What's Changed

• feat(zero): Zero now accepts a --security superflag (token=...;whitelist=...), matching Alpha's, and
  authorizes its administrative HTTP endpoints against it.

  WARNING Zero's admin HTTP endpoints (default port 6080) previously had no authentication.
  /removeNode and /moveTablet are now always guarded: without a configured token or
  whitelist, only loopback callers are admitted. /state and /assign keep their previous
  behavior until a token or whitelist is configured, at which point they are enforced too.
  Operators driving these endpoints remotely must set --security "whitelist=...;token=..." on
  Zero.

• fix(backup): contain restore file paths within the handler root by @alhudz in #9760

• fix(zero): size-aware predicate move timeout and rebalancer backoff by @matthewmcneely in #9792

• fix(posting): don't serve calculatedUids to reads below their compute ts by @shiva-istari in #9801

• chore(test): configure Zero security whitelist in test clusters by @matthewmcneely in #9788

• chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 by @dependabot[bot] in #9789

• chore(deps): bump github.com/dgraph-io/gqlgen to v1.0.0 by @matthewmcneely in #9802

• chore: upgrade Go to 1.26.5 by @matthewmcneely in #9797

• chore(deps): bump go.opentelemetry.io/otel from 1.43.0 to 1.44.0 by @matthewmcneely in #9799

• chore(deps): bump golang.org/x/text from 0.37.0 to 0.39.0 by @matthewmcneely in #9798

• chore(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.7 by @matthewmcneely in #9796

• chore: bump SPDX copyright headers from 2025 to 2026 by @mlwelles in #9709

• chore: add three published CVEs to openvex.json by @matthewmcneely in #9787

• chore(ci): update ci-dgraph-load-tests.yml by @matthewmcneely in #9800

Full Changelog: v25.3.8...v25.4.0

What's Changed

• add stale action by @shiva-istari in #9759
• chore: add abstraction for worker operations by @matthewmcneely in #9578
• chore(deps): bump badger to v4.9.4 and ristretto to v2.4.2 by @matthewmcneely in #9771

Full Changelog: v25.3.7...v25.3.8

What's Changed

• fix(security): bump golang.org/x/crypto and x/net for HIGH CVEs by @matthewmcneely in #9763

Full Changelog: v25.3.6...v25.3.7

What's Changed

• ci: remove labeler and simplify change detection by @matthewmcneely in #9751
• test: align GraphQL health check retries with gRPC pattern by @matthewmcneely in #9752
• build(jemalloc): patch jemalloc 5.3.1 source for libstdc++ 16+ ABI removal by @matthewmcneely in #9740
• dgraphtest: add WithStartupArg for arbitrary Alpha flags by @matthewmcneely in #9741
• test: poll for HNSW index readiness instead of fixed sleeps by @matthewmcneely in #9739
• fix: S390x compatibility by @navaneeswar1011 in #9746
• fix(security): compare poorman's auth token in constant time by @alhudz in #9736
• edgraph: add AlterNoAuth for trusted in-process schema callers by @matthewmcneely in #9748
• x,edgraph,worker: add a reserved-namespace plugin registry by @matthewmcneely in #9753
• x,edgraph: harden reserved-namespace registration and value-lock delete coverage by @matthewmcneely in #9754
• alpha: add public extensibility hooks for the gRPC server and CLI flags by @matthewmcneely in #9742

New Contributors

• @navaneeswar1011 made their first contribution in #9746
• @alhudz made their first contribution in #9736

Full Changelog: v25.3.5...v25.3.6

What's Changed

• fix(backup): reject incremental backups whose read_ts has regressed by @matthewmcneely in #9707
• chore(deps): Upgrade go 1.26.4; add a openvex for false positive CVE report by @matthewmcneely in #9735
• chore: remove unused buildvars.ComposeBuildDir Var by @mlwelles in #9704
• chore(ci): disable scheduled jepsen test runs by @matthewmcneely in #9729
• docs(changelog): backfill v25.3.1-v25.3.4 and v24.1.6-v24.1.9 entries by @mlwelles in #9705

Full Changelog: v25.3.4...v25.3.5

This preview release showcases the per-predicate mutation pipeline feature. This feature increases mutation performance for write heavy processes under certain conditions. See the PR for more information.

IMPORTANT
A feature flag enables this functionality: --feature-flags="mutations-pipeline-threshold=N" — N=0 disables the pipeline entirely (legacy path), N=1 always uses it, N>1 only routes mutations with ≥ N edges to it. The pipeline pays a per-predicate goroutine spin-up cost, so tiny mutations are slightly slower on it; bulk multi-predicate mutations are faster (crossover ≈ 100 edges in in-process benches; live-loading the 1M dataset is ~1.5× faster end-to-end at threshold=1 vs. legacy). As shipped, the current setting is 1, meaning always ON. It's recommended that for your testing you set the value to somewhere around 100.

What's Changed

• feat (backup): improve lsbackup tool by @shiva-istari in #9693
• perf(hnsw): deduplicate neighbor updates and fix error handling by @shaunpatterson in https://github.com/dgraph-*
• fix: zero address change by @shiva-istari in #9680
• fix tests by @shiva-istari in #9694
• fix(dql): whitespace sensitivity issues in conditional eval by @matthewmcneely in #9692
• fix: address CVE-2026-44840
• chore: update go version by @matthewmcneely in #9699
  io/dgraph/pull/9664
• chore: Update jemalloc to 5.3.1 by @RJKeevil in #9688

Full Changelog: v25.3.3...v25.3.4

Address CVE CVE-2026-44840

What's Changed

• chore(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 by @dependabot[bot] in #9682
• chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.42.0 to 1.43.0 by @dependabot[bot] in #9681
• fix: address CVEs: CVE-2026-41327, CVE-2026-41328, CVE-2026-41492

Full Changelog: v25.3.2...v25.3.3

Address CVEs CVE-2026-41327, CVE-2026-41328, CVE-2026-41492

Full Changelog: v24.1.7...v24.1.8