Release Note for Neo4j 2026.04 (Release date: 22 April 2026)

Server

• Introduces an expanded Query API transaction ID length from 4 to 6 characters, allowing the system to handle a significantly higher volume of concurrent transactions. In this latest release, developers will automatically benefit from these longer transaction identifiers to reduce the risk of ID collisions under higher concurrency.

Cypher

Cypher 25 Features

• IS LABELED and IS NOT LABELED predicates: Support has been added for these GQL predicates, which allow testing whether a node possesses or lacks specified labels. These predicates provide GQL equivalents to the existing Cypher IS and IS NOT predicates, without introducing new functionality.  See the Cypher Manual: IS [NOT] LABELED predicate.
• FOR Statement: The GQL FOR statement is now supported for extracting individual rows from a list. This statement is the GQL equivalent of the existing Cypher UNWIND statement, without introducing new functionality.
• SHORTEST: The memory usage for the SHORTEST statement has been reduced. Previously, this statement consumed more memory than was indicated by the memory-tracking estimate.
• AI Token Handling Functions:
  • ai.text.chunkByTokenLimit: A new function to split an input string into a list of strings, respecting a specified token limit. Docs
  • ai.text.countToken: A new function for estimating the token count of a given input string. Docs

Cypher Improvements (all versions)

• Parallel runtime memory tracking enhancements: Improved the precision of memory tracking within the Top operator.
• Detailed version reporting in query output: EXPLAIN and PROFILE output now consistently includes the underlying Neo4j version, reporting down to the point release.

Drivers

• Updated neo4j-java-driver from 6.0.3 to 6.0.4.
• Updated netty-bom from 4.2.10.Final to 4.2.12.Final.

Bug fixes

Server

• Fixed a bug for vector-3.0 indexes, where quantized data was correctly written during index population, but wasn’t used at query time. This meant the index behaved as an index without quantization, leading to increased memory usage. Quantized vectors are now used correctly, it is not necessary to rebuild the index.
• Fixed a performance bottleneck in the ID generator by optimizing how the system scans for and reuses deleted IDs, preventing unnecessary store file growth and reducing lock contention during high volume writes.

Cypher

• Fixed a bug where running the same GRANT/REVOKE Property-Based Access Control (PBAC) privilege command containing a temporal function will throw an error on the second command. Now it succeeds and gives a warning that no changes were made on the second command.
• Fixed an incorrect error message when passing a parameter with the incorrect type to SHOW DATABASES.
• Fixed a bug in record format where iterating the relationships of a node that concurrently turns dense could return wrong query results.
• Fixed a bug where SHORTEST would sometimes omit a valid path when multiple targets are found.

Deprecations

• For all Cypher language changes, deprecations, and compatibility, see
  • Cypher 5 Manual -> Deprecations, additions, and compatibility.
  • Cypher 25 Manual -> Deprecations, additions, and compatibility

Server

• Fixed bug in seed syncing where a server may fail even if the seeding servers can eventually find a quorum.
• Fixed a bug in record format where iterating the relationships of a node that concurrently turns dense could return wrong query results.
• Fixed some cases of ID allocation not reusing available free IDs and instead growing store files unnecessarily. Also fixed some cases of prolonged/slow scanning of the .ids files to look for available free IDs to reuse.

Cypher

• Always report underlying Neo4j version in EXPLAIN and PROFILE output, up to and including the point release.
• Fixed a bug where running the same GRANT/REVOKE PBAC privilege command containing a temporal function will throw an error on the second command. Now it succeeds and gives a warning that no changes were made on the second command.

Drivers

• Updated neo4j-java-driver from 5.28.10 to 5.28.12.
• Updated netty-bom from 4.1.129.Final to 4.1.131.Final.

Bundled Packages:

• labs/apoc-5.26.25
• lib/neo4j-browser-2026.04.16+0
• products/bloom-plugin-5.x-2.32.0
• products/neo4j-genai-plugin-5.26.25
• products/neo4j-graph-data-science-2.13.9
• products/neo4j-ops-manager-agent-1.15.1
• product/fleetManagement-1.1.1

Patch release

• All releases from Neo4j Ops Manager 1.15.0 and later require Neo4j persistence to be version 5.26 LTS or greater. 
• Monitoring instances with versions of 4.4 LTS and greater is still supported, although 4.4 LTS is out of support with Neo4j.

Fixes

• Fix doc links and add a note about Java 21

Internal

• pmd.version to 7.23.0
• tomcat-embed-core to 11.0.21
• protobuf-java to 4.34.1 
• neo4j-migrations-spring-boot-starter to  3.3.0
• bcpkix-jdk18on to 1.83
• pmd-core to 7.22.0 
• spring-grpc-spring-boot-starter to 1.0.2 
• grpc to 1.79.2
• nimbus-jose-jwt to 10.9 
• docker-java.version to 3.7.1
• json-schema-validator to 3.0.1
• zerolog to 1.35.0
• spring-boot.version to 4.0.5

New Features

• None.

Bug fixes

• Fixed a bug where graphs imported via Apache Arrow would not have node properties marked as null.
• Fixed a bug where gds.maxFlow or gds.maxFlow.minCost might fail when trying to discharge negligible excess.

Improvements

• Fail if passing unexpected configuration options to the global configuration of gds.graph.project.

Other changes

• None.

Server

• Fixed a bug where the last group in an IPv6 address was misinterpreted as a port in the server.default_advertised_address setting.
• Fixed an issue where large CSV from cloud storage stores could close the underlying SDK client prematurely.

Security

• Upgraded Apache Shiro to 2.1.0 to mitigate CVE-2026-23901 and CVE-2026-23903
  • Apache Shiro versions 1.x and 2.x before 2.0.7 have a timing discrepancy vulnerability allowing brute-force attacks to distinguish between non-existent users and incorrect passwords.
  • Apache Shiro 2.1.0 or later is required to address an authentication bypass vulnerability affecting static files on case-insensitive filesystems.
• Upgraded Eclipse Jetty to 12.0.33 to resolve CVE-2026-1605
  • Earlier Eclipse Jetty versions have a vulnerability in GzipHandler. This causes a memory leak when a compressed HTTP request is processed without a compressed response.
• Upgraded Jackson to 2.21.1 to resolve GHSA-72hv-8253-57qq
  • Jackson-core’s async JSON parser in earlier versions bypasses the maxNumberLength constraint, allowing attackers to cause Denial of Service (DoS) attacks through excessive memory allocation.

Bundled Packages:

• labs/apoc-5.26.24
• lib/neo4j-browser-2026.03.27+0
• products/bloom-plugin-5.x-2.31.0
• products/neo4j-genai-plugin-5.26.24
• products/neo4j-graph-data-science-2.13.8
• products/neo4j-ops-manager-agent-1.15.0
• product/fleetManagement-1.1.1

Server

• Attribute-Based Access Control (ABAC) – a new capability that enables users to secure access to data or administrative capabilities with granular, context-aware auth rules. Access is dynamically granted using rules written in Cypher 25 that evaluate real-time attributes from a user’s OpenID Connect (OIDC) SSO token, or environmental factors like date / time. See Operations manual -> Authentication and authorization -> Attribute-based access control.
• Fleet Manager is now built-in and ready by default. Go to https://console.neo4j.io/ to set it up. If you have previously used the Fleet Manager plugin to connect your Neo4j deployment to Fleet Manager, upgrading to this release will no longer need the plugin, and this should be removed after the upgrade. See Aura documentation.
• Fleet Manager from this release supports a collection of aggregate query logs for display in the Aura console. This feature will require the Neo4j deployment to be registered with Fleet Manager, and the db.logs.query.obfuscate_literals=true configuration to be set in order to use the feature. NOTE: This will obfuscate the literals in the local query log files as well.
• Cross-Cluster Database replication is available as a public Early Access Preview. This enables users to continuously replicate a database across separate Neo4j clusters as a read-only copy. On failure of the upstream, the replica can be ‘promoted’ to a write-enabled database. The feature is available in early access preview through a set of procedures – this may change in the future for general availability. For details, see the Operations manual -> Replicating databases across clusters.
•  Added a new setting `db.memory.pagecache.warmup.order` that controls the order in which database files are loaded during page cache warmup. This allows optimization of startup performance by prioritizing critical files. For details, see the Operations manual -> Performance tips.
• Improved replication of transactions in a cluster to ensure a transaction is only written once to the replication log, even when multiple replication attempts are made.
• Fixed an issue where large CSV from cloud storage stores could close the underlying SDK client prematurely

Neo4j-admin

• The database copy command now supports using a backup of a standard Neo4j DB using the options: –source-location and –source-format to the neo4j-admin database copy command. This allows creating a sharded database directly from a backup artifact, without needing a stopped database. See Operations Manual -> Resharding a database.
• To improve observability and debugging, each neo4j-admin import process now automatically generates a dedicated context directory within the server/data/imports folder. This isolated directory centralizes all job-specific data, including various logs, detailed progress tracking, and issue reporting. To better support automation and monitoring tools, both progress and issue reports are now formatted in structured JSON. (Note: Using the –report-file option will override this default location). See Operations Manual -> Import -> Import progress reporting.

Security

• Patch jetty to version 12.0.33 to resolve CVE-2026-1605, a vulnerability in the GzipHandler that can cause a memory leak when handling certain compressed HTTP requests. This issue could be exploited to exhaust server memory and trigger a denial-of-service (DoS) condition.
• Added new security configurations to the neo4j.conf configuration file to control how X-Forwarded-Host network headers are used in the database.server.http.x_forward.enabled server.http.x_forward.allow_hosts server.http.x_forward.allow_proxies server.http.x_forward.private_ips_enabledBy default, X-Forwarded-Host headers are accepted by the database and can be used by externally provided capability such as user-defined functions.  If these headers are not needed, it is recommended to disable them by setting the server.http.x_forward.enabled option to false, to improve overall security.  In a future release of Neo4j, X-Forwarded-Host headers will be disabled by default as they are not needed for standard deployments.Additional details are in the documentation: Operations Manual -> Configuration -> Configuration settings

Cypher

Cypher 25 additive features

• ACYCLIC path mode now available: When used in a MATCH statement, specifies that a node cannot be traversed more than once in a solution to the graph pattern, avoiding loops. In the current implementation, it cannot be used in conjunction with ANY or SHORTEST. This limitation will be lifted in future releases. See Patterns -> Path modes for details.
• Added real-time progress tracking for LOAD CSV and Cypher-based ingestion jobs in Neo4j using the command SHOW TRANSACTIONS. It allows users to see a set of key metrics for tracking the progress. See Clauses -> SHOW TRANSACTIONS.
• GQL conformance: Cypher now implements the GQL optional function PROPERTY_EXISTS().

