v1.30.0

Highlights

✨ CheckBulkPermission has now graduated!
⚡ Significantly improved write and delete performance in CockroachDB resulting in a major reduction in serialization errors occurring
⚡ Significantly improve deletion performance on deletions with limits across all datastores
🔍 Filters used for read relationships and delete relationships now have resource_type as optional
✨ WatchRelationships and BulkExportRelationships now support filters
📉 Memory reduction on WriteSchema
🔍 Various improvements in observability
🐛 fixes minimum connection handling for Postgres datastore not working as intended

Note

The CockroachDB datastore has a 2-phase migration in this release, we recommend using the spicedb-operator to automate the process

Warning

BulkExportRelationships cursors have changed and won't be compatible across versions.

What's Changed

• Further fixes to flaky Postgres tests by @josephschorr in #1750
• README: htmlify, update links by @jzelinskie in #1745
• spanner: allow spicedb to run with head or head-1 migration by @ecordell in #1752
• cmd: deprecate root-level head and migrate by @jzelinskie in #1746
• re-enable gosec/G404 by @vroldanbet in #1757
• Fix small TODO in type system with a small code move by @josephschorr in #1753
• Hide a previously deprecated flag by @josephschorr in #1761
• Small improvement in tuple package to remove TODO by @josephschorr in #1754
• skip all steps for matrix jobs when the whole job should be skipped by @ecordell in #1760
• Remove duplicate testing code by @josephschorr in #1762
• VSCode launch config by @alecmerdler in #1756
• reduces chunking allocations for wide relations by @vroldanbet in #1751
• refactor Security related actions and add Snyk by @vroldanbet in #1758
• Use the same default port for the HTTP API across serve and serve-testing by @torbenw in #1749
• Close the parent context in serve_test when complete by @josephschorr in #1763
• disables Snyk checks by @vroldanbet in #1766
• Remove stale TODOs by @josephschorr in #1764
• Fix flake in singleflight test by increasing the run time slightly by @josephschorr in #1767
• enables prometheus exemplars support by @vroldanbet in #1768
• Fix flake on transaction retry test by specifying a longer timeout by @josephschorr in #1769
• Change CRDB driver to use new method for getting transaction timestamp by @josephschorr in #1770
• Delete performance improvements by @josephschorr in #1771
• Bump github.com/prometheus/client_golang from 1.18.0 to 1.19.0 by @dependabot in #1777
• Bump golang.org/x/vuln from 1.0.1 to 1.0.4 by @dependabot in #1775
• Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.47.0 to 0.49.0 by @dependabot in #1774
• Bump github.com/planetscale/vtprotobuf from 0.5.1-0.20231212170721-e7d721933795 to 0.6.0 by @dependabot in #1778
• Bump cloud.google.com/go/spanner from 1.54.0 to 1.57.0 by @dependabot in #1776
• Ensure that invalid versions do not cause a nil panic by @josephschorr in #1781
• Ensure SpiceDB release versions are semver by @josephschorr in #1783
• Follow up changes for recent fixes: remove len downcasts and ensure all other downcasts are validated by @josephschorr in #1780
• fix: delete options not being passed by @ryaneorth in #1784
• Debug migrate command in VSCode by @alecmerdler in #1786
• Update gRPC health probe version for recent Go vulns by @josephschorr in #1787
• adds OpenTelemetry TraceID to logs by @vroldanbet in #1772
• Have caveat diffs properly check if an expression has changed by @josephschorr in #1788
• Extend support for relationship filtering and add relationship filtering to other APIs by @josephschorr in #1739
• Small increase in test coverage for subjects testutil by @josephschorr in #1793
• Add mage test:unitcover to generate coverage reports over all unit tests by @josephschorr in #1794
• CheckBulkPermissions by @alecmerdler in #1792
• Move health check logs to debug level by @vroldanbet in #1773
• dependency updates by @vroldanbet in #1797
• fix codeql by @vroldanbet in #1798
• use the most recent Go version with CodeQL by @vroldanbet in #1799
• fixes merge queue not supporting CodeQL by @vroldanbet in #1800
• Fix race on error member of TaskRunner by @ecordell in #1801
• Move debug traces for CheckPermission into the response by @josephschorr in #1795
• make registration of gRPC prom metrics not fail if already registered by @vroldanbet in #1803
• turns gRPC latency histogram into a toggleable option by @vroldanbet in #1805
• do not return backward incompatible --explain debug info in trailer by @vroldanbet in #1807

New Contributors

• @torbenw made their first contribution in #1749
• @ryaneorth made their first contribution in #1784

