v1.45.3

What's Changed

• Move Dockerfile builds to Go 1.24.6 by @josephschorr in #2533
• Improve the errors returned from schema changes by @josephschorr in #2532
• Fix issue with schema write validation by @tstirrat15 in #2534

Full Changelog: v1.45.2...v1.45.3

Docker Images

This release is available at authzed/spicedb:v1.45.3, quay.io/authzed/spicedb:v1.45.3, ghcr.io/authzed/spicedb:v1.45.3

v1.45.2

What's Changed

• add test for releases.go by @miparnisari in #2498
• docs: improve docs of flags by @miparnisari in #2490
• Fix flaky test for telemetry reporting by @davide-baldo in #2495
• feat(schema): add support for FunctionedTupleToUserset in arrow tracking by @mazdakb in #2501
• Populate empty caveat_name and caveat_context in MySQL with default values by @mazdakb in #2506
• OpenTelemetry Semantic Conventions for Tracing by @mazdakb in #2503
• Parse schema from schemafile property by @noseworthy in #2499
• Have check debug trace overall result have a finer-grain matching to the results by @josephschorr in #2511
• Replace nightly docker release with ko by @Meyazhagan in #2509
• Revert "Replace nightly docker release with ko" by @vroldanbet in #2512
• Replace nightly docker release with ko by @Meyazhagan in #2513
• update goreleaser in nightly build by @vroldanbet in #2514
• Bump the github-actions group with 3 updates by @dependabot[bot] in #2516
• Bump golang from 1.24.4-alpine3.21 to 1.24.5-alpine3.21 in the docker group by @dependabot[bot] in #2515
• fix: description of Stream Timeout flag by @miparnisari in #2519
• chore: update actions/setup-go by @miparnisari in #2524
• Ensure that the proper indexes are used for schema diff operations by @josephschorr in #2520
• docs: update discord link by @miparnisari in #2521
• fix: error message in validateIndirectSubjectsSelectors by @miparnisari in #2522
• Fix missing rows.Err check that could cause too-large writes to silently fail in PG by @josephschorr in #2526
• chore: minor refactor on usages of queryShape by @miparnisari in #2523

New Contributors

• @davide-baldo made their first contribution in #2495
• @mazdakb made their first contribution in #2501
• @noseworthy made their first contribution in #2499
• @Meyazhagan made their first contribution in #2509

Full Changelog: v1.45.1...v1.45.2

Docker Images

This release is available at authzed/spicedb:v1.45.2, quay.io/authzed/spicedb:v1.45.2, ghcr.io/authzed/spicedb:v1.45.2

v1.45.1

What's Changed

• fix #2496 by @miparnisari in #2497

Full Changelog: v1.45.0...v1.45.1

Docker Images

This release is available at authzed/spicedb:v1.45.1, quay.io/authzed/spicedb:v1.45.1, ghcr.io/authzed/spicedb:v1.45.1

v1.45.0

⚠️ Warning: Due to #2496, please use v1.45.1.

What's Changed

• Add v25.2.0 to the CRDB test matrix by @josephschorr in #2456
• Remove testing utility code from code coverage by @josephschorr in #2459
• remove @vroldanbet as owner of datastore/mysql by @vroldanbet in #2463
• Bump github.com/go-chi/chi/v5 from 5.0.14 to 5.2.2 in /magefiles in the go_modules group across 1 directory by @dependabot[bot] in #2464
• Postgres: configure migration driver to support PgBouncer by @vroldanbet in #2462
• trim binary by removing dep to github.com/google/go-github/v43 by @miparnisari in #2449
• default cockroachdb connection jitter to 30m by @ecordell in #2467
• reference multi-platform sha256 in Dockerfile and bring back BASE argument in Dockerfile.release by @miparnisari in #2471
• Fix prefix on metric in the TELEMETRY doc by @josephschorr in #2473
• Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 in the go_modules group by @dependabot[bot] in #2472
• Improve how we select index forcing for CRDB by @josephschorr in #2458
• Implement the "use typechecking" directive, annotating the source, and checking against the schema if the types are present by @barakmich in #2457
• pin fsnotify to prevent panics by @miparnisari in #2485
• pkg/cache: update to otter v2 by @jzelinskie in #2486
• Bump the github-actions group with 4 updates by @dependabot[bot] in #2477
• Move SpiceDB to the latest authzed-go client version by @josephschorr in #2489
• misc cleanup by @jzelinskie in #2475

