diff --git a/cmake/cpack_rpm.cmake b/cmake/cpack_rpm.cmake
index b3c35e2fedd..91e6b38e671 100644
--- a/cmake/cpack_rpm.cmake
+++ b/cmake/cpack_rpm.cmake
@@ -167,7 +167,6 @@ SET(CPACK_RPM_server_USER_FILELIST
     "%config(noreplace) ${INSTALL_SYSCONF2DIR}/*"
     "%config(noreplace) ${INSTALL_SYSCONFDIR}/logrotate.d/mysql"
     )
-
 SET(CPACK_RPM_common_USER_FILELIST ${ignored} "%config(noreplace) ${INSTALL_SYSCONFDIR}/my.cnf")
 SET(CPACK_RPM_shared_USER_FILELIST ${ignored} "%config(noreplace) ${INSTALL_SYSCONF2DIR}/*")
 SET(CPACK_RPM_client_USER_FILELIST ${ignored} "%config(noreplace) ${INSTALL_SYSCONF2DIR}/*")
@@ -183,13 +182,6 @@ MACRO(SETA var)
   ENDFOREACH()
 ENDMACRO(SETA)
 
-IF (CMAKE_VERSION VERSION_GREATER 3.10.0)
-  # cmake bug #14362
-  SET(CPACK_RPM_server_USER_FILELIST ${CPACK_RPM_server_USER_FILELIST}
-      "%caps(cap_ipc_lock=pe) %{_sbindir}/mysqld"
-      )
-ENDIF()
-
 SETA(CPACK_RPM_client_PACKAGE_OBSOLETES
   "mysql-client"
   "MySQL-client"
diff --git a/debian/mariadb-server-core-10.6.postinst b/debian/mariadb-server-core-10.6.postinst
deleted file mode 100644
index 5f79bed2402..00000000000
--- a/debian/mariadb-server-core-10.6.postinst
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/bin/sh
-
-set -e
-
-# inspired by iputils-ping
-#
-# cap_ipc_lock is required if a user wants to use --memlock
-# and has insufficient RLIMIT_MEMLOCK (MDEV-33301)
-
-PROGRAM=$(dpkg-divert --truename /usr/sbin/mysqld)
-
-if [ "$1" = configure ]; then
-  # If we have setcap installed, try setting
-  # which allows us to install our binaries without the setuid
-  # bit.
-  if command -v setcap > /dev/null; then
-    if ! setcap cap_ipc_lock+ep "$PROGRAM"; then
-      echo "Setcap failed on $PROGRAM, required with --memlock if insufficent RLIMIT_MEMLOCK" >&2
-    fi
-  fi
-fi
-
-
-#DEBHELPER#
-
-exit 0
diff --git a/mysql-test/main/ctype_ucs.result b/mysql-test/main/ctype_ucs.result
index eb1220f9a56..cab41febef2 100644
--- a/mysql-test/main/ctype_ucs.result
+++ b/mysql-test/main/ctype_ucs.result
@@ -6520,5 +6520,25 @@ SELECT 1 COLLATE latin1_swedish_ci;
 ERROR 42000: COLLATION 'latin1_swedish_ci' is not valid for CHARACTER SET 'ucs2'
 SET NAMES utf8;
 #
+# MDEV-33772 Bad SEPARATOR value in GROUP_CONCAT on character set conversion
+#
+SET NAMES utf8mb3, @@collation_connection=ucs2_general_ci;
+CREATE TABLE t1 (c VARCHAR(10)) CHARACTER SET ucs2;
+INSERT INTO t1 VALUES ('a'),('A');
+CREATE OR REPLACE VIEW v1 AS
+SELECT COUNT(*) AS cnt, GROUP_CONCAT(c) AS c1 FROM t1 GROUP BY c;
+SELECT * FROM v1;
+cnt	c1
+2	a,A
+SELECT HEX(c1) FROM v1;
+HEX(c1)
+0061002C0041
+SHOW CREATE VIEW v1;
+View	Create View	character_set_client	collation_connection
+v1	CREATE ALGORITHM=UNDEFINED DEFINER=`root`@`localhost` SQL SECURITY DEFINER VIEW `v1` AS select count(0) AS `cnt`,group_concat(`t1`.`c` separator ',') AS `c1` from `t1` group by `t1`.`c`	utf8mb3	ucs2_general_ci
+DROP VIEW v1;
+DROP TABLE t1;
+SET NAMES utf8mb3;
+#
 # End of 10.5 tests
 #
diff --git a/mysql-test/main/ctype_ucs.test b/mysql-test/main/ctype_ucs.test
index 993f9be5c54..93ddcb86964 100644
--- a/mysql-test/main/ctype_ucs.test
+++ b/mysql-test/main/ctype_ucs.test
@@ -1193,6 +1193,23 @@ SELECT HEX(1 COLLATE ucs2_bin);
 SELECT 1 COLLATE latin1_swedish_ci;
 SET NAMES utf8;
 
