---
type: Concept
title: ScalarDB 3.18 Release Notes
description: This page includes a list of release notes for ScalarDB 3.18.
resource: https://scalardb.scalar-labs.com/docs/3.18/releases/release-notes/
tags:
- scalardb
- v3.18
- phase:design
- section:about-scalardb
- edition:community
- edition:enterprise-standard
- edition:enterprise-premium
status: stable
product: scalardb
product_title: ScalarDB
version: '3.18'
patch_version: 3.18.1
doc_id: releases/release-notes
lifecycle_phase: design
breadcrumb:
- About ScalarDB
editions:
- Community
- Enterprise Standard
- Enterprise Premium
generated:
  by: process:okf-build/1.0.0
  at: '2026-08-04T23:50:49Z'
sources:
- id: docs-scalardb
  resource: https://github.com/scalar-labs/docs-scalardb/blob/6126dfe2f56389351d88b134752618641f9771dd/versioned_docs/version-3.18/releases/release-notes.mdx
  title: ScalarDB documentation source (MDX)
  author: process:scalar-labs/docs-scalardb
  last_modified: '2026-08-04T15:05:02Z'
---

# ScalarDB 3.18 Release Notes

This page includes a list of release notes for ScalarDB 3.18.

## v3.18.1

**Release date:** August 2, 2026

### Summary

This release improves `repairTable` to avoid unnecessary metadata and indexing-policy updates, adds support for `jdbc:spanner` connection strings, fixes multiple Consensus Commit transaction handling issues, improves ScalarDB Cluster metadata repair and ScalarDB SQL SELECT execution, resolves Cluster rollback/pause and SQL statement cache bugs, and upgrades several dependencies to address security vulnerabilities.

### Community edition

#### Improvements

- Improved `repairTable` to skip rewriting a table's metadata when it is already up to date (and, for Cosmos DB, to skip updating the container indexing policy when it already matches), avoiding unnecessary writes. ([#3613](https://github.com/scalar-labs/scalardb/pull/3613))

#### Bug fixes

- Accepts connection string starting with `jdbc:spanner` to connect to Spanner (emulator, omni, and cloud instance) in addition to the already supported `jdbc:cloudspanner` pattern. ([#3559](https://github.com/scalar-labs/scalardb/pull/3559))
- Fixed an issue in Consensus Commit where a `Get` operation using a secondary index could fail with an `IllegalArgumentException` when another record with the same indexed value was concurrently being deleted and inserted. ([#3607](https://github.com/scalar-labs/scalardb/pull/3607))
- Fixed an issue in Consensus Commit where a read-only transaction could fail when coordinator write omission on read-only was disabled and coordinator group commit was enabled. ([#3614](https://github.com/scalar-labs/scalardb/pull/3614))
- Fixed a bug where aborting an in-flight, group-committed transaction by ID via `DistributedTransactionManager.rollback(String)` / `abort(String)` could be lost when the Coordinator group commit feature was enabled. ([#3619](https://github.com/scalar-labs/scalardb/pull/3619))
- Fixed an issue in the Consensus Commit transaction manager where a read could return a stale (pre-commit) value for a record whose writing transaction committed concurrently during lazy recovery. ([#3621](https://github.com/scalar-labs/scalardb/pull/3621))
- Upgraded the Jackson, Netty, Azure Cosmos DB, and Azure Blob Storage libraries to fix security issues: [CVE-2026-42579](https://github.com/advisories/GHSA-cm33-6792-r9fm), [CVE-2026-42583](https://github.com/advisories/GHSA-mj4r-2hfc-f8p6), [CVE-2026-42584](https://github.com/advisories/GHSA-57rv-r2g8-2cj3), [CVE-2026-42587](https://github.com/advisories/GHSA-f6hv-jmp6-3vwv), [CVE-2026-44249](https://github.com/advisories/GHSA-3qp7-7mw8-wx86), [CVE-2026-45416](https://github.com/advisories/GHSA-x4gw-5cx5-pgmh), [CVE-2026-45674](https://github.com/advisories/GHSA-676x-f7gg-47vc), [CVE-2026-47691](https://github.com/advisories/GHSA-5pvg-856g-cp85), [CVE-2026-50010](https://github.com/advisories/GHSA-c653-97m9-rcg9), [CVE-2026-54512](https://github.com/advisories/GHSA-j3rv-43j4-c7qm), [CVE-2026-54513](https://github.com/advisories/GHSA-rmj7-2vxq-3g9f), [CVE-2026-55831](https://github.com/advisories/GHSA-6jqx-86gh-f27w), [CVE-2026-55833](https://github.com/advisories/GHSA-mvh2-crg5-v77c), [CVE-2026-56745](https://github.com/advisories/GHSA-jppx-w49h-x2qq), [CVE-2026-59901](https://github.com/advisories/GHSA-558v-64gr-wgg4), and [GHSA-r7wm-3cxj-wff9](https://github.com/advisories/GHSA-r7wm-3cxj-wff9) ([#3754](https://github.com/scalar-labs/scalardb/pull/3754))
- Upgraded the PostgreSQL JDBC driver to fix security issues: [CVE-2026-42198](https://github.com/advisories/GHSA-98qh-xjc8-98pq) and [CVE-2026-54291](https://github.com/advisories/GHSA-j92g-9f8w-j867) ([#3758](https://github.com/scalar-labs/scalardb/pull/3758))

