Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: OpenFGAClear ×

OpenFGAv1.18.2SecurityAug 3, 2026

ACTION 1OTHER 6View full analysis

A maintenance release with diagnostic logging, experimental cache metric changes, and corrections for weighted-graph and tuple-validation defects. It also updates the Go toolchain and embedded grpc-health-probe in released images.

Action needed (1)

securityhighgrpc-health-probe rebuilt at v0.4.53
The embedded grpc-health-probe is rebuilt with Go 1.26.5 and bumped to v0.4.53 in released images. The update addresses the Go standard library vulnerabilities documented in the Go 1.26.5 release notes, including CVE-2026-39822.

Source ↗

OpenFGAv1.17.1SecurityJun 5, 2026

ACTION 2OTHER 3View full analysis

OpenFGA v1.17.1 combines correctness fixes with security-related Go toolchain and image dependency updates. The security updates address Go standard library vulnerabilities in the toolchain and released images.

Action needed (2)

securityThe Go toolchain, updated to 1.26.4
OpenFGA v1.17.1 updates the Go toolchain version to 1.26.4 to address Go standard library vulnerabilities.
securitygrpc-health-probe updated to v0.4.52
Released images update grpc-health-probe to v0.4.52, rebuilt with Go 1.26.4, so they no longer ship the Go standard library vulnerabilities addressed by this update.

Source ↗

OpenFGAv1.17.0SecurityJun 2, 2026

ACTION 1OTHER 1View full analysis

OpenFGA v1.17.0 adds configurable trace sampling and changes cache key generation. The release concerns deployments that configure tracing or depend on cache key behavior.

Action needed (1)

securityTLV-based cache key generation
OpenFGA v1.17.0 redesigns cache key generation with TLV binary encoding, removing collision risk from string concatenation. It also adds per-process hash seeding to prevent hash-flooding attacks.

Source ↗

OpenFGAv1.16.1SecurityMay 28, 2026

ACTION 1OTHER 3View full analysis

OpenFGA v1.16.1 includes a third-party dependency update for multiple CVEs in the Go standard library. It also corrects defects in the experimental weighted_graph_check behavior.

Action needed (1)

securityThe grpc-health-probe dependency update
grpc-health-probe is updated to v0.4.50 to address multiple CVEs in the Go standard library.

Source ↗

OpenFGAv1.16.0SecurityMay 20, 2026

ACTION 1OTHER 6View full analysis

Release v1.16.0 adds datastore timeout configuration and additional tracing output. It also fixes defects in experimental weighted_graph_check and OIDC authentication, and updates the Go toolchain for standard-library vulnerability fixes.

Action needed (1)

securityThe Go toolchain, updated to 1.26.3
The toolchain now uses Go version 1.26.3 to address vulnerabilities in the Go standard library. This update ships in v1.16.0.

Source ↗

OpenFGAv1.15.0SecurityApr 27, 2026

ACTION 1OTHER 2View full analysis

This release updates the Go toolchain alongside changes to authorization behavior. The Go update addresses standard library vulnerabilities documented in the Go 1.26.2 release notes.

Action needed (1)

securityThe Go toolchain version, updated to 1.26.2
The toolchain Go version is updated to 1.26.2 to address Go standard library vulnerabilities documented in the Go 1.26.2 release notes.

Source ↗

OpenFGAv1.14.0SecurityApr 3, 2026

ACTION 1CHECK 1PLAN 2OTHER 5View full analysis

This release adds an operator-facing histogram metric and ListObjects performance improvements, fixes PostgreSQL and ListObjects defects, and addresses improper BatchCheck policy enforcement. Playground users face a breaking authentication constraint, while the built-in Playground and its port settings are deprecated.

Action needed (1)

securitymediumBatchCheck policy enforcement fix for CVE-2026-34972
The issue was fixed where BatchCheck calls with multiple checks for the same tuple could result in improper policy enforcement. The fix addresses CVE-2026-34972 and GHSA-jwvj-g8pc-cx45.

Check if affected (1)

breakingPlayground authentication limited to none
Applies if the Playground runs with preshared key authentication.
The Playground now supports only the none authentication method. preshared key authentication is no longer supported.