+--echo #
+--echo # MDEV-33772 Bad SEPARATOR value in GROUP_CONCAT on character set conversion
+--echo #
+
+SET NAMES utf8mb3, @@collation_connection=ucs2_general_ci;
+CREATE TABLE t1 (c VARCHAR(10)) CHARACTER SET ucs2;
+INSERT INTO t1 VALUES ('a'),('A');
+CREATE OR REPLACE VIEW v1 AS
+  SELECT COUNT(*) AS cnt, GROUP_CONCAT(c) AS c1 FROM t1 GROUP BY c;
+SELECT * FROM v1;
+SELECT HEX(c1) FROM v1;
+SHOW CREATE VIEW v1;
+DROP VIEW v1;
+DROP TABLE t1;
+SET NAMES utf8mb3;
+
+
 --echo #
 --echo # End of 10.5 tests
 --echo #
diff --git a/mysql-test/main/empty_string_literal.result b/mysql-test/main/empty_string_literal.result
index 732e8e6d557..71b0869cb2a 100644
--- a/mysql-test/main/empty_string_literal.result
+++ b/mysql-test/main/empty_string_literal.result
@@ -64,7 +64,7 @@ SET sql_mode=@mode;
 # Test litteral concat
 #
 SELECT 'a' 'b';
-a
+ab
 ab
 SELECT 'a' '';
 a
@@ -76,13 +76,13 @@ SELECT '' '';
 NULL
 NULL
 SELECT '' 'b' 'c';
-b
+bc
 bc
 SELECT '' '' 'c';
 c
 c
 SELECT 'a' '' 'c';
-a
+ac
 ac
 SELECT 'a' '' '';
 a
@@ -208,3 +208,22 @@ t1	CREATE TABLE `t1` (
   KEY `a` (`a`,`b`)
 ) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci
 drop table t1;
+#
+# MDEV-33460 select '123' 'x'; unexpected result
+#
+SELECT '';
+NULL
+NULL
+SELECT '' 'b' 'c';
+bc
+bc
+SELECT '' '' 'c';
+c
+c
+SELECT 'a' '' 'c';
+ac
+ac
+SELECT 'a' '' '';
+a
+a
+# End of 10.5 test
diff --git a/mysql-test/main/empty_string_literal.test b/mysql-test/main/empty_string_literal.test
index 9174a7714a2..3320841fb42 100644
--- a/mysql-test/main/empty_string_literal.test
+++ b/mysql-test/main/empty_string_literal.test
@@ -25,3 +25,15 @@ flush tables;
 update t1 set a = 2;
 show create table t1;
 drop table t1;
+
+--echo #
+--echo # MDEV-33460 select '123' 'x'; unexpected result
+--echo #
+
+SELECT '';
+SELECT '' 'b' 'c';
+SELECT '' '' 'c';
+SELECT 'a' '' 'c';
+SELECT 'a' '' '';
+
+--echo # End of 10.5 test
diff --git a/mysql-test/main/func_gconcat.result b/mysql-test/main/func_gconcat.result
index 7bc6441661b..f817a1176ea 100644
--- a/mysql-test/main/func_gconcat.result
+++ b/mysql-test/main/func_gconcat.result
@@ -1517,4 +1517,24 @@ deallocate prepare stmt;
 set join_cache_level=default;
 set group_concat_max_len=default;
 drop table t1,t2;
+#
+# MDEV-33772 Bad SEPARATOR value in GROUP_CONCAT on character set conversion
+#
+SET NAMES utf8, @@collation_connection=latin1_swedish_ci;
+CREATE TABLE t1 (c VARCHAR(10)) CHARACTER SET latin1;
+INSERT INTO t1 VALUES ('a'),('A');
+CREATE OR REPLACE VIEW v1 AS
+SELECT GROUP_CONCAT(c SEPARATOR 'ß') AS c1 FROM t1 GROUP BY c;
+SELECT * FROM v1;
+c1
+aßA
+SELECT HEX(c1) FROM v1;
+HEX(c1)
+61DF41
+SHOW CREATE VIEW v1;
+View	Create View	character_set_client	collation_connection
+v1	CREATE ALGORITHM=UNDEFINED DEFINER=`root`@`localhost` SQL SECURITY DEFINER VIEW `v1` AS select group_concat(`t1`.`c` separator 'ß') AS `c1` from `t1` group by `t1`.`c`	utf8mb3	latin1_swedish_ci
+DROP VIEW v1;
+DROP TABLE t1;
+SET NAMES latin1;
 # End of 10.5 tests
diff --git a/mysql-test/main/func_gconcat.test b/mysql-test/main/func_gconcat.test
index 2e09bddbb8b..c9787ce4471 100644
--- a/mysql-test/main/func_gconcat.test
+++ b/mysql-test/main/func_gconcat.test
@@ -1105,4 +1105,20 @@ set group_concat_max_len=default;
 
