[dependabot]

Bumps github.com/authzed/spicedb from 1.54.0 to 1.56.0.

Release notes

Sourced from github.com/authzed/spicedb's releases.

v1.56.0

Added

• New metric check_permissionship_total for CheckPermission and CheckBulkPermissions that counts the number of requests that returned HAS_PERMISSION. Also, write_relationships_updates also includes BulkImport calls (authzed/spicedb#3240)

Changed

• Schema: reads inside write transactions now use a cheap hash-only lookup (schema_revision) to check the cache before loading the full schema blob, reducing DB round-trips on cache hits (authzed/spicedb#3160)
• Updated the Prometheus buckets for grpc_server_handling_seconds and spicedb_datastore_query_latency to be able to correlate them (authzed/spicedb#3188)
• Use testcontainers instead of ory/dockertest for running containers in integration tests (authzed/spicedb#2782)
• Embedded: add pkg/embedded, an in-process library for running permission checks against a datastore via the dispatch engine, without standing up a gRPC server (authzed/spicedb#3166)
• Caveats: compiled caveats (and their CEL environments) are now cached per schema version — hung off the stored schema (ReadOnlyStoredSchema) and rebuilt only when the schema changes — rather than rebuilt on every check, reducing check cost for schemas with many caveats (authzed/spicedb#3166)

Fixed

• Fixed a nil pointer dereference panic in CheckBulkPermissions that could occur under concurrent load when a tracing-enabled check shared a singleflight dispatch with a non-tracing bulk check. Debug-enabled checks are no longer singleflighted together with non-debug checks. (authzed/spicedb#3174)
• Fixed a nil pointer dereference panic in the Postgres FDW (authzed/spicedb#3235)
• CockroachDB: deletes performed by CockroachDB's row-level TTL job for expired relationships are no longer emitted as DELETE events by the Watch API. On CockroachDB ≥ 24.1, SpiceDB sets the ttl_disable_changefeed_replication storage parameter on the relationship tables at startup (if it lacks ALTER TABLE privileges, it logs a warning with the statement to run manually); on older versions a startup warning is logged and TTL deletes continue to be emitted. Note that the parameter affects any changefeed over these tables — external changefeeds that want TTL deletes can opt back in with ignore_disable_changefeed_replication. Delete-only transactions also no longer write an internal transaction-metadata marker row, reducing write amplification. (authzed/spicedb#3210)
• When SpiceDB loses a connection to a CockroachDB node, every read happening in the server blocks for a short period of time (authzed/spicedb#3181)
• LSP: hover and go-to-definition now resolve identifiers on the right-hand side of arrow expressions (->, .any(...), .all(...)) (authzed/spicedb#3157)
• The in_cidr caveat now matches IPv4-mapped IPv6 addresses (e.g. ::ffff:10.1.2.3) against IPv4 CIDRs, the same as the dotted form (authzed/spicedb#3184)
• MySQL: MySQL deadlocks on WriteRelationships (authzed/spicedb#3187)
• Datastore: a hung datastore round-trip while computing the optimized revision can no longer wedge the server. The revision is computed under singleflight, which detaches the work from the caller's context (stripping its gRPC deadline); a stuck computation (e.g. a half-open connection silently dropped by a load balancer) therefore pinned the latency of every concurrent caller and inflated whole-system P99. The shared computation is now aggressively bounded (2s), with a direct, deadline-respecting retry outside singleflight on failure so a transient wedge does not fail the request. Applies to all datastores. (authzed/spicedb#3142)
• Postgres & CockroachDB: pooled connections that have gone idle are now liveness-pinged with a bounded timeout (default 5s) before being handed to a query, so a half-open connection is discarded and replaced instead of hanging the acquiring request. (authzed/spicedb#3142)
• Memory: If SpiceDB couldn't determine the memory available to it (such as can happen in AWS ECS), it assumed that its memory was unbounded. We changed how memory detection works to make conservative estimates in these cases and made some improvements to cache entry cost estimation. (authzed/spicedb#3201, authzed/spicedb#3247)
• Datastore: raw datastore driver errors that could leak engine internals (such as SQLSTATE codes or opaque COPY wrappers) are no longer returned to clients. Unhandled Postgres, MySQL, and CockroachDB driver errors — including CockroachDB's transient retryable/resettable errors — are now surfaced as descriptive, engine-agnostic gRPC statuses (with the full error logged server-side), and an aborted bulk-import COPY now reports the underlying source error instead of the driver's opaque wrapper. (authzed/spicedb#3202)

