AI-analyzed release notes for CNCF graduated and incubating projects.
This release updates the Go toolchain alongside changes to authorization behavior. The Go update addresses standard library vulnerabilities documented in the Go 1.26.2 release notes.
Action needed (1)
securityThe Go toolchain version, updated to 1.
The toolchain Go version is updated to 1. to address Go standard library vulnerabilities documented in the Go 1.26.2 release notes.
This release contains an operator-facing bug fix in OpenFGA. The recorded note tail refers to delimiter handling in the experimental weighted_graph_check and added validation in v2Check.
A maintenance release adds server shutdown-timeout configuration and performance improvements in object listing and cache key generation. It also corrects an AuthZEN discovery security issue and replaces a vulnerable test dependency.
Check if affected (2)
securityAuthZEN discovery metadata endpoint URLs
Applies if authzen. is configured.
AuthZEN discovery metadata now publishes endpoint URLs from the configured authzen. instead of request-supplied host headers, preventing host-header poisoning.
securityThe github. test dependency, replaced with Moby
Applies if tests run.
The vulnerable github. package, used only in tests, was removed and replaced with Moby (client & api).
This release adds an operator-facing histogram metric and ListObjects performance improvements, fixes PostgreSQL and ListObjects defects, and addresses improper BatchCheck policy enforcement. Playground users face a breaking authentication constraint, while the built-in Playground and its port settings are deprecated.
Action needed (1)
securitymediumBatchCheck policy enforcement fix for CVE-2026-34972
The issue was fixed where BatchCheck calls with multiple checks for the same tuple could result in improper policy enforcement. The fix addresses CVE-2026-34972 and GHSA-jwvj-g8pc-cx45.
Check if affected (1)
breakingPlayground authentication limited to none
Applies if the Playground runs with preshared key authentication.
The Playground now supports only the none authentication method. preshared key authentication is no longer supported.
Plan ahead (2)
deprecatedBuilt-in OpenFGA Playground deprecationremoval date not announced
Applies if you use the built-in OpenFGA Playground.
The built-in OpenFGA Playground is deprecated and intended only for development. It will be removed entirely in a future release.
deprecated--playground-port and OPENFGA_PLAYGROUND_PORT deprecation
Applies if you configure --playground-port or OPENFGA_PLAYGROUND_PORT.
The --playground-port flag and OPENFGA_PLAYGROUND_PORT environment variable are deprecated. The Playground server address is specified with --playground-addr (OPENFGA_PLAYGROUND_ADDR) instead, using the full host:port address.
