dgraph version history

- Added stale action - Added abstraction for worker operations - Updated dependencies (badger to v4.9.4, ristretto to v2.4.2)

- Security updates for golang.org/x/crypto and x/net to address HIGH CVEs

## What's Changed * ci: remove labeler and simplify change detection by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9751 * test: align GraphQL health check retries with gRPC pattern by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9752 * build(jemalloc): patch jemalloc 5.3.1 source for libstdc++ 16+ ABI removal by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9740 * dgraphtest: add WithStartupArg for arbitrary Alpha flags by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9741 * test: poll for HNSW index readiness instead of fixed sleeps by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9739 * fix: S390x compatibility by @navaneeswar1011 in https://github.com/dgraph-io/dgraph/pull/9746 * fix(security): compare poorman's auth token in constant time by @alhudz in https://github.com/dgraph-io/dgraph/pull/9736 * edgraph: add AlterNoAuth for trusted in-process schema callers by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9748 * x,edgraph,worker: add a reserved-namespace plugin registry by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9753 * x,edgraph: harden reserved-namespace re

## What's Changed * fix(backup): reject incremental backups whose read_ts has regressed by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9707 * chore(deps): Upgrade go 1.26.4; add a openvex for false positive CVE report by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9735 * chore: remove unused buildvars.ComposeBuildDir Var by @mlwelles in https://github.com/dgraph-io/dgraph/pull/9704 * chore(ci): disable scheduled jepsen test runs by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9729 * docs(changelog): backfill v25.3.1-v25.3.4 and v24.1.6-v24.1.9 entries by @mlwelles in https://github.com/dgraph-io/dgraph/pull/9705 **Full Changelog**: https://github.com/dgraph-io/dgraph/compare/v25.3.4...v25.3.5

This preview release showcases the per-predicate mutation pipeline feature. This feature increases mutation performance for write heavy processes under certain conditions. See the [PR](https://github.com/dgraph-io/dgraph/pull/9467) for more information. **IMPORTANT** A feature flag enables this functionality: `--feature-flags="mutations-pipeline-threshold=N"` — N=0 disables the pipeline entirely (legacy path), N=1 always uses it, N>1 only routes mutations with ≥ N edges to it. The pipeline pays a per-predicate goroutine spin-up cost, so tiny mutations are slightly slower on it; bulk multi-predicate mutations are faster (crossover ≈ 100 edges in in-process benches; live-loading the 1M dataset is ~1.5× faster end-to-end at threshold=1 vs. legacy). **As shipped, the current setting is 1, meaning always ON. It's recommended that for your testing you set the value to somewhere around 100.**

## What's Changed * feat (backup): improve lsbackup tool by @shiva-istari in https://github.com/dgraph-io/dgraph/pull/9693 * perf(hnsw): deduplicate neighbor updates and fix error handling by @shaunpatterson in https://github.com/dgraph-* * fix: zero address change by @shiva-istari in https://github.com/dgraph-io/dgraph/pull/9680 * fix tests by @shiva-istari in https://github.com/dgraph-io/dgraph/pull/9694 * fix(dql): whitespace sensitivity issues in conditional eval by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9692 * fix: address CVE-2026-44840 * chore: update go version by @matthewmcneely in https://github.com/dgraph-io/dgraph/pull/9699 io/dgraph/pull/9664 * chore: Update jemalloc to 5.3.1 by @RJKeevil in https://github.com/dgraph-io/dgraph/pull/9688 **Full Changelog**: https://github.com/dgraph-io/dgraph/compare/v25.3.3...v25.3.4

Address CVE CVE-2026-44840

## What's Changed * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 by @dependabot[bot] in https://github.com/dgraph-io/dgraph/pull/9682 * chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.42.0 to 1.43.0 by @dependabot[bot] in https://github.com/dgraph-io/dgraph/pull/9681 * fix: address CVEs: CVE-2026-41327, CVE-2026-41328, CVE-2026-41492 **Full Changelog**: https://github.com/dgraph-io/dgraph/compare/v25.3.2...v25.3.3

Address CVEs CVE-2026-41327, CVE-2026-41328, CVE-2026-41492 **Full Changelog**: https://github.com/dgraph-io/dgraph/compare/v24.1.7...v24.1.8

## What's Changed * fix(unique): prevent nil pointer panic in verifyUniqueWithinMutation by @shaunpatterson in https://github.com/dgraph-io/dgraph/pull/9677 * fix(backup): prevent duplicate predicates in backup manifest for vector indexes by @shiva-istari in https://github.com/dgraph-io/dgraph/pull/9679 * fix(sec): address CVE-2026-40173 ## New Contributors * @shaunpatterson made their first contribution in https://github.com/dgraph-io/dgraph/pull/9677 **Full Changelog**: https://github.com/dgraph-io/dgraph/compare/v25.3.1...v25.3.2

This release addresses CVE-2026-40173