v1.32.0

Highlights

🔐 AWS IAM Authentication for Postgres, MySQL datastores
✅ LSP now supports linting rules
🐧 Linux packages now distribute shell completion

What's Changed

• add support for AWS IAM authentication for postgres by @j-white in #1858
• lsp: implement didChange and fix logging by @jzelinskie in #1868
• Ignore AST nodes without rune positioning information (such as comments) by @josephschorr in #1869
• Include doc comments in resolver generated source by @josephschorr in #1870
• Add configurable limits for all APIs by @josephschorr in #1871
• add aws iam authentication for mysql by @j-white in #1867
• goreleaser: init snap, linux shell completions by @jzelinskie in #1744
• Begin support for warnings and linting in schema by @josephschorr in #1880
• Add warnings to the LSP by @josephschorr in #1881
• generate manpages for releases by @jzelinskie in #1779

New Contributors

• @j-white made their first contribution in #1858

Full Changelog: v1.31.0...v1.32.0

Docker Images

This release is available at authzed/spicedb:v1.32.0, quay.io/authzed/spicedb:v1.32.0, ghcr.io/authzed/spicedb:v1.32.0

v1.31.0

Highlights

🔤 Language Server support via spicedb lsp
🚮 Faster Postgres Garbage Collection, Relationship Touch
🔎 Faster and more memory efficient LookupResources, BulkImport
🐛 Lots of fixes to OpenTelemetry, Prometheus metrics, logging

What's Changed

• adds dependabot configuration to update GitHub Actions by @vroldanbet in #1808
• Bump docker/setup-qemu-action from 1 to 3 by @dependabot in #1811
• Bump actions/labeler from 3 to 5 by @dependabot in #1813
• add github action grouping by @vroldanbet in #1821
• Bump the gomod-version group with 24 updates by @dependabot in #1824
• Bump the gomod-version group with 1 update by @dependabot in #1822
• Bump the gomod-version group with 8 updates by @dependabot in #1823
• Bump github.com/docker/docker from 25.0.4+incompatible to 25.0.5+incompatible in /magefiles by @dependabot in #1827
• Bump the go_modules group group with 1 update by @dependabot in #1828
• report GC stats even in the event of a GC worker error by @vroldanbet in #1830
• Import request ID metadata key from authzed-go by @alecmerdler in #1829
• Update labeler config for labeler action v5 by @josephschorr in #1832
• Bump the go-mod group with 2 updates by @dependabot in #1825
• Use type information to optimize TOUCH operations in the PG datastore by @josephschorr in #1831
• Add some additional unit tests for expected behavior and fix BulkLoad errors by @josephschorr in #1839
• Update OpenTelemetry middlewares by @alecmerdler in #1836
• Early terminate in LookupResources when no limit was specified by @josephschorr in #1835
• Add some additional deletion tests for relationships by @josephschorr in #1841
• Small mem improvements on BulkImport by @josephschorr in #1838
• Fix re-creating deleted relationships by @alecmerdler in #1843
• fixes prometheus bug where count metrics had incorrect suffixes by @vroldanbet in #1844
• Improve request-id propagation by @vroldanbet in #1845
• Bump the go-mod group with 6 updates by @dependabot in #1847
• Bump the github-actions group with 1 update by @dependabot in #1846
• Add license checking lint step to CI by @josephschorr in #1848
• Correct version requirement for datastore repair by @alecmerdler in #1849
• Update README with playground repo link by @samkim in #1852
• LookupResources Postgres query optimization by @alecmerdler in #1850
• Use a specific relation for arrow lookups in LR when applicable by @josephschorr in #1851
• Development package improvements by @josephschorr in #1853
• Initial implementation of a Language Server for SpiceDB schema by @josephschorr in #1854
• bump analyzers go.work to 1.22.2 by @ecordell in #1855
• Disable the repair tests on PG versions that do not support it by @josephschorr in #1857
• LSP improvements by @josephschorr in #1856
• introduces a faster query to tuple GC by @vroldanbet in #1859
• cmd/server: log dispatching at debug level by @jzelinskie in #1864

Full Changelog: v1.30.0...v1.31.0

Docker Images

This release is available at authzed/spicedb:v1.31.0, quay.io/authzed/spicedb:v1.31.0, ghcr.io/authzed/spicedb:v1.31.0

v1.30.1

This is a hotfix release that contains the patch for CVE-2024-32001

Full Changelog: v1.30.0...v1.30.1

Docker Images

This release is available at authzed/spicedb:v1.30.1, quay.io/authzed/spicedb:v1.30.1, ghcr.io/authzed/spicedb:v1.30.1

v1.30.0

Highlights

✨ CheckBulkPermission has now graduated!
⚡ Significantly improved write and delete performance in CockroachDB resulting in a major reduction in serialization errors occurring
⚡ Significantly improve deletion performance on deletions with limits across all datastores
🔍 Filters used for read relationships and delete relationships now have resource_type as optional
✨ WatchRelationships and BulkExportRelationships now support filters
📉 Memory reduction on WriteSchema
🔍 Various improvements in observability
🐛 fixes minimum connection handling for Postgres datastore not working as intended

Note

The CockroachDB datastore has a 2-phase migration in this release, we recommend using the spicedb-operator to automate the process

Warning

BulkExportRelationships cursors have changed and won't be compatible across versions.

