arangodb · mpoeter · Oct 14, 2025 · Oct 14, 2025 · Oct 15, 2025 · Oct 15, 2025
diff --git a/CHANGELOG b/CHANGELOG
@@ -1,6 +1,11 @@
 devel
 -----
 
+* Fix a race when collecting list ongoing transactions.
+  The GET /_api/transaction API was missing a lock which could lead to
+  undefined behavior if a transaction would update its state at the same time
+  while we are collecting its details.
+
 * FE-835: Escape HTML in notifications.
 
 * Improved performance of filtered vector index queries by batching document
@@ -24,23 +29,24 @@ devel
   (2M before), maximum 200 (10 before) segments and 8G bytes (800M
   before).
 
-* Fix BTS-2231: Fix a divide-by-zero crash in case a smart edge collection is used in a
-  collect query with a custom index.
+* Fix BTS-2231: Fix a divide-by-zero crash in case a smart edge collection is
+  used in a collect query with a custom index.
 
 * Add API for deployment ID: /_admin/deployment/id .
 
 * Rename the `--experimental-vector-index` startup option to `--vector-index`
-  and remove the experimental flag. The old name can still be used to enable the
-  vector index feature.
+  and remove the experimental flag. The old name can still be used to enable
+  the vector index feature.
 
 * Add vertex collections for graph queries using edge collection syntax
   from named graphs. This means that if a query uses edge collection syntax
   and a named graph defines the from and to vertex collections for that edge
   collection, the WITH statement is no longer required.
 
 * Add filtering support for vector index queries. Filter conditions can now be
-  pushed down into vector similarity searches, enabling filtering with vector index by
-  evaluating filters during the index scan rather than as a post-processing step.
+  pushed down into vector similarity searches, enabling filtering with vector
+  index by evaluating filters during the index scan rather than as a
+  post-processing step.
 
 * Upgraded OpenSSL to 3.5.4.
 
@@ -72,17 +78,17 @@ devel
   during query destruction that could result in undefined behavior (e.g.
   memory leaks or crashes).
 
-* Fix BTS-2213: Adds a retry logic to the UserManager::updateUser to retry in certain situations 
-  (e.g. DB/Col create) until it succeeds instead of giving up after some _rev conflicts.
+* Fix BTS-2213: Adds a retry logic to the UserManager::updateUser to retry in
+  certain situations (e.g. DB/Col create) until it succeeds instead of giving
+  up after some _rev conflicts.
 
-* Fix fuzzer tests. Actually look at `Connection: Close` HTTP header and
-  do not expect the connection to stay open if we see this. This fixes
-  BTS-2185.
+* Fix fuzzer tests. Actually look at `Connection: Close` HTTP header and do not
+  expect the connection to stay open if we see this. This fixes BTS-2185.
 
 * Fix BTS-2220: Fix failing autoupgrade of databases in cluster mode.
-  This was caused by key generation now using the cluster key
-  generator on dbservers, which fails during upgrade with a message that
-  the database was shutting down.
+  This was caused by key generation now using the cluster key generator on
+  dbservers, which fails during upgrade with a message that the database was
+  shutting down.
 
 * Fix BTS-2219: Fix possible crashes with the log id [80e0e] and corresponding
   message
@@ -93,8 +99,8 @@ devel
   the unexpected shutdown so that in particular the RocksDBSyncThread does
   not crash with an assertion failure.
 
-* Fix BTS-2212: Fix a hang on singleserver upgrades. Some of the Upgrade tasks needed 
-  the UserManager to function properly.
+* Fix BTS-2212: Fix a hang on singleserver upgrades. Some of the Upgrade tasks
+  needed the UserManager to function properly.
 
 * Fix BTS-2178: If the URL in an HTTP request is bad, the server will
   now not simply close the connection but give a proper response.
@@ -106,21 +112,24 @@ devel
 * Fix BTS-1732 and BTS-2177: Possible crashes during shutdown, and maintainer
   mode (i.e. non-production) assertions during tests.
 
-* Add a separate thread to the UserManager to handle the load of the user-cache asynchronously.
-  This pre-loads the user-cache as fast as possible (as soon as the global version changes)
-  Also, compared to the old version, this allows the read-only operation to work on the user-cache 
-  for longer and not block each other while trying to load a new version. On a high load environment this also 
-  means a more responsive UserManager and to prevent the thread responsible for the HTTP server to not getting blocked
-  because of user-cache updates.
+* Add a separate thread to the UserManager to handle the load of the
+  user-cache asynchronously.
+  This pre-loads the user-cache as fast as possible (as soon as the global
+  version changes).
+  Also, compared to the old version, this allows the read-only operation to
+  work on the user-cache for longer and not block each other while trying to
+  load a new version. On a high load environment this also means a more
+  responsive UserManager and to prevent the thread responsible for the HTTP
+  server to not getting blocked because of user-cache updates.
 
 * During AQL setup, the Coordinator will no longer block threads while waiting
   for DBServers to finish the query instantiation.
 
 * Add faiss and openmp versions in --version output of arangod.
 
-* Fix BTS-2171: Reduce the amount of code executed on dedicated network threads,
-  which might have reduced its throughput or delayed processing of other network
-  responses.
+* Fix BTS-2171: Reduce the amount of code executed on dedicated network
+  threads, which might have reduced its throughput or delayed processing of
+  other network responses.
 
 * Updated ArangoDB Starter to v0.19.13.
 
@@ -134,7 +143,8 @@ devel
 
 * Fix error message to use proper terminology order instead of mode.
 
-* FE-636: bump jest from 27.5.1 to 30.0.5 (latest version) (form-data package is no longer included)
+* FE-636: bump jest from 27.5.1 to 30.0.5 (latest version) (form-data package
+  is no longer included).
 
 * FE-636: bump http-proxy-middleware from 2.0.6 to 2.0.9 (latest 2.X version).
 
@@ -163,8 +173,8 @@ devel
   fixes that problem in the optimization rule
   remove-filter-covered-by-traversal.
 
- * Fix BTS-2184: Sparse vector index creation fails when with  on documents which don't have
-  and embedding field defined.
+* Fix BTS-2184: Sparse vector index creation fails when with  on documents
+  which don't have and embedding field defined.
 
 * Fix for null access for smallest range when no files on level (RocksDB).
 

diff --git a/arangod/Transaction/Manager.cpp b/arangod/Transaction/Manager.cpp
@@ -1542,6 +1542,8 @@ void Manager::toVelocyPack(VPackBuilder& builder, std::string const& database,
           return;
         }
 
+        READ_LOCKER(guard, trx.rwlock);
+
         builder.openObject(true);
         builder.add("id", VPackValue(std::to_string(tid.id())));
         if (trx.state == nullptr) {