Bug fix

Server

• Fixed a bug for sharded databases: db.prepareForReplanning respects custom timeout
• neo4j-admin import tool now requires the –delimiter option to be a single-byte UTF-8 character.

Cypher

• Fixed a bug in pipelined runtime where some queries with EXISTS-subqueries planned with SelectOrSemiApply could in special circumstances cause incorrect intermediate result rows to be produced. The circumstances depend on a combination of the structure of the query, the input parameters and the queried data set. The bug did not affect parallel runtime. It could occur in cases where the order of intermediate rows needs to be preserved by SelectOrSemiApply, i.e. when it is planned on the right-hand side of an Apply or the plan relies on indexed-backed order. The symptoms and error messages triggered by the bug could vary. There is a theoretical risk that in the worst case it could potentially have resulted in incorrect data being written to the graph or an incorrect result returned to the client, even though we have seen no such example.
• Dynamic labels: Dynamic lookups now use locking index seeks when required, whereas previously they were vulnerable to constraint violations if used concurrently in a merge context.
• Fixed a regression in Cloud Object Storage Integration (COSI) where the S3/Cloud SDK client was prematurely closed during LOAD CSV operations. This resolves intermittent Neo.DatabaseError.Statement.ExecutionFailed errors (specifically “Unable to get the next chunk of data”) that occurred during long-running imports from S3-backed storage.

Bundled products

• APOC Core 2026.03.1 – The most popular community library developed for the database, is fully supported (included in Labs directory).
• Bloom 6.x-2.31.0 – A beautiful and expressive data visualization tool to quickly explore and interact with Neo4j’s graph data platform – no coding required. Please refer to the release notes for details.  (Requires a License)
• Browser 2026.03.23+0  – Neo4j Browser is a tool for developers to interact with the graph. It is the default interface for both Enterprise and Community Editions (included in the /libs directory) of the Neo4j database.
• Neo4j GenAI Plugin 2026.03.1 – Neo4j’s GenAI plugin provides functions and procedures to interact with external AI providers through Cypher, such as for creating vector embeddings and generating text. Added new aggregating text completion functions to the GenAI Plugin, ai.text.aggregateCompletion and ai.text.aggregateStructuredCompletion.
• Neo4j Graph Data Science 2026.03.0 is a compatible version of the connected data analytics and machine learning platform that helps you understand the connections in big data to answer critical questions and improve predictions. Please refer to the release notes for further details. (GDS Enterprise requires a License. )
• Enterprise Fleet Management is no longer bundled with the DBMS package as it is now included in Neo4j.
• Neo4j Ops Manager 1.15.0 is a UI-based tool that enables Administrators to operate and observe all of their Neo4j Database Management Servers. Now includes support for Neo4j’s any-to-any upgrade. Please refer to the release notes for details. (Included in Enterprise).

• Fix: Numerous accessibility improvements, including keyboard navigation for graph analytics, slicer, zoom, and legend items
• Fix: Database switches now correctly load styles
• Fix: Resolved issue where a single backspace could clear the entire search input
• Fix: Scenes no longer get assigned to the wrong perspective
• Fix: Immediate saving when switching scenes to avoid data loss
• Fix: Fixed unexpected auto-zoom when switching scenes
• Fix: Improved “Show me a graph” behavior when no relationships exist
  
  Other minor fixes and improvements.

Important Notice

Security

• This release patches Jackson to address GHSA-72hv-8253-57qq by improving input validation to prevent malformed inputs from influencing Cypher query execution. The fix mitigates potential risks of unauthorized data access or modification.
• This release patches Jetty to version 12.0.33 to address CVE-2026-1605, a vulnerability in the GzipHandler that can cause a memory leak when handling certain compressed HTTP requests. This issue could be exploited to exhaust server memory and trigger a denial-of-service (DoS) condition.

Bug fix

Cypher

• Fixed a bug in pipelined runtime where some queries with EXISTS-subqueries planned with SelectOrSemiApply could in special circumstances cause incorrect intermediate result rows to be produced. The circumstances depends on a combination of the structure of the query, the input parameters and the queried data set. The bug did not affect parallel runtime. It could occur in cases where the order of intermediate rows needs to be preserved by SelectOrSemiApply, i.e. when it is planned on the right-hand side of an Apply or the plan relies on indexed-backed order. The symptoms and error messages triggered by the bug could vary. There is a theoretical risk that in the worst case it could potentially have resulted in incorrect data being written to the graph or an incorrect result returned to the client, even though we have seen no such example.

Bundled products

• APOC Core 2026.02.3 – The most popular community library developed for the database, is fully supported (included in Labs directory).
• Bloom 6.x-2.30.1 – A beautiful and expressive data visualization tool to quickly explore and interact with Neo4j’s graph data platform – no coding required. Please refer to the release notes for details.  (Requires a License)
• Browser 2026.03.19+0  – Neo4j Browser is a tool for developers to interact with the graph. It is the default interface for both Enterprise and Community Editions (included in the /libs directory) of the Neo4j database.
• Neo4j GenAI Plugin 2026.02.3 -The GenAI plugin delivers integrations with various generative AI services, including support for transforming text data into vector embeddings using VertexAI, OpenAI, or Amazon Bedrock. The resulting vector embeddings can be used together with Neo4j’s vector search indexes.
• Neo4j Graph Data Science 2.27.1 is a compatible version of the connected data analytics and machine learning platform that helps you understand the connections in big data to answer critical questions and improve predictions. Please refer to the release notes for further details. (GDS Enterprise requires a License. )
• Enterprise Fleet Management 1.1.1 allows a self-managed deployment to be registered within the Aura console, providing a fleet-wide view of all Neo4j instances. It supports EE and CE deployments.
• Neo4j Ops Manager 1.15.0 is a UI-based tool that enables Administrators to operate and observe all of their Neo4j Database Management Servers. Now includes support for Neo4j’s any-to-any upgrade. Please refer to the release notes for details. (Included in Enterprise).

Important Notice

Security

• Patch parquet-floor to version 1.62  to resolve GHSA-72hv-8253-57qq
• Patch jetty to version 12.0.33 to resolve CVE-2026-1605

Bundled Packages:

• labs/apoc-5.26.23
• lib/neo4j-browser-2026.03.18+3
• products/bloom-plugin-5.x-2.30.1
• products/neo4j-genai-plugin-5.26.23
• products/neo4j-graph-data-science-2.13.8
• products/neo4j-ops-manager-agent-1.15.0
• product/fleetManagement-1.1.1

Important Notice

Server

• Resolved a rare concurrency issue that could cause a database to get stuck during a recreate operation when multiple databases were recreated simultaneously.
• Fixed an issue where configuring multiple auth plugins caused authentication-only providers to incorrectly grant authorization capabilities if at least one other plugin was configured for both.

Cypher

• Fixed a bug in pipelined runtime where sometimes queries with multiple SelectOrSemiApply operators in the query plan could fail with error messages like: “Cannot invoke org.neo4j.cypher.internal.runtime.pipelined.state.AbstractArgumentStateMap$StateController.peek()” because “controller” is null”.
• Bug fixes and security updates on components of Neo4j.
• Including composite namespace in privileges targeting remote alias constituents.

Security

• Patch jackson to version 2.21.1 to resolve GHSA-72hv-8253-57qq

Bundled Packages:

• labs/apoc-5.26.22
• lib/neo4j-browser-2026.03.10+2
• products/bloom-plugin-5.x-2.30.1
• products/neo4j-genai-plugin-5.26.22
• products/neo4j-graph-data-science-2.13.8
• products/neo4j-ops-manager-agent-1.15.0
• product/fleetManagement-1.1.1

New Features

• None.

Bug fixes

• Fixed a bug where the Leiden algorithm would throw an error when operating on a graph where no swaps would be done in the first iteration.
• Fixed a validation bug, where gds.graph.generate would allow for invalid averageDegree + nodeCount combinations.

Improvements

• The following procedures stop faster when a transaction terminates:

  • gds.bridges.*
  • gds.degree.*
  • gds.articulationPoints.*
  • gds.scaleProperties.*
  • gds.kcore.*
  • gds.sllpa.*
  • gds.prizeSteinerTree.*
  • gds.bellmanFord.*
  • gds.modularity.*
  • gds.hits.*
  • gds.allShortestPaths.delta.*

• Minor improvements in allocated memory by gds.nodeSimilarity.* under certain situations.

• Some unnecessary computations during similarity distribution computations are removed for:

  • gds.knn.stats
  • gds.knn.filtered.stats
  • gds.nodeSimilarity.stats
  • gds.nodeSimilarity.filtered.stats

• Performance improvements when running Yen’s shortest path algorithm on undirected or inverse-indexed graphs.

Other changes

• None.

Important Notice

Server

• The distributed neo4j.conf explicitly sets: db.query.default_language=CYPHER_25. As a result, deployments using the provided configuration file will default to Cypher 25 for newly created databases.
• New page cache metrics for MVCC snapshots and async I/O tracking
  • <prefix>.page_cache.pages_snapshot_loaded
  • <prefix>.page_cache.async_submit
  • <prefix>.page_cache.async_complete
  • <prefix>.page_cache.async_failure

Neo4j-admin

• Improved formatting of errors displayed in the terminal output. Stack traces will be logged to a file, unless –verbose flag is used.
• Introduced a new options to offline import:
  • –profile option runs the import with java flight recorder. See Operations Manual -> Import -> Diagnosing performance issues with Java Flight Recorder (JFR) for details. 
  • –profile-results-path option to specify the path the profile JFR should be written to. See Operations Manual -> Import -> Diagnosing performance issues with Java Flight Recorder (JFR) for details. 
  • –dry-run option to sanity check your parameters without running an actual import. For examples, see Operations Manual -> Full import and Incremental import.