 drop table t1,t2;
 
+--echo #
+--echo # MDEV-33772 Bad SEPARATOR value in GROUP_CONCAT on character set conversion
+--echo #
+
+SET NAMES utf8, @@collation_connection=latin1_swedish_ci;
+CREATE TABLE t1 (c VARCHAR(10)) CHARACTER SET latin1;
+INSERT INTO t1 VALUES ('a'),('A');
+CREATE OR REPLACE VIEW v1 AS
+  SELECT GROUP_CONCAT(c SEPARATOR 'ß') AS c1 FROM t1 GROUP BY c;
+SELECT * FROM v1;
+SELECT HEX(c1) FROM v1;
+SHOW CREATE VIEW v1;
+DROP VIEW v1;
+DROP TABLE t1;
+SET NAMES latin1;
+
 --echo # End of 10.5 tests
diff --git a/mysql-test/main/func_str.result b/mysql-test/main/func_str.result
index 1fdaebfda95..0f59f37e877 100644
--- a/mysql-test/main/func_str.result
+++ b/mysql-test/main/func_str.result
@@ -8,7 +8,7 @@ select 'hello',"'hello'",'""hello""','''h''e''l''l''o''',"hel""lo",'hel\'lo';
 hello	'hello'	""hello""	'h'e'l'l'o'	hel"lo	hel'lo
 hello	'hello'	""hello""	'h'e'l'l'o'	hel"lo	hel'lo
 select 'hello' 'monty';
-hello
+hellomonty
 hellomonty
 select length('\n\t\r\b\0\_\%\\');
 length('\n\t\r\b\0\_\%\\')
diff --git a/mysql-test/main/join.result b/mysql-test/main/join.result
index 690d443aac4..34c58910f07 100644
--- a/mysql-test/main/join.result
+++ b/mysql-test/main/join.result
@@ -894,7 +894,7 @@ show status like '%cost%';
 Variable_name	Value
 Last_query_cost	4.016090
 select 'The cost of accessing t1 (dont care if it changes' '^';
-The cost of accessing t1 (dont care if it changes
+The cost of accessing t1 (dont care if it changes^
 The cost of accessing t1 (dont care if it changes^
 select 'vv: Following query must use ALL(t1), eq_ref(A), eq_ref(B): vv' Z;
 Z
diff --git a/mysql-test/suite/compat/oracle/r/empty_string_literal.result b/mysql-test/suite/compat/oracle/r/empty_string_literal.result
index 4af576e90c0..1260c7aa75d 100644
--- a/mysql-test/suite/compat/oracle/r/empty_string_literal.result
+++ b/mysql-test/suite/compat/oracle/r/empty_string_literal.result
@@ -64,7 +64,7 @@ SET sql_mode=@mode;
 # Test litteral concat
 #
 SELECT 'a' 'b';
-a
+ab
 ab
 SELECT 'a' '';
 a
@@ -76,13 +76,13 @@ SELECT '' '';
 NULL
 NULL
 SELECT '' 'b' 'c';
-b
+bc
 bc
 SELECT '' '' 'c';
 c
 c
 SELECT 'a' '' 'c';
-a
+ac
 ac
 SELECT 'a' '' '';
