RATATOSKRATATOSK
Sign in

OpenFGA

v1.18.2Security
Aug 3, 2026

OpenFGA v1.18.2 is a patch release combining a Go toolchain security update (CVE-2026-39822) with several internal fixes to v2 Check engine behavior, tuple validation, and dependency updates. No APIs or configuration defaults have been removed or renamed.

  • securityGo toolchain security update (CVE-2026-39822)

    Go toolchain updated to 1.26.5 to address CVE-2026-39822. This fix ships in v1.18.2 and applies to all deployments.

  • breakingTuple condition type-restriction validation corrected

    Tuple validation now checks against the correct type-restriction facet. The fix ships in v1.18.2 and applies wherever tuple conditions are validated.

Key changes (7)

  • Go toolchain bumped to 1.26.5 to address CVE-2026-39822
  • Tuple condition validation corrected to check against proper type-restriction facet
  • v2 Check engine: FlattenNode refactored to iterative algorithm to reduce stack-depth risk on deep graphs
  • v2 Check graph node flattening fixed to skip only targeted recursive relations
  • v2 Check caching metrics consolidated with v1 metrics
  • openfga/language dependency updated to fix weighted_graph_check multi-branch recursion bug
  • Added logging for v2 Expand/ListUsers API breaking changes and v2 check exclusion diagnostics
Add OpenFGA to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Source ↗All OpenFGA releases →