v3.18.1

Summary

This release improves repairTable to avoid unnecessary metadata and indexing-policy updates, adds support for jdbc:spanner connection strings, fixes multiple Consensus Commit transaction handling issues, improves ScalarDB Cluster metadata repair and ScalarDB SQL SELECT execution, resolves Cluster rollback/pause and SQL statement cache bugs, and upgrades several dependencies to address security vulnerabilities.

Community edition

Improvements

• Improved repairTable to skip rewriting a table's metadata when it is already up to date (and, for Cosmos DB, to skip updating the container indexing policy when it already matches), avoiding unnecessary writes. (#3613)

Bug fixes

• Accepts connection string starting with jdbc:spanner to connect to Spanner (emulator, omni, and cloud instance) in addition to the already supported jdbc:cloudspanner pattern. (#3559)
• Fixed an issue in Consensus Commit where a Get operation using a secondary index could fail with an IllegalArgumentException when another record with the same indexed value was concurrently being deleted and inserted. (#3607)
• Fixed an issue in Consensus Commit where a read-only transaction could fail when coordinator write omission on read-only was disabled and coordinator group commit was enabled. (#3614)
• Fixed a bug where aborting an in-flight, group-committed transaction by ID via DistributedTransactionManager.rollback(String) / abort(String) could be lost when the Coordinator group commit feature was enabled. (#3619)
• Fixed an issue in the Consensus Commit transaction manager where a read could return a stale (pre-commit) value for a record whose writing transaction committed concurrently during lazy recovery. (#3621)
• Upgraded the Jackson, Netty, Azure Cosmos DB, and Azure Blob Storage libraries to fix security issues: CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587, CVE-2026-44249, CVE-2026-45416, CVE-2026-45674, CVE-2026-47691, CVE-2026-50010, CVE-2026-54512, CVE-2026-54513, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-59901, and GHSA-r7wm-3cxj-wff9 (#3754)
• Upgraded the PostgreSQL JDBC driver to fix security issues: CVE-2026-42198 and CVE-2026-54291 (#3758)

Enterprise edition

Enhancements

ScalarDB SQL

• Added @AutoConfigureBefore to ScalarDbJdbcConfiguration to explicitly declare auto-configuration ordering relative to Spring Boot's auto-configs.

Improvements

ScalarDB Cluster

• ScalarDB Cluster now repairs its authentication and ABAC system metadata tables at node startup to create the companion before-image secondary indexes required after upgrading, so deployments upgraded from an earlier version gain them automatically without a manual repairTable().

ScalarDB SQL

• Enabled the read-only optimization for one-shot SELECT statements and SELECT-only batches.

Bug fixes

ScalarDB Cluster

• Fixed a bug where a rollback that exceeded the cluster's request-forwarding hop limit was silently reported as successful instead of surfacing the failure, which could leave records prepared until lazy recovery.
• Fixed a race condition where pausing a cluster node or the Transaction Coordinator could report success while the node remained unpaused. This could happen when an unpause or another pause request was issued concurrently, and also when a pause that waits for outstanding requests timed out after an earlier pause had already succeeded.
• Upgraded the Jackson, Netty, and LangChain4j libraries to fix security issues: CVE-2026-40682, CVE-2026-42027, CVE-2026-42440, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587, CVE-2026-44249, CVE-2026-45416, CVE-2026-50010, CVE-2026-54512, CVE-2026-54513, CVE-2026-55405, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-59901, and GHSA-r7wm-3cxj-wff9
• Upgraded the Bouncy Castle library and the grpc_health_probe binary to fix security issues: CVE-2025-14813, CVE-2026-5598, CVE-2026-25681, CVE-2026-27136, CVE-2026-27145, CVE-2026-33811, CVE-2026-33814, CVE-2026-39820, CVE-2026-39821, CVE-2026-39822, CVE-2026-39836, CVE-2026-42499, and CVE-2026-42504

ScalarDB SQL

• Fixed a statement cache regression where non-parameterized DML statements occupied cache slots intended for parameterized SQL. Cache eligibility is now correctly gated on the presence of bind markers in the parsed SQL.