Full Changelog: v1.29.5...v1.30.0

Docker Images

This release is available at authzed/spicedb:v1.30.0, quay.io/authzed/spicedb:v1.30.0, ghcr.io/authzed/spicedb:v1.30.0

v1.29.5

This release adds support for a phased migration in Spanner, and is otherwise the same as v1.29.2

Full Changelog: 1.29.2...v1.29.5

Docker Images

This release is available at authzed/spicedb:v1.29.5, quay.io/authzed/spicedb:v1.29.5, ghcr.io/authzed/spicedb:v1.29.5

v1.29.2

Highlights

This is primarily a bugfix release to address GHSA-h3m7-rqc4-7h9p

What's Changed

• Fix typo in datastore by @josephschorr in #1726
• Add a retry to PG connections to reduce test flakiness by @josephschorr in #1727
• Update runc dependency for reported vuln in runc by @josephschorr in #1736
• Bump golang from 1.21.5-alpine3.18 to 1.21.6-alpine3.18 by @dependabot in #1733
• Bump github.com/jackc/pgx/v5 from 5.4.3 to 5.5.2 by @dependabot in #1730
• Bump github.com/aws/aws-sdk-go from 1.45.26 to 1.50.10 by @dependabot in #1737
• Bump github.com/prometheus/client_golang from 1.17.0 to 1.18.0 by @dependabot in #1732
• Bump google.golang.org/grpc from 1.59.0 to 1.61.0 by @dependabot in #1734
• Bump google.golang.org/api from 0.152.0 to 0.161.0 by @dependabot in #1735
• Add missing datastore READMEs by @josephschorr in #1738
• Clarify that the datastore-revision-quantization-max-staleness-percent is a float value by @josephschorr in #1740
• Prevent the staleness of an optimized revision from exceeding the GC window by @josephschorr in #1741
• Reduce memory usage of WriteSchema by @josephschorr in #1743
• fixes pgx min connection count always being set to max count by @vroldanbet in #1747

Full Changelog: v1.29.1...v1.29.2

Docker Images

This release is available at authzed/spicedb:v1.29.2, quay.io/authzed/spicedb:v1.29.2, ghcr.io/authzed/spicedb:v1.29.2

v1.29.1

What's Changed

• Add some invalid schema tests as per a recently reported error by @josephschorr in #1713
• Add invalid permission tests onto the various permissions APIs by @josephschorr in #1714
• Change telemetry failure to a warning and have Postgres check for its unique ID on startup by @josephschorr in #1717
• Respect dispatch concurrency limits for clusterdispatch by @sashayakovtseva in #1676
• implements schema watch support for MemDB by @vroldanbet in #1720
• fix broken v1alpha gRPC reflection support by @vroldanbet in #1718
• HLC Parsing fixes by @josephschorr in #1724
• Fix flaky Postgres GC tests by @josephschorr in #1655
• Add additional datastore revision tests by @josephschorr in #1725

New Contributors

• @sashayakovtseva made their first contribution in #1676

Full Changelog: v1.29.0...v1.29.1

Docker Images

This release is available at authzed/spicedb:v1.29.1, quay.io/authzed/spicedb:v1.29.1, ghcr.io/authzed/spicedb:v1.29.1

v1.29.1-rc1

What's Changed

• Add some invalid schema tests as per a recently reported error by @josephschorr in #1713
• Add invalid permission tests onto the various permissions APIs by @josephschorr in #1714
• Change telemetry failure to a warning and have Postgres check for its unique ID on startup by @josephschorr in #1717
• Respect dispatch concurrency limits for clusterdispatch by @sashayakovtseva in #1676
• implements schema watch support for MemDB by @vroldanbet in #1720
• fix broken v1alpha gRPC reflection support by @vroldanbet in #1718
• HLC Parsing fixes by @josephschorr in #1724
• Fix flaky Postgres GC tests by @josephschorr in #1655
• Add additional datastore revision tests by @josephschorr in #1725

New Contributors

• @sashayakovtseva made their first contribution in #1676

Full Changelog: v1.29.0...v1.29.1-rc1

Docker Images

This release is available at authzed/spicedb:v1.29.1-rc1, quay.io/authzed/spicedb:v1.29.1-rc1, ghcr.io/authzed/spicedb:v1.29.1-rc1

v1.29.0

Highlights

🔊 New foundation in Datastore Watch API now streams checkpoint revisions and schema changes
🥽 Postgres datastore now supports new experimental Schema Cache
⏰ Watch API now supports write timeouts

Warning

A bug has been identified in this release around handling of CRDB timestamps. Its recommended to move to v1.29.1

