Skip to content

Releases: authzed/spicedb

v1.54.0

18 Jun 23:27
@miparnisari miparnisari
Immutable release. Only release title and notes can be modified.
v1.54.0
3647a6e

Choose a tag to compare

View all tags
v1.54.0 Latest
Latest

Security

  • Prevent cache poisoning. The dispatch Check cache key now incorporates check hints. See GHSA-4vrg-r928-h5vv

Added

  • Query Planner: fast serialize/deserialize for query plans (#3122)

Changed

  • Cache: switch to otter as the primary cache implementation (#3112)
  • Server handles: GRPCDialContext as a handle on the server used deprecated gRPC methods. We modernized it and renamed it to NewClient (#3147)

Fixed

  • The watching schema cache (--enable-experimental-watchable-schema-cache) no longer enters permanent fallback on transient watch errors. A new supervisor restarts the watch cycle with bounded exponential backoff and only treats caller-driven cancellation or unsupported-watch as terminal (#3134)
  • Watch consumers that request WatchCheckpoints now eventually observe every revision returned by WriteRelationships as a checkpoint. MemDB regressed this in #2578 for no-op writes and MySQL never emitted checkpoints at all prior to now. Both now emit a checkpoint at the new revision. (#3114)
  • When Query Planner evaluates a union, short-circuit if one of the branches yields a positive un-caveated result (#3120)
  • DispatchQueryPlan previously did not try to use the singleflight middleware for check calls. (#3119)
  • Fixed regression introduced in 1.53.0. Postgres HeadRevision no longer allocates a new transaction ID on every call (#3127)
  • Fixed regression introduced in 1.53.0 for MySQL migration scripts (#3129)
  • Query Planner: LookupSubjects no longer returns a subject excluded from a wildcard (e.g. viewer:* - banned) when the exclusion feeds an intersection (experimental --experimental-query-plan ls) (#3136)
  • Tracing: When server is shutting down, flush traces. Also, elide the need for setting OTEL_EXPORTER_OTLP_ENDPOINT. (#3108)
  • Fixed a LookupSubjects issue in the query planner around the handling of wildcards in compound permissions (#3140)
  • MySQL: identifiers (object/subject IDs and relationship counter names) are now stored with a case-sensitive (binary) collation, matching the Postgres, CockroachDB, and Spanner datastores. Previously, identifiers differing only in letter case (e.g. Foo and foo) incorrectly collided in unique indexes and lookups. ⚠️ The migration rebuilds the relation_tuple table in place via ALTER TABLE, which can hold a metadata/table lock for a long time on large datasets — run the upgrade in a low-traffic window, or apply it with an online schema-change tool (e.g. gh-ost). (#3161)
  • server.NewConfigWithOptionsAndDefaults now populates Config and its embedded structs with the same defaults as the CLI flags, fixing zero-value behavior when embedding SpiceDB as a library. (#3156)

What's Changed

New Contributors

Docker Images

This release is available at authzed/spicedb:v1.54.0, quay.io/authzed/spicedb:v1.54.0, ghcr.io/authzed/spicedb:v1.54.0

Contributors

ecordell, barakmich, and 9 other contributors
Assets 16

v1.53.0

13 May 18:48
@miparnisari miparnisari
Immutable release. Only release title and notes can be modified.
v1.53.0
b15effc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.53.0

Added

  • Add DispatchExecutor, a query plan executor that is Dispatch-aware and sends subproblems on Alias boundaries (#3074)

  • Implement Dispatch caching for query plan execution (#3079)

  • Add new optimizer to query planner based on set theory laws for simplifications (#3051)

  • Experimental: Add unified schema storage with ReadStoredSchema/WriteStoredSchema APIs for improved schema read performance (#2924)

    This feature stores the entire schema as a single serialized proto rather than reading individual namespace and caveat definitions separately, significantly improving schema read performance.

    Migration to unified schema storage is controlled by the --experimental-schema-mode flag, which supports a 4-phase rolling migration:

    1. read-legacy-write-legacy (default) - No change; reads and writes use legacy per-definition storage.
    2. read-legacy-write-both - Reads from legacy storage, writes to both legacy and unified storage. This is the first migration step and backfills the unified schema table.
    3. read-new-write-both - Reads from unified storage, writes to both. Validates the new read path while maintaining backward compatibility.
    4. read-new-write-new - Reads and writes only unified storage. This is the final migration target.

