ArcadeDB 26.7.3

Overview

This is a focused hotfix on top of 26.7.2. It closes three security advisories from the internal audit - two in the MCP server transport and one in the JavaScript/Java trigger authorization gate - and repairs a data-loss regression in the 26.7.2 commutative super-node edge-append merge.

Upgrading from 26.7.2 is recommended, especially for deployments that expose the MCP server, run in server / multi-tenant mode, or store high-degree (super-node) graphs.

There are no breaking changes and no schema migration in this release.

Security Advisories

All three advisories were found in the same internal audit that produced the 26.7.2 fixes; they are MCP-transport and trigger issues that were not covered there.

• MCP command transport disabled all engine permission checks (GHSA-6x73-v3rc-f57c). The MCP transport never bound the authenticated principal onto the request thread's DatabaseContext, so the engine permission gates (which are deliberate no-ops when no user is bound) silently passed for every MCP caller. A non-root, MCP-allowed reader could perform arbitrary writes, DDL and schema/security mutation; the query + js sub-case could execute arbitrary in-JVM JavaScript. The principal is now bound at the single DB-resolution chokepoint and cleared on the pooled worker thread, so the engine per-user gates enforce for MCP exactly as for the HTTP, Bolt, PostgreSQL and gRPC transports.
• MCP get_server_settings leaked the HA clusterToken in cleartext (GHSA-p9wc-4fhr-78wm). The MCP get_server_settings tool masked only settings whose key contained "password", so arcadedb.ha.clusterToken was returned raw. That token is the trust anchor for cluster-forwarded authentication, so leaking it enables full root impersonation. This is the MCP sibling of the 26.7.2 fix (GHSA-46hj-24h4-j8gf); the tool now redacts value and default via GlobalConfiguration.isHidden(), matching GetServerHandler.
• JavaScript / Java triggers could escalate a schema admin to server-wide admin (GHSA-38pf-6hp2-pxww). A JAVASCRIPT trigger binds the real database object into a GraalVM context, so its script could call database.getSecurity().createUser(...) and escalate an UPDATE_SCHEMA (schema-admin) user to a server-wide admin; a JAVA trigger runs an arbitrary loaded class. Creating both host-code trigger types now requires UPDATE_SECURITY at the LocalSchema.createTrigger chokepoint, mirroring the DEFINE FUNCTION ... LANGUAGE js gate (GHSA-vwjc-v7x7-cm6g). Declarative SQL triggers keep UPDATE_SCHEMA, and schema reload of existing triggers is unaffected.

Major Fixes

Graph engine

• Edge-append merge no longer reverts concurrent writes on multi-page edge chunks (#5302). The commutative edge-append merge (GRAPH_EDGE_APPEND_MERGE, introduced in 26.7.2) resolved a commit-time page conflict by re-deriving the conflicted page and replaying the transaction's tracked appends. For an edge chunk stored as a multi-page record (a chunk that straddles a page boundary) this re-derivation was unsound: the rebase re-read the chunk through the transaction's stale in-transaction page copy and committed it, silently reverting concurrently committed appends on the continuation page - zeroed chunk tails, shifted/aliased pairs, lost edges, and BufferUnderflowException on later traversals of the vertex. Only records living entirely in place on the conflicted page are now re-derived; multi-page and indirected (placeholder) chunk records fall back to the standard full-transaction retry. Single-page chunks - the vast majority, including all super-node stripe chunks - keep the merge.

MCP server

• get_schema now builds its schema through a dedicated buildSchema path, and the MCP dispatcher handles a missing resource with a proper MCPResourceNotFoundException instead of a generic failure.

Full Changelog: 26.7.2...26.7.3

ArcadeDB 26.7.2

Overview

This release is a large stability and correctness milestone. It ships the results of a deep engine audit (storage, WAL/recovery, transactions/MVCC, LSM indexes and concurrency), hardens High Availability (Raft) recovery, completes the Neo4j Bolt driver compatibility certification, and fixes a broad set of OpenCypher and SQL query bugs.

It also closes five security advisories from an internal audit (see Security Advisories below); upgrading is strongly recommended for server-mode and multi-tenant deployments.

Two changes require attention before upgrading (see Breaking Changes): Raft storage is now durable by default, and the Bolt protocol now carries native temporal types instead of ISO-8601 strings.

Over 130 issues were closed for this milestone.

Security Advisories

This release closes several security advisories found in an internal audit. Upgrading is strongly recommended for any server-mode or multi-tenant deployment.

• RCE via JavaScript triggers (GHSA-x9f9-r4m8-9xc2). A JavaScript trigger could look up java.lang.* host classes and reach Runtime.getRuntime().exec(...), obtaining OS command execution with only UPDATE_SCHEMA privileges. java.lang.* is removed from the trigger host-class allow-list; only the benign value packages (java.util, java.time, java.math) remain.
• Arbitrary JavaScript execution via DEFINE FUNCTION ... LANGUAGE js (GHSA-vwjc-v7x7-cm6g). The SQL route to JavaScript bypassed the polyglot scripting gate, letting a user with schema (or lesser) access define and run arbitrary JavaScript. Defining a js function now requires UPDATE_SECURITY, and the polyglot engine runs with IOAccess.NONE (closing load(path|url) host-file read and SSRF) and PolyglotAccess.NONE (no cross-language pivot). SQL and Cypher user functions keep the standard schema-level protection.
• Secret disclosure / root impersonation via GET /api/v1/server (GHSA-46hj-24h4-j8gf). The server-settings export masked only keys literally containing "password", leaking arcadedb.ha.clusterToken in clear - which, combined with the cluster-forwarded-auth headers, let a low-privilege authenticated user impersonate root. Every setting flagged isHidden() (clusterToken and all password/secret keys) is now redacted, for both the current and default value.
• Cross-database IDOR on time-series / batch / Prometheus / Grafana endpoints (GHSA-x8mg-6r4p-87pf). Fourteen handlers extended the base HTTP handler directly and resolved the path database with no canAccessToDatabase check, so a user authorized for one database could read and write any other database on the server. All affected handlers now enforce database authorization (HTTP 403) before any payload handling and fail closed on a missing database name; the batch handler checks before leader-forwarding.
• Read-only identity could mutate persisted schema (GHSA-8vr5-263f-x5r3). Several schema/config mutators reachable from a remote command were missing the UPDATE_SCHEMA guard: ALTER TYPE ... CUSTOM / BUCKETSELECTIONSTRATEGY, ALTER MATERIALIZED VIEW ... REFRESH, DROP MATERIALIZED VIEW / DROP CONTINUOUS AGGREGATE, ALTER TIMESERIES TYPE ... DOWNSAMPLING POLICY, DEFINE FUNCTION, and the stats-only REBUILD INDEX path. All are now gated (database-settings mutators use UPDATE_DATABASE_SETTINGS); every guard is a no-op for embedded, schema-load and HA-replication paths.

Major Highlights

Engine deep-audit 2026-07 (storage, transactions, LSM, concurrency)

A multi-area audit (#4962) hardened the core engine against data-loss and corruption edge cases under crashes, concurrency and load. Notable outcomes:

• The WAL append is now the transaction's point of no return. Page versions are validated and bumped
  before the WAL write, so an aborted transaction can no longer be left in the WAL and partially replayed by
  recovery; a post-append failure is resolved by recovery replay and fences the database until reopen
  (#4936, #4937).
• Torn 64KB page writes are repaired on recovery even when the on-disk version header already advanced (#4926); a clean close whose data fsync failed now
  preserves the WAL for recovery instead of deleting it (#4934).
• Page-cache correctness: an older page version can no longer overwrite a newer committed one (lost
  update) and RAM accounting can no longer drift negative and disable eviction (unbounded growth) (#4925, #4933).
• LSM index hardening: compaction no longer loses re-inserted keys or leaks orphaned pages on failure,
  range scans are no longer truncated by tombstoned keys, and non-unique point lookups no longer resurrect
  deleted RIDs (#4942, #4943, #4944, #4945, #4946, #4947).
• Transactions: updating the same indexed record twice in one transaction no longer corrupts the index
  (#4935); dead-thread cleanup now rolls back abandoned
  transactions and releases their file locks, and is correct for virtual threads (#4941, #4956, #4939, #4940).
• Async executor and shutdown: the stall detector no longer false-positives on slow tasks, shutdown no
  longer drops queued tasks or hangs completion waiters, and close()/drop() are now bounded so a wedged
  worker cannot hang shutdown forever (#4953, #4954, #5080, #4991).

