Address CVE CVE-2026-44840

• feat (backup): improve lsbackup tool by @shiva-istari in https://github.com/dgraph-io/dgraph/pull/9693
• perf(hnsw): deduplicate neighbor updates and fix error handling by @shaunpatterson in https://github.com/dgraph-*
• fix: zero address change by @shiva-istari in https://github.com/dgraph-io/dgraph/pull/9680
• fix tests by @shiva-istari in https://github.com/dgraph-io/dgraph/pull/9694
• fix(dql): whitespace sensitivity issues in conditional eval by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9692
• fix: address CVE-2026-44840
• chore: update go version by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9699 io/dgraph/pull/9664
• chore: Update jemalloc to 5.3.1 by @RJKeevil in https://github.com/dgraph-io/dgraph/pull/9688

Full Changelog: https://github.com/dgraph-io/dgraph/compare/v25.3.3...v25.3.4

Address CVEs CVE-2026-41327, CVE-2026-41328, CVE-2026-41492

Full Changelog: https://github.com/dgraph-io/dgraph/compare/v24.1.7...v24.1.8

• chore(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 by @dependabot[bot] in https://github.com/dgraph-io/dgraph/pull/9682
• chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.42.0 to 1.43.0 by @dependabot[bot] in https://github.com/dgraph-io/dgraph/pull/9681
• fix: address CVEs: CVE-2026-41327, CVE-2026-41328, CVE-2026-41492

Full Changelog: https://github.com/dgraph-io/dgraph/compare/v25.3.2...v25.3.3

This release addresses CVE-2026-40173

• fix(unique): prevent nil pointer panic in verifyUniqueWithinMutation by @shaunpatterson in https://github.com/dgraph-io/dgraph/pull/9677
• fix(backup): prevent duplicate predicates in backup manifest for vector indexes by @shiva-istari in https://github.com/dgraph-io/dgraph/pull/9679
• fix(sec): address CVE-2026-40173

• @shaunpatterson made their first contribution in https://github.com/dgraph-io/dgraph/pull/9677

Full Changelog: https://github.com/dgraph-io/dgraph/compare/v25.3.1...v25.3.2

This release addresses CVE-2026-34976

Full Changelog: https://github.com/dgraph-io/dgraph/compare/v24.1.5...v24.1.6

• fix(ci): bump trivy to v0.69.3 to resolve 404 download failure by @mlwelles in https://github.com/dgraph-io/dgraph/pull/9660
• fix(dql): support IRI-ref at query start by @eileenaaa in https://github.com/dgraph-io/dgraph/pull/9667
• chore: update go version and new deps by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9668
• addresses CVE-2026-34976

Full Changelog: https://github.com/dgraph-io/dgraph/compare/v25.3.0...v25.3.1

Preview release for Apollo Federation changes proposed for v25.3.1

• Added

• Bulk Loader

  • feat(bulk): add a "skip reduce" flag to the bulk loader (#9618)
  • feat(bulk): add HNSW vector index support to bulk loader (#9598)
  • feat(bulk): add error logging to bulk loader (#9601)

• Test

  • feat(test): simplify macOS testing with automatic cross-compilation (#9585)

• Fixed

• Core

  • fix(posting): prevent stale cache hits when maxTs < readTs (#9597) (#9614)
  • fix(core): fix opentelemetry upgrade issues (#9595)
  • fix: fetch schema over network to ensure @unique check across groups (#9596)

• Test

  • fix(test): resolve macOS binary selection and test data clobbering (#9606)
  • fix(test): macOS local image, plugin tests, and test suite restructuring (#9610)
  • fix(test): make TestDropNamespaceErr resilient to async namespace operations (#9589)

• Changed

• Perf

  • perf(concurrency): cancel remaining goroutines when error occurs (#9484)

• Chore

  • chore: update docs references (#9617)
  • chore(test): Clean up testing guide and Makefile testing dependency checks (#9611)
  • chore: address CVEs (Feb '26 edition) (#9608)

    WARNING In #9608, badger will no longer be copied into the Dgraph image. You can download it from the releases page.

  • chore: suppress receipt of graphql request to logging level 2 (#9612)
  • chore(core): use provider.RetrieveWithCredContext instead of deprecated provider.Retrieve (#9551)
  • chore: remove hardcoded GOMAXPROCS; print cpu info in startup-banner (#9600)

• Dependency Updates

  • chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 (#9616)

Full Changelog: https://github.com/dgraph-io/dgraph/compare/v25.2.0...v25.3.0