ArcadeDB 26.9.1

Overview

This is the largest release ArcadeDB has ever shipped: 992 issues and pull requests closed under the 26.9.1 milestone - 675 issues and 317 pull requests - out of 655 pull requests merged and 1,500 commits in total since 26.8.1.

The headline work is in five places:

• Backup and restore - a full backup is 27.6x faster, a restore runs in parallel, and neither freezes page flushing any more, so writers keep working while a backup runs.
• Storage integrity - the family of defects around records that outgrow a page is closed: silent lost updates, a record returned twice by a scan, false conflicts, and a 16% chunk-slot space leak that nothing ever reclaimed.
• Query correctness - NOT IN on an indexed property returned the IN result set, DISTINCT ... ORDER BY ... LIMIT returned too few rows, a multi-key GROUP BY grouped on the last key only, and an index range scan could return rows the WHERE clause excluded. All fixed, with regression tests.
• Indexes are used where they were not - a literal IN (...) list, a composite-index prefix with ORDER BY, BETWEEN, @rid IN [...] and a Cypher label disjunction all take the index now instead of a full scan.
• Vector search - opening a database is constant-time again regardless of index size, rebuilds are scheduled instead of blocking the first query, and recall stopped degrading past 10,000 vectors.

Upgrading is strongly recommended for every deployment. There are breaking changes and behaviour changes - they are collected in Breaking changes and upgrade notes and each is called out again where it belongs. No schema migration is required, and no existing database is rewritten.

Contents: Highlights · Security advisories · New features · Major fixes and improvements · Breaking changes and upgrade notes · Dependency updates

Highlights

Backups are 27.6x faster and no longer stall the database

A full backup ran single-threaded deflate at level 9, CPU-bound at 20-40 MB/s, and it suspended page flushing for the whole window: dirty pages piled up until arcadedb.flushSuspendMaxDeferredRAM was reached, committers were throttled, and LSM compaction was postponed. HA snapshot shipping and cluster verify did the same thing (#6072, #6075, #6086).

Measured on a 1.25 GB database:

• Parallel compression, tunable with arcadedb.backup.compressionLevel (new default 1, was 9), arcadedb.backup.compressionThreads and arcadedb.backup.maxMBPerSecond. The ZIP format is unchanged and archives written by older versions restore normally.
• Parallel restore, largest entry first, behind a 256 KB buffered read instead of ZipInputStream's unbuffered 512-byte reads (arcadedb.restore.threads). Even the sequential path went 5.16 s to 3.96 s.
• A page-level copy-on-write snapshot replaces flush suspension: arcadedb.pageSnapshotEnabled, arcadedb.pageSnapshotMaxRAM, arcadedb.pageSnapshotMaxSize, arcadedb.pageSnapshotSpillPath. Backups, HA snapshot shipping and the /checksums endpoint now take a point-in-time view without ever stopping the flusher.
• Two JVM-wide stalls are gone with it. The deferred-flush backpressure gate was process-wide, so one database's backlog stopped the flush thread for every database on the server (#6200), and publishPages blocked inside the global page-manager lock whenever the flush queue filled, serialising the commits of every database behind one database's write burst (#6259). Both are now per-database.

Records larger than a page: lost updates, phantom rows and a 16% space leak

A record that outgrows its page is stored as a chunk chain or behind a placeholder pointer. Re-triaging #5279 turned up a whole family of defects on that path, every one of them silent:

• A lost update. Two transactions updating the same placeholder-backed record (pointer on one page, content on another) both committed and one write vanished, with no ConcurrentModificationException (#6141). The content page is version-checked now, so the conflict is raised.
• A record returned twice. A SELECT returned a placeholder-backed record under two different RIDs when its content had spilled into chunks, so count(@rid) reported 2 for one record (#6196).
• A 16% space leak. CRUDTest.multiUpdatesOverlap ended with 243,821 orphaned chunk slots out of 1,545,495 because a shrink ending exactly on a chunk boundary never freed the tail, and nothing ever reclaimed them although three code comments promised otherwise (#6319, #6294). CHECK DATABASE FIX now sweeps them and reports orphanedChunks / orphanedChunksReclaimed.
• False conflicts. Reading a multi-page record failed with "was modified during read after N retries" when an unrelated record's chunk on a shared page was written (#6217), and eight threads rewriting different large records on one page got ConcurrentModificationException with five of eight exhausting TX_RETRIES (#6129). Chunked head slots take part in the disjoint-slot merge now, and a read validates only its own chain.
• A permanent size ratchet. A chunked record's head chunk shrank to the smallest size it ever had and never recovered, so a record oscillating in size degraded for ever into a longer chain with unusable gaps (#6163). A record that shrinks back inside its slot is now collapsed to a plain record again (#6178, #6286).
• A checker that reported a clean database. After CHECK DATABASE FIX force-deleted a record with a broken chain, the placeholder pointing at it was left dangling, so count(*) said 8 and a scan said 7, permanently, while the report said totalErrors: 0 (#6292).

Free-space accounting was fixed with them (#6154, #6339), and a self-referencing edge-list chunk no longer hangs an ordinary traversal in a request thread (#6278).

Wrong results in ordinary SQL

Five independent defects, all of them returning a plausible answer to the wrong question:

• NOT IN returned the IN result set. WHERE prop NOT IN [...] on an indexed property returned 1 row where 25,089 matched, because the index planner served the lookup without consulting the NOT flag. Present since 26.7.1 (#6796).
• SELECT DISTINCT ... ORDER BY ... LIMIT n returned fewer than n rows, because the Top-K bound was applied before deduplication (#6923).
• A multi-key GROUP BY grouped on the last key only - the synthetic alias counter was final int i = 0 outside the loop, so every key got the same alias (#6924) - and DISTINCT was silently dropped whenever the statement also had GROUP BY, UNWIND or expand() (#6925).
• An index range scan ignored its own transaction's deletes. A range query inside a transaction returned rows deleted or re-keyed in that same transaction, including rows that did not match the WHERE clause (#6927).
• An indexed range over non-ASCII text returned nothing. BinaryComparator ordered STRINGs by UTF-16 code units while LSM index pages order them by unsigned UTF-8 bytes, so a scan whose bounds fell where the two orders disagree returned zero rows although both keys were in range (#6997).

Also: the ?? null-coalescing operator always returned its right operand because the AST builder had no visitor for it (#6393); WHERE @rid > :param returned nothing while the same RID as a literal worked, breaking RID-cursor paging (#6188); @rid IN (SELECT ...) never matched (#7054); TRUNCATE TYPE inside an explicit transaction committed the caller's transaction from the inside, so BEGIN; TRUNCATE TYPE; ROLLBACK destroyed 1,000 records (#6220); and EXPLAIN UPDATE ... submitted as sqlscript executed the update, which ran unbounded for hours in production ([#6648](https://github.com/ArcadeData...

ArcadeDB 26.8.1

Overview

This is a major release: 381 issues and pull requests closed under the 26.8.1 milestone - 281 issues and 100 PRs - out of 298 pull requests merged and 669 commits in total since 26.7.2. It also carries everything shipped in the 26.7.3 hotfix.

The headline work is in four places:

• Security - 13 advisories closed, most of them on the wire protocols and the MCP endpoint.
• Concurrency - concurrent writes to unrelated records of the same page no longer conflict, which is what made ArcadeDB usable under real multi-writer load on types with few buckets.
• Graph integrity - a family of vertex/edge delete defects that could silently lose edges under concurrency is closed, and deleting a super-node vertex got 5x faster along the way.
• Storage and indexes - bloom filters on compacted LSM series, a schema dictionary that is no longer capped at one page, a geospatial index that costs one entry per point instead of eleven, and TimeSeries TAG columns that are dictionary-encoded.

Upgrading is strongly recommended for every deployment. There are breaking changes and behaviour changes - they are collected in Breaking changes and upgrade notes and each is called out again where it belongs. No schema migration is required, and no existing database is rewritten.

Contents: Highlights · Security advisories · New features · Major fixes and improvements · Breaking changes and upgrade notes · Dependency updates

Highlights

Concurrent writes to unrelated records of the same page no longer conflict

ArcadeDB detects write conflicts per page, so two transactions that touched the same bucket page raised a ConcurrentModificationException even when they wrote completely unrelated records that merely happened to share it. On a type with few buckets and many concurrent writers this made a retry pointless: the retry ran straight into the same collision (#5279).

All three halves of that are gone:

• Inserts into one page reserve their slot per in-flight transaction, so concurrent inserts get different positions (and different RIDs) instead of all being handed the same one.
• Updates are replayed by the commit-time disjoint-slot merge whenever they stayed inside the page, which now includes a record that grew - a longer string, one more property - and not only an overwrite of the same size or smaller. Growth is the normal update shape, so leaving it out kept concurrent updates conflicting.
• Deletes of a plain in-place record are replayed too (#5569). Such a delete only zeroes one slot-table entry, so it commutes with writes to every other slot.