    Deployment:

    • Progress through the stages manually by updating the --experimental-schema-mode flag and performing a rolling restart at each stage. You can also take the system down briefly and move directly from stage 1 to stage 4, which runs the full migration in one step.

Changed

  • Build: strip quarantine attribute for MacOS (#3082)

Fixed

  • Query plan contexts are written to during recursive calls -- for now, disable dispatch inside recursive calls (#3078)

What's Changed

Full Changelog: v1.52.0...v1.53.0

Docker Images

This release is available at authzed/spicedb:v1.53.0, quay.io/authzed/spicedb:v1.53.0, ghcr.io/authzed/spicedb:v1.53.0

Contributors

barakmich, jzelinskie, and 4 other contributors
Loading

v1.52.0

30 Apr 15:50
@tstirrat15 tstirrat15
v1.52.0
76fc153
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.52.0

What's changed

Added

  • Added support for YAML-based validation files in DevContext (#3024)
  • Added support for YAML-based validation files in the Language Server (#3024)
  • Enable statistics-based optimizations when --experimental-query-plan is enabled. (#3052)
  • Added missing implementations of cursoring for LookupResource, LookupSubjects and ReadRelationships calls in FDW (#3016)
  • Add new gRPC Dispatch API and messages for dispatching query plans (#3072)
  • Support new withDebug flag in LookupResources calls to identify cycles (#3070)

Changed

  • Removed MySQL metrics prefixed with go_sql_stats_connections_* in favor of those prefixed with go_sql_* (#2980)
  • Removed support for Spanner flag value --datastore-spanner-metrics=deprecated-prometheus; please use values otel or native (#2980)
  • Reduced binary size (#3005)
  • Reduce memory consumption of Watch API (#2578)

Fixed

  • Improved error message when expiration is written before caveat in a relationship (#3071)
  • On a Postgres setup with read replicas, some requests may silently swallow errors of sort "revision not found in replica" (#2979)
  • Use cgroup-aware memory detection for cache and watch buffer sizing in containerized environments (#3000)
  • Upgraded the spanner client, which changed the internal implementation to not use a session pool. This means that the --datastore-spanner-max-sessions and --datastore-spanner-min-sessions flags are now deprecated and no-op. We also strongly recommend using Application Default Credentials in favor of a credentials file. (#3038)
  • Query Planner: error "ERROR: index \"pk_relation_tuple\" cannot be used for this query (SQLSTATE 42809)" returned when using wildcards (#3039)
  • Providing one of (--grpc-tls-cert-path, --grpc-tls-key-path) but not the other is now considered an error state, as both are necessary if you want to use TLS.
  • In a caveat context that uses nested lists of lists, the hashes generated for cache keys could collide because of an issue with the serialization logic. The serialization now uses deterministic protobuf serialization which avoids this issue (#3065)
Loading

v1.51.1

14 Apr 19:23
@miparnisari miparnisari
v1.51.1
add1e28

Choose a tag to compare

View all tags
v1.51.1

Fixed

Full Changelog: v1.51.0...v1.51.1

Docker Images

This release is available at authzed/spicedb:v1.51.1, quay.io/authzed/spicedb:v1.51.1, ghcr.io/authzed/spicedb:v1.51.1

Loading

v1.51.0

24 Mar 16:27
@miparnisari miparnisari
v1.51.0
b041b8f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.51.0

⚠️ Warning: Due to CVE-2026-40091, please use v1.51.1.

Changed

  • Updated DevContext and LSP to support composable schemas (#2965)

Fixed

  • Fix increase in memory usage brought in v1.50.0 due to replacing protoc-gen-validate with protovalidate (#2984)
  • Fix duplicate diagnostics in LSP server when VS Code pulls diagnostics (#2977)
  • In DevContext's schema position mapper, only the first occurrence of a caveat parameter could be found (#2972)

What's Changed

Full Changelog: v1.50.0...v1.51.0

Docker Images

This release is available at authzed/spicedb:v1.51.0, quay.io/authzed/spicedb:v1.51.0, ghcr.io/authzed/spicedb:v1.51.0

Contributors

barakmich, tstirrat15, and 2 other contributors
Loading

v1.50.0

19 Mar 19:32
@miparnisari miparnisari
v1.50.0
c4410bc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.50.0

⚠️ Warning: Due to an increase in memory usage and CVE-2026-40091, please use v1.51.1.

