ZBXNEXT-1322 introduced automatic upgrading of the database schema once an upgrade server daemon starts. While this is a fantastic convenience, it's also a risk which was realised in my environment today.

We were experimenting with a later version of Zabbix in our development environment but thanks to human error, the updated daemon in Dev was accidentally redirected to connect to the production database.

As a result, the production database was upgraded and the production server was brought down because of the database version mismatch.

We had to rush to upgrade our entire production infrastructure to the latest version as rolling back the database didn't seem to be an option.

In light of this, I like Cohan's suggestion in ZBXNEXT-1322 to use a `--upgrade` switch instead of assuming the server is allowed to upgrade the database.

There are a number of other mitigations (such as database ACLs) we should have/will implement to prevent this being an issue again but would Zabbix consider reassessing this feature please?