Measured on the reported workload (one single bucket, attempts=1, no retry):

A ConcurrentModificationException is still raised - by design - when two transactions really write the same record: a byte-for-byte pre-image check makes sure no concurrent write is ever silently overwritten. Nothing changes for single-writer workloads and no application change is needed. The merge can be switched off with arcadedb.txPageSlotMerge=false.

The merges also prove their coverage now instead of trusting every writer to declare its pages (#5596): a page carrying even one byte written outside a declared, replayable write is refused and falls back to the ordinary retry. The three merge counters (edgeAppendMerges, txPageSlotMerges, mergesDeclinedByCoverage) are now visible to an operator in the PAGE-MANAGER block, in /api/v1/server, in Studio and on /prometheus (#5608).

Deleting a vertex no longer loses its edges - and is up to 5x faster

Four defects, all on the same path, all capable of committing a graph with edges pointing at a vertex that is gone (#5670, #5680, #5725, #5760):

• An edge-list chunk that is momentarily unreadable - a normal MVCC window on a hot vertex, not a fact about the graph - was read as "nothing to remove here". The removal ended having removed nothing and the edge record was deleted anyway, leaving a back-reference on a neighbour. It is now a retryable ConcurrentModificationException, so the transaction re-reads a consistent view and completes the removal.
• The same window on the vertex's own list meant no edges collected, and the vertex record deleted on top of that empty view.
• An edge appended while the delete was running survived the delete with a live out and an in naming a record that no longer exists. A vertex delete now pins every page its edge list can grow through, at the version it read the list at.
• Each edge was disconnected from both endpoints, one of which is always the vertex being deleted - whose lists are dropped wholesale moments later. Each edge is now disconnected from its far end only.

That last one is also where the performance is. 100k edges into one hub, on an Apple M-series laptop:

The removal walk streams now: deleteVertex no longer materialises every edge into a list first, so there is no per-degree allocation on the path at all (tens of megabytes of retained heap on a million-edge super-node).

Visible effect. vertex.delete() / DELETE VERTEX and edge.delete() / DELETE EDGE can now raise a retryable ConcurrentModificationException where they previously "succeeded" while losing an edge. It is a NeedRetryException, so database.transaction(...) and the server's auto-retry for single-request commands absorb it. A client-managed explicit transaction over RemoteDatabase spans several HTTP requests, so its commit is not auto-retried and the caller should retry the transaction. A delete that keeps failing however often it is retried means the list is genuinely broken: the error now names the repair, CHECK DATABASE RECORD #12:3 FIX, and the retry after it goes through.

Bloom filters on compacted LSM indexes (enabled by default)

An LSM index lookup walks every compacted series from newest to oldest, and a series whose key range covers the key still costs a root-page search and a data-page read to discover it does not hold it. Each compacted series now carries a bloom filter that answers from a single 8 KB page (#5517).

Measured on 2M keys across 9 series (LSMTreeBloomFilterBenchmark):

• On by default at a 1% target false-positive rate: arcadedb.indexBloomFilterRate=0.01. Set 0 to disable.
• ~1.2 bytes per key on disk, about 3% of the index it describes, in a <index>_bf.bfidx component.
• No rebuild and no migration. Filters are written by compaction, so an existing index gains them at its next compaction. They replicate over HA and are included in backups.
• Helps most when compacted series overlap in key range - an email, a UUID, a business id. Ascending keys give each series a disjoint slice the root page already rules out. Range scans never consult them.
• Observability: bloomSkippedSeries and bloomProbedSeries in the index statistics.

Backward and forward compatible with no version bump: an older ArcadeDB does not recognise the .bfidx extension and reads the index exactly as it does today.

The schema dictionary is no longer capped at a single page

Every type and property name is mapped to a small integer id, and that table lived in one page: 48,396 short names measured. Past it, CREATE PROPERTY and inserting a document with a new field name failed permanently with No space left in dictionary file, with no way to grow and no way back (#5560).

Names now roll over onto further pages, so the cap is gone.

• No migration, and existing databases are not rewritten. A dictionary written by an earlier version is a dictionary of one page and loads unchanged; it gains rollover on the next write that needs it.
• Appending a name is no longer quadratic. Growing to 500,000 names took 11.2s of pure array copying; it now takes 2ms.
• New databases use a 65,536-byte dictionary page instead of 327,680, so a new name dirties and flushes 5x less. Existing databases keep the page size they were created with.

**Rolling upgrade: upgrade followers b...

ArcadeDB 26.7.3

Overview

This is a focused hotfix on top of 26.7.2. It closes three security advisories from the internal audit - two in the MCP server transport and one in the JavaScript/Java trigger authorization gate - and repairs a data-loss regression in the 26.7.2 commutative super-node edge-append merge.

Upgrading from 26.7.2 is recommended, especially for deployments that expose the MCP server, run in server / multi-tenant mode, or store high-degree (super-node) graphs.

There are no breaking changes and no schema migration in this release.

Security Advisories

All three advisories were found in the same internal audit that produced the 26.7.2 fixes; they are MCP-transport and trigger issues that were not covered there.

• MCP command transport disabled all engine permission checks (GHSA-6x73-v3rc-f57c). The MCP transport never bound the authenticated principal onto the request thread's DatabaseContext, so the engine permission gates (which are deliberate no-ops when no user is bound) silently passed for every MCP caller. A non-root, MCP-allowed reader could perform arbitrary writes, DDL and schema/security mutation; the query + js sub-case could execute arbitrary in-JVM JavaScript. The principal is now bound at the single DB-resolution chokepoint and cleared on the pooled worker thread, so the engine per-user gates enforce for MCP exactly as for the HTTP, Bolt, PostgreSQL and gRPC transports.
• MCP get_server_settings leaked the HA clusterToken in cleartext (GHSA-p9wc-4fhr-78wm). The MCP get_server_settings tool masked only settings whose key contained "password", so arcadedb.ha.clusterToken was returned raw. That token is the trust anchor for cluster-forwarded authentication, so leaking it enables full root impersonation. This is the MCP sibling of the 26.7.2 fix (GHSA-46hj-24h4-j8gf); the tool now redacts value and default via GlobalConfiguration.isHidden(), matching GetServerHandler.
• JavaScript / Java triggers could escalate a schema admin to server-wide admin (GHSA-38pf-6hp2-pxww). A JAVASCRIPT trigger binds the real database object into a GraalVM context, so its script could call database.getSecurity().createUser(...) and escalate an UPDATE_SCHEMA (schema-admin) user to a server-wide admin; a JAVA trigger runs an arbitrary loaded class. Creating both host-code trigger types now requires UPDATE_SECURITY at the LocalSchema.createTrigger chokepoint, mirroring the DEFINE FUNCTION ... LANGUAGE js gate (GHSA-vwjc-v7x7-cm6g). Declarative SQL triggers keep UPDATE_SCHEMA, and schema reload of existing triggers is unaffected.

Major Fixes

Graph engine

• Edge-append merge no longer reverts concurrent writes on multi-page edge chunks (#5302). The commutative edge-append merge (GRAPH_EDGE_APPEND_MERGE, introduced in 26.7.2) resolved a commit-time page conflict by re-deriving the conflicted page and replaying the transaction's tracked appends. For an edge chunk stored as a multi-page record (a chunk that straddles a page boundary) this re-derivation was unsound: the rebase re-read the chunk through the transaction's stale in-transaction page copy and committed it, silently reverting concurrently committed appends on the continuation page - zeroed chunk tails, shifted/aliased pairs, lost edges, and BufferUnderflowException on later traversals of the vertex. Only records living entirely in place on the conflicted page are now re-derived; multi-page and indirected (placeholder) chunk records fall back to the standard full-transaction retry. Single-page chunks - the vast majority, including all super-node stripe chunks - keep the merge.

MCP server

• get_schema now builds its schema through a dedicated buildSchema path, and the MCP dispatcher handles a missing resource with a proper MCPResourceNotFoundException instead of a generic failure.

Full Changelog: 26.7.2...26.7.3

ArcadeDB 26.7.2

Overview

This release is a large stability and correctness milestone. It ships the results of a deep engine audit (storage, WAL/recovery, transactions/MVCC, LSM indexes and concurrency), hardens High Availability (Raft) recovery, completes the Neo4j Bolt driver compatibility certification, and fixes a broad set of OpenCypher and SQL query bugs.

It also closes five security advisories from an internal audit (see Security Advisories below); upgrading is strongly recommended for server-mode and multi-tenant deployments.

Two changes require attention before upgrading (see Breaking Changes): Raft storage is now durable by default, and the Bolt protocol now carries native temporal types instead of ISO-8601 strings.

Over 130 issues were closed for this milestone.

Security Advisories

This release closes several security advisories found in an internal audit. Upgrading is strongly recommended for any server-mode or multi-tenant deployment.

