Skip to content

v1.56.0

Latest
Latest

Choose a tag to compare

View all tags
@miparnisari miparnisari released this 24 Jul 19:46
v1.56.0
8422483
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • New metric check_permissionship_total for CheckPermission and CheckBulkPermissions that counts the number of requests that returned HAS_PERMISSION. Also, write_relationships_updates also includes BulkImport calls (#3240)

Changed

  • Schema: reads inside write transactions now use a cheap hash-only lookup (schema_revision) to check the cache before loading the full schema blob, reducing DB round-trips on cache hits (#3160)
  • Updated the Prometheus buckets for grpc_server_handling_seconds and spicedb_datastore_query_latency to be able to correlate them (#3188)
  • Use testcontainers instead of ory/dockertest for running containers in integration tests (#2782)
  • Embedded: add pkg/embedded, an in-process library for running permission checks against a datastore via the dispatch engine, without standing up a gRPC server (#3166)
  • Caveats: compiled caveats (and their CEL environments) are now cached per schema version — hung off the stored schema (ReadOnlyStoredSchema) and rebuilt only when the schema changes — rather than rebuilt on every check, reducing check cost for schemas with many caveats (#3166)

Fixed

  • Fixed a nil pointer dereference panic in CheckBulkPermissions that could occur under concurrent load when a tracing-enabled check shared a singleflight dispatch with a non-tracing bulk check. Debug-enabled checks are no longer singleflighted together with non-debug checks. (#3174)
  • Fixed a nil pointer dereference panic in the Postgres FDW (#3235)
  • CockroachDB: deletes performed by CockroachDB's row-level TTL job for expired relationships are no longer emitted as DELETE events by the Watch API. On CockroachDB ≥ 24.1, SpiceDB sets the ttl_disable_changefeed_replication storage parameter on the relationship tables at startup (if it lacks ALTER TABLE privileges, it logs a warning with the statement to run manually); on older versions a startup warning is logged and TTL deletes continue to be emitted. Note that the parameter affects any changefeed over these tables — external changefeeds that want TTL deletes can opt back in with ignore_disable_changefeed_replication. Delete-only transactions also no longer write an internal transaction-metadata marker row, reducing write amplification. (#3210)
  • When SpiceDB loses a connection to a CockroachDB node, every read happening in the server blocks for a short period of time (#3181)
  • LSP: hover and go-to-definition now resolve identifiers on the right-hand side of arrow expressions (->, .any(...), .all(...)) (#3157)
  • The in_cidr caveat now matches IPv4-mapped IPv6 addresses (e.g. ::ffff:10.1.2.3) against IPv4 CIDRs, the same as the dotted form (#3184)
  • MySQL: MySQL deadlocks on WriteRelationships (#3187)
  • Datastore: a hung datastore round-trip while computing the optimized revision can no longer wedge the server. The revision is computed under singleflight, which detaches the work from the caller's context (stripping its gRPC deadline); a stuck computation (e.g. a half-open connection silently dropped by a load balancer) therefore pinned the latency of every concurrent caller and inflated whole-system P99. The shared computation is now aggressively bounded (2s), with a direct, deadline-respecting retry outside singleflight on failure so a transient wedge does not fail the request. Applies to all datastores. (#3142)
  • Postgres & CockroachDB: pooled connections that have gone idle are now liveness-pinged with a bounded timeout (default 5s) before being handed to a query, so a half-open connection is discarded and replaced instead of hanging the acquiring request. (#3142)
  • Memory: If SpiceDB couldn't determine the memory available to it (such as can happen in AWS ECS), it assumed that its memory was unbounded. We changed how memory detection works to make conservative estimates in these cases and made some improvements to cache entry cost estimation. (#3201, #3247)
  • Datastore: raw datastore driver errors that could leak engine internals (such as SQLSTATE codes or opaque COPY wrappers) are no longer returned to clients. Unhandled Postgres, MySQL, and CockroachDB driver errors — including CockroachDB's transient retryable/resettable errors — are now surfaced as descriptive, engine-agnostic gRPC statuses (with the full error logged server-side), and an aborted bulk-import COPY now reports the underlying source error instead of the driver's opaque wrapper. (#3202)

What's Changed

New Contributors

Full Changelog: v1.54.0...v1.56.0

Docker Images

This release is available at authzed/spicedb:v1.56.0, quay.io/authzed/spicedb:v1.56.0, ghcr.io/authzed/spicedb:v1.56.0

Contributors

jzelinskie, mazdakb, and 7 other contributors
Assets 15
Loading