26.7.1

ArcadeDB 26.7.1 Release Notes

Overview

ArcadeDB 26.7.1 is a large stability, resilience and security release with over 420 commits, 238 resolved issues and 32 merged pull requests. The headline theme is a deep High Availability / Raft hardening wave that makes clustered deployments far more robust under leader churn, node restarts, snapshot transfers and Kubernetes scale events. On top of that come a security hardening pass (polyglot scripting lockdown, gRPC and cluster-management authorization, DoS bounding), a new OpenTelemetry distributed-tracing module plus structured JSON logging, native BM25 full-text scoring, continued ISO GQL compliance and vector engine work, and a long list of gRPC, MongoDB wire-protocol, SQL, OpenCypher, time-series and Studio fixes.

New Features

• OpenTelemetry distributed tracing - an optional module for end-to-end request tracing, with opt-in OTLP export. (#4467, #4465)
• Structured JSON logging with per-request correlation IDs. (#4466)
• Native BM25 full-text scoring - field boosts, caret syntax and EXPLAIN / PROFILE support. (#4687)
• ISO GQL compliance - strict numeric types (schema round-trip), session management (SESSION SET / RESET / CLOSE) and transaction control (START TRANSACTION / COMMIT / ROLLBACK). (#4141)
• New vector formats and helpers - MATLAB / MATLAB_COLUMN, JULIA and NUMPY formats, asVector(), asSparse(), RRF array input and vectorDequantizeBinary. (#3099)
• MongoDB wire protocol - update, delete and createIndexes commands plus SASL PLAIN authentication. (#4750, #4751, #4746)
• HA auto-acquire of unseen databases - a joining node bootstraps databases it has never seen. (#4727)
• Kubernetes health probes - liveness/readiness/startup endpoints for orchestrated deployments. (#4464)
• Paginated remote fetching of edges and vertices across the remote API.
• Studio - cluster HA alerts and Restore / Delete row actions on the backup list. (#4737)

Major Highlights

High Availability & Raft resilience

The bulk of this release goes into making the Raft-based HA cluster survive real-world failure modes without data loss or node self-halt:

• No more node-wide halt on apply errors. Apply-time failures are now quarantined per-database instead of taking the whole node down, transient NeedRetryExceptions are retried in Raft apply, and unexpected throwables no longer kill the process. (#4797, #4659)
• Divergence self-recovery. A follower stuck on a divergent Raft log now performs follower-side reformat-and-rejoin instead of spinning on INCONSISTENCY, and a WAL-version-gap / phase-2 commit failure no longer causes a node to self-halt. (#4741, #4740)
• Snapshot integrity. Snapshot extraction, markers and the final swap are now fsynced before the backup is deleted, transfer completeness is verified with a manifest, takeSnapshot() persists a real snapshot marker so a log purge can no longer orphan applied state, and the database-registry lock is held across snapshot close -> swap -> reopen. (#4830, #4831, #4829, #4832)
• Membership & quorum safety. Raft membership now uses atomic deltas instead of last-write-wins setConfiguration, removePeer / leaveCluster are guarded against dropping below quorum, and stepDown selects the highest-priority non-lagging peer while skipping priority-0 witnesses. (#4795, #4796, #4808)
• Per-database applied-index tracking, so mixed-database clusters track progress correctly. (#4824)
• Silent write loss eliminated when replication times out after dispatch: the leader no longer acknowledges a write it failed to replicate. (#4790)
• Accurate lag diagnosis. New heartbeat-lag metrics, byte-bounded replication backpressure, resync logging (leader flood suppression + follower resync visibility), and a slow-but-progressing follower is now treated as catching up rather than stale. ClusterMonitor per-replica lag state is reset on each new leadership term to prevent false STALLED reports. (#4812, #4810, #4840, #4841)
• Auto-acquire of unseen databases so a joining node bootstraps databases it has never seen, with a single deterministic bootstrap source instead of abandoning databases on first transfer. (#4727, #4807)