• RCE via JavaScript triggers (GHSA-x9f9-r4m8-9xc2). A JavaScript trigger could look up java.lang.* host classes and reach Runtime.getRuntime().exec(...), obtaining OS command execution with only UPDATE_SCHEMA privileges. java.lang.* is removed from the trigger host-class allow-list; only the benign value packages (java.util, java.time, java.math) remain.
• Arbitrary JavaScript execution via DEFINE FUNCTION ... LANGUAGE js (GHSA-vwjc-v7x7-cm6g). The SQL route to JavaScript bypassed the polyglot scripting gate, letting a user with schema (or lesser) access define and run arbitrary JavaScript. Defining a js function now requires UPDATE_SECURITY, and the polyglot engine runs with IOAccess.NONE (closing load(path|url) host-file read and SSRF) and PolyglotAccess.NONE (no cross-language pivot). SQL and Cypher user functions keep the standard schema-level protection.
• Secret disclosure / root impersonation via GET /api/v1/server (GHSA-46hj-24h4-j8gf). The server-settings export masked only keys literally containing "password", leaking arcadedb.ha.clusterToken in clear - which, combined with the cluster-forwarded-auth headers, let a low-privilege authenticated user impersonate root. Every setting flagged isHidden() (clusterToken and all password/secret keys) is now redacted, for both the current and default value.
• Cross-database IDOR on time-series / batch / Prometheus / Grafana endpoints (GHSA-x8mg-6r4p-87pf). Fourteen handlers extended the base HTTP handler directly and resolved the path database with no canAccessToDatabase check, so a user authorized for one database could read and write any other database on the server. All affected handlers now enforce database authorization (HTTP 403) before any payload handling and fail closed on a missing database name; the batch handler checks before leader-forwarding.
• Read-only identity could mutate persisted schema (GHSA-8vr5-263f-x5r3). Several schema/config mutators reachable from a remote command were missing the UPDATE_SCHEMA guard: ALTER TYPE ... CUSTOM / BUCKETSELECTIONSTRATEGY, ALTER MATERIALIZED VIEW ... REFRESH, DROP MATERIALIZED VIEW / DROP CONTINUOUS AGGREGATE, ALTER TIMESERIES TYPE ... DOWNSAMPLING POLICY, DEFINE FUNCTION, and the stats-only REBUILD INDEX path. All are now gated (database-settings mutators use UPDATE_DATABASE_SETTINGS); every guard is a no-op for embedded, schema-load and HA-replication paths.

Major Highlights

Engine deep-audit 2026-07 (storage, transactions, LSM, concurrency)

A multi-area audit (#4962) hardened the core engine against data-loss and corruption edge cases under crashes, concurrency and load. Notable outcomes:

• The WAL append is now the transaction's point of no return. Page versions are validated and bumped
  before the WAL write, so an aborted transaction can no longer be left in the WAL and partially replayed by
  recovery; a post-append failure is resolved by recovery replay and fences the database until reopen
  (#4936, #4937).
• Torn 64KB page writes are repaired on recovery even when the on-disk version header already advanced (#4926); a clean close whose data fsync failed now
  preserves the WAL for recovery instead of deleting it (#4934).
• Page-cache correctness: an older page version can no longer overwrite a newer committed one (lost
  update) and RAM accounting can no longer drift negative and disable eviction (unbounded growth) (#4925, #4933).
• LSM index hardening: compaction no longer loses re-inserted keys or leaks orphaned pages on failure,
  range scans are no longer truncated by tombstoned keys, and non-unique point lookups no longer resurrect
  deleted RIDs (#4942, #4943, #4944, #4945, #4946, #4947).
• Transactions: updating the same indexed record twice in one transaction no longer corrupts the index
  (#4935); dead-thread cleanup now rolls back abandoned
  transactions and releases their file locks, and is correct for virtual threads (#4941, #4956, #4939, #4940).
• Async executor and shutdown: the stall detector no longer false-positives on slow tasks, shutdown no
  longer drops queued tasks or hangs completion waiters, and close()/drop() are now bounded so a wedged
  worker cannot hang shutdown forever (#4953, #4954, #5080, #4991).

Parallel query safety

Parallel bucket scans (enabled by default) could self-deadlock under pool saturation and wedge HTTP workers, race on the shared command context, or pin a CPU core at 100% when a consumer stopped draining. Scan producers now run on a dedicated pool, each worker gets its own context, and the native select().parallel() iterator bounds its producer offer and closes cleanly (#4948, #4949, #4950, #4951, #5065).

High Availability (Raft) recovery

• Durable Raft storage by default removes a class of permanent follower divergence after a full-cluster cold restart (see Breaking Changes, #4835).
• Diverged-follower resync no longer floods the logs and starves the snapshot download it triggers; only the first gap logs loudly (#4741 follow-up).
• The leader now auto-recovers a follower's replication channel wedged on stale DNS after a Kubernetes pod-IP change, instead of dropping to bare quorum until a manual leadership transfer (#4696).
• A distinct contract for "committed cluster-wide, local apply failed"
  (TransactionCommittedRemotelyException, mapped to HTTP 409) so applications no longer retry and create duplicates (#5064, #5017, #5018).
• Offline bootstrap leadership-transfer path now commits its baseline (#5099).

Neo4j Bolt driver compatibility certification

The Bolt epic (#4882) reached certification: a shared conformance spec, per-language driver e2e suites (Java, Python, JS, Go, C#) CI-gated with a nightly run, and broad type-fidelity work. Highlights: native temporal PackStream structs in both directions (see Breaking Changes), native Path/Duration/Point structures, retryable-conflict mapping so drivers auto-retry, HA-aware ROUTE responses, Bolt 5.x negotiation and populated write-result counters (#4883-#4892, #4905, #4907, [#4908(https://github.com//issues/4908), #4922,
#4997-#5002, [#5082](https://gi...

ArcadeDB 26.7.1 Release Notes

Overview

ArcadeDB 26.7.1 is a large stability, resilience and security release with over 420 commits, 238 resolved issues and 32 merged pull requests. The headline theme is a deep High Availability / Raft hardening wave that makes clustered deployments far more robust under leader churn, node restarts, snapshot transfers and Kubernetes scale events. On top of that come a security hardening pass (polyglot scripting lockdown, gRPC and cluster-management authorization, DoS bounding), a new OpenTelemetry distributed-tracing module plus structured JSON logging, native BM25 full-text scoring, continued ISO GQL compliance and vector engine work, and a long list of gRPC, MongoDB wire-protocol, SQL, OpenCypher, time-series and Studio fixes.

New Features

• OpenTelemetry distributed tracing - an optional module for end-to-end request tracing, with opt-in OTLP export. (#4467, #4465)
• Structured JSON logging with per-request correlation IDs. (#4466)
• Native BM25 full-text scoring - field boosts, caret syntax and EXPLAIN / PROFILE support. (#4687)
• ISO GQL compliance - strict numeric types (schema round-trip), session management (SESSION SET / RESET / CLOSE) and transaction control (START TRANSACTION / COMMIT / ROLLBACK). (#4141)
• New vector formats and helpers - MATLAB / MATLAB_COLUMN, JULIA and NUMPY formats, asVector(), asSparse(), RRF array input and vectorDequantizeBinary. (#3099)
• MongoDB wire protocol - update, delete and createIndexes commands plus SASL PLAIN authentication. (#4750, #4751, #4746)
• HA auto-acquire of unseen databases - a joining node bootstraps databases it has never seen. (#4727)
• Kubernetes health probes - liveness/readiness/startup endpoints for orchestrated deployments. (#4464)
• Paginated remote fetching of edges and vertices across the remote API.
• Studio - cluster HA alerts and Restore / Delete row actions on the backup list. (#4737)

Major Highlights

High Availability & Raft resilience

The bulk of this release goes into making the Raft-based HA cluster survive real-world failure modes without data loss or node self-halt:

• No more node-wide halt on apply errors. Apply-time failures are now quarantined per-database instead of taking the whole node down, transient NeedRetryExceptions are retried in Raft apply, and unexpected throwables no longer kill the process. (#4797, #4659)
• Divergence self-recovery. A follower stuck on a divergent Raft log now performs follower-side reformat-and-rejoin instead of spinning on INCONSISTENCY, and a WAL-version-gap / phase-2 commit failure no longer causes a node to self-halt. (#4741, #4740)
• Snapshot integrity. Snapshot extraction, markers and the final swap are now fsynced before the backup is deleted, transfer completeness is verified with a manifest, takeSnapshot() persists a real snapshot marker so a log purge can no longer orphan applied state, and the database-registry lock is held across snapshot close -> swap -> reopen. (#4830, #4831, #4829, #4832)
• Membership & quorum safety. Raft membership now uses atomic deltas instead of last-write-wins setConfiguration, removePeer / leaveCluster are guarded against dropping below quorum, and stepDown selects the highest-priority non-lagging peer while skipping priority-0 witnesses. (#4795, #4796, #4808)
• Per-database applied-index tracking, so mixed-database clusters track progress correctly. (#4824)
• Silent write loss eliminated when replication times out after dispatch: the leader no longer acknowledges a write it failed to replicate. (#4790)
• Accurate lag diagnosis. New heartbeat-lag metrics, byte-bounded replication backpressure, resync logging (leader flood suppression + follower resync visibility), and a slow-but-progressing follower is now treated as catching up rather than stale. ClusterMonitor per-replica lag state is reset on each new leadership term to prevent false STALLED reports. (#4812, #4810, #4840, #4841)
• Auto-acquire of unseen databases so a joining node bootstraps databases it has never seen, with a single deterministic bootstrap source instead of abandoning databases on first transfer. (#4727, #4807)

