Release Notes for v25.2-v25.2.19 (#23400)

Author: release-notes-automation[bot]

src/current/_data/releases.yml

@@ -11627,3 +11627,37 @@
       CockroachDB Cloud clusters. To request to upgrade
       a CockroachDB self-hosted cluster to this version,
       [contact support](https://support.cockroachlabs.com/hc/requests/new).
+
+- release_name: v25.2.19
+  major_version: v25.2
+  release_date: '2026-05-29'
+  release_type: Production
+  go_version: go1.26.2
+  sha: b7e5c408b737ce9e98f06ee972b165548ab3ffd8
+  has_sql_only: true
+  has_sha256sum: true
+  mac:
+    mac_arm: true
+    mac_arm_experimental: true
+    mac_arm_limited_access: false
+  windows: true
+  linux:
+    linux_arm: true
+    linux_arm_experimental: false
+    linux_arm_limited_access: false
+    linux_intel_fips: true
+    linux_arm_fips: false
+  docker:
+    docker_image: cockroachdb/cockroach
+    docker_arm: true
+    docker_arm_experimental: false
+    docker_arm_limited_access: false
+  source: true
+  previous_release: v25.2.18
+  cloud_only: true
+  cloud_only_message_short: 'Available only for select CockroachDB Cloud clusters'
+  cloud_only_message: >
+      This version is currently available only for select
+      CockroachDB Cloud clusters. To request to upgrade
+      a CockroachDB self-hosted cluster to this version,
+      [contact support](https://support.cockroachlabs.com/hc/requests/new).

src/current/_includes/releases/v25.2/v25.2.19.md

@@ -0,0 +1,13 @@
+## v25.2.19
+
+Release Date: May 29, 2026
+
+{% include releases/new-release-downloads-docker-image.md release=include.release %}
+
+<h3 id="v25-2-19-bug-fixes">Bug fixes</h3>
+
+- Fixed a bug where unqualified function calls could fail with incorrect privilege errors when two databases on the same cluster had identically-named functions in custom schemas. The query cache could serve a memo from one database context to another, causing `USAGE` privilege errors referencing schemas from the wrong database.
+- Fixed a rare panic that could occur when a virtual cluster entry was removed before it was fully populated by the rangefeed.
+- Fixed a possible `SIGSEGV` crash when a backup encountered a transient error writing to Azure Blob Storage.
+- A long-running `BACKUP` to S3 using `AUTH=implicit` no longer fails with an `ExpiredToken` error when it races the rotation of the underlying short-lived credentials. The S3 client now retries `ExpiredToken`, `ExpiredTokenException`, and `RequestExpired` errors the same way the legacy `aws-sdk-go` v1 client did.
+- Fixed a rare nil pointer panic in the internal SQL executor.