Full Changelog: v1.44.4...v1.45.0

Docker Images

This release is available at authzed/spicedb:v1.45.0, quay.io/authzed/spicedb:v1.45.0, ghcr.io/authzed/spicedb:v1.45.0

v1.44.4

What's Changed

• Add further filtering of forced indexes on CRDB to discount other shapes by @josephschorr in #2437
• Skip selecting caveats and/or expiration in LR2 where applicable by @josephschorr in #2441
• Allow for setting of the same metadata on a CRDB watch transaction by @josephschorr in #2445
• Change the schema for CRDB to have the subjects sort match the index field order by @josephschorr in #2440
• Add additional LSP unit tests by @josephschorr in #2444
• Fix arrows-over-subtype in type checking by @barakmich in #2436
• Bump the go-mod group across 1 directory with 22 updates by @dependabot in #2442
• Add unit tests for the readonly middleware by @josephschorr in #2447
• Add unit tests for the nodeid middleware by @josephschorr in #2452
• Add unit tests for the indexutil under the PG schema package by @josephschorr in #2454
• Add unit tests for serverversion middleware by @josephschorr in #2453

Full Changelog: v1.44.3...v1.44.4

Docker Images

This release is available at authzed/spicedb:v1.44.4, quay.io/authzed/spicedb:v1.44.4, ghcr.io/authzed/spicedb:v1.44.4

v1.44.3

What's Changed

• Remove subject check for deleted definitions in schema by @josephschorr in #2395
• revert PR #2382 by @miparnisari in #2397
• Handle both kinds of cancelation errors in test, part 2 by @miparnisari in #2402
• collect unit test coverage for codecov to work by @miparnisari in #2401
• include integration tests in code coverage by @miparnisari in #2403
• add codecov badge by @miparnisari in #2404
• update codecov.yaml by @miparnisari in #2408
• Add additional unit tests for the development package by @josephschorr in #2407
• Add additional unit tests to preshared key package by @josephschorr in #2406
• Add unit test for running main SpiceDB binary by @josephschorr in #2405
• Add development containers support by @katallaxie in #2379
• Add additional unit tests for the caveat replacer package by @josephschorr in #2409
• Add additional testing for perfinsights middleware by @josephschorr in #2412
• Add additional unit tests for the caveats package by @josephschorr in #2411
• Add tests for the pertoken middleware by @josephschorr in #2413
• Add additional testing for releases package by @josephschorr in #2415
• Add additional testing for telemetry package by @josephschorr in #2414
• Fix the kind of the logical checks telemetry by @josephschorr in #2416
• Rename the telemetry metric back, as fixing its type didn't break anything by @josephschorr in #2417
• Bump golang from 1.24.2-alpine3.20 to 1.24.3-alpine3.20 in the docker group by @dependabot in #2421
• Bump the github-actions group with 4 updates by @dependabot in #2423
• Add an additional unit test for the main function by @josephschorr in #2420
• Implement a typechecking function in schema by @barakmich in #2374
• remove serve-devtools command by @miparnisari in #2424
• improvements to context severing by @vroldanbet in #2370
• Secondary dispatch improvements by @josephschorr in #2389
• move default GOMEMLIMIT to 90% of available memory by @vroldanbet in #2427
• Fix flaky cluster test by @josephschorr in #2428
• Fix the flaky cluster test by @josephschorr in #2429
• Fix flaky reporter test by @josephschorr in #2430
• Quick test fixes for typechecking by @barakmich in #2425
• Add additional unit tests to the indexcheck package by @josephschorr in #2419
• Remove codecov from ALL zz files, which include migrations, which are… by @josephschorr in #2431
• Add unit tests for the dispatcher middleware by @josephschorr in #2432
• revert pgx context cancellation by @vroldanbet in #2434