### Enterprise edition

#### Enhancements

##### ScalarDB SQL

- Added `@AutoConfigureBefore` to `ScalarDbJdbcConfiguration` to explicitly declare auto-configuration ordering relative to Spring Boot's auto-configs.

#### Improvements

##### ScalarDB Cluster

- ScalarDB Cluster now repairs its authentication and ABAC system metadata tables at node startup to create the companion before-image secondary indexes required after upgrading, so deployments upgraded from an earlier version gain them automatically without a manual `repairTable()`.

##### ScalarDB SQL

- Enabled the read-only optimization for one-shot SELECT statements and SELECT-only batches.

#### Bug fixes

##### ScalarDB Cluster

- Fixed a bug where a `rollback` that exceeded the cluster's request-forwarding hop limit was silently reported as successful instead of surfacing the failure, which could leave records prepared until lazy recovery.
- Fixed a race condition where pausing a cluster node or the Transaction Coordinator could report success while the node remained unpaused. This could happen when an unpause or another pause request was issued concurrently, and also when a pause that waits for outstanding requests timed out after an earlier pause had already succeeded.
- Upgraded the Jackson, Netty, and LangChain4j libraries to fix security issues: [CVE-2026-40682](https://github.com/advisories/GHSA-4v8g-86x5-3vrc), [CVE-2026-42027](https://github.com/advisories/GHSA-cx4m-2p55-rw7j), [CVE-2026-42440](https://github.com/advisories/GHSA-659w-93r5-9j6m), [CVE-2026-42583](https://github.com/advisories/GHSA-mj4r-2hfc-f8p6), [CVE-2026-42584](https://github.com/advisories/GHSA-57rv-r2g8-2cj3), [CVE-2026-42587](https://github.com/advisories/GHSA-f6hv-jmp6-3vwv), [CVE-2026-44249](https://github.com/advisories/GHSA-3qp7-7mw8-wx86), [CVE-2026-45416](https://github.com/advisories/GHSA-x4gw-5cx5-pgmh), [CVE-2026-50010](https://github.com/advisories/GHSA-c653-97m9-rcg9), [CVE-2026-54512](https://github.com/advisories/GHSA-j3rv-43j4-c7qm), [CVE-2026-54513](https://github.com/advisories/GHSA-rmj7-2vxq-3g9f), [CVE-2026-55405](https://github.com/advisories/GHSA-2mfg-cc43-9pcj), [CVE-2026-55831](https://github.com/advisories/GHSA-6jqx-86gh-f27w), [CVE-2026-55833](https://github.com/advisories/GHSA-mvh2-crg5-v77c), [CVE-2026-56745](https://github.com/advisories/GHSA-jppx-w49h-x2qq), [CVE-2026-59901](https://github.com/advisories/GHSA-558v-64gr-wgg4), and [GHSA-r7wm-3cxj-wff9](https://github.com/advisories/GHSA-r7wm-3cxj-wff9)
- Upgraded the Bouncy Castle library and the grpc_health_probe binary to fix security issues: [CVE-2025-14813](https://github.com/advisories/GHSA-574f-3g2m-x479), [CVE-2026-5598](https://github.com/advisories/GHSA-p93r-85wp-75v3), [CVE-2026-25681](https://github.com/advisories/GHSA-w9p8-pvxh-rxpj), [CVE-2026-27136](https://github.com/advisories/GHSA-m9x8-m34x-fj9q), [CVE-2026-27145](https://github.com/advisories/GHSA-4279-q6mj-392r), [CVE-2026-33811](https://github.com/advisories/GHSA-497x-jcxf-m478), CVE-2026-33814, [CVE-2026-39820](https://github.com/advisories/GHSA-p9h5-jm8x-mjm5), [CVE-2026-39821](https://github.com/advisories/GHSA-w2q5-6q6x-x959), [CVE-2026-39822](https://github.com/advisories/GHSA-xcgv-8mv7-v8c7), [CVE-2026-39836](https://github.com/advisories/GHSA-8g2r-hhvj-mv99), [CVE-2026-42499](https://github.com/advisories/GHSA-xq5j-9r39-c3vf), and [CVE-2026-42504](https://github.com/advisories/GHSA-h524-452v-82p9)

