• fix(security): bump golang.org/x/crypto and x/net for HIGH CVEs by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9763

Full Changelog: https://github.com/dgraph-io/dgraph/compare/v25.3.6...v25.3.7

• ci: remove labeler and simplify change detection by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9751
• test: align GraphQL health check retries with gRPC pattern by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9752
• build(jemalloc): patch jemalloc 5.3.1 source for libstdc++ 16+ ABI removal by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9740
• dgraphtest: add WithStartupArg for arbitrary Alpha flags by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9741
• test: poll for HNSW index readiness instead of fixed sleeps by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9739
• fix: S390x compatibility by @navaneeswar1011 in https://github.com/dgraph-io/dgraph/pull/9746
• fix(security): compare poorman's auth token in constant time by @alhudz in https://github.com/dgraph-io/dgraph/pull/9736
• edgraph: add AlterNoAuth for trusted in-process schema callers by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9748
• x,edgraph,worker: add a reserved-namespace plugin registry by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9753
• x,edgraph: harden reserved-namespace registration and value-lock delete coverage by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9754
• alpha: add public extensibility hooks for the gRPC server and CLI flags by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9742

• @navaneeswar1011 made their first contribution in https://github.com/dgraph-io/dgraph/pull/9746
• @alhudz made their first contribution in https://github.com/dgraph-io/dgraph/pull/9736

Full Changelog: https://github.com/dgraph-io/dgraph/compare/v25.3.5...v25.3.6

• fix(backup): reject incremental backups whose read_ts has regressed by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9707
• chore(deps): Upgrade go 1.26.4; add a openvex for false positive CVE report by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9735
• chore: remove unused buildvars.ComposeBuildDir Var by @mlwelles in https://github.com/dgraph-io/dgraph/pull/9704
• chore(ci): disable scheduled jepsen test runs by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9729
• docs(changelog): backfill v25.3.1-v25.3.4 and v24.1.6-v24.1.9 entries by @mlwelles in https://github.com/dgraph-io/dgraph/pull/9705

Full Changelog: https://github.com/dgraph-io/dgraph/compare/v25.3.4...v25.3.5

This preview release showcases the per-predicate mutation pipeline feature. This feature increases mutation performance for write heavy processes under certain conditions. See the PR for more information.

IMPORTANT A feature flag enables this functionality: --feature-flags="mutations-pipeline-threshold=N" — N=0 disables the pipeline entirely (legacy path), N=1 always uses it, N>1 only routes mutations with ≥ N edges to it. The pipeline pays a per-predicate goroutine spin-up cost, so tiny mutations are slightly slower on it; bulk multi-predicate mutations are faster (crossover ≈ 100 edges in in-process benches; live-loading the 1M dataset is ~1.5× faster end-to-end at threshold=1 vs. legacy). As shipped, the current setting is 1, meaning always ON. It's recommended that for your testing you set the value to somewhere around 100.

Address CVE CVE-2026-44840

• feat (backup): improve lsbackup tool by @shiva-istari in https://github.com/dgraph-io/dgraph/pull/9693
• perf(hnsw): deduplicate neighbor updates and fix error handling by @shaunpatterson in https://github.com/dgraph-*
• fix: zero address change by @shiva-istari in https://github.com/dgraph-io/dgraph/pull/9680
• fix tests by @shiva-istari in https://github.com/dgraph-io/dgraph/pull/9694
• fix(dql): whitespace sensitivity issues in conditional eval by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9692
• fix: address CVE-2026-44840
• chore: update go version by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9699 io/dgraph/pull/9664
• chore: Update jemalloc to 5.3.1 by @RJKeevil in https://github.com/dgraph-io/dgraph/pull/9688

Full Changelog: https://github.com/dgraph-io/dgraph/compare/v25.3.3...v25.3.4

Address CVEs CVE-2026-41327, CVE-2026-41328, CVE-2026-41492

Full Changelog: https://github.com/dgraph-io/dgraph/compare/v24.1.7...v24.1.8

• chore(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 by @dependabot[bot] in https://github.com/dgraph-io/dgraph/pull/9682
• chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.42.0 to 1.43.0 by @dependabot[bot] in https://github.com/dgraph-io/dgraph/pull/9681
• fix: address CVEs: CVE-2026-41327, CVE-2026-41328, CVE-2026-41492

Full Changelog: https://github.com/dgraph-io/dgraph/compare/v25.3.2...v25.3.3

This release addresses CVE-2026-40173

• fix(unique): prevent nil pointer panic in verifyUniqueWithinMutation by @shaunpatterson in https://github.com/dgraph-io/dgraph/pull/9677
• fix(backup): prevent duplicate predicates in backup manifest for vector indexes by @shiva-istari in https://github.com/dgraph-io/dgraph/pull/9679
• fix(sec): address CVE-2026-40173

• @shaunpatterson made their first contribution in https://github.com/dgraph-io/dgraph/pull/9677

Full Changelog: https://github.com/dgraph-io/dgraph/compare/v25.3.1...v25.3.2