New Contributors

• @katallaxie made their first contribution in #2379

Full Changelog: v1.44.0...v1.44.3

Docker Images

This release is available at authzed/spicedb:v1.44.3, quay.io/authzed/spicedb:v1.44.3, ghcr.io/authzed/spicedb:v1.44.3

v1.44.2

This is a hotfix release that contains the patch for CVE-2025-49011

Full Changelog: v1.44.0...v1.44.2

Docker Images

This release is available at authzed/spicedb:v1.44.2, quay.io/authzed/spicedb:v1.44.2, ghcr.io/authzed/spicedb:v1.44.2

v1.44.0

Highlights

New Features

• Add new flag that toggles a new performance insights prometheus metric: --enable-performance-insight-metrics (#2383)

Bug Fixes

• Fix issue with underscore handling when deleting by object prefix (#2393)

What's Changed

• Bump the go-mod group with 14 updates by @dependabot in #2378
• pin github action and dockerfile.release base image by @miparnisari in #2381
• Add additional forced CRDB index in special case of no object IDs by @josephschorr in #2385
• Cache Features call in CRDB and skip outputting the check error by @josephschorr in #2380
• remove direct dependency to aws sdk v1 by @miparnisari in #2382
• add more default linters by @miparnisari in #2387
• Handle both kinds of cancelation errors in test by @josephschorr in #2390
• Add perfinsights middleware which writes the latency of API calls by @josephschorr in #2383
• Bump chainguard-dev/actions from 1.0.4 to 1.0.6 in the github-actions group by @dependabot in #2377
• Add additional steelthread test for an LR of page size 1 by @josephschorr in #2391
• Make sure to escape underscores in delete by object ID prefix by @josephschorr in #2393
• fix(CI): CLA GitHub Action permissions by @squat in #2394
• Refactor slice chunking using slices.Chunk from Go 1.23 and improve test coverage by @redouan-rhazouani in #2392

New Contributors

• @squat made their first contribution in #2394
• @redouan-rhazouani made their first contribution in #2392

Full Changelog: v1.43.0...v1.44.0

Docker Images

This release is available at authzed/spicedb:v1.44.0, quay.io/authzed/spicedb:v1.44.0, ghcr.io/authzed/spicedb:v1.44.0