##### ScalarDB SQL

- Fixed a statement cache regression where non-parameterized DML statements occupied cache slots intended for parameterized SQL. Cache eligibility is now correctly gated on the presence of bind markers in the parsed SQL.

## v3.18.0

**Release date:** May 1, 2026

### Summary

This release includes a lot of enhancements, improvements, security issue fixes, and bug fixes.

:::warning Backward-incompatible changes

- **JDBC connection pool migrated from Apache Commons DBCP2 to HikariCP:**
  - The following configuration properties are no longer supported. They are ignored, with a warning logged, if set:
- `scalar.db.jdbc.connection_pool.max_idle`
- `scalar.db.jdbc.table_metadata.connection_pool.max_idle`
- `scalar.db.jdbc.admin.connection_pool.max_idle`
- `scalar.db.jdbc.prepared_statements_pool.enabled`
- `scalar.db.jdbc.prepared_statements_pool.max_open`
  - Prepared statement pooling is no longer available because HikariCP has no equivalent feature.
  - Connection pool default behavior follows HikariCP rather than DBCP2, which may change runtime behavior even without configuration changes (for example, connection acquisition timeout and idle eviction).
- **Existing tables require `repairTable()` to create the new before-image secondary index.** Index-based `Get`, `Scan`, and `ScanAll` in Consensus Commit now rely on a companion `before_<col>` index. Until you run `repairTable()` on each existing table, ScalarDB logs a warning at startup and index-based reads fall back to the previous behavior, which may miss records whose indexed column is being concurrently updated. The configuration `scalar.db.consensus_commit.index.eventually_consistent_read.enabled` is provided as an opt-out but is not recommended for new workloads.
- **MySQL Connector/J replaced with MariaDB Connector/J.** SSL is no longer enabled by default. If you connect to MySQL 8.0 or later with `caching_sha2_password` authentication, add `sslMode=REQUIRED` or `allowPublicKeyRetrieval=true` to your JDBC URL. No action is required for `jdbc:mysql://` URLs because ScalarDB automatically appends `permitMysqlScheme` for compatibility.
- **`BigIntColumn.MAX_VALUE` and `BigIntColumn.MIN_VALUE` constants have been removed.** Code that referenced them must use `Long.MAX_VALUE` and `Long.MIN_VALUE` instead.

:::