Parallel query safety

Parallel bucket scans (enabled by default) could self-deadlock under pool saturation and wedge HTTP workers, race on the shared command context, or pin a CPU core at 100% when a consumer stopped draining. Scan producers now run on a dedicated pool, each worker gets its own context, and the native select().parallel() iterator bounds its producer offer and closes cleanly (#4948, #4949, #4950, #4951, #5065).

High Availability (Raft) recovery

• Durable Raft storage by default removes a class of permanent follower divergence after a full-cluster cold restart (see Breaking Changes, #4835).
• Diverged-follower resync no longer floods the logs and starves the snapshot download it triggers; only the first gap logs loudly (#4741 follow-up).
• The leader now auto-recovers a follower's replication channel wedged on stale DNS after a Kubernetes pod-IP change, instead of dropping to bare quorum until a manual leadership transfer (#4696).
• A distinct contract for "committed cluster-wide, local apply failed"
  (TransactionCommittedRemotelyException, mapped to HTTP 409) so applications no longer retry and create duplicates (#5064, #5017, #5018).
• Offline bootstrap leadership-transfer path now commits its baseline (#5099).

Neo4j Bolt driver compatibility certification

The Bolt epic (#4882) reached certification: a shared conformance spec, per-language driver e2e suites (Java, Python, JS, Go, C#) CI-gated with a nightly run, and broad type-fidelity work. Highlights: native temporal PackStream structs in both directions (see Breaking Changes), native Path/Duration/Point structures, retryable-conflict mapping so drivers auto-retry, HA-aware ROUTE responses, Bolt 5.x negotiation and populated write-result counters (#4883-#4892, #4905, #4907, [#4908(https://github.com//issues/4908), #4922,
#4997-#5002, [#5082](https://gi...

ArcadeDB 26.7.1 Release Notes

Overview

ArcadeDB 26.7.1 is a large stability, resilience and security release with over 420 commits, 238 resolved issues and 32 merged pull requests. The headline theme is a deep High Availability / Raft hardening wave that makes clustered deployments far more robust under leader churn, node restarts, snapshot transfers and Kubernetes scale events. On top of that come a security hardening pass (polyglot scripting lockdown, gRPC and cluster-management authorization, DoS bounding), a new OpenTelemetry distributed-tracing module plus structured JSON logging, native BM25 full-text scoring, continued ISO GQL compliance and vector engine work, and a long list of gRPC, MongoDB wire-protocol, SQL, OpenCypher, time-series and Studio fixes.

New Features

• OpenTelemetry distributed tracing - an optional module for end-to-end request tracing, with opt-in OTLP export. (#4467, #4465)
• Structured JSON logging with per-request correlation IDs. (#4466)
• Native BM25 full-text scoring - field boosts, caret syntax and EXPLAIN / PROFILE support. (#4687)
• ISO GQL compliance - strict numeric types (schema round-trip), session management (SESSION SET / RESET / CLOSE) and transaction control (START TRANSACTION / COMMIT / ROLLBACK). (#4141)
• New vector formats and helpers - MATLAB / MATLAB_COLUMN, JULIA and NUMPY formats, asVector(), asSparse(), RRF array input and vectorDequantizeBinary. (#3099)
• MongoDB wire protocol - update, delete and createIndexes commands plus SASL PLAIN authentication. (#4750, #4751, #4746)
• HA auto-acquire of unseen databases - a joining node bootstraps databases it has never seen. (#4727)
• Kubernetes health probes - liveness/readiness/startup endpoints for orchestrated deployments. (#4464)
• Paginated remote fetching of edges and vertices across the remote API.
• Studio - cluster HA alerts and Restore / Delete row actions on the backup list. (#4737)

Major Highlights

High Availability & Raft resilience

The bulk of this release goes into making the Raft-based HA cluster survive real-world failure modes without data loss or node self-halt:

• No more node-wide halt on apply errors. Apply-time failures are now quarantined per-database instead of taking the whole node down, transient NeedRetryExceptions are retried in Raft apply, and unexpected throwables no longer kill the process. (#4797, #4659)
• Divergence self-recovery. A follower stuck on a divergent Raft log now performs follower-side reformat-and-rejoin instead of spinning on INCONSISTENCY, and a WAL-version-gap / phase-2 commit failure no longer causes a node to self-halt. (#4741, #4740)
• Snapshot integrity. Snapshot extraction, markers and the final swap are now fsynced before the backup is deleted, transfer completeness is verified with a manifest, takeSnapshot() persists a real snapshot marker so a log purge can no longer orphan applied state, and the database-registry lock is held across snapshot close -> swap -> reopen. (#4830, #4831, #4829, #4832)
• Membership & quorum safety. Raft membership now uses atomic deltas instead of last-write-wins setConfiguration, removePeer / leaveCluster are guarded against dropping below quorum, and stepDown selects the highest-priority non-lagging peer while skipping priority-0 witnesses. (#4795, #4796, #4808)
• Per-database applied-index tracking, so mixed-database clusters track progress correctly. (#4824)
• Silent write loss eliminated when replication times out after dispatch: the leader no longer acknowledges a write it failed to replicate. (#4790)
• Accurate lag diagnosis. New heartbeat-lag metrics, byte-bounded replication backpressure, resync logging (leader flood suppression + follower resync visibility), and a slow-but-progressing follower is now treated as catching up rather than stale. ClusterMonitor per-replica lag state is reset on each new leadership term to prevent false STALLED reports. (#4812, #4810, #4840, #4841)
• Auto-acquire of unseen databases so a joining node bootstraps databases it has never seen, with a single deterministic bootstrap source instead of abandoning databases on first transfer. (#4727, #4807)

Kubernetes operations

• StatefulSet scale-up beyond HA_SERVER_LIST no longer crash-loops: a local Raft peer is synthesized and auto-joins when the pod ordinal exceeds the static list. (#4836)
• Raft storage is persisted by default under Kubernetes, so a pod restart no longer wipes the PVC-backed Raft log. (#4835)
• Kubernetes health/liveness/readiness probes and a graceful cluster-leave path owned solely by RaftHAServer.stop(). (#4464, #4837)

Security hardening

• Polyglot scripting now requires admin privileges and the GraalVM sandbox has been hardened (reflection deny-list), closing an advisory (GHSA-48qw-824m-86pr) where a reader-role user could read host files via JavaScript on /api/v1/command.
• gRPC authorization is enforced centrally instead of being blanket-skipped: getDatabase rejects path-traversal names and enforces auth, admin operations require admin auth, and cross-database access is covered by regression tests. (#4793, #4792, #4794)
• Cluster-management HTTP endpoints now require root. (#4791)
• DoS bounding on gRPC: result materialization and worker busy-wait are bounded, abandoned gRPC transactions are reaped to stop an executor/transaction leak, and in-band command failures are correctly counted as errors. (#4803, #4802, #4804)
• Hardened FileUtils path-traversal guard.

Observability

• Optional OpenTelemetry distributed-tracing module for end-to-end request tracing. (#4467)
• Structured JSON logging with per-request correlation IDs. (#4466)
• Metrics depth (Pillar 1): RED timers, engine gauges and opt-in OTLP export, plus gRPC metrics published into the shared server registry with method/status tags and executor-pool gauges. (#4465, #4826)

Native BM25 full-text scoring

Full-text search gains native BM25 scoring with field boosts, caret syntax and EXPLAIN / PROFILE support, along with fixes so SEARCH_INDEX no longer leaks internal posting-RID strings into @rid, multi-property and rebuilt FULL_TEXT indexes no longer crash, and multi-dot SEARCH_INDEX queries are parsed correctly. (#4687, #4731, #4732, #4733, #4734)

ISO GQL compliance

Continued work toward the ISO GQL standard (#4141): strict numeric types on the write side (schema round-trip), session management (SESSION SET / RESET / CLOSE) and transaction control (START TRANSACTION / COMMIT / ROLLBACK).