Kubernetes operations

• StatefulSet scale-up beyond HA_SERVER_LIST no longer crash-loops: a local Raft peer is synthesized and auto-joins when the pod ordinal exceeds the static list. (#4836)
• Raft storage is persisted by default under Kubernetes, so a pod restart no longer wipes the PVC-backed Raft log. (#4835)
• Kubernetes health/liveness/readiness probes and a graceful cluster-leave path owned solely by RaftHAServer.stop(). (#4464, #4837)

Security hardening

• Polyglot scripting now requires admin privileges and the GraalVM sandbox has been hardened (reflection deny-list), closing an advisory (GHSA-48qw-824m-86pr) where a reader-role user could read host files via JavaScript on /api/v1/command.
• gRPC authorization is enforced centrally instead of being blanket-skipped: getDatabase rejects path-traversal names and enforces auth, admin operations require admin auth, and cross-database access is covered by regression tests. (#4793, #4792, #4794)
• Cluster-management HTTP endpoints now require root. (#4791)
• DoS bounding on gRPC: result materialization and worker busy-wait are bounded, abandoned gRPC transactions are reaped to stop an executor/transaction leak, and in-band command failures are correctly counted as errors. (#4803, #4802, #4804)
• Hardened FileUtils path-traversal guard.

Observability

• Optional OpenTelemetry distributed-tracing module for end-to-end request tracing. (#4467)
• Structured JSON logging with per-request correlation IDs. (#4466)
• Metrics depth (Pillar 1): RED timers, engine gauges and opt-in OTLP export, plus gRPC metrics published into the shared server registry with method/status tags and executor-pool gauges. (#4465, #4826)

Native BM25 full-text scoring

Full-text search gains native BM25 scoring with field boosts, caret syntax and EXPLAIN / PROFILE support, along with fixes so SEARCH_INDEX no longer leaks internal posting-RID strings into @rid, multi-property and rebuilt FULL_TEXT indexes no longer crash, and multi-dot SEARCH_INDEX queries are parsed correctly. (#4687, #4731, #4732, #4733, #4734)

ISO GQL compliance

Continued work toward the ISO GQL standard (#4141): strict numeric types on the write side (schema round-trip), session management (SESSION SET / RESET / CLOSE) and transaction control (START TRANSACTION / COMMIT / ROLLBACK).

Vector engine (Epic #3099)

• Quantization ergonomics, asSparse(), asVector() (inverse of asString), RRF array input and vectorDequantizeBinary.
• New MATLAB / MATLAB_COLUMN, JULIA and NUMPY vector formats.
• Correctness fixes across the vector SQL functions, consistent cosineSimilarity on zero vectors, and a consistent ordinalToVectorId snapshot during brute-force scans. (#4583, #4581)

MongoDB wire protocol

The mongodbw plugin now supports update, delete and createIndexes commands, adds SASL PLAIN authentication, and returns correct data on find. (#4750, #4751, #4746, #4745)

Major Fixes

gRPC

• InsertStream is stopped after a mid-stream commit failure (and the error is no longer mis-indexed), the transaction is no longer begun/committed on different pool threads, and CONFLICT_UPDATE upsert now merges non-key columns. (#4806, #4656)
• Streaming terminal calls are serialized on a thread-safe StreamObserver. (#4801)
• DATETIME_MICROS / DATETIME_NANOS precision is preserved on the write path, null-valued projected columns survive ExecuteQuery, and the configured compression codec is honored. (#4805, #4692, #4827)
• Time-series INSERT over gRPC no longer throws on empty @type / @rid. (#4688)

High Availability (additional)

• TRUNCATE TYPE / TRUNCATE BUCKET are now HA-safe, using small batches and failing loud instead of silently truncating incompletely. (#4817)
• Follower match/next indices are correlated by peer-id stability rather than array position, fixing mis-zipped follower states. (#4842)
• The Raft gRPC allowlist fails open only up to quorum, not the full peer set, and the state machine is rewired to RaftHAServer on a HealthMonitor-driven Ratis restart. (#4828, #4839)
• AppendEntries element limit is configurable (default 64), RATIS-2523 matchIndex rewind is atomic and fail-loud, and a replica stuck STALLED at matchIndex=-1 auto-recovers. (#4752, #4833, #4728)
• LINEARIZABLE follower reads no longer serve stale state, and read-only statements honor the requested read consistency.
• Snapshot write watchdog now detects stalls rather than total elapsed time, proactive peer allowlist refresh + hardened DNS caching, and GraphBatch bulk load survives a transient leader re-election. (#4729, #4696, #4724)

SQL

• UPDATE SET map = map.remove(key) now persists map/collection key removal. (#4730)
• SELECT FROM <non-existent RID> returns an empty result set instead of HTTP 500.
• Planner prefers a full-key index over a partial-key scan on a longer composite index. (#4600)
• IN / NOT IN three-valued logic for NULL operands, GROUP BY on mixed-type numeric keys no longer splits equal groups, and min() / max() over mixed numeric collections no longer throws ClassCastException. (#4591, #4592)
• DISTINCT result can be used as a function argument / method base, backticks are stripped from quoted projection aliases, and algo.allSimplePaths supports skipVertexTypes. (#4691)
• Assorted math/collection function fixes: SplitFunction on null delimiter, AbstractMathFunction.asDouble(null), TailFunction sublist view, date.convert ...

ArcadeDB 26.6.1 Release Notes

Overview

ArcadeDB 26.6.1 is a stability, durability and security hardening release with over 280 commits and 66 resolved issues. The headline news is end-to-end TLS/SSL for the HA cluster, a deep wave of durability and crash-recovery hardening across the WAL, page and serialization layers, and a broad security hardening pass (schema authorization, IMPORT DATABASE source validation, injection fixes and a full CodeQL cleanup). On top of that comes a long list of High Availability / Raft, OpenCypher, SQL, vector index and wire-protocol fixes, plus Studio and operational improvements.

Major Highlights

TLS/SSL Across the HA Cluster

The Raft-based HA cluster can now run fully encrypted. Inter-node replication traffic supports SSL/TLS, and the snapshot installer was fixed so a follower can download a leader snapshot over the HTTPS listener instead of crashing with Unsupported or unrecognized SSL message. (#4470)

Durability & Crash-Recovery Hardening

A large batch of fixes closes data-integrity gaps in the storage, WAL and serialization layers so committed transactions survive crashes and power loss, and recovery never silently drops data:

• WAL is now fsynced on commit by default, and data files are fsynced before WAL files are deleted on clean close. (#4330, #4332)
• Crash recovery now aborts on a WAL version gap and preserves the WAL files instead of silently skipping the gap. (#4331, #4320)
• MutablePage.move no longer mis-tracks the modified range on backward shifts, so defrag bytes are no longer omitted from the WAL. (#4319)
• Binary serialization fixes: property count now matches the bytes written, and partial reads are handled via readFully. (#4328, #4329)
• Short-write / short-read returns are now respected in PaginatedComponentFile. (#4321)
• LZ4 compression no longer corrupts data when Binary.position() > 0. (#4317)
• Simple-8b codec validation no longer silently truncates Long.MAX_VALUE / Long.MIN_VALUE. (#4336)
• migratedFileIds is now persisted in schema.json, so compaction no longer silently drops in-flight transactions across restart. (#4333)
• java.lang.NegativeArraySizeException on transaction commit fixed. (#4420)

Security Hardening

• All LocalDocumentType / LocalProperty schema mutators now require the UPDATE_SCHEMA permission (previously only createProperty was gated). (#4423)
• IMPORT DATABASE now validates its source and requires admin privilege, closing SSRF / LFI vectors. (#4422)
• SQL injection fixed in RemoteVertex.newEdge by switching to parameter binding (also fixes breakage on apostrophes). (#4327)
• JavaScript injection in the polyglot engine closed by replacing the "looks-like-JSON" source-concatenation heuristic with Value.execute(). (#4326)
• Full CodeQL cleanup: open Java and JavaScript code-scanning alerts resolved at their true sources (workflow permissions, ReDoS, path-injection). (#4383, #4386, #4388)