### Community edition

#### Enhancements

- Added `AuthAdmin.getRole(roleName)`. ([#3238](https://github.com/scalar-labs/scalardb/pull/3238))
- Added operation-level attributes to allow cross-partition scan, filtering, and ordering on a per-operation basis without requiring global configuration. ([#3425](https://github.com/scalar-labs/scalardb/pull/3425))
- Added `DistributedTransactionAdmin.hasPrivilege()`. ([#3432](https://github.com/scalar-labs/scalardb/pull/3432))
- Added `AuthenticationMethod` enum and authentication-method-aware user management APIs to `AuthAdmin` to support OIDC authentication. ([#3433](https://github.com/scalar-labs/scalardb/pull/3433))
- Added `attributes` parameter to `DistributedTransactionManager` `begin` and `start` methods, enabling transaction-scoped attribute configuration. CRUD methods on `DistributedTransactionManager` also pass the operation's attributes to the internally begun transaction. Also added support for specifying the isolation level per transaction in Consensus Commit via the `cc-transaction-isolation` attribute. ([#3466](https://github.com/scalar-labs/scalardb/pull/3466) [#3517](https://github.com/scalar-labs/scalardb/pull/3517) [#3540](https://github.com/scalar-labs/scalardb/pull/3540))
- Added support for Google Cloud Spanner as a JDBC storage, via its PostgreSQL-compatible dialect. ([#3510](https://github.com/scalar-labs/scalardb/pull/3510))

#### Improvements

- Extended the applicability of one-phase commit optimization in the Consensus Commit protocol. This allows one-phase commit to be used even in SERIALIZABLE isolation level when the transaction only reads records that it subsequently updates, improving performance for read-modify-write workloads. ([#3295](https://github.com/scalar-labs/scalardb/pull/3295))
- Added batch execution support for mutate operations in the JDBC adapter to improve performance when executing multiple mutations. Mutations with the same SQL statement are now grouped and executed as a batch. ([#3304](https://github.com/scalar-labs/scalardb/pull/3304))
- Migrated the JDBC adapter's connection pooling library from Apache Commons DBCP2 to HikariCP for improved performance and reliability. ([#3305](https://github.com/scalar-labs/scalardb/pull/3305))
- Changed the behavior of Consensus Commit transactions to allow Insert/Upsert/Update operations after Delete on the same record within the same transaction. Previously, this operation threw an `IllegalArgumentException`, but now it properly handles the case by treating it as a new record insertion with null values for unspecified columns. ([#3319](https://github.com/scalar-labs/scalardb/pull/3319))
- Added @CheckReturnValue annotation to Get/Scan builders. ([#3320](https://github.com/scalar-labs/scalardb/pull/3320))
- Added support for setting null values on secondary index columns in DynamoDB. When a null value is set, the attribute is removed from the item and the record will not appear in secondary index scans. ([#3326](https://github.com/scalar-labs/scalardb/pull/3326))
- Inserting or updating records with TIME (microsecond precision), TIMESTAMP (millisecond precision), and TIMESTAMPTZ (millisecond precision) column values will truncate out-of-range precision rather than throwing an exception. ([#3393](https://github.com/scalar-labs/scalardb/pull/3393))
- Fixed a correctness issue in index-based Get, Scan, and ScanAll operations in Consensus Commit where records whose indexed column was being concurrently updated by another transaction could be missed. ScalarDB now maintains a companion before-image secondary index for each user-defined secondary index on a non-primary-key column and uses it to recover PREPARED/DELETED records during index reads. ([#3419](https://github.com/scalar-labs/scalardb/pull/3419) [#3463](https://github.com/scalar-labs/scalardb/pull/3463))
- Replaced MySQL Connector/J with MariaDB Connector/J to resolve GPLv2 licensing concerns. ([#3428](https://github.com/scalar-labs/scalardb/pull/3428))
- Shortened JDBC index names using a hash when they exceed the maximum identifier length supported by the underlying database. ([#3481](https://github.com/scalar-labs/scalardb/pull/3481))
- Relaxed the BigInt value range restriction (`-2^53` to `2^53`) that previously applied to all storage backends. This restriction now only applies to Cosmos DB and Object Storage. Other backends (JDBC, Cassandra, DynamoDB) now support the full Java long range for BigInt columns. ([#3490](https://github.com/scalar-labs/scalardb/pull/3490))
- Changed the Oracle BIGINT column type mapping from NUMBER(16) to NUMBER(19) to support the full Java long range. ([#3507](https://github.com/scalar-labs/scalardb/pull/3507))
- Changed the deprecation policy so that APIs and configurations marked as deprecated will now be removed in 4.0.0 instead of 5.0.0. ([#3520](https://github.com/scalar-labs/scalardb/pull/3520))

