What arangodb/arangodb shipped

This week: sorted COLLECT only reuses a SORT starting with the group variables, fullCount no longer double-counts empty COLLECT AGGREGATE, MATCH fixes for unbound vertices and projected variable-length endpoints, and IVF index profiling stats.

This week's changes to arangodb/arangodb include several query correctness fixes. A sorted COLLECT now reuses a preceding SORT only when it starts with the group variables, so each group is returned once. fullCount no longer reports 2 for an empty COLLECT AGGREGATE with LIMIT, and MATCH now reports a parse error for an unbound vertex without a label instead of an internal error. Inline projections on the endpoints of a variable-length MATCH segment are now reflected in results. The IVF vector index exposes profiling statistics on searches and centroid selection, the server checks the x-arango-api-version header, the temporary directory is set up thread-safely, and collections are accessed from a transaction only after begin succeeded.

This week: fixed fullCount for COLLECT WITH COUNT, subquery LENGTH/COUNT with COLLECT, skipped index lookups in OR conditions, smart edge joins, and two traversal projection bugs. Invalid API versions now get a clear 404.

This week's changes include several AQL correctness fixes: fullCount reporting one too high for COLLECT WITH COUNT with LIMIT, LENGTH and COUNT of a subquery with COLLECT returning null or zero, an IndexNode skipping index lookups of an OR condition when an output block filled exactly, smart edge joins losing edges on non-disjoint SmartGraphs, and two traversal projection bugs that produced null attributes or too few results. Projection pushdown now also covers MATCH collection scans. PUT /_api/query/properties requires a new database-scoped UpdateQueryProperties permission, invalid API versions in the URL are rejected with a 404 listing valid prefixes, and a new startup option caps global memory for concurrent request body decompression.

New RBAC permissions let admins monitor and kill other users' transactions and AQL queries. Also: configurable decompression size limit, AQL condition fixes, and RocksDB iterator bounds in write transactions.

This week's updates include new RBAC permissions: AdminMonitorTransactions and AdminKillTransactions let admins inspect and abort other users' stream transactions via API, while AdminMonitorAqlQueries and AdminKillAqlQueries enable monitoring and killing others' AQL queries. A configurable decompression size limit now protects against oversized request bodies, defaulting to 512 MiB. Several AQL fixes address ternary subqueries, IN with range operators, and MATCH projection warnings. Cache manager limits are corrected, and RocksDB now applies iterator bounds in write transactions.

This week: AQL correctness fixes. AND/OR now behave commutatively, smart-joins only joins across SatelliteCollections, and constant attribute propagation is restricted to variables. Indexes are no longer used for non-deterministic lookups.

This week we shipped a set of AQL correctness fixes. AND and OR are now treated as commutative, smart-joins only joins across SatelliteCollections, and propagate-constant-attributes only uses attributes of variables, so affected queries no longer return too many or too few rows. The optimizer no longer chooses an index when the lookup value is non-deterministic. Arithmetic now handles integers and doubles separately, ROUND and TO_NUMBER handle corner cases, and LOWER, UPPER, CONTAINS and FIND_LAST are fixed.

AQL fix: sparse indexes are used only for OR branches that exclude null, so results are correct. SUBSTITUTE no longer skips matches. Hotbackup list always returns a valid time stamp. Several Join Node issues fixed. arangosh error handling fixed.

This week a few correctness fixes landed. The optimizer now uses a sparse index for an OR branch only when that branch excludes null, so documents matching through the other branch are no longer dropped. SUBSTITUTE no longer skips a match when a replacement overlaps another search value's next match. The hotbackup list API now always returns a valid time stamp. Several small Join Node issues were fixed, including missing copies in clone and an incorrect strategy reset on skip. arangosh error handling was also fixed.

Shipped v3.12.12.1 and v3.11.14.6 with security updates and fixes for AQL queries, client authentication, and MDI indexes. MATCH now validates reference constraints, and REVERSE correctly handles emoji and special characters.

This week we released v3.12.12.1 and v3.11.14.6, addressing security vulnerabilities and improving query reliability. Updates include stricter MATCH constraint validation, JWT token auto-renewal in client tools, fixes for MDI index behavior in transactions, and corrections to string and numeric operations in AQL. These releases ensure better data consistency, security, and developer experience across supported versions.

3.12.12 and 3.12.11.1 released. JWT tokens now auto-renew in client tools for long operations. Vector index enabled by default. Graph traversal and SmartGraph UPDATE bugs fixed.

Versions 3.12.12 and 3.12.11.1 are now available. Key improvements include automatic JWT token renewal in arangodump, arangorestore, and other client tools to prevent timeout failures, vector index enabled by default, expanded ArangoSearch stats to cover all indexes, and fixes for graph traversal edge skipping and SmartGraph UPDATE operations.

Week 25 shipped: SmartGraph attribute fix, shutdown race condition fix, UI login for non-_system users, SUBSTITUTE on empty strings, API documentation access restored, and security improvements.

This week's release includes important fixes for SmartGraph consistency issues, a critical shutdown race condition, and improved UI accessibility for users without _system access. We've also restored public access to API documentation and strengthened security with hardened sandbox settings. These changes address stability, usability, and security concerns identified by the community.