Kubernetes operations

• StatefulSet scale-up beyond HA_SERVER_LIST no longer crash-loops: a local Raft peer is synthesized and auto-joins when the pod ordinal exceeds the static list. (#4836)
• Raft storage is persisted by default under Kubernetes, so a pod restart no longer wipes the PVC-backed Raft log. (#4835)
• Kubernetes health/liveness/readiness probes and a graceful cluster-leave path owned solely by RaftHAServer.stop(). (#4464, #4837)

Security hardening

• Polyglot scripting now requires admin privileges and the GraalVM sandbox has been hardened (reflection deny-list), closing an advisory (GHSA-48qw-824m-86pr) where a reader-role user could read host files via JavaScript on /api/v1/command.
• gRPC authorization is enforced centrally instead of being blanket-skipped: getDatabase rejects path-traversal names and enforces auth, admin operations require admin auth, and cross-database access is covered by regression tests. (#4793, #4792, #4794)
• Cluster-management HTTP endpoints now require root. (#4791)
• DoS bounding on gRPC: result materialization and worker busy-wait are bounded, abandoned gRPC transactions are reaped to stop an executor/transaction leak, and in-band command failures are correctly counted as errors. (#4803, #4802, #4804)
• Hardened FileUtils path-traversal guard.

Observability

• Optional OpenTelemetry distributed-tracing module for end-to-end request tracing. (#4467)
• Structured JSON logging with per-request correlation IDs. (#4466)
• Metrics depth (Pillar 1): RED timers, engine gauges and opt-in OTLP export, plus gRPC metrics published into the shared server registry with method/status tags and executor-pool gauges. (#4465, #4826)

Native BM25 full-text scoring

Full-text search gains native BM25 scoring with field boosts, caret syntax and EXPLAIN / PROFILE support, along with fixes so SEARCH_INDEX no longer leaks internal posting-RID strings into @rid, multi-property and rebuilt FULL_TEXT indexes no longer crash, and multi-dot SEARCH_INDEX queries are parsed correctly. (#4687, #4731, #4732, #4733, #4734)

ISO GQL compliance

Continued work toward the ISO GQL standard (#4141): strict numeric types on the write side (schema round-trip), session management (SESSION SET / RESET / CLOSE) and transaction control (START TRANSACTION / COMMIT / ROLLBACK).

Vector engine (Epic #3099)

• Quantization ergonomics, asSparse(), asVector() (inverse of asString), RRF array input and vectorDequantizeBinary.
• New MATLAB / MATLAB_COLUMN, JULIA and NUMPY vector formats.
• Correctness fixes across the vector SQL functions, consistent cosineSimilarity on zero vectors, and a consistent ordinalToVectorId snapshot during brute-force scans. (#4583, #4581)

MongoDB wire protocol

The mongodbw plugin now supports update, delete and createIndexes commands, adds SASL PLAIN authentication, and returns correct data on find. (#4750, #4751, #4746, #4745)

Major Fixes

gRPC

• InsertStream is stopped after a mid-stream commit failure (and the error is no longer mis-indexed), the transaction is no longer begun/committed on different pool threads, and CONFLICT_UPDATE upsert now merges non-key columns. (#4806, #4656)
• Streaming terminal calls are serialized on a thread-safe StreamObserver. (#4801)
• DATETIME_MICROS / DATETIME_NANOS precision is preserved on the write path, null-valued projected columns survive ExecuteQuery, and the configured compression codec is honored. (#4805, #4692, #4827)
• Time-series INSERT over gRPC no longer throws on empty @type / @rid. (#4688)

High Availability (additional)