Infinigraph

• add support db.index.fulltext.awaitEventuallyConsistentIndexRefresh for property sharded databases.

Cypher

• Starting from Neo4j 2026.02,the distributed neo4j.conf explicitly sets: db.query.default_language=CYPHER_25 rather than the previous default of CYPHER_5.  New deployments using the default configuration file will therefore default to Cypher 25 for newly created databases. The Cypher version can still be explicitly specified in the CREATE DATABASE command and can be changed at any time using ALTER DATABASE.
• Change the type of exception thrown for a NodeByIdSeek when ids argument is not a valid list. Exception is now CypherTypeException, rather than ClassCastException or InternalException.

Deployment Behaviour

• Upgraded deployments that retain their existing neo4j.conf will keep their current default query language.
• Docker deployments:
  • The neo4j.conf included with new Docker images will default to db.query.default_language=CYPHER_25.
  • When reusing an existing neo4j.conf file, the existing default query language will be retained.
  • On Aura, Cypher 25 is the new default query language for newly created organisations. The default query language attached to created databases is determined by the organisation setting “Default Cypher Version” and can be manually changed.

Cypher 25 additive features

• General availability: Vector search with filters (in-index filtering) and the new Cypher SEARCH syntax for vector queries are now GA and supported for production use. Vector indexes can include additional properties for filtering at index creation, and filters are applied via the WHERE subclause in SEARCH. See the Cypher SEARCH documentation and vector index documentation for syntax and supported filter predicates; the v2026.01 preview blog post remains a useful background overview.
• Introducing GRAPH TYPE (Preview): GRAPH TYPE provides you the ability to declare your data model in a single, unified blueprint. This enforces strict data integrity including validation of relationship connections and label definitions without sacrificing the flexibility of an open schema.  The GRAPH TYPE feature is available in the enterprise version offered AS-IS as described in your agreement with Neo4j and should only be used for internal development purposes.
• Added GQL-compliant aliases for existing Cypher functions (e.g., ceiling, local_time, local_datetime, zoned_time, zoned_datetime, duration_between, path_length, ln, collect_list, percentile_disc, percentile_cont, stdev_pop, stdev_samp). These aliases redirect to the existing implementations, improving GQL compliance without changing behaviour.
• Add ai.text.structuredOutput() function to the GenAI Plugin, taking a textual prompt and map schema and outputting the result as a map adhering to the given schema.

Bug fix

Server

• Support properties function in composite database context when possible.
• Including composite namespace in privileges targeting remote alias constituents.

Cypher

• Fixed a bug in pipelined runtime where sometimes queries with multiple SelectOrSemiApply operators in the query plan could fail with error messages like: “Cannot invoke “org.neo4j.cypher.internal.runtime.pipelined.state.AbstractArgumentStateMap$StateController.peek()” because “controller” is null”.
• Fixed a bug where use of a composite property index in combination with a dynamic node label or dynamic relationship type could result in an incorrect MATCH result being returned. Note: this could also affect the MATCHing portion of a MERGE statement, potentially resulting in the runtime issuing a CREATE that cannot succeed, or an update to the incorrect node.
• Fixed issue with conditional query WHEN not aggregating null values correctly without a grouping key.
• Fixed a bug with the new MergeUniqueNode operator.
• Restored behavior allowing simple node patterns in FOREACH to shadow incoming variables.

Bundled products & plugins

• APOC Core 2026.02.2 – The most popular community library developed for the database, is fully supported (included in Labs directory).
• Bloom 6.x-2.30.1– A beautiful and expressive data visualization tool to quickly explore and interact with Neo4j’s graph data platform – no coding required. Please refer to the release notes for details.  (Requires a License)
• Browser 2026.03.04+0  – Neo4j Browser is a tool for developers to interact with the graph. It is the default interface for both Enterprise and Community Editions (included in the /web directory) of the Neo4j database. 
• Neo4j GenAI Plugin 2026.02.2 -The GenAI plugin delivers integrations with various generative AI services, including support for transforming text data into vector embeddings using VertexAI, OpenAI, or Amazon Bedrock. The resulting vector embeddings can be used together with Neo4j’s vector search indexes.
  • added the function ai.text.structuredCompletion. It is similar to submitting a prompt to an LLM, but with the additional guarantee that the output conforms to the requested schema
• Neo4j Graph Data Science 2.27.0 is a compatible version of the connected data analytics and machine learning platform that helps you understand the connections in big data to answer critical questions and improve predictions. Please refer to the release notes for further details. (GDS Enterprise requires a License. )
• Enterprise Fleet Management 1.1.1 allows a self-managed deployment to be registered within the Aura console, providing a fleet-wide view of all Neo4j instances. It supports EE and CE deployments.
• Neo4j Ops Manager 1.15.0 is a UI-based tool that enables Administrators to operate and observe all of their Neo4j Database Management Servers. Now includes support for Neo4j’s any-to-any upgrade. Please refer to the release notes for details. (Included in Enterprise).

Release Note for Neo4j 2026.03 (Release date: 27 March 2026)

Server

• Fleet Manager is now built-in and ready by default. Go to https://console.neo4j.io/ to set it up. If you have previously used the Fleet Manager plugin to connect your Neo4j deployment to Fleet Manager, upgrading to this release will no longer need the plugin, and this should be removed after the upgrade. See Aura documentation.
• Fleet Manager from this release supports collection of aggregate query logs for display in the Aura console. This feature will require the Neo4j deployment to be registered with Fleet Manager, and the db.logs.query.obfuscate_literals=true configuration to be set in order to use the feature. NOTE: This will obfuscate the literals in the local query log files as well.

Security

• Patch Jetty to version 12.0.33 to address CVE-2026-1605, a vulnerability in the GzipHandler that can cause a memory leak when handling certain compressed HTTP requests. This issue could be exploited to exhaust server memory and trigger a denial-of-service (DoS) condition.  

Cypher

Cypher 25 additive features

• ACYCLIC path mode now available: When used in a MATCH statement, specifies that a node cannot be traversed more than once in a solution to the graph pattern, avoiding loops. In the current implementation, it cannot be used in conjunction with SHORTEST. This limitation will be lifted in future releases. 
• Added real-time progress tracking for LOAD CSV and Cypher-based ingestion jobs in Neo4j using the command SHOW TRANSACTIONS. It allows users to see a set of key metrics for tracking the progress 
• GQL conformance: Cypher now implements the GQL optional function PROPERTY_EXISTS() 

Bug fix

Cypher

• Fixed a bug in pipelined runtime where some queries with EXISTS-subqueries planned with SelectOrSemiApply could in special circumstances cause incorrect intermediate result rows to be produced. The circumstances depend on a combination of the structure of the query, the input parameters and the queried data set. The bug did not affect parallel runtime. It could occur in cases where the order of intermediate rows needs to be preserved by SelectOrSemiApply, i.e. when it is planned on the right-hand side of an Apply or the plan relies on indexed-backed order. The symptoms and error messages triggered by the bug could vary. There is a theoretical risk that in the worst case it could potentially have resulted in incorrect data being written to the graph or an incorrect result returned to the client, even though we have seen no such example.
• Dynamic labels: Dynamic lookups now use locking index seeks when required, whereas previously they were vulnerable to constraint violations if used concurrently in a merge context.

Deprecations

• For all Cypher language changes, deprecations, and compatibility, see 
  • Cypher 5 Manual -> Deprecations, additions, and compatibility.
  • Cypher 25 Manual -> Deprecations, additions, and compatibility

Release Note for Neo4j 2026.02 (Release date: 2 March 2026)

Server

• The distributed neo4j.conf explicitly sets: db.query.default_language=CYPHER_25. As a result, deployments using the provided configuration file will default to Cypher 25 for newly created databases.
• New page cache metrics for MVCC snapshots and async I/O tracking
  • <prefix>.page_cache.pages_snapshot_loaded
  • <prefix>.page_cache.async_submit
  • <prefix>.page_cache.async_complete
  • <prefix>.page_cache.async_failure

Cypher

• Cypher 25 is the new default query language for newly created organisations. The default query language attached to created databases is determined by the organisation setting “Default Cypher Version” and can be manually changed.
• Change the type of exception thrown for a NodeByIdSeek when ids argument is not a valid list. Exception is now CypherTypeException, rather than ClassCastException or InternalException.

Cypher 25 Additive Features

• General availability: Vector search with filters (in-index filtering) and the new Cypher SEARCH syntax for vector queries are now GA and supported for production use. Vector indexes can include additional properties for filtering at index creation, and filters are applied via the WHERE subclause in SEARCH. See the Cypher SEARCH documentation and vector index documentation for syntax and supported filter predicates; the v2026.01 preview blog post remains a useful background overview.
• Introducing GRAPH TYPE (Preview): GRAPH TYPE provides you the ability to declare your data model in a single, unified blueprint. This enforces strict data integrity including validation of relationship connections and label definitions without sacrificing the flexibility of an open schema.  The GRAPH TYPE feature is offered AS-IS as described in your agreement with Neo4j and should only be used for internal development purposes.
• Added GQL-compliant aliases for existing Cypher functions (e.g., ceiling, local_time, local_datetime, zoned_time, zoned_datetime, duration_between, path_length, ln, collect_list, percentile_disc, percentile_cont, stdev_pop, stdev_samp). These aliases redirect to the existing implementations, improving GQL compliance without changing behaviour.
• Add ai.text.structuredOutput() function to the GenAI Plugin, taking a textual prompt and map schema and outputting the result as a map adhering to the given schema.