 a
diff --git a/sql/item.cc b/sql/item.cc
index e974fc084c2..9b9d92decf1 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -6982,6 +6982,7 @@ Item_basic_constant *
 Item_string::make_string_literal_concat(THD *thd, const LEX_CSTRING *str)
 {
   append(str->str, (uint32) str->length);
+  set_name(thd, &str_value);
   if (!(collation.repertoire & MY_REPERTOIRE_EXTENDED))
   {
     // If the string has been pure ASCII so far, check the new part.
diff --git a/sql/item_sum.cc b/sql/item_sum.cc
index 59670dedac7..6986814a9d3 100644
--- a/sql/item_sum.cc
+++ b/sql/item_sum.cc
@@ -4594,7 +4594,7 @@ void Item_func_group_concat::print(String *str, enum_query_type query_type)
   if (sum_func() == GROUP_CONCAT_FUNC)
   {
     str->append(STRING_WITH_LEN(" separator \'"));
-    str->append_for_single_quote(separator->ptr(), separator->length());
+    str->append_for_single_quote_opt_convert(*separator);
     str->append(STRING_WITH_LEN("\'"));
   }
 
diff --git a/sql/sql_string.cc b/sql/sql_string.cc
index 25521bb370f..f5edb1a5414 100644
--- a/sql/sql_string.cc
+++ b/sql/sql_string.cc
@@ -1145,26 +1145,45 @@ bool String::append_for_single_quote(const char *st, size_t len)
   int chlen;
   for (; st < end; st++)
   {
-    switch (*st)
+    char ch2= (char) (uchar) escaped_wc_for_single_quote((uchar) *st);
+    if (ch2)
     {
-    case '\\':   APPEND(STRING_WITH_LEN("\\\\")); break;
-    case '\0':   APPEND(STRING_WITH_LEN("\\0")); break;
-    case '\'':   APPEND(STRING_WITH_LEN("\\'")); break;
-    case '\n':   APPEND(STRING_WITH_LEN("\\n")); break;
-    case '\r':   APPEND(STRING_WITH_LEN("\\r")); break;
-    case '\032': APPEND(STRING_WITH_LEN("\\Z")); break;
-    default:     if ((chlen=charset()->charlen(st, end)) > 0)
-                 {
-                   APPEND(st, chlen);
-                   st+= chlen-1;
-                 }
-                 else
-                   APPEND(*st);
+      if (append('\\') || append(ch2))
+        return true;
+      continue;
     }
+    if ((chlen= charset()->charlen(st, end)) > 0)
+    {
+     APPEND(st, chlen);
+      st+= chlen-1;
+    }
+    else
+      APPEND(*st);
   }
   return 0;
 }
 
