InfluxDB v2.8.0

v2.8.0
Added 1
  • Add optional token hashing via --use-hashed-tokens flag to store API tokens as hashes on disk
Changed 1
  • Update Go to 1.24.9
Fixed 1
  • Fix compilation on alpine linux

In addition to the list of changes below, please also see the official release notes for other important information about this release.

v2.8.0 [2025/12/12]

Bug Fixes
  1. 305e61d: Fix compilation on alpine linux
Features
  1. 5e204dc: Add optional token hashing
Token Hashing

InfluxDB OSS 2.8.0 introduces token hashing. When activated using the --use-hashed-tokens, all API tokens are stored as hashes on disk. While token hashing is a valuable security upgrade, care should be taken when upgrading and enabling token hashing.

Documentation link: use-hashed-tokens

It is highly recommended to upgrade to 2.8.0 or later versions and enable hashed tokens in two steps, not one.

How Token Hashing Works

Upon upgrading to version 2.8.0 or later releases from version 2.7.12 or earlier releases, the BoltDB schema is upgraded to add a new index bucket.

Upon startup when token hashing is enabled, all unhashed tokens are converted to hashed tokens and unhashed tokens are deleted. This check and conversion of unhashed tokens occurs on every startup when token hashing is enabled.

When token hashing is disabled, any new tokens are stored as hashed tokens. If token hashing is disabled after being disabled, newly created tokens are stored unhashed. However, existing tokens remain hashed on disk.

Hashed Tokens Are Lost During Downgrade

Be aware that once token hashing is enabled, downgrading to a version earlier than 2.8.0 will erase all API tokens due to the required schema downgrade. This means downgrading requires recreating all API tokens and updating them on clients. Even if token hashing is disabled before downgrading, all API tokens will still need to be recreated because disabling token hashing does not unhash tokens stored in hashed form.

If token hashing is never enabled, then it is possible to downgrade from 2.8.0 to 2.7.12 and earlier.

Recommended Process

It is not necessary to enabled token hashing immediately after upgrading. Token hashing is also not required by 2.8.0.

  1. Upgrade InfluxDB.
    1. Initiate influxd shutdown.
    2. Wait for a clean shutdown.
    3. Upgrade influxd.
    4. Start influxd.
  2. Verify upgrade is successful.
  3. Enable Token Hashing (if desired)
    1. Initiate influxd shutdown.
    2. Wait for a clean shutdown.
    3. Update configuration to use token hashing by adding --use-hashed-tokens to the command line or INFLUXD_USE_HASHED_TOKENS=true to the container environment. Or set use-hashed-tokens to true in the configuration file.
    4. Start influxd.
Other
  1. 1e14c08: Update Go to 1.24.9
  2. 40a6332: Updates post-install for linux package builds
OSS BINARY FILESSHA256
influxdb2-2.8.0_darwin_amd64.tar.gzab08199474f26c2feb636b993b1aaa3b159b9d849d0e66a69a812af193a042ec
influxdb2-2.8.0_linux_arm64.tar.gz263196a8970ceea2d8ff4b90c85555b7573a86c9d83f797a8dfc136e554edd70
influxdb2-2.8.0_linux_amd64.tar.gzdf28cb9d3cb47732908604d963b20271a3fb0e83f418976cc482f991e328957d
influxdb2-2.8.0-windows.zip464d1240a7764c1c024021b5c5ac4a9943570929d615beec83a12f5e793becae
OSS UBUNTU & DEBIAN PACKAGE FILESSHA256
influxdb2_2.8.0-1_amd64.deba4f2bcbf858ea664136c83faf603aa694edef4d1a54b11ad8305126fd77e9142
influxdb2_2.8.0-1_arm64.debb0a5326a3ecaad20176528dd7404a3b262bb59a9eae15095fb5f2bab085e2757
OSS REDHAT & CENTOS PACKAGE FILESSHA256
influxdb2-2.8.0.x86_64.rpmfc5cdb6d3fdec1d8b4d0e3130cb424ea14dbf88da4de8d88666aa4bc87adfc57
influxdb2-2.8.0.aarch64.rpmf53d82e0f2b2a60b941ba3119f42b444a9a840e0d956dfa9e2cb0876eef7952d
View original

Upgraded? How did it go?

Discussion