Bug fixes

Cypher

• Fixed a bug in pipelined runtime where sometimes queries with multiple SelectOrSemiApply operators in the query plan could fail with error messages like: “Cannot invoke “org.neo4j.cypher.internal.runtime.pipelined.state.AbstractArgumentStateMap$StateController.peek()” because “controller” is null”. 
• Fixed a bug where use of a composite property index in combination with a dynamic node label or dynamic relationship type could result in an incorrect MATCH result being returned. Note: this could also affect the MATCHing portion of a MERGE statement, potentially resulting in the runtime issuing a CREATE that cannot succeed, or an update to the incorrect node. 
• Fixed issue with conditional query WHEN not aggregating null values correctly without a grouping key 
• Fixed a bug with the new MergeUniqueNode operator
• Restored behavior allowing simple node patterns in FOREACH to shadow incoming variables.

Deprecations

• Cypher 5 Manual -> Deprecations, additions, and compatibility.
• Cypher 25 Manual -> Deprecations, additions, and compatibility

• Feature: Export Scene as SVG file
• Feature: Export and import of zipped perspectives with “Export all Perspectives” and “Import”
  
  
• Fix: Pinch to zoom is working again in Canvas
• Fix: Bloom Enterprise users with only read access can export Perspective
• Fix: Accessibility of Search Phrases details
• Fix: ‘Jump to node’ via context menu not zooming on node
• Fix: Loading Scene with old IDs is not working properly
  
  Other minor fixes and improvements.

Bug fix

Server

• Fix a bug where use of a composite property index in combination with a dynamic node label or dynamic relationship type could result in an incorrect MATCH result being returned. Note: this could also affect the MATCHing portion of a MERGE statement, potentially resulting in the runtime issuing a CREATE that cannot succeed, or an update to the incorrect node.
• Fixed an issue where the neo4j-admin backup aggregate command failed to correctly resolve the backup artifact path in the output when run on a cloud-stored backup chain requiring no aggregation.
• System V (SysV) init scripts are now deprecated.  These scripts which reside in /etc/rc.d/init.d/ or /etc/init.d are provided from the Neo4j package installation.  All currently supported Linux distributions use systemd not SysV init scripts by default, so they will be removed in a future release.  Refer to our documentation page on setting up a Linux service.

Cypher

• Bug fix for privileges targeting remote alias constituents.
• Bug fixes and security updates on components of Neo4j

Bundled products

• APOC Core 2026.01.4 – The most popular community library developed for the database, is fully supported (included in Labs directory).
• Bloom 6.x-2.29.0 – A beautiful and expressive data visualization tool to quickly explore and interact with Neo4j’s graph data platform – no coding required. Please refer to the release notes for details.  (Requires a License)
• Browser 2026.02.03+0  – Neo4j Browser is a tool for developers to interact with the graph. It is the default interface for both Enterprise and Community Editions (included in the /libs directory) of the Neo4j database.
• Neo4j GenAI Plugin 2026.01.4 -The GenAI plugin delivers integrations with various generative AI services, including support for transforming text data into vector embeddings using VertexAI, OpenAI, or Amazon Bedrock. The resulting vector embeddings can be used together with Neo4j’s vector search indexes.
• Neo4j Graph Data Science 2.26.0 is a compatible version of the connected data analytics and machine learning platform that helps you understand the connections in big data to answer critical questions and improve predictions. Please refer to the release notes for further details. (GDS Enterprise requires a License. )
• Enterprise Fleet Management 1.1.1 allows a self-managed deployment to be registered within the Aura console, providing a fleet-wide view of all Neo4j instances. It supports EE and CE deployments.
• Neo4j Ops Manager 1.14.1 is a UI-based tool that enables Administrators to operate and observe all of their Neo4j Database Management Servers. Now includes support for Neo4j’s any-to-any upgrade. Please refer to the release notes for details. (Included in Enterprise).

Security

• added a new configuration flag “db.logs.query.obfuscate_errors” which obfuscates errors from the query log

Bundled Packages:

• Cypher-Shell 4.4.48
• labs/apoc-4.4.0.40-core
• products/bloom-plugin-4.x-2.28.1
• products/neo4j-graph-data-science-2.6.11
• products/neo4j-ops-manager-agent-1.15.0
• neo4j-fleet-management-plugin-1.1.1-v4

4.4 End of Support was November 30, 2025

4.4 Changelog

4.4 Operations manual

Security

• added a new configuration flag “db.logs.query.obfuscate_errors” which obfuscates errors from the query log

Bundled Packages:

• labs/apoc-5.26.21
• lib/neo4j-browser-2026.02.03+0
• products/bloom-plugin-5.x-2.29.0
• products/neo4j-genai-plugin-5.26.21
• products/neo4j-graph-data-science-2.13.7
• products/neo4j-ops-manager-agent-1.15.0
• product/fleetManagement-1.1.1

New Features

• None.

Bug fixes

• Fix a bug where the hits algorithm would return similar auth/hub scores for mutate/write.

Other changes

• None.

Important Notice

Server

General

• Public preview: Vector search with filters supported by in-index filtering and new Cypher syntax for querying vectors. See blog post and Cypher Manual -> SEARCH.
• Improved reuse of deleted space for big property values in block format. See Operations Manual -> Space reuse.
• New metric transaction.rollbacks_deadlocked, a counter that shows the total number of transactions that were rolled back due to being deadlocked. See Operations Manual -> Metrics reference.

Security

• General Availability (GA) release of Auth Token Passthrough – Add OIDC credential forwarding as an authentication method to remote database aliases. The column credentials is added to SHOW ALIAS, which shows what type of credentials are used for remote database aliases. See Operations Manual -> Database administration -> Configuring remote database aliases.
• The plain text query log now escapes potentially dangerous unicode characters to avoid log injection.
• added a new configuration flag “db.logs.query.obfuscate_errors” which obfuscates errors from the query log

Neo4j-admin

• Improved path pattern matching for –nodes and –relationships files used by neo4j-admin database import with new parameter –path-pattern-style. See Operations Manual – Import. Possible values are:
  • glob — allows you to write patterns like /some/**/deep/**/nested/structure.*.
  • regex — allows you to write regular expressions, i.e. /some/nested/structure.*.
  • none — you have to enumerate all the file paths exactly, i.e. /some/content/structure1.csv,/some/content/structure2.csv.

Cypher-shell

• New parameter –debug as an alias for –log in Cypher Shell. See Operations Manual -> Cypher Shell

Platforms

• Red Hat Enterprise Linux Server 10.x and CentOS Stream 10.x are now supported platforms. See Operations Manual -> System requirements for details.
• CentOS Stream 8.x is now deprecated, with support for this platform being removed in a future release.
• Container images will now default to use updated Operating Systems. Debian container images now default to using Debian 13 (Trixie) while Red Hat UBI images will default to UBI10. See Operations Manual -> Getting started with Neo4j in Docker for details.

Infinigraph

• A new safety mechanism in Infinigraph deployments to prevent potential data corruption. This mechanism prevents property shard replicas from falling behind by putting the sharded property database into read-only mode. Guidance for identifying and resolving this condition is provided in the Operations Manual -> Transaction log pruning and recovery.

Cypher

Cypher 25 additive features

• New SEARCH subclause that lets developers invoke ANN vector search as part of a MATCH, without calling stored procedures. The update streamlines query authoring, makes advanced search feel native inside Cypher. See Cypher Manual -> Clauses -> Search
• Introduced a query size limit for a query to be considered for query caching. This limit is used to prevent large generated query text strings from occupying memory in the query cache. Such query strings often contain inlined data, and are unlikely to be reusable before auto-parameterization of literals is applied. The default query size limit is 128 KiB of query text. To circumvent the default, prefix the query with either CYPHER cache=force to always cache it, or CYPHER cache=skip to never cache it and skip the query cache lookup. As a best practice, avoid passing data in the query text string and use parameters instead.

Bug fix

Server

• Fixed a bug when deleting a relationship property that was added or changed in the same transaction, that could sometimes cause a NullPointerException and fail the transaction.

Cypher

• Fixed stack overflows when traversing long lists constructed by append/prepend
• Fixed a bug where SHORTEST 1 would return a path shorter than the lower bound of the variable-length pattern.
• Fixed issue with conditional query WHEN not aggregating null values correctly without a grouping key

Bundled products

• APOC Core 2026.01.3 – The most popular community library developed for the database, is fully supported (included in Labs directory).
• Bloom 6.x-2.29.0 – A beautiful and expressive data visualization tool to quickly explore and interact with Neo4j’s graph data platform – no coding required. Please refer to the release notes for details.  (Requires a License)
• Browser 2026.02.03+0  – Neo4j Browser is a tool for developers to interact with the graph. It is the default interface for both Enterprise and Community Editions (included in the /libs directory) of the Neo4j database.
• Neo4j GenAI Plugin 2026.01.3 -The GenAI plugin delivers integrations with various generative AI services, including support for transforming text data into vector embeddings using VertexAI, OpenAI, or Amazon Bedrock. The resulting vector embeddings can be used together with Neo4j’s vector search indexes.
• Neo4j Graph Data Science 2.26.0 is a compatible version of the connected data analytics and machine learning platform that helps you understand the connections in big data to answer critical questions and improve predictions. Please refer to the release notes for further details. (GDS Enterprise requires a License. )
• Enterprise Fleet Management 1.1.1 allows a self-managed deployment to be registered within the Aura console, providing a fleet-wide view of all Neo4j instances. It supports EE and CE deployments.
• Neo4j Ops Manager 1.14.1 is a UI-based tool that enables Administrators to operate and observe all of their Neo4j Database Management Servers. Now includes support for Neo4j’s any-to-any upgrade. Please refer to the release notes for details. (Included in Enterprise).

Security

• Upgraded jose4j to version 0.9.6 to mitigate CVE-2024-29371
• Patch jersey to version 2.46 to resolve CVE-2025-12383

Bundled products

• Cypher-Shell 4.4.47
• labs/apoc-4.4.0.40-core
• products/bloom-plugin-4.x-2.28.1
• products/neo4j-graph-data-science-2.6.11
• products/neo4j-ops-manager-agent-1.14.0
• neo4j-fleet-management-plugin-1.1.1-v4

4.4 End of Support was November 30, 2025

4.4 Changelog

4.4 Operations manual

Compatibility update

• This release and subsequent Neo4j Ops Manager releases require Neo4j persistence to be version 5.26 LTS or greater. 
• Monitoring instances with versions of 4.4 LTS and greater is still supported.

