Skip to content

feat(query): tenant DB in SHOW TRANSACTIONS / SHOW ACTIVE USERS + foreign-read UAF fix + precise stuck-drain diagnostics - #1843

Merged
vpavicic merged 2 commits into
release/3.14from
docs/tenant-db-in-show-transactions
Oct 20, 2026
Merged

feat(query): tenant DB in SHOW TRANSACTIONS / SHOW ACTIVE USERS + foreign-read UAF fix + precise stuck-drain diagnostics#1843
vpavicic merged 2 commits into
release/3.14from
docs/tenant-db-in-show-transactions

Conversation

@andrejtonev

@andrejtonev andrejtonev commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Description

Documents the database and database marked for deletion columns of SHOW ACTIVE USERS INFO (server-stats.mdx) and brings the remaining SHOW TRANSACTIONS outputs on transactions.mdx to the new 8-column shape. The other transactions.mdx changes for the database column (column count, column table, first output, snapshot output) are in #1814 and are not repeated here; both PRs merge without conflicts.

Changes:

  • server-stats.mdx: one row per open session; table of the five columns; recorded example with a session on a database dropped with FORCE.
  • transactions.mdx: snapshot phase values fixed (the server reports lowercase values, and idle before the first phase); db_name on snapshot and GC rows equals the database column; GC example re-recorded with 8 columns; the "Show and terminate transactions" walkthrough re-recorded as one run (the infinite.get() module it used doesn't ship with Memgraph, so it uses a plain long-running query; the client message is the current Transaction was asked to abort by another user.).

Also covers, in the same server-stats.mdx table (to avoid a second PR editing these rows), from memgraph/memgraph#4932 (checked live on the same build): login timestamp is the most recent login and changes when another user logs in on the same connection, while session uuid stays the same; username is the logged-in user even when the session impersonates another user; with no database requested, database is the user's main database.

Release-note gap: the 3.14 entry says the SHOW TRANSACTIONS database column is "the database the session is using"; for the snapshot and GC rows it is the database being snapshotted or collected.

Left for docs#1814 (its hunk): what the database value means for user transactions (the listed transaction's database, not the caller's; always memgraph on Community).

Noticed, not fixed:

  • The GC callout says the user's FREE MEMORY row and the gc row are "distinguished by trigger"; the user's row has empty metadata, so they're told apart by transaction_id.
  • A user's CREATE SNAPSHOT also appears twice (user row and snapshot row); the page says this only for FREE MEMORY.
  • SHOW ACTIVE USERS needs the STATS privilege on Enterprise (already in query-privileges); not repeated on server-stats.

Checked on the 3.14.0-rc3 package (8e7e2c28d, contains #4571), Enterprise and Community.

Product PR

memgraph/memgraph#4571

Checklist

  • For a product change: milestone set to the release and feature or bugfix label added
  • For a product change: this PR is linked from the product PR's documentation checklist

@vercel

vercel Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
documentation Ready Ready Preview Oct 19, 2026 12:31pm UTC

Request Review

@andrejtonev andrejtonev added this to the 3.14 milestone Oct 19, 2026
@andrejtonev andrejtonev added the feature Documentation related to a new product feature of feature update label Oct 19, 2026
@andrejtonev andrejtonev self-assigned this Oct 19, 2026
@andrejtonev andrejtonev mentioned this pull request Oct 19, 2026
Merged
This was referenced Oct 19, 2026
Merged
Merged
Merged
Merged
@andrejtonev
andrejtonev marked this pull request as ready for review October 20, 2026 09:16
@andrejtonev andrejtonev added the status: ready PR is ready for review label Oct 20, 2026
@vpavicic
vpavicic merged commit ffdc47f into release/3.14 Oct 20, 2026
3 checks passed
vpavicic added a commit that referenced this pull request Oct 21, 2026
@vpavicic @cursoragent
@imilinovic @as51340 @katarinasupe @andrejtonev @colinbarry @claude @mattkjames7
Memgraph v3.14.0 (#1764)
44e6543 
* Add Memgraph v3.14.0 and Lab v3.14.0 release note titles

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs: the bare pattern shorthand takes what a MATCH pattern takes (#1756)

* docs: the bare pattern shorthand takes what a MATCH pattern takes

The page stated two rules that no longer hold: that the shorthand's pattern cannot introduce names
of its own, and that it holds a pattern and nothing else so a filter needs the `MATCH` form. It now
takes a variable it declares itself, a trailing `WHERE`, a comma-separated list, a named path and a
lone node.

