: libmariadb/libmariadb/ma_dtoa.*
 Copyright:
  1991, 2000-2001, Lucent Technologies
  2007, 2012, Oracle and/or its affiliates.
-License: LGPL
+ 2016, 2022, MariaDB Corporation
+License: LGPL-2
 
 Files: libmariadb/unittest/libmariadb/getopt.*
 Copyright:
  1989-1994, Free Software Foundation, Inc
 License: LGPL-2+
 
-Files: libmariadb/cmake/FindIconv.cmake
-Copyright:
- 2010, Michael Bell <michael.bell@web.de>
-License: BSD-2-Clause
-
 Files: storage/archive/azio.c
  storage/archive/azlib.h
  zlib/*
@@ -730,21 +824,6 @@ Copyright:
  1995-2005 Jean-loup Gailly
  1995-2005 Mark Adler
 License: zlib/libpng
-  This software is provided 'as-is', without any express or implied
-  warranty.  In no event will the authors be held liable for any damages
-  arising from the use of this software.
-  .
-  Permission is granted to anyone to use this software for any purpose,
-  including commercial applications, and to alter it and redistribute it
-  freely, subject to the following restrictions:
-  .
-  1. The origin of this software must not be misrepresented; you must not
-     claim that you wrote the original software. If you use this software
-     in a product, an acknowledgment in the product documentation would be
-     appreciated but is not required.
-  2. Altered source versions must be plainly marked as such, and must not be
-     misrepresented as being the original software.
-  3. This notice may not be removed or altered from any source distribution.
 
 Files: mysys/CMakeLists.txt
 Copyright: 2006, 2014, Oracle and/or its affiliates
@@ -768,12 +847,11 @@ License: GPL-2
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  GNU General Public License for more details.
  .
- On Debian and systems the full text of the GNU General Public
- License version 2 can be found in the file
- `/usr/share/common-licenses/GPL-2`
- .
  You should have received a copy of the GNU General Public License
  along with this program.  If not, see <https://www.gnu.org/licenses/>.
+Comment:
+ On Debian systems, the complete text of the GNU General Public
+ License version 2 can be found in `/usr/share/common-licenses/GPL-2`.
 
 License: GPL-2+
  This program is free software; you can redistribute it and/or modify
@@ -786,32 +864,65 @@ License: GPL-2+
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  GNU General Public License for more details.
  .
- On Debian and systems the full text of the GNU General Public
- License version 2 can be found in the file
- `/usr/share/common-licenses/GPL-2`
- .
  You should have received a copy of the GNU General Public License
  along with this program.  If not, see <https://www.gnu.org/licenses/>.
+Comment:
+ On Debian systems, the complete text of the GNU General Public
+ License version 2 can be found in `/usr/share/common-licenses/GPL-2`.
 
-License: LGPL
- This library is free software; you can redistribute it and/or
- modify it under the terms of the GNU Library General Public
- License as published by the Free Software Foundation; version 2
- of the License.
+License: GPL-2+-with-bison-exception
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2, or (at your option)
+ any later version.
  .
- This library is distributed in the hope that it will be useful,
+ This program is distributed in the hope that it will be useful,
  but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- Library General Public License for more details.
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU General Public License for more details.
  .
- You should have received a copy of the GNU Library General Public
- License along with this library; if not, write to the Free
- Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- MA 02110-1301, USA
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, see <https://www.gnu.org/licenses/>.
+ .
+ As a special exception, you may create a larger work that contains
+ part or all of the Bison parser skeleton and distribute that work
+ under terms of your choice, so long as that work isn't itself a
+ parser generator using the skeleton or a modified version thereof
+ as a parser skeleton.  Alternatively, if you modify or redistribute
+ the parser skeleton itself, you may (at your option) remove this
+ special exception, which will cause the skeleton and the resulting
+ Bison output files to be licensed under the GNU General Public
+ License without this special exception.
  .
- On Debian and systems the full text of the GNU Library General Public
- License version 2 can be found in the file
- `/usr/share/common-licenses/LGPL-2`
+ This special exception was added by the Free Software Foundation in
+ version 2.2 of Bison.
+
+License: GPL-3+-with-bison-exception
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+ .
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU General Public License for more details.
+ .
+ You should have received a copy of the GNU General Public License
+ along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ .
+ As a special exception, you may create a larger work that contains
+ part or all of the Bison parser skeleton and distribute that work
+ under terms of your choice, so long as that work isn't itself a
+ parser generator using the skeleton or a modified version thereof
+ as a parser skeleton.  Alternatively, if you modify or redistribute
+ the parser skeleton itself, you may (at your option) remove this
+ special exception, which will cause the skeleton and the resulting
+ Bison output files to be licensed under the GNU General Public
+ License without this special exception.
+ .
+ This special exception was added by the Free Software Foundation in
+ version 2.2 of Bison.
 
 License: LGPL-2
  This library is free software; you can redistribute it and/or
@@ -825,13 +936,10 @@ License: LGPL-2
  Library General Public License for more details.
  .
  You should have received a copy of the GNU Library General Public
- License along with this library; if not, write to the Free
- Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
- MA 02110-1301, USA
- .
- On Debian and systems the full text of the GNU Library General Public
- License version 2 can be found in the file
- `/usr/share/common-licenses/LGPL-2`
+ License along with this library; if not, see <https://www.gnu.org/licenses/>.
+Comment:
+ On Debian systems, the complete text of the GNU Library General Public
+ License version 2 can be found in "/usr/share/common-licenses/LGPL-2".
 
 License: LGPL-2+
  This library is free software; you can redistribute it and/or
@@ -845,10 +953,8 @@ License: LGPL-2+
  Library General Public License for more details.
  .
  You should have received a copy of the GNU Library General Public
- License along with this library; if not see <https://www.gnu.org/licenses>
- or write to the Free Software Foundation, Inc.,
- 51 Franklin St., Fifth Floor, Boston, MA 02110, USA
- .
+ License along with this library; if not, see <https://www.gnu.org/licenses>.
+Comment:
  On Debian systems, the complete text of the GNU Library General Public
  License version 2 can be found in "/usr/share/common-licenses/LGPL-2".
 
@@ -864,14 +970,12 @@ License: LGPL-2.1+
  GNU Lesser General Public License for more details.
  .
  You should have received a copy of the GNU Lesser General Public License along
- with this program; if not, write to the Free Software Foundation,
- Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.  */
- .
- On Debian and systems the full text of the GNU Library General Public
- License version 2.1 can be found in the file
- `/usr/share/common-licenses/LGPL-2.1`
+ with this program; if not, see <https://www.gnu.org/licenses/>.
+Comment:
+ On Debian systems, the complete text of the GNU Library General Public
+ License version 2.1 can be found in `/usr/share/common-licenses/LGPL-2.1`.
 
-License: BSD-2-clause
+License: BSD-2-Clause
  Redistribution and use in source and binary forms, with or without
  modification, are permitted provided that the following conditions are
  met:
@@ -895,147 +999,31 @@ License: BSD-3-clause
  3. Neither the name of the University nor the names of its contributors
     may be used to endorse or promote products derived from this software
     without specific prior written permission.
- .
- THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- SUCH DAMAGE.
 
 License: Artistic
- The "Artistic License"
- .
- Preamble
- .
- The intent of this document is to state the conditions under which a
- Package may be copied, such that the Copyright Holder maintains some
- semblance of artistic control over the development of the package,
- while giving the users of the package the right to use and distribute
- the Package in a more-or-less customary fashion, plus the right to make
- reasonable modifications.
- .
- Definitions:
- .
- "Package" refers to the collection of files distributed by the
- Copyright Holder, and derivatives of that collection of files
- created through textual modification.
- .
- "Standard Version" refers to such a Package if it has not been
- modified, or has been modified in accordance with the wishes
- of the Copyright Holder as specified below.
- .
- "Copyright Holder" is whoever is named in the copyright or
- copyrights for the package.
- .
- "You" is you, if you're thinking about copying or distributing
- this Package.
- .
- "Reasonable copying fee" is whatever you can justify on the
- basis of media cost, duplication charges, time of people involved,
- and so on.  (You will not be required to justify it to the
- Copyright Holder, but only to the computing community at large
- as a market that must bear the fee.)
- .
- "Freely Available" means that no fee is charged for the item
- itself, though there may be fees involved in handling the item.
- It also means that recipients of the item may redistribute it
- under the same conditions they received it.
- .
- 1. You may make and give away verbatim copies of the source form of the
- Standard Version of this Package without restriction, provided that you
- duplicate all of the original copyright notices and associated disclaimers.
- .
- 2. You may apply bug fixes, portability fixes and other modifications
- derived from the Public Domain or from the Copyright Holder.  A Package
- modified in such a way shall still be considered the Standard Version.
- .
- 3. You may otherwise modify your copy of this Package in any way, provided
- that you insert a prominent notice in each changed file stating how and
- when you changed that file, and provided that you do at least ONE of the
- following:
- .
-     a) place your modifications in the Public Domain or otherwise make them
-     Freely Available, such as by posting said modifications to Usenet or
-     an equivalent medium, or placing the modifications on a major archive
-     site such as uunet.uu.net, or by allowing the Copyright Holder to include
-     your modifications in the Standard Version of the Package.
- .
-     b) use the modified Package only within your corporation or organization.
- .
-     c) rename any non-standard executables so the names do not conflict
-     with standard executables, which must also be provided, and provide
-     a separate manual page for each non-standard executable that clearly
-     documents how it differs from the Standard Version.
- .
-     d) make other distribution arrangements with the Copyright Holder.
- .
- 4. You may distribute the programs of this Package in object code or
- executable form, provided that you do at least ONE of the following:
- .
-     a) distribute a Standard Version of the executables and library files,
-     together with instructions (in the manual page or equivalent) on where
-     to get the Standard Version.
- .
-     b) accompany the distribution with the machine-readable source of
-     the Package with your modifications.
- .
-     c) give non-standard executables non-standard names, and clearly
-     document the differences in manual pages (or equivalent), together
-     with instructions on where to get the Standard Version.
- .
-     d) make other distribution arrangements with the Copyright Holder.
- .
- 5. You may charge a reasonable copying fee for any distribution of this
- Package.  You may charge any fee you choose for support of this
- Package.  You may not charge a fee for this Package itself.  However,
- you may distribute this Package in aggregate with other (possibly
- commercial) programs as part of a larger (possibly commercial) software
- distribution provided that you do not advertise this Package as a
- product of your own.  You may embed this Package's interpreter within
- an executable of yours (by linking); this shall be construed as a mere
- form of aggregation, provided that the complete Standard Version of the
- interpreter is so embedded.
- .
- 6. The scripts and library files supplied as input to or produced as
- output from the programs of this Package do not automatically fall
- under the copyright of this Package, but belong to whoever generated
- them, and may be sold commercially, and may be aggregated with this
- Package.  If such scripts or library files are aggregated with this
- Package via the so-called "undump" or "unexec" methods of producing a
- binary executable image, then distribution of such an image shall
- neither be construed as a distribution of this Package nor shall it
- fall under the restrictions of Paragraphs 3 and 4, provided that you do
- not represent such an executable image as a Standard Version of this
- Package.
- .
- 7. C subroutines (or comparably compiled subroutines in other
- languages) supplied by you and linked into this Package in order to
- emulate subroutines and variables of the language defined by this
- Package shall not be considered part of this Package, but are the
- equivalent of input as in Paragraph 6, provided these subroutines do
- not change the language in any way that would cause it to fail the
- regression tests for the language.
- .
- 8. Aggregation of this Package with a commercial distribution is always
- permitted provided that the use of this Package is embedded; that is,
- when no overt attempt is made to make this Package's interfaces visible
- to the end user of the commercial distribution.  Such use shall not be
- construed as a distribution of this Package.
- .
- 9. The name of the Copyright Holder may not be used to endorse or promote
- products derived from this software without specific prior written permission.
- .
- 10. THIS PACKAGE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR
- IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
- WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
- .
- The End
+ THIS PROGRAM IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR IMPLIED
+ WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+ MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+Comment:
+ On Debian systems, the complete text of the Artistic License can be
+ found in `/usr/share/common-licenses/Artistic`.
+
+License: zlib/libpng
+  This software is provided 'as-is', without any express or implied
+  warranty.  In no event will the authors be held liable for any damages
+  arising from the use of this software.
+  .
+  Permission is granted to anyone to use this software for any purpose,
+  including commercial applications, and to alter it and redistribute it
+  freely, subject to the following restrictions:
+  .
+  1. The origin of this software must not be misrepresented; you must not
+     claim that you wrote the original software. If you use this software
+     in a product, an acknowledgment in the product documentation would be
+     appreciated but is not required.
+  2. Altered source versions must be plainly marked as such, and must not be
+     misrepresented as being the original software.
+  3. This notice may not be removed or altered from any source distribution.
 
 License: public-domain
  The work is public domain (no license).
diff --git a/debian/mariadb-server.NEWS b/debian/mariadb-server.NEWS
index bdc162385ec..2718fe89d60 100644
--- a/debian/mariadb-server.NEWS
+++ b/debian/mariadb-server.NEWS
@@ -1,3 +1,157 @@
+mariadb (1:11.8.2-1) unstable; urgency=medium
+
+  MariaDB 11.8.2 was released on June 4th 2025 by the MariaDB Foundation
+  (https://mariadb.org/mariadb-11-8-2-ga-now-available/). This is the first
+  release in the 11.8 series to be announced GA (general availability). The
+  11.8 series has long-term support with commitment from the MariaDB Foundation
+  (https://mariadb.org/about/#maintenance-policy) to publish maintenance
+  versions with fixes to software defects and security vulnerabilities until
+  May 2030. Commercial extended support may be available past 2030 as well.
+
+  The previous major long-term supported MariaDB release 11.4 was available only
+  in Debian unstable and in some intermediate Ubuntu releases, so this 11.8 is
+  the first new long-term supported MariaDB release available in long-term
+  supported Debian and Ubuntu releases after MariaDB 10.11.
+
+  To learn what is new in 11.8 it is recommended to read all the previous
+  release notes since 10.11:
+  * https://mariadb.com/kb/en/changes-improvements-in-mariadb-11-0/
+  * https://mariadb.com/kb/en/changes-improvements-in-mariadb-11-1/
+  * https://mariadb.com/kb/en/changes-improvements-in-mariadb-11-2/
+  * https://mariadb.com/kb/en/what-is-mariadb-113/
+  * https://mariadb.com/kb/en/what-is-mariadb-114/
+    - also includes summary of 11.0-11.3
+  * https://mariadb.com/kb/en/changes-improvements-in-mariadb-11-5/
+  * https://mariadb.com/kb/en/changes-improvements-in-mariadb-11-6/
+  * https://mariadb.com/kb/en/changes-improvements-in-mariadb-11-7/
+  * https://mariadb.com/kb/en/changes-improvements-in-mariadb-11-8/
+    - also includes summary of 11.5-11.7
+
+  Notable new features:
+  - New vector functions and system variables to allow MariaDB to store AI
+    embeddings and search them efficiently: https://mariadb.com/kb/en/vectors/
+  - Change default Unicode collation to uca1400_ai_ci, a modern Unicode
+    collation with proper support for SMP characters (including emoji)
+  - Charset narrowing optimization by default:
+    https://mariadb.com/kb/en/charset-narrowing-optimization/
+  - Unix socket authentication now supports an authentication_string, so the
+    system username and database username can be different
+  - New authentication plugin intended to be the default in a future release:
+    https://mariadb.com/kb/en/authentication-plugin-parsec/
+  - The TIMESTAMP range of values is extended and all of MariaDB validated to
+    support running in 2038
+  - New native functions UUID_v4 and UUID_v7 to make tables that have UUIDs
+    use less space and run operations faster
+  - Multiple extensions to the JSON_* functions
+  - Major improvements to the optimizer:
+    https://mariadb.com/kb/en/the-optimizer-cost-model-from-mariadb-11-0/
+  - The 'mariadb' client has a new argument --show-query-costs to show the
+    query costs after every statement, making optimizing queries easier
+  - InnoDB change buffering removed:
+    https://mariadb.com/kb/en/innodb-change-buffering/
+  - Extended features in SQL_MODE='ORACLE' to help migrations from Oracle
+  - Online schema changes by default
+  - Automatic reclaiming of unused system table space and temporary table space
+  - Most temporary tables now visible in SHOW TABLES and SHOW TABLE STATUS
+  - New SHOW CREATE SERVER statement for easier replication management
+  - All binlog* variables now visible as system variables
+  - New database-level privilege, SHOW CREATE ROUTINE that allows one to see the
+    routine definition even if the user isn't the routine owner
+  - New view sys.privileges_by_table_by_level
+  - TLS encryption use by default expanded. Use --disable-ssl or
+    --disable-ssl-verify-server-cert to revert to the old behavior.
+  - New 'mariadb' client arguments --ssl-fp and -ssl-fplist to ensure the remote
+    server certificate matches a predefined fingerprint
+  - New mariadb-dump and mariadb-import option --parallel for faster batch
+    operations and --dir for easier large database management
+  - The xtrabackup_* files have been renamed to mariadb_backup_*
+  - Multiple occurrences of 'MySQL' has been renamed to 'MariaDB' in
+    documentation, user visible strings and commands
+
+  Things to consider when upgrading from 10.11 to 11.8 are listed on the page
+  https://mariadb.com/kb/en/upgrading-from-mariadb-10-11-to-mariadb-11-4/ and
+  https://mariadb.com/kb/en/upgrading-from-mariadb-11-4-to-mariadb-11-8/.
+
+  Removed in 11.8 (compared to 10.11):
+  - date-format, datetime-format, time-format
+  - debug-no-thread-alarm
+  - innodb-change-buffer-max-size, innodb-change-buffering
+  - innodb-defragment, innodb-defragment-fill-factor,
+    innodb-defragment-fill-factor-n-recs, innodb-defragment-frequency,
+    innodb-defragment-n-pages, innodb-defragment-stats-accuracy
+  - max-tmp-tables (use 'max-temp-*' instead)
+  - old-alter-table (use 'alter-algorithm' instead)
+  - wsrep-causal-reads, wsrep-load-data-splitting
+
+  Deprecated server variables (marked as deprecated in 11.8):
+  - alter-algorithm
+  - big-tables
+  - binlog-optimize-thread-scheduling
+  - innodb-file-per-table
+  - innodb-flush-method
+  - innodb-prefix-index-cluster-optimization
+  - keep-files-on-create
+  - language (use 'lc-messages-dir' instead)
+  - log-slow-admin-statements (use 'log-slow-filter' instead)
+  - long-query-time (use 'log-slow-query-time' instead)
+  - old (use 'old-mode' instead)
+  - optimizer-adjust-secondary-key-costs
+  - secure-auth
+
+  Changed behavior in server variables in 11.8 (compared to 10.11):
+  - binlog-row-image has new available option: FULL_NODUP
+  - collation-server defaults now to 'utf8mb4_uca1400_ai_ci'
+  - histogram-type defaults now to 'JSON_HB'
+  - innodb-doublewrite now accepts 'ON', 'OFF', 'fast' (default remains 'ON')
+  - innodb-prefix-index-cluster-optimization defaults now to FALSE (also
+    deprecated)
+  - innodb-snapshot-isolation defaults now to TRUE
+  - innodb-undo-tablespaces defaults now to 3
+  - old-mode has new available options: LOCK_ALTER_TABLE_COPY, OLD_FLUSH_STATUS,
+    SESSION_USER_IS_USER
+  - optimizer-switch has new available option: sargable_casefold
+  - optimizer-switch defaults now include: not_null_range_scan=off,
+    hash_join_cardinality=on, cset_narrowing=on, sargable_casefold=on
+    (and no longer any engine_condition_pushdown)
+  - ssl defaults to 'on'; use --skip-ssl to disable
+
+  New server variables in 11.8 (compared to 10.11):
+  - New variables to control binary logs and GTID: binlog-gtid-index,
+    binlog-gtid-index-page-size, binlog-gtid-index-span-min (control GTID
+    indexing for faster lookups); binlog-large-commit-threshold (improve
+    concurrency for large transactions); binlog-legacy-event-pos (add
+    end_log_pos to all events for compatibility); binlog-space-limit,
+    max-binlog-total-size (limit total disk space used by binary logs)
+  - block-encryption-mode: Default mode for AES_ENCRYPT/AES_DECRYPT functions
+  - character-set-collations: Override default collations for character sets
+  - innodb-data-file-buffering, innodb-data-file-write-through,
+    innodb-log-file-write-through: Control file system caching and write-through
+    behavior for InnoDB data and log files
+  - innodb-truncate-temporary-tablespace-now: Trigger immediate shrinking of the
+    temporary tablespace
+  - log-slow-always-query-time: Set a time threshold above which slow queries
+    are *always* logged, regardless of rate limits
+  - max-tmp-session-space-usage, max-tmp-total-space-usage: Limit temporary
+    file/table usage per session and globally
+  - mhnsw-default-distance, mhnsw-default-m, mhnsw-ef-search,
+    mhnsw-max-cache-size: Control parameters for the MHNSW vector index used
+    for AI embeddings
+  - optimizer-disk-read-cost, optimizer-disk-read-ratio,
+    optimizer-index-block-copy-cost, optimizer-key-compare-cost,
+    optimizer-key-copy-cost, optimizer-key-lookup-cost,
+    optimizer-key-next-find-cost, optimizer-row-copy-cost,
+    optimizer-row-lookup-cost, optimizer-row-next-find-cost,
+    optimizer-rowid-compare-cost, optimizer-rowid-copy-cost,
+    optimizer-scan-setup-cost, optimizer-where-cost: Fine-tune the optimizer's
+    cost model calculations for various operations
+  - redirect-url: URL for redirecting clients to another server
+  - slave-abort-blocking-timeout: Timeout for slave DDL waiting on blocking
+    queries
+  - slave-connections-needed-for-purge: Minimum slaves needed for automatic
+    binlog purge based on size/time limits
+
+ -- Otto Kekäläinen <otto@debian.org>  Sun, 08 Jun 2025 11:19:07 +0300
+
 mariadb (1:10.11.2-1) unstable; urgency=medium
 
