2026-08-25
Upgraded Neo4j to 5.26.30
The Neo4j cluster module has been bumped from 5.26.25 to 5.26.30, the latest patch release on the 5.26 LTS line. The Helm charts (neo4j, neo4j-admin, neo4j-headless-service) and the Neo4j server image (neo4j:5.26.30-enterprise) move together.
Notable patch highlights between 5.26.26 and 5.26.30
- Security: log4j 2.26.1 (CVE-2026-49844) and 2.25.4 (CVE-2026-34477, CVE-2026-34478, CVE-2026-34480, CVE-2026-34481), netty 4.1.135 (several CVEs, including CVE-2026-42579), and Apache Shiro 3.0.0 after 2.2.1 (CVE-2026-49268).
- Clustering: a new optional setting (
dbms.cluster.raft.async_channel_acquisition_enabled) makes Raft message sending asynchronous, which can reduce write delays when a cluster member is unreachable (5.26.29). Off by default. - Cypher: fixes for
COUNT(DISTINCT)overcounting in the pipelined runtime (5.26.26), wrong results from the parallel runtime when returning all properties with{.*}(5.26.28), and memory errors and wrong aggregation counts in composite database subqueries (5.26.29). - Import: multiple
--nodesor--relationshipsarguments with explicit headers no longer share the first header file, and Parquet files with empty row groups import correctly (5.26.28). - Helm chart: the helper that enables a new server in the cluster now runs as a Kubernetes Job with its own service account, limited to reading the Neo4j auth secret. Previously it ran with broader read access to all secrets in the namespace.
The release notes for 5.26.30 itself were not published yet when the chart and images came out on 2026-08-25.