What's Changed

• Further fixes to flaky Postgres tests by @josephschorr in #1750
• README: htmlify, update links by @jzelinskie in #1745
• spanner: allow spicedb to run with head or head-1 migration by @ecordell in #1752
• cmd: deprecate root-level head and migrate by @jzelinskie in #1746
• re-enable gosec/G404 by @vroldanbet in #1757
• Fix small TODO in type system with a small code move by @josephschorr in #1753
• Hide a previously deprecated flag by @josephschorr in #1761
• Small improvement in tuple package to remove TODO by @josephschorr in #1754
• skip all steps for matrix jobs when the whole job should be skipped by @ecordell in #1760
• Remove duplicate testing code by @josephschorr in #1762
• VSCode launch config by @alecmerdler in #1756
• reduces chunking allocations for wide relations by @vroldanbet in #1751
• refactor Security related actions and add Snyk by @vroldanbet in #1758
• Use the same default port for the HTTP API across serve and serve-testing by @torbenw in #1749
• Close the parent context in serve_test when complete by @josephschorr in #1763
• disables Snyk checks by @vroldanbet in #1766
• Remove stale TODOs by @josephschorr in #1764
• Fix flake in singleflight test by increasing the run time slightly by @josephschorr in #1767
• enables prometheus exemplars support by @vroldanbet in #1768
• Fix flake on transaction retry test by specifying a longer timeout by @josephschorr in #1769
• Change CRDB driver to use new method for getting transaction timestamp by @josephschorr in #1770
• Delete performance improvements by @josephschorr in #1771
• Bump github.com/prometheus/client_golang from 1.18.0 to 1.19.0 by @dependabot in #1777
• Bump golang.org/x/vuln from 1.0.1 to 1.0.4 by @dependabot in #1775
• Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.47.0 to 0.49.0 by @dependabot in #1774
• Bump github.com/planetscale/vtprotobuf from 0.5.1-0.20231212170721-e7d721933795 to 0.6.0 by @dependabot in #1778
• Bump cloud.google.com/go/spanner from 1.54.0 to 1.57.0 by @dependabot in #1776
• Ensure that invalid versions do not cause a nil panic by @josephschorr in #1781
• Ensure SpiceDB release versions are semver by @josephschorr in #1783
• Follow up changes for recent fixes: remove len downcasts and ensure all other downcasts are validated by @josephschorr in #1780
• fix: delete options not being passed by @ryaneorth in #1784
• Debug migrate command in VSCode by @alecmerdler in #1786
• Update gRPC health probe version for recent Go vulns by @josephschorr in #1787
• adds OpenTelemetry TraceID to logs by @vroldanbet in #1772
• Have caveat diffs properly check if an expression has changed by @josephschorr in #1788
• Extend support for relationship filtering and add relationship filtering to other APIs by @josephschorr in #1739
• Small increase in test coverage for subjects testutil by @josephschorr in #1793
• Add mage test:unitcover to generate coverage reports over all unit tests by @josephschorr in #1794
• CheckBulkPermissions by @alecmerdler in #1792
• Move health check logs to debug level by @vroldanbet in #1773
• dependency updates by @vroldanbet in #1797
• fix codeql by @vroldanbet in #1798
• use the most recent Go version with CodeQL by @vroldanbet in #1799
• fixes merge queue not supporting CodeQL by @vroldanbet in #1800
• Fix race on error member of TaskRunner by @ecordell in #1801
• Move debug traces for CheckPermission into the response by @josephschorr in #1795
• make registration of gRPC prom metrics not fail if already registered by @vroldanbet in #1803
• turns gRPC latency histogram into a toggleable option by @vroldanbet in #1805
• do not return backward incompatible --explain debug info in trailer by @vroldanbet in #1807

New Contributors

• @torbenw made their first contribution in #1749
• @ryaneorth made their first contribution in #1784

Full Changelog: v1.29.5...v1.30.0

Docker Images

This release is available at authzed/spicedb:v1.30.0, quay.io/authzed/spicedb:v1.30.0, ghcr.io/authzed/spicedb:v1.30.0

v1.29.5

This release adds support for a phased migration in Spanner, and is otherwise the same as v1.29.2

