Tags give the ability to mark specific points in history as being important
-
v0.7.1
protected8a702bd8 · ·geode v0.7.1 — production-eligible 3-node Raft cluster (v0.7.0 + release-pipeline fix) Identical to v0.7.0's validated source (commit c5c0b833): the 3-node Raft cluster survives sustained extreme churn on real Kubernetes (no QUIC acceptor wedge, no no-leader livelock, a churned node re-handshakes and rejoins to clean 3/3 with no manual roll, zero data loss). v0.7.0's build-release failed on a CI-only bug (goreleaser cross-builds could not resolve DNS in docker:dind, and the vendored deps were absent), not a code defect. v0.7.1 carries the fix: pre-fetch the Zig dependency closure in the DNS-capable release before_script so the offline cross-builds resolve everything from cache. No source change vs v0.7.0. Closes the cluster-raft-no-stable-quorum saga (docs/bugs/2026-06-04-cluster-raft-no-stable-quorum-writes-time-out.md).
-
v0.7.0
protectedc5c0b833 · ·geode v0.7.0 — production-eligible 3-node Raft cluster The distributed Raft cluster now survives sustained extreme churn on real Kubernetes. Validated on arda geode-qa (clean PVCs, 6×4-kill leader-kill bursts = 24 rapid kills + 8-min self-heal watch): - No QUIC acceptor wedge (rx_queue stays bounded under reconnect storms; quic v0.1.29). - No no-leader all-candidate livelock (raft v0.1.9 timer-based candidate demotion + backoff). - A churned node re-handshakes its raft peer connection and rejoins to a clean 3/3 automatically — no manual pod roll (RC-C stale-conn reap, c5c0b833). - Zero data loss; edges durable; writes commit+replicate to the quorum throughout. Closes the cluster-raft-no-stable-quorum saga (docs/bugs/2026-06-04-cluster-raft-no-stable-quorum-writes-time-out.md).
-
v0.6.27
protected34667514 · ·v0.6.27 BREAKING: release builds now refuse --insecure-tls-skip-verify under production conditions (SEC-CLI-01). Any deployment whose health probes or clients use that flag must migrate to --ca-cert <ca> before upgrading (k8s probe overlays included). Highlights since v0.6.26: - fix(raft): cluster churn-recovery campaign — receiver-side inbound idle reap (30s, was 300s; zombie connections no longer starve the 4-worker pool), rebuild probation with escalating budget (ends mutual re-eviction chase), directional follower eviction + empty-heartbeat implicit ack, per-direction liveness (response-only progress stamping), candidate-armed stall detector + frozen-term visibility, stalled-stream liveness detector. - fix(raft): durable raft hard-state/log via FileStorage (election safety), idempotent restart apply keyed by raft index (no restart duplicates), peer FQDN re-resolution on pod reschedule, raft lib v0.1.6 (auto-drive InstallSnapshot). - fix(cluster): write surfaces are now replicated-or-refused — edge CREATE / DELETE / MERGE / MATCH...SET replication slices, MATCH...CREATE edge slice (GNC2), fail-closed gateUnreplicatedWrite for all sliceless surfaces (auth DDL, policy DDL, tenant ops, indexes, graphs, constraints, TDE/CDC/FLE, ts ingest), FTS maintenance on raft apply + snapshot install. - fix(quic): FirstStreamOwnerContext refcount — closes SIGSEGV in nextMessage under sustained query load. - Multi-tenant hardening: strict-tenancy auto-default, production guard refusing --insecure-allow-all, tenant-hierarchy read-path enforcement, FLE request context, tenant drop cascade, durable ALTER POLICY, FLE audit-chain fix, native-tenant write tagging (GAP-0891). - Security: S3 SigV4 signing, dual-token cluster bearer rotation, MFA step-up operation classification, real HMAC-SHA3 for TDE status, LSP timing-safe compare/URI escaping, no session token on stderr. - LSP: protocol-conformance pack (cancel, positionEncoding, framing, truthful capabilities), per-document AST cache. - Honesty/closure round: GAP-0855..0892 batch (real CDC webhook/Kafka sinks, real FTS phrase/proximity, real PROFILE timing, CBO statistics, MV exact-match rewrite, backup upload ingestion + gzip, time-series durability), GAP-0514 CANARY governance closed (223 IMPL residual, documented lanes). Known residuals: client-retry idempotency on committed-but-Timeout cluster writes (treat Timeout as unknown outcome), k8s churn validation owed on this build, GAP-0838 cross-pod TLS verify, GAP-0893 gRPC vendor crash. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
-
v0.6.26
protectedRelease: Geode v0.6.26f653bdb1 · ·v0.6.26 Highlights since v0.6.25: - perf(transport): eliminate idle-node CPU spin (~810% -> ~23%) across the QUIC poll loop, thread-pool idle park, FirstStreamScheduler, and the timeseries pool. - fix(raft): root cause #5 — bounded multiplexed streams per peer so heartbeats/ votes are never dropped under write load (no more split-brain). - Multi-tenant hardening (CaaST findings GAP-0838..0845): opt-in strict-tenancy mode, CALL geode.tenant.* + durable registry + 'geode tenant' CLI + admin_tenant authz, string-keyed tenant HierarchyManager, real per-page TDE encrypt + tested per-tenant key isolation, FLE role via ExecutionContext, GEODE_CURRENT_ROLE override removed, hardening + FLE-CALL docs. - All 5 geode clients (go/python/zig/nodejs/rust) now send tenant_id + role in HELLO.