   MariaDB 10.11.2 was released on February 16th 2023 by the MariaDB Foundation
diff --git a/debian/mariadb-server.README.Debian b/debian/mariadb-server.README.Debian
index 1f51ed43f43..6a9b66b0927 100644
--- a/debian/mariadb-server.README.Debian
+++ b/debian/mariadb-server.README.Debian
@@ -1,4 +1,13 @@
-* MYSQL WON'T START OR STOP?
+* WHAT TO DO AFTER UPGRADES
+===========================
+
+Please see the MariaDB package changelog to learn what is new in the latest
+Debian revision. It can be read by e.g.
+
+    zcat /usr/share/doc/mariadb-server/changelog.Debian.gz | more
+
+
+* MARIADB WON'T START OR STOP?
 ============================
 
 The most common reasons the server does not start are:
@@ -6,26 +15,42 @@ The most common reasons the server does not start are:
 - Process supervisor scripts (init, systemd etc) fail to execute normally.
 - The configuration in /etc/mysql/... is wrong and prevents server from running.
 
-First check the contents of syslog (or systemd journal) and then check the
-logs at /var/log/mysql/ for any hints of what might be wrong.
+Typically this is debugged by attempting to restart the server several times,
+and looking in the system logs what the server is reporting.
+
+Example commands when running systemd:
+
+    systemctl restart mariadb
+    systemctl status mariadb
+    journalctl -u mariadb
+
+Example commands when running rsyslogd or syslog-ng:
 
-Examples:
-  grep mysql /var/log/syslog
-  journalctl -u mariadb
+    /etc/init.d/mariadb restart
+    /etc/init.d/mariadb status
+    grep mysql /var/log/syslog
+
+If the system does not seem to have any logs visible by default, such when
+running inside a container, these commands can be used to install and activate
+rsyslog:
+
+    apt install --yes rsyslog
+    /usr/sbin/rsyslogd -n -iNONE &
 
 
 * NEW SERVICE NAME, PROCESS AND BINARY NAMES IN MARIADB 10.5
 ============================================================
 
-Starting form MariaDB 10.5, the default SysV init service name is 'mariadb',
+Starting from MariaDB 10.5, the default SysV init service name is 'mariadb',
 and can be accessed at path /etc/init.d/mariadb. The alias 'mysql' is only
 created on upgrades.
 
 On systemd services both 'mariadb' and alias 'mysql' are available all the time.
 
-Note that the new daemon name is 'mariadbd' instead of 'mysqld' and also most
-of the binaries have been renamed to mariadb-something, yet the old mysql-something
-name has been kept as a symbolic link to the new name for backwards compatibility.
+Note that the new daemon name is 'mariadbd' instead of 'mysqld' and also most of
+the binaries have been renamed to mariadb-something, yet the old mysql-something
+name has been kept as a symbolic link to the new name for backwards
+compatibility.
 
 
 * NATIVE SYSTEMD SERVICE INTRODUCED IN MARIADB 10.1
@@ -40,11 +65,12 @@ https://mariadb.com/kb/en/mariadb/systemd/
 * MIXING PACKAGES FROM MARIADB.ORG AND OFFICIAL DEBIAN REPOSITORIES
 ==================================================================
 
-Please note that the MariaDB packaging in official Debian repositories are of
-a completely new generation compared to the legacy packaging used in MariaDB.org
-repositories. You cannot mix and match MariaDB 10.1 packages from official
-Debian (or Ubuntu) repositories with packages from MariaDB.org repositories.
-Packages from the MariaDB.org repositories include the revision string '+maria'.
+Please note that the MariaDB packaging in official Debian repositories is not
+identical to that in the MariaDB.org repositories, and the packages might not be
+fully interoperable. To avoid issues, don't mix and match MariaDB packages from
+official Debian (or Ubuntu) repositories with packages from MariaDB.org
+repositories. Packages from the MariaDB.org repositories include the revision
+string '+maria'.
 
 If a MariaDB.org repository is enabled, learn to use apt pinning properly.
 
@@ -52,17 +78,114 @@ Please do not file bugs in Debian regarding packages with '+maria' in the
 revision string.
 
 
+* DOWNGRADING MAJOR VERSIONS (E.G. 11.8 -> 11.4)
+================================================
+
+Due to the nature of databases with persistent data, major version upgrades that
+alter the on-disk format will render downgrading impossible. Downgrading a major
+version in-place, such as swapping the binaries of 11.8 to 11.4 with the same
+data directory, is not possible.
+
+The only way to execute a major version downgrade is to, take a
+mariadb-dump/mariadb-backup consistent backup using the current version and
+reload after downgrading and purging existing databases.
+
+This may however not always work. It is always recommended to take a backup
+**before** attempting an upgrade, so that in case of an emergency one can
+restore to the backup.
+
+
+* DOWNGRADING MINOR VERSIONS (E.G. 11.8.2 -> 11.8.1)
+====================================================
+
+Minor versions of MariaDB do not alter the on-disk data format, and thus allow
+downgrades. However, once a new MariaDB version is available in the
+Debian/Ubuntu repositories, it is not straightforward to `apt install` the old
+version. Previous Debian packages are however available from
+https://snapshot.debian.org/ but require learning how apt pinning works to use
+correctly.
+
+
+* DEFAULT MARIADB SERVER SETTINGS ARE SECURE
+============================================
+
+For reference, these are the default users, grants and databases in a fresh
+MariaDB installation:
+
+    SELECT User,Host FROM mysql.user;
+    +-------------+-----------+
+    | User        | Host      |
+    +-------------+-----------+
+    | mariadb.sys | localhost |
+    | mysql       | localhost |
+    | root        | localhost |
+    +-------------+-----------+
+
+    SHOW GRANTS FOR 'mariadb.sys'@'localhost';
+    +----------------------------------------------------------------------------+
+    | Grants for mariadb.sys@localhost                                           |
+    +----------------------------------------------------------------------------+
+    | GRANT USAGE ON *.* TO `mariadb.sys`@`localhost`                            |
+    | GRANT SELECT, DELETE ON `mysql`.`global_priv` TO `mariadb.sys`@`localhost` |
+    +----------------------------------------------------------------------------+
+
+    SHOW GRANTS FOR 'mysql'@'localhost';
+    +------------------------------------------------------------------------------------------------------------------------------------------+
+    | Grants for mysql@localhost                                                                                                               |
+    +------------------------------------------------------------------------------------------------------------------------------------------+
+    | GRANT ALL PRIVILEGES ON *.* TO `mysql`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket WITH GRANT OPTION |
+    | GRANT PROXY ON ''@'%' TO 'mysql'@'localhost' WITH GRANT OPTION                                                                           |
+    +------------------------------------------------------------------------------------------------------------------------------------------+
+
+    SHOW GRANTS FOR 'root'@'localhost';
+    +-----------------------------------------------------------------------------------------------------------------------------------------+
+    | Grants for root@localhost                                                                                                               |
+    +-----------------------------------------------------------------------------------------------------------------------------------------+
+    | GRANT ALL PRIVILEGES ON *.* TO `root`@`localhost` IDENTIFIED VIA mysql_native_password USING 'invalid' OR unix_socket WITH GRANT OPTION |
+    | GRANT PROXY ON ''@'%' TO 'root'@'localhost' WITH GRANT OPTION                                                                           |
+    +-----------------------------------------------------------------------------------------------------------------------------------------+
+
+    SHOW DATABASES;
+    +--------------------+
+    | Database           |
+    +--------------------+
+    | information_schema |
+    | mysql              |
+    | performance_schema |
+    | sys                |
+    +--------------------+
+
+These are secure. All users are bound to localhost only. The `root` user is used
+by the Linux root user (or somebody running `sudo`) accessing MariaDB. The user
+`mysql` is used by some system automation scripts that don't need full database
+root access. The user `mariadb.sys` cannot be used to login at all, and exists
+only as an internal construct for system table access.
+
+There is absolutely no need to run the script `mariadb-secure-installation` or
+(`mysql_secure_installation`) after installing MariaDB with `apt install
+mariadb-server`. The script is useless, and very misleading with reporting
+"Success!" after every step even if it did nothing.
+
+The script claims to activate unix socket authentication for root, but
+Debian/Ubuntu has already been using it by default for over a decade. The script
+also claims to remove remote access for the root user, but the default root user
+is already bound to localhost only by default. Additionally the script claims to
+drop anonymous users and remove test databases, but there are none. The script
+itself hasn't really been maintained for over a decade, and it is best to not
+trust it in any way.
+
+
 * ROOT USER AUTHENTICATION VIA UNIX SOCKET
 ==========================================
 
 On new installs no root password is set and no debian-sys-maint user is
 created anymore. Instead the MariaDB root account is set to be authenticated
 using the Unix socket, e.g. any mysqld invocation by root or via sudo will
-let the user see the mysqld prompt.
+let the user see the mariadbd prompt.
 
-You may never ever delete the mysql user "root". Although it has no password
-is set, the unix_auth plugin ensure that it can only be run locally as the root
-user.
+You may never ever delete the MariaDB user "root". Although it has no password,
+the unix_auth plugin ensures that it can be accessed by a locally connecting
+superuser (Linux root or sudo user).
 
 The credentials in /etc/mysql/debian.cnf specify the user which is used by the
 init scripts to stop the server and perform log rotation. This used to be the
@@ -74,7 +197,7 @@ file as is has been obsoleted.
 
 If you need to do a restore of a previous `mysql_dump`/`mariadb-dump` that
 includes the `mysql.user` table from before the passwordless transition, that
-will revert you to a non-passwordless root setup (and it's various drawbacks
+will revert you to a non-passwordless root setup (and its various drawbacks
 illustrated above and below). If you'd like to restore the now-standard
 passwordless-root setup, you can do so with:
 
@@ -82,7 +205,7 @@ passwordless-root setup, you can do so with:
 
 And then drop the debian-sys-maint user with:
 
-  DROP USER 'debian-sys-maint'@'localhost' 
+  DROP USER 'debian-sys-maint'@'localhost'
 
 And then:
 
@@ -93,109 +216,101 @@ ensure you keep a mysql root connection open until you're sure the changes
 work and you can still create new root connections to your server.
 
 
-* MARIADB IS SECURE BY DEFAULT
+* ROOT USER WITH REMOTE ACCESS
 ==============================
 
-MariaDB in Debian is secure by default, because:
+This is not recommended in general, but if you specifically want the user 'root'
+to be able to access MariaDB remotely, run this to add a second 'root' entry in
+the users table that can access from any remote host and authenticate using
+password:
 
-- It only listens to the localhost socket and cannot be accessed remotely unless
-  the sysadmin changes the configuration in /etc/mysql to allow so.
-- There is no debian-sys-maint with password in /etc/mysql/debian.cnf anymore.
-- There is no root account with password anymore. The system admin needs to
-  create one themselves if they need it. With no password, all issues related
-  to password management and password leaking are gone. Sysadmins can access
-  the database without a password simply by running 'sudo mysql' thanks to
-  socket based authentication, which detects the system root user and allows
-  them to use the mysqld console as the mysql root user. For details see
-  https://www.slideshare.net/ottokekalainen/less-passwords-more-security-unix-socket-authentication-and-other-mariadb-hardening-tips
-- There is no test database nor test accounts in the out-of-the-box Debian
-  installation.
+    -- Configure root@% for remote connections using password
+    CREATE OR REPLACE USER 'root'@'%' IDENTIFIED BY 'your_secure_password';
 
-Therefore there is also no need to run the 'mysql_secure_installation'. In fact
-that script will try to do things that are already prevented, and might fail.
+    -- Grant full privileges with permission to grant more
+    GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION;
+    GRANT PROXY ON ''@'%' TO 'root'@'%' WITH GRANT OPTION;
 
+    -- Reload privilege tables
+    FLUSH PRIVILEGES;
 
-* WHAT TO DO AFTER UPGRADES
-===========================
 
-The privilege tables are automatically updated so all there is left is read
-the release notes on https://mariadb.com/kb/en/release-notes/ to see if any
-changes affect custom apps.
+* CREATING DATABASES AND USERS FOR APPS
+=======================================
 
-There should not be any need to run 'mysql_upgrade' manually, as the upgrade
-scripts do that automatically.
+On Debian/MariaDB running `apt install mariadb-server` will set up a sane and
+secure MariaDB server by default. The commands `mariadb-install-db` and
+`mariadb-upgrade` run automatically when needed.
 
+The primary tasks for the administrator is to create new users and databases,
+and add custom settings in `/etc/mysql/mariadb.conf.d/`.
 
-* WHAT TO DO AFTER INSTALLATION
-===============================
+To add a custom database for an app, and create a custom password-authenticated
+user that has full access to that database over the network, run the following
+commands using the `mariadb` client (e.g., via `sudo mariadb`):
 
-The MySQL manual describes certain steps to do at this stage in a separate
-chapter. They are not necessary as the Debian packages does them
-automatically.
+    -- Create the database
+    CREATE DATABASE app_db;
 
-There should not be any need to run 'mysql_install_db' manually, as the install
-scripts do that automatically.
+    -- Create the user 'app_user' with a secure password, allowing connections from any IP address
+    CREATE USER 'app_user'@'%' IDENTIFIED BY 'your_secure_password';
 
-The only thing that is left over for the admin is
- - creating new users and databases
- - read the rest of this text
+    -- Grant full privileges to the 'app_user' user on the 'app_db' database
+    GRANT ALL PRIVILEGES ON app_db.* TO 'app_user'@'%';
 
+    -- Reload the privilege tables to apply changes
+    FLUSH PRIVILEGES;
 
-* NETWORKING
-============
+Remember to replace 'your_secure_password' with a strong, unique password.
+Using '%' for the host allows connections from any IP address, which is less
+secure than restricting connections to a specific IP address or subnet if
+possible.
 
-For security reasons, the Debian package has enabled networking only on the
-loop-back device using "bind-address" in /etc/mysql/my.cnf.  Check with
-"netstat -tlnp" where it is listening. If your connection is aborted
-immediately check your firewall rules or network routes.
 
-* WHERE IS THE DOCUMENTATION?
-=============================
-
-https://mariadb.com/kb
-
-
-* PASSWORDS
-===========
+* REMOTE CONNECTIONS OVER THE NETWORK AND TLS
+=============================================
 
-It is recommended you create additional admin users for your database
-administration needs in addition to the default root user.
+For security reasons, the Debian package has enabled networking only on the
+loop-back device using `bind-address` in
+`/etc/mysql/mariadb.conf.d/50-server.cnf`. Check current setting by running:
 
-If your local Unix account is the one you want to have local super user
-access on your database with you can create the following account that will
-only work for the local Unix user connecting to the database locally.
+    SHOW VARIABLES LIKE 'bind_address';
 
-  sudo /usr/bin/mariadb -e "GRANT ALL ON *.* TO '$USER'@'localhost' IDENTIFIED VIA unix_socket WITH GRANT OPTION"
+Alternatively, check with `sudo netstat -tlnp` on what ports services are
+listening. If your connection is aborted immediately, check your firewall rules
+or network routes.
 
-To create a local machine account username=USERNAME with a password:
+To allow remote connections from the network, the easiest way is to create a new
+configuration file and allow the MariaDB Server to listen for remote
+connections. To ensure passwords don't leak on the network, enforce that
+connections must use TLS encryption.
 
-  sudo /usr/bin/mariadb -e "GRANT ALL ON *.* TO 'USERNAME'@'localhost' IDENTIFIED BY 'password' WITH GRANT OPTION"
+Create file `/etc/mysql/mariadb.conf.d/99-server-customizations.cnf`
+with contents:
 
-To create a USERNAME user with password 'password' admin user that can access
-the DB server over the network:
+    [mariadbd]
+    # Listen for connections from anywhere
+    bind-address = 0.0.0.0
+    # Only allow TLS encrypted connections
+    require-secure-transport = on
 
-  sudo /usr/bin/mariadb -e "GRANT ALL ON *.* TO 'USERNAME'@'%' IDENTIFIED BY 'password' WITH GRANT OPTION"
+For settings to take effect, restart the server:
 
-Scripts should run as a user who have the required grants and be identified via unix_socket.
+    systemctl restart mariadb
 
-It is wise to run scripts as the "mysql" system user. Like root,
-mysql@localhost is created by default to have all privileges in MariaDB
-and to use unix_socket authentication. But scripts running under "mysql"
-won't have system-wide root so they won't be able to corrupt your system.
+Note that in MariaDB 11.8 the TLS certificates are generated automatically, so
+there is no need to create them manually.
 