+
+bool String::append_for_single_quote_using_mb_wc(const char *src,
+                                                 size_t length,
+                                                 CHARSET_INFO *cs)
+{
+  DBUG_ASSERT(&my_charset_bin != charset());
+  DBUG_ASSERT(&my_charset_bin != cs);
+  const uchar *str= (const uchar *) src;
+  const uchar *end= (const uchar *) src + length;
+  int chlen;
+  my_wc_t wc;
+  for ( ; (chlen= cs->cset->mb_wc(cs, &wc, str, end)) > 0; str+= chlen)
+  {
+    my_wc_t wc2= escaped_wc_for_single_quote(wc);
+    if (wc2 ? (append_wc('\\') || append_wc(wc2)) : append_wc(wc))
+      return true;
+  }
+  return false;
+}
+
+
 void String::print(String *str) const
 {
   str->append_for_single_quote(Ptr, str_length);
diff --git a/sql/sql_string.h b/sql/sql_string.h
index 200735922df..3b90f2c4ecc 100644
--- a/sql/sql_string.h
+++ b/sql/sql_string.h
@@ -1188,6 +1188,42 @@ public:
       print_with_conversion(to, cs);
   }
 
+  static my_wc_t escaped_wc_for_single_quote(my_wc_t ch)
+  {
+    switch (ch)
+    {
+    case '\\':   return '\\';
+    case '\0':   return '0';
+    case '\'':   return '\'';
+    case '\n':   return 'n';
+    case '\r':   return 'r';
+    case '\032': return 'Z';
+    }
+    return 0;
+  }
+
+  // Append for single quote using mb_wc/wc_mb Unicode conversion
+  bool append_for_single_quote_using_mb_wc(const char *str, size_t length,
+                                           CHARSET_INFO *cs);
+
+  // Append for single quote with optional mb_wc/wc_mb conversion
+  bool append_for_single_quote_opt_convert(const char *str,
+                                           size_t length,
+                                           CHARSET_INFO *cs)
+  {
+    return charset() == &my_charset_bin || cs == &my_charset_bin  ||
+           my_charset_same(charset(), cs) ?
+           append_for_single_quote(str, length) :
+           append_for_single_quote_using_mb_wc(str, length, cs);
+  }
+
+  bool append_for_single_quote_opt_convert(const String &str)
+  {
+    return append_for_single_quote_opt_convert(str.ptr(),
+                                               str.length(),
+                                               str.charset());
+  }
+
   bool append_for_single_quote(const char *st, size_t len);
   bool append_for_single_quote(const String *s)
   {
diff --git a/sql/wsrep_mysqld.cc b/sql/wsrep_mysqld.cc
index 6d20f60b290..f8da5171bcc 100644
--- a/sql/wsrep_mysqld.cc
+++ b/sql/wsrep_mysqld.cc
@@ -3840,21 +3840,11 @@ void wsrep_ready_set(bool ready_value)
   step is performed to leave the wsrep transaction in the state as it
   never existed.
 
-  This should not be an inline functions as it requires a lot of stack space
-  because of WSREP_DBUG() usage.  It's also not a function that is
-  frequently called.
 */
 
 void wsrep_commit_empty(THD* thd, bool all)
 {
   DBUG_ENTER("wsrep_commit_empty");
-  WSREP_DEBUG("wsrep_commit_empty for %llu client_state %s client_mode"
-              " %s trans_state %s sql %s",
-              thd_get_thread_id(thd),
-              wsrep::to_c_string(thd->wsrep_cs().state()),
-              wsrep::to_c_string(thd->wsrep_cs().mode()),
-              wsrep::to_c_string(thd->wsrep_cs().transaction().state()),
-              wsrep_thd_query(thd));
 