Major Fixes

High Availability & Clustering

• TimeSeries data now replicates correctly across an HA cluster, and a compaction/append deadlock that caused a WAL version gap on Raft followers was eliminated. (#4414, #4458)
• Concurrent single-row time-series INSERTs no longer silently lose samples (sealed-slot lost update). (#4453)
• Bolt writes to a follower no longer fail with "no authenticated user in the current security context"; the authenticated user is now bound on DatabaseContext in the Bolt executor. (#4456)
• PeerAddressAllowlistFilter no longer rejects legitimate peers during a Kubernetes DNS-resolution race (incomplete allowlist on startup/restart). (#4471)
• Stale-follower recovery is fixed when a snapshot download fails on a quiet cluster.
• New configurable paths: arcadedb.ha.raftStorageDirectory for the Raft storage directory (#4446), configurable server log directory for read-only root filesystems (#4451), and arcadedb.ha.clusterTokenPath to read the cluster shared secret from a file (#4431).
• RemoteDatabase no longer reuses a session id across servers on HA failover during an open transaction; a TransactionException is now raised on server switch. (#4373)
• RemoteHttpComponent no longer mutates leaderServer / currentServer non-atomically during retries. (#4372)
• New STICKY strategy pins HTTP transactions to a concrete cluster member. (#4273)
• getReplicaAddresses now excludes the local peer instead of the leader. (#4274)
• /api/v1/server?mode=cluster returns the ha section again after the Raft migration. (#4261)
• New "Force Resync" button in Studio to recover a diverged follower from the leader.
• HA bootstrap-fingerprint replay race fixed, and HA node aliases corrected. (#4259)
• Massive-insertion cluster configuration issues resolved, plus assorted HA log improvements.

Concurrency & Async

• FileManager no longer mutates its ArrayList<ComponentFile> from multiple threads without synchronization (fixes CME / AIOOBE). (#4371)
• LockManager.tryLock now re-attempts putIfAbsent after a wait timeout and tracks the remaining timeout per await. (#4367)
• DatabaseAsyncTransaction now rolls back before retrying after a ConcurrentModificationException, invokes the per-task onErrorCallback, and no longer swallows final-retry failures or contaminates the shared transaction. (#4368, #4369, #4370)
• PageManager.putPageInReadCache no longer leaks RAM accounting when replacing an existing CachedPage. (#4390)

OpenCypher

• CREATE INDEX now implicitly creates the referenced property (Neo4j-style lazy schema). (#4354)
• nodes(), relationships() and length() on variable-length path patterns (e.g. [*1..3]) are now implemented. (#4353)
• Records written via SQL are now visible to subsequent Cypher queries (and vice versa) within the same connection/transaction. (#4355)
• EXPLAIN no longer fails with an idempotency error on a multi-statement query containing CREATE. (#4366)
• Label disjunction (n:A|B) no longer returns 0 rows. (#4221)
• allShortestPaths() now returns all co-shortest paths instead of just one.
• MERGE now uses a bound anchor as the traversal start instead of a full edge-type scan (performance), and no longer crashes on a single-quote property value with UNWIND or rebinds the variable from an OPTIONAL MATCH null endpoint. (#4213, #4210)
• DATETIME property comparison with datetime() no longer returns 0 rows. (#4231)
• Redundant AND true / OR false branches are now simplified in WHERE clauses. (#4405)
• MATCH ... WHERE ID(n) IN $ids now accepts a long[] parameter array.
• Query results are now consistent between parameterized and hard-coded values.

SQL

• IN :param with a collection parameter now returns rows when an index is used. (#4468)
• MOVE VERTEX no longer generates an internal error. (#4461, #4347)
• expand() projection now honors its AS alias instead of always being named value. (#4389)
• IN (SELECT …) no longer always returns empty (InCondition now unwraps single-property results). (#4337)
• MERGE on a UNIQUE-indexed property no longer throws DuplicatedKeyException when the same key appears twice in a batch (Neo4j matches the second occurrence). (#4351)
• node.* and rel.* functions no longer silently return null/0 from SQL. (#4216)
• TimeSeries timestamps are now returned in queries. (#4418)
• New cypherRID(<cypher-rid>) SQL function and asCypherRID() method for interoperating with Cypher numeric ids.
• ResultInternal.getProperty no longer re-surfaces removed properties via element fall-through. (#4398)
• EdgeLinkedList.removeVertex / removeEdge now iterate all segments to remove every matching entry. (#4395)
• MultiIterator.countEntries no longer discards the count for non-resettable iterables. (#4396)
• MATCHES now keys its regex Pattern cache by the regex string rather than hashCode() (collision no longer returns the wrong pattern). (#4397)
• Case conversions across the function library now use Locale.ROOT. (#4393)
• RangeFunction and the math functions are now guarded against long-range overflow / infinite loops. (#4391, #4392)
• CREATE INDEX ON ... (...) without an index type now raises a clear parsing error instead of an NPE.
• Inserting edges between existing nodes with mandatory properties now works. (#4413)
• Multiple-inheritance handling fixed, and point() over a latitude property surfaced as a string no longer throws a ClassCastException.
• SEARCH_INDEX() negative Lucene clauses now return correct results. (#4220)

Vector & Index

• TRUNCATE TYPE no longer resets an LSM_VECTOR index dimension to 0, nor leaves UNIQUE indexes in an inconsistent state requiring DROP TYPE. (#4359, #4352)
• LSMVectorIndex now converts JVector's EUCLIDEAN return to L2² distance in all search paths, so K-NN no longer returns the worst matches first. (#4334)
• LSMVectorIndexCompactor now handles the old-format tombstone rewind correctly. (#4335)
• NPE in discoverAndLoadCompactedSubIndex that prevented loading compacted vector sub-indexes at startup fixed.
• LSM_VECTOR inactivity rebuild timer is now re-armed after a skip. (#4272)
• REBUILD INDEX now works for BY ITEM indexes. (#4448)
• vector.fuse() is now recognised as a SQL function (no more "Unknown method name: fuse").

Wire Protocols

• Bolt: parameterized Cypher MATCH queries via the JavaScript neo4j-driver now work (#4452); integer property values are no longer coerced to strings after CREATE INDEX, and index-backed lookups return rows.
• PostgreSQL: scalar columns are now advertised with native OIDs. (#4202)
• gRPC: correct exceptions are now thrown (NOT_FOUND for RecordNotFoundException on lookupByRid) (#4364); LocalDateTime / LocalDate and ISO-string fallback handled i...

ArcadeDB 26.5.1 Release Notes

Overview

ArcadeDB 26.5.1 is a major release with over 270 commits and 128 resolved issues. The headline news is the new sparse vector index with server-side hybrid retrieval and INT8 quantization end-to-end, a huge wave of OpenCypher correctness fixes, query partitioning, a new EXTERNAL property storage layout for heavy values, plus a long list of HA, wire-protocol, and Studio improvements.

Major Highlights

Sparse Vector Index + Hybrid Retrieval

A brand-new LSM_SPARSE_VECTOR index brings sparse-embedding retrieval (BM25/SPLADE-style) directly into the engine, with server-side fusion of dense and sparse results and diversified top-K. (#4065, #4066, #4067, #4068, #4070, #4078, #4119, #4130)

• New index type LSM_SPARSE_VECTOR for sparse-embedding retrieval.
• vector.fuse(...) server-side hybrid fusion with RRF, DBSF and LINEAR strategies.
• vector.neighbors(...) gains groupBy / groupSize options for diversified retrieval, including dotted nested-field grouping (#4072) and traversal-integrated grouping (#4071).
• WAND / BlockMax-WAND dynamic pruning to scale sparse retrieval to 100M+ documents.
• Sparse-vector partitioning so a single index can be sharded by tenant / domain.
• Reranker SQL functions for two-stage retrieval pipelines.
• Bolt and HTTP wire support for the new sparse vector type, including $bytes / $int8 markers for INT8 query vectors.