v1.43.0

What's Changed

• introduces depot runners by @vroldanbet in #2297
• feat: make build notification links clickable by @Verolop in #2303
• Bump golang from 1.24.0-alpine3.20 to 1.24.2-alpine3.20 in the docker group by @dependabot in #2298
• Bump the go-mod group with 26 updates by @dependabot in #2299
• fixes incorrect handling of definition deltas via Postgres Watch API by @vroldanbet in #2305
• enable tparallel to keep tests fast by @vroldanbet in #2306
• Add improved caveat filtering to the datastore relationship filter by @josephschorr in #2309
• bug-fix(schema): prevent schema write failures when migrating to caveated relation by @kartikaysaxena in #2308
• Remove panic from devcontext serve in favor of a warning by @josephschorr in #2312
• fix(memdb): check if closed by @miparnisari in #2307
• Fix handling of no columns in Spanner by @josephschorr in #2319
• Update Go to 1.23.8 to fix a reported vuln in Go by @josephschorr in #2318
• [typesystem] Remove typesystem package by @barakmich in #2313
• put error checks before accessing return values by @miparnisari in #2317
• Ensure the Postgres read-write tx uses the TX for the reader by @josephschorr in #2321
• Improved indexing part 2 by @josephschorr in #2310
• Add option to disable watch by @josephschorr in #2323
• Force indexes on Postgres and change subject sort order to match index by @josephschorr in #2327
• introduces a flag to relax postgres isolation level by @vroldanbet in #2324
• internal/datastore/pg: server-side loop for repair by @jzelinskie in #2322
• Force indexes on Spanner and change subject sort order to match index by @josephschorr in #2326
• postgres: optimize CheckRevision query by @vroldanbet in #2328
• document packages by @miparnisari in #2316
• Further optimize the cases when transaction metadata is written in CRDB by @josephschorr in #2330
• Add logical checks telemetry by @josephschorr in #2325
• Switch to larger depot instances for datastore consistency tests by @josephschorr in #2331
• Add a concept of a caveat TypeSet to allow overriding the types available to caveat processing by @josephschorr in #2315
• Simplify the registration in the caveats typeset by @josephschorr in #2335
• Add accessors for deserialization of a caveat using a custom typeset by @josephschorr in #2336
• Bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules group by @dependabot in #2332
• add mutex analyzer by @miparnisari in #2334
• Bump the go_modules group across 2 directories with 1 update by @dependabot in #2337
• Fix logger for certmanager by @tstirrat15 in #2338
• amend mutex analyzer by @miparnisari in #2339
• amend mutex analyzer by @miparnisari in #2340
• Change PG and CRDB datastore drivers to use PGX cancelation by @josephschorr in #2294
• Add retries to MySQL test DB constructor by @josephschorr in #2343
• Minimal decoupling of validation file parsing and schema compilation by @tstirrat15 in #2342
• Switch the loader to use the passed-in typeset by @josephschorr in #2344
• Add missing type set pass, add test and rename all defaults by @josephschorr in #2346
• remove dependency on github.com/hashicorp/go-multierror by @miparnisari in #2345
• Fix labels on telemetry metric by @josephschorr in #2348
• Switch experimental column optimizations to be enabled by default by @josephschorr in #2349
• Disable test of readonly serve-test, as it is making the test server … by @josephschorr in #2350
• Use golangci-lint v2 for linting by @tstirrat15 in #2301
• add security policy by @miparnisari in #2352
• tighten github workflow scopes by @miparnisari in #2353
• fix regression in #2353 - add PR write permissions to labeler action by @miparnisari in #2355
• pin github actions by @miparnisari in #2356
• pin dockerfile images by @miparnisari in #2357
• add GCI linter for better organization of imports by @miparnisari in #2354
• add ssf badge by @miparnisari in #2359
• fix custom analyzers skipping all files by @miparnisari in #2360
• fix typo in goreleaser.windows.yml by @miparnisari in #2361
• Logging and metrics improvements after recent datastore changes by @josephschorr in #2362
• fix panic when running mage test:all by @miparnisari in #2363
• wires query shape into the datastore QueryRels latency metric by @vroldanbet in #2364
• Allow schema watch in CRDB driver when watch is otherwise disabled by @josephschorr in #2365
• make consistency middleware return invalid revision error as gRPC InvalidArgument by @vroldanbet in #2366
• add query shape and fix observe closer in ReverseQueryRelationships by @vroldanbet in #2367
• postgres datastore: do not warn on context cancelation by @vroldanbet in #2368
• Set pgx CancelRequestContextWatcherHandler.CancelRequestDelay to fixcancelation delay by @vroldanbet in #2369
• Improve CRDB index forcing logic to be more fine-grain by @josephschorr in #2376

Full Changelog: v1.42.1...v1.43.0

Docker Images

This release is available at authzed/spicedb:v1.43.0, quay.io/authzed/spicedb:v1.43.0, ghcr.io/authzed/spicedb:v1.43.0

v1.42.1

What's Changed

• remove limit in AtRevision in dispatch ResolverMeta by @ecordell in #2296
• support both old and new read replica flag prefixes by @ecordell in #2300

Full Changelog: v1.42.0...v1.42.1

Docker Images

This release is available at authzed/spicedb:v1.42.1, quay.io/authzed/spicedb:v1.42.1, ghcr.io/authzed/spicedb:v1.42.1