Highlights

• Support Cypher25 for persistence Neo4j 
• Upgrade to spring boot 4 
• Support 2026 versions of Neo4j
• Add alert for query errors in agent

• Use golang:1.24.11-trixie image to fix CVE-2025-22871, CVE-2025-47913, CVE-2025-61725, CVE-2025-61723, CVE-2025-58188, CVE-2025-58187

Internal

• google.golang.org/grpc to 1.78.0 
• org.junit.jupiter:junit-jupiter-engine to 6.0.1
• docker-java.version to 3.7.0
• google.golang.org/protobuf to 1.36.11
• com.google.protobuf:protobuf-java to 4.33.4 
• eu.michael-simons.neo4j:neo4j-migrations-spring-boot-starter to 3.0.0 
• github.com/prometheus/common to 0.67.5
• org.jsoup:jsoup to 1.22.1
• golang.org/x/crypto to 0.47.0
• org.apache.commons:commons-text to 1.15.0
• org.springframework.grpc:spring-grpc-spring-boot-starter to 1.0.1
• com.networknt:json-schema-validator to 3.0.0
• com.graphql-java:graphql-java-extended-scalars to 24.0
• org.apache.commons:commons-lang3 to 3.20.0
• net.bytebuddy:byte-buddy to 1.18.4
• pmd.version to 7.20.0
• com.nimbusds:nimbus-jose-jwt to 10.7

• Feature: Aura Graph Analytics when connected to the Aura Console
• Feature: New circular layout


• Fix: Hide irrelevant error dialogs
• Fix: Issues with Microsoft Fabric
• Fix: Scene interactions with grouped nodes/relationships

Server

• Improves reuse of deleted space for big property values in block format, i.e. some large value records have the potential to be split into multiple smaller if there are lots of unused records in that store.
• Allow transaction termination to happen Async so that it does not block external connections

Security

• Patch lz4 to version 1.10.1 to resolve CVE-2025-66566

Bundled Packages:

• labs/apoc-5.26.20
• lib/neo4j-browser-2026.01.23+0
• products/bloom-plugin-5.x-2.28.1
• products/neo4j-genai-plugin-5.26.20
• products/neo4j-graph-data-science-2.13.7
• products/neo4j-ops-manager-agent-1.14.1
• product/fleetManagement-1.1.1

Overview

Features

• No new features in this patch

Fixes

• Improved handling of transient network connection issues and error messages when API is unreachable
• Fix for issue seen on Neo4j v4 LTS clusters when creating and starting with Fleet Management installed

Deprecation

New Features

• The parameter nodeCapacityProperty has been introduced to set capacity requirements on an individual node level in gds.maxFlow.
• New algorithm for Min-Cost Maximum Flow. Supported modes:
  • gds.maxFlow.minCost.stream
  • gds.maxFlow.minCost.stream.estimate
  • gds.maxFlow.minCost.mutate
  • gds.maxFlow.minCost.mutate.estimate
  • gds.maxFlow.minCost.write
  • gds.maxFlow.minCost.write.estimate
  • gds.maxFlow.minCost.stats
  • gds.maxFlow.minCost.stats.estimate

Bug fixes

• Fixed a bug where gds.maxFlow would return an invalid flow.
• Fixed a bug where Arrow export processes would not be cleaned up properly in some cases.

Other changes

• The ability pass sources/targets with capacity is deprecated in gds.maxFlow, but not removed. The replacement is nodeCapacityProperty instead.

Important Notice

Server

• General Availability (GA) release of Property sharding – property sharding has left preview and is now ready for production usage. See Operations Manual -> Property Sharding (Infinigraph) for details.
• Allowed and denied database names support wildcard patterns, and can have a length between 1 and 63 characters. See Operations Manual -> Configuration settings for details.

Neo4j-admin

• The default number of bad entries before the offline import is aborted is changed from 1000 to unlimited. The import process is optimized for error-free data and cleaning the data before importing it is highly recommended. The bad entry tolerance can be manually set using –bad-tolerance. See Operations Manual -> Import for details.
• Add neo4j-admin backup validate command that checks the integrity and consistency of the backup artifacts for a specified sharded property database. See Operations Manual -> Validate a sharded property database backup for details.

Cypher-shell

• Add –transaction-timeout <duration> argument to Cypher Shell. For details, see Operations Manual -> Cypher Shell.

Platforms

• macOS Tahoe 26 is now a supported platform for development use-cases. See Operations Manual -> System requirements for details.

Security

• Patch lz4 to version 1.10.1 to resolve CVE-2025-66566
• Patch Jersey to version 2.46 to resolve CVE-2025-12383

Cypher

Cypher performance improvements

• Optimize path value comparisons

Bug fixes

Server

• Fixed an issue where any single relationship having more than ~10MiB worth of property data could fail an offline import. This limit is increased to ~2GiB.
• Fixed an issue with neo4j-admin copy/migrate where both source and target database formats are block format, that could cause relationships with large amounts of properties to be truncated.
• Fixed an issue with neo4j-admin copy where a transaction could be duplicated during a store copy. 

Cypher

• Fixed an issue where we could underestimate the heap usage of DISTINCT in Cypher queries. For queries with very large DISTINCT sets this could lead to a JVM OutOfMemoryError instead of the normal recoverable “The memory pool limit was exceeded” error. 
• Fixed a bug where using a subquery expression in allReduce() initializer would fail with an error like Did not find UNNAMED9 in the slot configuration.
• Fixed a bug in parallel runtime queue maintenance where failed queries were holding on to heap memory for longer than necessary.
• Fixed a bug when returning entities located inside a map or list where these were incorrectly evaluated due to a missing eager operator.

Bundled products

• APOC Core 2025.12.1 – The most popular community library developed for the database, is fully supported (included in Labs directory).
• Bloom 6.x-2.28.1 – A beautiful and expressive data visualization tool to quickly explore and interact with Neo4j’s graph data platform – no coding required. Please refer to the release notes for details.  (Requires a License)
• Browser 2025.12.17+0  – Neo4j Browser is a tool for developers to interact with the graph. It is the default interface for both Enterprise and Community Editions (included in the /libs directory) of the Neo4j database.
• Neo4j GenAI Plugin 2025.12.1 -The GenAI plugin delivers integrations with various generative AI services, including support for transforming text data into vector embeddings using VertexAI, OpenAI, or Amazon Bedrock. The resulting vector embeddings can be used together with Neo4j’s vector search indexes.
• Neo4j Graph Data Science 2.24.0 is a compatible version of the connected data analytics and machine learning platform that helps you understand the connections in big data to answer critical questions and improve predictions. Please refer to the release notes for further details. (GDS Enterprise requires a License. )
• Enterprise Fleet Management 1.1.0 allows a self-managed deployment to be registered within the Aura console, providing a fleet-wide view of all Neo4j instances. It supports EE and CE deployments.
• Neo4j Ops Manager 1.14.0 is a UI-based tool that enables Administrators to operate and observe all of their Neo4j Database Management Servers. Now includes support for Neo4j’s any-to-any upgrade. Please refer to the release notes for details. (Included in Enterprise).

Release Note for Neo4j 2026.01 (Release date: 26 January 2026)

Server

• Public preview: Vector search with filters supported by in-index filtering and new Cypher syntax for querying vectors. See blog post.

Bug fixes

Server

• Fixed a bug when deleting a relationship property that was added or changed in the same transaction, which in some cases could cause a NullPointerException and failing the transaction.

Cypher

• Fixed stack overflows when traversing long lists constructed by append/prepend.
• Fixed a bug where SHORTEST 1 would return a path shorter than the lower bound of the variable-length pattern.

• During the rollout of Neo4jAura 2026.01, a bug was identified in conditional queries where WHEN clauses did not correctly handle null values when no grouping key was present. The issue was fixed and the release then proceeded to higher tiers. More details on Status Page.

• During the roll of Neo4j 2025.11, a bug in Dynamic Node Labels and Dynamic Relationship Types was identified. It happened when used with composite (multi-property) indexes, which could lead to the operator sometimes returning incorrect MATCH results. This could also potentially result in updates to the incorrect node, or in the runtime issuing CREATE operations that cannot succeed. The fix has been released and rolling out to higher tiers, but in the meantime we advise customers not to use Dynamic Label/Relationship Types in conjunction with composite indexes.

Deprecations

• For all Cypher language changes, deprecations, and compatibility, see
  • Cypher 5 Manual -> Deprecations, additions, and compatibility.
  • Cypher 25 Manual -> Deprecations, additions, and compatibility

Release Note for Neo4j 2025.12.1 (Release date: 16 January 2026)

Server

Security

• Patched lz4 to version 1.10.1 to resolve CVE-2025-66566
• Patched Jersey to version 2.46 to resolve CVE-2025-12383

Bug fixes

Cypher

• Fixed an issue where we could underestimate the heap usage of DISTINCT in Cypher queries. For queries with very large DISTINCT sets this could lead to a JVM OutOfMemoryError instead of the normal recoverable “The memory pool limit was exceeded” error.
• Fixed a bug where using a subquery expression in allReduce() initializer would fail with an error like Did not find UNNAMED9 in the slot configuration. 
• Fixed a bug in parallel runtime queue maintenance where failed queries were holding on to heap memory for longer than necessary.
• Fixed a bug when returning entities located inside a map or list where these were incorrectly evaluated due to a missing eager operator.

Deprecations

• For all Cypher language changes, deprecations, and compatibility, see
  • Cypher 5 Manual -> Deprecations, additions, and compatibility.
  • Cypher 25 Manual -> Deprecations, additions, and compatibility

Bug fixes

• Fixed a bug where gds.maxFlow would return an invalid flow.
• Fixed a bug where Arrow export processes would not be cleaned up properly in some cases.

