• feat(security): add a --security "anonymous=..." posture, defaulting to full by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9844
• feat(bulk): deterministic initial tablet placement via --tablet_placement by @shiva-istari in https://github.com/dgraph-io/dgraph/pull/9842
• feat(zero): allow --rebalance_interval=0 to disable automatic tablet rebalancing by @shiva-istari in https://github.com/dgraph-io/dgraph/pull/9848
• feat(edgraph): add an AccessController and separate identity from tenancy by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9813
• perf(unique): make verifyUniqueWithinMutation linear by @shiva-istari in https://github.com/dgraph-io/dgraph/pull/9822
• fix(unique): include language in value identity by @gooohgb in https://github.com/dgraph-io/dgraph/pull/9820
• fix(query): avoid eager UID materialization on posting reads by @gooohgb in https://github.com/dgraph-io/dgraph/pull/9809
• chore(deps): bump badger from v4.9.4 to v4.9.6 by @shiva-istari in https://github.com/dgraph-io/dgraph/pull/9849
• chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 by @dependabot[bot] in https://github.com/dgraph-io/dgraph/pull/9821
• deps: upgrade golang.org/x/crypto to v0.55.0 by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9826
• chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 by @dependabot[bot] in https://github.com/dgraph-io/dgraph/pull/9828
• chore(test): pull MinIO test images from quay.io instead of Docker Hub by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9832
• chore(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 by @dependabot[bot] in https://github.com/dgraph-io/dgraph/pull/9835
• chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.45.0 by @dependabot[bot] in https://github.com/dgraph-io/dgraph/pull/9833
• chore(core): remove net/trace event log by @xqqp in https://github.com/dgraph-io/dgraph/pull/9593
• chore(test): pull MinIO test images from an org-owned ghcr mirror by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9843
• docs: fix typo neccessary -> necessary by @vaibhav8a in https://github.com/dgraph-io/dgraph/pull/9819

• @vaibhav8a made their first contribution in https://github.com/dgraph-io/dgraph/pull/9819

Full Changelog: https://github.com/dgraph-io/dgraph/compare/v25.4.1...v25.5.0

Download page What's new highlights

• Security: Fix CVE-2026-15577
• Security: Fix CVE-2026-33374
• Security: Fix CVE-2026-93294

• Alerting: Strip sensitive headers from oauth2 cross-host redirects #134424, @JacobsonMT
• Dashboard: Fall back when collection deletion is unsupported (#128259) #134229, @bestend

• CVE-2026-92539: IAM: Fix CVE-2026-92539: Scim endpoints (Enterprise)

Download page What's new highlights

• Security: Fix CVE-2026-15577
• Security: Fix CVE-2026-33374
• Security: Fix CVE-2026-93294
• Security: Fix CVE-2026-95502

• Alerting: Strip sensitive headers from oauth2 cross-host redirects #134428, @JacobsonMT
• Dashboard: Fall back when collection deletion is unsupported #134225, @bestend

• CVE-2026-92539: IAM: Fix: SCIM (Enterprise)

Download page What's new highlights

• Security: Fix CVE-2026-15577
• Security: Fix CVE-2026-33374
• Security: Fix CVE-2026-93294
• Security: Fix CVE-2026-95502

• Alerting: Strip sensitive headers from oauth2 cross-host redirects #134426, @JacobsonMT
• Dashboard: Fall back when collection deletion is unsupported #134228, @bestend

• CVE-2026-92539: IAM: Fix: Scim endpoints (Enterprise)

Download page What's new highlights

• Security: Fix CVE-2026-15577
• Security: Fix CVE-2026-33374
• Security: Fix CVE-2026-93294
• Security: Fix CVE-2026-95502

• Alerting: Strip sensitive headers from oauth2 cross-host redirects #134433, @JacobsonMT
• Dashboard: Fall back when collection deletion is unsupported #134224, @bestend
• Git Sync: Clarify repository links for pure Git #134253, @ferruvich
• Provisioning: Allow resource previews in unsynced folders #134391, @grafana-writer[bot]
• Provisioning: Reject invalid resource names before API calls #133776, @grafana-writer[bot]
• Provisioning: Show last checked time in Pull status #134483, @ferruvich
• Provisioning: Skip previews for pull requests from forks #133799, @ferruvich
• Provisioning: Stop PR previews when refs disappear #133855, @ferruvich
• Provisioning: Support legacy paths and diagnose missing source annotations #133779, @grafana-writer[bot]
• Provisioning: write terminal sync status back to repository on early sync-job failures and Respect Git Sync polling intervals after unchanged refs #134478, @mustafasencer

• CVE-2026-92539: IAM: Fix: SCIM (Enterprise)