INT8 Quantization for Dense Vectors

End-to-end INT8 support across the dense vector pipeline: ingest, storage and query path now share the same 8-bit representation, dramatically reducing disk and RSS without going through the FP32 path. (#3143, #4132, #4133, #4135, #4136)

EXTERNAL Property Storage

New paired-bucket layout for heavy property values (vectors, large strings, JSON). Hot row data stays compact in the main bucket while bulky payloads live in a sibling external bucket, sharply reducing scan cost on wide records. (#4027, #4028)

Query Partitioning

Query-level partitioning lands together with a partition-aware planner that prunes pruned partitions from SQL and Cypher plans, plus integrity guardrails for partitioned types. (#4087, #4088)

HA: Offline Cluster Bootstrap

You can now bootstrap a fresh HA cluster from a pre-seeded database (snapshot-and-restore), avoiding a full re-replication of large datasets when expanding or rebuilding a cluster. Includes regression integration tests for the cluster-formation edge cases. (#4147, #4205)

Production-Ready Helm Chart

The Helm chart has been reworked to align with the Raft-based HA subsystem introduced in 26.4.2 and is now suitable for production rollouts. (#4035)

Cypher: SHOW INDEXES / SHOW CONSTRAINTS

Standard Cypher administrative commands SHOW INDEXES and SHOW CONSTRAINTS are now supported. (#3972)

SQL: FIND REFERENCES

Restores the OrientDB-compatible FIND REFERENCES command for locating all records pointing to a given RID. (#4146)

C# End-to-End Tests

A new e2e suite exercises ArcadeDB over the Postgres wire via Npgsql and Testcontainers, validating the C# client path on every build. (#4036, #4038)

HA Operational Improvements

• Optional human-readable peer names in HA_SERVER_LIST for friendlier cluster topology. (#3974)
• Studio gains peer add/remove controls in the HA cluster panel. (#4145)

Studio Improvements

• Full-screen mode for graph view. (#4032)
• Clear query button / textbox. (#4121)
• Session reset on token expire instead of silent failure. (#4082)
• Error messages now persist instead of disappearing after a few seconds. (#4124)
• Query history no longer auto-submits on selection. (#4022)
• Inherited indexes are now visible. (#4140)

Major Fixes

OpenCypher Correctness

A large batch of correctness fixes landed across pattern matching, write clauses, subqueries, list/temporal expressions and the optimizer fast-path. Highlights:

• valueType(...) now reports the NOT NULL suffix for non-null values. (#3991)
• point(...) WGS-84-3D exposes .height as an alias for .z. (#3992)
• CALL ... YIELD no longer nullifies variables carried in from WITH. (#3996, #4094)
• collect(r) followed by a variable-length match no longer drops all rows. (#3997)
• Variable-length pattern segments no longer re-traverse a relationship bound in a prior MATCH. (#4006)
• MERGE with an unbound label-only endpoint now creates a fresh node instead of reusing an existing one. (#3998)
• SET now propagates to all aliases bound to the same node within the same query. (#4000)
• Self-referential property updates and SET :Label are now idempotent across row fanout. (#4016, #4017)
• Temporal component access on date/datetime values no longer returns null. (#4018)
• WITH-carried node variables are no longer nulled out by a later CREATE / MERGE. (#4019)
• allReduce(...) no longer evaluates true cases as false. (#4043)
• Anonymous middle nodes in multi-hop chains now match rows. (#4092)
• Backslashes in string literals and property values are preserved. (#4093)
• Consecutive directed and undirected relationship patterns must not reuse the same edge. (#4095, #4096)
• EXISTS { ... } subqueries returning an outer-variable expression no longer evaluate as false. (#4097)
• List literals containing duration(...) no longer drop rows. (#4099)
• List subscript with an inline aggregate index no longer returns null. (#4100)
• MATCH immediately after CREATE now sees newly created labeled nodes. (#4101)
• MATCH on a null carried variable now correctly filters out the row. (#4102)
• MERGE ... ON MATCH SET no longer returns the pre-update property value. (#4103)
• MERGE patterns no longer reuse a newly created endpoint across input rows. (#4104)
• Node label-union patterns now match when either label exists. (#4105)
• Pattern comprehensions over existing relationships are no longer empty. (#4106)
• reduce(...) over an inline aggregate expression is now evaluated correctly. (#4107)
• Relationship type predicates on bound relationship variables no longer evaluate as false. (#4108)
• Repeated relationship variables in WHERE patterns now match no rows (as expected). (#4109)
• Uncorrelated pattern predicates now correctly reflect existing relationships. (#4110)
• Variable-length pattern comprehensions no longer duplicate projected elements. (#4111)
• WHERE false literal predicates are no longer ignored. (#4112)
• datetime() values are now persisted on DATETIME-typed properties. (#4125)
• OR EXISTS + AND NOT (EXISTS ... OR EXISTS ...) returns the correct rows under two-outer-MATCH binding. (#4126)
• Optimizer fast path is now skipped when a write clause precedes MATCH. (#4131)
• CALL subquery SET no longer leaves the carried outer variable stale. (#4182)
• id(...) is now numeric and no longer breaks numeric predicates. (#4183)
• shortestPath / allShortestPaths with variable-length relationship type alternation now match. (#4190)
• Write-only CALL subqueries no longer return an extra empty row. (#4191)
• MATCH on a parent edge type now matches sub-typed edges (polymorphic edge traversal). (#4192)
• Batch fixes for #4184, #4185, #4186, #4188, #4189. (#4196)

SQL

• CONTAINSALL now works when comparing a list of Identifiables against a list of RID strings. (#4002)
• Correlated COLLECT { ... } / COUNT { ... } subqueries with outer-variable access now evaluate correctly instead of always returning empty/zero. (#4014, #4015)
• SEARCH_INDEX and SEARCH_FIELDS now propagate return values in filters and correctly handle wildcards. (#4023, #4030)
• SELECT with a non-unique LSM index no longer returns zero rows after partial deletes (per-RID tombstones no longer suppress the whole key). (#4024)
• Edge creation with CONTENT no longer silently ignores properties. (#4033)
• algo.dijkstra no longer yields a weight of zero. (#4042)
• LIST of STRING in GraphBatch works again. (#4069)
• UPDATE EDGE SET @in/@out correctly rewires the vertex edge lists. (#4074)
• = combined with LIKE on time-series types no longer returns zero results. (#4128)
• Range queries no longer raise a spurious "Non-existent edge type" error. (#4199)
• point.withinBBox(...) now supports cross-meridian bounding boxes. (#3994)

Storage, Indexing and Schema

• HASH index lookups now return rows when data encryption is enabled (keys are kept deterministic). (#4137)
• Orphan TypeIndex wrapper is now dropped when its last bucket child is removed. (#4179)
• Indexes on a subclass are no longer incorrectly related to superclass indexes. (#4120)
• Manual index names are now respected on creation. (#4139)
• Inherited indexes are now shown in Studio. (#4140)

High Availability

• Schema changes now ship to followers, closing a WAL-gap source. (#4077)
• Cluster inconsistency reports after node shutdowns resolved. (#4081)
• Massive inserts over gRPC now replicate correctly. (#4076)
• Correct leader is now reported in the resume table. (#4075)
• ClassCastException (RaftReplicatedDatabase to LocalDatabase) on the leader during import / read-only property writes fixed. (#4144)
• /api/v1/batch no longer fails with "Error on updating dictionary" on follower nodes. (#4039, #4122)
• /batch endpoint no longer returns HTTP 500 NPE after a successful commit. (#4123)
• Spurious index warnings from cluster followers removed. (#4063)
• e2e-ha integration tests stabilized, with on-demand Toxiproxy support. (#4013, #4020)

Wire Protocols

• PostgreSQL: empty SELECT results now include the RowDescription schema (#3971); SHOW server_version returns a proper value for SQLAlchemy (#4116); Cypher WHERE id(n) IN $array round-trips correctly after id() became numeric (#4200); binary array deserializati...

ArcadeDB 26.4.2 Release Notes

Overview

ArcadeDB 26.4.2 is a major release with over 340 commits and 100+ resolved issues. The headline is a brand-new Raft-based High Availability stack built on Apache Ratis, alongside a deep wave of OpenCypher correctness and performance work, expanded wire-protocol security (BOLT + TLS), a new end-to-end Query Profiler, and a long list of SQL, HA, storage, and Studio improvements.

Highlights

Raft-based High Availability using Apache Ratis

ArcadeDB now ships a new HA mode backed by Apache Ratis, bringing a battle-tested Raft consensus implementation to the server. Leader election, log replication, and membership changes are all delegated to Ratis, giving stronger correctness guarantees for replicated writes and simpler operational semantics for clusters running on Kubernetes and bare metal #3730.

End-to-end Query Profiler

The query profiler has been promoted to a first-class feature across every query entrypoint (HTTP, Studio, embedded, drivers). In addition to planner and executor timings, it now also accounts for record deserialization and result serialization, giving a complete picture of where the time goes. Studio surfaces the new serialization cost directly in the results panel #3894.

