MySQL 26.10: What's New in REST APIs, Authentication, and Database Performance?

Building a REST API around MySQL usually involves more than writing SQL queries. You need an application server, database connections, authentication, authorization, response formatting, and somewhere to deploy and maintain all of it.

MySQL 26.10 offers an interesting alternative for applications that primarily need secure access to database-backed resources.

Released on October 20, 2026, MySQL 26.10 introduces an in-server REST Service component, brings WebAuthn authentication and Health Monitor capabilities to Community Edition, and improves JSON document updates, query diagnostics, and InnoDB internals.

The most interesting change isn't simply that MySQL can serve HTTPS requests. It's that developers now have another choice about where the boundary between their application and database should live.

Here's what actually changed, how the new features work, and when they're worth adopting.

1. MySQL 26.10 Introduces REST APIs Directly Inside the Database Server

The headline feature of MySQL 26.10 is the general availability of the MySQL REST Service (MRS) Server Component.

MRS itself isn't entirely new. Previous deployments could use MySQL Router to host REST endpoints connected to a MySQL database.

What's new is that MRS can now run directly inside mysqld, without requiring a separate MySQL Router process.

This allows applications to communicate with configured database resources over HTTPS while MySQL handles the associated data-access operations.

How the REST Service works

Consider a product catalog application.

Normally, a Laravel backend might query a products table, transform the results into JSON, apply access rules, and return an HTTP response.

With MRS, developers can configure selected tables, views, or procedures as REST resources. The service handles the corresponding database access and JSON responses.

A simplified architecture comparison looks like this:

Traditional Laravel API

Frontend / Mobile App
         |
         v
    Laravel API
         |
         v
     MySQL Server

MySQL 26.10 with embedded MRS

Frontend / Mobile App
         |
       HTTPS
         |
         v
  MySQL REST Service
    (inside mysqld)
         |
         v
      MySQL Data

The second approach removes a separate API runtime for suitable data-access workloads. It doesn't eliminate the need for authentication, authorization, or application business rules.

MRS also supports relational-to-JSON mapping, configurable access controls, and generated client SDKs for supported languages.

Installing the REST Service component

On a MySQL 26.10 Server installation that includes the component, an appropriately privileged administrator can install it using:

INSTALL COMPONENT 'file://component_mysql_rest_service';

The REST Service can be managed using SQL functions:

SELECT mysql_rest_service_restart();

To inspect its current state:

SHOW GLOBAL STATUS
LIKE 'mysql_rest_service.state';

The default HTTPS listener uses port 33443, which can be changed using the mysql_rest_service.http_port configuration variable.

There is one setup detail worth knowing: installing the component does not automatically create a working API.

MRS requires its metadata schema and configured, published REST services. If that metadata is unavailable, the component can remain in the WAITING_FOR_METADATA state. A READY state indicates that the REST runtime and HTTPS listener are running, but only published endpoints are served.

The MySQL REST Service documentation explains the metadata setup, service publishing, and required privileges.

Should Laravel developers replace their API layer?

For straightforward CRUD applications, internal tools, dashboards, or carefully scoped data services, MRS could reduce the amount of backend code needed.

But I wouldn't recommend replacing a Laravel API simply because the database can now serve HTTP.

A Laravel application may coordinate payments, dispatch queues, enforce domain-specific authorization, call external services, or execute multi-step business workflows. Those responsibilities still need an appropriate application layer.

There's also an operational trade-off. Running HTTP request handling inside the database places API traffic and database workloads closer together. Resource limits, network exposure, failure isolation, and observability become particularly important.

MRS is most attractive when data access is the main job. A traditional backend remains valuable when business logic is the main job.

2. Enhanced Authentication: WebAuthn Comes to Community Edition

Security is another important part of the MySQL 26.10 release.

The authentication_webauthn server plugin is now available in MySQL Community Edition for Innovation releases.

WebAuthn supports authentication using FIDO-compatible devices, enabling multifactor and passwordless authentication configurations.

This expands the authentication options available to Community Edition users without requiring Enterprise Edition solely for this plugin.

What this means in practice

Instead of relying exclusively on a traditional database password, supported authentication flows can use registered security devices.

For database administrators and organizations managing privileged database accounts, hardware-backed authentication can reduce reliance on reusable passwords.

However, adopting WebAuthn requires compatible MySQL clients, supported authenticators, and a suitable device-registration process.

It's also important to distinguish two different types of authentication:

• MySQL WebAuthn authentication protects supported database-account login flows.

• MRS application authentication controls who can access published REST APIs.

MRS separately supports authentication approaches including REST-service-specific accounts, MySQL accounts, and configured OAuth2 providers.

Enabling the WebAuthn plugin doesn't automatically give a mobile application's users passkey authentication through its REST endpoints.

That distinction matters when designing a security architecture.

For public-facing APIs, developers should review their MRS authentication provider, HTTPS configuration, permissions, and authorization rules rather than assuming that stronger database login security automatically protects every API request.

3. JSON Relational Duality Views Get More Precise Update Controls

MySQL 26.10 also improves JSON Relational Duality Views, which allow applications to work with JSON representations of underlying relational data.

The idea is useful: developers can preserve structured relational tables while interacting with document-shaped data.

The latest improvements focus on two concerns that frequently become complicated in document-oriented APIs: deciding which fields may change and detecting conflicting updates.

