Dgraph Files

What's Changed

• feat(zero): Zero now accepts a --security superflag (token=...;whitelist=...), matching Alpha's, and authorizes its administrative HTTP endpoints against it.

  WARNING Zero's admin HTTP endpoints (default port 6080) previously had no authentication. /removeNode and /moveTablet are now always guarded: without a configured token or whitelist, only loopback callers are admitted. /state and /assign keep their previous behavior until a token or whitelist is configured, at which point they are enforced too. Operators driving these endpoints remotely must set --security "whitelist=...;token=..." on Zero.

• fix(backup): contain restore file paths within the handler root by @alhudz in https://github.com/dgraph-io/dgraph/pull/9760

• fix(zero): size-aware predicate move timeout and rebalancer backoff by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9792
• fix(posting): don't serve calculatedUids to reads below their compute ts by @shiva-istari in https://github.com/dgraph-io/dgraph/pull/9801
• chore(test): configure Zero security whitelist in test clusters by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9788
• chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 by @dependabot[bot] in https://github.com/dgraph-io/dgraph/pull/9789
• chore(deps): bump github.com/dgraph-io/gqlgen to v1.0.0 by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9802
• chore: upgrade Go to 1.26.5 by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9797
• chore(deps): bump go.opentelemetry.io/otel from 1.43.0 to 1.44.0 by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9799
• chore(deps): bump golang.org/x/text from 0.37.0 to 0.39.0 by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9798
• chore(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.7 by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9796
• chore: bump SPDX copyright headers from 2025 to 2026 by @mlwelles in https://github.com/dgraph-io/dgraph/pull/9709
• chore: add three published CVEs to openvex.json by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9787
• chore(ci): update ci-dgraph-load-tests.yml by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9800

Full Changelog: https://github.com/dgraph-io/dgraph/compare/v25.3.8...v25.4.0