What's Changed

• release/1.54 by @​miparnisari in authzed/spicedb#3188
• test(lsp): cover arrow RHS multi-match permission branch by @​ivanauth in authzed/spicedb#3182
• fix: match IPv4-mapped IPv6 addresses in the in_cidr caveat by @​kanywst in authzed/spicedb#3184
• fix(mysql): exponential backoff on write retries (#3172) by @​ivanauth in authzed/spicedb#3187
• chore: update buckets for latency and datastore latency by @​miparnisari in authzed/spicedb#3191
• fix(datastore): prevent optimized revision singleflight from wedging the server by @​josephschorr in authzed/spicedb#3142
• test: consolidate TestConsistency by @​miparnisari in authzed/spicedb#3185
• chore: add IsSubset to mapz/ by @​miparnisari in authzed/spicedb#3197
• chore: change how memory limit is set by @​tstirrat15 in authzed/spicedb#3201
• fix(datastore): return descriptive, engine-agnostic errors instead of raw driver errors by @​josephschorr in authzed/spicedb#3202
• ci: stop E2E required check from getting stuck on non-code PRs by @​miparnisari in authzed/spicedb#3205
• chore: Add threat model to SECURITY.md by @​jzelinskie in authzed/spicedb#3194
• chore: update grafana dashboard for CRDB tx restarts, and update gith… by @​miparnisari in authzed/spicedb#3204
• fix: guard nil debug request in bulk check by @​ivanauth in authzed/spicedb#3174
• chore(deps): bump the docker group across 1 directory with 2 updates by @​dependabot[bot] in authzed/spicedb#3178
• fix(crdb): suppress row-level TTL deletes from the Watch API at the source by @​josephschorr in authzed/spicedb#3210
• chore(deps): bump the github-actions group across 1 directory with 12 updates by @​dependabot[bot] in authzed/spicedb#3209
• test: fix flaky TestConsistencyPerDatastore/postgres by @​miparnisari in authzed/spicedb#3216
• chore: replace ory/dockertest with testcontainers by @​miparnisari in authzed/spicedb#2782
• test: fix flaky TestOldWatchingCacheBasicOperation by @​miparnisari in authzed/spicedb#3217
• ci: update benchmark mage targets by @​miparnisari in authzed/spicedb#3221
• chore: fix broken test by @​tstirrat15 in authzed/spicedb#3233
• perf(mysql): force per-query-shape indexes for relationship queries by @​josephschorr in authzed/spicedb#3173
• chore: small followups to the testcontainers PR by @​tstirrat15 in authzed/spicedb#3230

... (truncated)

Changelog

Sourced from github.com/authzed/spicedb's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog.

[Unreleased]

Added

• New metric check_permissionship_total for CheckPermission and CheckBulkPermissions that counts the number of requests that returned HAS_PERMISSION. Also, write_relationships_updates also includes BulkImport calls (authzed/spicedb#3240)

Changed

• Schema: reads inside write transactions now use a cheap hash-only lookup (schema_revision) to check the cache before loading the full schema blob, reducing DB round-trips on cache hits (authzed/spicedb#3160)
• Updated the Prometheus buckets for grpc_server_handling_seconds and spicedb_datastore_query_latency to be able to correlate them (authzed/spicedb#3188)
• Use testcontainers instead of ory/dockertest for running containers in integration tests (authzed/spicedb#2782)
• Embedded: add pkg/embedded, an in-process library for running permission checks against a datastore via the dispatch engine, without standing up a gRPC server (authzed/spicedb#3166)
• Caveats: compiled caveats (and their CEL environments) are now cached per schema version — hung off the stored schema (ReadOnlyStoredSchema) and rebuilt only when the schema changes — rather than rebuilt on every check, reducing check cost for schemas with many caveats (authzed/spicedb#3166)

