Skip to content

dgraph

v25.3.6 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo NoSQL & Document
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

database distributed go knowledge-graph

Affected surfaces

auth

Summary

AI summary

Updates test, ci, and jemalloc across a mixed release.

Full changelog

What's Changed

  • ci: remove labeler and simplify change detection by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9751
  • test: align GraphQL health check retries with gRPC pattern by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9752
  • build(jemalloc): patch jemalloc 5.3.1 source for libstdc++ 16+ ABI removal by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9740
  • dgraphtest: add WithStartupArg for arbitrary Alpha flags by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9741
  • test: poll for HNSW index readiness instead of fixed sleeps by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9739
  • fix: S390x compatibility by @navaneeswar1011 in https://github.com/dgraph-io/dgraph/pull/9746
  • fix(security): compare poorman's auth token in constant time by @alhudz in https://github.com/dgraph-io/dgraph/pull/9736
  • edgraph: add AlterNoAuth for trusted in-process schema callers by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9748
  • x,edgraph,worker: add a reserved-namespace plugin registry by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9753
  • x,edgraph: harden reserved-namespace registration and value-lock delete coverage by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9754
  • alpha: add public extensibility hooks for the gRPC server and CLI flags by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9742

New Contributors

  • @navaneeswar1011 made their first contribution in https://github.com/dgraph-io/dgraph/pull/9746
  • @alhudz made their first contribution in https://github.com/dgraph-io/dgraph/pull/9736

Full Changelog: https://github.com/dgraph-io/dgraph/compare/v25.3.5...v25.3.6

Security Fixes

  • fix(security): compare poorman's auth token in constant time

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track dgraph

Get notified when new releases ship.

Sign up free

About dgraph

high-performance graph database for real-time use cases

All releases →

Related context

Beta — feedback welcome: [email protected]