Added

  • Query Planner: New pkg/query/queryopt package for building optimizations (#2970)
  • Added tracing to request validation (#2950)

Changed

  • Updated CI so that Postgres tests run against v18 which is GA and not against v13 which is EOL (#2926)
  • Use protovalidate instead of protoc-gen-validate for request validation (#2863, #2596, #2959)
  • Query Planner optimization: in Check requests, prune branches that cannot lead to the subject type specified (#2968)
  • Added lr and ls to --experimental-query-plan for those endpoints, as well as in-memory statistics for optimizing the plans (#2929)

Fixed

  • Regression introduced in 1.49.2: missing spans in ReadSchema calls (#2947)
  • Long standing bug in the way postgres revisions were being compared. Sometimes revisions that were actually overlapping were erroneously being ordered. (#2958)
  • Prevent panics in schema compiler, which can reproduce if using the VSCode extension or zed (#2971)

What's Changed

New Contributors

Full Changelog: v1.49.2...v1.50.0

Docker Images

This release is available at authzed/spicedb:v1.50.0, quay.io/authzed/spicedb:v1.50.0, ghcr.io/authzed/spicedb:v1.50.0

Contributors

ecordell, barakmich, and 7 other contributors
Loading

v1.49.2

02 Mar 15:24
@tstirrat15 tstirrat15
v1.49.2
a01eddc
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.49.2

⚠️ Warning: Due to CVE-2026-40091, please use v1.51.1.

Added

  • feat(query planner): add recursive direction strategies, and fix IS BFS (#2891)
  • feat(query planner): introduce query plan outlines and canonicalization (#2901)
  • Schema v2: introduces support for PostOrder traversal in walk.go (#2761) and improve PostOrder walker cycle detection (#2902)

Changed

  • Begin deprecation of library "github.com/dlmiddlecote/sqlstats" (#2904).
    NOTE: in a future release, MySQL metrics will change.
  • Add support for imports and partials to the schemadsl package that drives the LSP and development server (#2919).
  • Added support for CRDB 26.1 by fixing how version information is read from the cluster

Fixed

  • enforce graceful shutdown on serve and serve-testing (#2888)
  • Spanner metrics regression (#2329)
  • improve streaming dispatch logging and observability (#2915)

What's Changed

Full Changelog: v1.49.1...v1.49.2

Docker Images

This release is available at authzed/spicedb:v1.49.2, quay.io/authzed/spicedb:v1.49.2, ghcr.io/authzed/spicedb:v1.49.2

Contributors

ecordell, barakmich, and 8 other contributors
Loading

v1.49.1

09 Feb 15:05
@tstirrat15 tstirrat15
v1.49.1
d842a97
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.49.1

⚠️ Warning: Due to CVE-2026-40091, please use v1.51.1.

Highlights

What's Changed

  • fix: update IterSubjects for wildcards and Alias iterators for confomance by @barakmich in #2864
  • ci: use arm runners in integration tests by @tstirrat15 in #2877
  • fix: prevent panic on malformed cursor by @tstirrat15 in #2878
  • fix: improve LR consistency and support multiple resourcetypes by @barakmich in #2875
  • chore: add metrics and tests to all cache implementations by @miparnisari in #2874
  • fix: query both subrelation and ellipses on arrows for IterResources by @barakmich in #2879
  • chore(deps): bump the github-actions group with 5 updates by @dependabot[bot] in #2870
  • feat: finish LR consistency tests with the fix to the recursive iterator by @barakmich in #2881
  • fix: handle self keyword in warnings checks, and check these warnings are error-free in consistency by @barakmich in #2884
  • fix: make sure that use self comes out of formatter when self is used by @tstirrat15 in #2885
  • build: add new mustcallcheck analyzer and fix instances by @tstirrat15 in #2886
  • chore: implement self in schemav2 by @tstirrat15 in #2887

