Release Notes for v25.4-v25.4.11 (#23401)

Author: release-notes-automation[bot]

src/current/_data/releases.yml

@@ -11628,6 +11628,40 @@
       a CockroachDB self-hosted cluster to this version,
       [contact support](https://support.cockroachlabs.com/hc/requests/new).
 
+- release_name: v25.4.11
+  major_version: v25.4
+  release_date: '2026-05-29'
+  release_type: Production
+  go_version: go1.26.2
+  sha: 6383ee79d8d482ecf9f08f35f9b9a0e835deef7d
+  has_sql_only: true
+  has_sha256sum: true
+  mac:
+    mac_arm: true
+    mac_arm_experimental: true
+    mac_arm_limited_access: false
+  windows: true
+  linux:
+    linux_arm: true
+    linux_arm_experimental: false
+    linux_arm_limited_access: false
+    linux_intel_fips: true
+    linux_arm_fips: false
+  docker:
+    docker_image: cockroachdb/cockroach
+    docker_arm: true
+    docker_arm_experimental: false
+    docker_arm_limited_access: false
+  source: true
+  previous_release: v25.4.10
+  cloud_only: true
+  cloud_only_message_short: 'Available only for select CockroachDB Cloud clusters'
+  cloud_only_message: >
+      This version is currently available only for select
+      CockroachDB Cloud clusters. To request to upgrade
+      a CockroachDB self-hosted cluster to this version,
+      [contact support](https://support.cockroachlabs.com/hc/requests/new).
+
 - release_name: v25.2.19
   major_version: v25.2
   release_date: '2026-05-29'

src/current/_includes/releases/v25.4/v25.4.11.md

@@ -0,0 +1,19 @@
+## v25.4.11
+
+Release Date: May 29, 2026
+
+{% include releases/new-release-downloads-docker-image.md release=include.release %}
+
+<h3 id="v25-4-11-sql-language-changes">SQL language changes</h3>
+
+- Added a new cluster setting `sql.stats.table_statistics_cache.capacity` that controls the maximum number of tables whose statistics are retained in the in-memory LRU cache (default: `256`).
+
+<h3 id="v25-4-11-bug-fixes">Bug fixes</h3>
+
+- Fixed a bug where unqualified function calls could fail with incorrect privilege errors when two databases on the same cluster had identically-named functions in custom schemas. The query cache could serve a memo from one database context to another, causing `USAGE` privilege errors referencing schemas from the wrong database.
+- Fixed a panic during `CREATE VECTOR INDEX` backfill when the table contained a public column ordered before the vector column that was not stored in the source primary index and was not referenced by the new index. In practice this was triggered by virtual computed columns. The schema change crashed the SQL node processing the backfill instead of completing.
+- Fixed a rare panic that could occur when a virtual cluster entry was removed before it was fully populated by the rangefeed.
+- Fixed a bug where Physical Cluster Replication (PCR) reader virtual clusters could permanently fail authentication, causing all SQL connections to fail with "descriptor not found".
+- A long-running `BACKUP` to S3 using `AUTH=implicit` no longer fails with an `ExpiredToken` error when it races the rotation of the underlying short-lived credentials. The S3 client now retries `ExpiredToken`, `ExpiredTokenException`, and `RequestExpired` errors the same way the legacy `aws-sdk-go` v1 client did.
+- Fixed a rare nil pointer panic in the internal SQL executor.
+- The `storage.compression.cr` metric now includes blob files.