-If you are too tired to type the password in every time and unix_socket auth
-doesn't suit your needs, you can store it in the file $HOME/.my.cnf. It should
-be chmod 0600 (-rw------- username usergroup .my.cnf) to ensure that nobody else
-can read it.  Every other configuration parameter can be stored there, too.
+Test connections with e.g.
 
-For more information in the MariaDB manual in/usr/share/doc/mariadb-doc or
-https://mariadb.com/kb/en/configuring-mariadb-with-mycnf/.
+    mariadb --user=app_user --password=your_secure_password  --host=192.168.1.66 -e '\s'
+    mariadb --user=root --password=your_secure_password  --host=192.168.1.66 --ssl
 
 
-* FURTHER NOTES ON REPLICATION
-==============================
+* WARNING OF REPLICATION WITH TMPDIR
+====================================
 
-If the MySQL server is acting as a replication slave, you should not
+If the MariaDB server is acting as a replication slave, you should not
 set --tmpdir to point to a directory on a memory-based file system or to
 a directory that is cleared when the server host restarts. A replication
 slave needs some of its temporary files to survive a machine restart so
@@ -204,21 +319,13 @@ files in the temporary file directory are lost when the server restarts,
 replication fails.
 
 
-* DOWNGRADING
-=============
-
-Unsupported. Period.
-
-You might get lucky downgrading a few minor versions without issued. Take a
-backup first. If you break it you get to keep both pieces. Do a restore from
-backup or upgrade to the previous version.
-
-If doing a major version downgrade, take a mysqldump/maria-backup consistent
-backup using the current version and reload after downgrading and purging
-existing databases.
-
-
 * BACKUPS
 =========
 
 Backups save jobs. Don't get caught without one.
+
+
+* WHERE IS THE DOCUMENTATION?
+=============================
+
+Read more at https://mariadb.com/kb
diff --git a/debian/mariadb-server.lintian-overrides b/debian/mariadb-server.lintian-overrides
index 6d2a6ad0110..bff5f7537e0 100644
--- a/debian/mariadb-server.lintian-overrides
+++ b/debian/mariadb-server.lintian-overrides
@@ -18,5 +18,3 @@ executable-in-usr-lib [usr/lib/mysql/plugin/auth_pam_tool_dir/auth_pam_tool]
 uses-dpkg-database-directly [postinst]
 # New issue in summer of 2024, perhaps due to dependency update and should be investigated
 library-not-linked-against-libc [usr/lib/mysql/plugin/metadata_lock_info.so]
-# Lintian check outdated, does not detect new path /usr/lib/lsb/init-functions
-init.d-script-does-not-source-init-functions [etc/init.d/mariadb]
diff --git a/debian/patches/1063738-x32-compile-time-assert.patch b/debian/patches/1063738-x32-compile-time-assert.patch
index d6c96d4fc28..b7ec5b83a25 100644
--- a/debian/patches/1063738-x32-compile-time-assert.patch
+++ b/debian/patches/1063738-x32-compile-time-assert.patch
@@ -18,15 +18,15 @@ Forwarded: no
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/tests/mysql_client_fw.c b/tests/mysql_client_fw.c
-index 9f0faf8..b8794d0 100644
+index 1c71ac8..e192287 100644
 --- a/tests/mysql_client_fw.c
 +++ b/tests/mysql_client_fw.c
-@@ -1442,7 +1442,7 @@ int main(int argc, char **argv)
-   this limited check is enough, if sizeof(MYSQL) changes, it changes
-   everywhere
+@@ -1444,7 +1444,7 @@ int main(int argc, char **argv)
  */
--#if defined __x86_64__
-+#if defined(__x86_64__) && !defined(__ILP32__)
+ #if defined _M_AMD64
+   compile_time_assert(sizeof(MYSQL) == 1208);
+-#elif defined __x86_64__
++#elif defined(__x86_64__) && !defined(__ILP32__)
    compile_time_assert(sizeof(MYSQL) == 1272);
  #elif defined __i386__
    compile_time_assert(sizeof(MYSQL) == 964);
diff --git a/debian/patches/1084293-allow-cest-in-timezone-test.patch b/debian/patches/1084293-allow-cest-in-timezone-test.patch
deleted file mode 100644
index a80ffa68c2f..00000000000
--- a/debian/patches/1084293-allow-cest-in-timezone-test.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From: Sergei Golubchik <serg@mariadb.org>
-Date: Mon, 31 Mar 2025 11:10:12 +0200
-Subject: fix main.timezone test for DST
-
-Origin: https://github.com/MariaDB/server/commit/402595f138db92a3bf7e67f30e24f682e6c3ca82.patch
-Forwarded: https://github.com/MariaDB/server/commit/402595f138db92a3bf7e67f30e24f682e6c3ca82
----
- mysql-test/main/timezone.test | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/mysql-test/main/timezone.test b/mysql-test/main/timezone.test
-index 0fa50b7..fb03889 100644
---- a/mysql-test/main/timezone.test
-+++ b/mysql-test/main/timezone.test
-@@ -8,7 +8,7 @@ select FROM_UNIXTIME(24*3600);
- enable_query_log;
- 
- # The following is because of daylight saving time
----replace_result MEST CET MET CET
-+--replace_result MEST CET MET CET CEST CET
- show variables like "system_time_zone";
- 
- --echo #
diff --git a/debian/patches/1095286-pcre-tests-case-confusion.patch b/debian/patches/1095286-pcre-tests-case-confusion.patch
deleted file mode 100644
index 17841ae733a..00000000000
--- a/debian/patches/1095286-pcre-tests-case-confusion.patch
+++ /dev/null
@@ -1,104 +0,0 @@
-From: Matthew Vernon <matthew@debian.org>
-Date: Thu, 6 Feb 2025 14:44:19 +0000
-Subject: Update PCRE tests to fix case confusion (Closes: #1095286)
-MIME-Version: 1.0
-Content-Type: text/plain; charset="utf-8"
-Content-Transfer-Encoding: 8bit
-
-MariaDB RLIKE is case-insensitive; in perl the Unicode character
-property tests \p{Lu} and \p{Ll} are equivalent to \p{L&} in
-case-insensitive matches. So remove those tests (since there is
-already the \p{L&} test).
-
-This fixes a FTBFS with PCRE2 10.45 which fixed its handling of Ll Lt
-and Lu under case-insensitive matching to match perl's behaviour.
-
-Example of failure seen in MTR:
-
-    main.func_regexp_pcre                    w4 [ fail ]
-            Test ended at 2025-02-06 07:00:25
-    CURRENT_TEST: main.func_regexp_pcre
-    @@ -169,13 +169,13 @@
-     \p{Latin}	㐗	0
-     \p{Latin}	갷	0
-     \p{Ll}	1	0
-    -\p{Ll}	A	0
-    +\p{Ll}	A	1
-     \p{Ll}	a	1
-    -\p{Ll}	À	0
-    +\p{Ll}	À	1
-     \p{Ll}	à	1
-    -\p{Ll}	Σ	0
-    +\p{Ll}	Σ	1
-     \p{Ll}	σ	1
-    -\p{Ll}	Я	0
-    +\p{Ll}	Я	1
-     \p{Ll}	я	1
-     \p{Ll}	௨	0
-     \p{Ll}	ප	0
-
-Forwarded: no
----
- mysql-test/main/func_regexp_pcre.result | 28 +---------------------------
- mysql-test/main/func_regexp_pcre.test   |  2 +-
- 2 files changed, 2 insertions(+), 28 deletions(-)
-
-diff --git a/mysql-test/main/func_regexp_pcre.result b/mysql-test/main/func_regexp_pcre.result
-index 3085d2a..eda2e9d 100644
---- a/mysql-test/main/func_regexp_pcre.result
-+++ b/mysql-test/main/func_regexp_pcre.result
-@@ -60,7 +60,7 @@ INSERT INTO t1 VALUES ('1'),('௨');
- INSERT INTO t2 VALUES ('\\p{Cyrillic}'),('\\p{Greek}'),('\\p{Latin}');
- INSERT INTO t2 VALUES ('\\p{Han}'),('\\p{Hangul}');
- INSERT INTO t2 VALUES ('\\p{Sinhala}'), ('\\p{Tamil}');
--INSERT INTO t2 VALUES ('\\p{L}'),('\\p{Ll}'),('\\p{Lu}'),('\\p{L&}');
-+INSERT INTO t2 VALUES ('\\p{L}'),('\\p{L&}');
- INSERT INTO t2 VALUES ('[[:alpha:]]'),('[[:digit:]]');
- SELECT class, ch, ch RLIKE class FROM t1, t2 ORDER BY BINARY class, BINARY ch;
- class	ch	ch RLIKE class
-@@ -168,32 +168,6 @@ class	ch	ch RLIKE class
- \p{Latin}	ප	0
- \p{Latin}	㐗	0
- \p{Latin}	갷	0
--\p{Ll}	1	0
--\p{Ll}	A	0
--\p{Ll}	a	1
--\p{Ll}	À	0
--\p{Ll}	à	1
--\p{Ll}	Σ	0
--\p{Ll}	σ	1
--\p{Ll}	Я	0
--\p{Ll}	я	1
--\p{Ll}	௨	0
--\p{Ll}	ප	0
--\p{Ll}	㐗	0
--\p{Ll}	갷	0
--\p{Lu}	1	0
--\p{Lu}	A	1
--\p{Lu}	a	0
--\p{Lu}	À	1
--\p{Lu}	à	0
--\p{Lu}	Σ	1
--\p{Lu}	σ	0
--\p{Lu}	Я	1
--\p{Lu}	я	0
--\p{Lu}	௨	0
--\p{Lu}	ප	0
--\p{Lu}	㐗	0
--\p{Lu}	갷	0
- \p{L}	1	0
- \p{L}	A	1
- \p{L}	a	1
-diff --git a/mysql-test/main/func_regexp_pcre.test b/mysql-test/main/func_regexp_pcre.test
-index 53280b7..4d5b4ad 100644
---- a/mysql-test/main/func_regexp_pcre.test
-+++ b/mysql-test/main/func_regexp_pcre.test
-@@ -41,7 +41,7 @@ INSERT INTO t1 VALUES ('1'),('௨');
- INSERT INTO t2 VALUES ('\\p{Cyrillic}'),('\\p{Greek}'),('\\p{Latin}');
- INSERT INTO t2 VALUES ('\\p{Han}'),('\\p{Hangul}');
- INSERT INTO t2 VALUES ('\\p{Sinhala}'), ('\\p{Tamil}');
--INSERT INTO t2 VALUES ('\\p{L}'),('\\p{Ll}'),('\\p{Lu}'),('\\p{L&}');
-+INSERT INTO t2 VALUES ('\\p{L}'),('\\p{L&}');
- INSERT INTO t2 VALUES ('[[:alpha:]]'),('[[:digit:]]');
- # Use "ORDER BY BINARY" to avoid dependency on the default utf8 collation
- SELECT class, ch, ch RLIKE class FROM t1, t2 ORDER BY BINARY class, BINARY ch;
diff --git a/debian/patches/1101397-revert-CONC-710.patch b/debian/patches/1101397-revert-CONC-710.patch
deleted file mode 100644
index 3031062b64c..00000000000
--- a/debian/patches/1101397-revert-CONC-710.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From: Georg Richter <georg@mariadb.com>
-Date: Tue, 18 Feb 2025 16:19:50 +0100
-Subject: Revert "CONC-710: Remove UDF declarations"
-
-Since UDF declarations are used  e.g. by lib_mysqludf_sys, I'm reverting
-this commit. (See also CONC-757).
-
-This reverts (mariadb-connector-c) commit 1a2ed3f67af698b394b2faed069b49d4f409a155.
-
-Closes: Debian Bug#1101397
-Forwarded: https://github.com/mariadb-corporation/mariadb-connector-c/commit/d4eec05d00ce77d2bab3848ff49d04acf0ed2cc0
----
- libmariadb/include/mariadb_com.h | 26 ++++++++++++++++++++++++--
- 1 file changed, 24 insertions(+), 2 deletions(-)
-
-diff --git a/libmariadb/include/mariadb_com.h b/libmariadb/include/mariadb_com.h
-index 8e89c24..63185db 100644
---- a/libmariadb/include/mariadb_com.h
-+++ b/libmariadb/include/mariadb_com.h
-@@ -52,8 +52,6 @@
- #define MYSQL_AUTODETECT_CHARSET_NAME "auto"
- #define BINCMP_FLAG       131072
- 
--enum Item_result {STRING_RESULT,REAL_RESULT,INT_RESULT,ROW_RESULT,DECIMAL_RESULT};
--
- enum mysql_enum_shutdown_level
- {
-   SHUTDOWN_DEFAULT = 0,
-@@ -429,6 +427,30 @@ struct rand_struct {
-   double max_value_dbl;
- };
- 
-+  /* The following is for user defined functions */
-+
-+enum Item_result {STRING_RESULT,REAL_RESULT,INT_RESULT,ROW_RESULT,DECIMAL_RESULT};
-+
-+typedef struct st_udf_args
-+{
-+  unsigned int arg_count;		/* Number of arguments */
-+  enum Item_result *arg_type;		/* Pointer to item_results */
-+  char **args;				/* Pointer to argument */
-+  unsigned long *lengths;		/* Length of string arguments */
-+  char *maybe_null;			/* Set to 1 for all maybe_null args */
-+} UDF_ARGS;
-+
-+  /* This holds information about the result */
-+
-+typedef struct st_udf_init
-+{
-+  my_bool maybe_null;			/* 1 if function can return NULL */
-+  unsigned int decimals;		/* for real functions */
-+  unsigned int max_length;		/* For string functions */
-+  char	  *ptr;				/* free pointer for function data */
-+  my_bool const_item;			/* 0 if result is independent of arguments */
-+} UDF_INIT;
-+
- /* Connection types */
- #define MARIADB_CONNECTION_UNIXSOCKET   0
- #define MARIADB_CONNECTION_TCP          1
diff --git a/debian/patches/Fix-misc-spelling-in-MariaDB-Server-repository.patch b/debian/patches/Fix-misc-spelling-in-MariaDB-Server-repository.patch
index b2c65189825..b48eaa250ef 100644
--- a/debian/patches/Fix-misc-spelling-in-MariaDB-Server-repository.patch
+++ b/debian/patches/Fix-misc-spelling-in-MariaDB-Server-repository.patch
@@ -36,7 +36,7 @@ Forwarded: no
  12 files changed, 24 insertions(+), 23 deletions(-)
 
 diff --git a/extra/mariabackup/innobackupex.cc b/extra/mariabackup/innobackupex.cc
-index 60c3854..bb5656a 100644
+index 22f4dc3..1c0bc11 100644
 --- a/extra/mariabackup/innobackupex.cc
 +++ b/extra/mariabackup/innobackupex.cc
 @@ -188,7 +188,7 @@ enum innobackupex_options
@@ -58,10 +58,10 @@ index 60c3854..bb5656a 100644
           "terminates with an error. Default is 0, in which case mariadb-backup waits "
           "indefinitely for BACKUP STAGE START to finish",
 diff --git a/extra/mariabackup/xtrabackup.cc b/extra/mariabackup/xtrabackup.cc
-index 34d6314..d0b60a1 100644
+index 7751bc5..41e257f 100644
 --- a/extra/mariabackup/xtrabackup.cc
 +++ b/extra/mariabackup/xtrabackup.cc
-@@ -219,7 +219,7 @@ uint xtrabackup_compress = FALSE;
+@@ -217,7 +217,7 @@ uint xtrabackup_compress = FALSE;
  uint xtrabackup_compress_threads;
  ulonglong xtrabackup_compress_chunk_size = 0;
  
@@ -79,7 +79,7 @@ index 34d6314..d0b60a1 100644
       "If there are still such queries when the timeout expires, mariadb-backup "
       "terminates with an error. Default is 0, in which case mariadb-backup waits "
       "indefinitely for BACKUP STAGE START to finish",
-@@ -5799,7 +5799,7 @@ void CorruptedPages::backup_fix_ddl(ds_ctxt *ds_data, ds_ctxt *ds_meta)
+@@ -5812,7 +5812,7 @@ void CorruptedPages::backup_fix_ddl(ds_ctxt *ds_data, ds_ctxt *ds_meta)
  	}
  
  	/* Mariabackup doesn't detect any FILE_OP for the deferred
@@ -115,10 +115,10 @@ index 00fbdf5..02e27c2 100644
   Cost of checking a key against the end key condition
   --optimizer-key-copy-cost=# 
 diff --git a/mysql-test/suite/sys_vars/r/sysvars_innodb.result b/mysql-test/suite/sys_vars/r/sysvars_innodb.result
-index fe7c07c..0d58133 100644
+index 1043684..714c317 100644
 --- a/mysql-test/suite/sys_vars/r/sysvars_innodb.result
 +++ b/mysql-test/suite/sys_vars/r/sysvars_innodb.result
-@@ -528,7 +528,7 @@ SESSION_VALUE	NULL
+@@ -552,7 +552,7 @@ SESSION_VALUE	NULL
  DEFAULT_VALUE	OFF
  VARIABLE_SCOPE	GLOBAL
  VARIABLE_TYPE	BOOLEAN
@@ -176,10 +176,10 @@ index 4ad0540..873e56a 100644
    }
  
 diff --git a/sql/sql_select.cc b/sql/sql_select.cc
-index c14afdc..d3e5d38 100644
+index e40a5b5..074b677 100644
 --- a/sql/sql_select.cc
 +++ b/sql/sql_select.cc
-@@ -11745,7 +11745,7 @@ double recompute_join_cost_with_limit(const JOIN *join, bool skip_sorting,
+@@ -11749,7 +11749,7 @@ double recompute_join_cost_with_limit(const JOIN *join, bool skip_sorting,
  
  /*
    @brief
@@ -188,7 +188,7 @@ index c14afdc..d3e5d38 100644
      execution.
  