OpenCypher: major correctness and optimization round

Dozens of OpenCypher issues have been closed in this release. Highlights:

• Filter pushdown for list predicates (any / all / none / single) in WHERE clauses, which dramatically reduces scanned rows on complex predicates - PR #3891, #3888
• Index usage for MATCH WHERE ID(n) = <expr> when the expression is dynamic (was falling back to full scan) - PR #3865
• Aggregation with CASE no longer returns multiple rows from an implicit GROUP BY - #3858
• CREATE CONSTRAINT ... IS TYPED is now supported - #3800
• CREATE INDEX statement is now supported - #3763
• Path Mode (WALK, TRAIL, ACYCLIC) support - #3710
• WITH * + extra AS alias no longer drops the extra items - #3761
• Cypher support removed from the Gremlin module in favor of the native engine - #3811
• Many subquery fixes:
  • EXISTS { MATCH ... } when relationship type embeds a Cypher keyword after underscore - #3952
  • CALL subquery with UNWIND no longer multiplies outer rows - #3944
  • CALL subquery reusing an outer variable name no longer drops rows - #3959
  • CALL + UNION ALL keeps all branches - #3958
  • COLLECT { ... } returns the list instead of null - #3957
  • COUNT { ... } pattern subqueries return the count, not the bound node - #3955, #3956
  • Inline relationship WHERE predicate is now applied - #3951
  • Existential pattern predicate in WHERE correctly filters by target node - #3938
  • Standalone ORDER BY ... LIMIT ... before MATCH preserves the selected row - #3950
• Expression and null handling fixes:
  • tail(null) returns null (not []) - #3920
  • CASE null WHEN null returns not_matched - #3922
  • List / string concatenation || with null returns null - #3921, #3926, #3927, #3928
  • Dynamic label matching with $() - #3923
  • Quantified path pattern ->+ matches 1+ relationships - #3924
  • Variable-length pattern *2..2 no longer includes distance-1 nodes - #3931
  • RETURN ALL raises a syntax error as expected - #3925
  • Fixes from the TCK run: 10 OpenCypher TCK failures from optimizer clause ordering resolved
  • Parameterized queries match correctly in property maps when an edge is present - #3765
  • Label expression predicate with null node returns null - #3935
  • Mandatory MATCH over existing relationships consistent with OPTIONAL MATCH and SQL - #3711
  • Cypher self-join on the same edge type - #3758
  • Stack Overflow workload result divergence from Neo4j - #3759
  • Concatenation of constant string to list with + operator - #3771
  • Subquery with UNION only returning first branch - #3772
  • Types automatically created when creating a constraint - #3760

BOLT + TLS

The Neo4j Bolt wire protocol now supports TLS, and the plugin no longer binds to a random ephemeral port when a port is configured.

• TLS support: #3799
• Port binding fix: #3809
• Parameterized query fix when forwarded through HA - PR #3961

SQL function options map and new function surface

All complex SQL functions now accept a trailing options map as an alternative to long lists of positional optional arguments. This is adopted across:

• Full-text search: #3880 (also adds fulltext.* namespace aliases)
• Graph algorithms: shortestPath, dijkstra, bellmanFord, astar - #3881
• Time-series: movingAvg, timeBucket, interpolate, promql - #3882
• Vector scoring: vectorRRFScore, multiVectorScore, vectorHybridScore - #3883
• Geo / date: geo.buffer, date functions - #3884
• General SQL function support - #3879
• vectorNeighbors accepts a map of optional arguments
• allSimplePaths now supports an exclusion list of edge types (commit 8bd74916d)
• All stateless Cypher functions (e.g. text.jaroWinklerDistance) are now reachable from SQL - #3866

SQL: batch UPDATE / DELETE / TRUNCATE

Bulk mutation workflows are significantly faster thanks to true batch execution for UPDATE, DELETE, and TRUNCATE:

• BATCH support in SQL UPDATE and DELETE - #3806
• Batch delete path in SQL TRUNCATE

Case-insensitive indexes (COLLATE)

SQL indexes can now be declared case-insensitive via COLLATE, enabling indexed lookups on text fields without case normalization at query time. #3726

Production mode safety

When the server is started in SERVER_MODE = production:

• fsync is automatically set to true to protect durability on crash - #3808
• A new startup security checklist surfaces misconfigurations before the server accepts traffic

HTTP: restore database + Studio integration

A new HTTP command allows restoring a database directly over the REST API, with Studio UI support and a progress bar for long-running imports and restores. #3764

The legacy BACKUP DATABASE command now also gives a clear error when handed an http(s):// URL. #3716

RemoteGraphBatch client API

A client-side RemoteGraphBatch batching API with auto-flush targets the server-side /batch endpoint, making high-volume ingestion from remote drivers much easier. #3817

Performance

• Custom collections and maps in hot paths reduce RAM usage and improve iteration throughput - #3965
• TimeSeries: batch writes per shard to reduce transaction overhead - #3862
• Neo4j importer uses the new BatchGraph API, drops more than 80% of RAM with numeric Neo4j ids - #3770
• **Vector...

ArcadeDB 26.3.2 Release Notes

We're excited to announce ArcadeDB 26.3.2, a performance-focused release with 100+ commits and 21 closed issues that introduces the Graph Analytical View (GAV) for OLAP-grade graph analytics, a high-performance bulk edge importer, HTTP batch endpoint, gRPC batch graph loading, GraphQL introspection, MCP stdio transport, and numerous bug fixes and performance improvements across the SQL, OpenCypher, and Gremlin engines.

Major New Features

Graph Analytical View (GAV) — CSR-based OLAP Acceleration

Introduced the Graph Analytical View (#3617, #3618), a CSR (Compressed Sparse Row) based OLAP acceleration layer that dramatically speeds up graph analytics. GAV is automatically used by both the SQL and OpenCypher query planners when beneficial, enabling orders-of-magnitude faster execution of graph algorithms, traversals, and pattern matching on large datasets. Key optimizations include:

• Build-probe hash join for multi-pattern Cypher queries sharing endpoint variables
• Count push-down to graph algorithms, avoiding materialization of millions of records
• Sorted neighbor lists enabling merge-join for triangle counting and similar algorithms
• Anti-join with binary search for target nodes in anchor's sorted neighbor list
• Automatic async rebuild on graph mutations

High-Performance Bulk Edge Creation

New GraphBatchImporter (#3621) for ultra-fast bulk edge creation with parallel writes for both outgoing and incoming edges, parallel sorting, and optimized edge insertion. Includes a new database.batch() API for super-fast batch operations.

HTTP Batch Endpoint

Added a new /batch HTTP endpoint (#3675) for executing multiple operations in a single HTTP request, reducing round-trip overhead for bulk operations.

gRPC GraphBatchLoad RPC

New GraphBatchLoad client-streaming RPC (#3678, #3680) in the gRPC module for high-throughput bulk graph loading via streaming.

GraphQL Introspection

GraphQL introspection is now available (#3671), enabling tools and IDEs to discover the schema and available queries/mutations automatically.

MCP Stdio Transport

Added MCP stdio transport (#3685) alongside the existing SSE transport, enabling direct integration with AI assistants and tools that use the stdio protocol. Also added profiler and server settings to MCP server tools (#3663) and fixed MCP authentication with API tokens (#3620).

Auto-tune maxPageRAM

ArcadeDB now auto-detects container memory limits at startup (#3580) and adjusts maxPageRAM accordingly, improving out-of-the-box performance in Docker and Kubernetes environments.

Bug Fixes & Improvements

SQL Engine

• Fixed aggregating projection with count(*) returning nothing on empty types (#3585)
• Fixed Invalid value for $current: null when SQL command is executed (#3583, #3584)
• Fixed CONTAINSANY with method call on left-hand side (regression) (#3581, #3582)
• Fixed SQLScript with LET/RETURN throwing QueryNotIdempotentException (#3664, #3666)
• Fixed Class Cast Exception in SQL queries
• Optimized graph filtering (SQL only)

OpenCypher Engine

• Fixed WHERE predicates referencing UNWIND variables not being pushed down into MatchNodeStep
• Fixed UNWIND $batch MATCH ... CREATE edge failing unless WHERE clause is used explicitly (#3612)
• Dramatically optimized Cypher edge creation performance
• Optimized Cypher aggregation
• Implemented queryNodes Cypher function

Wire Protocols

• Bolt: Fixed parameterized queries failing to substitute in WHERE clauses (#3650, #3651)
• gRPC: Fixed query and streaming query ignoring the language parameter (always using SQL) (#3588, #3589)
• Gremlin: Fixed default graph database creation on Gremlin plugin start; scaled concurrent test threads to available processors

Core Engine

• Fixed ConcurrentModificationException regression in schema.getTypes() (#3590)
• Fixed concurrency over multi-page record update
• Fixed concurrency over schema files
• Fixed transaction commit failing when indexes are dropped mid-transaction (#3673)
• Fixed error during index compaction (#3615)
• Fixed old concurrency issue hard to reproduce with high concurrency
• Fixed duplicate types returned from schema

Vector Index

• Fixed async graph build not re-triggered for embeddings added during an ongoing build (#3683, #3684)
• Fixed performance regression on huge vector indexes (190k+) where adding one vector made next vectorNeighbors call extremely slow (#3679)
• Fixed LSM vector rebuild strategy
• Fixed JVector COSINE score calculation

Server & HTTP

• Fixed HTTP 413 response with JSON error body when request body exceeds size limit
• Fixed Undertow throwing away oversized requests with no message

Graph Algorithms

• Fixed PageRank bug with direction
• Fixed graph algorithm inversion

Other

• Fixed runtime warnings with Java 25 (#3486)
• Improved Studio rendering with label sizing, colored edges by type, and updated logo
• Added GOVERNANCE.md

Performance Improvements

This release includes significant performance work focused on graph traversal and analytics:

• OLTP graph traversal optimizations for Cypher
• Optimized graph algorithms to avoid loading full vertices when not necessary
• Optimized iteration on GAV when available
• Hash join improvements for Cypher
• Count push-down to avoid materializing millions of records
• Single-pass per-source inequality + BFS count propagation on CSR path
• Optimized edge insertion speed

Upgraded Major Dependencies

• Apache Tinkerpop Gremlin 3.7.5 → 3.8.0 (#3667)
• Neo4j Java Driver 5.28.10 → 6.0.3
• Apache Groovy 4.0.28 → 5.0.4
• JVector 4.0.0-rc.7 → 4.0.0-rc.8

Additionally, 30+ minor dependency updates were applied including security patches for studio, e2e test, CI/CD, and pre-commit tooling.

