dgraph-io/dgraph v25.4.0

on GitHub

What's Changed

• feat(zero): Zero now accepts a --security superflag (token=...;whitelist=...), matching Alpha's, and
  authorizes its administrative HTTP endpoints against it.

  WARNING Zero's admin HTTP endpoints (default port 6080) previously had no authentication.
  /removeNode and /moveTablet are now always guarded: without a configured token or
  whitelist, only loopback callers are admitted. /state and /assign keep their previous
  behavior until a token or whitelist is configured, at which point they are enforced too.
  Operators driving these endpoints remotely must set --security "whitelist=...;token=..." on
  Zero.

• fix(backup): contain restore file paths within the handler root by @alhudz in #9760

• fix(zero): size-aware predicate move timeout and rebalancer backoff by @matthewmcneely in #9792

• fix(posting): don't serve calculatedUids to reads below their compute ts by @shiva-istari in #9801

• chore(test): configure Zero security whitelist in test clusters by @matthewmcneely in #9788

• chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 by @dependabot[bot] in #9789

• chore(deps): bump github.com/dgraph-io/gqlgen to v1.0.0 by @matthewmcneely in #9802

• chore: upgrade Go to 1.26.5 by @matthewmcneely in #9797

• chore(deps): bump go.opentelemetry.io/otel from 1.43.0 to 1.44.0 by @matthewmcneely in #9799

• chore(deps): bump golang.org/x/text from 0.37.0 to 0.39.0 by @matthewmcneely in #9798

• chore(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.7 by @matthewmcneely in #9796

• chore: bump SPDX copyright headers from 2025 to 2026 by @mlwelles in #9709

• chore: add three published CVEs to openvex.json by @matthewmcneely in #9787

• chore(ci): update ci-dgraph-load-tests.yml by @matthewmcneely in #9800

Full Changelog: v25.3.8...v25.4.0