-
v0.6.25
protectedRelease: Geode v0.6.25d0da9dfe · ·v0.6.25 Release-affecting fixes integrated to main (this conversation): - fix(fts): CALL geode.fts.search returns zero results — CREATE INDEX getOrCreate the target graph (index-first ordering) + skip the fts-storage permanent tombstone on the live SET hook so re-indexed docs are searchable; loud-fail on genuine FTS unavailability; free a pre-existing index_type leak on DROP INDEX. - fix(quic): sustained-load liveness-kill Phase 1 — advertise the out-of-band /health liveness endpoint at startup, rate-limited slow-poll warning, and a CPU-constrained reproduction harness. (Durable Endpoint.mu Phase 2 scoped.) - fix(server): emit a secret-free first-boot admin-password breadcrumb to stdout/stderr for log-scraping harnesses + operator discoverability.
-
v0.6.24
protected39dcd003 · ·geode v0.6.24 Cluster raft write replication — fail-closed write routing. Fixes the re-opened blocker docs/bugs/2026-06-04-cluster-raft-no-stable-quorum-writes-time-out.md: graph writes in cluster mode are now ordered through Raft on the leader and never silently applied to a single node's local store. A write is EITHER replicated through Raft (a single-node CREATE, incl. a constant RETURN and parameter props) OR rejected (error.ClusterNotLeader on a follower; error.ClusterWriteNotReplicable for shapes outside the replicable slice) — eliminating the silent-divergence defect where RETURN/complex/follower writes landed on only one node. Verified with a faithful distinct-IP network-namespace regression (tests/cluster/netns_cluster_replication_test.sh) plus tests/test_cluster_3node_steady_state.zig Phases 3-5. Also includes: re-open + resolution notes for the cluster bug, and new bug reports (first-boot admin-password discoverability; unresponsive-under-load liveness-kill). The first-boot admin-password breadcrumb fix ships separately. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
-
v0.6.23
protectedRelease: Geode v0.6.231d11abee · ·v0.6.23 — first fully-green release pipeline (flaky benches no longer block) Same geode binary as v0.6.20-v0.6.22 (raft 3-node write replication + QUIC acceptor wedge self-heal). Carries the full CI hardening (reliable protoc via the GitLab package-registry mirror; test-cross-build pull-only; dep-fetch retries) AND the rolling multi-arch dev image (dev / main / main-<sha> to the GitLab registry + docker.io/geodedb/geode, never `latest`). This patch stops pre-existing flaky tests from reding the RELEASE (tag) pipeline: test-performance-benchmarks (a noisy SIMD/throughput benchmark the snapshot job already treats as optional) is now allow_failure like bench-query-path, and test-harness-integration retries its timing-sensitive specs twice. Both passed on the main pipeline of the prior commit while flaking the v0.6.22 tag pipeline. See docs/bugs/2026-06-04-cluster-raft-no-stable-quorum-writes-time-out.md and docs/bugs/2026-06-03-acceptor-wedge-connection-burst-new-conns-refused.md.