More control over ETAG-based concurrency

MySQL 26.10 introduces CHECK and NO CHECK annotations to determine which fields participate in ETAG calculations.

An ETAG represents the state of selected document data and helps an application detect changes before performing an update.

Imagine an order document containing:

• Order status

• Shipping address

• Delivery instructions

• A frequently updated informational field

If an informational field changes constantly, you may not want that change to invalidate every attempted update to the main order.

The new NO CHECK annotation can exclude appropriate fields from the ETAG calculation.

Developers can also use UPDATE and NO UPDATE annotations to control field mutability through the duality view.

For example, a status field might be readable through a document but not directly modifiable through that view.

These controls offer finer flexibility, but they also require thoughtful design.

Excluding a field from concurrency checks means changes to that field won't cause the ETAG to change. That's appropriate only when such changes should not invalidate another operation.

A poorly chosen NO CHECK annotation could weaken conflict detection that an application actually depends on.

The effective settings are inspectable through the JSON_DUALITY_VIEW_COLUMNS metadata.

This is a useful improvement for applications that work with JSON documents but still want relational constraints and deliberate update semantics.

4. Database Performance and Monitoring Improvements

Not every meaningful database release feature changes application code.

MySQL 26.10 includes several improvements that can help developers and DBAs understand and operate their databases more effectively.

Health Monitor becomes available in Community Edition

Previously associated with MySQL HeatWave, the Health Monitor component is now available in MySQL Community Edition.

It provides visibility into system resource usage and related diagnostic information, including disk capacity monitoring and forecasting.

Administrators can inspect resource information through Performance Schema, allowing database and system diagnostics to be investigated together.

Platform support differs:

• Linux: Supports the complete initial metric set.

• macOS: Supports basic memory, filesystem, and CPU collection.

• Windows: Not supported by the Health Monitor in this release.

Low-disk-space fencing is disabled by default, so the monitoring component doesn't automatically place the server into a restricted state when storage becomes low.

This is useful because monitoring and automatically changing server availability are different operational decisions.

Better visibility into partition pruning

MySQL 26.10 improves the information available through query execution plans.

For supported partitioned tables, EXPLAIN FORMAT=TREE, applicable EXPLAIN ANALYZE plans, and JSON EXPLAIN format version 2 can now identify selected partitions.

For example:

EXPLAIN FORMAT=TREE
SELECT *
FROM orders
WHERE order_date >= '2026-10-01'
  AND order_date < '2026-11-01';

Assuming orders is partitioned by an appropriate date key, the execution plan can show which partitions were selected for reading.

That helps developers investigate whether their partitioning strategy is being used as expected.

One subtle but important distinction: the reported partitions describe the plan-time candidate read set. They are not a measurement of every partition physically accessed at runtime.

This change improves diagnostics; it doesn't automatically make a poorly optimized query faster.

InnoDB recovery and redo-log improvements

MySQL 26.10 also improves how InnoDB processes redo information.

The storage engine can now reuse parsed index metadata during redo-log processing instead of repeatedly rebuilding temporary metadata objects.

This reduces repeated work in the relevant processing path and can benefit recovery and Read Replica Applier workloads.

The release also includes fixes for tablespace handling, page reorganization, and other reliability issues.

These are meaningful improvements, although performance gains depend on workload characteristics. Oracle hasn't established a universal performance improvement percentage that should be applied to every installation.

5. Should You Upgrade to MySQL 26.10?

The answer depends on whether you want the newest capabilities or a longer-lived release track.

MySQL has moved to calendar-based versioning, using a YY.M.P format. The version 26.10.0 identifies the October 2026 release, not MySQL's twenty-sixth major compatibility generation.

MySQL 26.10.0 is an Innovation release, intended to deliver newer functionality through a more frequent release cadence.

Oracle also announced maintenance releases for two LTS lines in October 2026.

Both Innovation and LTS are considered production-grade release tracks. The difference is primarily their release cadence and support model.

A sensible upgrade approach

Before considering an upgrade, check the deployed version:

SELECT VERSION();

Then evaluate the application rather than upgrading simply for the newest release number.

Start by reviewing the official MySQL 26.10 release notes, taking a recoverable backup, and running MySQL Shell's Upgrade Checker against the intended target.

Compatibility deserves special attention because calendar-versioned releases use compatibility lineages for direct upgrades. An older LTS or Innovation installation may need an intermediate upgrade through MySQL 9.7 LTS.

Also validate connector compatibility, replication topology, SQL behavior, and any components your deployment relies on.

For Laravel applications, I'd test database migrations, transactions, authentication-related queries, queue workloads, and critical application queries against a staging environment before changing production.

Oracle's upgrade-path documentation is essential here. A direct binary downgrade from MySQL 26.10 to MySQL 9.7 isn't supported; recovery requires a suitable pre-upgrade backup.

Final Thoughts

MySQL 26.10 is an interesting release because it makes the database more application-facing while also improving security options, document updates, and operational visibility.

The embedded REST Service has the most immediate architectural implications. It can remove unnecessary API infrastructure from applications whose main requirement is controlled database access.

But reducing the number of components doesn't automatically reduce the responsibility of operating the system securely.

For teams running established Laravel applications, the best reason to adopt MySQL 26.10 is a specific capability that delivers meaningful value, not simply the availability of a newer release.

If your existing backend already handles complex business logic reliably, an LTS release may remain the more appropriate choice. If you're building a focused data service, MySQL 26.10's REST capabilities deserve a closer technical evaluation.