ScalarDL 3.12 Release Notes

This page includes a list of release notes for ScalarDL 3.12.

v3.12.4

Release date: September 8, 2026

Summary

This release includes several improvements, bug fixes, and vulnerability fixes. For detailed changes, see the following.

Backward-incompatible changes

The nonce of a contract execution request must now be a canonical UUID. A request whose nonce is not a canonical UUID (36 characters in the 8-4-4-4-12 hyphenated form; uppercase and lowercase hex are both accepted) is now rejected. The client SDKs have always generated UUID nonces, so this affects only applications that pass their own nonce through the deprecated executeContract methods that take a nonce argument. If your application does this, either stop passing a nonce and let the SDK generate one, or make sure the value you pass is a canonical UUID. (#662)

Community and Enterprise editions

Improvements

• Added validation that the nonce of a contract execution request is a canonical UUID. Rejecting a malformed nonce at the server entry point prevents it from corrupting downstream bookkeeping. (#662)
• Upgraded ScalarDB to 3.16.7, which replaces MySQL Connector/J with MariaDB Connector/J. (#608)

Bug fixes

• Fixed an issue where contracts could not access a JDBC database (e.g., PostgreSQL). (#558)
• Fixed the Ledger to reject unsupported ScalarDB transaction managers at startup instead of silently accepting them. (#585)
• Fixed contract execution failing with an AccessControlException when ScalarDL runs on a ScalarDB multi-storage configuration backed by JDBC (or DynamoDB / Cloud Storage), by granting the required sandbox permissions regardless of the configured storage type. (#588)
• Fixed an issue where contract execution failed when database connections needed to be re-established (for example, after a database restart or an idle timeout) with the SecurityManager enabled. (#621)
• Fixed a race condition where pausing a Ledger (or Auditor/Gateway) server could report success while the server remained unpaused. (#637)
• Fixed several vulnerabilities in grpc-health-probe. (#589)
• Fixed CVE-2026-54512 and CVE-2026-54513. (#591)
• Fixed CVE-2026-33818, CVE-2026-39821, CVE-2026-46600, CVE-2026-56852, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862, CVE-2026-84304, and GHSA-hrxh-6v49-42gf. (#681)

Enterprise edition

Bug fixes

• Fixed lock-related error codes and their solutions.
• Fixed read lock count corruption caused by concurrent recovery and eliminated unnecessary CAS failures when recovering multiple read lock nonces.
• Fixed an issue in the Auditor where a Ledger call failure during asset lock recovery was reported to clients as a generic runtime error, or its cause was lost by being treated as an unknown transaction state.
• Fixed an issue where the Auditor on JDBC databases (Oracle) could fail to execute contracts with a DL-COMMON-305001 error caused by reading an asset lock entry whose value was stored as NULL.
• Fixed an issue where contract execution on Auditor failed when database connections needed to be re-established (for example, after a database restart or an idle timeout) with the SecurityManager enabled.
• Fixed an issue where releasing a read or write lock could fail with a misleading INCONSISTENT_STATES error, or release another transaction's write lock, when a concurrent recovery had already released the lock.
• Fixed an issue where retrying a read lock release could fail with a StackOverflowError and retry without any wait when the underlying storage kept failing conditional writes.
• Fixed an issue where releasing a read lock could leave the lock owner list and the lock count inconsistent.

v3.12.3

Release date: March 26, 2026

Summary

This release includes several bug fixes and vulnerability fixes.

Community and Enterprise editions

Bug fixes

• Fixed the parameter name for the client entity ID. (#376)
• Fixed a bug where users cannot register a custom ValidateLedger contract after bootstrapping. (#404)
• Fixed CVE-2025-61726, CVE-2025-61728, CVE-2025-61729 and CVE-2025-68121. (#472)

Enterprise edition

Bug fixes

• Fixed Gateway exception handling.
• Fixed a SLF4J version conflict in BYOL Docker images.

v3.12.2

Release date: December 26, 2025

Summary

This release includes several bug fixes and vulnerability fixes.

Community and Enterprise editions

Bug fixes

• Fixed bugs to handle FLOAT and BLOB data types in the PutToMutable function. (#297)
• Fixed NullPointerException when a client is misconfigured with a digital signature. (#302)
• Fixed status code handling. (#323)
• Fixed CVE-2025-47907 and CVE-2025-58183. (#364)
• Fixed CVE-2025-55163. (#365)

v3.12.1

Release date: October 8, 2025

Summary

This release has several bug fixes.

Community edition

Bug fixes

• Fixed JSON Schema Validator repository and version. (#277)

Enterprise edition

Bug fixes

• Fixed duplicated read lock.

v3.12.0

Release date: September 22, 2025

Summary

This release introduces several enhancements, such as ScalarDL HashStore and TableStore, and includes several improvements and bug fixes. For detailed changes, see the following.

Enhancements

• Added ScalarDL HashStore. (#255, #256, #260, #261)
• Added ScalarDL TableStore. (#180, #192, #220, #221, #239, #246, #260, #261)

Improvements

• Supported time-related data types in the generic function. (#200)
• Bundled the ValidateLedger contract into the client. (#254, #260)
• Disabled the coordinator write omission in ScalarDB. (#203)

Bug fixes

• Fixed the state management behavior for read-only transactions. (#181)
• Fixed certificate and secret key version check and messages. (#202)
• Fixed Ledger and Auditor configuration validations for correct authentication settings. (#222)
• Fixed IS NULL and IS NOT NULL conditions handling in table-oriented generic contracts. (#238)
• Fixed CVE-2025-22874. (#262)