What arangodb/arangodb shipped
Written by FoxPlug from the repository's own releases; not affiliated with Arangodb. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/arangodb/arangodb; Arangodb did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- AQL now uses a sparse index for an OR branch only when that branch excludes null, so documents that match only through the other branch are no longer missing. Pull request #23418
- SUBSTITUTE no longer skips a match when a replacement overlaps another search value's next match. Pull request #23416
- Getcwd(nullptr, 0) was replaced with std::file_systems::current_path() and unused getcwd() lines were removed. Pull request #23370
- Unit tests were added for the read_cwd() and ensure_absolute() functions. Pull request #23381
- The hotbackup list API always returns a valid time stamp, so the CreationTime field is never an empty string. Pull request #23445
- Several small issues in the Join Node were fixed, including missing copies of filterProjections and isUniqueStream in clone and incorrect strategy reset on skip. Pull request #23429
- Error handling during arangosh connections was fixed. Pull request #23405
- Velocypack was updated to parse doubles using fast float parsing. Pull request #23435
Why it matters
This week brings fixes that change query results directly: sparse indexes are no longer used for OR branches that include null, and SUBSTITUTE no longer skips matches. Backups now always report a valid creation time, and arangosh connections handle errors more reliably.
Changelog entry
- Fixed the optimizer so a sparse index is used for an OR branch only if the branch excludes null. Pull request #23418
- Fixed SUBSTITUTE skipping a match when a replacement overlapped the next match of another search value. Pull request #23416
- The hotbackup list API now always returns a valid time stamp. Pull request #23445
- Fixed the Join Node to copy filterProjections and isUniqueStream in clone and to reset the strategy correctly on skip. Pull request #23429
- Replaced getcwd(nullptr, 0) with std::file_systems::current_path(). Pull request #23370
- Added unit tests for read_cwd() and ensure_absolute(). Pull request #23381
- Updated velocypack to parse doubles with fast float parsing. Pull request #23435
- Fixed error handling during arangosh connections. Pull request #23405
AQL fix: sparse indexes are used only for OR branches that exclude null, so results are correct. SUBSTITUTE no longer skips matches. Hotbackup list always returns a valid time stamp. Several Join Node issues fixed. arangosh error handling fixed.
This week a few correctness fixes landed. The optimizer now uses a sparse index for an OR branch only when that branch excludes null, so documents matching through the other branch are no longer dropped. SUBSTITUTE no longer skips a match when a replacement overlaps another search value's next match. The hotbackup list API now always returns a valid time stamp. Several small Join Node issues were fixed, including missing copies in clone and an incorrect strategy reset on skip. arangosh error handling was also fixed.
Week of September 28, 2026
What shipped
- Released version 3.12.12.1. Release
- Released version 3.11.14.6. Release
- Updated brace-expansion to 5.0.12 and fast-uri to 3.1.8 to resolve multiple CVEs. Pull request #23407
- MATCH queries now disallow filters and constraints on variables that reference documents defined outside the MATCH pattern. Pull request #23392
- Client tools arangodump, arangorestore, arangoexport, arangobench, and arangobackup now request and renew JWT tokens automatically when started with username and password. Pull request #23342
- MDI index queries in write transactions now stay within their index to prevent returning duplicate documents. Pull request #23380
- Improved floating point number calculation in array functions to handle larger ranges without extra elements. Pull request #23330
- Fixed SUBSTITUTE function to handle empty replacement strings correctly. Pull request #23353
- Fixed AQL REVERSE function to keep characters above U+FFFF intact instead of breaking them into replacement characters. Pull request #23376
- Document validation is now ignored during initial syncing to prevent replication failures from stale vertex references. Pull request #23368
Why it matters
Two patch releases address stability and security issues across the 3.12 and 3.11 branches. Multiple AQL query fixes improve correctness for MATCH patterns, regex matching, sparse indexes, and string operations. Client tooling enhancements streamline authentication workflows.