    @detail
-@@ -15185,7 +15185,7 @@ void JOIN::drop_unused_derived_keys()
+@@ -15219,7 +15219,7 @@ void JOIN::drop_unused_derived_keys()
        }
        /*
          We dropped all keys except the chosen one and unique keys.
@@ -198,7 +198,7 @@ index c14afdc..d3e5d38 100644
        tab->ref.key= 0;
      }
 diff --git a/sql/sys_vars.cc b/sql/sys_vars.cc
-index 4e4a77e..230b614 100644
+index c8f6bb6..a7b3a65 100644
 --- a/sql/sys_vars.cc
 +++ b/sql/sys_vars.cc
 @@ -2958,7 +2958,7 @@ static Sys_var_ulong Sys_optimizer_selectivity_sampling_limit(
@@ -224,10 +224,10 @@ index 520b82d..a782570 100644
  	} catch (const char *msg) {
  		htrc(g->Message, msg);
 diff --git a/storage/innobase/handler/ha_innodb.cc b/storage/innobase/handler/ha_innodb.cc
-index 0d26b70..62d67f1 100644
+index b4e6112..e632cb0 100644
 --- a/storage/innobase/handler/ha_innodb.cc
 +++ b/storage/innobase/handler/ha_innodb.cc
-@@ -19898,7 +19898,7 @@ static MYSQL_SYSVAR_BOOL(immediate_scrub_data_uncompressed,
+@@ -19892,7 +19892,7 @@ static MYSQL_SYSVAR_BOOL(immediate_scrub_data_uncompressed,
  
  static MYSQL_SYSVAR_BOOL(encrypt_temporary_tables, innodb_encrypt_temporary_tables,
    PLUGIN_VAR_OPCMDARG | PLUGIN_VAR_READONLY,
diff --git a/debian/patches/Improve-output-from-mariadb-secure-installation-to-be-mor.patch b/debian/patches/Improve-output-from-mariadb-secure-installation-to-be-mor.patch
new file mode 100644
index 00000000000..d50214c1190
--- /dev/null
+++ b/debian/patches/Improve-output-from-mariadb-secure-installation-to-be-mor.patch
@@ -0,0 +1,82 @@
+From: =?utf-8?b?T3R0byBLZWvDpGzDpGluZW4=?= <otto@debian.org>
+Date: Wed, 4 Jun 2025 14:46:31 +0300
+Subject: Improve output from mariadb-secure-installation to be more honest
+
+The script is not useful in Debian, and likely misleading to users.
+Improve the output to be more clear about what it is doing or is not
+doing.
+---
+ scripts/mysql_secure_installation.sh | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/scripts/mysql_secure_installation.sh b/scripts/mysql_secure_installation.sh
+index ad18385..1248103 100644
+--- a/scripts/mysql_secure_installation.sh
++++ b/scripts/mysql_secure_installation.sh
+@@ -338,7 +338,8 @@ set_root_password() {
+ remove_anonymous_users() {
+     do_query "DELETE FROM mysql.global_priv WHERE User='';"
+     if [ $? -eq 0 ]; then
+-	echo " ... Success!"
++  echo "SQL executed without errors!"
++  echo "The operation might have been successful, or it might have not done anything."
+     else
+ 	echo " ... Failed!"
+ 	clean_and_exit
+@@ -350,7 +351,8 @@ remove_anonymous_users() {
+ remove_remote_root() {
+     do_query "DELETE FROM mysql.global_priv WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');"
+     if [ $? -eq 0 ]; then
+-	echo " ... Success!"
++  echo "SQL executed without errors!"
++  echo "The operation might have been successful, or it might have not done anything."
+     else
+ 	echo " ... Failed!"
+     fi
+@@ -360,7 +362,8 @@ remove_test_database() {
+     echo " - Dropping test database..."
+     do_query "DROP DATABASE IF EXISTS test;"
+     if [ $? -eq 0 ]; then
+-	echo " ... Success!"
++  echo "SQL executed without errors!"
++  echo "The operation might have been successful, or it might have not done anything."
+     else
+ 	echo " ... Failed!  Not critical, keep moving..."
+     fi
+@@ -368,7 +371,8 @@ remove_test_database() {
+     echo " - Removing privileges on test database..."
+     do_query "DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%'"
+     if [ $? -eq 0 ]; then
+-	echo " ... Success!"
++  echo "SQL executed without errors!"
++  echo "The operation might have been successful, or it might have not done anything."
+     else
+ 	echo " ... Failed!  Not critical, keep moving..."
+     fi
+@@ -413,12 +417,12 @@ prepare
+ set_echo_compat
+ 
+ echo
+-echo "NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB"
+-echo "      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!"
++echo "NOTE: MariaDB is secure by default in Debian. Running this script is"
++echo "      useless at best, and misleading at worst. This script will be"
++echo "      removed in a future MariaDB release in Debian. Please read"
++echo "      mariadb-server.README.Debian for details."
+ echo
+-echo "In order to log into MariaDB to secure it, we'll need the current"
+-echo "password for the root user. If you've just installed MariaDB, and"
+-echo "haven't set the root password yet, you should just press enter here."
++echo "Enter root user password or leave blank:"
+ echo
+ 
+ get_root_password
+@@ -450,7 +454,7 @@ else
+   emptypass=0
+   do_query "UPDATE mysql.global_priv SET priv=json_set(priv, '$.password_last_changed', UNIX_TIMESTAMP(), '$.plugin', 'mysql_native_password', '$.authentication_string', 'invalid', '$.auth_or', json_array(json_object(), json_object('plugin', 'unix_socket'))) WHERE User='root';"
+   if [ $? -eq 0 ]; then
+-   echo "Enabled successfully!"
++   echo "Enabled successfully (or at least no errors was emitted)!"
+    echo "Reloading privilege tables.."
+    reload_privilege_tables
+    if [ $? -eq 1 ]; then
diff --git a/debian/patches/MDEV-36009-Systemd-Restart-on-OOM.patch b/debian/patches/MDEV-36009-Systemd-Restart-on-OOM.patch
deleted file mode 100644
index e3701979dc4..00000000000
--- a/debian/patches/MDEV-36009-Systemd-Restart-on-OOM.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From: Sam Bull <git@sambull.org>
-Date: Tue, 5 Nov 2024 12:44:58 +0000
-Subject: MDEV-36009: Systemd: Restart on OOM
-
-Per https://github.com/systemd/systemd/issues/36529 OOM counts
-as a on-abnormal condition. To ensure that MariaDB testart on
-OOM the Restart is changes to on-abnormal which an extension
-on the current on-abort condition.
-
-(cherry-picked from 839828e57fdf734b15c81cb9cb76d3760a9161f1)
-
-Closes Debian Bug#1073847.
-
-Forwarded: https://github.com/MariaDB/server/pull/3611
----
- support-files/mariadb.service.in  | 2 +-
- support-files/mariadb@.service.in | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/support-files/mariadb.service.in b/support-files/mariadb.service.in
-index 0aa157d..3c16a46 100644
---- a/support-files/mariadb.service.in
-+++ b/support-files/mariadb.service.in
-@@ -108,7 +108,7 @@ SendSIGKILL=no
- 
- # Restart crashed server only, on-failure would also restart, for example, when
- # my.cnf contains unknown option
--Restart=on-abort
-+Restart=on-abnormal
- RestartSec=5s
- 
- UMask=007
-diff --git a/support-files/mariadb@.service.in b/support-files/mariadb@.service.in
-index 31f1586..0c5372c 100644
---- a/support-files/mariadb@.service.in
-+++ b/support-files/mariadb@.service.in
-@@ -219,7 +219,7 @@ SendSIGKILL=no
- 
- # Restart crashed server only, on-failure would also restart, for example, when
- # my.cnf contains unknown option
--Restart=on-abort
-+Restart=on-abnormal
- RestartSec=5s
- 
- UMask=007
diff --git a/debian/patches/MDEV-36334-test-main.func_format-fails-on-i386-on-exabyte.patch b/debian/patches/MDEV-36334-test-main.func_format-fails-on-i386-on-exabyte.patch
deleted file mode 100644
index 8f615854535..00000000000
--- a/debian/patches/MDEV-36334-test-main.func_format-fails-on-i386-on-exabyte.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From: Sergei Golubchik <serg@mariadb.org>
-Date: Wed, 2 Apr 2025 18:06:29 +0200
-Subject: MDEV-36334 test main.func_format fails on i386 on exabyte/petabyte
- mismatch
-
-snprintf below uses %4.2f. values above 1023.99 MiB should be shown
-as 1.00 GiB not as 1024.00 MiB
-
-(cherry picked from commit e5574d8b94681755becead56fa67c95792f83668)
-
-Origin: upstream, https://github.com/MariaDB/server/commit/e5574d8b94681755becead56fa67c95792f83668
-Bug: https://jira.mariadb.org/browse/MDEV-36334
----
- mysql-test/main/func_format.result | 8 ++++----
- sql/item_strfunc.cc                | 5 ++++-
- 2 files changed, 8 insertions(+), 5 deletions(-)
-
-diff --git a/mysql-test/main/func_format.result b/mysql-test/main/func_format.result
-index eb0ee1d..c1b7389 100644
---- a/mysql-test/main/func_format.result
-+++ b/mysql-test/main/func_format.result
-@@ -248,7 +248,7 @@ format_bytes(1024 * 1024 - 200)
- 
- SELECT format_bytes(1024 * 1024 - 1);
- format_bytes(1024 * 1024 - 1)
--1024.00 KiB
-+1.00 MiB
- 
- SELECT format_bytes(1024 * 1024);
- format_bytes(1024 * 1024)
-@@ -264,7 +264,7 @@ format_bytes(1024 * 1024 + 200)
- 
- SELECT format_bytes(1024 * 1024 * 1024 - 1);
- format_bytes(1024 * 1024 * 1024 - 1)
--1024.00 MiB
-+1.00 GiB
- 
- SELECT format_bytes(1024 * 1024 * 1024);
- format_bytes(1024 * 1024 * 1024)
-@@ -276,7 +276,7 @@ format_bytes(1024 * 1024 * 1024 + 1)
- 
- SELECT format_bytes(1024 * 1024 * 1024 * 1024 - 1);
- format_bytes(1024 * 1024 * 1024 * 1024 - 1)
--1024.00 GiB
-+1.00 TiB
- 
- SELECT format_bytes(1024 * 1024 * 1024 * 1024);
- format_bytes(1024 * 1024 * 1024 * 1024)
-@@ -288,7 +288,7 @@ format_bytes(1024 * 1024 * 1024 * 1024 + 1)
- 
- SELECT format_bytes(1024 * 1024 * 1024 * 1024 * 1024 - 1);
- format_bytes(1024 * 1024 * 1024 * 1024 * 1024 - 1)
--1024.00 TiB
-+1.00 PiB
- 
- SELECT format_bytes(1024 * 1024 * 1024 * 1024 * 1024);
- format_bytes(1024 * 1024 * 1024 * 1024 * 1024)
-diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc
-index ef95894..51b1cdd 100644
---- a/sql/item_strfunc.cc
-+++ b/sql/item_strfunc.cc
-@@ -6155,7 +6155,10 @@ String *Item_func_format_bytes::val_str_ascii(String *)
-   if (null_value)
-     return 0;
- 
--  double bytes_abs= fabs(bytes);
-+  /*
-+    snprintf below uses %4.2f, so 1023.99 MiB should be shown as 1.00 GiB
-+  */
-+  double bytes_abs= fabs(bytes)/1023.995*1024;
- 
-   constexpr uint64_t kib{1024};
-   constexpr uint64_t mib{1024 * kib};
diff --git a/debian/patches/env-perl-usr-bin-perl.patch b/debian/patches/env-perl-usr-bin-perl.patch
index cc87c4aea48..f8d833fc39a 100644
--- a/debian/patches/env-perl-usr-bin-perl.patch
+++ b/debian/patches/env-perl-usr-bin-perl.patch
@@ -54,7 +54,7 @@ index 3ccf965..ef7d974 100755
  # Copyright (c) 2005, 2011, Oracle and/or its affiliates. All rights reserved.
  #
 diff --git a/mysql-test/mariadb-test-run.pl b/mysql-test/mariadb-test-run.pl
-index afe13a8..91e3adb 100755
+index 4e9aa8b..beb44f4 100755
 --- a/mysql-test/mariadb-test-run.pl
 +++ b/mysql-test/mariadb-test-run.pl
 @@ -1,4 +1,4 @@
diff --git a/debian/patches/fix-reproducible-builds-rocksdb.patch b/debian/patches/fix-reproducible-builds-rocksdb.patch
deleted file mode 100644
index cb90336c54c..00000000000
--- a/debian/patches/fix-reproducible-builds-rocksdb.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From: Otto Kekalainen <otto@debian.org>
-Date: Tue, 29 Jun 2021 21:08:05 -0700
-Subject: Make RocksDB build reproducible
-
-The RocksDB binary included a string with the build timestamp:
-> rocksdb_build_git_date:@2021-05-23-16:04:38@
-
-As this changes from build to build, it makes the builds unreproducible.
-Simply removing it solves the issue.
-
-This temporary fix can be removed when a proper fix already done in upstream
-lands in MariaDB when the RocksDB submodule is updated to a newer release.
-
-Origin: https://github.com/facebook/rocksdb/commit/0a9a05ae12943b1529ef1eabbca5ce5a71c986bf
-Bug: https://github.com/facebook/rocksdb/issues/7035
-# Merged in RocksDB 6.19.3, but not updated into MariaDB yet
----
- storage/rocksdb/rocksdb/util/build_version.cc.in | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/storage/rocksdb/rocksdb/util/build_version.cc.in b/storage/rocksdb/rocksdb/util/build_version.cc.in
-index 8569580..56a1235 100644
---- a/storage/rocksdb/rocksdb/util/build_version.cc.in
-+++ b/storage/rocksdb/rocksdb/util/build_version.cc.in
-@@ -1,5 +1,5 @@
- // Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved.
- #include "build_version.h"
--const char* rocksdb_build_git_sha = "rocksdb_build_git_sha:@@GIT_SHA@@";
--const char* rocksdb_build_git_date = "rocksdb_build_git_date:@@GIT_DATE_TIME@@";
--const char* rocksdb_build_compile_date = __DATE__;
-+const char* rocksdb_build_git_sha = "rocksdb_build_git_sha:REDACTED";
-+const char* rocksdb_build_git_date = "rocksdb_build_git_date:REDACTED";
-+const char* rocksdb_build_compile_date = "REDACTED";
diff --git a/debian/patches/fix-spelling-rocksdb.patch b/debian/patches/fix-spelling-rocksdb.patch
deleted file mode 100644
index 056cc88a660..00000000000
--- a/debian/patches/fix-spelling-rocksdb.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From: Otto Kekalainen <otto@debian.org>
-Date: Wed, 2 Mar 2022 18:13:18 -0800
-Subject: Fix various spelling errors still found in code
-
-Two upstream PRs remain that have been merged, but not imported on MariaDB yet.
-
-Forwarded: https://github.com/facebook/rocksdb/pull/9653
-Origin: https://patch-diff.githubusercontent.com/raw/facebook/rocksdb/pull/9653.patch
-# Merged in RocksDB 7.3.1, but not updated into MariaDB yet
----
- storage/rocksdb/rocksdb/db/external_sst_file_ingestion_job.cc | 4 ++--
- storage/rocksdb/rocksdb/include/rocksdb/cache.h               | 2 +-
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/storage/rocksdb/rocksdb/db/external_sst_file_ingestion_job.cc b/storage/rocksdb/rocksdb/db/external_sst_file_ingestion_job.cc
-index 4cec5d3..86aec50 100644
---- a/storage/rocksdb/rocksdb/db/external_sst_file_ingestion_job.cc
-+++ b/storage/rocksdb/rocksdb/db/external_sst_file_ingestion_job.cc
-@@ -46,7 +46,7 @@ Status ExternalSstFileIngestionJob::Prepare(
-             TablePropertiesCollectorFactory::Context::kUnknownColumnFamily &&
-         f.cf_id != cfd_->GetID()) {
-       return Status::InvalidArgument(
--          "External file column family id dont match");
-+          "External file column family id don't match");
-     }
-   }
- 
-@@ -646,7 +646,7 @@ Status ExternalSstFileIngestionJob::AssignGlobalSeqnoForIngestedFile(
-     return Status::InvalidArgument("Global seqno is required, but disabled");
-   } else if (file_to_ingest->global_seqno_offset == 0) {
-     return Status::InvalidArgument(
--        "Trying to set global seqno for a file that dont have a global seqno "
-+        "Trying to set global seqno for a file that don't have a global seqno "
-         "field");
-   }
- 
-diff --git a/storage/rocksdb/rocksdb/include/rocksdb/cache.h b/storage/rocksdb/rocksdb/include/rocksdb/cache.h
-index 77ddf52..ee27538 100644
---- a/storage/rocksdb/rocksdb/include/rocksdb/cache.h
-+++ b/storage/rocksdb/rocksdb/include/rocksdb/cache.h
-@@ -60,7 +60,7 @@ struct LRUCacheOptions {
-   // If greater than zero, the LRU list will be split into a high-pri
-   // list and a low-pri list. High-pri entries will be insert to the
-   // tail of high-pri list, while low-pri entries will be first inserted to
--  // the low-pri list (the midpoint). This is refered to as
-+  // the low-pri list (the midpoint). This is referred to as
-   // midpoint insertion strategy to make entries never get hit in cache
-   // age out faster.
-   //
diff --git a/debian/patches/install-files-into-usr.patch b/debian/patches/install-files-into-usr.patch
index ed1e0ec83f0..796b7314c8f 100644
--- a/debian/patches/install-files-into-usr.patch
+++ b/debian/patches/install-files-into-usr.patch
@@ -6,7 +6,7 @@ Since Debian trixie all files need to be installed into their canonical
 location under /usr.
 