Full Changelog: v1.49.0...v1.49.1

Docker Images

This release is available at authzed/spicedb:v1.49.1, quay.io/authzed/spicedb:v1.49.1, ghcr.io/authzed/spicedb:v1.49.1

Contributors

barakmich, tstirrat15, and 2 other contributors
Loading

v1.49.0

03 Feb 20:16
@tstirrat15 tstirrat15
v1.49.0
10cc7f7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.49.0

⚠️ Warning: Due to CVE-2026-40091, please use v1.51.1.

Highlights

Support for self keyword added to permissions

Previously, if you wanted to represent something like "a user should be able to view themselves," this required adding a relation to the schema and then writing a relation from the user to itself. We've added support for a self keyword in permissions that represents this directly, which reduces storage requirements, removes the need for a trip to the database, and removes a relationship that needs to be synced.
For more information, see the Docs and the PR: #2785

Experimental

Postgres Foreign Data Wrapper

In #2806, we added a new experimental command to SpiceDB that serves a Postgres Foreign Data Wrapper: spicedb postgres-fdw [flags].
If you configure your Postgres instance accordingly, it can speak to SpiceDB through the FDW as a proxy, allowing you to write queries like:

-- Check if user:alice has permission to view document:readme
SELECT has_permission
FROM permissions
WHERE resource_type = 'document'
  AND resource_id = 'readme'
  AND permission = 'view'
  AND subject_type = 'user'
  AND subject_id = 'alice';

You can now express checks and lookups as SELECTs and JOINs in your main application code, and you can read, write, and delete relationships using Postgres as the client.
For more information, see the documentation in the repo.

Warnings
  • This feature is experimental. We'd welcome you trying it out and providing feedback, but it will likely change before its final GA'd form.
  • This feature DOES NOT solve the Dual-Write Problem. You can make updates in the context of a Postgres transaction, but Postgres's FDW protocol doesn't support a two-phase commit semantic, which means there are still failure modes where a transactional write will land in SpiceDB but not Postgres or vice-versa.

Query Planner

This release includes the first experimental handle on our new Query Planner. If you run SpiceDB with the new --experimental-query-plan flag, SpiceDB will use the query planner to resolve queries.
This is mostly provided for the curious; there's still work to do on statistics sources and optimizations before we expect that it will provide performance benefits across most workloads.
We don't yet recommend turning on this flag in your system outside of experiments in your local or development environments. We'll continue work and let you know when it's ready for production.

Smaller Things

  • A fix for cockroach's connection pooler where the pooler won't report itself as ready until all connections are ready to be used: #2766
  • A fix for a segfault when providing datastore bootstrap files with caveats in them: #2784
  • Touching an existing relationship and providing an empty expiration field will now clear an existing expiration value in CRDB and MySQL: #2796
  • A fix for lexing Unicode characters in string literals in schemas: #2836
  • We've deprecated datastore hedging, as it didn't provide performance gains and led to a less stable system: #2819
  • There's a new --datastore-watch-change-buffer-maximum-size flag for the Watch API that determines how many changes SpiceDB will buffer in memory before it emits an error. This protects against OOMkills when the backing datastore fails to produce a checkpoint: #2859

What's Changed

Read more

Contributors

cduruk, ecordell, and 9 other contributors
Loading

v1.48.0

12 Dec 01:37
@miparnisari miparnisari
v1.48.0
12293b4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.48.0

Added

  • feat: add Memory Protection Middleware (enabled by default, use --enable-memory-protection-middleware=false to disable) by @miparnisari in #2691.
    ⚠️ Now, if your server's memory usage is too high, incoming requests may be rejected with code "ResourceExhausted" (HTTP 429).

Changed

Fixed

Full Changelog: v1.47.1...v1.48.0

Docker Images

This release is available at authzed/spicedb:v1.48.0, quay.io/authzed/spicedb:v1.48.0, ghcr.io/authzed/spicedb:v1.48.0

Contributors

Verolop, tstirrat15, and miparnisari
Loading