Publish release 2026.07

.github/workflows/docs-deploy-surge.yml

@@ -22,7 +22,7 @@ on:
       - completed
 
 jobs:
-  # [Optional] Restrict automatic dpeloyment to PRs from the upstream repo
+  # [Optional] Restrict automatic deployment to PRs from the upstream repo
   # For fork PRs, requires manual approval via the "preview" environment.
   # For PRs from the main repository this job is skipped and deploy-docs runs immediately.
   # Setup: create a "preview" environment in Settings → Environments with required reviewers.
@@ -56,7 +56,7 @@ jobs:
             var artifacts = await github.rest.actions.listWorkflowRunArtifacts({
                owner: context.repo.owner,
                repo: context.repo.repo,
-               run_id: ${{ env.RUN_ID }},
+               run_id: process.env.RUN_ID,
             });
 
             var matchArtifactDocs = artifacts.data.artifacts.filter((artifact) => {
@@ -86,13 +86,32 @@ jobs:
 
       - id: suspicious-path-check
         name: Suspicious paths check
+        shell: bash
         env:
           ARTIFACT_DIR: ${{ runner.temp }}/artifacts/docs
         run: |
+          set -euo pipefail
           cd "$ARTIFACT_DIR"
-          if unzip -l docs.zip | grep -q "\.\./"; then
+
+          mapfile -t ZIP_ENTRIES < <(zipinfo -1 docs.zip)
+          if [ "${#ZIP_ENTRIES[@]}" -eq 0 ]; then
+            echo "docs.zip is empty"
             exit 1
           fi
+          for entry in "${ZIP_ENTRIES[@]}"; do
+            if [[ "$entry" =~ ^/ ]]; then
+              echo "Blocked absolute path in artifact: $entry"
+              exit 1
+            fi
+            if [[ "$entry" =~ (^|/)\.\.(/|$) ]]; then
+              echo "Blocked path traversal in artifact: $entry"
+              exit 1
+            fi
+            if [[ "$entry" == *\\* ]]; then
+              echo "Blocked Windows-style path separator in artifact: $entry"
+              exit 1
+            fi
+          done
 
       - id: hidden-files-check
         name: Hidden files check
@@ -132,6 +151,26 @@ jobs:
           cd "$ARTIFACT_DIR"
           unzip changelog.zip
 
+      # The changelog file is built from untrusted PR content and its contents
+      # are posted to the PR as a comment. A malicious artifact could make
+      # `changelog` a symlink pointing at an arbitrary file the runner can read,
+      # turning the comment step into an arbitrary-file-read. Reject anything
+      # that isn't a plain regular file before we read it.
+      - id: validate-changelog
+        name: Validate changelog is a regular file
+        if: ${{ steps.find-changelog.outputs.has-changelog == 'true' }}
+        env:
+          CHANGELOG_FILE: ${{ runner.temp }}/artifacts/changelog/changelog
+        run: |
+          if [ -L "$CHANGELOG_FILE" ]; then
+            echo "Security Alert: changelog is a symlink — refusing!"
+            exit 1
+          fi
+          if [ ! -f "$CHANGELOG_FILE" ]; then
+            echo "changelog missing or not a regular file"
+            exit 1
+          fi
+
       - id: get-deploy-id
         name: Get deploy ID
         env:
@@ -150,7 +189,7 @@ jobs:
         run: |
           deployurl=$ORG-$REPO-$DEPLOYID.surge.sh
           echo "deploy-url=$deployurl" >> $GITHUB_OUTPUT
-
+      
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: lts/*
@@ -165,7 +204,7 @@ jobs:
           mkdir -p "$DOCS_DEPLOY_DIR"
           # Copy only the built docs into a clean directory for deployment
           cp -R "$DOCS_SRC_DIR"/. "$DOCS_DEPLOY_DIR"/
-
+      
       - id: surge-deploy
         name: Deploy docs to surge
         shell: bash