Vector engine (Epic #3099)

• Quantization ergonomics, asSparse(), asVector() (inverse of asString), RRF array input and vectorDequantizeBinary.
• New MATLAB / MATLAB_COLUMN, JULIA and NUMPY vector formats.
• Correctness fixes across the vector SQL functions, consistent cosineSimilarity on zero vectors, and a consistent ordinalToVectorId snapshot during brute-force scans. (#4583, #4581)

MongoDB wire protocol

The mongodbw plugin now supports update, delete and createIndexes commands, adds SASL PLAIN authentication, and returns correct data on find. (#4750, #4751, #4746, #4745)

Major Fixes

gRPC

• InsertStream is stopped after a mid-stream commit failure (and the error is no longer mis-indexed), the transaction is no longer begun/committed on different pool threads, and CONFLICT_UPDATE upsert now merges non-key columns. (#4806, #4656)
• Streaming terminal calls are serialized on a thread-safe StreamObserver. (#4801)
• DATETIME_MICROS / DATETIME_NANOS precision is preserved on the write path, null-valued projected columns survive ExecuteQuery, and the configured compression codec is honored. (#4805, #4692, #4827)
• Time-series INSERT over gRPC no longer throws on empty @type / @rid. (#4688)

High Availability (additional)

• TRUNCATE TYPE / TRUNCATE BUCKET are now HA-safe, using small batches and failing loud instead of silently truncating incompletely. (#4817)
• Follower match/next indices are correlated by peer-id stability rather than array position, fixing mis-zipped follower states. (#4842)
• The Raft gRPC allowlist fails open only up to quorum, not the full peer set, and the state machine is rewired to RaftHAServer on a HealthMonitor-driven Ratis restart. (#4828, #4839)
• AppendEntries element limit is configurable (default 64), RATIS-2523 matchIndex rewind is atomic and fail-loud, and a replica stuck STALLED at matchIndex=-1 auto-recovers. (#4752, #4833, #4728)
• LINEARIZABLE follower reads no longer serve stale state, and read-only statements honor the requested read consistency.
• Snapshot write watchdog now detects stalls rather than total elapsed time, proactive peer allowlist refresh + hardened DNS caching, and GraphBatch bulk load survives a transient leader re-election. (#4729, #4696, #4724)

SQL

• UPDATE SET map = map.remove(key) now persists map/collection key removal. (#4730)
• SELECT FROM <non-existent RID> returns an empty result set instead of HTTP 500.
• Planner prefers a full-key index over a partial-key scan on a longer composite index. (#4600)
• IN / NOT IN three-valued logic for NULL operands, GROUP BY on mixed-type numeric keys no longer splits equal groups, and min() / max() over mixed numeric collections no longer throws ClassCastException. (#4591, #4592)
• DISTINCT result can be used as a function argument / method base, backticks are stripped from quoted projection aliases, and algo.allSimplePaths supports skipVertexTypes. (#4691)
• Assorted math/collection function fixes: SplitFunction on null delimiter, AbstractMathFunction.asDouble(null), TailFunction sublist view, date.convert ...

ArcadeDB 26.6.1 Release Notes

Overview

ArcadeDB 26.6.1 is a stability, durability and security hardening release with over 280 commits and 66 resolved issues. The headline news is end-to-end TLS/SSL for the HA cluster, a deep wave of durability and crash-recovery hardening across the WAL, page and serialization layers, and a broad security hardening pass (schema authorization, IMPORT DATABASE source validation, injection fixes and a full CodeQL cleanup). On top of that comes a long list of High Availability / Raft, OpenCypher, SQL, vector index and wire-protocol fixes, plus Studio and operational improvements.

Major Highlights

TLS/SSL Across the HA Cluster

The Raft-based HA cluster can now run fully encrypted. Inter-node replication traffic supports SSL/TLS, and the snapshot installer was fixed so a follower can download a leader snapshot over the HTTPS listener instead of crashing with Unsupported or unrecognized SSL message. (#4470)

Durability & Crash-Recovery Hardening

A large batch of fixes closes data-integrity gaps in the storage, WAL and serialization layers so committed transactions survive crashes and power loss, and recovery never silently drops data:

• WAL is now fsynced on commit by default, and data files are fsynced before WAL files are deleted on clean close. (#4330, #4332)
• Crash recovery now aborts on a WAL version gap and preserves the WAL files instead of silently skipping the gap. (#4331, #4320)
• MutablePage.move no longer mis-tracks the modified range on backward shifts, so defrag bytes are no longer omitted from the WAL. (#4319)
• Binary serialization fixes: property count now matches the bytes written, and partial reads are handled via readFully. (#4328, #4329)
• Short-write / short-read returns are now respected in PaginatedComponentFile. (#4321)
• LZ4 compression no longer corrupts data when Binary.position() > 0. (#4317)
• Simple-8b codec validation no longer silently truncates Long.MAX_VALUE / Long.MIN_VALUE. (#4336)
• migratedFileIds is now persisted in schema.json, so compaction no longer silently drops in-flight transactions across restart. (#4333)
• java.lang.NegativeArraySizeException on transaction commit fixed. (#4420)

Security Hardening

• All LocalDocumentType / LocalProperty schema mutators now require the UPDATE_SCHEMA permission (previously only createProperty was gated). (#4423)
• IMPORT DATABASE now validates its source and requires admin privilege, closing SSRF / LFI vectors. (#4422)
• SQL injection fixed in RemoteVertex.newEdge by switching to parameter binding (also fixes breakage on apostrophes). (#4327)
• JavaScript injection in the polyglot engine closed by replacing the "looks-like-JSON" source-concatenation heuristic with Value.execute(). (#4326)
• Full CodeQL cleanup: open Java and JavaScript code-scanning alerts resolved at their true sources (workflow permissions, ReDoS, path-injection). (#4383, #4386, #4388)

Major Fixes

High Availability & Clustering

• TimeSeries data now replicates correctly across an HA cluster, and a compaction/append deadlock that caused a WAL version gap on Raft followers was eliminated. (#4414, #4458)
• Concurrent single-row time-series INSERTs no longer silently lose samples (sealed-slot lost update). (#4453)
• Bolt writes to a follower no longer fail with "no authenticated user in the current security context"; the authenticated user is now bound on DatabaseContext in the Bolt executor. (#4456)
• PeerAddressAllowlistFilter no longer rejects legitimate peers during a Kubernetes DNS-resolution race (incomplete allowlist on startup/restart). (#4471)
• Stale-follower recovery is fixed when a snapshot download fails on a quiet cluster.
• New configurable paths: arcadedb.ha.raftStorageDirectory for the Raft storage directory (#4446), configurable server log directory for read-only root filesystems (#4451), and arcadedb.ha.clusterTokenPath to read the cluster shared secret from a file (#4431).
• RemoteDatabase no longer reuses a session id across servers on HA failover during an open transaction; a TransactionException is now raised on server switch. (#4373)
• RemoteHttpComponent no longer mutates leaderServer / currentServer non-atomically during retries. (#4372)
• New STICKY strategy pins HTTP transactions to a concrete cluster member. (#4273)
• getReplicaAddresses now excludes the local peer instead of the leader. (#4274)
• /api/v1/server?mode=cluster returns the ha section again after the Raft migration. (#4261)
• New "Force Resync" button in Studio to recover a diverged follower from the leader.
• HA bootstrap-fingerprint replay race fixed, and HA node aliases corrected. (#4259)
• Massive-insertion cluster configuration issues resolved, plus assorted HA log improvements.

Concurrency & Async

• FileManager no longer mutates its ArrayList<ComponentFile> from multiple threads without synchronization (fixes CME / AIOOBE). (#4371)
• LockManager.tryLock now re-attempts putIfAbsent after a wait timeout and tracks the remaining timeout per await. (#4367)
• DatabaseAsyncTransaction now rolls back before retrying after a ConcurrentModificationException, invokes the per-task onErrorCallback, and no longer swallows final-retry failures or contaminates the shared transaction. (#4368, #4369, #4370)
• PageManager.putPageInReadCache no longer leaks RAM accounting when replacing an existing CachedPage. (#4390)

OpenCypher

• CREATE INDEX now implicitly creates the referenced property (Neo4j-style lazy schema). (#4354)
• nodes(), relationships() and length() on variable-length path patterns (e.g. [*1..3]) are now implemented. (#4353)
• Records written via SQL are now visible to subsequent Cypher queries (and vice versa) within the same connection/transaction. (#4355)
• EXPLAIN no longer fails with an idempotency error on a multi-statement query containing CREATE. (#4366)
• Label disjunction (n:A|B) no longer returns 0 rows. (#4221)
• allShortestPaths() now returns all co-shortest paths instead of just one.
• MERGE now uses a bound anchor as the traversal start instead of a full edge-type scan (performance), and no longer crashes on a single-quote property value with UNWIND or rebinds the variable from an OPTIONAL MATCH null endpoint. (#4213, #4210)
• DATETIME property comparison with datetime() no longer returns 0 rows. (#4231)
• Redundant AND true / OR false branches are now simplified in WHERE clauses. (#4405)
• MATCH ... WHERE ID(n) IN $ids now accepts a long[] parameter array.
• Query results are now consistent between parameterized and hard-coded values.