Plan ahead (2)

deprecatedBuilt-in OpenFGA Playground deprecationremoval date not announced
Applies if you use the built-in OpenFGA Playground.
The built-in OpenFGA Playground is deprecated and intended only for development. It will be removed entirely in a future release.
deprecated--playground-port and OPENFGA_PLAYGROUND_PORT deprecation
Applies if you configure --playground-port or OPENFGA_PLAYGROUND_PORT.
The --playground-port flag and OPENFGA_PLAYGROUND_PORT environment variable are deprecated. The Playground server address is specified with --playground-addr (OPENFGA_PLAYGROUND_ADDR) instead, using the full host:port address.

Source ↗

OpenFGAv1.12.0SecurityMar 13, 2026

ACTION 2CHECK 1OTHER 7View full analysis

A maintenance release adds gRPC message-size configuration, changes TLS certificate rotation handling, and updates an experimental default. It also tightens tuple validation, fixes correctness issues, and updates the Go toolchain for disclosed advisories.

Action needed (2)

securityhighGo toolchain version 1.25.8
The Go toolchain is updated to version 1.25.8 to address standard library vulnerabilities identified by GO-2026-4603 and GO-2026-4601.
breakingStricter tuple string validation
Tuple validation now fails when a tuple string contains Unicode control characters or null bytes.

Check if affected (1)

breakingThe pipeline_list_objects experimental default
Applies if you set pipeline_list_objects, set listObjects-pipeline-enabled, or use a custom featureflag client.
pipeline_list_objects is enabled by default in experimental settings. The ListObjects pipeline can be disabled by setting listObjects-pipeline-enabled to false.

Source ↗

OpenFGAv1.11.6SecurityFeb 23, 2026

ACTION 1CHECK 1OTHER 1View full analysis

This release changes the default ListObjects pipeline and narrows the requirements for read-only container deployments. It updates grpc-health-probe to address CVE-2025-68121, while the grpc-gateway client migration remains internal-only.

Action needed (1)

securitycriticalThe grpc-health-probe dependency update for CVE-2025-68121
The grpc-health-probe dependency is updated to v0.4.45 to address CVE-2025-68121.

Check if affected (1)

breakingInternal HTTP-to-gRPC communication over UDS
Applies if you use --read-only.
The HTTP server now communicates with the gRPC server internally over a UDS instead of a TCP socket. Read-only container deployments must also set --tmpfs /tmp when using --read-only.

Source ↗

OpenFGAv1.11.5SecurityFeb 11, 2026

ACTION 1OTHER 1View full analysis

This release includes an operator-facing toolchain update. The change addresses CVE-2025-68121 in OpenFGA v1.11.5.

Action needed (1)

securitycriticalThe Go toolchain, updated to 1.25.7
The Go toolchain is updated to 1.25.7 in OpenFGA v1.11.5 to address CVE-2025-68121.

Source ↗

OpenFGAv1.11.4SecurityFeb 10, 2026

ACTION 1OTHER 1View full analysis

OpenFGA v1.11.4 fixes a planner regression in specific scenarios and updates the OpenTelemetry SDK. The SDK change addresses a disclosed issue affecting earlier versions.

Action needed (1)

securityThe otel/sdk dependency at v1.40.0
The otel/sdk dependency is upgraded to v1.40.0 in OpenFGA v1.11.4 to address the issue identified as SNYK-GOLANG-GOOPENTELEMETRYIOOTELSDKRESOURCE-15182758 in earlier versions.

Source ↗

OpenFGAv1.11.3SecurityJan 28, 2026

ACTION 2OTHER 9View full analysis

This release adds configuration and observability capabilities while changing throttling and metric behavior. It also fixes correctness defects, including a described improper policy enforcement issue.

Action needed (2)

securitymediumThe CVE-2026-24851 and GHSA-jq9f-gm9w-rwm9 policy enforcement fix
The release fixes improper policy enforcement associated with CVE-2026-24851 and GHSA-jq9f-gm9w-rwm9.
breakingThe custom grpc_code metric label, removed
The custom grpc_prometheus fork is replaced with go-grpc-middleware's provider, and the custom grpc_code label is removed from the metric.

Source ↗

Browse by month