antora.yml

@@ -1,12 +1,12 @@
 name: status-codes
 title: Status Codes for Errors & Notifications
-version: '2026.06'
+version: '2026.07'
 start_page: ROOT:index.adoc
 nav:
 - modules/ROOT/content-nav.adoc
 asciidoc:
   attributes:
     page-origin-private: false
-    neo4j-version: '2026.06'
-    neo4j-version-exact: '2026.06.0'
-    neo4j-buildnumber: '2026.06'
+    neo4j-version: '2026.07'
+    neo4j-version-exact: '2026.07.0'
+    neo4j-buildnumber: '2026.07'

modules/ROOT/content-nav.adoc

@@ -38,6 +38,8 @@
 **** xref:errors/gql-errors/22015.adoc[]
 **** xref:errors/gql-errors/22G03.adoc[]
 **** xref:errors/gql-errors/22G05.adoc[]
+**** xref:errors/gql-errors/22G06.adoc[]
+**** xref:errors/gql-errors/22G08.adoc[]
 **** xref:errors/gql-errors/22G0I.adoc[]
 **** xref:errors/gql-errors/22N00.adoc[]
 **** xref:errors/gql-errors/22N01.adoc[]
@@ -299,6 +301,8 @@
 **** xref:errors/gql-errors/42I74.adoc[]
 **** xref:errors/gql-errors/42I75.adoc[]
 **** xref:errors/gql-errors/42I78.adoc[]
+**** xref:errors/gql-errors/42I79.adoc[]
+**** xref:errors/gql-errors/42I80.adoc[]
 **** xref:errors/gql-errors/42N00.adoc[]
 **** xref:errors/gql-errors/42N01.adoc[]
 **** xref:errors/gql-errors/42N02.adoc[]
@@ -416,6 +420,7 @@
 **** xref:errors/gql-errors/42NAD.adoc[]
 **** xref:errors/gql-errors/42NAE.adoc[]
 **** xref:errors/gql-errors/42NAM.adoc[]
+**** xref:errors/gql-errors/42NAP.adoc[]
 **** xref:errors/gql-errors/42NFC.adoc[]
 **** xref:errors/gql-errors/42NFD.adoc[]
 **** xref:errors/gql-errors/42NFE.adoc[]

modules/ROOT/pages/errors/gql-errors/22G06.adoc

@@ -0,0 +1,20 @@
+= 22G06
+
+
+== Status description
+error: data exception - invalid date, time, or datetime function field value
+
+== Scenario
+
+A temporal field, such as `year`, `day`, `hour`, `minute`, in the map provided argument of one of the temporal functions `date()`, `time()`, `localtime()`, `datetime()`, `localdatetime()` has an invalid value.
+
+== Possible solution
+
+Adjust the value.
+
+ifndef::backend-pdf[]
+[discrete.glossary]
+== Glossary
+
+include::partial$glossary.adoc[]
+endif::[]

modules/ROOT/pages/errors/gql-errors/22G08.adoc

@@ -0,0 +1,20 @@
+= 22G08
+
+
+== Status description
+error: data exception - invalid duration function field value
+
+== Scenario
+
+A temporal field, such as `years`, `days`, `hours`, `minutes`, in the map provided argument of one of the temporal functions `duration()` has an invalid value.
+
+== Possible solution
+
+Adjust the value.
+
+ifndef::backend-pdf[]
+[discrete.glossary]
+== Glossary
+
+include::partial$glossary.adoc[]
+endif::[]

modules/ROOT/pages/errors/gql-errors/22N03.adoc

@@ -3,6 +3,32 @@
 == Status description
 error: data exception - specified numeric value out of range. Expected `{ <<component>> }` to be of type `{ <<valueType>> }` and in the range `{ <<lower>> }` to `{ <<upper>> }` but found `{ <<value>> }`.
 
+== Example scenario
+
+Try providing a value of `1005` for the `millisecond` field:
+
+[source,cypher]
+----
+RETURN time({hour: 1, minute: 1, second: 1, millisecond: 1005});
+----
+
+The query returns a chain of errors where GQLSTATUS 22N03 is the cause of GQLSTATUS xref:errors/gql-errors/22007.adoc[22007]:
+
+.GQLSTATUS error chain
+[source, error]
+----
+22N03: data exception - specified numeric value out of range. Expected 'Millisecond' to be of type INTEGER and in the range 0 to 999 but found 1005.
+  22007: data exception - invalid date, time, or datetime format
+----
+
+== Possible solution
+
+Provide an integer value in the valid range for the `millisecond` field:
+
+[source,cypher]
+----
+RETURN time({hour: 1, minute: 1, second: 2, millisecond: 5});
+----
 
 ifndef::backend-pdf[]
 [discrete.glossary]

modules/ROOT/pages/errors/gql-errors/22N40.adoc

@@ -3,6 +3,34 @@
 == Status description
 error: data exception - non-assignable temporal component. Cannot assign `{ <<component>> }` of a `{ <<valueType>> }`.
 
