1.2.2 - Man In The Box

[v1.2.2] - Man In The Box - 8/6/2026

Thank you to everyone who submitted issues! I was out traveling last week, so now back to it.

Security

• Bolt now authorizes registered procedures by their declared mode.
  A caller with only read permission could previously invoke a WRITE
  procedure when its mutation was supplied dynamically, because Bolt classified
  only outer-query keywords. WRITE, SCHEMA, ADMIN, and DBMS procedures
  now require their corresponding entitlements before execution. Dynamic nested
  statements inherit the invoking caller's permissions, closing the same bypass
  for parameterized APOC execution in both autocommit and explicit transactions.
• Bolt rejects malformed PackStream lists before allocating their declared
  size. LIST8, LIST16, and LIST32 headers are validated against the
  remaining payload, preventing unauthenticated peers from using an oversized
  list declaration during HELLO decoding to request an attacker-controlled
  memory allocation.
• Updated AWS SDK dependencies for published security advisories.

Fixed

• Relationship MERGE now includes properties from the pattern in its
  identity.
  NornicDB previously matched relationships by start node, end node, and type
  only. Two assertions such as [:BUILT_FROM {scope_id: ...}] between the
  same nodes therefore collapsed into one relationship, and deleting one
  scope could remove the other scope's evidence. Plain and UNWIND relationship
  merges now match the complete property pattern. Concurrent writers of the
  same property identity use one deterministic storage key and converge after
  the existing transient-conflict retry, while different identities remain
  independent.
• Remote relationship MERGE now converges on the deterministic edge ID.
  Remote storage previously translated edge creation to Cypher CREATE, which
  could insert duplicate relationships when property-aware MERGE retries
  targeted the same generated identity. ID-bearing remote edges now use an
  identity-bearing relationship MERGE; legacy empty-ID edge creation retains
  its existing CREATE behavior.
• Empty property maps in relationship MERGE patterns are accepted.
  MERGE (a)-[:TYPE {}]->(b) now has the same behavior as an unqualified
  relationship pattern instead of failing parser validation.
• Bolt's committed-write cache now invalidates from the transaction's
  authoritative operation count. This prevents a query result cached before
  a committed transaction from being reused after that transaction has changed
  graph state, including writes executed through paths that are not reliably
  identified by outer-query keyword scanning.

What's Changed

• fix(cypher): include properties in relationship merge identity by @linuxdynasty in #290

Full Changelog: v1.2.1...v1.2.2