-
v0.6.22
protected6672fadd · ·v0.6.22 — reliably-green CI + rolling dev image; carries v0.6.20's cluster fixes Functionally identical geode binary to v0.6.20/v0.6.21 (raft 3-node write replication + QUIC acceptor wedge self-heal). This patch makes the build/release pipeline RELIABLY green and adds a dev image for e2e systems. CI hardening (root-caused: deps are not vendored in-repo — zig-pkg/ is gitignored — so CI depended on the GitLab cache + GitHub network): - test-cross-build no longer corrupts the shared cache (pull-only + 2h timeout). - protoc (protobuf's lazy binary) is pre-fetched into zig's cache, sourced FIRST from an in-project GitLab generic-package mirror (same network) with GitHub as fallback — a GitHub-releases outage can no longer red the pipeline. - dep-fetch / flaky jobs (test-zig-release-safe, bench-timeseries, test-gql-compliance) get retries. Dev image (new): every main push publishes a rolling multi-arch (amd64+arm64) runtime image tagged dev / main / main-<short-sha> to the GitLab Container Registry AND docker.io/geodedb/geode — NEVER 'latest' — so e2e systems can pull a fresh build without waiting for a tagged release. See Dockerfile.devimage. See docs/bugs/2026-06-04-cluster-raft-no-stable-quorum-writes-time-out.md and docs/bugs/2026-06-03-acceptor-wedge-connection-burst-new-conns-refused.md.
-
v0.6.21
protectedRelease: Geode v0.6.2143a9c524 · ·v0.6.21 — CI: green release/main pipeline (cache + dep-fetch hardening) CI-only patch over v0.6.20. The geode binary is identical — no source changes. v0.6.20 is a protected/immutable tag, so the CI fix that greens the release+main pipelines ships as a new patch. - test-cross-build no longer corrupts the shared protected cache: its ReleaseSafe-across-every-target build produced a ~10K-file cache whose pull-push archival overran the job timeout ("execution took longer than 1h0m0s"), leaving zig-cache-main-protected half-written. Every later job then hit "Failed to extract cache" → re-fetched deps → flaked on HttpConnectionClosing, reding the blocking gates. Now pull-only + 2h timeout (matching the test-macos-unit large-cache precedent), plus dep-fetch retries (max: 2) on test-zig-release-safe and bench-timeseries. Carries v0.6.20's functional content: - 3-node Raft cluster write replication (fixed in geode's raft bridge; pinned raft library proven correct) — a leader CREATE reads back count=1 on both followers and the leader. - QUIC acceptor wedge auto-recovery (rx_queue watchdog self-restart). See docs/bugs/2026-06-04-cluster-raft-no-stable-quorum-writes-time-out.md and docs/bugs/2026-06-03-acceptor-wedge-connection-burst-new-conns-refused.md. -
v0.6.20
protected70a0eb27 · ·v0.6.20 — 3-node Raft cluster replicates writes; QUIC acceptor self-heals from wedge Distributed/clustered mode is now functional end-to-end and a wedged QUIC acceptor auto-recovers — the two outstanding cluster blockers above v0.6.19. - Raft write replication (4b550709 + 893d2b5d + dfd5d5b7): fixed entirely in geode's raft bridge — the pinned raft library was proven CORRECT. Four stacked geode bugs: the protobuf boundary dropped every AppendEntries log entry; the bridge use-after-free'd a freshly-proposed entry's command (aliased the library's unstable buffer that stableTo frees before the async outbox encodes); an unbounded heartbeat backlog buried newly-proposed entries; and the loopback self-skip orphaned a node addressed via an alias. A leader CREATE now reads back count=1 on BOTH followers and the leader, term 2. Adds GEODE_CLUSTER_LISTEN_ADDRESS for distinct multi-node binds + a 3-node steady-state regression test that asserts replication. - QUIC acceptor wedge auto-recovery (7264eaba): an rx_queue watchdog on the metrics loop self-restarts the pod (exit 70) when the :3141 UDP rx_queue stays >= 8 MiB for >= 30 s, so a compound connection burst no longer requires a manual pod delete. Env-tunable; 8/8 unit tests. See docs/bugs/2026-06-04-cluster-raft-no-stable-quorum-writes-time-out.md and docs/bugs/2026-06-03-acceptor-wedge-connection-burst-new-conns-refused.md.
-
v0.6.19
protectedRelease: Geode v0.6.19e7e447e4 · ·v0.6.19 — honor operator-provided --cert/--key (load-as-is, fail loud) so k8s cluster TLS forms Fixes the containerized cert-discard bug: geode no longer silently self-signs when an explicit --cert/--key is supplied, and the existence check no longer depends on the .failing-allocator std.Io probe. Every k8s pod now presents the same operator-provided cert on the Raft port, so the 3-node cluster can complete peer TLS handshakes and elect a leader. See docs/bugs/2026-06-04-cluster-cert-provided-cert-discarded-containerized.md.
