This release includes 1 security fix for security teams reviewing exposed deployments.
Published 1mo
NoSQL & Document
✓ No known CVEs patched
This release patches 1 known CVE
Topics
database
distributed
go
knowledge-graph
Affected surfaces
auth
Summary
AI summaryUpdates test, ci, and jemalloc across a mixed release.
Full changelog
What's Changed
- ci: remove labeler and simplify change detection by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9751
- test: align GraphQL health check retries with gRPC pattern by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9752
- build(jemalloc): patch jemalloc 5.3.1 source for libstdc++ 16+ ABI removal by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9740
- dgraphtest: add WithStartupArg for arbitrary Alpha flags by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9741
- test: poll for HNSW index readiness instead of fixed sleeps by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9739
- fix: S390x compatibility by @navaneeswar1011 in https://github.com/dgraph-io/dgraph/pull/9746
- fix(security): compare poorman's auth token in constant time by @alhudz in https://github.com/dgraph-io/dgraph/pull/9736
- edgraph: add AlterNoAuth for trusted in-process schema callers by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9748
- x,edgraph,worker: add a reserved-namespace plugin registry by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9753
- x,edgraph: harden reserved-namespace registration and value-lock delete coverage by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9754
- alpha: add public extensibility hooks for the gRPC server and CLI flags by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9742
New Contributors
- @navaneeswar1011 made their first contribution in https://github.com/dgraph-io/dgraph/pull/9746
- @alhudz made their first contribution in https://github.com/dgraph-io/dgraph/pull/9736
Full Changelog: https://github.com/dgraph-io/dgraph/compare/v25.3.5...v25.3.6
Security Fixes
- fix(security): compare poorman's auth token in constant time
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]