SQL

• IN :param with a collection parameter now returns rows when an index is used. (#4468)
• MOVE VERTEX no longer generates an internal error. (#4461, #4347)
• expand() projection now honors its AS alias instead of always being named value. (#4389)
• IN (SELECT …) no longer always returns empty (InCondition now unwraps single-property results). (#4337)
• MERGE on a UNIQUE-indexed property no longer throws DuplicatedKeyException when the same key appears twice in a batch (Neo4j matches the second occurrence). (#4351)
• node.* and rel.* functions no longer silently return null/0 from SQL. (#4216)
• TimeSeries timestamps are now returned in queries. (#4418)
• New cypherRID(<cypher-rid>) SQL function and asCypherRID() method for interoperating with Cypher numeric ids.
• ResultInternal.getProperty no longer re-surfaces removed properties via element fall-through. (#4398)
• EdgeLinkedList.removeVertex / removeEdge now iterate all segments to remove every matching entry. (#4395)
• MultiIterator.countEntries no longer discards the count for non-resettable iterables. (#4396)
• MATCHES now keys its regex Pattern cache by the regex string rather than hashCode() (collision no longer returns the wrong pattern). (#4397)
• Case conversions across the function library now use Locale.ROOT. (#4393)
• RangeFunction and the math functions are now guarded against long-range overflow / infinite loops. (#4391, #4392)
• CREATE INDEX ON ... (...) without an index type now raises a clear parsing error instead of an NPE.
• Inserting edges between existing nodes with mandatory properties now works. (#4413)
• Multiple-inheritance handling fixed, and point() over a latitude property surfaced as a string no longer throws a ClassCastException.
• SEARCH_INDEX() negative Lucene clauses now return correct results. (#4220)

Vector & Index

• TRUNCATE TYPE no longer resets an LSM_VECTOR index dimension to 0, nor leaves UNIQUE indexes in an inconsistent state requiring DROP TYPE. (#4359, #4352)
• LSMVectorIndex now converts JVector's EUCLIDEAN return to L2² distance in all search paths, so K-NN no longer returns the worst matches first. (#4334)
• LSMVectorIndexCompactor now handles the old-format tombstone rewind correctly. (#4335)
• NPE in discoverAndLoadCompactedSubIndex that prevented loading compacted vector sub-indexes at startup fixed.
• LSM_VECTOR inactivity rebuild timer is now re-armed after a skip. (#4272)
• REBUILD INDEX now works for BY ITEM indexes. (#4448)
• vector.fuse() is now recognised as a SQL function (no more "Unknown method name: fuse").

Wire Protocols

• Bolt: parameterized Cypher MATCH queries via the JavaScript neo4j-driver now work (#4452); integer property values are no longer coerced to strings after CREATE INDEX, and index-backed lookups return rows.
• PostgreSQL: scalar columns are now advertised with native OIDs. (#4202)
• gRPC: correct exceptions are now thrown (NOT_FOUND for RecordNotFoundException on lookupByRid) (#4364); LocalDateTime / LocalDate and ISO-string fallback handled i...

ArcadeDB 26.5.1 Release Notes

Overview

ArcadeDB 26.5.1 is a major release with over 270 commits and 128 resolved issues. The headline news is the new sparse vector index with server-side hybrid retrieval and INT8 quantization end-to-end, a huge wave of OpenCypher correctness fixes, query partitioning, a new EXTERNAL property storage layout for heavy values, plus a long list of HA, wire-protocol, and Studio improvements.

Major Highlights

Sparse Vector Index + Hybrid Retrieval

A brand-new LSM_SPARSE_VECTOR index brings sparse-embedding retrieval (BM25/SPLADE-style) directly into the engine, with server-side fusion of dense and sparse results and diversified top-K. (#4065, #4066, #4067, #4068, #4070, #4078, #4119, #4130)

• New index type LSM_SPARSE_VECTOR for sparse-embedding retrieval.
• vector.fuse(...) server-side hybrid fusion with RRF, DBSF and LINEAR strategies.
• vector.neighbors(...) gains groupBy / groupSize options for diversified retrieval, including dotted nested-field grouping (#4072) and traversal-integrated grouping (#4071).
• WAND / BlockMax-WAND dynamic pruning to scale sparse retrieval to 100M+ documents.
• Sparse-vector partitioning so a single index can be sharded by tenant / domain.
• Reranker SQL functions for two-stage retrieval pipelines.
• Bolt and HTTP wire support for the new sparse vector type, including $bytes / $int8 markers for INT8 query vectors.

INT8 Quantization for Dense Vectors

End-to-end INT8 support across the dense vector pipeline: ingest, storage and query path now share the same 8-bit representation, dramatically reducing disk and RSS without going through the FP32 path. (#3143, #4132, #4133, #4135, #4136)

EXTERNAL Property Storage

New paired-bucket layout for heavy property values (vectors, large strings, JSON). Hot row data stays compact in the main bucket while bulky payloads live in a sibling external bucket, sharply reducing scan cost on wide records. (#4027, #4028)

Query Partitioning

Query-level partitioning lands together with a partition-aware planner that prunes pruned partitions from SQL and Cypher plans, plus integrity guardrails for partitioned types. (#4087, #4088)

HA: Offline Cluster Bootstrap

You can now bootstrap a fresh HA cluster from a pre-seeded database (snapshot-and-restore), avoiding a full re-replication of large datasets when expanding or rebuilding a cluster. Includes regression integration tests for the cluster-formation edge cases. (#4147, #4205)

Production-Ready Helm Chart

The Helm chart has been reworked to align with the Raft-based HA subsystem introduced in 26.4.2 and is now suitable for production rollouts. (#4035)

Cypher: SHOW INDEXES / SHOW CONSTRAINTS

Standard Cypher administrative commands SHOW INDEXES and SHOW CONSTRAINTS are now supported. (#3972)

SQL: FIND REFERENCES

Restores the OrientDB-compatible FIND REFERENCES command for locating all records pointing to a given RID. (#4146)

C# End-to-End Tests

A new e2e suite exercises ArcadeDB over the Postgres wire via Npgsql and Testcontainers, validating the C# client path on every build. (#4036, #4038)

HA Operational Improvements

• Optional human-readable peer names in HA_SERVER_LIST for friendlier cluster topology. (#3974)
• Studio gains peer add/remove controls in the HA cluster panel. (#4145)

Studio Improvements

• Full-screen mode for graph view. (#4032)
• Clear query button / textbox. (#4121)
• Session reset on token expire instead of silent failure. (#4082)
• Error messages now persist instead of disappearing after a few seconds. (#4124)
• Query history no longer auto-submits on selection. (#4022)
• Inherited indexes are now visible. (#4140)

Major Fixes

OpenCypher Correctness

A large batch of correctness fixes landed across pattern matching, write clauses, subqueries, list/temporal expressions and the optimizer fast-path. Highlights:

• valueType(...) now reports the NOT NULL suffix for non-null values. (#3991)
• point(...) WGS-84-3D exposes .height as an alias for .z. (#3992)
• CALL ... YIELD no longer nullifies variables carried in from WITH. (#3996, #4094)
• collect(r) followed by a variable-length match no longer drops all rows. (#3997)
• Variable-length pattern segments no longer re-traverse a relationship bound in a prior MATCH. (#4006)
• MERGE with an unbound label-only endpoint now creates a fresh node instead of reusing an existing one. (#3998)
• SET now propagates to all aliases bound to the same node within the same query. (#4000)
• Self-referential property updates and SET :Label are now idempotent across row fanout. (#4016, #4017)
• Temporal component access on date/datetime values no longer returns null. (#4018)
• WITH-carried node variables are no longer nulled out by a later CREATE / MERGE. (#4019)
• allReduce(...) no longer evaluates true cases as false. (#4043)
• Anonymous middle nodes in multi-hop chains now match rows. (#4092)
• Backslashes in string literals and property values are preserved. (#4093)
• Consecutive directed and undirected relationship patterns must not reuse the same edge. (#4095, #4096)
• EXISTS { ... } subqueries returning an outer-variable expression no longer evaluate as false. (#4097)
• List literals containing duration(...) no longer drop rows. (#4099)
• List subscript with an inline aggregate index no longer returns null. (#4100)
• MATCH immediately after CREATE now sees newly created labeled nodes. (#4101)
• MATCH on a null carried variable now correctly filters out the row. (#4102)
• MERGE ... ON MATCH SET no longer returns the pre-update property value. (#4103)
• MERGE patterns no longer reuse a newly created endpoint across input rows. (#4104)
• Node label-union patterns now match when either label exists. (#4105)
• Pattern comprehensions over existing relationships are no longer empty. (#4106)
• reduce(...) over an inline aggregate expression is now evaluated correctly. (#4107)
• Relationship type predicates on bound relationship variables no longer evaluate as false. (#4108)
• Repeated relationship variables in WHERE patterns now match no rows (as expected). (#4109)
• Uncorrelated pattern predicates now correctly reflect existing relationships. (#4110)
• Variable-length pattern comprehensions no longer duplicate projected elements. (#4111)
• WHERE false literal predicates are no longer ignored. (#4112)
• datetime() values are now persisted on DATETIME-typed properties. (#4125)
• OR EXISTS + AND NOT (EXISTS ... OR EXISTS ...) returns the correct rows under two-outer-MATCH binding. (#4126)
• Optimizer fast path is now skipped when a write clause precedes MATCH. (#4131)
• CALL subquery SET no longer leaves the carried outer variable stale. (#4182)
• id(...) is now numeric and no longer breaks numeric predicates. (#4183)
• shortestPath / allShortestPaths with variable-length relationship type alternation now match. (#4190)
• Write-only CALL subqueries no longer return an extra empty row. (#4191)
• MATCH on a parent edge type now matches sub-typed edges (polymorphic edge traversal). (#4192)
• Batch fixes for #4184, #4185, #4186, #4188, #4189. (#4196)

SQL

• CONTAINSALL now works when comparing a list of Identifiables against a list of RID strings. (#4002)
• Correlated COLLECT { ... } / COUNT { ... } subqueries with outer-variable access now evaluate correctly instead of always returning empty/zero. (#4014, #4015)
• SEARCH_INDEX and SEARCH_FIELDS now propagate return values in filters and correctly handle wildcards. (#4023, #4030)
• SELECT with a non-unique LSM index no longer returns zero rows after partial deletes (per-RID tombstones no longer suppress the whole key). (#4024)
• Edge creation with CONTENT no longer silently ignores properties. (#4033)
• algo.dijkstra no longer yields a weight of zero. (#4042)
• LIST of STRING in GraphBatch works again. (#4069)
• UPDATE EDGE SET @in/@out correctly rewires the vertex edge lists. (#4074)
• = combined with LIKE on time-series types no longer returns zero results. (#4128)
• Range queries no longer raise a spurious "Non-existent edge type" error. (#4199)
• point.withinBBox(...) now supports cross-meridian bounding boxes. (#3994)

Storage, Indexing and Schema

• HASH index lookups now return rows when data encryption is enabled (keys are kept deterministic). (#4137)
• Orphan TypeIndex wrapper is now dropped when its last bucket child is removed. (#4179)
• Indexes on a subclass are no longer incorrectly related to superclass indexes. (#4120)
• Manual index names are now respected on creation. (#4139)
• Inherited indexes are now shown in Studio. (#4140)

High Availability

• Schema changes now ship to followers, closing a WAL-gap source. (#4077)
• Cluster inconsistency reports after node shutdowns resolved. (#4081)
• Massive inserts over gRPC now replicate correctly. (#4076)
• Correct leader is now reported in the resume table. (#4075)
• ClassCastException (RaftReplicatedDatabase to LocalDatabase) on the leader during import / read-only property writes fixed. (#4144)
• /api/v1/batch no longer fails with "Error on updating dictionary" on follower nodes. (#4039, #4122)
• /batch endpoint no longer returns HTTP 500 NPE after a successful commit. (#4123)
• Spurious index warnings from cluster followers removed. (#4063)
• e2e-ha integration tests stabilized, with on-demand Toxiproxy support. (#4013, #4020)

Wire Protocols

• PostgreSQL: empty SELECT results now include the RowDescription schema (#3971); SHOW server_version returns a proper value for SQLAlchemy (#4116); Cypher WHERE id(n) IN $array round-trips correctly after id() became numeric (#4200); binary array deserializati...

ArcadeDB 26.4.2 Release Notes

Overview

ArcadeDB 26.4.2 is a major release with over 340 commits and 100+ resolved issues. The headline is a brand-new Raft-based High Availability stack built on Apache Ratis, alongside a deep wave of OpenCypher correctness and performance work, expanded wire-protocol security (BOLT + TLS), a new end-to-end Query Profiler, and a long list of SQL, HA, storage, and Studio improvements.

Highlights

Raft-based High Availability using Apache Ratis

ArcadeDB now ships a new HA mode backed by Apache Ratis, bringing a battle-tested Raft consensus implementation to the server. Leader election, log replication, and membership changes are all delegated to Ratis, giving stronger correctness guarantees for replicated writes and simpler operational semantics for clusters running on Kubernetes and bare metal #3730.

End-to-end Query Profiler

The query profiler has been promoted to a first-class feature across every query entrypoint (HTTP, Studio, embedded, drivers). In addition to planner and executor timings, it now also accounts for record deserialization and result serialization, giving a complete picture of where the time goes. Studio surfaces the new serialization cost directly in the results panel #3894.

OpenCypher: major correctness and optimization round

Dozens of OpenCypher issues have been closed in this release. Highlights:

• Filter pushdown for list predicates (any / all / none / single) in WHERE clauses, which dramatically reduces scanned rows on complex predicates - PR #3891, #3888
• Index usage for MATCH WHERE ID(n) = <expr> when the expression is dynamic (was falling back to full scan) - PR #3865
• Aggregation with CASE no longer returns multiple rows from an implicit GROUP BY - #3858
• CREATE CONSTRAINT ... IS TYPED is now supported - #3800
• CREATE INDEX statement is now supported - #3763
• Path Mode (WALK, TRAIL, ACYCLIC) support - #3710
• WITH * + extra AS alias no longer drops the extra items - #3761
• Cypher support removed from the Gremlin module in favor of the native engine - #3811
• Many subquery fixes:
  • EXISTS { MATCH ... } when relationship type embeds a Cypher keyword after underscore - #3952
  • CALL subquery with UNWIND no longer multiplies outer rows - #3944
  • CALL subquery reusing an outer variable name no longer drops rows - #3959
  • CALL + UNION ALL keeps all branches - #3958
  • COLLECT { ... } returns the list instead of null - #3957
  • COUNT { ... } pattern subqueries return the count, not the bound node - #3955, #3956
  • Inline relationship WHERE predicate is now applied - #3951
  • Existential pattern predicate in WHERE correctly filters by target node - #3938
  • Standalone ORDER BY ... LIMIT ... before MATCH preserves the selected row - #3950
• Expression and null handling fixes:
  • tail(null) returns null (not []) - #3920
  • CASE null WHEN null returns not_matched - #3922
  • List / string concatenation || with null returns null - #3921, #3926, #3927, #3928
  • Dynamic label matching with $() - #3923
  • Quantified path pattern ->+ matches 1+ relationships - #3924
  • Variable-length pattern *2..2 no longer includes distance-1 nodes - #3931
  • RETURN ALL raises a syntax error as expected - #3925
  • Fixes from the TCK run: 10 OpenCypher TCK failures from optimizer clause ordering resolved
  • Parameterized queries match correctly in property maps when an edge is present - #3765
  • Label expression predicate with null node returns null - #3935
  • Mandatory MATCH over existing relationships consistent with OPTIONAL MATCH and SQL - #3711
  • Cypher self-join on the same edge type - #3758
  • Stack Overflow workload result divergence from Neo4j - #3759
  • Concatenation of constant string to list with + operator - #3771
  • Subquery with UNION only returning first branch - #3772
  • Types automatically created when creating a constraint - #3760

BOLT + TLS

The Neo4j Bolt wire protocol now supports TLS, and the plugin no longer binds to a random ephemeral port when a port is configured.