-
v0.6.18
protectedRelease: Geode v0.6.18a148e4f3 · ·v0.6.18 — k8s clustering: DNS-search peer resolution + Raft election auto-derives node_id Fixes a 3-node Kubernetes StatefulSet failing to elect a leader (hung at state=candidate term=0), past the GAP-0838 TLS fix. - fix(cluster, 5bc256b4): land the stranded GAP-0838 k8s work that had never reached main/any tag — dns_search.zig (resolv.conf search/ndots so short headless peer names like geode-0.geode resolve), cluster_identity.zig (boot-time identity-contract diagnostic), and $HOSTNAME forwarding. - fix(cluster, a148e4f3): auto-derive GEODE_NODE_ID from the pod's $HOSTNAME position in GEODE_PEERS. The hostname-matched position is authoritative (it is the raft id every peer assigns this node): derived when GEODE_NODE_ID is unset, overridden+warned when a set one disagrees — so a StatefulSet forms a leader with no GEODE_NODE_ID, and a mis-set one no longer silently drops this node's votes as a non-voter. Tests: zig build test-cluster-bootstrap (10 cases), test-cluster-3node-election and -subprocess (loopback election regression), test-dns-search, test-cluster-identity. Full pre-push gate (cross-compile 5 targets + sharded zig build test + CANARY) green on this commit. Residual: end-to-end k8s validation requires a real cluster (re-enable the 3-node kustomize component in geode-argo-arda).
-
v0.6.17
protectedRelease: Geode v0.6.17303c9d38 · ·v0.6.17 — OTel export-status visibility + acceptor-wedge connection-burst mitigation - otel(e1c1dbdc): log OTLP/HTTP push ENABLED/DISABLED unconditionally at startup and warn when a legacy GEODE_OTEL_* var is set (geode reads only the standard OTEL_* SDK vars). Fixes the silent "exporting nothing" misconfiguration. - server(303c9d38): cap the acceptor-shutdown bail at a short, env-tunable deadline (default 1s, GEODE_ACCEPTOR_BAIL_MS) instead of 30s, deferring wedged connections to the leaked-conn reaper — a connection-burst can no longer starve new-connection admission by pinning capped owner slots for 30s. Both fixes carry regression tests. Full pre-push gate (zig fmt + compile + cross-compile 5 targets + sharded `zig build test` + CANARY) green on this commit.
-
v0.6.16
protectedRelease: Geode v0.6.1654cecd24 · ·v0.6.16 — CI: stable-keyed protoc cache stops cold-cache GitHub HttpConnectionClosing fetch flakes (recurring pipeline failure root cause); gitleaks allowlist for the new cache key. Main pipeline green (all blocking jobs pass).
-
v0.6.15
protected86d58fdb · ·v0.6.15 — fix acceptor-bail use-after-free (root cause of 0.6.13 sendExecuteError @memcpy-alias panic + processInitialDatagramConcurrent recovery SIGSEGV) Both 0.6.13 crash signatures were downstream symptoms of a single UAF in cleanupFirstStreamOwner: on the stream-acceptor 30s bail path the owner freed the FirstStreamOwnerContext + embedded conn_state while the still-running acceptor kept dereferencing it. Fixed by deferring that teardown to the leaked-conn reaper (runs only after the acceptor exits). The protobuf/quic deps were innocent (no dep changes). See docs/bugs/2026-06-02-*.md.
-
v0.6.14
protectedRelease: Geode v0.6.14a69cd6ae · ·v0.6.14 — GAP-0838: fix cross-pod Raft TLS handshake (CertificateVerify transcript fold-order in devnw/zig/tls; tls v0.1.9 + 18-repo dependency convergence). Verified TLS server-auth now works for distinct peer IPs.
-
v0.6.13
protectedRelease: Geode v0.6.1328db6b84 · ·fix(systemd): raise LimitNPROC/TasksMax to 4096 to fix SystemResources crash loop
-
v0.6.12
protectedRelease: Geode v0.6.1232e4ea84 · ·Release v0.6.12 — build-release Zig cache fix (vendored zig-pkg/ for the goreleaser cross-compile). Green main + harness; targeting the apt deploy chain.