   if (wsrep_is_real(thd, all) &&
       wsrep_thd_is_local(thd) &&
@@ -3862,14 +3852,40 @@ void wsrep_commit_empty(THD* thd, bool all)
       !thd->internal_transaction() &&
       thd->wsrep_trx().state() != wsrep::transaction::s_committed)
   {
-    /* Here transaction is either empty (i.e. no changes) or
-       it was CREATE TABLE with no row binlog format or
-       we have already aborted transaction e.g. because max writeset size
-       has been reached. */
-    DBUG_ASSERT(!wsrep_has_changes(thd) ||
-                (thd->lex->sql_command == SQLCOM_CREATE_TABLE &&
-                 !thd->is_current_stmt_binlog_format_row()) ||
-                thd->wsrep_cs().transaction().state() == wsrep::transaction::s_aborted);
+#ifndef DBUG_OFF
+    const bool empty= !wsrep_has_changes(thd);
+    const bool create= thd->lex->sql_command == SQLCOM_CREATE_TABLE &&
+      !thd->is_current_stmt_binlog_format_row();
+    const bool aborted= thd->wsrep_cs().transaction().state() == wsrep::transaction::s_aborted;
+    const bool ddl_replay= ((sql_command_flags[thd->lex->sql_command] &
+                  (CF_SCHEMA_CHANGE | CF_ADMIN_COMMAND)) &&
+                 thd->wsrep_cs().transaction().state() == wsrep::transaction::s_must_replay);
+    /* Here transaction is either
+       (1) empty (i.e. no changes) or
+       (2) it was CREATE TABLE with no row binlog format or
+       (3) we have already aborted transaction e.g. because max writeset size
+       has been reached or
+       (4) it was DDL and got BF aborted and must replay.
+    */
+    if(!(empty || create || aborted || ddl_replay))
+    {
+      WSREP_DEBUG("wsrep_commit_empty: thread: %llu client_state: %s client_mode:"
+                  " %s trans_state: %s error: %s empty: %d create: %d aborted:"
+		  " %d ddl_replay: %d sql: %s",
+                  thd_get_thread_id(thd),
+                  wsrep::to_c_string(thd->wsrep_cs().state()),
+                  wsrep::to_c_string(thd->wsrep_cs().mode()),
+                  wsrep::to_c_string(thd->wsrep_cs().transaction().state()),
+                  wsrep::to_c_string(thd->wsrep_cs().current_error()),
+                  empty, create, aborted, ddl_replay,
+                  wsrep_thd_query(thd));
+
+      DBUG_ASSERT(empty ||     // 1
+                  create ||    // 2
+                  aborted ||   // 3
+                  ddl_replay); // 4
+    }
+#endif /* DBUG_OFF */
     bool have_error= wsrep_current_error(thd);
     int ret= wsrep_before_rollback(thd, all) ||
       wsrep_after_rollback(thd, all) ||
@@ -3883,10 +3899,10 @@ void wsrep_commit_empty(THD* thd, bool all)
       DBUG_ASSERT(wsrep_current_error(thd) == wsrep::e_deadlock_error);
       thd->wsrep_cs().reset_error();
     }
+
     if (ret)
-    {
-      WSREP_DEBUG("wsrep_commit_empty failed: %d", wsrep_current_error(thd));
-    }
+      WSREP_DEBUG("wsrep_commit_empty failed: %s",
+                  wsrep::to_c_string(thd->wsrep_cs().current_error()));
   }
   DBUG_VOID_RETURN;
 }
diff --git a/storage/innobase/buf/buf0flu.cc b/storage/innobase/buf/buf0flu.cc
index d7e4e19c672..3342b2b11e7 100644
--- a/storage/innobase/buf/buf0flu.cc
+++ b/storage/innobase/buf/buf0flu.cc
@@ -1378,10 +1378,12 @@ static void buf_flush_LRU_list_batch(ulint max, flush_counters_t *n)
     space->release();
 
   if (scanned)
+  {
     MONITOR_INC_VALUE_CUMULATIVE(MONITOR_LRU_BATCH_SCANNED,
                                  MONITOR_LRU_BATCH_SCANNED_NUM_CALL,
                                  MONITOR_LRU_BATCH_SCANNED_PER_CALL,
                                  scanned);
+  }
 }
 