#### Bug fixes

- Fixed option issues in Object Storage adapter. ([#3237](https://github.com/scalar-labs/scalardb/pull/3237))
- On Oracle, when importing a table with a column using the `NUMBER(1)` data type, which is usually used for BOOLEAN data, that column can now be mapped to ScalarDB BOOLEAN using ScalarDB Schema Loader `override-columns-type` setting. ([#3239](https://github.com/scalar-labs/scalardb/pull/3239))
- Fix to increase the maximum allowed string length with Object Storage. ([#3248](https://github.com/scalar-labs/scalardb/pull/3248))
- Updated the upper limit value displayed in the error message for data size limitation in Object Storage adapter. ([#3264](https://github.com/scalar-labs/scalardb/pull/3264))
- Added explicit commits for Oracle database when using SERIALIZABLE isolation level to ensure snapshot updates after each operation. ([#3294](https://github.com/scalar-labs/scalardb/pull/3294))
- Upgraded the Jackson library to fix a security issue: [GHSA-72hv-8253-57qq](https://github.com/advisories/GHSA-72hv-8253-57qq "GHSA-72hv-8253-57qq") ([#3394](https://github.com/scalar-labs/scalardb/pull/3394))
- Fix `dropColumnFromTable()` dropping the secondary index even when column drop is unsupported. ([#3450](https://github.com/scalar-labs/scalardb/pull/3450))
- Upgraded the Netty library to fix security issues: [CVE-2026-33870](https://github.com/advisories/GHSA-pwqr-wmgm-9rr8 "CVE-2026-33870") and [CVE-2026-33871](https://github.com/advisories/GHSA-w9fj-cfpg-grvv "CVE-2026-33871") ([#3452](https://github.com/scalar-labs/scalardb/pull/3452))
- Fixed a bug where index-based Get and Scan operations could return incorrect results after lazy recovery rolled back a PREPARED record whose after-image index value matched the query but whose before-image (restored) value did not. ([#3488](https://github.com/scalar-labs/scalardb/pull/3488))

### Enterprise edition

#### Enhancements

##### ScalarDB Cluster

- Added `getRole()` API and equivalent to retrieve a single role by name.
- Added support for starting replication with existing backup site tables.
- Added support for the `executeBatch` API in ScalarDB Cluster SQL transactions, enabling batch execution of multiple SQL statements in a single call.
- Added client-side optimizations for SQL transactions (piggyback_begin and write_buffering) to reduce RPC overhead between the client and the cluster.
- Added support for configuring a separate gRPC port for the admin service by using the `scalar.db.cluster.node.admin.port` property.
- Added `DistributedTransactionAdmin.hasPrivilege()` to check if a specified user has a specific privilege on a table.
- Added support for the attributes parameter in transaction begin/start methods, enabling transaction-scoped configuration such as isolation level.
- Added OIDC JWT authentication support.
- Added ThreadLocal-based user-password authentication support via `CredentialsHolder`, allowing multiple users to share a single `TransactionManager`.
- Added property-based OIDC JWT authentication support for the client, allowing JWT access tokens to be passed via configuration properties.

##### ScalarDB SQL

- Added `Metadata.getRole(roleName)`
- Added support for Spring Boot 4 in Spring Data JDBC for ScalarDB.
- Added support for extending `AbstractJdbcConfiguration` for custom bean configuration in Spring Data JDBC for ScalarDB.
- Changed the `PreparedStatement` API to use `bind()` methods that return a `BoundStatement` for parameter binding, instead of directly setting values on `PreparedStatement`.
- Added `executeBatch` API to execute multiple statements in a single call, with support in the core SQL API, direct-mode, and JDBC driver.
- Added support for BLOB literals using X'hex' syntax in SQL statements.
- Added support for AuthenticationMethod in `CREATE/ALTER USER` and `SHOW USERS`
- Added support for specifying transaction-scoped attributes in `BEGIN` and `START TRANSACTION` SQL statements using the `WITH` clause (e.g., `BEGIN WITH 'cc-transaction-isolation' = 'SNAPSHOT'`). Also added `begin(Map)`, and `beginReadOnly(Map)` methods to `SqlSession` for programmatic attribute specification.
- Updated `SqlJdbcDatabaseMetaData.getUserName()` to return the authenticated user name via `Metadata.getCurrentUser()`.
- Added support for specifying ABAC read and write tags in the `WITH` clause of `BEGIN` and `START TRANSACTION` statements.

