v25.4.0

[matthewmcneely]

We're pleased to announce the release of Dgraph v25.4.0.

Note a potential breaking feature with the administrative HTTP endpoints for zero:

Zero: authentication for admin HTTP endpoints (--security)

Zero now accepts the same --security superflag as Alpha, adding a token (checked against the X-Dgraph-AuthToken header) and an IP whitelist to gate its admin HTTP endpoints on port 6080. The destructive control-plane endpoints, /removeNode and /moveTablet, are now restricted to loopback by default and require a configured token or whitelisted source IP to be reached remotely. The informational endpoints, /state and /assign, keep their previous behavior and stay open until you configure --security, so existing tooling and monitoring continue to work.

Upgrading: if you move tablets or remove nodes remotely — through Ratel's move-predicate feature or your own scripts against /moveTablet and /removeNode — those calls now require the caller's source IP in the Zero --security "whitelist=..." list, or a matching --security "token=..." sent in the X-Dgraph-AuthToken header. Requests from Ratel originate from the operator's browser machine, so a shared token is usually more practical than whitelisting each client IP. Local (loopback) administration is unaffected.

We've released a new version of Ratel (v25.2.0) which includes a input field for the zero auth token (if you've configured one). Note the alpha and zero auth tokens can, but do not need to match.

What's Changed

• feat(zero): Zero now accepts a --security superflag (token=...;whitelist=...), matching Alpha's, and
  authorizes its administrative HTTP endpoints against it.

  WARNING Zero's admin HTTP endpoints (default port 6080) previously had no authentication.
  /removeNode and /moveTablet are now always guarded: without a configured token or
  whitelist, only loopback callers are admitted. /state and /assign keep their previous
  behavior until a token or whitelist is configured, at which point they are enforced too.
  Operators driving these endpoints remotely must set --security "whitelist=...;token=..." on
  Zero.

• fix(backup): contain restore file paths within the handler root by @alhudz in fix(backup): contain restore file paths within the handler root #9760

• fix(zero): size-aware predicate move timeout and rebalancer backoff by @matthewmcneely in fix(zero): size-aware predicate move timeout and rebalancer backoff #9792

• fix(posting): don't serve calculatedUids to reads below their compute ts by @shiva-istari in fix(posting): don't serve calculatedUids to reads below their compute ts #9801

• chore(test): configure Zero security whitelist in test clusters by @matthewmcneely in chore(test): configure Zero security whitelist in test clusters #9788

• chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 by @dependabot[bot] in chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 #9789

• chore(deps): bump github.com/dgraph-io/gqlgen to v1.0.0 by @matthewmcneely in chore(deps): bump github.com/dgraph-io/gqlgen to v1.0.0 #9802

• chore: upgrade Go to 1.26.5 by @matthewmcneely in chore: upgrade Go to 1.26.5 #9797

• chore(deps): bump go.opentelemetry.io/otel from 1.43.0 to 1.44.0 by @matthewmcneely in chore(deps): bump go.opentelemetry.io/otel from 1.43.0 to 1.44.0 #9799

• chore(deps): bump golang.org/x/text from 0.37.0 to 0.39.0 by @matthewmcneely in chore(deps): bump golang.org/x/text from 0.37.0 to 0.39.0 #9798

• chore(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.7 by @matthewmcneely in chore(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.7 #9796

• chore: bump SPDX copyright headers from 2025 to 2026 by @mlwelles in chore: bump SPDX copyright headers from 2025 to 2026 #9709

• chore: add three published CVEs to openvex.json by @matthewmcneely in chore: add three published CVEs to openvex.json #9787

• chore(ci): update ci-dgraph-load-tests.yml by @matthewmcneely in chore(ci): update ci-dgraph-load-tests.yml #9800

Full Changelog: v25.3.8...v25.4.0

---

This discussion was created from the release v25.4.0.