 Origin: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1061348
-Forwarded: no
+Forwarded: https://github.com/MariaDB/server/pull/4065
 ---
  cmake/install_layout.cmake | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/debian/patches/mroonga-mrn-lib-dirs-path-reproducible-build.patch b/debian/patches/mroonga-mrn-lib-dirs-path-reproducible-build.patch
index d2529a95dc8..3f77d7239c0 100644
--- a/debian/patches/mroonga-mrn-lib-dirs-path-reproducible-build.patch
+++ b/debian/patches/mroonga-mrn-lib-dirs-path-reproducible-build.patch
@@ -13,10 +13,10 @@ Forwarded: not-needed
  1 file changed, 4 insertions(+), 8 deletions(-)
 
 diff --git a/storage/mroonga/CMakeLists.txt b/storage/mroonga/CMakeLists.txt
-index d39e628..5bb2e2c 100644
+index bdda771..14e9f49 100644
 --- a/storage/mroonga/CMakeLists.txt
 +++ b/storage/mroonga/CMakeLists.txt
-@@ -213,7 +213,7 @@ set(MYSQL_INCLUDE_DIRS
+@@ -214,7 +214,7 @@ set(MYSQL_INCLUDE_DIRS
  
  if(MRN_BUNDLED)
    set(MYSQL_PLUGIN_DIR "${INSTALL_PLUGINDIR}")
@@ -25,7 +25,7 @@ index d39e628..5bb2e2c 100644
    set(MYSQL_CFLAGS "${CMAKE_C_FLAGS}")
    set(MYSQL_VERSION "${MYSQL_BASE_VERSION}")
  else()
-@@ -252,15 +252,11 @@ endif()
+@@ -253,15 +253,11 @@ endif()
  
  if(MRN_GROONGA_BUNDLED)
    set(GROONGA_INCLUDE_DIRS "${MRN_BUNDLED_GROONGA_DIR}/include")
diff --git a/debian/patches/rocksdb-kfreebsd.patch b/debian/patches/rocksdb-kfreebsd.patch
deleted file mode 100644
index f9e491142e0..00000000000
--- a/debian/patches/rocksdb-kfreebsd.patch
+++ /dev/null
@@ -1,176 +0,0 @@
-From: Andrew Kryczka <andrewkr@fb.com>
-Date: Tue, 16 Jun 2020 19:34:21 -0700
-Subject: rocksdb-kfreebsd
-
-Upstream has merged this but we still need to wait for it to be included
-in a RocksDB release and imported into MariaDB and then into Debian.
-
-Bug: https://jira.mariadb.org/browse/MDEV-19251
-Forwarded: https://github.com/facebook/rocksdb/pull/6992
-# Merged in RocksDB 6.12.6 but not updated into MariaDB yet
----
- storage/rocksdb/build_rocksdb.cmake                       |  2 ++
- storage/rocksdb/rdb_io_watchdog.cc                        |  2 +-
- storage/rocksdb/rdb_io_watchdog.h                         | 12 ++++++------
- storage/rocksdb/rocksdb/CMakeLists.txt                    |  4 +++-
- storage/rocksdb/rocksdb/build_tools/build_detect_platform | 11 +++++++++++
- storage/rocksdb/rocksdb/env/env_posix.cc                  |  9 +++++----
- storage/rocksdb/rocksdb/port/stack_trace.cc               |  2 +-
- 7 files changed, 29 insertions(+), 13 deletions(-)
-
-diff --git a/storage/rocksdb/build_rocksdb.cmake b/storage/rocksdb/build_rocksdb.cmake
-index e89dbfc..4302c55 100644
---- a/storage/rocksdb/build_rocksdb.cmake
-+++ b/storage/rocksdb/build_rocksdb.cmake
-@@ -90,6 +90,8 @@ elseif(CMAKE_SYSTEM_NAME MATCHES "Linux")
-   add_definitions(-DOS_LINUX)
- elseif(CMAKE_SYSTEM_NAME MATCHES "SunOS")
-   add_definitions(-DOS_SOLARIS)
-+elseif(CMAKE_SYSTEM_NAME MATCHES "kFreeBSD")
-+  add_definitions(-DOS_GNU_KFREEBSD)
- elseif(CMAKE_SYSTEM_NAME MATCHES "FreeBSD")
-   add_definitions(-DOS_FREEBSD)
- elseif(CMAKE_SYSTEM_NAME MATCHES "NetBSD")
-diff --git a/storage/rocksdb/rdb_io_watchdog.cc b/storage/rocksdb/rdb_io_watchdog.cc
-index 0783411..cd027fd 100644
---- a/storage/rocksdb/rdb_io_watchdog.cc
-+++ b/storage/rocksdb/rdb_io_watchdog.cc
-@@ -111,7 +111,7 @@ void Rdb_io_watchdog::io_check_callback(union sigval timer_data) {
-     sql_print_warning("Deleting the watchdog I/O timer failed with %d.", errno);
-   }
- 
--  m_io_check_watchdog_timer = nullptr;
-+  m_io_check_watchdog_timer = reinterpret_cast<timer_t>(-1);
- 
-   RDB_MUTEX_UNLOCK_CHECK(m_reset_mutex);
- }
-diff --git a/storage/rocksdb/rdb_io_watchdog.h b/storage/rocksdb/rdb_io_watchdog.h
-index 8ee5b1f..d2d2d62 100644
---- a/storage/rocksdb/rdb_io_watchdog.h
-+++ b/storage/rocksdb/rdb_io_watchdog.h
-@@ -56,19 +56,19 @@ class Rdb_io_watchdog {
-   int stop_timers() {
-     int ret = 0;
- 
--    if (m_io_check_watchdog_timer) {
-+    if (m_io_check_watchdog_timer != reinterpret_cast<timer_t>(-1)) {
-       ret = timer_delete(m_io_check_watchdog_timer);
- 
-       if (!ret) {
--        m_io_check_watchdog_timer = nullptr;
-+        m_io_check_watchdog_timer = reinterpret_cast<timer_t>(-1);
-       }
-     }
- 
--    if (m_io_check_timer && !ret) {
-+    if (m_io_check_timer != reinterpret_cast<timer_t>(-1) && !ret) {
-       ret = timer_delete(m_io_check_timer);
- 
-       if (!ret) {
--        m_io_check_timer = nullptr;
-+        m_io_check_timer = reinterpret_cast<timer_t>(-1);
-       }
-     }
- 
-@@ -93,8 +93,8 @@ class Rdb_io_watchdog {
- 
-  public:
-   explicit Rdb_io_watchdog(std::vector<std::string> &&directories)
--      : m_io_check_timer(nullptr),
--        m_io_check_watchdog_timer(nullptr),
-+      : m_io_check_timer(reinterpret_cast<timer_t>(-1)),
-+        m_io_check_watchdog_timer(reinterpret_cast<timer_t>(-1)),
-         m_io_in_progress(false),
-         m_dirs_to_check(std::move(directories)),
-         m_buf(nullptr) {
-diff --git a/storage/rocksdb/rocksdb/CMakeLists.txt b/storage/rocksdb/rocksdb/CMakeLists.txt
-index aeef92e..40d3bea 100644
---- a/storage/rocksdb/rocksdb/CMakeLists.txt
-+++ b/storage/rocksdb/rocksdb/CMakeLists.txt
-@@ -91,7 +91,7 @@ if(MSVC)
-   option(WITH_XPRESS "build with windows built in compression" OFF)
-   include(${CMAKE_CURRENT_SOURCE_DIR}/thirdparty.inc)
- else()
--  if(CMAKE_SYSTEM_NAME MATCHES "FreeBSD")
-+  if(CMAKE_SYSTEM_NAME MATCHES "FreeBSD" AND NOT CMAKE_SYSTEM_NAME MATCHES "kFreeBSD")
-     # FreeBSD has jemalloc as default malloc
-     # but it does not have all the jemalloc files in include/...
-     set(WITH_JEMALLOC ON)
-@@ -413,6 +413,8 @@ elseif(CMAKE_SYSTEM_NAME MATCHES "Linux")
-   add_definitions(-DOS_LINUX)
- elseif(CMAKE_SYSTEM_NAME MATCHES "SunOS")
-   add_definitions(-DOS_SOLARIS)
-+elseif(CMAKE_SYSTEM_NAME MATCHES "kFreeBSD")
-+  add_definitions(-DOS_GNU_KFREEBSD)
- elseif(CMAKE_SYSTEM_NAME MATCHES "FreeBSD")
-   add_definitions(-DOS_FREEBSD)
- elseif(CMAKE_SYSTEM_NAME MATCHES "NetBSD")
-diff --git a/storage/rocksdb/rocksdb/build_tools/build_detect_platform b/storage/rocksdb/rocksdb/build_tools/build_detect_platform
-index 158c161..708a42c 100755
---- a/storage/rocksdb/rocksdb/build_tools/build_detect_platform
-+++ b/storage/rocksdb/rocksdb/build_tools/build_detect_platform
-@@ -190,6 +190,17 @@ EOF
-         PLATFORM_LDFLAGS="$PLATFORM_LDFLAGS -lpthread"
-         # PORT_FILES=port/freebsd/freebsd_specific.cc
-         ;;
-+    GNU/kFreeBSD)
-+        PLATFORM=OS_GNU_KFREEBSD
-+        COMMON_FLAGS="$COMMON_FLAGS -DOS_GNU_KFREEBSD"
-+        if [ -z "$USE_CLANG" ]; then
-+            COMMON_FLAGS="$COMMON_FLAGS -fno-builtin-memcmp"
-+        else
-+            PLATFORM_LDFLAGS="$PLATFORM_LDFLAGS -latomic"
-+        fi
-+        PLATFORM_LDFLAGS="$PLATFORM_LDFLAGS -lpthread -lrt"
-+        # PORT_FILES=port/gnu_kfreebsd/gnu_kfreebsd_specific.cc
-+        ;;
-     NetBSD)
-         PLATFORM=OS_NETBSD
-         COMMON_FLAGS="$COMMON_FLAGS -fno-builtin-memcmp -D_REENTRANT -DOS_NETBSD"
-diff --git a/storage/rocksdb/rocksdb/env/env_posix.cc b/storage/rocksdb/rocksdb/env/env_posix.cc
-index 861fbcf..92a3b74 100644
---- a/storage/rocksdb/rocksdb/env/env_posix.cc
-+++ b/storage/rocksdb/rocksdb/env/env_posix.cc
-@@ -41,7 +41,7 @@
- #include <time.h>
- #include <algorithm>
- // Get nano time includes
--#if defined(OS_LINUX) || defined(OS_FREEBSD)
-+#if defined(OS_LINUX) || defined(OS_FREEBSD) || defined(OS_GNU_KFREEBSD)
- #elif defined(__MACH__)
- #include <Availability.h>
- #include <mach/clock.h>
-@@ -287,7 +287,8 @@ class PosixEnv : public CompositeEnvWrapper {
-   }
- 
-   uint64_t NowNanos() override {
--#if defined(OS_LINUX) || defined(OS_FREEBSD) || defined(OS_AIX)
-+#if defined(OS_LINUX) || defined(OS_FREEBSD) || defined(OS_GNU_KFREEBSD) || \
-+    defined(OS_AIX)
-     struct timespec ts;
-     clock_gettime(CLOCK_MONOTONIC, &ts);
-     return static_cast<uint64_t>(ts.tv_sec) * 1000000000 + ts.tv_nsec;
-@@ -307,8 +308,8 @@ class PosixEnv : public CompositeEnvWrapper {
-   }
- 
-   uint64_t NowCPUNanos() override {
--#if defined(OS_LINUX) || defined(OS_FREEBSD) || defined(OS_AIX) || \
--    (defined(__MACH__) && defined(__MAC_10_12))
-+#if defined(OS_LINUX) || defined(OS_FREEBSD) || defined(OS_GNU_KFREEBSD) || \
-+    defined(OS_AIX) || (defined(__MACH__) && defined(__MAC_10_12))
-     struct timespec ts;
-     clock_gettime(CLOCK_THREAD_CPUTIME_ID, &ts);
-     return static_cast<uint64_t>(ts.tv_sec) * 1000000000 + ts.tv_nsec;
-diff --git a/storage/rocksdb/rocksdb/port/stack_trace.cc b/storage/rocksdb/rocksdb/port/stack_trace.cc
-index 32eb45b..35e3931 100644
---- a/storage/rocksdb/rocksdb/port/stack_trace.cc
-+++ b/storage/rocksdb/rocksdb/port/stack_trace.cc
-@@ -32,7 +32,7 @@ namespace port {
- 
- namespace {
- 
--#if defined(OS_LINUX) || defined(OS_FREEBSD)
-+#if defined(OS_LINUX) || defined(OS_FREEBSD) || defined(OS_GNU_KFREEBSD)
- const char* GetExecutableName() {
-   static char name[1024];
- 
diff --git a/debian/patches/series b/debian/patches/series
index 2a876ab6c53..e62b381714f 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,7 +1,4 @@
-rocksdb-kfreebsd.patch
 env-perl-usr-bin-perl.patch
-fix-spelling-rocksdb.patch
-fix-reproducible-builds-rocksdb.patch
 mroonga-mrn-lib-dirs-path-reproducible-build.patch
 install-files-into-usr.patch
 1006531-hurd-no-auth-socket.patch
@@ -10,9 +7,5 @@ hurd-i386-plugin_disks_information_schema_disks.cc.patch
 hurd-i386-storage_connect_ioapi.h.patch
 hide-mysql-command-deprecation-warnings.patch
 1063738-x32-compile-time-assert.patch
-1095286-pcre-tests-case-confusion.patch
 Fix-misc-spelling-in-MariaDB-Server-repository.patch
-1084293-allow-cest-in-timezone-test.patch
-1101397-revert-CONC-710.patch
-MDEV-36009-Systemd-Restart-on-OOM.patch
-MDEV-36334-test-main.func_format-fails-on-i386-on-exabyte.patch
+Improve-output-from-mariadb-secure-installation-to-be-mor.patch
diff --git a/debian/patches/startup-message.patch b/debian/patches/startup-message.patch
index 6cfb5896484..7e3481a1e70 100644
--- a/debian/patches/startup-message.patch
+++ b/debian/patches/startup-message.patch
@@ -8,48 +8,36 @@ star on GitHub. This patch experiments with how well such a banner works, and
 may later change the contents to drive some other kind of engagement.
 
 Client output:
+
     Welcome to the MariaDB monitor.  Commands end with ; or \g.
-    Your MariaDB connection id is 34
-    Server version: 10.11.7-MariaDB-3 Debian n/a
+    Your MariaDB connection id is 17
+    Server version: 11.8.1-MariaDB-5 from Debian -- Please help get to 10k stars at https://github.com/MariaDB/Server
 
     Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
-    Support MariaDB developers by giving a star at https://github.com/MariaDB/server
 
     Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
 
     MariaDB [(none)]>
 
 Server output:
-    [Note] Support MariaDB developers by giving a star at https://github.com/MariaDB/server
+    [Note] Please help get to 10k stars at https://github.com/MariaDB/Server
+
+Server output if built in git directory:
+    [Note] Starting MariaDB 11.8.1-MariaDB-5 from Debian source revision 1a9c3debfd6b1b16af4e501d3530b866b85c38a8 server_uid eNAjF8/wvUNM09/mSmh+k3a5o5w= as process 1359
 
-Server output if build in git directory:
-    [Note] Starting MariaDB 10.11.7-MariaDB-3 source revision 219efb0a6ab0ee8ce2ec831c715783586c4db2ef as process 5426
+Logs will also show as server output:
+    mysqld: Version: '11.8.1-MariaDB-5 from Debian'  socket: '/run/mysqld/mysqld.sock'  port: 3306  -- Please help get to 10k stars at https://github.com/MariaDB/Server
 
 Forwarded: no
 ---
- client/mysql.cc |  3 +++
- sql/mysqld.cc   | 20 +++++++++++++++-----
- 2 files changed, 18 insertions(+), 5 deletions(-)
+ sql/mysqld.cc | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
 
-diff --git a/client/mysql.cc b/client/mysql.cc
-index e04276d..debe1d8 100644
---- a/client/mysql.cc
-+++ b/client/mysql.cc
-@@ -1339,6 +1339,9 @@ int main(int argc,char *argv[])
-             mysql_thread_id(&mysql), server_version_string(&mysql));
-     put_info((char*) glob_buffer.ptr(),INFO_INFO);
-     put_info(ORACLE_WELCOME_COPYRIGHT_NOTICE("2000"), INFO_INFO);
-+    put_info("Support MariaDB developers by giving a star at "
-+             "https://github.com/MariaDB/server",
-+             INFO_INFO);
-   }
- 
- #ifdef HAVE_READLINE
 diff --git a/sql/mysqld.cc b/sql/mysqld.cc
-index ce75a02..bb1ae7f 100644
+index bcbda40..90397c5 100644
 --- a/sql/mysqld.cc
 +++ b/sql/mysqld.cc
-@@ -5038,13 +5038,23 @@ static int init_server_components()
+@@ -5041,13 +5041,23 @@ static int init_server_components()
  
    /*
      Print source revision hash, as one of the first lines, if not the
@@ -72,7 +60,7 @@ index ce75a02..bb1ae7f 100644
 +      sql_print_information("Starting MariaDB %s server_uid %s "
 +                            "as process %lu",
 +                            server_version, server_uid, (ulong) getpid());
-+      sql_print_information("Support MariaDB developers by giving a star at "
++      sql_print_information("Please help get to 10k stars at "
 +                            "https://github.com/MariaDB/server");
 +    }
  
diff --git a/debian/rules b/debian/rules
index 31cc83dc6d7..ef243ed0616 100755
--- a/debian/rules
+++ b/debian/rules
@@ -104,8 +104,8 @@ endif
 	    -DCMAKE_BUILD_TYPE=RelWithDebInfo \
 	    $(CMAKEFLAGS) \
 	    $(if $(filter $(DEB_BUILD_ARCH),$(DEB_HOST_ARCH)),,-DIMPORT_EXECUTABLES=$(CURDIR)/builddir-native/import_executables.cmake) \
-	    -DCOMPILATION_COMMENT="$(DEB_VENDOR) $(RELEASE)" \
-	    -DMYSQL_SERVER_SUFFIX="-$(DEB_VERSION_REVISION)" \
+	    -DCOMPILATION_COMMENT="-- Please help get to 10k stars at https://github.com/MariaDB/Server" \
+	    -DMYSQL_SERVER_SUFFIX="-$(DEB_VERSION_REVISION) from $(DEB_VENDOR)" \
 	    -DSYSTEM_TYPE="debian-$(DEB_HOST_GNU_SYSTEM)" \
 	    -DBUILD_CONFIG=mysql_release \
 	    -DCONC_DEFAULT_CHARSET=utf8mb4 \
@@ -221,7 +221,7 @@ ifneq (,$(filter linux,$(DEB_HOST_ARCH_OS)))
 	dh_missing --list-missing
 endif
 
-override_dh_installinit-arch:
+override_dh_installinit:
 	dh_installinit --name=mariadb
 
 # Use custom server version string variable
diff --git a/debian/salsa-ci.yml b/debian/salsa-ci.yml
index d6129406ede..03fd0f9a376 100644
--- a/debian/salsa-ci.yml
+++ b/debian/salsa-ci.yml
@@ -3,7 +3,7 @@
 include:
   - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/recipes/debian.yml
 
-# Override Salsa CI with MariaDB specific variations
+# Override Salsa CI defaults with MariaDB specific variations
 variables:
   BUILT_PACKAGES: "libmariadb-dev libmariadb-dev-compat libmariadb3
     libmariadbd19t64 libmariadbd-dev mariadb-common mariadb-client-core
@@ -16,13 +16,17 @@ variables:
     mariadb-plugin-provider-lzma mariadb-plugin-provider-lzo
     mariadb-plugin-provider-snappy mariadb-test mariadb-test-data"
   DEB_BUILD_OPTIONS: "nocheck noautodbgsym"
+  # The jobs build-package-any nd build-package-all work, but they can take 2h+
+  # for MariaDB and provide little value as changes to debian/control
+  # `Architecture` and `Multi-Arch` stanzas are rare.
+  SALSA_CI_DISABLE_BUILD_PACKAGE_ALL: 1
+  SALSA_CI_DISABLE_BUILD_PACKAGE_ANY: 1
   # Reprotest works, but takes very long time and often fails due to timeouts.
   # Thus is best kept disabled and only occasionally manually enabled to
   # test that reproducibility works, along with atomic reprotest to directly
   # pinpoint what aspect of the build is broken if not reproducible.
   SALSA_CI_DISABLE_REPROTEST: 1
   SALSA_CI_ENABLE_ATOMIC_REPROTEST: 0
-  SALSA_CI_DISABLE_MISSING_BREAKS: 0
   SALSA_CI_DISABLE_RC_BUGS: 0
 
 .build-package:
@@ -40,26 +44,12 @@ variables:
 stages:
   - provisioning
   - build
-  - test
+  - test  # Stage referenced by Salsa CI template reprotest stanza, so must exist
   - upgrade MariaDB
   - upgrade MariaDB and distro
   - upgrade MariaDB variant
   - test extras
-  - publish # Stage referenced by Salsa-CI template aptly stanza, so must exist even though not used
-
-gnitpick:
-  stage: provisioning
-  image: debian:sid-slim
-  script: |
-    # Bare minimal (<4MB) for apt-key and gnitpick to work
-    apt-get update -qq && apt-get -qq install --no-install-recommends --yes ca-certificates curl python3-minimal git
-    curl -sL https://raw.githubusercontent.com/Seravo/gnitpick/master/gnitpick.py -o /usr/bin/gnitpick; chmod +x /usr/bin/gnitpick
-    # Actual Gnitpick part
-    gnitpick --target-repository https://salsa.debian.org/mariadb-team/mariadb-server.git --target-branch debian/latest
-  except:
-    variables:
-      - $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
-  allow_failure: true  # Gnitpick does not fully support this branch naming scheme so ignore it for now
+  - publish  # Stage referenced by Salsa CI template aptly stanza, so must exist even though not used
 
 packaging-fix-checks:
   stage: provisioning
@@ -85,7 +75,6 @@ packaging-fix-checks:
       fi
     - |
       wrap-and-sort -ast
-      git checkout debian/tests/control # Revert touching this file, wrap-and-sort shouldn't do it
       if [ "$(git diff --name-only | wc -l)" -eq 0 ]
       then
         echo "No uncommitted changes after 'wrap-and-sort -ast', maintainer has done good job keeping files in order."
@@ -98,9 +87,11 @@ packaging-fix-checks:
     - |
       shellcheck -x --shell=sh $(grep -Irnw debian/ -e '^#!.*/sh' | sort -u |cut -d ':' -f 1 | xargs)
       shellcheck -x --shell=bash $(grep -Irnw debian/ -e '^#!.*/bash' | sort -u |cut -d ':' -f 1 | xargs)
-  except:
-    variables:
-      - $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
+  rules:
+    # Do not create a pipeline for tags unless SALSA_CI_ENABLE_PIPELINE_ON_TAGS is set
+    - if: $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
+      when: never
+    - when: always
 
 # Bookworm and Bullseye backports can be enabled if
 # https://salsa.debian.org/mariadb-team/mariadb-server/-/merge_requests/67 is
@@ -108,26 +99,6 @@ packaging-fix-checks:
 # Buster only has libfmt 6.1 but 7.0 is required, so backport build for Buster
 # is not possible unless somebody packages libfmt7-dev for Buster.
 
