OpenFGA

v1.19.0Security

2026年8月25日

依存関係の更新に加え、不正なモデルへの防御的な修正、ログ出力の見直し、内部ストリーミング処理の最適化を含む保守リリースです。既に保存された不正なモデルはキャッシュミス時の扱いが変わり、暗黙に縮退実行されなくなります。

影響確認 (1)

breaking保存済みの不正なモデルを ErrInvalidModel で拒否
適用対象はリリースノートに明記されていません。
既に保存された不正なモデルは、キャッシュミス時に暗黙の縮退状態で実行されず、ErrInvalidModel を返して解決に失敗します。

その他の記録済み変更 18 件すべてvalue changes 10 · fixes 6 · additions 1 · removals 1

* chore(deps): bump the dependencies group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/openfga/openfga/pull/3229
* chore(deps): bump the dependencies group across 1 directory with 6 updates by @dependabot[bot] in https://github.com/openfga/openfga/pull/3243
* chore(deps): bump the dependencies group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/openfga/openfga/pull/3251
* chore(deps): bump the dependencies group with 8 updates by @dependabot[bot] in https://github.com/openfga/openfga/pull/3252
* chore(deps): bump the dependencies group with 2 updates by @dependabot[bot] in https://github.com/openfga/openfga/pull/3260
* chore(deps): bump the dependencies group with 3 updates by @dependabot[bot] in https://github.com/openfga/openfga/pull/3261
* chore(deps): bump the dependencies group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/openfga/openfga/pull/3253
* chore(deps): bump the dependencies group with 3 updates by @dependabot[bot] in https://github.com/openfga/openfga/pull/3269
* chore(deps): bump the dependencies group with 4 updates by @dependabot[bot] in https://github.com/openfga/openfga/pull/3270
* chore(deps): bump grpc-ecosystem/grpc-health-probe from v0.4.55 to v0.4.56 in the dependencies group by @dependabot[bot] in https://github.com/openfga/openfga/pull/3268

* fix: scope context-cancelation stripping to query execution only by @senojj in https://github.com/openfga/openfga/pull/3255
* fix: update potential resolution changes logs to only log on InfoLevel by @Vic-Dev in https://github.com/openfga/openfga/pull/3254
* fix(typesystem): prevent panic on malformed RelationReference by @adriantam in https://github.com/openfga/openfga/pull/3262
Fixed validation-ordering defect where malformed RelationReference (relation_or_wildcard oneof set but yielding neither wildcard nor non-empty relation) panicked WriteAuthorizationModel.
Scope context-cancelation stripping to query execution only. No longer can deadlock on saturated connection pool.
Updated v2 resolution diagnostic logging in Check and ListUsers to gate on InfoLevel log level.

* feature: create a new "difference direct subtract" worker that can stream its results by @senojj in https://github.com/openfga/openfga/pull/3267

OpenFGAをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。今回の破壊的変更も、その一例です。