chore(deps): Bump github.com/authzed/spicedb from 1.51.1 to 1.52.0

[dependabot]

Bumps github.com/authzed/spicedb from 1.51.1 to 1.52.0.

Release notes

Sourced from github.com/authzed/spicedb's releases.

v1.52.0

What's changed

Added

• Added support for YAML-based validation files in DevContext (authzed/spicedb#3024)
• Added support for YAML-based validation files in the Language Server (authzed/spicedb#3024)
• Enable statistics-based optimizations when --experimental-query-plan is enabled. (authzed/spicedb#3052)
• Added missing implementations of cursoring for LookupResource, LookupSubjects and ReadRelationships calls in FDW (authzed/spicedb#3016)
• Add new gRPC Dispatch API and messages for dispatching query plans (authzed/spicedb#3072)
• Support new withDebug flag in LookupResources calls to identify cycles (authzed/spicedb#3070)

Changed

• Removed MySQL metrics prefixed with go_sql_stats_connections_* in favor of those prefixed with go_sql_* (authzed/spicedb#2980)
• Removed support for Spanner flag value --datastore-spanner-metrics=deprecated-prometheus; please use values otel or native (authzed/spicedb#2980)
• Reduced binary size (authzed/spicedb#3005)
• Reduce memory consumption of Watch API (authzed/spicedb#2578)

Fixed

• Improved error message when expiration is written before caveat in a relationship (authzed/spicedb#3071)
• On a Postgres setup with read replicas, some requests may silently swallow errors of sort "revision not found in replica" (authzed/spicedb#2979)
• Use cgroup-aware memory detection for cache and watch buffer sizing in containerized environments (authzed/spicedb#3000)
• Upgraded the spanner client, which changed the internal implementation to not use a session pool. This means that the --datastore-spanner-max-sessions and --datastore-spanner-min-sessions flags are now deprecated and no-op. We also strongly recommend using Application Default Credentials in favor of a credentials file. (authzed/spicedb#3038)
• Query Planner: error "ERROR: index \"pk_relation_tuple\" cannot be used for this query (SQLSTATE 42809)" returned when using wildcards (authzed/spicedb#3039)
• Providing one of (--grpc-tls-cert-path, --grpc-tls-key-path) but not the other is now considered an error state, as both are necessary if you want to use TLS.
• In a caveat context that uses nested lists of lists, the hashes generated for cache keys could collide because of an issue with the serialization logic. The serialization now uses deterministic protobuf serialization which avoids this issue (authzed/spicedb#3065)

Changelog

Sourced from github.com/authzed/spicedb's changelog.

[1.52.0] - 2026-04-30

Added

• Added support for YAML-based validation files in DevContext (authzed/spicedb#3024)
• Added support for YAML-based validation files in the Language Server (authzed/spicedb#3024)
• Enable statistics-based optimizations when --experimental-query-plan is enabled. (authzed/spicedb#3052)
• Added missing implementations of cursoring for LookupResource, LookupSubjects and ReadRelationships calls in FDW (authzed/spicedb#3016)
• Add new gRPC Dispatch API and messages for dispatching query plans (authzed/spicedb#3072)
• Support new withDebug flag in LookupResources calls to identify cycles (authzed/spicedb#3070)

Changed

• Removed MySQL metrics prefixed with go_sql_stats_connections_* in favor of those prefixed with go_sql_* (authzed/spicedb#2980)
• Removed support for Spanner flag value --datastore-spanner-metrics=deprecated-prometheus; please use values otel or native (authzed/spicedb#2980)
• Reduced binary size (authzed/spicedb#3005)
• Reduce memory consumption of Watch API (authzed/spicedb#2578)

Fixed

• Improved error message when expiration is written before caveat in a relationship (authzed/spicedb#3071)
• On a Postgres setup with read replicas, some requests may silently swallow errors of sort "revision not found in replica" (authzed/spicedb#2979)
• Use cgroup-aware memory detection for cache and watch buffer sizing in containerized environments (authzed/spicedb#3000)
• Upgraded the spanner client, which changed the internal implementation to not use a session pool. This means that the --datastore-spanner-max-sessions and --datastore-spanner-min-sessions flags are now deprecated and no-op. We also strongly recommend using Application Default Credentials in favor of a credentials file. (authzed/spicedb#3038)
• Query Planner: error "ERROR: index \"pk_relation_tuple\" cannot be used for this query (SQLSTATE 42809)" returned when using wildcards (authzed/spicedb#3039)
• Providing one of (--grpc-tls-cert-path, --grpc-tls-key-path) but not the other is now considered an error state, as both are necessary if you want to use TLS.
• In a caveat context that uses nested lists of lists, the hashes generated for cache keys could collide because of an issue with the serialization logic. The serialization now uses deterministic protobuf serialization which avoids this issue (authzed/spicedb#3065)

Commits

• 76fc153 feat: Add debug output to MaxRecursionDepthError when debug header is set (#3...
• e677c6a feat: introduce protobuf and gRPC for dispatching query plans (#3072)
• 259732a chore: add cyclic tests to query planner (#3075)
• 75b2b72 fix: improve error when expiration is before caveat (#3071)
• 5804d74 chore: fix flaking middleware tests (#3066)
• cd1e2b9 fix: avoid hash collision in caveat context (#3065)
• 312216f chore: refactor complete method to pull out validation and more strictly vali...
• a813585 chore: update changelog
• 86c18e9 perf: have the changes functions return an iter
• b371613 chore: fix docker-composes (Envoy not starting) (#3056)
• Additional commits viewable in compare view