What arangodb/arangodb shipped
Generated by FoxPlug from public activity — not affiliated with Arangodb.
Week of September 14, 2026
What shipped
- Fixed returnNew/returnOld incorrectly being stored as document attributes in shadow collections on non-disjoint SmartGraphs, causing inconsistency between edge halves. Pull request #23279
- Fixed shutdown crash caused by a race condition in the heartbeat thread that did not wait for scheduled work items to complete. Pull request #23299
- Fixed UI login for users without _system database access. Pull request #23301
- Fixed SUBSTITUTE function to return empty string instead of null when operating on empty input strings. Pull request #23297
- Security fix applied to address COR-984. Pull request #23295
- Made swagger.json publicly available again at /_admin/aardvark/api/ for REST API documentation without authentication. Pull request #23291
- Restored public access to / root path for Aardvark UI when authentication-system-only is disabled. Pull request #23281
- Improved arangodump error messages to include actual server errors when connection attempts fail. Pull request #23274
- Hardened JavaScript sandbox settings and removed broken routes in /_admin/foxx/* endpoints. Pull request #23298
- Added typed AST node wrappers for MATCH and PATTERN_MATCH_EXPRESSION with updated builder and normalizer entry points. Pull request #23305
Why it matters
This week includes fixes for critical issues affecting SmartGraphs, server stability, and UI accessibility. Security improvements and hardened JavaScript sandbox settings strengthen the platform. Refactoring of MATCH query planning code improves code organization and maintainability.
Changelog entry
- Fixed returnNew/returnOld being incorrectly stored as document attributes in shadow collections on non-disjoint SmartGraphs Pull request #23279
- Fixed shutdown crash caused by race condition in heartbeat thread Pull request #23299
- Fixed UI login for users without _system database access Pull request #23301
- Fixed SUBSTITUTE function returning null instead of empty string on empty input Pull request #23297
- Security fix for COR-984 Pull request #23295
- Restored public access to swagger.json at /_admin/aardvark/api/ Pull request #23291
- Restored public access to root path / for Aardvark UI Pull request #23281
- Improved arangodump error messages to display actual server errors Pull request #23274
- Hardened JavaScript sandbox settings and removed broken routes in Foxx endpoints Pull request #23298
- Added typed AST node wrappers for MATCH query planning Pull request #23305
Week 25 shipped: SmartGraph attribute fix, shutdown race condition fix, UI login for non-_system users, SUBSTITUTE on empty strings, API documentation access restored, and security improvements.
This week's release includes important fixes for SmartGraph consistency issues, a critical shutdown race condition, and improved UI accessibility for users without _system access. We've also restored public access to API documentation and strengthened security with hardened sandbox settings. These changes address stability, usability, and security concerns identified by the community.