Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint).
We recommend upgrading to versions 2026.01.4 (or 5.26.22) where the …
An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:
If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those th…
Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario:
an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any local database or remote alias called "name". If such database …
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.
P…
databases/neo4j: Fix run-time
- Assign UID and GIT to neo4j (both 369)
- Instruct neo4j to run as neo4j user
- Move config directory to PREFIX/etc/neo4j
- Move certificates base directory to PREFIX/etc/neo4j/certificates
- Move data directory to /var/db/neo4j/data
- Move metrics directory to /var/db/neo4j/metrics
- Move import directory to /var/db/neo4j/import
- Fix rc.d script accordingly
Partially based on information from [1] and [2]
PR: 268526 [1]
PR: 228532 [2]
Sponsored by: resulta.sk
Mk/**java.mk: Convert bsd.java.mk to USES
The following features have been added or changed:
- Instead of USE_JAVA use USES=java. This defaults to
USES=java:build,run if NO_BUILD is undefined. Else it defaults to
USES=java:run
- Instead of USE_ANT=yes use USES=java:ant which also implies
USES=java:build
- Instead of JAVA_BUILD=yes use USES=java:build. Does not imply run or
extract
- Instead of JAVA_EXTRACT=yes use USES=java:extract does not imply
build or run
- Instead of JAVA_RUN=yes use USES=java:run does not imply extract or
build
- Instead of USE_JAVA=<version> use USES=java and JAVA_VERSION=<version>
Approved by: mat (portmgr), glewis
Differential Revision: https://reviews.freebsd.org/D48201
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
Update neo4j to v3.3.2.
While we're here, fix up some variable names to ensure that all of the
scripts work (e.g., /usr/local/etc/rc.d/neo4j).
Approved by: crees
Differential Revision: https://reviews.freebsd.org/D14260
Neo4j is the world's leading Graph Database. It is a high performance graph store with all the features expected of a mature and robust database, like a friendly query language and ACID transactions. The programmer works with a flexible network structure of nodes and relationships rather than static tables yet enjoys all the benefits of enterprise-quality database. For many applications, Neo4j of
WWW: https://neo4j.com