RATATOSKRATATOSK
Sign in

OpenFGA

v1.11.3Security
Jan 28, 2026

ACTION 1CHECK 1OTHER 9

Release v1.11.3 combines configuration and observability changes with updates to throttling and metric behavior. It also fixes correctness defects, including the described improper policy enforcement issue.

Action needed (1)

Check if affected (1)

  • breakingThe grpc_code metric label, removed

    Applies if you depend on the metric's grpc_code label.

    v1.11.3 removes the custom grpc_prometheus fork and uses the go-grpc-middleware provider instead. The metric no longer includes the custom grpc_code label.

All 9 other recorded changesfixes 4 · additions 2 · value changes 2 · constraints 1

fixes (4)

  • ListUsers will now properly get datastore throttled if enabled.
  • Cache controller now uses the logger provided to the server instead of always using a no-op logger.
  • Typesystem invalidate model with empty intersection and union.
  • Ordered iterator to iterate tuples correctly.

additions (2)

  • Add configuration option to limit max type system cache size.
  • Add configurable server-side validation for ReadChanges page size. The default max page size remains 100 to maintain backward compatibility, and can be configured via --readChanges-max-page-size CLI flag or OPENFGA_READ_CHANGES_MAX_PAGE_SIZE environment variable.

value changes (2)

  • Datastore throttling separated from dispatch throttling in BatchCheck, ListUsers metadata.
  • throttling_type label added to throttledRequestCounter metric to differentiate between dispatch/datastore throttling.

constraints (1)

  • Add OTEL_* env var support to existing otel env vars.
Add OpenFGA to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All OpenFGA releases →