The worked example is the filter the old text used to send to the `MATCH` form, written as the
shorthand, with output from the page's own dataset. `COLLECT` still has no shorthand.

* docs: a pattern holding only a bound variable matches on its value

A pattern that names a variable the query has already bound used to be ignored, so the row passed
through whatever the variable held. It is now matched: a node is kept, a null matches nothing and
drops the row, and a value that is neither raises. This applies to a top-level MATCH and a CALL {}
subquery as well as to a subquery expression body, which the pages did not say.

Also documents the rule that came with it: a pattern name inside a subquery expression body may not
repeat a name from outside the body.

Every output block was produced by running the query against its own page's dataset block.

* docs: document the nullIf built-in (#1763)

* docs(querying): document the nullIf built-in

nullIf(value1, value2) answers null where the two arguments are equal
and the first argument otherwise, so it takes a value away where
coalesce supplies one.

* docs(querying): drop nullIf from the unsupported function list

It was the only entry under the scalar functions heading, so the
heading goes with it.

* Add Memgraph v3.14.0 release notes and drop per-release sitemap steps.

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs: unlisted auth schemes pass through on coordinators without SSO (#1792)

Document memgraph/memgraph#4962: on a coordinator, any Bolt scheme not
listed in --auth-module-mappings now takes the same passthrough path as
basic/none instead of being rejected outright. Describe the two-path
rule, the per-scheme denial messages once SSO is configured, and the
3.13 -> 3.14 behavior change.

* docs: document disk_available row in SHOW STORAGE INFO (#1791)

Documents the new instance-level disk_available row added in
memgraph/memgraph#4952. Adds it to the SHOW STORAGE INFO reference
table and the example output.

Co-authored-by: Vlasta <95473291+vpavicic@users.noreply.github.com>

* docs: allow UNWIND in an EXISTS, COUNT or COLLECT body (#1783)

* docs: add collections.index_of (#1782)

* feat: label expressions in node patterns and expressions (#1797)

* docs: label expressions in node patterns and expressions

* Update pages/querying/differences-in-cypher-implementations.mdx

---------

Co-authored-by: Vlasta <95473291+vpavicic@users.noreply.github.com>

* Document OPTIONAL CALL subqueries (#1776)

`OPTIONAL CALL ( scope ) { body }` keeps an input row whose subquery returns no
rows, with the subquery's columns set to null - the OPTIONAL MATCH contract.

Section 2.4 said the scoped `CALL (...)` form could not be combined with
`OPTIONAL` and showed the exact query that now works. It is replaced by 1.7
under the supported uses, and 2.4 now covers the case that is still rejected:
`OPTIONAL` on a procedure call rather than on a subquery, with the subquery
wrapping that does work.

* Complete the Memgraph v3.14.0 changelog.

Fill in the remaining breaking, feature, fix, and improvement notes
for merged memgraph PRs on this release.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Add v3.14.0 release notes for nine more PRs and tighten bug-fix skill wording.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Add v3.14.0 release notes for 18 more milestone PRs.

Co-authored-by: Cursor <cursoragent@cursor.com>

* feat(dbms): close idle sessions that keep a FORCE-dropped database pinned (#1831)

* docs: forced DROP DATABASE closes idle sessions on the dropped database

* Apply batched suggestions from code review

Co-authored-by: andrejtonev <29177572+andrejtonev@users.noreply.github.com>

* Apply batched suggestions from code review

Co-authored-by: Vlasta <95473291+vpavicic@users.noreply.github.com>

---------

Co-authored-by: Vlasta <95473291+vpavicic@users.noreply.github.com>
Co-authored-by: andrejtonev <29177572+andrejtonev@users.noreply.github.com>

* How Memgraph compares and orders values (3.14 comparison series) (#1833)

* Document comparisons with null in lists and maps (memgraph#4794)

* Document ordering comparisons for values without an order

* Fix the ORDER BY sentence: two maps raise an error

* Document which values a uniqueness constraint never treats as duplicates

* Document ORDER BY and min/max over columns of different types (3.14 comparison series)

* Keep only what readers hit; don't restate openCypher's comparison rules

* docs: explain and raise the per-process open files limit (#1834)

* docs: explain and raise the open files limit (LimitNOFILE, Docker ulimit)

* docs: soften open files sizing numbers and document the fs.nr_open ceiling

Review follow-up: sizing figures are now approximate, and the section notes
that LimitNOFILE cannot exceed fs.nr_open and how to check it. The heading
anchor #handle-numerous-open-files-simultaneously is referenced from the
Memgraph startup warning.