Changelog entry
- Security: Updated brace-expansion to 5.0.12 and fast-uri to 3.1.8 to resolve CVE-2026-102276, CVE-2026-102277, CVE-2026-102278, and CVE-2026-86472 Pull request #23407
- AQL: MATCH queries now disallow filters and constraints on variables referencing external documents Pull request #23392
- Tools: arangodump, arangorestore, arangoexport, arangobench, and arangobackup now automatically request and renew JWT tokens Pull request #23342
- AQL: Fixed MDI index queries in write transactions to prevent duplicate document results Pull request #23380
- AQL: Fixed SUBSTITUTE function to correctly handle empty replacement strings Pull request #23353
- AQL: Fixed REVERSE function to preserve characters above U+FFFF instead of breaking them Pull request #23376
- AQL: Fixed REGEX_MATCHES to correctly handle empty input strings Pull request #23377
- AQL: Fixed sparse MDI index queries to accept non-comparison filter conditions Pull request #23378
- Replication: Document validation now ignored during initial syncing to prevent stale vertex reference failures Pull request #23368
- Fixed floating point calculation in array functions to handle larger numeric ranges Pull request #23330
- Fixed web UI error message when creating indexes with arangosearch view links Pull request #23354
- Fixed use-after-free vulnerability in JWT token renewal Pull request #23366
Shipped v3.12.12.1 and v3.11.14.6 with security updates and fixes for AQL queries, client authentication, and MDI indexes. MATCH now validates reference constraints, and REVERSE correctly handles emoji and special characters.
This week we released v3.12.12.1 and v3.11.14.6, addressing security vulnerabilities and improving query reliability. Updates include stricter MATCH constraint validation, JWT token auto-renewal in client tools, fixes for MDI index behavior in transactions, and corrections to string and numeric operations in AQL. These releases ensure better data consistency, security, and developer experience across supported versions.
Week of September 21, 2026
What shipped
- Released version 3.12.12. Release
- Released version 3.12.11.1. Release
- Client tools arangodump, arangorestore, arangoexport, arangobench, and arangobackup now request and renew JWT tokens from the server when started with username and password. Pull request #23341
- Arangodump, arangorestore, and arangosh now renew JWT tokens during execution to prevent timeouts on long-running operations. Pull request #23308
- Vector index is now enabled by default in all setups. Pull request #23333
- Added maximum WAL point TTL to prevent clients from indefinitely pinning RocksDB WAL. Pull request #23339
- ArangoSearch stats API now returns information about all indexes across all ArangoSearch stores instead of just the first store. Pull request #23303
- Fixed graph traversal bug where integer underflow caused the server to skip edges when refilling cache. Pull request #23316
- Fixed AQL UPDATE with keepNull: false on non-disjoint SmartGraphs leaving attributes in the shadow collection. Pull request #23318
- Metric names are now escaped for Prometheus output compatibility. Pull request #23340
Why it matters
Two patch releases ship this week with critical fixes for JWT token handling in long-running operations and graph traversal. The default enablement of vector indexing and improved ArangoSearch stats reporting expand functionality for users working with advanced index types and analytics.
Changelog entry
- Released v3.12.12 Release
- Released v3.12.11.1 Release
- Client tools (arangodump, arangorestore, arangoexport, arangobench, arangobackup) request and renew JWT tokens via /_open/auth when started with username and password Pull request #23341
- Arangodump, arangorestore, and arangosh renew JWT tokens if they expire during long-running operations Pull request #23308
- Fixed JWT vs.