Other changes

• We have moved several algorithms and functions from alpha and beta tier into production tier, to indicate that their APIs are finalised, and that they are fully supported. These include:

  • Harmonic Centrality
  • HashGNN
  • HITS
  • K Spanning Tree
  • Longest Path
  • Node2Vec
  • Speaker-Listener Label Propagation
  • Split Relationships
  • Topological Link Prediction functions
  • Topological Sort
  • Triangle Listing

Server

• Fixed an issue where any single relationship having more than ~10MiB worth of property data may fail the import. Now that limit is ~2GiB.
• Fixed an issue when running e.g. copy or migrate where the source and target database is block format, where relationships with a large amount of properties might lose their properties.

Cypher

• More timely query queue maintenance in parallel runtime, to prevent failed queries from holding on to heap memory for longer than necessary.

Security

• Fix to mitigate CVE-2025-12183

Bundled Packages:

• labs/apoc-5.26.19
• lib/neo4j-browser-2025.12.17+0
• products/bloom-plugin-5.x-2.28.1
• products/neo4j-genai-plugin-5.26.19
• products/neo4j-graph-data-science-2.13.7
• products/neo4j-ops-manager-agent-1.14.0
• product/fleetManagement-1.1.0

Important Notice

Cypher

Cypher 25 additive features

• Adds new collection-based functions: coll.distinct, coll.flatten, coll.indexOf, coll.insert, coll.max, coll.min, coll.remove, coll.sort. See documentation.

Cypher performance improvements

• MATCH and MERGE queries that use dynamic labels, like MATCH (p:$(“Person”) { id: 123 }) can now be much faster, since they make use of property indexes. Please see the Cypher Manual documentation for dynamic dynamic MATCH, and dynamic MERGE. 
• Add a new planner operator MergeUniqueNode, speeding up some merge queries when there are uniqueness constraints. For documentation, see here.
• Add a new planner operator MergeInto, speeding up queries like MATCH (a), (b) MERGE (a)-[r:R]->(b). See documentation.
• Performance improvements for SHOW DATABASES with a large number of databases

Bug fixes

• Previously, users could set a property to its existing value without triggering a database change or transaction log entry, and this action was permitted even if they lacked the necessary permission to set the property. Now, any attempt to set a property, even if the value remains the same, will be recorded as a change in the database and the transaction log. Consequently, permissions are now consistently enforced: users who are not allowed to set a property will always be blocked from attempting to set it, regardless of whether the property value is actually modified. This resolves CVE-2025-12738
• Replaces error 42N68 with the correct 42I58 error code.
• Fixes bug where IF NOT EXISTS for fulltext indexes would mistakenly also match on other indexes on the same schema and not just fulltext indexes:
• Fixes bug where ANY INDEX instead of ANY FULLTEXT INDEX on the same label/reltype and property combination caused the IF NOT EXISTS for fulltext indexes to be triggered, and no index to be created 

GenAI Plug-in

• Added new GenAI function ai.text.embed and procedure ai.text.embedBatch to generate vector embeddings as Neo4j vector types. These functions and procedures are available for OpenAI, Azure OpenAI, Google VertexAI and Amazon Bedrock. See documentation for more details.
• Added a new function ai.text.completion to generate text based on a textual input prompt. This function is available for Azure OpenAI, OpenAI, Google VertexAI and Amazon Bedrock. See documentation for more details.
• Added two new procedures: ai.text.embed.providers and ai.text.completion.providers, which list the allowed providers and their config requirements.

Server

Neo4j-admin

• Additional options for backup. For documentation, see the Operations manual -> Back up an online database
  • –skip-recovery Speeds up backup operations, but causes a slower restore operation.
  • –parallel-download When enabled, pulls data from multiple Neo4j servers in parallel.
• Backup now deletes the downloaded store file after packaging it into a backup artefact.

Infinigraph

Security

• Fixes CVE-2025-11602 by initialisation of self-allocated Bolt BitMask

Bug fixes

• Fix for error: “java.lang.ArrayIndexOutOfBoundsException: Index 2 out of bounds for length 2” which occurred on rare occasions when extremely long (2000+ characters) Label, Type, or property name values were used.
• Fix to prevent migration of a database from Block format to Standard format.
• Fix bug in neo4j-admin database dump, where if the flag –overwrite-destination was used, the command could, under some circumstances, produce a corrupt dump file. This dump file would fail to be loaded by the neo4j-admin database load command with a Zstd error “Unknown frame descriptor”.

Bundled products

• APOC Core 2025.11.1 – The most popular community library developed for the database, is fully supported (included in Labs directory).
• Bloom 6.x-2.28.0 – A beautiful and expressive data visualization tool to quickly explore and interact with Neo4j’s graph data platform – no coding required. Please refer to the release notes for details.  (Requires a License)
• Browser 2025.12.11+0  – Neo4j Browser is a tool for developers to interact with the graph. It is the default interface for both Enterprise and Community Editions (included in the /libs directory) of the Neo4j database. 
• Neo4j GenAI Plugin 2025.11 -The GenAI plugin delivers integrations with various generative AI services, including support for transforming text data into vector embeddings using VertexAI, OpenAI, or Amazon Bedrock. The resulting vector embeddings can be used together with Neo4j’s vector search indexes.
• Neo4j Graph Data Science 2.24.0 is a compatible version of the connected data analytics and machine learning platform that helps you understand the connections in big data to answer critical questions and improve predictions. Please refer to the release notes for further details. (GDS Enterprise requires a License. )
• Enterprise Fleet Management 1.1.0 allows a self-managed deployment to be registered within the Aura console, providing a fleet-wide view of all Neo4j instances. It supports EE and CE deployments.
• Neo4j Ops Manager 1.13.2 is a UI-based tool that enables Administrators to operate and observe all of their Neo4j Database Management Servers. Now includes support for Neo4j’s any-to-any upgrade. Please refer to the release notes for details. (Included in Enterprise).

Release Note for Neo4j 2025.11 (Release date: 16 December 2025)

Cypher 25 additive features

• Adds new collection-based functions: coll.distinct, coll.flatten, coll.indexOf, coll.insert, coll.max, coll.min, coll.remove, coll.sort. See documentation.

Cypher performance improvements

• MATCH and MERGE queries that use dynamic labels, like MATCH (p:$(“Person”) { id: 123 }) can now be much faster, since they make use of property indexes. Please see the Cypher Manual documentation for  dynamic MATCH, and dynamic MERGE. 
• Add a new planner operator MergeUniqueNode, speeding up some merge queries when there are uniqueness constraints. For documentation, see here.
• Add a new planner operator MergeInto, speeding up queries like MATCH (a), (b) MERGE (a)-[r:R]->(b). See documentation. 

Bug fixes

• Previously, users could set a property to its existing value without triggering a database change or transaction log entry, and this action was permitted even if they lacked the necessary permission to set the property. Now, any attempt to set a property, even if the value remains the same, will be recorded as a change in the database and the transaction log. Consequently, permissions are now consistently enforced: users who are not allowed to set a property will always be blocked from attempting to set it, regardless of whether the property value is actually modified. This resolves CVE-2025-12738 
• Replaces error 42N68 with the correct 42I58 error code.
• Fixes bug where IF NOT EXISTS for fulltext indexes would mistakenly also match on other indexes on the same schema and not just fulltext indexes:
• Fixes bug where ANY INDEX instead of ANY FULLTEXT INDEX on the same label/reltype and property combination caused the IF NOT EXISTS for fulltext indexes to be triggered, and no index to be created

GenAI Plug-in

• Added new GenAI function ai.text.embed and procedure ai.text.embedBatch to generate vector embeddings as Neo4j vector types. These functions and procedures are available for OpenAI, Azure OpenAI, Google VertexAI and Amazon Bedrock. See documentation for more details.
• Added a new function ai.text.completion to generate text based on a textual input prompt. This function is available for Azure OpenAI, OpenAI, Google VertexAI and Amazon Bedrock. See documentation for more details.
• Added two new procedures: ai.text.embed.providers and ai.text.completion.providers, which list the allowed providers and their config requirements.

Security

• Fixes CVE-2025-11602 by initialisation of self-allocated Bolt BitMask

Bug fixes

• Fix for error: “java.lang.ArrayIndexOutOfBoundsException: Index 2 out of bounds for length 2” which occurred on rare occasions when extremely long (2000+ characters) Label, Type, or property name values were used.

Deprecations

• For all Cypher language changes, deprecations, and compatibility, see 
  • Cypher 5 Manual -> Deprecations, additions, and compatibility.
  • Cypher 25 Manual -> Deprecations, additions, and compatibility

Overview

Highlights

• Support for integrating with SSO for login authorization flow (Docs):
  • Add Google Identity authorization code flow
  • Add Auth0 authorization code flow
  • Add Entra ID authorization code flow
  • Add Okta auth code flow
  • Add profile page for SSO 
  • Block username-password login if it is turned off
  • Log warnings on missing claims, default to empty first/last name, email 
• Migrate to Neo4j Design Library v3
• Migrate to official spring gRPC
• Allow external emails in notification configs
• Add userCreated field to conditions
• Update to Spring boot 3.5.8

Fixes

• Make non-user created conditions undeletable
• Make mTLS cert config optional
• Adding constraint for Metric timestamps
• Add migration to remove any broken metrics

Internal version changes

• Upgrade from 3-eclipse-temurin-24 to 3-eclipse-temurin-25 as docker base image
• protobuf to 1.36.10 
• neo4j-migrations-spring-boot-starter to 2.19.2 
• neo4j-go-driver/v5 to 5.28.4
• crypto to 0.45.0
• grpc to 1.77.0
• prometheus/common to 0.67.4
• jjwt.version to 0.13.0 
• tomcat-embed-core to 11.0.14 
• jsoup to 1.21.2
• nimbus-jose-jwt to 10.6
• byte-buddy to 1.18.2
• json-schema-validator to 2.0.0
• jakarta.validation-api to 3.1.0 
• Use latest protobuf libs
• bcpkix-jdk18on to 1.83
• cobra to 1.10.2
• caffeine to 3.2.3

Bundled Packages:

• labs/apoc-5.26.18
• lib/neo4j-browser-2025.12.01+0
• products/bloom-plugin-5.x-2.28.0
• products/neo4j-genai-plugin-5.26.18
• products/neo4j-graph-data-science-2.13.7
• products/neo4j-ops-manager-agent-1.13.2
• product/fleetManagement-1.1.0

• Backup now deletes the downloaded store file after packaging it into a backup artefact, gradually freeing up space.
• Fix to avoid potential issues in backup/dump commands when the target location is a cloud object store and the object to store exceeds 8GB.
• Fixes bug in neo4j-admin database dump, where if the flag –overwrite-destination was used, the command could, under some circumstances, produce a corrupt dump file. This dump file would fail to be loaded by the neo4j-admin database load command with the error “Unknown frame descriptor.”