Full Changelog: 1.29.2...v1.29.5

Docker Images

This release is available at authzed/spicedb:v1.29.5, quay.io/authzed/spicedb:v1.29.5, ghcr.io/authzed/spicedb:v1.29.5

v1.29.2

Highlights

This is primarily a bugfix release to address GHSA-h3m7-rqc4-7h9p

What's Changed

• Fix typo in datastore by @josephschorr in #1726
• Add a retry to PG connections to reduce test flakiness by @josephschorr in #1727
• Update runc dependency for reported vuln in runc by @josephschorr in #1736
• Bump golang from 1.21.5-alpine3.18 to 1.21.6-alpine3.18 by @dependabot in #1733
• Bump github.com/jackc/pgx/v5 from 5.4.3 to 5.5.2 by @dependabot in #1730
• Bump github.com/aws/aws-sdk-go from 1.45.26 to 1.50.10 by @dependabot in #1737
• Bump github.com/prometheus/client_golang from 1.17.0 to 1.18.0 by @dependabot in #1732
• Bump google.golang.org/grpc from 1.59.0 to 1.61.0 by @dependabot in #1734
• Bump google.golang.org/api from 0.152.0 to 0.161.0 by @dependabot in #1735
• Add missing datastore READMEs by @josephschorr in #1738
• Clarify that the datastore-revision-quantization-max-staleness-percent is a float value by @josephschorr in #1740
• Prevent the staleness of an optimized revision from exceeding the GC window by @josephschorr in #1741
• Reduce memory usage of WriteSchema by @josephschorr in #1743
• fixes pgx min connection count always being set to max count by @vroldanbet in #1747

Full Changelog: v1.29.1...v1.29.2

Docker Images

This release is available at authzed/spicedb:v1.29.2, quay.io/authzed/spicedb:v1.29.2, ghcr.io/authzed/spicedb:v1.29.2

v1.29.1

What's Changed

• Add some invalid schema tests as per a recently reported error by @josephschorr in #1713
• Add invalid permission tests onto the various permissions APIs by @josephschorr in #1714
• Change telemetry failure to a warning and have Postgres check for its unique ID on startup by @josephschorr in #1717
• Respect dispatch concurrency limits for clusterdispatch by @sashayakovtseva in #1676
• implements schema watch support for MemDB by @vroldanbet in #1720
• fix broken v1alpha gRPC reflection support by @vroldanbet in #1718
• HLC Parsing fixes by @josephschorr in #1724
• Fix flaky Postgres GC tests by @josephschorr in #1655
• Add additional datastore revision tests by @josephschorr in #1725

New Contributors

• @sashayakovtseva made their first contribution in #1676

Full Changelog: v1.29.0...v1.29.1

Docker Images

This release is available at authzed/spicedb:v1.29.1, quay.io/authzed/spicedb:v1.29.1, ghcr.io/authzed/spicedb:v1.29.1

v1.29.1-rc1

What's Changed

• Add some invalid schema tests as per a recently reported error by @josephschorr in #1713
• Add invalid permission tests onto the various permissions APIs by @josephschorr in #1714
• Change telemetry failure to a warning and have Postgres check for its unique ID on startup by @josephschorr in #1717
• Respect dispatch concurrency limits for clusterdispatch by @sashayakovtseva in #1676
• implements schema watch support for MemDB by @vroldanbet in #1720
• fix broken v1alpha gRPC reflection support by @vroldanbet in #1718
• HLC Parsing fixes by @josephschorr in #1724
• Fix flaky Postgres GC tests by @josephschorr in #1655
• Add additional datastore revision tests by @josephschorr in #1725

New Contributors

• @sashayakovtseva made their first contribution in #1676

Full Changelog: v1.29.0...v1.29.1-rc1

Docker Images

This release is available at authzed/spicedb:v1.29.1-rc1, quay.io/authzed/spicedb:v1.29.1-rc1, ghcr.io/authzed/spicedb:v1.29.1-rc1

v1.29.0

Highlights

🔊 New foundation in Datastore Watch API now streams checkpoint revisions and schema changes
🥽 Postgres datastore now supports new experimental Schema Cache
⏰ Watch API now supports write timeouts

Warning

A bug has been identified in this release around handling of CRDB timestamps. Its recommended to move to v1.29.1