#### Improvements

##### ScalarDB Cluster

- Refactored internal auth token handling to use a type-safe class hierarchy instead of string prefix parsing.
- Auth, ABAC, and Encryption modules no longer require `scalar.db.cross_partition_scan.enabled=true` to be enabled globally. These modules now use operation-level cross-partition scan attributes and run internal metadata transactions with Snapshot Isolation.
- Changed the deprecation policy so that APIs marked as deprecated will now be removed in 4.0.0 instead of 5.0.0.

##### ScalarDB GraphQL

- Relaxed the range of values accepted by the GraphQL `BigInt` scalar to the full Java `long` range, aligning with the corresponding relaxation in ScalarDB. Backend-specific limits (Cosmos DB and Object Storage still restrict BigInt to `-2^53` to `2^53`) are now enforced by ScalarDB at the storage layer rather than by the GraphQL layer.

##### ScalarDB SQL

- Improve thread pool management in two-phase commit interface transaction to avoid potential starvation issues in Spring Data JDBC for ScalarDB.
- Added one-operation mode support for one-shot query execution to improve performance by skipping explicit transaction begin/commit when the SQL query can be expressed as a single operation.
- Inserting or updating records with TIME (microsecond precision), TIMESTAMP (millisecond precision), and TIMESTAMPTZ (millisecond precision) column values will truncate out-of-range precision rather than throwing an exception.
- Fixed an issue where the shadow jar was unnecessarily published to GitHub Packages for the CLI module.
- Update the TIMESTAMPTZ literal to make optional the space character before the UTC timezone `Z` character. For example, `2021-03-04 12:30:45.123Z` is now accepted, in addition to the current format `2021-03-04 12:30:45.123 Z`. Also, when selecting a TIMESTAMPTZ column, the value is printed without a space before the `Z`.
- Refactored the SQL statement builder APIs for improved type safety and ergonomics. `SelectStatementBuilder` now enforces SQL clause ordering at the type level so that `having()` is only callable after `groupBy()`, and HAVING supports the same fluent `.and(...)` / `.or(...)` chain as WHERE; `Having.of(...)` factories have been consolidated into `Having.create(...)`; `CreateUserStatementBuilder` / `AlterUserStatementBuilder` expose explicit `withPassword()` / `withSuperuser()` / `withNoSuperuser()` methods in place of the previous overloaded `with(...)`; the `UserOption` enum has been removed in favor of a nullable `superuser` boolean on `CreateUserStatement` / `AlterUserStatement`; and `FunctionRef` now provides convenience factories (`count()`, `sum(...)`, `avg(...)`, `min(...)`, `max(...)`) for common aggregates.