• Patch Jersey to 2.46 to resolve CVE-2025-12383.
• Fixes CVE-2025-12738 by blocking users from setting a property to the existing value if they don’t have permission.
• Bump google-cloud-storage 2.43.2 -> 2.60.0 to mitigate CVE-2025-55163.

Bundled Packages:

• labs/apoc-5.26.17
• lib/neo4j-browser-2025.11.20+0
• products/bloom-plugin-5.x-2.27.0
• products/neo4j-genai-plugin-5.26.17
• products/neo4j-graph-data-science-2.13.7
• products/neo4j-ops-manager-agent-1.13.2
• product/fleetManagement-1.1.0

Overview

Highlights

• org.springframework.security:spring-security-core to 6.5.4  to fix CVE-2025-41249
• org.apache.tomcat.embed:tomcat-embed-core to 11.0.12 to fix CVE-2025-55752 and CVE-2025-55754 and CVE-2025-61795

Fixes

• Bring back form validation errors for Notification configuration modals

Internal version changes

• io.github.classgraph:classgraph to 4.8.181
• maven to 3-eclipse-temurin-25
• google.golang.org/protobuf to 1.36.10
• neo4j:neo4j-migrations-spring-boot-starter to 2.19.2
• git-commit-id-maven-plugin to 9.0.2
• pmd.version to 7.17.0
• pmd-core to 7.17.0
• neo4j-go-driver/v5 to 5.28.4
• golang.org/x/crypto to 0.43.0

• This release only bundles the latest version of Bloom, as an older version of Bloom was mistakenly packaged with release 5.26.15

Bundled Packages:

• labs/apoc-5.26.16
• lib/neo4j-browser-2025.11.05+0
• products/bloom-plugin-5.x-2.27.0
• products/neo4j-genai-plugin-5.26.16
• products/neo4j-graph-data-science-2.13.7
• products/neo4j-ops-manager-agent-1.13.1
• product/fleetManagement-1.1.0

New Feature

• Beta release of a new algorithm – Maximum Flow. Supported modes:

  • gds.maxFlow.stream
  • gds.maxFlow.stream.estimate
  • gds.maxFlow.mutate
  • gds.maxFlow.mutate.estimate
  • gds.maxFlow.write
  • gds.maxFlow.write.estimate
  • gds.maxFlow.stats
  • gds.maxFlow.stats.estimate

Server

• Fix for where a secondary may not fully wait for all transactions to have been applied before stopping, which could put it in quarantine

Cypher

• Fix a bug in privilege loading that can prevent the cleanup of dropped database references from the system graph
• Performance improvements for SHOW DATABASES with a large number of databases

Bundled Packages:

• labs/apoc-5.26.15
• lib/neo4j-browser-2025.10.17+0
• products/bloom-plugin-5.x-2.22.1
• products/neo4j-genai-plugin-5.26.15
• products/neo4j-graph-data-science-2.13.7
• products/neo4j-ops-manager-agent-1.13.1
• product/fleetManagement-1.1.0

Release Note for Neo4j 2025.10 (Release date: 29 October 2025)

Cypher

Cypher 25 additive features

• Introduced VECTOR as a new type supported by Cypher, Block store format, and v6 drivers.
• The previous release introduced the ability to format temporal values as strings. In this release, we tackle the other side of the temporals/strings mapping by allowing the construction of temporal values from formatted strings. Temporal value constructors have been extended to take an optional pattern parameter that describes the structure of the incoming temporal string representation.  

Cypher errors improvements

• To assist with error identification, query logs in JSON format and cypher-shell now display the query string along with the position marker of where an error occurred. This enhancement is part of the new error framework.

Bug fixes

Cypher

• Allow using null as default procedure parameter value for all non-primitive types. 
• Fixes a bug where the values in the options maps of CREATE INDEX and CONSTRAINTS commands could become transposed. 

Server

• Fixes a rare issue where malformed tokens (empty string or containing null bytes) could bypass validation and cause database panic
• Avoid stack overflow when sorting free IDs for big value store 

Deprecations

• For all Cypher language changes, deprecations, and compatibility, see 
  • Cypher 5 Manual -> Deprecations, additions, and compatibility.
  • Cypher 25 Manual -> Deprecations, additions, and compatibility

Security changes

• TLS CBC (cipher block chaining) ciphers, as used in TLS v1.2 network encryption, are no longer available by default.   These ciphers have several security vulnerabilities that make them less secure than alternative methods. The Internet Engineering Task Force (IETF) does not recommend using CBC-based ciphers (RFC 8447), and these ciphers were removed from the TLS standard with the development of TLS v1.3.   CBC-based ciphers such as TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 are deprecated and have been unsupported since the 2025.01 Neo4j release.Ensure that applications are using supported TLS ciphers before upgrading to the 2025.10 release. For most deployments no changes are required as other ciphers will be used automatically. Manually adding a cipher to the neo4j.conf will override the defaults to allow a wider range of ciphers, including CBC-based ciphers if needed.  For example: dbms.ssl.policy.bolt.ciphers=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 See our documentation for more information.

Cypher

Cypher 25 additive features

• Introduced VECTOR as a new type supported by Cypher, Block store format, and v6 drivers. See our blog post for details.
• The previous release introduced the ability to format temporal values as strings. In this release, we tackle the other side of the temporals/strings mapping by allowing the construction of temporal values from formatted strings. Temporal value constructors have been extended to take an optional pattern parameter that describes the structure of the incoming temporal string representation.

Cypher errors improvements

• To assist with error identification, query logs in JSON format and cypher-shell now display the query string along with the position marker of where an error occurred. This enhancement is part of the new error framework. 

Server

• Infinigraph Preview The October release introduces property sharding as a preview feature. The preview feature is intended only for testing and development purposes. Property sharding enables the implementation of an Infinigraph architecture allowing the creation of distributed graphs across multiple machines. It provides independent scaling of property data, enabling the handling of larger volumes of properties without impacting the graph topology performance.A sharded property database maintains ACID guarantees for write transactions and full Cypher query support. For details, see the Operations Manual -> Scalability section.
• Java 25 versioned JREs (JDK) are now supported for the platform. See our documentation for more details.
• Introduce a deny list setting server.metrics.deny_filter, which overrides metrics requested in server.metrics.filter. See our documentation for more details.
• Insecure CBC ciphers are removed from defaults in all TLS configurations. For details, see the Operations manual -> SSL framework.

Neo4j-admin

• The backup command now includes a new parameter to filter metadata by user IDs. This enhancement enables the backup of metadata to be restricted to specific users, rather than applying to all users. For example, you can use include-metadata=users=user1,user2 to specify the users that should be included in the metadata script. See the Operations manual -> Changes, deprecations, and removals for more details.

Bug fixes

Cypher

• Allow using null as a default procedure parameter value for all non-primitive types.
• Fixes a bug where the values in the options maps of CREATE INDEX and CONSTRAINTS, CREATE DATABASE, ALTER DATABASE commands could become transposed.

Server

• Fixes a rare issue where malformed tokens (empty string or containing null bytes) could bypass validation and cause database panic.
• Avoid stack overflow when sorting free IDs for a big value store.

Deprecations

• The following Operating Systems are deprecated.  They will continue to be supported along with the next Neo4j Long-Term Support (LTS) release in 2026, but new releases after the 2026 LTS will no longer support these platforms.  We recommend planning an upgrade to a newer Operating System in the meantime. 
  • Red Hat Enterprise Linux 8.x
  • Debian 11.x
  • Windows Server 2022
  • MacOS 13 Ventura
  • MacOS 14 Sonoma

Bundled products

• APOC Core 2025.10.1 – The most popular community library developed for the database, is fully supported (included in Labs directory).
• Bloom 6.x-2.26.0 – A beautiful and expressive data visualization tool to quickly explore and interact with Neo4j’s graph data platform – no coding required. Please refer to the release notes for details.  (Requires a License)
• Browser 2025.10.24+0  – Neo4j Browser is a tool for developers to interact with the graph. It is the default interface for both Enterprise and Community Editions (included in the /libs directory) of the Neo4j database. 
• Neo4j GenAI Plugin 2025.10.1 -The GenAI plugin delivers integrations with various generative AI services, including support for transforming text data into vector embeddings using VertexAI, OpenAI, or Amazon Bedrock. The resulting vector embeddings can be used together with Neo4j’s vector search indexes.
• Neo4j Graph Data Science 2.23.0 is a compatible version of the connected data analytics and machine learning platform that helps you understand the connections in big data to answer critical questions and improve predictions. Please refer to the release notes for further details. (GDS Enterprise requires a License. )
• Enterprise Fleet Management 1.1.0 allows a self-managed deployment to be registered within the Aura console, providing a fleet-wide view of all Neo4j instances. It supports EE and CE deployments.
• Neo4j Ops Manager 1.13.1 is a UI-based tool that enables Administrators to operate and observe all of their Neo4j Database Management Servers. Now includes support for Neo4j’s any-to-any upgrade. Please refer to the release notes for details. (Included in Enterprise).