-# Cross-builds for arm64 frequenlty fails on unstable dependencies in Sid, or is
-# just very slow, so stop using it and rely on armhf and armel cross-builds to
-# detect cross-build regressions
-#test-crossbuild-arm64:
-#  stage: build
-
-test-crossbuild-armhf:
-  stage: build
-  extends: .test-crossbuild-package-arm64
-  variables:
-    HOST_ARCH: armhf
-  allow_failure: true  # Cross-builds seem to fail frequently due to unclear reasons
-
-test-crossbuild-armel:
-  stage: build
-  extends: .test-crossbuild-package-arm64
-  variables:
-    HOST_ARCH: armel
-  allow_failure: true  # Cross-builds seem to fail frequently due to unclear reasons
-
 autopkgtest:
   extends: .test-autopkgtest
   artifacts:
@@ -148,23 +119,40 @@ blhc:
   # Change directory to ./debian/output where build artifacts can be found
   cd ${WORKING_DIR}
   # Enable automatic restarts from maint scripts
-  sed -i "s/101/0/g" -i /usr/sbin/policy-rc.d
+  sed -i "s/101/0/g" /usr/sbin/policy-rc.d
   # Fake /sbin/runlevel to avoid warnings of "invoke-rc.d: could not determine current runlevel"
   echo -e '#!/bin/sh\necho "N 5"' > /sbin/runlevel; chmod +x /sbin/runlevel
+  # Never stop apt to ask for confirmation, just assume `--yes` all the time
+  echo 'APT::Get::Assume-Yes "true";' > /etc/apt/apt.conf.d/assume-yes
+  # Ensure dpkg does not ask questions
+  export DEBIAN_FRONTEND=noninteractive
+  # Ensure dpkg does not stop to ask if config files should be kept, but instead
+  # just installs the maintainer version from the new package
+  cat > /etc/apt/apt.conf.d/99force-confnew <<EOF
+  Dpkg::Options {
+    "--force-confnew";
+  };
+  EOF
   # Avoid the warnings of "debconf: unable to initialize frontend: Dialog"
   echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections
+  # In CI runs we do not enforce strict supply-chain security and thus expired
+  # and missing keys are ignored. In particular when testing upgrades from old
+  # releases, the old repositories may have expired keys by design, and must be
+  # ignored for CI to be able to run. Instead of adding '[trusted=yes
+  # check-valid-until=no check-date=no]' to every 'deb https://' line in
+  # sources, lax apt security settings system-wide.
+  cat > /etc/apt/apt.conf.d/99ignore-keys <<EOF
+  APT::Get::AllowUnauthenticated "true";
+  Acquire::AllowInsecureRepositories "true";
+  Acquire::AllowDowngradeToInsecureRepositories "true";
+  Acquire::Check-Valid-Until "false";
+  Acquire::Check-Date "false";
+  EOF
   # Emit non-zero exit code also on warnings to ensure CI stops on any issue
   echo 'APT::Update::Error-Mode "any";' > /etc/apt/apt.conf.d/non-zero-exit-on-warnings
   # Prime the apt cache so later apt commands can run
   apt-get update -q
 
-# OpenSSL 1.1 was Debian Sid in Dec 2022 (as Bookworm will ship with OpenSSL 3.0
-# only). To be able to install versions of MariaDB that depend on OpenSSL 1.1,
-# fetch and install it manually.
-.test-install-openssl1-in-sid-for-backwards-compat: &test-install-openssl1-in-sid-for-backwards-compat |
-  curl -sLO https://snapshot.debian.org/archive/debian/20220507T034236Z/pool/main/o/openssl/libssl1.1_1.1.1o-1_amd64.deb
-  apt-get -qq install --no-install-recommends --yes ./libssl1.1_1.1.1o-1_amd64.deb
-
 .test-verify-initial: &test-verify-initial |
   dpkg -l | grep -iE 'maria|mysql|galera' || true  # List installed
   # MariaDB until 10.5 only had 'mysql', and since only 'mariadb', so try both
@@ -185,26 +173,21 @@ blhc:
       # Install tools that may be needed to circumvent issues in the upgrade
       apt-get install -qq --yes --no-install-recommends ca-certificates curl
       # Replace any old repos with just Sid, and trust blindly as old Debian releases won't have latest Sid in their keyring
-      echo 'deb [trusted=yes] http://deb.debian.org/debian sid main' > /etc/apt/sources.list
-
+      echo 'deb http://deb.debian.org/debian sid main' > /etc/apt/sources.list
       # Attempting upgrade from Bullseye or older to Debian Sid is no longer
       # possible in April 2025, as even with all usrmerge workarounds applied
-      # the util-linux upgrade is practically impossible due to versioned hard
-      # dependencies:
+      # the coreutils and util-linux upgrade is practically impossible due to
+      # versioned hard dependencies:
       #
       #    coreutils : PreDepends: libsystemd0 (>= 254) but 247.3-7+deb11u6 is to be installed
       #    util-linux : PreDepends: libc6 (>= 2.41) but 2.38-11 is to be installed
-      # Also with older util-linux these dependencies must be fetched manually:
-      #    util-linux : PreDepends: libblkid1 (= 2.40.4-5) but 2.41-4 is to be installed
-      #                 PreDepends: libmount1 (= 2.40.4-5) but 2.41-4 is to be installed
-      #                 PreDepends: libsmartcols1 (= 2.40.4-5) but 2.41-4 is to be installed
-      #                 PreDepends: libuuid1 (= 2.40.4-5) but 2.41-4 is to be installed
       #
       # Thus, on these older distros, test upgrade only up until the Debian Sid
-      # March 2025 version:
-      if grep -q -E 'bullseye|buster|stretch' /etc/os-release
+      # March 2025 version (snapshot chosen just before coreutils/util-linux
+      # gained hard dependencies making upgrades from Bullseye/older impossible):
+      if grep -q -E 'bullseye|buster|stretch|jammy|focal' /etc/os-release
       then
-        echo 'deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20250315T025205Z sid main' > /etc/apt/sources.list
+        echo 'deb http://snapshot.debian.org/archive/debian/20250315T025205Z sid main' > /etc/apt/sources.list
       fi
       # Run update to ensure next install command uses latest apt sources
       apt-get update -q
@@ -226,6 +209,9 @@ blhc:
   #   *************************************************************************
   # Therefore, an older base-files must be used:
   - |
+    # If apt install failed, it might be due to base-files needing usrmerge.
+    # Attempt workaround using base-files 13.2 (snapshot chosen just before
+    # base-files 13.3 started requiring usrmerge).
     if [ "$APT_STATUS" = "failed" ]
     then
       curl -sLO https://snapshot.debian.org/archive/debian/20240531T083821Z/pool/main/b/base-files/base-files_13.2_amd64.deb
@@ -234,11 +220,24 @@ blhc:
       # Ensure upgrades past 13.2 are blocked to avoid failure on usrmerge issue
       apt-mark hold base-files
       apt-get install -q --yes --fix-broken apt
+      # Upgrades from Ubuntu Jammy will fail on:
+      #   Unpacking libc6-dev:amd64 (2.41-5) over (2.35-0ubuntu3.9) ...
+      #   dpkg: error processing archive /var/cache/apt/archives/libc6-dev_2.41-5_amd64.deb (--unpack):
+      #   trying to overwrite '/usr/lib/x86_64-linux-gnu/audit/sotruss-lib.so', which is also in package libc6:amd64 2.35-0ubuntu3.9
+      # This is because the Breaks/Replaces version in https://salsa.debian.org/glibc-team/glibc/-/commit/331bb702600840c345d804fe689e0d402dc5ad05
+      # does not match the Ubuntu version 2.35-0ubuntu3.9. Seems situation can be
+      # fixed with a simple re-run, which does not hurt on any other version either,
+      # so issue it every time just in case:
+      apt-get install -q --yes --fix-broken
+      apt-get install -q --yes --fix-broken apt
     fi || export BASE_FILES_STATUS="failed"
   # Latest apt attempts to pull in latest libc6, which fails on:
   #   libc6 : Breaks: base-files (< 13.3~) but 13.2 is to be installed
   # Therefore, older libc6 and it's dependency libc6-bin must be used:
   - |
+    # If base-files workaround failed, it might be due to libc6 breaking older
+    # base-files. Attempt workaround using libc6 2.38 (snapshot chosen just
+    # before libc6 2.39 started breaking base-files < 13.3).
     if [ "$BASE_FILES_STATUS" = "failed" ]
     then
       curl -sLO https://snapshot.debian.org/archive/debian/20240531T083821Z/pool/main/g/glibc/libc6_2.38-11_amd64.deb
@@ -247,7 +246,7 @@ blhc:
       curl -sLO https://snapshot.debian.org/archive/debian/20240531T083821Z/pool/main/g/glibc/libc6-dev_2.38-11_amd64.deb
       curl -sLO https://snapshot.debian.org/archive/debian/20240531T083821Z/pool/main/g/glibc/libc-dev-bin_2.38-11_amd64.deb
       # Apt version in Jessie does not support 'apt install ./package.deb', use this only for Stretch or newer
-      apt-get install -q --yes --no-install-recommends ./libc*_amd64.deb || true
+      apt-get install -q --yes --no-install-recommends ./libc*_*.deb || true
       # Ensure upgrades past 2.38-11 are blocked to avoid failure on usrmerge issue
       apt-mark hold libc6 libc-bin libc6-dev libc-dev-bin
       apt-get install -q --yes --fix-broken apt
@@ -270,15 +269,13 @@ blhc:
       cd - # Back to CI run directory
       find /lib/*/libcrypt.* -ls # Show that new libcrypt is there
       apt-mark unhold libc6 libc-bin libc6-dev libc-dev-bin
-      apt-get install -q --yes --fix-broken --no-install-recommends ./libc*_amd64.deb || true
+      apt-get install -q --yes --fix-broken --no-install-recommends ./libc*_*.deb || true
       # Ensure upgrades past 2.38-11 are blocked to avoid failure on usrmerge issue
       apt-mark hold libc6 libc-bin libc6-dev libc-dev-bin
       apt-get install -q --yes apt
     fi
   # If system has not undergone usrmerge upgrade, don't attempt it in CI containers
-  - test -L /bin || apt-mark hold usrmerge usr-is-merged || true
-  # Ignore apt-mark exit code as Buster/Bookworm upgrades to Trixie/Sid will not
-  # have those transient packages at all
+  - test -L /bin || apt-mark hold usrmerge usr-is-merged
   # For debugging purposes show what packages are now on hold
   - apt-mark showhold
   # Update base system
@@ -300,6 +297,30 @@ blhc:
       test -L /lib || cp -av /usr/lib/lsb /lib/
       apt-get remove login mount perl -qq --yes --allow-remove-essential || true
     fi
+  - |
+    # Pre-emptively upgrade sysvinit-utils and symlink new location from old to
+    # prevent upgrades from old MariaDB versions failing when the old service
+    # file tries to restart server before upgrade:
+    #   /etc/init.d/mysql: line 22: /lib/lsb/init-functions: No such file or directory
+    apt-get install -q --yes sysvinit-utils && cp -av /usr/lib/lsb /lib/ || true
+  - |
+    # Upgrades from Ubuntu Noble fail on:
+    #   Prevent: dpkg-divert: error:
+    #   'diversion of /lib32 to /.lib32.usr-is-merged by base-files' clashes
+    #    with 'diversion of /lib32 to /lib32.usr-is-merged by base-files'
+    # This is because Noble already has these:
+    #   $ dpkg-divert --list | grep 'by base-files'
+    #   diversion of /libx32 to /.libx32.usr-is-merged by base-files
+    #   diversion of /lib32 to /.lib32.usr-is-merged by base-files
+    #   diversion of /libo32 to /.libo32.usr-is-merged by base-files
+    # Circumvent them by simply removing them before starting upgrade, as the
+    # upgrade of base-files will immediately put them back again:
+    if grep -q -E 'noble' /etc/os-release
+    then
+      BASE_DIVERSIONS="$(dpkg-divert --list | grep 'by base-files' | \
+                       grep --only-matching --perl-regex 'of\K /[a-z0-9]+ ')"
+      for x in $BASE_DIVERSIONS; do dpkg-divert --no-rename --remove $x; done
+    fi
   - |
     # First 'apt-get upgrade' run fails on:
     #   dpkg (subprocess): unable to execute installed bash package post-installation script (/var/lib/dpkg/info/bash.postinst): No such file or directory
@@ -309,7 +330,7 @@ blhc:
     #   update-alternatives: error: alternative path /bin/more doesn't exist
     # Repeat upgrade attempts until passes
     function usrmerge-temp-fix {
-      for x in bash dash sh more cp ln sleep
+      for x in bash cat cp dash ln more sh sleep
       do
         if [ -x /usr/bin/$x ]
         then
@@ -330,12 +351,29 @@ blhc:
       fi
     done
 
+    # MariaDB depends on procps, which in turn depends on a libsystemd0 version
+    # that libc6 holds present in upgrades from Bullseye or older may prevent
+    # getting installed. Workaround this by upgrading it to the last version
+    # that was still compatible with libc6 2.38
+    if dpkg --compare-versions "256" gt "$(dpkg-query -W -f='${Version}' libsystemd0)"
+    then
+      curl -sLO https://snapshot.debian.org/archive/debian/20240531T083821Z/pool/main/s/systemd/libsystemd0_256~rc3-6_amd64.deb
+      apt-get install -q --yes --no-install-recommends ./libsystemd0_*.deb
+    fi
+  # Once base system is updated, we can re-enable latest sid repository again
+  - |
+    echo 'deb http://deb.debian.org/debian sid main' > /etc/apt/sources.list
+    apt-get update -q
+
 .test-enable-artifacts-repo: &test-enable-artifacts-repo |
+  # List files so it can be verified from logs that correct artifacts are present
   find -ls -maxdepth 3
+  # Delete any custom pinning thay may have been used to install initial pacakges
+  rm -rfv /etc/apt/preferences.d/mariadb
   apt-get install -qq --yes apt-utils
   apt-ftparchive packages . > Packages
   apt-ftparchive release . > Release
-  echo "deb [trusted=yes] file:$(pwd) ./" > /etc/apt/sources.list.d/local.list
+  echo "deb file:$(pwd) ./" > /etc/apt/sources.list.d/local.list
   apt-get update -q
 
 .test-install-all: &test-install-all
@@ -490,9 +528,11 @@ blhc:
     - echo "This script section must be overridden in each test" && exit 1
   variables:
     GIT_STRATEGY: none
-  except:
-    variables:
-      - $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
+  rules:
+    # Do not create a pipeline for tags unless SALSA_CI_ENABLE_PIPELINE_ON_TAGS is set
+    - if: $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
+      when: never
+    - when: always
 
 .salsa-ci-template-for-mariadb-upgrade:
   stage: test
@@ -506,17 +546,25 @@ blhc:
       - ${WORKING_DIR}/debug
   before_script:
     - *test-prepare-container
-    - apt-get install -qq --yes --no-install-recommends ca-certificates curl
+    - apt-get install -qq --yes --no-install-recommends ca-certificates
     - |
-      [[ -d /etc/apt/keyrings ]] || mkdir /etc/apt/keyrings
-      curl -sL https://mariadb.org/mariadb_release_signing_key.pgp -o /etc/apt/keyrings/mariadb-keyring.pgp
-      cat >/etc/apt/sources.list.d/mariadb.sources <<EOF
+      cat > /etc/apt/sources.list.d/mariadb.sources <<EOF
       X-Repolib-Name: MariaDB
       Types: deb
       URIs: https://archive.mariadb.org/mariadb-${MARIADB_VERSION}/repo/debian
       Suites: sid
       Components: main
-      Signed-By: /etc/apt/keyrings/mariadb-keyring.pgp
+      EOF
+      # Pin the MariaDB.org repository so all MariaDB packages are from the
+      # MariaDB archive and not from the Debian/Ubntu archive
+      cat > /etc/apt/preferences.d/mariadb <<EOF
+      Package: *
+      Pin: origin archive.mariadb.org
+      Pin-Priority: 1000
+
+      Package: *
+      Pin: release o=Debian
+      Pin-Priority: 500
       EOF
     - apt-get update -qq
   script:
@@ -525,9 +573,11 @@ blhc:
     GIT_STRATEGY: none
     MARIADB_VERSION: "10.0"
     RELEASE: sid  # does not seem to affect "Suites: ${RELEASE}", resorting to hard-coded string there
-  except:
-    variables:
-      - $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
+  rules:
+    # Do not create a pipeline for tags unless SALSA_CI_ENABLE_PIPELINE_ON_TAGS is set
+    - if: $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
+      when: never
+    - when: always
 
 fresh install:
   extends: .salsa-ci-template-for-mariadb
@@ -572,7 +622,7 @@ mariadb-10.6 and Bookworm-20230208 upgrade:
   script:
     - *test-prepare-container
     - |
-      echo 'deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20230208T130000Z bookworm main' > /etc/apt/sources.list.d/bookworm.list
+      echo 'deb http://snapshot.debian.org/archive/debian/20230208T130000Z bookworm main' > /etc/apt/sources.list.d/bookworm.list
       rm /etc/apt/sources.list.d/debian.sources
       apt-get update -qq
     # In February 2023 Bookworm snapshot this will install MariaDB 10.6
@@ -588,13 +638,7 @@ mariadb-10.6 and Bookworm-20230208 upgrade:
     - apt-get purge --yes mariadb*10.?
     - *test-verify-final
 