#### Bug fixes

##### ScalarDB Cluster

- Made `GRANT ROLE` command idempotent, allowing duplicate grants and upgrading to `WITH ADMIN OPTION` when re-granting.
- Fixed a bug where ScalarDB Cluster cannot be deployed in the Omnistrate environment by upgrading `scalar-metering`.
- Fixed a bug where the pause functionality did not work correctly when transactions expired.
- Fixed an issue where the batch operation with piggyback commit threw `CrudException` instead of `CrudConflictException` when a commit conflict occurred. This allows clients to properly detect and handle commit conflicts.
- Fixed a bug where `batch()` with piggyback commit threw `CrudException` instead of `UnknownTransactionStatusException` on unexpected gRPC errors. This could cause incorrect error handling on the client side, as the transaction status was actually unknown when piggyback commit was enabled.
- Upgraded `grpc_health_probe` to fix security issues: [CVE-2025-68121](https://github.com/advisories/GHSA-h355-32pf-p2xm "CVE-2025-68121"), [CVE-2025-61726](https://github.com/advisories/GHSA-gm9r-q53w-2gh4 "CVE-2025-61726"), [CVE-2025-61728](https://github.com/advisories/GHSA-g9q4-qjx4-2v7q "CVE-2025-61728"), [CVE-2025-61729](https://github.com/advisories/GHSA-7c64-f9jr-v9h2 "CVE-2025-61729"), and [CVE-2025-61730](https://github.com/advisories/GHSA-gr56-3gp6-6gmj "CVE-2025-61730")
- Excluded `com.microsoft.azure:adal4j` from the Kubernetes Java Client to fix security issues: [CVE-2023-52428](https://github.com/advisories/GHSA-gvpg-vgmx-xg6w "CVE-2023-52428"), [CVE-2021-31684](https://github.com/advisories/GHSA-fg2v-w576-w4v3 "CVE-2021-31684"), and [CVE-2023-1370](https://github.com/advisories/GHSA-493p-pfq6-5258 "CVE-2023-1370")
- Upgraded the Jackson library to fix a security issue: [GHSA-72hv-8253-57qq](https://github.com/advisories/GHSA-72hv-8253-57qq "GHSA-72hv-8253-57qq")
- Upgraded `grpc_health_probe` to fix security issues: [CVE-2025-59250](https://github.com/advisories/GHSA-m494-w24q-6f7w "CVE-2025-59250") and [CVE-2026-25679](https://github.com/advisories/GHSA-j3gx-2473-5fp8 "CVE-2026-25679")
- Upgraded the Netty library to fix security issues: [CVE-2026-33870](https://github.com/advisories/GHSA-pwqr-wmgm-9rr8 "CVE-2026-33870") and [CVE-2026-33871](https://github.com/advisories/GHSA-w9fj-cfpg-grvv "CVE-2026-33871")
- Fixed a bug where one-shot batch operations bypassed pause control in the GateKept transaction managers.
- Upgraded `grpc_health_probe` to fix a security issue: [CVE-2026-34986](https://github.com/advisories/GHSA-78h2-9frx-2jm8 "CVE-2026-34986").

##### ScalarDB SQL

- Ambiguous column names in ORDER BY and HAVING clauses were detected.
- Fixed a `ClassCastException` that occurred in `StatementUtils.appendTerm()` when handling `DATE`, `TIME`, `TIMESTAMP`, and `TIMESTAMPTZ` values. These values are now correctly formatted as string literals instead of being incorrectly cast to String.
- Fixed `SelectStatement.toSql()` to correctly generate ORDER BY clauses with aggregate functions such as `SUM()` and `COUNT()`. Previously, only column-based orderings were handled, causing incorrect SQL output when function-based orderings were used.
- Fixed a bug where duplicate column names were allowed in CREATE TABLE statements.
- Fixed missing strict date validation on time-related type formatters, which could allow invalid dates (e.g., February 30) to be silently accepted instead of rejected.
- `ResultSet.getObject` on BLOB columns now returns a `java.sql.Blob`, and `ResultSet.getBlob`, `ResultSet.getBinaryStream`, and several `PreparedStatement.setBlob` / `setBinaryStream` overloads are now supported. `ResultSetMetaData.getColumnType` for FLOAT columns now returns `Types.REAL` (previously `Types.FLOAT`). `ResultSet.getString` now returns Java `null` for SQL NULL instead of the literal string `"null"`, in line with the JDBC spec. As a side effect, the SQL CLI now renders BLOB values as `X'...'` hex literals instead of `[B@xxxxxxxx`.
- Fixed an issue where `CachedMetadata#invalidateNamespaceNamesCache()` did not actually invalidate the cached list of namespaces, causing `SHOW NAMESPACES` and related operations to potentially return stale results until the cache TTL expired.

### Enterprise Options

#### ScalarDB Analytics

##### Enhancements

- Password authentication with access token support.
- Internal user directory management.
- gRPC authentication interceptor.
- SDK and CLI authentication with token caching.
- Spark data source authentication support.
- ScalarDB Cluster password authentication backend.
- gRPC retry with exponential backoff for Client SDK.

##### Improvements

- Set scan fetch size to 4096 for JDBC and ScalarDB data sources.

##### Breaking changes

- Unify ScalarDB namespace to `scalardb_analytics` and add domain prefixes to table names (`registry_`, `auth_`) to avoid PostgreSQL identifier length limits.

##### Bug fixes

- Use TIMESTAMPTZ instead of TIMESTAMP for temporal columns.