• Feature: New force-based layout option
• Feature: Exclude vector properties from the user interface
• Feature: Always use webGL renderer for small graphs
  
  
• Fix: Improvements to “Show me a graph”
• Fix: Better permission handling in the UI for users without edit rights
• Fix: Fit all nodes for bigger graphs
• Fix: Preserve layout when ungrouping nodes in coordinate layout
• Fix: Resolve issues with Search phrase with parameters

Server

• Fix possible “Index 2 out of bounds for length 2” errors when using excessively long label, relationship type, or property names
• Progress made by the RAFT Log Shipper will now further the scheduled timeout
• Azure dependencies bumped to address CVE-2025-53864

Bundled Packages:

• labs/apoc-5.26.14
• lib/neo4j-browser-2025.10.17+0
• products/bloom-plugin-5.x-2.26.0
• products/neo4j-genai-plugin-5.26.14
• products/neo4j-graph-data-science-2.13.7
• products/neo4j-ops-manager-agent-1.13.1
• product/fleetManagement-1.1.0

Cypher

• Fixed the missing null-pointer check, which could cause a NullPointerException to be thrown for variable path patterns when concurrent node deletions occur.

Server

• Avoid stack overflow when sorting free IDs for a big value store
• Fixed a bug where, in very rare cases, a uniqueness constraint would mistakenly allow duplicate properties during population of the constraint backing index.
• Update netty to 4.1.126.Final to resolve CVE-2025-58057

Bundled Packages:

• labs/apoc-5.26.13
• lib/neo4j-browser-2025.08.14+0
• products/bloom-plugin-5.x-2.26.0
• products/neo4j-genai-plugin-5.26.13
• products/neo4j-graph-data-science-2.13.7
• products/neo4j-ops-manager-agent-1.13.1
• product/fleetManagement-1.1.0

• Update Netty to 4.1.126.Final to resolve CVE-2025-58057

Bundled Packages:

• Cypher-Shell 4.4.46
• labs/apoc-4.4.0.38-core
• products/bloom-plugin-4.x-2.25.0
• products/neo4j-graph-data-science-2.6.11
• products/neo4j-ops-manager-agent-1.13.0
• neo4j-fleet-management-plugin-1.1.0-v4

4.4 End of Support is November 30, 2025

4.4 Changelog

4.4 Operations manual

Bug Fix

•  Fixed an issue that caused error messages from gds.graph.project Cypher projections to lack specific details on cause of error.

Neo4j Server

Server internals:

• Embedded Lucene upgraded. This brings general performance improvements to indexing and query execution. Heads-up: if you maintain a custom full-text index analyzer provider or other extensions that access Lucene libraries or on-disk files, you may need to update them for compatibility with the new Lucene version.

Neo4j-admin:

• Added –remote-address-resolution to the neo4j-admin database backup command. When used, it allows the DBMS to determine which servers are valid targets to take a backup from for a given database. For documentation, see Operations Manual -> Backup/Restore -> Backup an online database
• Added the ability to run a consistency check against a specific full backup or a dump file when many artifacts are in the same directory. For documentation, see Operation Manual -> Check database consistency.

Cypher 

Cypher 25 additive features:

• Added format() function. The format() function returns a string representation of a temporal value according to a user-defined pattern. For documentation, see the Cypher Manual: format() function.

• When running a valid Cypher 25 query as Cypher 5, the parser will now provide a more informative error, pointing out that the failed Cypher 5 query would be a valid Cypher 25 query. For documentation, see Status Codes for Errors & Notifications -> 42I67

Cypher performance improvements

• Increased the cost of SubtractionNodeByLabelsScan. The Planner should prefer NodeIndexScan over it more often.

Bug fixes

• Fix a bug where, in very rare cases, a uniqueness constraint would mistakenly allow duplicate properties during population of the constraint backing index.
• Fix missing null-pointer check which could lead to a NullPointerException being thrown for variable path patterns when concurrent deletions of nodes occurred.
• Fix for a memory issue that could lead to OutOfMemoryError in physical planning.
• Fix bug that sometimes leads to the wrong result for queries with p=shortestPath() combined with `all(n IN nodes(p) WHERE…)’
• Fix a bug in pipelined runtime dynamic scheduling that could cause certain queries with multiple SelectOrSemiApply operators in the query plan to sometimes fail with error messages like: “Cannot put key 1234 before first key 1235”
• Fix a bug where relationship indexes were not returned in the indexes column of SHOW TRANSACTIONS
• The GQL error code on an invalid allReduce invocation is now 42I51
• Fixes an issue in neo4j-admin import with the block format importer where a very long :ID string could fail the import due to an internal buffer overflow

Deprecations

• For all server changes and deprecations, see Operations Manual -> Changes, deprecations, and removals in Neo4j 2025.x
• For all Cypher language changes, deprecations, and compatibility, see 
  • Cypher 5 Manual -> Deprecations, additions, and compatibility.
  • Cypher 25 Manual -> Deprecations, additions, and compatibility
• CBC (cipher block chaining) ciphers, as used in TLS v1.2 network encryption, have several security vulnerabilities that make them less secure than alternative methods. The Internet Engineering Task Force (IETF) does not recommend using CBC-based ciphers (RFC 8447), and these ciphers were removed from the TLS standard with the development of TLS v1.3.   CBC-based ciphers such as TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 are deprecated and have been unsupported since the 2025.01 Neo4j release.  In our next monthly Neo4j release in October they will be no longer available by default.  Ensure that applications are using supported TLS ciphers before upgrading to the 2025.10 release. Manually adding a cipher to the neo4j.conf will override the defaults.  For example: dbms.ssl.policy.bolt.ciphers=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

Bundled products

• APOC Core 2025.09.0 – The most popular community library developed for the database, is fully supported (included in Labs directory).
• Bloom 6.x-2.24.0 – A beautiful and expressive data visualization tool to quickly explore and interact with Neo4j’s graph data platform – no coding required. Please refer to the release notes for details.  (Requires a License)
• Browser 2025.08.0  – Neo4j Browser is a tool for developers to interact with the graph. It is the default interface for both Enterprise and Community Editions (included in the /libs directory) of the Neo4j database. 
• Neo4j GenAI Plugin 2025.09.0 -The GenAI plugin delivers integrations with various generative AI services, including support for transforming text data into vector embeddings using VertexAI, OpenAI, or Amazon Bedrock. The resulting vector embeddings can be used together with Neo4j’s vector search indexes.
• Neo4j Graph Data Science 2.22.0 is a compatible version of the connected data analytics and machine learning platform that helps you understand the connections in big data to answer critical questions and improve predictions. Please refer to the release notes for further details. (GDS Enterprise requires a License. )
• Enterprise Fleet Management 1.1.0 allows a self-managed deployment to be registered within the Aura console, providing a fleet-wide view of all Neo4j instances. It supports EE and CE deployments.
• Neo4j Ops Manager 1.13.0 is a UI-based tool that enables Administrators to operate and observe all of their Neo4j Database Management Servers. Now includes support for Neo4j’s any-to-any upgrade. Please refer to the release notes for details. (Included in Enterprise).

Overview

Highlights

• org.springframework.security:spring-security-core to 6.5.4  to fix CVE-2025-41248
• org.apache.tomcat.embed:tomcat-embed-core to 11.0.10 to fix CVE-2025-48989

Internal version changes

• github.com/prometheus/common to 0.65.0
• com.networknt:json-schema-validator to 1.5.8
• golang.org/x/crypto to 0.42.0
• spring-security-config.version to 6.5.3
• grpc to 1.75.1
• io.github.classgraph:classgraph to 4.8.180 
• docker-java.version to 3.6.0
• Security upgrade org.apache.commons:commons-lang3 to 3.18.0
• jsoup to 1.21.1 
• kardianos/service to 1.2.4
• neo4j-migrations-spring-boot-starter to 2.18.1
• docker to 28.3.3 
• caffeine to 3.2.2
• google.golang.org/protobuf to 1.36.9
• spf13/cobra to 1.10.1 
• neo4j-go-driver/v5 to 5.28.3
• org.springframework.security:spring-security-web to 6.5.3 
• Use latest ubuntu in dockerfiles

Release Note for Neo4j 2025.09

Neo4j Server

Server

Bug fixes

• Fixed a bug where, in very rare cases, a uniqueness constraint would mistakenly allow duplicate properties during population of the constraint backing index.

Cypher 

Cypher 25 additive features:

• Added format() function. The format() function returns a string representation of a temporal value according to a user-defined pattern.

• When running a valid Cypher 25 query as Cypher 5, the parser will now provide a more informative error, pointing out that the failed Cypher 5 query would be a valid Cypher 25 query.

Cypher performance improvements

• Increased the cost of SubtractionNodeByLabelsScan. The Planner should prefer NodeIndexScan over it more often.

Bug fixes

• Fixed missing null-pointer check which could lead to a NullPointerException being thrown for variable path patterns when concurrent deletions of nodes occurred.
• Fixed a memory issue that could lead to OutOfMemoryError in physical planning.
• Fixed a bug that sometimes leads to the wrong result for queries with p=shortestPath() combined with `all(n IN nodes(p) WHERE…)’
• Fixed a bug in pipelined runtime dynamic scheduling that could cause certain queries with multiple SelectOrSemiApply operators in the query plan to sometimes fail with error messages like: “Cannot put key 1234 before first key 1235”
• Fixed a bug where relationship indexes were not returned in the indexes column of SHOW TRANSACTIONS
• The GQL error code on an invalid allReduce invocation is now 42I51

Deprecations

• For all Cypher language changes, deprecations, and compatibility, see 
  • Cypher 5 Manual -> Deprecations, additions, and compatibility.
  • Cypher 25 Manual -> Deprecations, additions, and compatibility

• Feature: Default Perspective in Standalone (without Plugin)
• Fix: Freeze Bloom UI When Database is Offline
• Fix: Implement a timeout for the scene update request to prevent it from running indefinitely
• Fix: Implement User-Facing Error Notifications for Scene CRUD operations
• Fix: Hide uncategorised labels from Property Value Suggestions from text indexes
• Fix: Fix Bloom slowness on DB with RBAC