• TRUNCATE TYPE / TRUNCATE BUCKET are now HA-safe, using small batches and failing loud instead of silently truncating incompletely. (#4817)
• Follower match/next indices are correlated by peer-id stability rather than array position, fixing mis-zipped follower states. (#4842)
• The Raft gRPC allowlist fails open only up to quorum, not the full peer set, and the state machine is rewired to RaftHAServer on a HealthMonitor-driven Ratis restart. (#4828, #4839)
• AppendEntries element limit is configurable (default 64), RATIS-2523 matchIndex rewind is atomic and fail-loud, and a replica stuck STALLED at matchIndex=-1 auto-recovers. (#4752, #4833, #4728)
• LINEARIZABLE follower reads no longer serve stale state, and read-only statements honor the requested read consistency.
• Snapshot write watchdog now detects stalls rather than total elapsed time, proactive peer allowlist refresh + hardened DNS caching, and GraphBatch bulk load survives a transient leader re-election. (#4729, #4696, #4724)

SQL

• UPDATE SET map = map.remove(key) now persists map/collection key removal. (#4730)
• SELECT FROM <non-existent RID> returns an empty result set instead of HTTP 500.
• Planner prefers a full-key index over a partial-key scan on a longer composite index. (#4600)
• IN / NOT IN three-valued logic for NULL operands, GROUP BY on mixed-type numeric keys no longer splits equal groups, and min() / max() over mixed numeric collections no longer throws ClassCastException. (#4591, #4592)
• DISTINCT result can be used as a function argument / method base, backticks are stripped from quoted projection aliases, and algo.allSimplePaths supports skipVertexTypes. (#4691)
• Assorted math/collection function fixes: SplitFunction on null delimiter, AbstractMathFunction.asDouble(null), TailFunction sublist view, date.convert overflow and ISO-8601 week-of-year at year boundaries. (#4704, #4556, #4558, #4555, #4554)

OpenCypher

• Ghost (dangling) edges are tolerated in OpenCypher queries instead of crashing. (#4657)
• MATCH (u:User) RETURN u no longer throws NoSuchElementException, and [:RX|RY] disjunction returns rows when one type is undeclared with a property anchor. (#4689)
• shortestPath with edge:true no longer throws ClassCastException or returns the wrong vertex in the BOTH direction. (#4645)

Storage, indexing & recovery

• Schema is recovered from schema.prev.json when schema.json is corrupt after a crash mid-save. (#1249)
• Corrupt hash-index metadata is detected and recovered, dangling UNIQUE index entries no longer block writes, and REBUILD INDEX validates entries under bucket-selection strategies.
• BasePage.equals / hashCode key on pageId only, replicated pages are written under the per-page I/O lock, and PaginatedComponentFile channel-reopen retries clear/restore the thread interrupt flag. (#4722, #4712)
• Time-series fixes: negative-timestamp bucket alignment, skip-NaN consistency across MIN/MAX paths, NaN for empty MIN/MAX buckets, and aggregate() anchoring to the caller-supplied fromTs. (#4595, #4596, #4597)

Client, HTTP & Studio

• Remote client hydrates LIST / MAP ofType nested values to the declared primitive type, and paginated remote fetching of edges/vertices is covered across the remote API. (#4735)
• DATE values are encoded as epoch days on the JSON wire, and temporal types are handled in array serialization. (#4601, #4654)
• Studio gains cluster HA alerts and Restore / Delete row actions on the backup list. (#4737)
• The reserved internal .raft database is hidden from cluster status. (ops#379)

Dependencies

Notable upgrades in this release include:

• Netty 4.2.15.Final
• Undertow 2.4.2.Final
• Lucene 10.5.0
• Protobuf (Java) 4.35.1
• Jackson Databind 2.22.0
• Micrometer 1.17.0
• OpenTelemetry BOM 1.63.0
• JLine 4.2.1
• Logback 1.5.37
• JUnit Jupiter 6.1.1
• Neo4j Java Driver 6.2.0
• JVector 4.0.0-rc.8-hf1
• Swagger 2.2.52 / Swagger Parser 2.1.45

Plus the usual round of Studio frontend updates (SwaggerUI, ApexCharts, FontAwesome and the webpack/build toolchain), e2e test-harness bumps (Playwright, TestContainers, psycopg, pytest), CI / GitHub Actions updates and pre-commit hook refreshes.