Fixed

• Fixed a nil pointer dereference panic in CheckBulkPermissions that could occur under concurrent load when a tracing-enabled check shared a singleflight dispatch with a non-tracing bulk check. Debug-enabled checks are no longer singleflighted together with non-debug checks. (authzed/spicedb#3174)
• Fixed a nil pointer dereference panic in the Postgres FDW (authzed/spicedb#3235)
• CockroachDB: deletes performed by CockroachDB's row-level TTL job for expired relationships are no longer emitted as DELETE events by the Watch API. On CockroachDB ≥ 24.1, SpiceDB sets the ttl_disable_changefeed_replication storage parameter on the relationship tables at startup (if it lacks ALTER TABLE privileges, it logs a warning with the statement to run manually); on older versions a startup warning is logged and TTL deletes continue to be emitted. Note that the parameter affects any changefeed over these tables — external changefeeds that want TTL deletes can opt back in with ignore_disable_changefeed_replication. Delete-only transactions also no longer write an internal transaction-metadata marker row, reducing write amplification. (authzed/spicedb#3210)
• When SpiceDB loses a connection to a CockroachDB node, every read happening in the server blocks for a short period of time (authzed/spicedb#3181)
• LSP: hover and go-to-definition now resolve identifiers on the right-hand side of arrow expressions (->, .any(...), .all(...)) (authzed/spicedb#3157)
• The in_cidr caveat now matches IPv4-mapped IPv6 addresses (e.g. ::ffff:10.1.2.3) against IPv4 CIDRs, the same as the dotted form (authzed/spicedb#3184)
• MySQL: MySQL deadlocks on WriteRelationships (authzed/spicedb#3187)
• Datastore: a hung datastore round-trip while computing the optimized revision can no longer wedge the server. The revision is computed under singleflight, which detaches the work from the caller's context (stripping its gRPC deadline); a stuck computation (e.g. a half-open connection silently dropped by a load balancer) therefore pinned the latency of every concurrent caller and inflated whole-system P99. The shared computation is now aggressively bounded (2s), with a direct, deadline-respecting retry outside singleflight on failure so a transient wedge does not fail the request. Applies to all datastores. (authzed/spicedb#3142)
• Postgres & CockroachDB: pooled connections that have gone idle are now liveness-pinged with a bounded timeout (default 5s) before being handed to a query, so a half-open connection is discarded and replaced instead of hanging the acquiring request. (authzed/spicedb#3142)
• Memory: If SpiceDB couldn't determine the memory available to it (such as can happen in AWS ECS), it assumed that its memory was unbounded. We changed how memory detection works to make conservative estimates in these cases and made some improvements to cache entry cost estimation. (authzed/spicedb#3201, authzed/spicedb#3247)
• Datastore: raw datastore driver errors that could leak engine internals (such as SQLSTATE codes or opaque COPY wrappers) are no longer returned to clients. Unhandled Postgres, MySQL, and CockroachDB driver errors — including CockroachDB's transient retryable/resettable errors — are now surfaced as descriptive, engine-agnostic gRPC statuses (with the full error logged server-side), and an aborted bulk-import COPY now reports the underlying source error instead of the driver's opaque wrapper. (authzed/spicedb#3202)

Security

• Bumped google.golang.org/grpc to v1.82.1 to address GHSA-hrxh-6v49-42gf (gRPC-Go: xDS RBAC and HTTP/2 vulnerabilities) (authzed/spicedb#3246)

Commits

• 8422483 test: add test for catching cache memory leaks (#3247)
• bc671b1 chore(deps): bump google.golang.org/grpc to v1.82.1 (#3246)
• a1a9509 feat: add metric counting % of HAS_PERMISSION results (#3240)
• 398abc0 feat: in-process embedded permissions and per-schema-version caching (#3166)
• 2614340 chore: update docker-composes's prometheus version (#3242)
• fd84b2a chore(deps): bump the docker group with 2 updates (#3231)
• c825ec8 docs(fdw): correct relationships table caveat columns (#3229)
• 9ebd803 fix(fdw): prevent nil pointer panic on non-string literals in WHERE c… (#3235)
• 385bf9c chore: small followups to the testcontainers PR (#3230)
• 339c166 perf(mysql): force per-query-shape indexes for relationship queries
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)