dgraph-io / dgraph-io/dgraph

Release request: gRPC security update and posting-list cache improvements

Open
#9,831 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
21.8k
Forks
1.6k
Avg merge
2d 5h
Merged PRs (30d)
9

Description

Is your feature request related to a problem? Please describe
During a recent CVE review of our Dgraph deployment, our security scanner flagged CVE-2026-84304 in Dgraph v25.4.1. We noticed that the gRPC upgrades to v1.83.1 in #9821 and then v1.83.2 in #9828 have already been merged, addressing the affected dependency.
We also run with the posting-list cache disabled (percentage=0,...) and would like to test whether the changes in #9809 improve memory usage and performance for our workload.
Describe the solution you'd like
Would it be possible to cut a release tag with these changes soon? This would help us address the CVE finding and test the posting-list cache improvements in our environment.
Describe alternatives you've considered
Building a custom image from source is an option, but we would prefer an official release for our validation and deployment process.
Additional context
Related PRs:
#9821: Upgrade gRPC from v1.82.1 to v1.83.1.
#9828: Upgrade gRPC from v1.83.1 to v1.83.2.
#9809: Posting-list UID cache improvements.
Thanks for your work on these updates!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No files, tests, or entry points are named. Start by reviewing PRs #9821, #9828, and #9809 alongside the repository's release process; done means an official release tag containing those merged changes and suitable for CVE validation.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, grpc
Domain
databases, release, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.