• TLS support: #3799
• Port binding fix: #3809
• Parameterized query fix when forwarded through HA - PR #3961

SQL function options map and new function surface

All complex SQL functions now accept a trailing options map as an alternative to long lists of positional optional arguments. This is adopted across:

• Full-text search: #3880 (also adds fulltext.* namespace aliases)
• Graph algorithms: shortestPath, dijkstra, bellmanFord, astar - #3881
• Time-series: movingAvg, timeBucket, interpolate, promql - #3882
• Vector scoring: vectorRRFScore, multiVectorScore, vectorHybridScore - #3883
• Geo / date: geo.buffer, date functions - #3884
• General SQL function support - #3879
• vectorNeighbors accepts a map of optional arguments
• allSimplePaths now supports an exclusion list of edge types (commit 8bd74916d)
• All stateless Cypher functions (e.g. text.jaroWinklerDistance) are now reachable from SQL - #3866

SQL: batch UPDATE / DELETE / TRUNCATE

Bulk mutation workflows are significantly faster thanks to true batch execution for UPDATE, DELETE, and TRUNCATE:

• BATCH support in SQL UPDATE and DELETE - #3806
• Batch delete path in SQL TRUNCATE

Case-insensitive indexes (COLLATE)

SQL indexes can now be declared case-insensitive via COLLATE, enabling indexed lookups on text fields without case normalization at query time. #3726

Production mode safety

When the server is started in SERVER_MODE = production:

• fsync is automatically set to true to protect durability on crash - #3808
• A new startup security checklist surfaces misconfigurations before the server accepts traffic

HTTP: restore database + Studio integration

A new HTTP command allows restoring a database directly over the REST API, with Studio UI support and a progress bar for long-running imports and restores. #3764

The legacy BACKUP DATABASE command now also gives a clear error when handed an http(s):// URL. #3716

RemoteGraphBatch client API

A client-side RemoteGraphBatch batching API with auto-flush targets the server-side /batch endpoint, making high-volume ingestion from remote drivers much easier. #3817

Performance

• Custom collections and maps in hot paths reduce RAM usage and improve iteration throughput - #3965
• TimeSeries: batch writes per shard to reduce transaction overhead - #3862
• Neo4j importer uses the new BatchGraph API, drops more than 80% of RAM with numeric Neo4j ids - #3770
• **Vector...

ArcadeDB 26.3.2 Release Notes

We're excited to announce ArcadeDB 26.3.2, a performance-focused release with 100+ commits and 21 closed issues that introduces the Graph Analytical View (GAV) for OLAP-grade graph analytics, a high-performance bulk edge importer, HTTP batch endpoint, gRPC batch graph loading, GraphQL introspection, MCP stdio transport, and numerous bug fixes and performance improvements across the SQL, OpenCypher, and Gremlin engines.

Major New Features

Graph Analytical View (GAV) — CSR-based OLAP Acceleration

Introduced the Graph Analytical View (#3617, #3618), a CSR (Compressed Sparse Row) based OLAP acceleration layer that dramatically speeds up graph analytics. GAV is automatically used by both the SQL and OpenCypher query planners when beneficial, enabling orders-of-magnitude faster execution of graph algorithms, traversals, and pattern matching on large datasets. Key optimizations include:

• Build-probe hash join for multi-pattern Cypher queries sharing endpoint variables
• Count push-down to graph algorithms, avoiding materialization of millions of records
• Sorted neighbor lists enabling merge-join for triangle counting and similar algorithms
• Anti-join with binary search for target nodes in anchor's sorted neighbor list
• Automatic async rebuild on graph mutations

High-Performance Bulk Edge Creation

New GraphBatchImporter (#3621) for ultra-fast bulk edge creation with parallel writes for both outgoing and incoming edges, parallel sorting, and optimized edge insertion. Includes a new database.batch() API for super-fast batch operations.

HTTP Batch Endpoint

Added a new /batch HTTP endpoint (#3675) for executing multiple operations in a single HTTP request, reducing round-trip overhead for bulk operations.

gRPC GraphBatchLoad RPC

New GraphBatchLoad client-streaming RPC (#3678, #3680) in the gRPC module for high-throughput bulk graph loading via streaming.

GraphQL Introspection

GraphQL introspection is now available (#3671), enabling tools and IDEs to discover the schema and available queries/mutations automatically.

MCP Stdio Transport

Added MCP stdio transport (#3685) alongside the existing SSE transport, enabling direct integration with AI assistants and tools that use the stdio protocol. Also added profiler and server settings to MCP server tools (#3663) and fixed MCP authentication with API tokens (#3620).

Auto-tune maxPageRAM

ArcadeDB now auto-detects container memory limits at startup (#3580) and adjusts maxPageRAM accordingly, improving out-of-the-box performance in Docker and Kubernetes environments.

Bug Fixes & Improvements

SQL Engine

• Fixed aggregating projection with count(*) returning nothing on empty types (#3585)
• Fixed Invalid value for $current: null when SQL command is executed (#3583, #3584)
• Fixed CONTAINSANY with method call on left-hand side (regression) (#3581, #3582)
• Fixed SQLScript with LET/RETURN throwing QueryNotIdempotentException (#3664, #3666)
• Fixed Class Cast Exception in SQL queries
• Optimized graph filtering (SQL only)

OpenCypher Engine

• Fixed WHERE predicates referencing UNWIND variables not being pushed down into MatchNodeStep
• Fixed UNWIND $batch MATCH ... CREATE edge failing unless WHERE clause is used explicitly (#3612)
• Dramatically optimized Cypher edge creation performance
• Optimized Cypher aggregation
• Implemented queryNodes Cypher function

Wire Protocols

• Bolt: Fixed parameterized queries failing to substitute in WHERE clauses (#3650, #3651)
• gRPC: Fixed query and streaming query ignoring the language parameter (always using SQL) (#3588, #3589)
• Gremlin: Fixed default graph database creation on Gremlin plugin start; scaled concurrent test threads to available processors

Core Engine

• Fixed ConcurrentModificationException regression in schema.getTypes() (#3590)
• Fixed concurrency over multi-page record update
• Fixed concurrency over schema files
• Fixed transaction commit failing when indexes are dropped mid-transaction (#3673)
• Fixed error during index compaction (#3615)
• Fixed old concurrency issue hard to reproduce with high concurrency
• Fixed duplicate types returned from schema

Vector Index

• Fixed async graph build not re-triggered for embeddings added during an ongoing build (#3683, #3684)
• Fixed performance regression on huge vector indexes (190k+) where adding one vector made next vectorNeighbors call extremely slow (#3679)
• Fixed LSM vector rebuild strategy
• Fixed JVector COSINE score calculation

Server & HTTP

• Fixed HTTP 413 response with JSON error body when request body exceeds size limit
• Fixed Undertow throwing away oversized requests with no message

Graph Algorithms

• Fixed PageRank bug with direction
• Fixed graph algorithm inversion

Other

• Fixed runtime warnings with Java 25 (#3486)
• Improved Studio rendering with label sizing, colored edges by type, and updated logo
• Added GOVERNANCE.md

Performance Improvements

This release includes significant performance work focused on graph traversal and analytics:

• OLTP graph traversal optimizations for Cypher
• Optimized graph algorithms to avoid loading full vertices when not necessary
• Optimized iteration on GAV when available
• Hash join improvements for Cypher
• Count push-down to avoid materializing millions of records
• Single-pass per-source inequality + BFS count propagation on CSR path
• Optimized edge insertion speed

Upgraded Major Dependencies

• Apache Tinkerpop Gremlin 3.7.5 → 3.8.0 (#3667)
• Neo4j Java Driver 5.28.10 → 6.0.3
• Apache Groovy 4.0.28 → 5.0.4
• JVector 4.0.0-rc.7 → 4.0.0-rc.8

Additionally, 30+ minor dependency updates were applied including security patches for studio, e2e test, CI/CD, and pre-commit tooling.

New Contributors

• @lekmaneb made their first contribution in #3584

Full Changelog

Full Changelog: 26.3.1...26.3.2

Closed Issues: 21 issues resolved — see milestone 26.3.2 for details

ArcadeDB 26.3.1 Release Notes

We're excited to announce ArcadeDB 26.3.1, a feature-packed release with 190+ commits and 52 closed issues that brings major new capabilities including a completely redesigned Studio with an AI assistant, built-in MCP server support, geospatial indexing, a new TimeSeries data model, materialized views, hash indexes, 72 built-in graph algorithms, parallel query execution, and significant improvements across the board.