New Contributors

• @lekmaneb made their first contribution in #3584

Full Changelog

Full Changelog: 26.3.1...26.3.2

Closed Issues: 21 issues resolved — see milestone 26.3.2 for details

ArcadeDB 26.3.1 Release Notes

We're excited to announce ArcadeDB 26.3.1, a feature-packed release with 190+ commits and 52 closed issues that brings major new capabilities including a completely redesigned Studio with an AI assistant, built-in MCP server support, geospatial indexing, a new TimeSeries data model, materialized views, hash indexes, 72 built-in graph algorithms, parallel query execution, and significant improvements across the board.

🎯 Major New Features

Completely Redesigned Studio with AI Assistant

The ArcadeDB Studio has been completely rewritten from scratch (#3485, #3509), delivering a modern, more powerful administration interface:

• New homepage and login experience
• Code completion for ArcadeDB SQL and OpenCypher in the query editor (#3508)
• Server profiler with FlameGraph visualization (#3528, #3409)
• Dedicated pages for buckets, indexes, and dictionary management
• New metric pages for both server and database monitoring (req/min charts, CRUD + Tx operations, concurrent modification tracking)
• Improved graph rendering with element customization
• User & Group management panel with centralized security controls
• Materialized views display under query results
• AI Assistant panel (Beta) (#3574) — integrated ArcadeDB AI assistant with two modes of execution, AI-powered profiler analysis, and agentic capabilities to help with queries and database management

MCP Server (Model Context Protocol)

ArcadeDB now includes a built-in MCP server (#3481, #3460), enabling AI assistants and LLM-based tools to interact with ArcadeDB directly. This release also introduces API Key authentication for programmatic access, manageable through the new Studio security panel.

Geospatial Indexing

New native geospatial indexing with geo.* SQL functions (#3510, #3513), powered by LSM-Tree native storage. Enables efficient spatial queries and proximity searches directly within ArcadeDB without external dependencies.

TimeSeries Data Model

Introduced the TimeSeries data model (#3511, #3488), adding native time-series support to ArcadeDB's multi-model capabilities. This enables efficient storage and querying of time-ordered data alongside graphs, documents, and other models in the same database. Main features:

• Columnar storage with Gorilla (float), Delta-of-Delta (timestamp), Simple-8b (integer), and Dictionary (tag) compression
• Shard-per-core parallelism with lock-free writes
• Block-level aggregation statistics for zero-decompression fast-path queries
• InfluxDB Line Protocol ingestion for compatibility with Telegraf, Grafana Agent, and hundreds of collection agents
• Prometheus remote_write / remote_read protocol for drop-in Prometheus backend usage
• PromQL query language - native parser and evaluator with HTTP-compatible API endpoints
• SQL analytical functions - ts.timeBucket, ts.rate, ts.percentile, ts.interpolate, window functions, and more
• Continuous aggregates with watermark-based incremental refresh
• Retention policies and downsampling tiers for automatic data lifecycle
• Grafana integration via DataFrame-compatible endpoints (works with the Infinity datasource plugin)
• Studio TimeSeries Explorer with query, schema inspection, ingestion docs, and PromQL tabs

Materialized Views

Added support for materialized views (#3464, #3463), allowing pre-computed query results to be stored and automatically maintained. Materialized views are fully integrated into Studio for easy management and monitoring.

Hash Index (Extendible Hashing)

New hash index type using extendible hashing algorithm (#3527), providing faster exact-match lookups when range queries are not needed. The hash index is a more efficient alternative to the LSM-Tree index for equality-only access patterns. Studio has been updated to support the new index type.

73 Built-in Graph Algorithms

Implemented a comprehensive set of popular graph algorithms (#3515), making advanced graph analytics available out of the box without external libraries. Multiple batches of algorithms were added covering common use cases like centrality, community detection, pathfinding, and more.

• Pathfinding: Shortest Path, Dijkstra, A*, Bellman-Ford, Duan SSSP, K-Shortest Paths (Yen's), All Simple Paths, All-Pairs Shortest Paths (Floyd-Warshall), Single-Source Dijkstra, Longest Path (DAG), All Shortest
  Paths
• Traversal: Breadth-First Search (BFS), Depth-First Search (DFS)
• Centrality: PageRank, Personalized PageRank, ArticleRank, Betweenness Centrality (Brandes), Closeness Centrality, Harmonic Centrality, Eigenvector Centrality, Degree Centrality, Katz Centrality, HITS (Hub/Authority), Eccentricity
• Community Detection: Weakly Connected Components (Union-Find), Strongly Connected Components (Kosaraju), Louvain, Leiden, Label Propagation, Speaker-Listener Label Propagation (SLPA), Hierarchical Clustering
• Graph Structure / Topology: Triangle Count, Local Clustering Coefficient, Articulation Points (Tarjan), Bridges (Tarjan), Biconnected Components, Topological Sort (Kahn), Cycle Detection, K-Core Decomposition, K-Truss Decomposition, Maximal Cliques (Bron-Kerbosch), Graph Summary, Assortativity, Conductance, Modularity Score, Rich-Club Coefficient, Bipartite Check, Graph Coloring, Densest Subgraph (Charikar), Maximum, Flow (Edmonds-Karp), Max K-Cut, Minimum Spanning Tree (Kruskal), Minimum Spanning Arborescence (Chu-Liu/Edmonds), Steiner Tree
• Link Prediction: Adamic-Adar, Jaccard Similarity, Common Neighbors, Resource Allocation, Preferential Attachment, Same Community, Total Neighbors, SimRank
• Graph Embeddings / ML: Node2Vec, FastRP, HashGNN, GraphSAGE
• Other: VoteRank, Influence Maximization (Independent Cascade), Random Walk, K-Nearest Neighbors
• Path Expansion (APOC-style): Path Expand, Path Expand Config, Spanning Tree, Subgraph All, Subgraph Nodes

Parallel Query Execution

Introduced parallel query support (#1339) for SQL, enabling queries to leverage multiple CPU cores for faster execution on large datasets. Includes safety guards to avoid deadlocks in concurrent scenarios.

OpenCypher User Management & Constraints

• User management: Supported CREATE USER, DROP USER, and related Cypher commands (#3461)
• Constraints: Supported OpenCypher constraint syntax (#3459)

🔧 Bug Fixes & Improvements

SQL Engine

• Fixed IN (SELECT ...) returning wrong results when field has an index (#3565, #3566)
• Fixed SQL optimization failure on arithmetic expressions
• Fixed LET in sub-queries
• Fixed CONTAINSTEXT with FULL_TEXT BY ITEM and compound filters (#3483, #3484)
• Fixed include and exclude operators (#3480)
• Fixed index usage with min/max functions
• Fixed CREATE EDGE with empty array destinations (#3518)
• Fixed System as reserved keyword in ANTLR parser
• Planner now prefers full-text index when CONTAINSTEXT is used
• Fixed accessing internal properties in maps (#3571)
• Fixed pushed-down filtering in both SQL and Cypher engines
• Prevented incorrect filter pushdown for WHERE predicates with nested variable references (#3534)
• Improved native select() API with new methods (#3535)

OpenCypher Engine

• Fixed filter on queries not working in some cases (#3563)
• Fixed inline property filters on target nodes in MATCH relationship patterns being silently ignored
• Fixed usage of parameters (#3556, #3476)
• COUNT on non-existing label now correctly returns 0 instead of error (#3479)
• Fixed result property ordering (#3475)
• Fixed CASE sub-clause handling (#3468)
• Profiled new OpenCypher commands for security

Wire Protocols

• Bolt: Fixed parameterized queries failing to match in MATCH property maps (#3560)
• Bolt: Fixed connection to Neo4j Desktop 1.6.0+ (#3471)
• gRPC: Fixed transactionId not included in CRUD reques...