v1.18.0 is a security-focused release with authentication hardening and stricter configuration validation. MySQL deployments have migration and maintenance-window requirements, while OIDC deployments have required issuer and audience settings.
Check if affected (3)
securitymediumMySQL schema migrations 008
Applies if you use the
MySQL backend.v1.18.0 ships schema migrations 008 for the
MySQL backend, and they require a maintenance window. The release note points to the [operator runbook](https://github.com/openfga/openfga/blob/main/assets/migrations/mysql/collation_migrations.md) before upgrading and associates the migrations with CVE-2026-55170 and CVE-2026-55689.securityConstant-time preshared key authentication
Applies if you use preshared key authentication.
The release uses
crypto/subtle.for preshared key authentication in v1.18.0. This closes a timing side-channel caused by the prior map lookup revealing information about valid key bytes.ConstantTimeCompare securityRequired OIDC issuer and audience configuration
Applies if
authn.is set tomethod oidc.v1.18.0 requires both
authn.andoidc. issuer authn.to be set whenoidc. audience authn.ismethod oidc.