jwt_secrethandling in additional places Pull request #23346 - Vector index enabled by default in all setups Pull request #23333
- Added maximum WAL point TTL to prevent indefinite WAL pinning by clients Pull request #23339
- ArangoSearch stats API (/_admin/arangosearch/stats) now returns statistics for all indexes across all stores Pull request #23303
- Fixed graph traversal missing edges due to integer underflow when refilling cache Pull request #23316
- Fixed AQL UPDATE with keepNull: false leaving attributes in non-disjoint SmartGraph shadow collections Pull request #23318
- Metric names are now properly escaped for Prometheus output format Pull request #23340
- Separated fixed-length and variable-length relationship handling in MATCH queries Pull request #23332
- Added comprehensive unit tests for MATCH components including PatternTypes, VariableScope, and PathConstruction Pull request #23344
- Refactored MATCH path construction into dedicated logic Pull request #23310
- Fixed flaky NetworkFeature assertion in restart tests Pull request #23312
- Fixed forwarding of API version in /_arango/experimental/_admin/activities requests Pull request #23325
- Fixed StringBuffer pre-allocation in lz4Decompress with size validation Pull request #23332
- Fixed improper AstNode comparison for non-const objects that generated invalid vpack Pull request #23311
- Made OBJECT comparison order-independent when keys are safe to reorder Pull request #23313
- Fixed TSAN race conditions in faiss IVF_HNSW parallel searches Pull request #23327
3.12.12 and 3.12.11.1 released. JWT tokens now auto-renew in client tools for long operations. Vector index enabled by default. Graph traversal and SmartGraph UPDATE bugs fixed.
Versions 3.12.12 and 3.12.11.1 are now available. Key improvements include automatic JWT token renewal in arangodump, arangorestore, and other client tools to prevent timeout failures, vector index enabled by default, expanded ArangoSearch stats to cover all indexes, and fixes for graph traversal edge skipping and SmartGraph UPDATE operations.
Week of September 14, 2026
What shipped
- Fixed returnNew/returnOld incorrectly being stored as document attributes in shadow collections on non-disjoint SmartGraphs, causing inconsistency between edge halves. Pull request #23279
- Fixed shutdown crash caused by a race condition in the heartbeat thread that did not wait for scheduled work items to complete. Pull request #23299
- Fixed UI login for users without _system database access. Pull request #23301
- Fixed SUBSTITUTE function to return empty string instead of null when operating on empty input strings. Pull request #23297
- Security fix applied to address COR-984. Pull request #23295
- Made swagger.json publicly available again at /_admin/aardvark/api/ for REST API documentation without authentication. Pull request #23291
- Restored public access to / root path for Aardvark UI when authentication-system-only is disabled. Pull request #23281
- Improved arangodump error messages to include actual server errors when connection attempts fail. Pull request #23274
- Hardened JavaScript sandbox settings and removed broken routes in /_admin/foxx/* endpoints. Pull request #23298
- Added typed AST node wrappers for MATCH and PATTERN_MATCH_EXPRESSION with updated builder and normalizer entry points. Pull request #23305
Why it matters
This week includes fixes for critical issues affecting SmartGraphs, server stability, and UI accessibility. Security improvements and hardened JavaScript sandbox settings strengthen the platform. Refactoring of MATCH query planning code improves code organization and maintainability.
Changelog entry
- Fixed returnNew/returnOld being incorrectly stored as document attributes in shadow collections on non-disjoint SmartGraphs Pull request #23279
- Fixed shutdown crash caused by race condition in heartbeat thread Pull request #23299
- Fixed UI login for users without _system database access Pull request #23301
- Fixed SUBSTITUTE function returning null instead of empty string on empty input Pull request #23297
- Security fix for COR-984 Pull request #23295
- Restored public access to swagger.json at /_admin/aardvark/api/ Pull request #23291
- Restored public access to root path / for Aardvark UI Pull request #23281
- Improved arangodump error messages to display actual server errors Pull request #23274
- Hardened JavaScript sandbox settings and removed broken routes in Foxx endpoints Pull request #23298
- Added typed AST node wrappers for MATCH query planning Pull request #23305
Week 25 shipped: SmartGraph attribute fix, shutdown race condition fix, UI login for non-_system users, SUBSTITUTE on empty strings, API documentation access restored, and security improvements.
This week's release includes important fixes for SmartGraph consistency issues, a critical shutdown race condition, and improved UI accessibility for users without _system access. We've also restored public access to API documentation and strengthened security with hardened sandbox settings. These changes address stability, usability, and security concerns identified by the community.