🎯 Major New Features

Completely Redesigned Studio with AI Assistant

The ArcadeDB Studio has been completely rewritten from scratch (#3485, #3509), delivering a modern, more powerful administration interface:

• New homepage and login experience
• Code completion for ArcadeDB SQL and OpenCypher in the query editor (#3508)
• Server profiler with FlameGraph visualization (#3528, #3409)
• Dedicated pages for buckets, indexes, and dictionary management
• New metric pages for both server and database monitoring (req/min charts, CRUD + Tx operations, concurrent modification tracking)
• Improved graph rendering with element customization
• User & Group management panel with centralized security controls
• Materialized views display under query results
• AI Assistant panel (Beta) (#3574) — integrated ArcadeDB AI assistant with two modes of execution, AI-powered profiler analysis, and agentic capabilities to help with queries and database management

MCP Server (Model Context Protocol)

ArcadeDB now includes a built-in MCP server (#3481, #3460), enabling AI assistants and LLM-based tools to interact with ArcadeDB directly. This release also introduces API Key authentication for programmatic access, manageable through the new Studio security panel.

Geospatial Indexing

New native geospatial indexing with geo.* SQL functions (#3510, #3513), powered by LSM-Tree native storage. Enables efficient spatial queries and proximity searches directly within ArcadeDB without external dependencies.

TimeSeries Data Model

Introduced the TimeSeries data model (#3511, #3488), adding native time-series support to ArcadeDB's multi-model capabilities. This enables efficient storage and querying of time-ordered data alongside graphs, documents, and other models in the same database. Main features:

• Columnar storage with Gorilla (float), Delta-of-Delta (timestamp), Simple-8b (integer), and Dictionary (tag) compression
• Shard-per-core parallelism with lock-free writes
• Block-level aggregation statistics for zero-decompression fast-path queries
• InfluxDB Line Protocol ingestion for compatibility with Telegraf, Grafana Agent, and hundreds of collection agents
• Prometheus remote_write / remote_read protocol for drop-in Prometheus backend usage
• PromQL query language - native parser and evaluator with HTTP-compatible API endpoints
• SQL analytical functions - ts.timeBucket, ts.rate, ts.percentile, ts.interpolate, window functions, and more
• Continuous aggregates with watermark-based incremental refresh
• Retention policies and downsampling tiers for automatic data lifecycle
• Grafana integration via DataFrame-compatible endpoints (works with the Infinity datasource plugin)
• Studio TimeSeries Explorer with query, schema inspection, ingestion docs, and PromQL tabs

Materialized Views

Added support for materialized views (#3464, #3463), allowing pre-computed query results to be stored and automatically maintained. Materialized views are fully integrated into Studio for easy management and monitoring.

Hash Index (Extendible Hashing)

New hash index type using extendible hashing algorithm (#3527), providing faster exact-match lookups when range queries are not needed. The hash index is a more efficient alternative to the LSM-Tree index for equality-only access patterns. Studio has been updated to support the new index type.

73 Built-in Graph Algorithms

Implemented a comprehensive set of popular graph algorithms (#3515), making advanced graph analytics available out of the box without external libraries. Multiple batches of algorithms were added covering common use cases like centrality, community detection, pathfinding, and more.

• Pathfinding: Shortest Path, Dijkstra, A*, Bellman-Ford, Duan SSSP, K-Shortest Paths (Yen's), All Simple Paths, All-Pairs Shortest Paths (Floyd-Warshall), Single-Source Dijkstra, Longest Path (DAG), All Shortest
  Paths
• Traversal: Breadth-First Search (BFS), Depth-First Search (DFS)
• Centrality: PageRank, Personalized PageRank, ArticleRank, Betweenness Centrality (Brandes), Closeness Centrality, Harmonic Centrality, Eigenvector Centrality, Degree Centrality, Katz Centrality, HITS (Hub/Authority), Eccentricity
• Community Detection: Weakly Connected Components (Union-Find), Strongly Connected Components (Kosaraju), Louvain, Leiden, Label Propagation, Speaker-Listener Label Propagation (SLPA), Hierarchical Clustering
• Graph Structure / Topology: Triangle Count, Local Clustering Coefficient, Articulation Points (Tarjan), Bridges (Tarjan), Biconnected Components, Topological Sort (Kahn), Cycle Detection, K-Core Decomposition, K-Truss Decomposition, Maximal Cliques (Bron-Kerbosch), Graph Summary, Assortativity, Conductance, Modularity Score, Rich-Club Coefficient, Bipartite Check, Graph Coloring, Densest Subgraph (Charikar), Maximum, Flow (Edmonds-Karp), Max K-Cut, Minimum Spanning Tree (Kruskal), Minimum Spanning Arborescence (Chu-Liu/Edmonds), Steiner Tree
• Link Prediction: Adamic-Adar, Jaccard Similarity, Common Neighbors, Resource Allocation, Preferential Attachment, Same Community, Total Neighbors, SimRank
• Graph Embeddings / ML: Node2Vec, FastRP, HashGNN, GraphSAGE
• Other: VoteRank, Influence Maximization (Independent Cascade), Random Walk, K-Nearest Neighbors
• Path Expansion (APOC-style): Path Expand, Path Expand Config, Spanning Tree, Subgraph All, Subgraph Nodes

Parallel Query Execution

Introduced parallel query support (#1339) for SQL, enabling queries to leverage multiple CPU cores for faster execution on large datasets. Includes safety guards to avoid deadlocks in concurrent scenarios.

OpenCypher User Management & Constraints

• User management: Supported CREATE USER, DROP USER, and related Cypher commands (#3461)
• Constraints: Supported OpenCypher constraint syntax (#3459)

🔧 Bug Fixes & Improvements

SQL Engine

• Fixed IN (SELECT ...) returning wrong results when field has an index (#3565, #3566)
• Fixed SQL optimization failure on arithmetic expressions
• Fixed LET in sub-queries
• Fixed CONTAINSTEXT with FULL_TEXT BY ITEM and compound filters (#3483, #3484)
• Fixed include and exclude operators (#3480)
• Fixed index usage with min/max functions
• Fixed CREATE EDGE with empty array destinations (#3518)
• Fixed System as reserved keyword in ANTLR parser
• Planner now prefers full-text index when CONTAINSTEXT is used
• Fixed accessing internal properties in maps (#3571)
• Fixed pushed-down filtering in both SQL and Cypher engines
• Prevented incorrect filter pushdown for WHERE predicates with nested variable references (#3534)
• Improved native select() API with new methods (#3535)

OpenCypher Engine

• Fixed filter on queries not working in some cases (#3563)
• Fixed inline property filters on target nodes in MATCH relationship patterns being silently ignored
• Fixed usage of parameters (#3556, #3476)
• COUNT on non-existing label now correctly returns 0 instead of error (#3479)
• Fixed result property ordering (#3475)
• Fixed CASE sub-clause handling (#3468)
• Profiled new OpenCypher commands for security

Wire Protocols

• Bolt: Fixed parameterized queries failing to match in MATCH property maps (#3560)
• Bolt: Fixed connection to Neo4j Desktop 1.6.0+ (#3471)
• gRPC: Fixed transactionId not included in CRUD reques...

@ -0,0 +1,189 @@

ArcadeDB 26.2.1 Release Notes

We're excited to announce ArcadeDB 26.2.1, a massive release that brings 484 commits and 200+ closed issues with significant advancements across the platform. This release focuses on hardening the native OpenCypher engine with official TCK compliance, introducing the Bolt protocol for Neo4j driver compatibility, a new plugin architecture, a powerful backup scheduler, a new SQL parser (ANTLR) and major performance optimizations.

🎯 Major New Features

Bolt Protocol (Neo4j Driver Compatibility)

ArcadeDB now supports the Neo4j Bolt wire protocol (#3250), allowing applications to connect using standard Neo4j drivers. This opens ArcadeDB to the vast ecosystem of Neo4j-compatible tools and libraries:

• First version of the Bolt wire protocol implementation
• Compatible with the official Neo4j Java driver
• Correct protocol version encoding and handshake negotiation (#3413)
• Proper field name preservation for single-element Cypher RETURN over Bolt (#3286)

Cypher LOAD CSV

Implemented the OpenCypher LOAD CSV clause (#3450), enabling bulk data import from CSV files directly in Cypher queries, including context functions file() and linenumber().

New SQL Parser (ANTLR4)

Replaced the legacy JavaCC-based SQL parser with a modern ANTLR4 implementation (#3195), providing:

• More robust and maintainable parsing infrastructure
• Better error messages and diagnostics
• Foundation for future SQL language extensions

Plugin Architecture with Isolated Class Loaders

Introduced a new modular plugin architecture (#3260) that supports isolated class loaders, enabling clean separation of plugin code from the core engine, dynamic loading/unloading at runtime, and reduced risk of dependency conflicts.

