Release Date: 14 October 2026

The Neo4j Aura October release has started to roll out, commencing on AuraDB Free and progressing to higher tiers later. 

Release Note for Neo4j 2026.10 

Advance notice of upcoming changes

DBMS.Components

Currently, dbms.components currently reports 5.27 on Aura regardless of the version actually running your database. After the 2026.12 LTS, dbms.components will report the calendar version of the engine actually running your database, for example [2027.01]. Nothing changes in this release.  
Who this affects
Any application or integration that reads the value returned by dbms.components and depends on its format. This includes the Kafka connector, the Spark connector and GraphQL integrations.  
What to do before then
  • Check whether your application parses the value returned by dbms.components.
  • Update any logic that assumes a 5.x version string so that it accepts a calendar version.
   

Database Password Requirements

Starting in January, alongside the upgrade of Neo4j AuraDB instances to the 2027.01 release, we are increasing the minimum password length for native database users from 8 characters to 16 characters.
Why are we making this change?
At Neo4j, we take the security of your data seriously. Password length is one of the most effective tools for keeping accounts secure. This update aligns Neo4j Aura with modern security best practices and recommendations from standards bodies like NIST.
Who is impacted?
For the vast majority of our customers, this change will have no impact and requires no action. You will not be affected by this change if:
  • You use secure 16+ character passwords such as the automatically generated 44-character password issued when an Aura instance is first deployed.
  • You manage user authentication through an external OIDC SSO provider rather than native database users.
What about existing native users?
Existing native database users will not be impacted. Your current passwords will continue to work without interruption. The new 16-character minimum will only be enforced in the following scenarios:
  1. When creating a new native database user.
  2. When changing or resetting the password for an existing native database user.
If you have any questions or need assistance adjusting your provisioning scripts to accommodate the new minimum length, please reach out to Neo4j Support.  

New features and improvements

Database

  • Dynamic Row-Level Security via ABAC User Tags in PBAC: you can now reference Attribute-Based Access Control (ABAC) user tags inside Property-Based Access Control (PBAC) rules using abac.native.user_tags().
This enables a capability similar to dynamic Row-Level Security (RLS) in relational databases by restricting access based on whether an element’s property matches the authenticated user’s tags. Example:
GRANT TRAVERSE ON GRAPH * FOR (n:Project) WHERE n.department IN abac.native.user_tags() TO projectTeam
Limitation:  Negation unsupported: Unlike standard IN expressions, predicates using abac.native.user_tags() cannot be negated with NOT.  See Operations Manual → Grant a property-based privilege using native user tags and Operations Manual → Negation and DENY with abac.native.user_tags().  

Cypher 25

  • Improve the concurrency of CALL { … } IN CONCURRENT TRANSACTIONS DISJOINT BY transaction batch scheduling with resource access conflicts between batches.
  • Added a parameter to db.schema.visualization() to eliminate ghost relationships, at the cost of some performance. See Operations Manual -> Procedures for details.
  • Introduced map addition, allowing maps to be merged using the plus operator; RETURN map1 + map2
  • Added the capability to combine SHOW CURRENT USER command with regular Cypher that can be run against the system database, for example, SHOW DATABASES and SHOW TRANSACTIONS. To ensure the command is run against the system database, prepend it with the USE clause. See Operations Manual – Manage users for details.
 

Bug Fixes

  • Fixed an issue where dividing the minimum 64-bit integer (-9223372036854775808) by -1 silently returned an incorrect result due to integer overflow. Cypher now correctly detects this condition and raises an arithmetic overflow error (22N28), ensuring consistent overflow handling across integer arithmetic operations.

Deprecations

    Please refer to the changelog for full details of the changes, and Neo4j Release notes for all changes to other Neo4j products and services.

Recent Aura Releases

See All Aura Releases →