+== Example scenario
+
+Try providing a string value for the `minute` field:
+
+[source,cypher]
+----
+RETURN time({hour: 10, minute: '20', second: 23});
+----
+
+The query returns a chain of errors where GQLSTATUS 22N40 is the cause of GQLSTATUS xref:errors/gql-errors/22G06.adoc[22G06]:
+
+.GQLSTATUS error chain
+[source, error]
+----
+22N40: data exception - non-assignable temporal component. Cannot assign 'minute' of a STRING.
+  22G06: data exception - invalid date, time, or datetime function field value
+----
+
+== Possible solution
+
+Provide an integer value for the `minute` field
+
+[source,cypher]
+----
+RETURN time({hour: 10, minute: 20, second: 23});
+----
+
+
 ifndef::backend-pdf[]
 [discrete.glossary]
 == Glossary

modules/ROOT/pages/errors/gql-errors/42I79.adoc

@@ -0,0 +1,73 @@
+= 42I79
+
+== Status description
+error: syntax error or access rule violation - invalid reference in subclause expression. Aggregation in subclause expression is not allowed to reference variables declared in the same clause `{ <<argList>> }`.
+
+== Explanation
+A subclause expression is an expression used in a subclause (e.g., `WHERE` or `ORDER BY`) that belongs to a projection clause.
+If that expression is aggregating, it is not allowed to reference aliases introduced in the same projection clause; only variables incoming to the clause are allowed.
+
+== Example scenario
+Try sorting by an aggregation over a variable that the same `RETURN` clause introduces:
+
+.Aggregates over parity, which is declared in the same clause
+[source,cypher]
+----
+UNWIND [1, 2, 3, 4] AS x
+RETURN x % 2 AS parity, sum(x) AS total
+  ORDER BY sum(parity);
+----
+
+`sum(parity)` is an aggregation, and `parity` is introduced by the same `RETURN` clause.
+
+The query returns a chain of errors where GQLSTATUS 42I79 is the cause of GQLSTATUS xref:errors/gql-errors/42001.adoc[42001]:
+
+.GQLSTATUS error chain
+[source, error]
+
+----
+42I79: syntax error or access rule violation - invalid reference in subclause expression. Aggregation in subclause expression is not allowed to reference variables declared in the same clause: `parity`. (line 3, column 12 (offset: 76))
+"  ORDER BY sum(parity)"
+            ^
+  42001: syntax error or access rule violation - invalid syntax
+----
+
+== Possible solutions
+
+To resolve this issue, aggregate over the underlying incoming expression instead of the same-clause alias:
+
+.Aggregates over the underlying expression x % 2
+[source,cypher]
+----
+UNWIND [1, 2, 3, 4] AS x
+RETURN x % 2 AS parity, sum(x) AS total
+  ORDER BY sum(x % 2);
+----
+
+Alternatively, compute the value in a preceding clause so it is an incoming variable rather than one declared in the same clause:
+
+.Introduces parity in an earlier clause
+[source,cypher]
+----
+UNWIND [1, 2, 3, 4] AS x
+LET parity = x % 2
+RETURN parity, sum(x) AS total
+  ORDER BY sum(parity);
+----
+
+If the aggregation is meant to reuse a value already projected by the clause, reference that return item by its alias without re-aggregating it:
+
+.Sorts by the existing total aggregation
+[source,cypher]
+----
+UNWIND [1, 2, 3, 4] AS x
+RETURN x % 2 AS parity, sum(x) AS total
+  ORDER BY total;
+----
+
+ifndef::backend-pdf[]
+[discrete.glossary]
+== Glossary
+
+include::partial$glossary.adoc[]
+endif::[]