ArcadeDB 26.6.1: TLS for HA Clusters, Durability Hardening & Security

We’re pleased to announce ArcadeDB 26.6.1, a stability, durability, and security focused release with 280+ commits resolving 66 issues. Where 26.5.1 was about new retrieval features, 26.6.1 is about making the engine harder to break: encrypted HA clusters, crash-safe durability, and a broad security hardening pass, on top of a long list of OpenCypher, SQL, vector, and wire-protocol fixes.

Major Highlights

TLS/SSL Across the HA Cluster

The Raft-based High Availability cluster can now run fully encrypted. Inter-node replication traffic supports SSL/TLS, and the snapshot installer was fixed so a follower can download a leader snapshot over the HTTPS listener instead of failing with Unsupported or unrecognized SSL message. Encrypted clustering is now a first-class deployment option for regulated and zero-trust environments.

Durability & Crash-Recovery Hardening

A large batch of fixes closes data-integrity gaps across the storage, WAL, and serialization layers, so committed transactions survive crashes and power loss, and recovery never silently drops data:

• The WAL is fsynced on commit by default, and data files are fsynced before WAL files are deleted on a clean close.
• Crash recovery aborts on a WAL version gap and preserves the WAL files instead of silently skipping it.
• MutablePage.move no longer mis-tracks the modified range on backward shifts, so defragmentation bytes are never omitted from the WAL.
• Binary serialization now writes a property count that matches the bytes written, and handles partial reads via readFully.
• Short-write / short-read returns are respected in the paginated component file.
• LZ4 compression no longer corrupts data when the source buffer position is non-zero.
• The Simple-8b codec no longer silently truncates Long.MAX_VALUE / Long.MIN_VALUE.
• migratedFileIds is persisted in schema.json, so compaction no longer silently drops in-flight transactions across a restart.
• A NegativeArraySizeException on transaction commit was fixed.

These are the kind of fixes you never see in a benchmark but feel in production: the database does what it promised on the unhappy path.

Security Hardening

• All schema mutators now require the UPDATE_SCHEMA permission (previously only createProperty was gated).
• IMPORT DATABASE now validates its source and requires admin privilege, closing SSRF and local-file-inclusion vectors.
• SQL injection in RemoteVertex.newEdge was fixed by switching to parameter binding (which also fixes breakage on apostrophes).
• JavaScript injection in the polyglot engine was closed by replacing a “looks-like-JSON” source-concatenation heuristic with a safe Value.execute() call.
• A full CodeQL cleanup resolved open Java and JavaScript code-scanning alerts at their true sources (workflow permissions, ReDoS, path-injection).

Major Fixes

High Availability & Clustering

• TimeSeries data now replicates correctly across an HA cluster, and a compaction/append deadlock that caused a WAL version gap on Raft followers was eliminated.
• Concurrent single-row time-series INSERTs no longer silently lose samples.
• Bolt writes to a follower no longer fail with “no authenticated user in the current security context”.
• PeerAddressAllowlistFilter no longer rejects legitimate peers during a Kubernetes DNS-resolution race on startup or restart.
• New configurable paths for read-only and containerized deployments: arcadedb.ha.raftStorageDirectory, a configurable server log directory, and arcadedb.ha.clusterTokenPath to read the cluster shared secret from a file.
• RemoteDatabase no longer reuses a session id across servers on HA failover during an open transaction; a clear TransactionException is raised on server switch instead.
• New STICKY strategy pins HTTP transactions to a concrete cluster member.
• /api/v1/server?mode=cluster returns the ha section again after the Raft migration.
• New “Force Resync” button in Studio to recover a diverged follower from the leader.

OpenCypher

• CREATE INDEX now implicitly creates the referenced property (Neo4j-style lazy schema).
• nodes(), relationships(), and length() on variable-length path patterns (e.g. [*1..3]) are now implemented.
• Records written via SQL are now visible to subsequent Cypher queries (and vice versa) within the same transaction.
• EXPLAIN no longer fails with an idempotency error on a multi-statement query containing CREATE.
• Label disjunction (n:A|B) no longer returns zero rows.
• allShortestPaths() returns all co-shortest paths instead of just one.
• MERGE uses a bound anchor as the traversal start instead of a full edge-type scan, and no longer crashes on single-quote property values or rebinds variables from an OPTIONAL MATCH null endpoint.
• DATETIME comparison with datetime() no longer returns zero rows, and results are now consistent between parameterized and hard-coded values.

SQL

• IN :param with a collection parameter now returns rows when an index is used.
• MOVE VERTEX no longer generates an internal error.
• expand() projection honors its AS alias instead of always being named value.
• IN (SELECT …) no longer always returns empty.
• MERGE on a UNIQUE-indexed property no longer throws on a duplicate key when the same key appears twice in a batch (matching Neo4j semantics).
• node.* and rel.* functions no longer silently return null from SQL.
• TimeSeries timestamps are now returned in queries.
• New cypherRID() SQL function and asCypherRID() method for interoperating with Cypher numeric ids.

Vector & Index

• TRUNCATE TYPE no longer resets an LSM_VECTOR index dimension to 0, nor leaves UNIQUE indexes in an inconsistent state.
• LSMVectorIndex now converts JVector’s EUCLIDEAN return to L2² distance in all search paths, so K-NN no longer returns the worst matches first.
• REBUILD INDEX now works for BY ITEM indexes.
• vector.fuse() is now recognized as a SQL function.

Wire Protocols

• Bolt: parameterized Cypher MATCH queries via the JavaScript neo4j-driver now work; integer property values are no longer coerced to strings after CREATE INDEX.
• PostgreSQL: scalar columns are advertised with native OIDs.
• gRPC: correct exceptions (NOT_FOUND for missing records), proper LocalDateTime / LocalDate handling, and InsertStream no longer rolls back a whole stream on a commit-time duplicate with CONFLICT_IGNORE.
• HTTP: DuplicatedKeyException now returns 409 Conflict instead of 503 Service Unavailable.

Studio & Operations

• Optional production-mode Studio, enabled by a global setting on request.
• New show/hide toggle for the Appearance section in the graph side panel.
• AI assistant flow, database selection, and layout improvements; query profiler “Analyze with AI”; refreshed server and profiler metrics.
• New offline build mode for the distribution builder.

Dependencies

Notable upgrades include Netty 4.2.14.Final, Undertow 2.4.1.Final, Protobuf 4.35.0, JLine 4.1.3, JUnit Jupiter 6.1.0, Jackson Databind 2.21.4, Apache Commons Configuration 2.15.1, Swagger 2.2.50, SLF4J 2.0.18, and Logback 1.5.33, plus the usual round of Studio frontend, e2e harness, and CI updates.

Getting Started with 26.6.1

Docker

docker pull arcadedata/arcadedb:26.6.1

Visit our Docker Hub repository for more information.

Maven

<dependency>
    <groupId>com.arcadedb</groupId>
    <artifactId>arcadedb-engine</artifactId>
    <version>26.6.1</version>
</dependency>

All artifacts are available on Maven Central.

Documentation

For detailed information on features and usage, refer to our comprehensive documentation.

Compatibility Note

This release maintains 100% compatibility with previous database formats, meaning no export/import is required when upgrading. As always, we recommend creating a database backup before upgrading.

Download ArcadeDB 26.6.1 now: GitHub Releases

Thanks to everyone in the community who reported issues, opened PRs, and helped shape this release.

Luca Garulli ArcadeDB Founder