vault / openfga / v1.20.0

openfga @ v1.20.0

integrity

size: 1.3 MiB
downloaded: 2026-09-09 01:33 UTC
last checked: 2026-09-09 01:33 UTC
overlays: go
detected: go module github.com/openfga/openfga

source https://github.com/openfga/openfga · available · github

release notes

What's Changed

Added

Added WithServiceName server option to allow embedders to override the serviceName field used for the grpc_service label on OpenFGA's package-level Prometheus metrics and telemetry.RPCInfo.Service. This enables multiple Server instances in the same process to emit separate metric series. Note it does not rename the standard gRPC server metrics (e.g. grpc_server_handled_total), whose labels are derived from the registered gRPC service. Use stable, low-cardinality names, as the value becomes a metric label. Defaults to openfgav1.OpenFGAService_ServiceDesc.ServiceName when omitted (backward compatible). #3265

Fixed

Fixed a deadlock in ListUsers that caused a timeout with partial results when the number of union/intersection operands exceeded OPENFGA_RESOLVE_NODE_BREADTH_LIMIT and the operands each resolved to more than one user. Thank you to @fabianluque for the discovery and detailed report! #3284

Security

Upgraded go toolchain and images to use go1.26.8 to fix CVE-2026-39821. #3287
Rebuilt the embedded grpc-health-probe (bumped to v0.4.57, built with Go 1.26.8) to match the server toolchain and pick up google.golang.org/grpc v1.83.2, which fixes GHSA-vp52-pcj8-j9qc. #3289

Full Changelog: https://github.com/openfga/openfga/compare/v1.19.0...v1.20.0

download

unix · zip

curl -fL -o v1.20.0.zip https://ratatoskr.space/pkg/openfga/v1.20.0.zip
                    printf '%s  %s\n' 'e567190e637e78084397b81ad37a2fbd8b9ea0b882b9398a56cf3897df883344' 'v1.20.0.zip' | sha256sum -c -

windows · zip

$url = "https://ratatoskr.space/pkg/openfga/v1.20.0.zip"
$out = "v1.20.0.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "e567190e637e78084397b81ad37a2fbd8b9ea0b882b9398a56cf3897df883344") { throw "sha256 mismatch" }

unix · tar.gz

curl -fL -o v1.20.0.tar.gz https://ratatoskr.space/pkg/openfga/v1.20.0.tar.gz
                    printf '%s  %s\n' 'de67090ec690766879edf3ac9a860871c43b94e7fa2169a63f1a55648fe27037' 'v1.20.0.tar.gz' | sha256sum -c -

windows · tar.gz

$url = "https://ratatoskr.space/pkg/openfga/v1.20.0.tar.gz"
$out = "v1.20.0.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "de67090ec690766879edf3ac9a860871c43b94e7fa2169a63f1a55648fe27037") { throw "sha256 mismatch" }

download via yggdrasil mesh

unix · zip

curl -fL -o v1.20.0.zip http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga/v1.20.0.zip
                    printf '%s  %s\n' 'e567190e637e78084397b81ad37a2fbd8b9ea0b882b9398a56cf3897df883344' 'v1.20.0.zip' | sha256sum -c -

windows · zip

$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga/v1.20.0.zip"
$out = "v1.20.0.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "e567190e637e78084397b81ad37a2fbd8b9ea0b882b9398a56cf3897df883344") { throw "sha256 mismatch" }

unix · tar.gz

curl -fL -o v1.20.0.tar.gz http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga/v1.20.0.tar.gz
                    printf '%s  %s\n' 'de67090ec690766879edf3ac9a860871c43b94e7fa2169a63f1a55648fe27037' 'v1.20.0.tar.gz' | sha256sum -c -

windows · tar.gz

$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga/v1.20.0.tar.gz"
$out = "v1.20.0.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "de67090ec690766879edf3ac9a860871c43b94e7fa2169a63f1a55648fe27037") { throw "sha256 mismatch" }

artifact	format	size	hashes
v1.20.0.zip	zip	1.3 MiB	blake3-24 4dd49cdb7779500cc68d03250ccc5349e4a106b722d58d15 sha256 e567190e637e78084397b81ad37a2fbd8b9ea0b882b9398a56cf3897df883344 sha1 3d60550faaac8173cbd585f678b701bb1486efb7
v1.20.0.tar.gz	tar.gz	1.1 MiB	blake3-24 08cad44e8b96f27afc6080e8b9136fb43be0b69860d132a7 sha256 de67090ec690766879edf3ac9a860871c43b94e7fa2169a63f1a55648fe27037 sha1 ba45a705391ffc37081be79de4dc7b6f9324819d

go module archive

module zip with the module path rewritten to this mirror; fetched by go get through the GOPROXY route

artifact	format	size	hashes
v1.20.0.zip	zip	1.3 MiB	blake3-24 1227deaf82e88ac7805f6fecff7b61726359b8625f0333da sha256 cee3ca19f23505a4c204a0f0e67051a9701b142618b703d0866442f59631ccc2 sha1 b6b0663b76b6f66b61149705ee46120bc259e4e1

install

bazel

http_archive(
    name = "openfga",
    urls = ["https://ratatoskr.space/pkg/openfga/v1.20.0.tar.gz"],
    integrity = "sha256-3mcJDsaQdmh57fOsmoYIccQ7lOf6IWmmPxpVZI/icDc=",
    strip_prefix = "openfga-v1.20.0",
)

zig

.url = "https://ratatoskr.space/pkg/openfga/v1.20.0.tar.gz",

GOPROXY=https://ratatoskr.space GOSUMDB=off go get ratatoskr.space/pkg/openfga@v1.20.0

install via yggdrasil mesh

bazel

http_archive(
    name = "openfga",
    urls = ["http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga/v1.20.0.tar.gz"],
    integrity = "sha256-3mcJDsaQdmh57fOsmoYIccQ7lOf6IWmmPxpVZI/icDc=",
    strip_prefix = "openfga-v1.20.0",
)

zig

.url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga/v1.20.0.tar.gz",

GOPROXY=http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg GOSUMDB=off GOINSECURE=14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/* go get 14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/openfga@v1.20.0

v1.19.0 →