v3.15.9

Summary

This release updates the deprecation policy for both Community and Enterprise editions, fixes transaction abort, rollback, pause, and metadata cache invalidation issues, and upgrades several dependencies to address security vulnerabilities.

Community edition

Improvements

• Changed the deprecation policy so that APIs and configurations marked as deprecated will now be removed in 4.0.0 instead of 5.0.0. (#3520)

Bug fixes

• Fixed a bug where aborting an in-flight, group-committed transaction by ID via DistributedTransactionManager.rollback(String) / abort(String) could be lost when the Coordinator group commit feature was enabled. (#3619)
• Upgraded the Jackson, Netty, Azure Cosmos DB, and Azure Blob Storage libraries to fix security issues: CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587, CVE-2026-44249, CVE-2026-45416, CVE-2026-45674, CVE-2026-47691, CVE-2026-50010, CVE-2026-54512, CVE-2026-54513, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-59901, and GHSA-r7wm-3cxj-wff9 (#3754)
• Upgraded the PostgreSQL JDBC driver and the Netty library to fix security issues: CVE-2026-42198, CVE-2026-42579, CVE-2026-45674, CVE-2026-47691, and CVE-2026-54291 (#3761)

Enterprise edition

Improvements

ScalarDB Cluster

• Changed the deprecation policy so that APIs marked as deprecated will now be removed in 4.0.0 instead of 5.0.0.

Bug fixes

ScalarDB Cluster

• Fixed a bug where a rollback that exceeded the cluster's request-forwarding hop limit was silently reported as successful instead of surfacing the failure, which could leave records prepared until lazy recovery.
• Fixed a race condition where pausing a cluster node or the Transaction Coordinator could report success while the node remained unpaused. This could happen when an unpause or another pause request was issued concurrently, and also when a pause that waits for outstanding requests timed out after an earlier pause had already succeeded.
• Upgraded the Jackson and Netty libraries to fix security issues: CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587, CVE-2026-44249, CVE-2026-45416, CVE-2026-45674, CVE-2026-47691, CVE-2026-50010, CVE-2026-54512, CVE-2026-54513, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-59901, and GHSA-r7wm-3cxj-wff9
• Upgraded the Bouncy Castle library and the grpc_health_probe binary to fix security issues: CVE-2025-14813, CVE-2026-5598, CVE-2026-25681, CVE-2026-27136, CVE-2026-27145, CVE-2026-33811, CVE-2026-33814, CVE-2026-39820, CVE-2026-39821, CVE-2026-39822, CVE-2026-39836, CVE-2026-42499, and CVE-2026-42504

ScalarDB SQL

• Fixed an issue where CachedMetadata#invalidateNamespaceNamesCache() did not actually invalidate the cached list of namespaces, causing SHOW NAMESPACES and related operations to potentially return stale results until the cache TTL expired.