release v4.2.3 - #2000

✅ Approving to unblock you — with 1 thing that needs to be addressed before this merges.

The one thing: docs/concepts/datatypes.md:359 and :364 say 4.2.1 is the last release without #1966's datatype-limit fix, but #1966 missed the 4.2.2 cut, so both sentences should say 4.2.2 (details inline on Cargo.toml:61).

The bump itself is exactly what it should be: the same six files as #1946, #1893 and #1660, and every path package in all three lockfiles resolves to 4.2.3 (53, 27 and 28 of them) under cargo metadata --locked at the head. A trial merge of today's origin/main (61b836e9a) is clean, and all three lockfiles still resolve --locked on the composite, since nothing after bf523e24e touched a manifest. fluree-sql-bridge staying at 4.1.6 matches every release since it was added (it isn't a dist member and has no path deps), and the wasm package.json is 0.0.0-dev by design.

On content, 4.2.3 currently carries #1966, #1988, #1990, #1995, #1997 and #1989 (CI only). Since I'd flagged perf regressions on both #1990 and #1995, I re-ran the same probes against today's main: SELECT ?s ?p WHERE { ?s ?p 25 } takes 0.92 ms at 200k flakes and 4.4 ms at 1M (at review time the PR head measured 67 ms and 343 ms, against 0.78 ms and 3.5 ms at its base), and the computed-key FILTER probe is back to 1.07 fuel from 7.01. The #1966 tests that #1988 broke in a composite are green in main's CI test job at 61b836e9a. So I don't see a known regression on main that 4.2.3 would ship.

A few notes, none blocking:

• The nightly bench-gate has died in "Build benches" every night from 09-26 through today (runner shutdown, exit 143), and the nightly bench-compare runs only in advisory mode against a Mac baseline. So nothing in 4.2.3, or in 4.2.2, has full bench evidence behind it. The spot checks above cover the two regressions we knew about, but it seems worth knowing before tagging.

• Release notes: #1966 has no label, so it will land under "Other Changes" even though it fixes #1751 and adds a new refusal (err:db/DatatypeLimitExceeded, 422). A bug label would put it with the other fixes, and labels can be changed after merge.

• docs/troubleshooting/typed-values-wrong-after-indexing.md:8 says the affected values were written "by a version predating the fix for #1987", and :52 says "Upgrade, then reindex". Now that we know the fix ships in 4.2.3, naming it ("4.2.2 or earlier", "upgrade to 4.2.3 or later") would let an operator tell from fluree --version whether they're affected. This is minor — but if you agree, I'd rather see it folded into this branch alongside the fix above than lost in the backlog.

• What 4.2.3 carries on unknown graphs: #2005 and my #2007 (draft) answer "a dataset clause names a graph the ledger doesn't have" with different statuses (400 vs 404 err:db/GraphNotFound), and whichever lands before this bump is what 4.2.3 ships. I've raised it on #2005; it'd be good to settle there before merging main into this branch, so the next release doesn't flip it.

Adherence to repo commitments:

• Patterns/abstractions: ✔ n/a — version bump only, same shape as the last several release PRs.
• Performance (speed first, memory second): ✔ no code change; the two known regressions from this cycle are fixed on main (measured above).
• Deployment targets: ✔ n/a — the version reaches the binaries only through CARGO_PKG_VERSION (CLI and server version strings, the materialize builder id); solo pins db by rev, so nothing changes there until a repin.
• Testing: ✔ cargo metadata --locked on all three lockfiles, at the head and on the composite with origin/main.
• Conventions: ⚠️ title and file set match the release convention; the one docs version boundary above needs updating.

Verified locally at a806ceefb: three lockfiles resolve --locked (head and composite with 61b836e9a); the #1990 and #1995 perf probes re-run on 61b836e9a; version strings grepped across the tree.

Approving now so you can merge without waiting on another pass from me — just be sure the datatypes.md fix is in before you tag.