-# TODO: failing on this and forced libc6 downgrade can't be resolved
-# Unpacking libc6-dev:amd64 (2.40-4) over (2.35-0ubuntu3.8) ...
-# dpkg: error processing archive /var/cache/apt/archives/libc6-dev_2.40-4_amd64.deb (--unpack):
-#  trying to overwrite '/usr/lib/x86_64-linux-gnu/audit/sotruss-lib.so', which is also in package libc6:amd64 2.35-0ubuntu3.8
-# dpkg-deb: error: paste subprocess was killed by signal (Broken pipe)
-#
-mariadb-10.6 and Jammy upgrade:
+mariadb-10.6 and Ubuntu Jammy upgrade:
   extends: .salsa-ci-template-for-mariadb
   stage: upgrade MariaDB and distro
   image: ubuntu:jammy
@@ -605,10 +649,6 @@ mariadb-10.6 and Jammy upgrade:
     # Verify installation of MariaDB from Jammy
     - dpkg -l | grep -e "mariadb-server.*10\.6"
     - *test-verify-initial
-    # Install Debian Sid signing keys as Ubuntu does not have them by default
-    - apt-get install -qq --yes --no-install-recommends curl
-    - curl -sLO http://deb.debian.org/debian/pool/main/d/debian-archive-keyring/debian-archive-keyring_2023.4_all.deb
-    - apt-get install -qq --yes ./debian-archive-keyring_*
     - *test-enable-sid-repos
     # Ensure mariadbd will not crash on next shutdown for any reason
     - service mariadb restart
@@ -619,11 +659,6 @@ mariadb-10.6 and Jammy upgrade:
     - service mariadb status  # There is no init.d/mysql in MariaDB 10.5+
     - apt-get purge --yes mariadb*10.?
     - *test-verify-final
-  # Upgrading Jammy to Debian Sid will fail on:
-  # dpkg: error processing archive /var/cache/apt/archives/libc6-dev_2.39-6_amd64.deb (--unpack):
-  #  trying to overwrite '/usr/lib/x86_64-linux-gnu/audit/sotruss-lib.so', which is also in package libc6:amd64 2.35-0ubuntu3.8
-  allow_failure: true
-
 
 mariadb-10.5 and Bullseye upgrade:
   extends: .salsa-ci-template-for-mariadb
@@ -646,7 +681,6 @@ mariadb-10.5 and Bullseye upgrade:
     - service mariadb status  # There is no init.d/mysql in MariaDB 10.5+
     - apt-get purge --yes mariadb*10.?
     - *test-verify-final
-  allow_failure: true  # Temporarily allow failure due to usrmerge related changes in fall 2024
 
 mariadb-10.3 and Buster upgrade:
   extends: .salsa-ci-template-for-mariadb
@@ -675,9 +709,8 @@ mariadb-10.3 and Buster upgrade:
     # fail on non-existing mariadb.sys user
     - sleep 15
     - *test-verify-final
-  allow_failure: true  # Temporarily allow failure due to usrmerge related changes in fall 2024
 
-mariadb-10.3 and Focal upgrade:
+mariadb-10.3 and Ubuntu Focal upgrade:
   extends: .salsa-ci-template-for-mariadb
   stage: upgrade MariaDB and distro
   image: ubuntu:focal
@@ -688,10 +721,6 @@ mariadb-10.3 and Focal upgrade:
     # Verify installation of MariaDB from Focal
     - dpkg -l | grep -e "mariadb-server.*10\.3"
     - *test-verify-initial
-    # Install Debian Sid signing keys as Ubuntu does not have them by default
-    - apt-get install -qq --yes --no-install-recommends curl
-    - curl -sLO http://deb.debian.org/debian/pool/main/d/debian-archive-keyring/debian-archive-keyring_2023.4_all.deb
-    - apt-get install -qq --yes ./debian-archive-keyring_*
     - *test-enable-sid-repos
     # Ensure mariadbd will not crash on next shutdown for any reason
     - service mysql restart # in 10.3 service name is still 'mysql'
@@ -747,7 +776,6 @@ default-mysql-server and Bullseye upgrade:
     # Due to usrmerge, full-upgrade from Bullseye to Trixie or newer cannot work
     - service mariadb status  # There is no init.d/mysql in MariaDB 10.5+
     - *test-verify-final
-  allow_failure: true  # Temporarily allow failure due to usrmerge related changes in fall 2024
 
 test basic features:
   extends: .salsa-ci-template-for-mariadb
@@ -894,30 +922,8 @@ default-libmysqlclient-dev and Bookworm upgrade:
     - *test-full-upgrade-libs
     - *test-verify-libs
 
-default-libmysqlclient-dev and Bullseye upgrade:
-  extends: .salsa-ci-template-for-mariadb
-  stage: upgrade MariaDB and distro
-  image: debian:bullseye
-  script:
-    - *test-prepare-container
-    - apt-get install -qq --yes pkg-config default-libmysqlclient-dev
-    - pkg-config --list-all
-    - *test-enable-sid-repos
-    # Don't use latest libc6-dev as trying to install it errors on:
-    #  The current installation does not have a merged-/usr layout.
-    #  This is unsupported and unpacking libc6 would break the system.
-    - curl -sLO https://snapshot.debian.org/archive/debian/20240531T083821Z/pool/main/g/glibc/libc6-dev_2.38-11_amd64.deb
-    - curl -sLO https://snapshot.debian.org/archive/debian/20240531T083821Z/pool/main/g/glibc/libc-dev-bin_2.38-11_amd64.deb
-    - apt-get -qq install --no-install-recommends --yes --allow-downgrades ./libc6-dev_2.38-11_amd64.deb ./libc-dev-bin_2.38-11_amd64.deb
-    # Must be reinstalled as libc6 upgrade removes them:
-    - apt-get install -qq --yes pkg-config default-libmysqlclient-dev
-    # Due to usrmerge, full-upgrade from Bullseye to Trixie or newer cannot work
-    - *test-install-all-libs
-    - *test-verify-libs
-  allow_failure: true  # Temporarily allow failure due to usrmerge related changes in fall 2024
-
-# No longer possible since as it pulls as dependencies packages that trigger
-# usrmerge, which cannot run in a container
+# No longer possible since due to entanglement with usrmerge upgrades:
+#default-libmysqlclient-dev and Bullseye upgrade:
 #default-libmysqlclient-dev and Buster upgrade:
 
 # Upgrading from MySQL 8.0 with datadir in place is not possible. Users need to do a data dump.
@@ -947,6 +953,34 @@ mysql-8.0 in Sid upgrade:
     - service mysql status || service mariadb status
     - *test-verify-final
 
+# Upgrading from MySQL 8.4 with datadir in place is not possible. Users need to do a data dump.
+# The Debian maintainer scripts detect this situation and simply moves old datadir aside and start fresh.
+mysql-8.4 in Ubuntu 25.04 upgrade:
+  extends: .salsa-ci-template-for-mariadb
+  stage: upgrade MariaDB variant
+  image: ubuntu:plucky
+  script:
+    - *test-prepare-container
+    - apt-get install -qq --yes procps mysql-server 'libmysqlc*' systemctl
+    # Ensure MySQL 8.0 package actually got installed
+    - dpkg -l | grep mysql
+    - sed 's/ExecStartPre=+/ExecStartPre=/' -i /lib/systemd/system/mysql.service # Hack to make file compatible with systemctl shim
+    - systemctl start mysql
+    - dpkg -l | grep -iE 'maria|mysql|galera'
+    - systemctl status mysql; mysql -e 'SELECT VERSION()'
+    - systemctl stop mysql # Stop manually as maintainer scripts don't handle this with systemctl shim
+    - *test-enable-sid-repos
+    # MySQL 8.4 in Ubuntu does not ship any /etc/init.d/mysql nor is the systemd
+    # service file compatible with daemonless systemctl, so skip trying to
+    # start or stop the service, just proceed directly to upgrade
+    - *test-enable-artifacts-repo
+    - apt-get install -qq --simulate mariadb-server
+    - apt-get install -qq --yes mariadb-server
+    - service mariadb status  # There is no init.d/mysql in MariaDB 10.5+
+    # Remove everything MySQL except mysql-common which also MariaDB depends on
+    - apt-get purge --yes mysql-s* mysql-cl* libmysql*
+    - *test-verify-final
+
 # Upgrading from MySQL 8.0 with datadir in place is not possible. Users need to do a data dump.
 # The Debian maintainer scripts detect this situation and simply moves old datadir aside and start fresh.
 mysql-8.0 in Ubuntu 24.10 upgrade:
@@ -960,10 +994,6 @@ mysql-8.0 in Ubuntu 24.10 upgrade:
     - dpkg -l | grep mysql
     - service mysql status
     - *test-verify-initial
-    # Install Debian Sid signing keys as Ubuntu does not have them by default
-    - apt-get install -qq --yes --no-install-recommends curl
-    - curl -sSLO http://deb.debian.org/debian/pool/main/d/debian-archive-keyring/debian-archive-keyring_2023.4_all.deb
-    - apt-get install -qq --yes ./debian-archive-keyring_*
     - *test-enable-sid-repos
     # Ensure mysqld will not crash on next shutdown for any reason
     - service mysql restart
@@ -983,12 +1013,10 @@ mysql-community-cluster-8.0 from MySQL.com with Bookworm upgrade:
   image: debian:bookworm
   script:
     - *test-prepare-container
-    - |
-      apt-get install -qq --yes --no-install-recommends ca-certificates curl systemctl
-      curl -sL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0xbca43417c3b485dd128ec6d4b7b3b788a8d3785c" -o /etc/apt/trusted.gpg.d/mysql.asc
-      echo "deb https://repo.mysql.com/apt/debian/ bookworm mysql-cluster-8.0" > /etc/apt/sources.list.d/mysql.list
-      apt-get update -qq
-    - apt-get install -qq --yes mysql-cluster-community-server
+    - apt-get install -qq --yes --no-install-recommends ca-certificates
+    - echo "deb https://repo.mysql.com/apt/debian/ bookworm mysql-cluster-8.0" > /etc/apt/sources.list.d/mysql.list
+    - apt-get update -qq
+    - apt-get install -qq --yes mysql-cluster-community-server systemctl
     - sed 's/ExecStartPre=+/ExecStartPre=/' -i /lib/systemd/system/mysql.service # Hack to make file compatible with systemctl shim
     - systemctl start mysql
     - dpkg -l | grep -iE 'maria|mysql|galera'
@@ -1005,13 +1033,14 @@ mysql-community-cluster-8.0 from MySQL.com with Bookworm upgrade:
     - sleep 5 # Give the mysql_upgrade a bit of time to complete before querying the server
     - *test-verify-final
 
-mariadb.org-11.4 upgrade:
+mariadb.org-11.8 upgrade:
   extends: .salsa-ci-template-for-mariadb-upgrade
   stage: upgrade MariaDB variant
   variables:
-    MARIADB_VERSION: "11.4"
+    MARIADB_VERSION: "11.8"
   script:
     - apt-get install -qq --yes mariadb-server
+    - dpkg -l | grep -e "mariadb-server.*11\.8"
     - *test-verify-initial
     # Install MariaDB built in this commit
     # Force downgrades so our version installs on top of upstream revision, e.g. 1:11.4.2-1 vs 1:11.4.2+mariadb~debsid
@@ -1022,79 +1051,59 @@ mariadb.org-11.4 upgrade:
     - service mariadb status # There is no init.d/mysql in MariaDB 10.5+
     - *test-verify-final
 
-mariadb.org-10.11 upgrade:
-  extends: .salsa-ci-template-for-mariadb-upgrade
-  stage: upgrade MariaDB variant
-  variables:
-    MARIADB_VERSION: "10.11"
-  script:
-    # this should not use Sid to begin with
-    - apt-get install -qq --yes mariadb-server=1:10.11.8+maria~debsid mariadb-client=1:10.11.8+maria~debsid
-    - *test-verify-initial
-    - *test-full-upgrade
-    - service mariadb status # There is no init.d/mysql in MariaDB 10.5+
-    - *test-verify-final
-
-mariadb.org-10.10 upgrade:
+# archive.mariadb.org for Debian Sid latest is 11.7.2
+mariadb.org-11.7 upgrade:
   extends: .salsa-ci-template-for-mariadb-upgrade
   stage: upgrade MariaDB variant
   variables:
-    MARIADB_VERSION: "10.10"
+    MARIADB_VERSION: "11.7"
   script:
-    # this should not use Sid to begin with
-    - apt-get install -qq --yes mariadb-server=1:10.10.2+maria~debunstable mariadb-client=1:10.10.2+maria~debunstable
-    - *test-verify-initial
-    - *test-full-upgrade
-    - service mariadb status # There is no init.d/mysql in MariaDB 10.5+
-    - *test-verify-final
-
-mariadb.org-10.9 upgrade:
-  extends: .salsa-ci-template-for-mariadb-upgrade
-  stage: upgrade MariaDB variant
-  variables:
-    MARIADB_VERSION: "10.9"
-  script:
-    # this should not use Sid to begin with
-    - apt-get install -qq --yes mariadb-server=1:10.9.4+maria~debunstable mariadb-client=1:10.9.4+maria~debunstable
+    - apt-get install -qq --yes mariadb-server
+    - dpkg -l | grep -e "mariadb-server.*11\.7"
     - *test-verify-initial
-    - *test-full-upgrade
+    - *test-install-all
     - service mariadb status # There is no init.d/mysql in MariaDB 10.5+
     - *test-verify-final
 
-mariadb.org-10.8 upgrade:
+# archive.mariadb.org for Debian Sid latest is 11.4.5
+mariadb.org-11.4 upgrade:
   extends: .salsa-ci-template-for-mariadb-upgrade
   stage: upgrade MariaDB variant
   variables:
-    MARIADB_VERSION: "10.8"
+    MARIADB_VERSION: "11.4"
   script:
-    - apt-get install -qq --yes mariadb-server-10.8
+    - apt-get install -qq --yes mariadb-server
+    - dpkg -l | grep -e "mariadb-server.*11\.4"
     - *test-verify-initial
     - *test-install-all
     - service mariadb status # There is no init.d/mysql in MariaDB 10.5+
     - *test-verify-final
 
-mariadb.org-10.7 upgrade:
+# archive.mariadb.org for Debian Sid latest is 10.11.8
+mariadb.org-10.11 upgrade:
   extends: .salsa-ci-template-for-mariadb-upgrade
   stage: upgrade MariaDB variant
   variables:
-    MARIADB_VERSION: "10.7"
+    MARIADB_VERSION: "10.11"
   script:
-    - apt-get install -qq --yes mariadb-server-10.7
+    - apt-get install -qq --yes mariadb-server
+    - dpkg -l | grep -e "mariadb-server.*10\.11"
     - *test-verify-initial
     - *test-install-all
     - service mariadb status # There is no init.d/mysql in MariaDB 10.5+
     - *test-verify-final
 
+# archive.mariadb.org for Debian Sid latest is 10.6.12
 mariadb.org-10.6 upgrade:
   extends: .salsa-ci-template-for-mariadb-upgrade
   stage: upgrade MariaDB variant
   variables:
     MARIADB_VERSION: "10.6"
   script:
-    # Package libmariadbclient-dev from mariadb.org conflicts with libmariadb-dev in Sid, so cannot use wildcard that would include it
-    # Enable this line when there is a way to install them only from the mariadb.org repo
+    # Enable this line when there mariadb-server-10.5 metapackage anymore in Sid
     # - apt-get install -qq --yes 'mariadb*' libmariadb3 'libmariadb-*' 'libmariadbd*'
-    - apt-get install -qq --yes mariadb-server-10.6
+    - apt-get install -qq --yes mariadb-server
+    - dpkg -l | grep -e "mariadb-server.*10\.6"
     - *test-verify-initial
     - *test-install-all
     - service mariadb status # There is no init.d/mysql in MariaDB 10.5+
@@ -1107,8 +1116,20 @@ mariadb.org-10.5 upgrade:
   variables:
     MARIADB_VERSION: "10.5"
   script:
-    - *test-install-openssl1-in-sid-for-backwards-compat
-    - apt-get install -qq --yes mariadb-server-10.5
+    # OpenSSL 1.1 was removed from Debian Sid in Dec 2022 as Bookworm will ship
+    # with OpenSSL 3.0 only. Use OpenSSL 1.1 from Debian snapshots to be able to
+    # install MariaDB binaries that depend on it.
+    - |
+      apt-get -qq install --no-install-recommends --yes curl ca-certificates
+      curl -sLO https://snapshot.debian.org/archive/debian/20220507T034236Z/pool/main/o/openssl/libssl1.1_1.1.1o-1_amd64.deb
+      apt-get -qq install --no-install-recommends --yes ./libssl1.1_1.1.1o-1_amd64.deb
+    # Package libaio1 was replaced by libaio1t64 in Debian Sid in April 2024.
+    # Use libaio1 from Debian snapshots to be able to install MariaDB binaries
+    # that depend on it.
+    - |
+      curl -sLO https://snapshot.debian.org/archive/debian/20240331T210805Z/pool/main/liba/libaio/libaio1_0.3.113-5_amd64.deb
+      apt-get -qq install --no-install-recommends --yes ./libaio1_0.3.113-5_amd64.deb
+    - apt-get install -qq --yes mariadb-server
     - *test-verify-initial
     - *test-install-all
     - service mariadb status # There is no init.d/mysql in MariaDB 10.5+
@@ -1123,11 +1144,9 @@ mysql.com-5.7 with Buster upgrade:
   image: debian:buster
   script:
     - *test-prepare-container
-    - |
-      apt-get install -qq --yes --no-install-recommends gpg gpg-agent dirmngr ca-certificates # Bare minimal (<4MB) for apt-key to work
-      apt-key adv --recv-keys --keyserver hkps://keyserver.ubuntu.com:443 B7B3B788A8D3785C BCA43417C3B485DD128EC6D4B7B3B788A8D3785C
-      echo "deb https://repo.mysql.com/apt/debian/ buster mysql-5.7" > /etc/apt/sources.list.d/mysql.list
-      apt-get update -qq
+    - apt-get install -qq --yes --no-install-recommends ca-certificates
+    - echo "deb https://repo.mysql.com/apt/debian/ buster mysql-5.7" > /etc/apt/sources.list.d/mysql.list
+    - apt-get update -qq
     - apt-get install -qq --yes mysql-server 'libmysqlc*'
     # Ensure MySQL 5.7 package actually got installed
     - dpkg -l | grep -e "mysql-server.*5.7"
@@ -1146,7 +1165,6 @@ mysql.com-5.7 with Buster upgrade:
     - service mysql status || service mariadb status
     - sleep 15 # Give the mysql_upgrade a bit of extra time to complete with MySQL 5.7 before querying the server
     - *test-verify-final
-  allow_failure: true  # Temporarily allow failure due to usrmerge related changes in fall 2024
 
