openfga @ v1.18.0

integrity

size: 1.3 MiB
downloaded: 2026-07-04 06:56 UTC
last checked: 2026-07-18 21:05 UTC
overlays: go
detected: go module github.com/openfga/openfga

source https://github.com/openfga/openfga · available · github

release notes

🚨 Operational warning for MySQL users 🚨

This release contains a migration for MySQL which acquires a shared lock on the tuple and changelog tables. This is a potentially-lengthy migration, during which you will not be able to perform Write operations.

What you should do: Do not execute auto-migrations on startup for production instances with large datasets. Please refer to this migration guide before applying this migration.

Fixed

Use crypto/subtle.ConstantTimeCompare for preshared key authentication to close a timing side-channel where the prior map lookup could reveal information about valid key bytes. #3168 Thanks to @geo-chen for reporting this.

Security

Fixed identifier comparison on the MySQL backend to be case-sensitive, matching Postgres and SQLite. Ships schema migrations 008, which require a maintenance window — see the operator runbook before upgrading. Resolves CVE-2026-55170. Resolves CVE-2026-55689. Thank you @sahajamoth for bringing this to our attention.
Enforce that authn.oidc.issuer and authn.oidc.audience are both set when authn.method is oidc. Previously, omitting --authn-oidc-audience caused the JWT aud claim to be silently skipped during token validation, allowing any validly-signed token from the trusted issuer to be accepted regardless of its intended audience. OpenFGA will now refuse to start if either value is missing. Thank you @0xVijay for bringing this to our attention.

Full Changelog: https://github.com/openfga/openfga/compare/v1.17.1...v1.18.0

download

unix · zip

curl -fL -o v1.18.0.zip https://ratatoskr.space/pkg/openfga/v1.18.0.zip
                    printf '%s  %s\n' 'cf3a0323706430a7ad16dfdd0de25479cc465d97bc5739bd75f5b516f7bc8865' 'v1.18.0.zip' | sha256sum -c -

windows · zip

$url = "https://ratatoskr.space/pkg/openfga/v1.18.0.zip"
$out = "v1.18.0.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "cf3a0323706430a7ad16dfdd0de25479cc465d97bc5739bd75f5b516f7bc8865") { throw "sha256 mismatch" }

unix · tar.gz

curl -fL -o v1.18.0.tar.gz https://ratatoskr.space/pkg/openfga/v1.18.0.tar.gz
                    printf '%s  %s\n' '24f4f8c6f0e6fd56c913beda32a528cf56e346f574f3029593b7035804247ab7' 'v1.18.0.tar.gz' | sha256sum -c -

windows · tar.gz

$url = "https://ratatoskr.space/pkg/openfga/v1.18.0.tar.gz"
$out = "v1.18.0.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "24f4f8c6f0e6fd56c913beda32a528cf56e346f574f3029593b7035804247ab7") { throw "sha256 mismatch" }

download via yggdrasil mesh

unix · zip

curl -fL -o v1.18.0.zip http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga/v1.18.0.zip
                    printf '%s  %s\n' 'cf3a0323706430a7ad16dfdd0de25479cc465d97bc5739bd75f5b516f7bc8865' 'v1.18.0.zip' | sha256sum -c -

windows · zip

$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga/v1.18.0.zip"
$out = "v1.18.0.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "cf3a0323706430a7ad16dfdd0de25479cc465d97bc5739bd75f5b516f7bc8865") { throw "sha256 mismatch" }

unix · tar.gz

curl -fL -o v1.18.0.tar.gz http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga/v1.18.0.tar.gz
                    printf '%s  %s\n' '24f4f8c6f0e6fd56c913beda32a528cf56e346f574f3029593b7035804247ab7' 'v1.18.0.tar.gz' | sha256sum -c -

windows · tar.gz

$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga/v1.18.0.tar.gz"
$out = "v1.18.0.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "24f4f8c6f0e6fd56c913beda32a528cf56e346f574f3029593b7035804247ab7") { throw "sha256 mismatch" }

artifact	format	size	hashes
v1.18.0.zip	zip	1.3 MiB	blake3-24 85ef723d2ede8f94cbd28ea063fb9a28f2e70347f093f811 sha256 cf3a0323706430a7ad16dfdd0de25479cc465d97bc5739bd75f5b516f7bc8865 sha1 c8db16c807e687f8afabee6805ff3c0a5d42affd
v1.18.0.tar.gz	tar.gz	1.0 MiB	blake3-24 b7378d67a19b0d7251621e4cbcf3b099150469dac1f54436 sha256 24f4f8c6f0e6fd56c913beda32a528cf56e346f574f3029593b7035804247ab7 sha1 45315b2e58220a592d2e2a3477e3dd1816fd395e

go module archive

module zip with the module path rewritten to this mirror; fetched by go get through the GOPROXY route

artifact	format	size	hashes
v1.18.0.zip	zip	1.3 MiB	blake3-24 5f48a37658be352ad63f6f2201b94c8f3a40a8bb74186fb5 sha256 65b2935e56688408d346ab014ba0409f59de3075144fe7e06f725e0d4b2696d8 sha1 269f6fce254be3688d99ba7e5bef6df9cc24290e

install

bazel

http_archive(
    name = "openfga",
    urls = ["https://ratatoskr.space/pkg/openfga/v1.18.0.tar.gz"],
    integrity = "sha256-JPT4xvDm/VbJE77aMqUoz1bjRvV08wKVk7cDWAQkerc=",
    strip_prefix = "openfga-v1.18.0",
)

zig

.url = "https://ratatoskr.space/pkg/openfga/v1.18.0.tar.gz",

GOPROXY=https://ratatoskr.space GOSUMDB=off go get ratatoskr.space/pkg/openfga@v1.18.0

install via yggdrasil mesh

bazel

http_archive(
    name = "openfga",
    urls = ["http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga/v1.18.0.tar.gz"],
    integrity = "sha256-JPT4xvDm/VbJE77aMqUoz1bjRvV08wKVk7cDWAQkerc=",
    strip_prefix = "openfga-v1.18.0",
)

zig

.url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga/v1.18.0.tar.gz",

GOPROXY=http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg GOSUMDB=off GOINSECURE=14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/* go get 14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga@v1.18.0

← v1.18.1 v1.17.1 →