What's Changed

• bulk import: reduce allocations by allocation a value buffer by @vroldanbet in #1658
• Don't call ObserveDuration more than one in the observable proxy by @josephschorr in #1666
• Fix garbage collector interval and backoff resets by @chriskdon in #1663
• crdb: don't allow relationship counters to go negative by @ecordell in #1657
• Fix handling of NULL caveats in Postgres watch by @josephschorr in #1668
• make datastore metrics more representative of the actual underlying datastore by @vroldanbet in #1669
• CRDB: adds missing observability for Watch API by @vroldanbet in #1656
• Bump cloud.google.com/go/spanner from 1.51.0 to 1.53.0 by @dependabot in #1670
• Bump go.opentelemetry.io/otel/trace from 1.20.0 to 1.21.0 by @dependabot in #1671
• Bump github.com/spf13/cobra from 1.7.0 to 1.8.0 by @dependabot in #1674
• Bump google.golang.org/api from 0.149.0 to 0.152.0 by @dependabot in #1673
• Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.46.0 to 0.46.1 by @dependabot in #1672
• Bump golang from 1.21.3-alpine3.18 to 1.21.4-alpine3.18 by @dependabot in #1675
• Move the diff library into pkg for use by external tooling by @josephschorr in #1677
• schemadsl/compiler: optionally skip validation by @jzelinskie in #1679
• Make sure to clone metadata in LR before changing by @josephschorr in #1680
• decorate check dispatch spans with caching and singleflight attributes by @vroldanbet in #1678
• fixes datastore command not using the spicedb prefix for ENV by @vroldanbet in #1682
• fixes regression in Schema Watch led schema caching by @vroldanbet in #1684
• fixes regression in compiler.Compile() contract by @vroldanbet in #1683
• Add an integration test for schema watch by @josephschorr in #1685
• Use logger from context in RedactAndLogSensitiveConnString by @bison in #1686
• Watch improvements in datastore by @josephschorr in #1681
• Move to Go 1.21.5 for external vuln fixed in crypto lib by @josephschorr in #1690
• authenticate with docker to raise rate-limits by @vroldanbet in #1691
• Ignore the source position when diffing permission expressions by @josephschorr in #1689
• fixes WriteRelationships/BulkImport GRPC error codes on conflicts and retryable errors by @vroldanbet in #1688
• .github: use public-read-only docker account by @jzelinskie in #1694
• pkg/proto: upgrade vtprotobuf to support WKTs by @jzelinskie in #1693
• Major cleanup and improvements around revision handling in the datastores by @josephschorr in #1695
• Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.46.0 to 0.46.1 by @dependabot in #1697
• Bump github.com/jzelinskie/stringz from 0.0.2 to 0.0.3 by @dependabot in #1700
• Bump github.com/google/uuid from 1.4.0 to 1.5.0 by @dependabot in #1699
• Bump golang.org/x/mod from 0.13.0 to 0.14.0 by @dependabot in #1698
• Fix flakiness of HLC changes test by @josephschorr in #1701
• Bump github.com/samber/lo from 1.38.1 to 1.39.0 by @dependabot in #1696
• Small micro-optimizations around set performance by @josephschorr in #1702
• Add Union and Merge to Set by @josephschorr in #1704
• expose revision parsing function for tests by @vroldanbet in #1705
• Watch revision checkpoints using memdb datastore by @alecmerdler in #1706
• Add timeout to watch buffers by @josephschorr in #1707
• Switch HLC timestamps to be stored as an array of two int64s by @josephschorr in #1709
• makes less verbose CRDB connection balacer by @vroldanbet in #1708
• compiler: adds a helper method to require any object type prefix by @vroldanbet in #1710
• Have spiceerrors.MustBugf contain the full stack trace of the bug by @josephschorr in #1711

New Contributors

• @chriskdon made their first contribution in #1663
• @bison made their first contribution in #1686
• @alecmerdler made their first contribution in #1706

Full Changelog: v1.28.0...v1.29.0

Docker Images

This release is available at authzed/spicedb:v1.29.0, quay.io/authzed/spicedb:v1.29.0, ghcr.io/authzed/spicedb:v1.29.0

v1.28.0

What's Changed

• fix dispatch deduplication regression by @vroldanbet in #1643
• use internal/logging instead of zerolog global logger by @vroldanbet in #1647
• singleflight dispatch: adds a fallback in case the traversal bloom is not present by @vroldanbet in #1648
• Add missing combined recursive test case by @josephschorr in #1645
• Add additional expand canonical key tests by @josephschorr in #1649
• singleflight dispatcher: do not double-singleflight on remote cluster dispatch by @vroldanbet in #1650
• Disable the default GC process in PG GC tests by @josephschorr in #1654
• Add a datastore repair command for revisions from Postgres backups by @josephschorr in #1642
• crdb: fix watch error: %!s() by @vroldanbet in #1660

