OpenFGA v0.4.1 is out - hiding Schema v1.0 support behind flags & bringing various fixes to ListObjects

[rhamzeh]

Hey folks!

We just released OpenFGA v0.4.1. It is includes the v0.4.0 changes, as that release was held due to issues discovered after the release was cut.

v0.4.1 continues the Schema v1.0 deprecation journey by turning off support for v1.0 by default unless some flags are set. This release also brings in various important improvements, especially to ListObjects.

If you are running through docker:

• If you are targeting latest, make sure to update by running docker pull openfga/openfga
• If you are targeting pinned releases, make sure to set your pinned version to: openfga/openfga:v0.4.1

Changes in this release

Removed

• [BREAKING] Disable schema 1.0 support, except if appropriate flags are set (feat: allow schema 1.0 flag openfga#613)
  • As of this release, OpenFGA no longer allows writing or evaluating schema v1.0 models by default. If you need support for it for now, you can use the:
    • OPENFGA_ALLOW_WRITING_1_0_MODELS: set to true to allow WriteAuthorizationModel to accept schema v1.0 models.
    • OPENFGA_ALLOW_EVALUATING_1_0_MODELS: set to true to allow Check, Expand, ListObjects, Write and WriteAssertions that target schema v1.0 models.
    • ReadAuthorizationModel, ReadAuthorizationModels and ReadAssertions are unaffected and will continue to work regardless of the target model schema version.
  • Note that these flags will be removed and support fully dropped in a future release. Read the Schema v1.0 Deprecation Timeline for more details.

Added

• Add OpenFGA version command to the CLI (feat: add version in CLI openfga#625)
• Add timeout flag to migrate command (chore: add timeout flag to migrate command openfga#634)

Fixed

• Improve the speed of Check for 1.1 models by using type restrictions (feat: improve the speed of Check by using type restrictions openfga#545, fix: read userset tuples with a filter like group#member openfga#596)
• Various important fixes to the experimental ListObjects endpoint
  • Improve readUsersets query by dropping unnecessary sorting (Remove sort from ReadUsersetTuples openfga#631, fix: remove sort from ReadUsersetTuples in mysql openfga#633)
  • Fix null pointer exception if computed userset does not exist (fix: list objects null pointer if computed userset does not exist openfga#572)
  • Fix race condition in memory store (fix: race condition in memory store list object openfga#585)
  • Ensure no objects returned that would not have been allowed in Checks (fix: ListObjects should not return objects where Check->false openfga#577, fix: ConnectedObjects TTU expansion behavior openfga#637)
  • Reverse expansion with indirect computed userset relationship (fix: reverse expansion with indirect computed userset relationship openfga#611)
  • Improved tests (chore: enhance integration tests for list objects by asserting on the streaming endpoint openfga#582, chore: make ListObjects tests more readable openfga#599, chore: consolidate integration tests between Check and ListObjects APIs openfga#601, fix: list objects test setup openfga#620)
• Tuning of OTEL parameters (feat: tuning of OTEL parameters openfga#570)
• Fix tracing in Check API (fix: tracing in Check API openfga#627)
• Use chainguard images in Dockerfile (build: use chainguard images in Dockerfile openfga#628)