v3.16.6

Summary

This release updates the deprecation policy, improves repairTable behavior, fixes Consensus Commit, Cluster rollback/pause, and SQL metadata cache issues, and upgrades several dependencies to address security vulnerabilities across the Community and Enterprise editions.

Community edition

Improvements

• Changed the deprecation policy so that APIs and configurations marked as deprecated will now be removed in 4.0.0 instead of 5.0.0. (#3520)
• Improved repairTable to skip rewriting a table's metadata when it is already up to date (and, for Cosmos DB, to skip updating the container indexing policy when it already matches), avoiding unnecessary writes. (#3613)

Bug fixes

• Fixed an issue in Consensus Commit where a Get operation using a secondary index could fail with an IllegalArgumentException when another record with the same indexed value was concurrently being deleted and inserted. (#3607)
• Fixed an issue in Consensus Commit where a read-only transaction could fail when coordinator write omission on read-only was disabled and coordinator group commit was enabled. (#3614)
• Fixed a bug where aborting an in-flight, group-committed transaction by ID via DistributedTransactionManager.rollback(String) / abort(String) could be lost when the Coordinator group commit feature was enabled. (#3619)
• Fixed an issue in the Consensus Commit transaction manager where a read could return a stale (pre-commit) value for a record whose writing transaction committed concurrently during lazy recovery. (#3621)
• Upgraded the Jackson, Netty, Azure Cosmos DB, and Azure Blob Storage libraries to fix security issues: CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587, CVE-2026-44249, CVE-2026-45416, CVE-2026-45674, CVE-2026-47691, CVE-2026-50010, CVE-2026-54512, CVE-2026-54513, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-59901, and GHSA-r7wm-3cxj-wff9 (#3754)
• Upgraded the PostgreSQL JDBC driver and the Netty library to fix security issues: CVE-2026-42198, CVE-2026-42579, CVE-2026-45674, CVE-2026-47691, and CVE-2026-54291 (#3760)

Enterprise edition

Improvements

ScalarDB Cluster

• Changed the deprecation policy so that APIs marked as deprecated will now be removed in 4.0.0 instead of 5.0.0.

Bug fixes

ScalarDB Cluster

• Fixed a bug where a rollback that exceeded the cluster's request-forwarding hop limit was silently reported as successful instead of surfacing the failure, which could leave records prepared until lazy recovery.
• Fixed a race condition where pausing a cluster node or the Transaction Coordinator could report success while the node remained unpaused. This could happen when an unpause or another pause request was issued concurrently, and also when a pause that waits for outstanding requests timed out after an earlier pause had already succeeded.
• Upgraded the Jackson and Netty libraries to fix security issues: CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587, CVE-2026-44249, CVE-2026-45416, CVE-2026-45674, CVE-2026-47691, CVE-2026-50010, CVE-2026-54512, CVE-2026-54513, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-59901, and GHSA-r7wm-3cxj-wff9
• Upgraded the Bouncy Castle library and the grpc_health_probe binary to fix security issues: CVE-2025-14813, CVE-2026-5598, CVE-2026-25681, CVE-2026-27136, CVE-2026-27145, CVE-2026-33811, CVE-2026-33814, CVE-2026-39820, CVE-2026-39821, CVE-2026-39822, CVE-2026-39836, CVE-2026-42499, and CVE-2026-42504

ScalarDB SQL

• Fixed an issue where CachedMetadata#invalidateNamespaceNamesCache() did not actually invalidate the cached list of namespaces, causing SHOW NAMESPACES and related operations to potentially return stale results until the cache TTL expired.