Docker Images

This release is available at authzed/spicedb:v1.28.0, quay.io/authzed/spicedb:v1.28.0, ghcr.io/authzed/spicedb:v1.28.0

v1.28.0-rc1

What's Changed

• Add missing combined recursive test case by @josephschorr in #1645
• Add additional expand canonical key tests by @josephschorr in #1649
• singleflight dispatcher: do not double-singleflight on remote cluster dispatch by @vroldanbet in #1650
• Disable the default GC process in PG GC tests by @josephschorr in #1654
• Add a datastore repair command for revisions from Postgres backups by @josephschorr in #1642
• crdb: fix watch error: %!s() by @vroldanbet in #1660

Full Changelog: v1.27.1-rc1...v1.28.0-rc1

Docker Images

This release is available at authzed/spicedb:v1.28.0-rc1, quay.io/authzed/spicedb:v1.28.0-rc1, ghcr.io/authzed/spicedb:v1.28.0-rc1

v1.27.1-rc1

What's Changed

• fix dispatch deduplication regression by @vroldanbet in #1643
• use internal/logging instead of zerolog global logger by @vroldanbet in #1647
• singleflight dispatch: adds a fallback in case the traversal bloom is not present by @vroldanbet in #1648

Full Changelog: v1.27.0...v1.27.1-rc1

Docker Images

This release is available at authzed/spicedb:v1.27.1-rc1, quay.io/authzed/spicedb:v1.27.1-rc1, ghcr.io/authzed/spicedb:v1.27.1-rc1

v1.27.0

Docker Images

This release is available at authzed/spicedb:v1.27.0, quay.io/authzed/spicedb:v1.27.0, ghcr.io/authzed/spicedb:v1.27.0

What's Changed

• Optimistic locking on Spanner read/write transactions by @jzelinskie in #1590
• .github: move to buildjet by @jzelinskie in #1591
• spanner: add missing calls to RowIterator.Stop by @vroldanbet in #1592
• Some improvements to tracing UX by @vroldanbet in #1595
• middleware/consistency: fix source of atLeast by @jzelinskie in #1597
• Revert Optimistic Locking in Spanner by @vroldanbet in #1599
• tracing ux: enriches traversal operations by @vroldanbet in #1596
• propagates gRPC errors in graph package by @vroldanbet in #1598
• Disable spanner gzip compression by @vroldanbet in #1601
• Add a map of revision parsing functions by engine kind by @josephschorr in #1604
• Add support for experimental secondary dispatching by @josephschorr in #1603
• Add a golden unit test for parser associativity by @josephschorr in #1605
• Have diff of namespaces and caveats report changes to comments by @josephschorr in #1606
• add singleflight check dispatch by @vroldanbet in #1607
• More spanner observability / Go Scheduler metrics by @vroldanbet in #1609
• fix grpc-health-probe flagged by trivy by @vroldanbet in #1613
• dispatch: singleflight expand by @jzelinskie in #1617
• datastore/proxy: add singleflight proxy by @jzelinskie in #1610
• do not open a new Spanner client for version checks by @vroldanbet in #1616
• Add schema watch support in Spanner datastore driver by @josephschorr in #1588
• log payloads, and add grpc duration as an integer by @vroldanbet in #1615
• Run postgres datastore tests with pgbouncer by @bradengroom in #1594
• MySQL: introduces an index to speed up Watch API calls by @vroldanbet in #1566
• Fix benchmark test for changes in ReadWriteTx by @josephschorr in #1623
• derive Spanner default gRPC connection count from GOMAXPROCS by @vroldanbet in #1622
• Ensure all datastores return an error if accessed after Close by @josephschorr in #1624
• Remove support for MySQL v5 by @josephschorr in #1625
• introduces flags to set min/max Spanner sessions by @vroldanbet in #1627
• Fix error redaction in MySQL driver by @josephschorr in #1628
• adds flags to enable block and mutex profiles by @vroldanbet in #1621
• do not create custom canceled graph error by @vroldanbet in #1629
• Bump github.com/google/uuid from 1.3.1 to 1.4.0 by @dependabot in #1634
• Bump google.golang.org/grpc from 1.58.3 to 1.59.0 by @dependabot in #1633
• Bump github.com/golangci/golangci-lint from 1.54.2 to 1.55.1 by @dependabot in #1636
• Bump github.com/prometheus/common from 0.44.0 to 0.45.0 by @dependabot in #1632
• Fix flake in Postgres GC revision test by ensuring GC is run by @josephschorr in #1631
• Fix the caveat expr limit to be processed by our code by @josephschorr in #1638
• Bump google.golang.org/api from 0.147.0 to 0.149.0 by @dependabot in #1635
• Fix handling of recursive calls via singleflight dispatch by @josephschorr in #1640

Full Changelog: v1.26.0...v1.27.0