* docs: pin open files limit change to v3.15 and trim unverified sizing numbers

* docs: restore upstream heading ids after rebase, add ids to new steps, target v3.14

* docs: open files limit — only the hard limit matters on 3.14; symptoms, warning and INFO line

* Document auth queries in explicit transactions (#1836)

Auth queries can now run in an explicit transaction and apply together or
not at all. Add a section on this to the authentication overview, and update
the pages that said auth queries can't run in a transaction. Document that
user and tenant profile changes are now refused in explicit transactions.

* docs(multi-tenancy): what happens after DROP DATABASE ... FORCE (#1842)

* feat(query): tenant DB in SHOW TRANSACTIONS / SHOW ACTIVE USERS + foreign-read UAF fix + precise stuck-drain diagnostics (#1843)

* docs: database columns in SHOW ACTIVE USERS INFO and SHOW TRANSACTIONS outputs

* docs(server-stats): login timestamp, username and database cells match the 3.14 behaviour

* docs: per-session state lasts for the connection; a user switch clears it (#1844)

* release notes 3.14: correct #4571 #4573 #4577 #4843 #4932; add #5029 #5129 #5132 #5135 (#1845)

* feat(query): SHOW/TERMINATE SESSIONS (#1814)

* docs: SHOW SESSIONS and TERMINATE SESSIONS

Documents the session management queries from memgraph/memgraph#4577:
listing open Bolt sessions and terminating them from another connection,
who can see and terminate which sessions, the result columns, and the
SESSIONS reserved keyword. Adds both queries to the query privileges table.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs: apply review on SHOW/TERMINATE SESSIONS

Also fix the TERMINATE TRANSACTIONS parameter claim and add the database
column of SHOW TRANSACTIONS.

* docs: apply review on session wording and termination behavior

* docs: real SHOW TRANSACTIONS output, FORCE note, pooled clients

* Apply batched suggestions from code review

Co-authored-by: andrejtonev <29177572+andrejtonev@users.noreply.github.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Vlasta <95473291+vpavicic@users.noreply.github.com>
Co-authored-by: andrejtonev <29177572+andrejtonev@users.noreply.github.com>

* Conditional subqueries with WHEN in CALL, EXISTS, COUNT and COLLECT (#1813)

* docs: add conditional CALL subqueries with WHEN

* docs: allow WHEN branches in EXISTS, COUNT and COLLECT bodies

* docs: drop the predicate evaluation details

* docs: use Croatian names in the conditional CALL example

* release notes 3.14: add #4524 #4953 #5026 #5032 #5107 #5111 #5126 #5139 #5156

Co-authored-by: Cursor <cursoragent@cursor.com>

* update docs for FIPS builds of Memgraph (#1848)

* update docs for FIPS builds of Memgraph

* update docker page

* docs: move WHEN in EXISTS, COUNT and COLLECT bodies to 3.15

memgraph#4985 moved to the 3.15 milestone.

* docs: tag non-runnable examples and drop duplicate Previous releases heading

* release notes 3.14: #4969 closes only connections whose driver session targeted the database

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Ivan Milinović <44698587+imilinovic@users.noreply.github.com>
Co-authored-by: Andi Skrgat <andi8647@gmail.com>
Co-authored-by: Katarina Supe <61758502+katarinasupe@users.noreply.github.com>
Co-authored-by: andrejtonev <29177572+andrejtonev@users.noreply.github.com>
Co-authored-by: colinbarry <colin.barry@memgraph.io>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Dr Matt James <mattkjames7@gmail.com>
Co-authored-by: katarinasupe <supe.katarina@gmail.com>

This branch was successfully deployed

1 active deployment
Preview — d26222f6 Deployed Oct 19, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vpavicic vpavicic Awaiting requested review from vpavicic vpavicic is a code owner
@gitbuda gitbuda Awaiting requested review from gitbuda gitbuda is a code owner
@Josipmrden Josipmrden Awaiting requested review from Josipmrden Josipmrden is a code owner

Assignees

@andrejtonev andrejtonev

Labels

feature Documentation related to a new product feature of feature update status: ready PR is ready for review

Projects

None yet

Milestone

3.14

Development

Successfully merging this pull request may close these issues.

2 participants

@andrejtonev @vpavicic