Added Added diagnostic logging in experimental weighted_graph_check when v2 Check resolution might produce a different result than v1 for the same query. These logs surface authorization models that may be affected by a future v1 deprecation, and no operator action is required. #3149 Added diagnostic logging in Expand and ListUsers when v2 resolution might produce a different result than v1 for th…
🚨 Operational warning for MySQL users 🚨 This release contains a migration for MySQL which acquires a shared lock on the tuple and changelog tables. This is a potentially-lengthy migration, during which you will not be able to perform Write operations. What you should do: Do not execute auto-migrations on startup for production instances with large datasets. Please refer to this migration guide bef…
Changed Update PR workflow benchmark comparison to be less flakey. #3153 Fixed Fixed experimental weighted_graph_check falling back to the standard algorithm on errors that v1 would reject identically or that should not be retried. ErrTransactionThrottled, check.ErrValidation, check.ErrInvalidUser, and *tuple.InvalidTupleError (from contextual-tuple validation) are now returned directly instead of…
Added Added a configurable trace sampler via trace.sampler (OPENFGA_TRACE_SAMPLER / OTEL_TRACES_SAMPLER), supporting the standard OpenTelemetry strategies always_on, always_off, traceidratio, parentbased_always_on, parentbased_always_off, and parentbased_traceidratio. This lets OpenFGA honor upstream parent sampling decisions when running as a downstream service. Defaults to traceidratio to preser…
Changed Added workflow-level concurrency.group and cancel-in-progress for PR-related workflow runs to reduce wasted effort. #3140 Fixed Fixed experimental weighted_graph_check incorrectly falling back to the standard algorithm on deadline/cancellation/throttle-timeout errors; these are now returned directly. Also fixed weighted_graph_check emitting metrics under the wrong method label when used as…
Added Added datastore ping timeout (PingTimeout) and datastore ping retry timeout (PingRetryMaxElapsedTime) configurations. #3113 Changed Report allowed result and tuple_key on Check and experimental weighted_graph_check resolution trace spans. #3116 Fixed Fixed cache key collisions in experimental weighted_graph_check union resolution by moving result caching from the union node level to the indi…
Changed Reuse a single MySQL container across tests by replacing the test fixture implementation, improving test performance and reducing resource usage. #3042 Fixed Fixed a potential panic within command error handling. #3091 Fixed a bug that propagated expected errors from list objects when a path short-circuits. #3096 Fixed cache key collisions in experimental weighted_graph_check for edges in…
Changed Implemented edge pruning in the list objects pipeline algorithm. This introduces a measurable improvement to request latency for larger, more complex authorization models. #3075 Fixed Fixed experimental weighted_graph_check query cache being skipped when the cache controller returns a zero invalidation time (e.g., on cold start or when disabled), despite the cache controller documenting th…
Added Added configuration for the server shutdown timeout. #2976 Changed Made some minor changes in ListObjects to reduce heap allocations. Results in minor latency reduction. #3043 Improve cache key generation performance by removing fmt usage and extend control-character sanitization to all cache key inputs (tuples, conditions, context). #3006 Fixed Fixed AuthZEN discovery metadata to publish en…
Fixed Use delimiter in contextual tuple key in experimental weighted_graph_check, and add validation in v2Check. Thanks to @0xmrma for reporting this bug. #3064 Full Changelog: v1.14.1...v1.14.2