1.4.4

CHANGELOG:

• (Bugfix) (Platform) Recover Helm releases stuck in a pending state (roll back pending upgrades/rollbacks, uninstall pending installs) instead of retrying the upgrade forever
• (Maintenance) Bump Kubernetes to v0.33.13, Go toolchain to 1.25.12, Envoy to v1.37.5 and other dependencies (regclient, containerd, golang.org/x/net) to fix known vulnerabilities
• (Feature) Mount lifecycle volume read-only in runtime containers when the secured-containers feature is enabled
• (Feature) Set RuntimeDefault seccomp profile on managed pods when the secured-containers feature is enabled
• (Feature) (Chart) Harden operator chart: seccompProfile RuntimeDefault, runAsGroup/fsGroup, automountServiceAccountToken, HA-gated RollingUpdate + PodDisruptionBudget
• (Bugfix) Detect context deadline/cancellation through standard Unwrap() error chains (e.g. net/http *url.Error, go-driver v1)
• (Bugfix) Disable member maintenance when a not-Ready DBServer leads failover-capable shards
• (Bugfix) Do not fail on removed operator flags; deprecate, hide and ignore --operator.deployment-replication, --operator.apps, --operator.ml and --operator.analytics
• (Feature) (RBAC) Add ArangoPermissionRoleUserBinding handler
• (Feature) (Gateway) Use HTTP/2 for the default upstream to ArangoDB (hidden feature gateway-default-http2, enabled by default)
• (Bugfix) (RBAC) Fix scope evaluation, pool propagation, missing indexes, and add APIRefresh endpoint
• (Feature) Remove Replication operator, ArangoDeploymentReplication CRD, go-helper and go-driver v1 dependencies
• (Maintenance) Merge enterprise module into community, remove build tags and private dependencies
• (Bugfix) Add missing CRDs
• (Improvement) Refactor operator to use context.Context instead of stopCh, add CRD sync timeout (30s) and waitForCRD timeout (15s)
• (Feature) (RBAC) Design adjustments
• (Feature) (Platform) Improve Chart Generator
• (Design) Add OpenTelemetry integration design for ArangoProfile
• (Improvement) Expose Docker base image as overridable Makefile variable (BASEIMAGE)
• (Bugfix) Fix async context for backup restore, compact member, and rebuild outsynced shards actions after Driver V1 removal
• (Feature) (Scheduler) Allow SecurityContext in ArangoProfile Generic (all) container template
• (Feature) (Scheduler) Add Description and Tags to ArangoProfile and expose in Inventory
• (Feature) (Platform) Storage V2 Central Service
• (Feature) Remove ArangoML operator and all related CRDs (ArangoMLExtension, ArangoMLStorage, ArangoMLBatchJob, ArangoMLCronJob)
• (Maintenance) Deprecate --operator.ml CLI flag (hidden, warns if used)
• (Feature) Remove Analytics operator and GraphAnalyticsEngine CRD
• (Maintenance) Deprecate --operator.analytics CLI flag (hidden, warns if used)
• (Feature) Remove Apps operator and ArangoJob CRD
• (Maintenance) Deprecate --operator.apps CLI flag (hidden, warns if used)
• (Bugfix) Fix CircleCI path-filtering on master branch
• (Feature) (Platform) License Generate TTL Flag
• (Maintenance) Bump Kubernetes libraries to v0.33.12
• (Maintenance) Bump Envoy to v1.37.2 and go-control-plane/envoy to v1.37.0
• (Bugfix) Add missing testing build tag to pkg/util/tests/azure.go
• (Design) Add Platform Metrics Integration design document
• (Feature) Remove DriverV1, fix gateway inventory non-JSON responses, imagePullSecrets rotation loop, and backup finalizer infinite loop

What's Changed

• [Feature] [Platform] Proxy Storage V2 by @ajanikow in #2079
• [Feature] [ML] Remove API by @ajanikow in #2090
• [Feature] [GRAL] Remove API by @ajanikow in #2091
• [Feature] [APPS] Remove API by @ajanikow in #2092
• [Feature] [Platform] License Generate TTL Flag by @ajanikow in #2093
• [Feature] [Schedule] Add Description and Tags to ArangoProfile and expose in Inventory by @ajanikow in #2096
• fix(deps): CVE-2026-35469 (+3 more) by @ajanikow in #2097
• [Design] [Platform] Monitoring Metrics design by @ajanikow in #2098
• [Feature] Remove Driver V1 by @ajanikow in #2073
• [Bugfix] Fix missing async context in Driver V2 migration for backup restore, compact, and shard rebuild by @ajanikow in #2101
• [Improvement] Expose Docker base image as overridable Makefile variable by @ajanikow in #2102
• [Feature] [Scheduler] Allow SecurityContext in ArangoProfile Generic container template by @ajanikow in #2100
• [Design] [Platform] OpenTelemetry integration by @ajanikow in #2105
• [Feature] [RBAC] Design adjustments by @ajanikow in #2099
• [Maintenance] Refactor operator to use context.Context instead of stopCh by @ajanikow in #2106
• [Feature] [Platform] Improve Chart Generator by @ajanikow in #2107
• [Bugfix] Fix missing CRD permission by @ajanikow in #2108
• [Feature] Unify EE Operator by @ajanikow in #2109
• [Feature] (Gateway) Use HTTP/2 for default upstream to ArangoDB by @ajanikow in #2110
• [Feature] [Platform] Fix scope evaluation, pool propagation, missing indexes, and add APIRefresh endpoint by @ajanikow in #2111
• [Feature] [RBAC] Add ArangoPermissionRoleUserBinding handler by @ajanikow in #2114
• [Feature] Remove ArangoDeploymentReplication CRD and go-driver v1 dependency by @ajanikow in #2113
• [Bugfix] Do not fail on removed operator flags; deprecate, hide and ignore --operator.deployment-replication, --operator.apps, --operator.ml and --operator.analytics by @ajanikow in #2116
• OAS-12737: Disable member maintenance via high-priority plan when member is not Ready by @harryzhang-wq in #2112
• Detect context deadline/cancellation through standard Unwrap() error chains by @ajanikow in #2121
• Mount lifecycle volume read-only in runtime containers when secured-containers is enabled by @ajanikow in #2122
• Harden operator chart and secured-container managed pods security context by @ajanikow in #2123
• Bump Kubernetes to v0.33.13, Go toolchain to 1.25.12, Envoy to v1.37.5 and dependencies to fix known vulnerabilities by @ajanikow in #2124
• Document seccomp profile and read-only lifecycle mount in secured-containers feature by @ajanikow in #2125
• ci(security): add warn-only Trivy dependency CVE scan by @MarkusReadius in #2118
• Document required cloud storage permissions for S3, GCS and Azure Blob Storage by @ajanikow in #2126
• Recover Helm releases stuck in a pending state in the platform service handler by @ajanikow in #2127

New Contributors

• @harryzhang-wq made their first contribution in #2112
• @MarkusReadius made their first contribution in #2118

Full Changelog: 1.4.3...1.4.4