Backup Scheduler Plugin

A new backup scheduler plugin (#3263) allows automated, scheduled database backups with security validation — a highly requested feature for production deployments.

SQL Triggers

Added support for SQL triggers (#3222) that can execute SQL, JavaScript, and Java code, enabling powerful event-driven automation within the database.

HTTP Session Management

Introduced HTTP session support with token-based authentication, including configurable session expiration, new /login and /logout APIs, and a list of active connections in Studio.

Database Transient Variables via Redis

Added support for transient database global variables accessible through the Redis wire protocol (#3248), and Redis can now be used as a query language.

🔐 OpenCypher Engine Hardening

This release brings massive improvements to the native OpenCypher engine, achieving the compliance with the OpenCypher TCK (Technology Compatibility Kit)**:

TCK Compliance

• Integrated the official OpenCypher TCK test suite (#3358)
• Multiple rounds of TCK-driven fixes (#3362, #3363, #3366, #3367, #3368)
• Completed 100% temporal OpenCypher TCK compliance (#3369)

New Cypher Functions

• Added many new Cypher functions (#3275)
• Math functions: cosh(), sinh(), tanh(), cot(), coth(), pi(), e()
• Utility functions: isempty(), isnan(), randomuuid(), allReduce(), collflatten()
• Spatial functions: distance(point1, point2) and distance(point1, point2, unit)
• User-defined functions in Cypher language with cross-language invocation
• Mega refactor consolidating all functions under com.arcadedb.function with merged SQL/Cypher function framework

Cypher Bug Fixes

• MERGE: Label-only patterns now correctly find existing nodes instead of always creating new ones (#3255)
• Relationship direction: Relations created with MERGE and CREATE now respect arrow direction (#3353)
• Label filtering: Fixed label filtering in MATCH relationship patterns (#3252)
• RETURN clause: Single element results are now correctly unwrapped (#3268)
• head(collect()): Fixed returning null in WITH clauses (#3309, #3310)
• Backtick handling: Fixed backtick stripping in map literal keys (#3322)
• PROFILE/EXPLAIN: Fixed corrupting returned values (#3406)
• CREATE path variables: Fixed CreateStep.createPath() not building TraversalPath objects for path variables
• Serialization: Fixed result field mapping for non-Studio serializers (#3392)
• Fixed arithmetic operations, polymorphism handling, multiple parenthesized expressions, FOREACH, UNWIND with nested lists, list comprehension, pattern comprehension, zero-length paths, shortestPath, subquery, OPTIONAL MATCH with pattern predicates, and sort with null values
• Function fixes: trim(), length(null), avg(), round() precision, stdev()/stdevp(), toBoolean() from integer, timestamp(), collect() on Studio

⚡ Performance Optimizations

Significant performance work across the OpenCypher engine and core:

• Batch CREATE: Implemented batch create in OpenCypher with configurable batch size (default 20K entries per transaction)
• Chunked streaming: Implemented chunked streaming with limit usage in ORDER BY
• Edge traversal: Skipped loading of edges when not necessary, loading connected vertices directly; inverted traversal optimization
• Aggregation: Optimized aggregation and GROUP BY when there is a LIMIT; optimized count of edges
• Count optimization: Improved performance for count() in OpenCypher
• Function caching: Cached function calls in OpenCypher for repeated invocations
• Graph algorithms: Dijkstra and A* now return list of RIDs instead of whole vertex objects; avoided unnecessary overhead
• Spatial: Optimized point insertion with a lightweight version; removed dynamic dependency with spatial4j for improved performance
• Index selection: Improved index selection; distinct is used to normalize avoiding cartesian product when possible
• Memory: Reduced allocation on common paths; using optimized SingletonMap when possible; replaced new Random() with ThreadLocalRandom.current()
• Unsafe removal: Replaced usage of sun.misc.Unsafe with VarHandle for modern Java compatibility

🚀 Vector Index Enhancements

• Diagnostics logging: Added vector graph build diagnostics for better observability (#3305)
• Preload vectors API: New API to preload vectors for faster search
• OpenCypher integration: Fixed vector functions accessibility from OpenCypher queries
• Upgraded to jvector 4.0.0-rc.7

🔧 Improvements & Bug Fixes

Core Engine

• Concurrent multi-page record reads: Added automatic retry mechanism during concurrent modifications (#3396)
• CREATE INDEX: Now waits for any running async tasks before proceeding (#3408)
• Index edge removal: Fixed index remove edge for non-unique indexes
• SQL CREATE EDGE: Fixed argument expression resolution (#3323)
• SQL concatenation: Fixed second concatenation operator failing without parenthesis
• Full-text index improvements (#3221)
• Memory leak fix: Removed strong reference of Thread in DatabaseContext.CONTEXTS
• Page isolation: Fixed page isolation bug with concurrent access
• Index rebuild: Fixed async rebuild while another rebuild is in progress
• Schema concurrency: Fixed concurrency issue with schema
• Export: Fixed database export
• Shapes support: Added support for shapes in SQL
• Truncate bucket: Implemented TRUNCATE BUCKET command
• JSON array in UPDATE: Supported JSON array in SQL UPDATE
• SQL buckets/page size: SQL now supports setting buckets and page size at type creation
• NULL index strategy: Return NULL when index null strategy is set to skip
• lookupByRID: Ensured it always returns a record or exception, never null

PostgreSQL Wire Protocol

• Fixed DATETIME serialization to use ISO 8601 format (#3245)
• Fixed PostgreSQL protocol issues with Node.js driver

gRPC

• Tests and refactoring of gRPC client (#3306, #3317)
• Fixed gRPC context management and transaction management
• Fixed record crea...

ArcadeDB 26.1.1 Release Notes

We're excited to announce ArcadeDB 26.1.1, a significant release that brings 92 closed issues and introduces major new capabilities to the platform. This release marks a milestone with the introduction of a native OpenCypher query engine and substantial improvements to our Vector indexing capabilities.

🎯 Major New Features

Native OpenCypher Query Engine

The highlight of this release is the complete native Cypher query engine implementation (#3123), delivering the most important features of the OpenCypher graph query language. This native implementation provides:

• Full Cypher query support directly in ArcadeDB
• Optimized execution without external dependencies
• Seamless integration with existing multi-model capabilities
• Enhanced graph traversal and pattern matching capabilities

Modular Distribution Builder

Introduced a new modular distribution builder (#3194) that allows users to create custom ArcadeDB distributions with only the modules they need, reducing deployment size and complexity.

🚀 LSM Vector Index Enhancements

This release brings significant improvements to our vector indexing capabilities:

• Hierarchy Flag Support: Added configurable hierarchy flag to LSM vector index configuration (#3130) for optimized index structures
• Eager Vector Graph Rebuild API: New API for eager vector graph rebuilding (#3146), providing better control over index maintenance
• Product Quantization (PQ) Improvements:
  • Fixed PQ file path canonicalization (#3159)
  • Automatic migration of legacy PQ files
  • Enhanced file handling and reliability
• storeVectorsInGraph Consistency: Honor the storeVectorsInGraph flag when writing vecgraph (#3145)
• Improved Progress Logging: Enhanced graph build progress logging with fallback mechanisms and 2-second throttle (#3165) for better monitoring
• Chunk-size Warning Improvements: Ensure warnings display original values and maintain WAL settings (#3134)

🔧 Improvements & Bug Fixes

PostgreSQL Wire Protocol

• Fixed PostgreSQL type mapping (#3119) for improved compatibility

Studio Enhancements

• Upgraded to jQuery 4.0.0 (#3166) for modern browser support and security improvements
• Improved chart rendering tests and response handling (#3164)
• Fixed TypeError when importing JSON graph without settings property (#3100)
• Multiple UI library updates (ApexCharts, CodeMirror, pdfmake)

Core Engine

• Removed deprecated HNSW vector index support (#3095), consolidating on LSM-based implementation
• Updated Maven wrapper to version 3.9.12 (#3098)

Tools, Infrastructure & Build

• Fixed many issues on database importer (CSV, JSON and XML)
• Enhanced distribution builder with modular architecture
• Improved test coverage and reliability
• Code quality improvements and refactoring

📝 Full Changelog

Full Changelog: 25.12.1...26.1.1

Closed Issues: 92 issues resolved - see milestone 26.1.1 for details