 /** Flush and move pages from LRU or unzip_LRU list to the free list.
@@ -1526,10 +1528,13 @@ static ulint buf_do_flush_list_batch(ulint max_n, lsn_t lsn)
     space->release();
 
   if (scanned)
+  {
     MONITOR_INC_VALUE_CUMULATIVE(MONITOR_FLUSH_BATCH_SCANNED,
                                  MONITOR_FLUSH_BATCH_SCANNED_NUM_CALL,
                                  MONITOR_FLUSH_BATCH_SCANNED_PER_CALL,
                                  scanned);
+  }
+
   return count;
 }
 
diff --git a/storage/innobase/include/ut0new.h b/storage/innobase/include/ut0new.h
index f4183e4c61a..3ff5f8853e0 100644
--- a/storage/innobase/include/ut0new.h
+++ b/storage/innobase/include/ut0new.h
@@ -1071,9 +1071,8 @@ static inline void *ut_malloc_dontdump(size_t n_bytes, ...)
 {
 	void *ptr = my_large_malloc(&n_bytes, MYF(0));
 
-	ut_dontdump(ptr, n_bytes, true);
-
 	if (ptr) {
+		ut_dontdump(ptr, n_bytes, true);
 		os_total_large_mem_allocated += n_bytes;
 	}
 	return ptr;
diff --git a/storage/mroonga/CMakeLists.txt b/storage/mroonga/CMakeLists.txt
index c048b214658..fffcd80c971 100644
--- a/storage/mroonga/CMakeLists.txt
+++ b/storage/mroonga/CMakeLists.txt
@@ -57,6 +57,11 @@ if(MRN_BUNDLED)
       "${PLUGIN_MROONGA}" STREQUAL "NO")
     return()
   endif()
+  if(WITHOUT_DYNAMIC_PLUGINS)
+    if(NOT (PLUGIN_MROONGA STREQUAL STATIC))
+      return()
+    endif()
+  endif()
 endif()
 
 set(MRN_BUNDLED_GROONGA_RELATIVE_DIR "vendor/groonga")
diff --git a/support-files/mariadb.service.in b/support-files/mariadb.service.in
index 1af0106e929..79c8b9a8cca 100644
--- a/support-files/mariadb.service.in
+++ b/support-files/mariadb.service.in
@@ -51,7 +51,7 @@ Group=mysql
 # CAP_DAC_OVERRIDE To allow auth_pam_tool (which is SUID root) to read /etc/shadow when it's chmod 0
 #   does nothing for non-root, not needed if /etc/shadow is u+r
 # CAP_AUDIT_WRITE auth_pam_tool needs it on Debian for whatever reason
-CapabilityBoundingSet=CAP_IPC_LOCK CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
+AmbientCapabilities=CAP_IPC_LOCK CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
 
 # PrivateDevices=true implies NoNewPrivileges=true and
 # SUID auth_pam_tool suddenly doesn't do setuid anymore
diff --git a/support-files/mariadb@.service.in b/support-files/mariadb@.service.in
index 8cb3ab2a4d7..31f1586f1bf 100644
--- a/support-files/mariadb@.service.in
+++ b/support-files/mariadb@.service.in
@@ -181,7 +181,7 @@ PrivateNetwork=false
 # CAP_DAC_OVERRIDE To allow auth_pam_tool (which is SUID root) to read /etc/shadow when it's chmod 0
 #   does nothing for non-root, not needed if /etc/shadow is u+r
 # CAP_AUDIT_WRITE auth_pam_tool needs it on Debian for whatever reason
-CapabilityBoundingSet=CAP_IPC_LOCK CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
+AmbientCapabilities=CAP_IPC_LOCK CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
 
 # PrivateDevices=true implies NoNewPrivileges=true and
 # SUID auth_pam_tool suddenly doesn't do setuid anymore
diff --git a/wsrep-lib b/wsrep-lib
index a5d95f0175f..7d108eb8706 160000
--- a/wsrep-lib
+++ b/wsrep-lib
@@ -1 +1 @@
-Subproject commit a5d95f0175f10b6127ea039c542725f6c4aa5cb9
+Subproject commit 7d108eb8706962abc74705bedfc60cfc3f296ea6