What's Changed

• bulk import: reduce allocations by allocation a value buffer by @vroldanbet in #1658
• Don't call ObserveDuration more than one in the observable proxy by @josephschorr in #1666
• Fix garbage collector interval and backoff resets by @chriskdon in #1663
• crdb: don't allow relationship counters to go negative by @ecordell in #1657
• Fix handling of NULL caveats in Postgres watch by @josephschorr in #1668
• make datastore metrics more representative of the actual underlying datastore by @vroldanbet in #1669
• CRDB: adds missing observability for Watch API by @vroldanbet in #1656
• Bump cloud.google.com/go/spanner from 1.51.0 to 1.53.0 by @dependabot in #1670
• Bump go.opentelemetry.io/otel/trace from 1.20.0 to 1.21.0 by @dependabot in #1671
• Bump github.com/spf13/cobra from 1.7.0 to 1.8.0 by @dependabot in #1674
• Bump google.golang.org/api from 0.149.0 to 0.152.0 by @dependabot in #1673
• Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.46.0 to 0.46.1 by @dependabot in #1672
• Bump golang from 1.21.3-alpine3.18 to 1.21.4-alpine3.18 by @dependabot in #1675
• Move the diff library into pkg for use by external tooling by @josephschorr in #1677
• schemadsl/compiler: optionally skip validation by @jzelinskie in #1679
• Make sure to clone metadata in LR before changing by @josephschorr in #1680
• decorate check dispatch spans with caching and singleflight attributes by @vroldanbet in #1678
• fixes datastore command not using the spicedb prefix for ENV by @vroldanbet in #1682
• fixes regression in Schema Watch led schema caching by @vroldanbet in #1684
• fixes regression in compiler.Compile() contract by @vroldanbet in #1683
• Add an integration test for schema watch by @josephschorr in #1685
• Use logger from context in RedactAndLogSensitiveConnString by @bison in #1686
• Watch improvements in datastore by @josephschorr in #1681
• Move to Go 1.21.5 for external vuln fixed in crypto lib by @josephschorr in #1690
• authenticate with docker to raise rate-limits by @vroldanbet in #1691
• Ignore the source position when diffing permission expressions by @josephschorr in #1689
• fixes WriteRelationships/BulkImport GRPC error codes on conflicts and retryable errors by @vroldanbet in #1688
• .github: use public-read-only docker account by @jzelinskie in #1694
• pkg/proto: upgrade vtprotobuf to support WKTs by @jzelinskie in #1693
• Major cleanup and improvements around revision handling in the datastores by @josephschorr in #1695
• Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.46.0 to 0.46.1 by @dependabot in #1697
• Bump github.com/jzelinskie/stringz from 0.0.2 to 0.0.3 by @dependabot in #1700
• Bump github.com/google/uuid from 1.4.0 to 1.5.0 by @dependabot in #1699
• Bump golang.org/x/mod from 0.13.0 to 0.14.0 by @dependabot in #1698
• Fix flakiness of HLC changes test by @josephschorr in #1701
• Bump github.com/samber/lo from 1.38.1 to 1.39.0 by @dependabot in #1696
• Small micro-optimizations around set performance by @josephschorr in #1702
• Add Union and Merge to Set by @josephschorr in #1704
• expose revision parsing function for tests by @vroldanbet in #1705
• Watch revision checkpoints using memdb datastore by @alecmerdler in #1706
• Add timeout to watch buffers by @josephschorr in #1707
• Switch HLC timestamps to be stored as an array of two int64s by @josephschorr in #1709
• makes less verbose CRDB connection balacer by @vroldanbet in #1708
• compiler: adds a helper method to require any object type prefix by @vroldanbet in #1710
• Have spiceerrors.MustBugf contain the full stack trace of the bug by @josephschorr in #1711

New Contributors

• @chriskdon made their first contribution in #1663
• @bison made their first contribution in #1686
• @alecmerdler made their first contribution in #1706

Full Changelog: v1.28.0...v1.29.0

Docker Images

This release is available at authzed/spicedb:v1.29.0, quay.io/authzed/spicedb:v1.29.0, ghcr.io/authzed/spicedb:v1.29.0

v1.28.0

What's Changed

• fix dispatch deduplication regression by @vroldanbet in #1643
• use internal/logging instead of zerolog global logger by @vroldanbet in #1647
• singleflight dispatch: adds a fallback in case the traversal bloom is not present by @vroldanbet in #1648
• Add missing combined recursive test case by @josephschorr in #1645
• Add additional expand canonical key tests by @josephschorr in #1649
• singleflight dispatcher: do not double-singleflight on remote cluster dispatch by @vroldanbet in #1650
• Disable the default GC process in PG GC tests by @josephschorr in #1654
• Add a datastore repair command for revisions from Postgres backups by @josephschorr in #1642
• crdb: fix watch error: %!s() by @vroldanbet in #1660

Docker Images

This release is available at authzed/spicedb:v1.28.0, quay.io/authzed/spicedb:v1.28.0, ghcr.io/authzed/spicedb:v1.28.0