vault / openfga / v1.14.0

openfga @ v1.14.0

integrity

size: 1.2 MiB
downloaded: 2026-07-04 06:56 UTC
last checked: 2026-07-19 09:04 UTC
overlays: go
detected: go module github.com/openfga/openfga

source https://github.com/openfga/openfga · available · github

release notes

Added

Added openfga_iter_query_duration_ms histogram metric to track storage iterator query latency across all storage backends, labeled by success. The metric is recorded in each backend's fetchBuffer after error classification: infrastructure failures are labeled success=false; expected storage outcomes (ErrNotFound, ErrCollision, ErrInvalidWriteInput) are labeled success=true. #3030

Changed

Changed the ListObjects pipeline intersection algorithm to improve intersection performance. #3031
[BREAKING] The Playground now only supports the none authentication method. Running the Playground with preshared key authentication is no longer supported. The server will error and not start if it detects this combination.

Deprecated

The built-in OpenFGA Playground is intended for development purposes only and is deprecated. It will be removed entirely in a future release.
The --playground-port flag and OPENFGA_PLAYGROUND_PORT environment variable are deprecated. Use --playground-addr (OPENFGA_PLAYGROUND_ADDR) instead to specify the full host:port address for the Playground server. When --playground-addr is not set, the Playground binds to 127.0.0.1 using the port from --playground-port.

Fixed

Fixed Write operations failing with invalid input syntax for type integer (SQLSTATE 22P02) when PostgreSQL is behind PgBouncer or a connection pooler using the simple query protocol. #3014
Fixed PostgreSQL HandleSQLError and GetStore returning a wrapped error instead of storage.ErrNotFound when no rows are found. When using pgxpool directly, QueryRow().Scan() returns pgx.ErrNoRows, not sql.ErrNoRows; both are now handled. #3014
Fixed the possibility of deadlocks within the ListObjects pipeline algorithm. Also added short-circuit enhancements that will reduce latency and message processing in certain scenarios. Cyclical edges now use as much memory as necessary to process deep and wide data hierarchies without the risk of a deadlock. #3028
Fixed issue where BatchCheck calls with multiple checks for the same tuple could result in improper policy enforcement. CVE-2026-34972

Full Changelog: https://github.com/openfga/openfga/compare/v1.13.1...v1.14.0

download

unix · zip

curl -fL -o v1.14.0.zip https://ratatoskr.space/pkg/openfga/v1.14.0.zip
                    printf '%s  %s\n' 'fb1b18e8058c07eb58a5056130e1b4d4ac5e9e967fb21c41293094594309a031' 'v1.14.0.zip' | sha256sum -c -

windows · zip

$url = "https://ratatoskr.space/pkg/openfga/v1.14.0.zip"
$out = "v1.14.0.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "fb1b18e8058c07eb58a5056130e1b4d4ac5e9e967fb21c41293094594309a031") { throw "sha256 mismatch" }

unix · tar.gz

curl -fL -o v1.14.0.tar.gz https://ratatoskr.space/pkg/openfga/v1.14.0.tar.gz
                    printf '%s  %s\n' '0d10deaefc5891cb47d07f4d4dade0b55aaad801750652c1af911eda02bbbbba' 'v1.14.0.tar.gz' | sha256sum -c -

windows · tar.gz

$url = "https://ratatoskr.space/pkg/openfga/v1.14.0.tar.gz"
$out = "v1.14.0.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "0d10deaefc5891cb47d07f4d4dade0b55aaad801750652c1af911eda02bbbbba") { throw "sha256 mismatch" }

download via yggdrasil mesh

unix · zip

curl -fL -o v1.14.0.zip http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga/v1.14.0.zip
                    printf '%s  %s\n' 'fb1b18e8058c07eb58a5056130e1b4d4ac5e9e967fb21c41293094594309a031' 'v1.14.0.zip' | sha256sum -c -

windows · zip

$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga/v1.14.0.zip"
$out = "v1.14.0.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "fb1b18e8058c07eb58a5056130e1b4d4ac5e9e967fb21c41293094594309a031") { throw "sha256 mismatch" }

unix · tar.gz

curl -fL -o v1.14.0.tar.gz http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga/v1.14.0.tar.gz
                    printf '%s  %s\n' '0d10deaefc5891cb47d07f4d4dade0b55aaad801750652c1af911eda02bbbbba' 'v1.14.0.tar.gz' | sha256sum -c -

windows · tar.gz

$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga/v1.14.0.tar.gz"
$out = "v1.14.0.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "0d10deaefc5891cb47d07f4d4dade0b55aaad801750652c1af911eda02bbbbba") { throw "sha256 mismatch" }

artifact	format	size	hashes
v1.14.0.zip	zip	1.2 MiB	blake3-24 1d8e12422265d367392bf47aeff6220fd8e4344f0c3531bc sha256 fb1b18e8058c07eb58a5056130e1b4d4ac5e9e967fb21c41293094594309a031 sha1 faba47c574239f26569d283a348fdb12e796d2b5
v1.14.0.tar.gz	tar.gz	943.2 KiB	blake3-24 c1ab5b12b6cda7cb00edf7c1f3bb3f49bb03a50772aac787 sha256 0d10deaefc5891cb47d07f4d4dade0b55aaad801750652c1af911eda02bbbbba sha1 6b13c8b393e8eccedd6d06dde35adb581c6f0394

go module archive

module zip with the module path rewritten to this mirror; fetched by go get through the GOPROXY route

artifact	format	size	hashes
v1.14.0.zip	zip	1.2 MiB	blake3-24 07f6b0bf753d4fbed1fa28596c3d2111762c11ca0638af6a sha256 c7f10fd6fb4759b277723862c0ee72cc892ef34c94306ce76bd6aae1e792d978 sha1 f14defb20cedd9e546333aa7c52fbcae5f3083dc

install

bazel

http_archive(
    name = "openfga",
    urls = ["https://ratatoskr.space/pkg/openfga/v1.14.0.tar.gz"],
    integrity = "sha256-DRDervxYkctH0H9NTa3gtVqq2AF1BlLBr5Ee2gK7u7o=",
    strip_prefix = "openfga-v1.14.0",
)

zig

.url = "https://ratatoskr.space/pkg/openfga/v1.14.0.tar.gz",

GOPROXY=https://ratatoskr.space GOSUMDB=off go get ratatoskr.space/pkg/openfga@v1.14.0

install via yggdrasil mesh

bazel

http_archive(
    name = "openfga",
    urls = ["http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga/v1.14.0.tar.gz"],
    integrity = "sha256-DRDervxYkctH0H9NTa3gtVqq2AF1BlLBr5Ee2gK7u7o=",
    strip_prefix = "openfga-v1.14.0",
)

zig

.url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga/v1.14.0.tar.gz",

GOPROXY=http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg GOSUMDB=off GOINSECURE=14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/* go get 14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga@v1.14.0

← v1.14.1 v1.13.1 →