 # Note: pmm2-client does not exist in the Bookworm repository anymore
 percona-xtradb-5.7 with Bookworm upgrade:
@@ -1155,11 +1173,9 @@ percona-xtradb-5.7 with Bookworm upgrade:
   image: debian:bookworm
   script:
     - *test-prepare-container
-    - |
-      apt-get install -qq --yes --no-install-recommends ca-certificates curl systemctl
-      curl -sL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x9334A25F8507EFA5" -o /etc/apt/trusted.gpg.d/percona.asc
-      echo "deb https://repo.percona.com/apt/ bookworm main" > /etc/apt/sources.list.d/percona.list
-      apt-get update -qq
+    - apt-get install -qq --yes --no-install-recommends ca-certificates
+    - echo "deb https://repo.percona.com/apt/ bookworm main" > /etc/apt/sources.list.d/percona.list
+    - apt-get update -qq
     - apt-get install -qq --yes percona-xtradb-cluster-full-57 percona-xtrabackup-24 percona-toolkit
     # Ensure Percona 5.7 package actually got installed
     - dpkg -l | grep -e "percona.*5\.7"
diff --git a/debian/tests/configuration-tracing b/debian/tests/configuration-tracing
index 23c60932927..07dba4173cc 100755
--- a/debian/tests/configuration-tracing
+++ b/debian/tests/configuration-tracing
@@ -49,10 +49,6 @@ trace() {
     # Hostname varies one very machine
     sed "s/$(hostname)/HOSTNAME/g" -i "$TEMPFILE"
 
-    # Version/revision increases on every release
-    VERSION=$($MARIADB_SERVER_PATH/mariadbd --help --verbose | grep -e "^version " | rev | cut -d ' ' -f 1 | rev)
-    sed "s/$VERSION/VERSION/g" -i "$TEMPFILE"
-
     # SSL library version inherited form dependency, not relevant for tracing
     # the correctness of the MariaDB build itself
     sed 's/OpenSSL 3.*/SSL-VERSION/' -i "$TEMPFILE"
@@ -66,8 +62,10 @@ trace() {
     # armhf/armel might have: debian-linux-gnueabi, debian-linux-gnueabihf
     normalize_value version-compile-os debian-linux-gnu
 
-    # In Sid 'Debian n/a', in Bookworm 'Debian 12'
-    normalize_value version-comment "Debian RELEASE"
+    # Version strings and compilation comment contents may change on every
+    # release and build on different Debian/Ubuntu releases and architecutres
+    normalize_value version "VERSION"
+    normalize_value version-comment "VERSION-COMMENT"
 
     # Inherits git commit id from latest upstream release and thus not constant
     normalize_value version-source-revision -
diff --git a/debian/tests/control b/debian/tests/control
index 0a605dc0ced..f1cd4bc58e4 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -16,6 +16,7 @@ Depends:
  mariadb-plugin-provider-lzo,
  mariadb-plugin-provider-snappy,
  mariadb-plugin-rocksdb [amd64 arm64 mips64el ppc64el riscv64 loong64],
+ mariadb-server,
 Restrictions:
  allow-stderr,
  isolation-container,
diff --git a/debian/tests/traces/mariadbd-verbose-help.expected b/debian/tests/traces/mariadbd-verbose-help.expected
index de6817cd4fb..4f2cf5af76b 100644
--- a/debian/tests/traces/mariadbd-verbose-help.expected
+++ b/debian/tests/traces/mariadbd-verbose-help.expected
@@ -605,9 +605,8 @@ The following specify which files/extra groups are read (specified before remain
                       FORCE_PLUS_PERMANENT (like FORCE, but the plugin can not
                       be uninstalled).
   --innodb-buffer-pool-chunk-size=# 
-                      Size of a single memory chunk for resizing buffer pool.
-                      Online buffer pool resizing happens at this granularity.
-                      0 means autosize this variable based on buffer pool size
+                      Deprecated parameter with no effect. Deprecated, will be
+                      removed in a future release.
   --innodb-buffer-pool-dump-at-shutdown 
                       Dump the buffer pool into a file named
                       @@innodb_buffer_pool_filename
@@ -633,6 +632,11 @@ The following specify which files/extra groups are read (specified before remain
   --innodb-buffer-pool-size=# 
                       The size of the memory buffer InnoDB uses to cache data
                       and indexes of its tables
+  --innodb-buffer-pool-size-auto-min=# 
+                      Minimum innodb_buffer_pool_size for dynamic shrinking on
+                      memory pressure
+  --innodb-buffer-pool-size-max=# 
+                      Maximum innodb_buffer_pool_size
   --innodb-buffer-pool-stats[=name] 
                       Enable or disable INNODB_BUFFER_POOL_STATS plugin. One
                       of: ON, OFF, FORCE (don't start if the plugin fails to
@@ -741,7 +745,7 @@ The following specify which files/extra groups are read (specified before remain
   --innodb-encryption-rotation-iops=# 
                       Use this many iops for background key rotation
   --innodb-encryption-threads=# 
-                      Number of threads performing background key rotation 
+                      Number of threads performing background key rotation
   --innodb-fast-shutdown[=#] 
                       Speeds up the shutdown process of the InnoDB storage
                       engine. Possible values are 0, 1 (faster), 2
@@ -816,7 +820,7 @@ The following specify which files/extra groups are read (specified before remain
                       FORCE_PLUS_PERMANENT (like FORCE, but the plugin can not
                       be uninstalled).
   --innodb-ft-enable-diag-print 
-                      Whether to enable additional FTS diagnostic printout 
+                      Whether to enable additional FTS diagnostic printout
   --innodb-ft-enable-stopword 
                       Create FTS index with stopword
                       (Defaults to on; use --skip-innodb-ft-enable-stopword to disable.)
@@ -836,7 +840,7 @@ The following specify which files/extra groups are read (specified before remain
                       InnoDB Fulltext search minimum token size in characters
   --innodb-ft-num-word-optimize[=#] 
                       InnoDB Fulltext search number of words to optimize for
-                      each optimize table call 
+                      each optimize table call
   --innodb-ft-result-cache-limit=# 
                       InnoDB Fulltext search query result cache limit in bytes
   --innodb-ft-server-stopword-table[=name] 
@@ -875,6 +879,9 @@ The following specify which files/extra groups are read (specified before remain
                       be uninstalled).
   --innodb-log-buffer-size=# 
                       Redo log buffer size in bytes
+  --innodb-log-checkpoint-now 
+                      Write back dirty pages from the buffer pool and update
+                      the log checkpoint
   --innodb-log-file-buffering 
                       Whether the file system cache for ib_logfile0 is enabled
   --innodb-log-file-mmap 
@@ -888,8 +895,8 @@ The following specify which files/extra groups are read (specified before remain
   --innodb-log-group-home-dir=name 
                       Path to ib_logfile0
   --innodb-log-spin-wait-delay[=#] 
-                      Delay between log buffer spin lock polls (0 to use a
-                      blocking latch)
+                      Deprecated parameter with no effect. Deprecated, will be
+                      removed in a future release.
   --innodb-log-write-ahead-size=# 
                       Redo log write size to avoid read-on-write; must be a
                       power of two
@@ -2453,7 +2460,7 @@ The following specify which files/extra groups are read (specified before remain
                       wsrep_sst_donor as a preferred donor. Note that multiple
                       nodes in a cluster can have the same name
   --wsrep-notify-cmd=name 
-  --wsrep-on          To enable wsrep replication 
+  --wsrep-on          To enable wsrep replication
   --wsrep-provider=name 
                       Path to replication provider library
   --wsrep-provider-options=name 
@@ -2488,7 +2495,7 @@ The following specify which files/extra groups are read (specified before remain
   --wsrep-sst-receive-address=name 
                       Address where node is waiting for SST contact
   --wsrep-start-position=name 
-                      global transaction position to start from 
+                      global transaction position to start from
   --wsrep-status-file=name 
                       wsrep status output filename
   --wsrep-sync-wait[=#] 
@@ -2672,6 +2679,8 @@ innodb-buffer-pool-load-abort                                FALSE
 innodb-buffer-pool-load-at-startup                           TRUE
 innodb-buffer-pool-load-now                                  FALSE
 innodb-buffer-pool-size                                      134217728
+innodb-buffer-pool-size-auto-min                             0
+innodb-buffer-pool-size-max                                  0
 innodb-buffer-pool-stats                                     ON
 innodb-checksum-algorithm                                    full_crc32
 innodb-cmp                                                   ON
@@ -2740,6 +2749,7 @@ innodb-lock-wait-timeout                                     50
 innodb-lock-waits                                            ON
 innodb-locks                                                 ON
 innodb-log-buffer-size                                       16777216
+innodb-log-checkpoint-now                                    FALSE
 innodb-log-file-buffering                                    FALSE
 innodb-log-file-mmap                                         TRUE
 innodb-log-file-size                                         100663296
@@ -3011,7 +3021,7 @@ performance-schema-setup-objects-size                        -1
 performance-schema-users-size                                -1
 pid-file                                                     /run/mysqld/mysqld.pid
 plugin-dir                                                   /usr/lib/mysql/plugin/
-plugin-maturity                                              beta
+plugin-maturity                                              gamma
 port                                                         3306
 port-open-timeout                                            0
 preload-buffer-size                                          32768
@@ -3167,7 +3177,7 @@ user-variables                                               ON
 userstat                                                     FALSE
 verbose                                                      TRUE
 version                                                      VERSION
-version-comment                                              Debian RELEASE
+version-comment                                              VERSION-COMMENT
 version-compile-machine                                      ARCH
 version-compile-os                                           debian-linux-gnu
 version-malloc-library                                       system
diff --git a/debian/unstable-tests.alpha b/debian/unstable-tests.alpha
index 722ed455ecb..aa4513203a1 100644
--- a/debian/unstable-tests.alpha
+++ b/debian/unstable-tests.alpha
@@ -1,2 +1,3 @@
 main.alter_table_mdev539_maria : MDEV-23922
+main.mysql-interactive : disable new test in MariaDB 10.4.6 with Windows line endings that cause unpatcheable line ending mismatches
 repair_symlink-5543            : MDEV-23920
diff --git a/debian/unstable-tests.amd64 b/debian/unstable-tests.amd64
index 667c2e26ea0..75d63510662 100644
--- a/debian/unstable-tests.amd64
+++ b/debian/unstable-tests.amd64
@@ -1,2 +1,3 @@
+main.mysql-interactive : disable new test in MariaDB 10.4.6 with Windows line endings that cause unpatcheable line ending mismatches
 main.mysqld--help-aria : MDEV-36334
 unit.conc_connection : CONC-640: unit.conc_connection fails on test_conc21
diff --git a/debian/unstable-tests.arm64 b/debian/unstable-tests.arm64
index f5991c855db..f57ce52506e 100644
--- a/debian/unstable-tests.arm64
+++ b/debian/unstable-tests.arm64
@@ -1,3 +1,4 @@
 binlog.flashback-largebinlog : MDEV-32352
+main.mysql-interactive : disable new test in MariaDB 10.4.6 with Windows line endings that cause unpatcheable line ending mismatches
 main.mysqld--help-aria : MDEV-36334
 unit.conc_connection : CONC-640: unit.conc_connection fails on test_conc21
diff --git a/debian/unstable-tests.armel b/debian/unstable-tests.armel
index 667c2e26ea0..75d63510662 100644
--- a/debian/unstable-tests.armel
+++ b/debian/unstable-tests.armel
@@ -1,2 +1,3 @@
+main.mysql-interactive : disable new test in MariaDB 10.4.6 with Windows line endings that cause unpatcheable line ending mismatches
 main.mysqld--help-aria : MDEV-36334
 unit.conc_connection : CONC-640: unit.conc_connection fails on test_conc21
diff --git a/debian/unstable-tests.armhf b/debian/unstable-tests.armhf
index 4aa7d2359aa..0f7751e18ee 100644
--- a/debian/unstable-tests.armhf
+++ b/debian/unstable-tests.armhf
@@ -1,6 +1,7 @@
 # MDEV-33381: The full test suite (including --big-test) has numerous failures
 # on armhf and a Raspberry Pi enthusiast is needed to debug them
 federated.federatedx_versioning : MDEV-33381
+main.mysql-interactive : disable new test in MariaDB 10.4.6 with Windows line endings that cause unpatcheable line ending mismatches
 main.mysqld--help-aria : MDEV-36334
 main.xml : MDEV-21968
 period.versioning : MDEV-33381
diff --git a/debian/unstable-tests.hppa b/debian/unstable-tests.hppa
index 79fffb86722..abbf5ba30d2 100644
--- a/debian/unstable-tests.hppa
+++ b/debian/unstable-tests.hppa
@@ -6,6 +6,7 @@ main.derived_split_innodb : MDEV-32375
 main.explain_json_format_partitions : MDEV-32375
 main.join_cache_notasan : MDEV-31893 (fixed but perhaps not for hppa)
 main.join_cache_notasan : MDEV-34084
+main.mysql-interactive : disable new test in MariaDB 10.4.6 with Windows line endings that cause unpatcheable line ending mismatches
 main.rowid_filter_innodb : MDEV-32375
 repair_symlink-5543  : MDEV-23920
 unit.conc_connection : CONC-640: unit.conc_connection fails on test_conc21
diff --git a/debian/unstable-tests.i386 b/debian/unstable-tests.i386
index 8210ff0f438..54245a303c4 100644
--- a/debian/unstable-tests.i386
+++ b/debian/unstable-tests.i386
@@ -1 +1,2 @@
+main.mysql-interactive : disable new test in MariaDB 10.4.6 with Windows line endings that cause unpatcheable line ending mismatches
 main.mysqld--help-aria : MDEV-36334
diff --git a/debian/unstable-tests.mips64el b/debian/unstable-tests.mips64el
index 8210ff0f438..54245a303c4 100644
--- a/debian/unstable-tests.mips64el
+++ b/debian/unstable-tests.mips64el
@@ -1 +1,2 @@
+main.mysql-interactive : disable new test in MariaDB 10.4.6 with Windows line endings that cause unpatcheable line ending mismatches
 main.mysqld--help-aria : MDEV-36334
diff --git a/debian/unstable-tests.powerpc b/debian/unstable-tests.powerpc
index 818de085597..32eb42eaaad 100644
--- a/debian/unstable-tests.powerpc
+++ b/debian/unstable-tests.powerpc
@@ -1 +1,2 @@
+main.mysql-interactive : disable new test in MariaDB 10.4.6 with Windows line endings that cause unpatcheable line ending mismatches
 unit.conc_connection : CONC-640: unit.conc_connection fails on test_conc21
diff --git a/debian/unstable-tests.ppc64 b/debian/unstable-tests.ppc64
index 818de085597..32eb42eaaad 100644
--- a/debian/unstable-tests.ppc64
+++ b/debian/unstable-tests.ppc64
@@ -1 +1,2 @@
+main.mysql-interactive : disable new test in MariaDB 10.4.6 with Windows line endings that cause unpatcheable line ending mismatches
 unit.conc_connection : CONC-640: unit.conc_connection fails on test_conc21
diff --git a/debian/unstable-tests.ppc64el b/debian/unstable-tests.ppc64el
index 667c2e26ea0..75d63510662 100644
--- a/debian/unstable-tests.ppc64el
+++ b/debian/unstable-tests.ppc64el
@@ -1,2 +1,3 @@
+main.mysql-interactive : disable new test in MariaDB 10.4.6 with Windows line endings that cause unpatcheable line ending mismatches
 main.mysqld--help-aria : MDEV-36334
 unit.conc_connection : CONC-640: unit.conc_connection fails on test_conc21
diff --git a/debian/unstable-tests.riscv64 b/debian/unstable-tests.riscv64
index 667c2e26ea0..75d63510662 100644
--- a/debian/unstable-tests.riscv64
+++ b/debian/unstable-tests.riscv64
@@ -1,2 +1,3 @@
+main.mysql-interactive : disable new test in MariaDB 10.4.6 with Windows line endings that cause unpatcheable line ending mismatches
 main.mysqld--help-aria : MDEV-36334
 unit.conc_connection : CONC-640: unit.conc_connection fails on test_conc21
diff --git a/debian/unstable-tests.s390x b/debian/unstable-tests.s390x
index 667c2e26ea0..75d63510662 100644
--- a/debian/unstable-tests.s390x
+++ b/debian/unstable-tests.s390x
@@ -1,2 +1,3 @@
+main.mysql-interactive : disable new test in MariaDB 10.4.6 with Windows line endings that cause unpatcheable line ending mismatches
 main.mysqld--help-aria : MDEV-36334
 unit.conc_connection : CONC-640: unit.conc_connection fails on test_conc21
diff --git a/debian/unstable-tests.sparc64 b/debian/unstable-tests.sparc64
index 813d785bba0..70debd4dfd6 100644
--- a/debian/unstable-tests.sparc64
+++ b/debian/unstable-tests.sparc64
@@ -1,3 +1,5 @@
+main.check : MDEV-36670
+main.concurrent_innodb_safelog : MDEV-36670
 main.ctype_binary : https://bugs.debian.org/1053485
 main.ctype_latin1 : https://bugs.debian.org/1053485
 main.features : MDEV-27954
@@ -8,16 +10,19 @@ main.group_by : MDEV-27954
 main.group_by_null : MDEV-27954
 main.long_unique_bugs : MDEV-30928
 main.mariadb-import : MDEV-36670
+main.mysql-interactive : disable new test in MariaDB 10.4.6 with Windows line endings that cause unpatcheable line ending mismatches
 main.mysqld--help-aria : MDEV-36334
 main.partition : MDEV-27954
 main.partition_icp : MDEV-36669
 main.partition_order : MDEV-27954
 main.repair_symlink-5543 : MDEV-23920
+main.sp-innodb : MDEV-36670
 main.type_datetime : MDEV-27954
 main.vector : MDEV-36670
 main.vector_aria : MDEV-36670
 main.vector_funcs : MDEV-36670
 main.vector_innodb : MDEV-36670
+main.vector2 : MDEV-36670
 main.vector2_notembedded : MDEV-36670
 main.view : MDEV-36145
 main.xml : MDEV-21968
diff --git a/debian/upstream/metadata b/debian/upstream/metadata
index 184baa42788..78bf453edc7 100644
--- a/debian/upstream/metadata
+++ b/debian/upstream/metadata
@@ -1,6 +1,6 @@
 Bug-Database: https://jira.mariadb.org
 Bug-Submit: https://jira.mariadb.org
 Donation: https://mariadb.org/donate/
-Repository: git://github.com/MariaDB/server.git
+Repository: https://github.com/MariaDB/server.git
 Repository-Browse: https://github.com/MariaDB/server
 Security-Contact: security@mariadb.org
