Skip to content

chore(deps): bump github.com/openfga/openfga from 1.16.1 to 1.17.1 in the dependencies group#702

Merged
curfew-marathon merged 2 commits into
mainfrom
dependabot/go_modules/dependencies-f6e44caef2
Jun 8, 2026
Merged

chore(deps): bump github.com/openfga/openfga from 1.16.1 to 1.17.1 in the dependencies group#702
curfew-marathon merged 2 commits into
mainfrom
dependabot/go_modules/dependencies-f6e44caef2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 8, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 1 update: github.com/openfga/openfga.

Updates github.com/openfga/openfga from 1.16.1 to 1.17.1

Release notes

Sourced from github.com/openfga/openfga's releases.

v1.17.1

What's Changed

New Contributors

Full Changelog: openfga/openfga@v1.17.0...v1.17.1

v1.17.0

Added

  • Added a configurable trace sampler via trace.sampler (OPENFGA_TRACE_SAMPLER / OTEL_TRACES_SAMPLER), supporting the standard OpenTelemetry strategies always_on, always_off, traceidratio, parentbased_always_on, parentbased_always_off, and parentbased_traceidratio. This lets OpenFGA honor upstream parent sampling decisions when running as a downstream service. Defaults to traceidratio to preserve existing behavior. #3072 Thanks @​armujahid!

Changed

  • Redesigned cache key generation to use TLV (type-length-value) binary encoding, eliminating collision risk from string concatenation and adding per-process hash seeding to prevent hash-flooding attacks. #3148

New Contributors

Full Changelog: openfga/openfga@v1.16.1...v1.17.0

Changelog

Sourced from github.com/openfga/openfga's changelog.

[1.17.1] - 2026-06-05

Changed

  • Update PR workflow benchmark comparison to be less flakey. #3153

Fixed

  • Fixed experimental weighted_graph_check falling back to the standard algorithm on errors that v1 would reject identically or that should not be retried. ErrTransactionThrottled, check.ErrValidation, check.ErrInvalidUser, and *tuple.InvalidTupleError (from contextual-tuple validation) are now returned directly instead of triggering a v1 retry. #3150
  • Fixed a race where an iterator cache entry flushed concurrently with a write could survive cache controller invalidation checks, causing stale tuples to be returned to subsequent requests. #3155 Thanks to @​0xmrma for reporting this bug.
  • Fixed ReadChanges pagination erroring past the first page when an object type name contains |, and tightened Deserialize to reject tokens with an empty ULID segment rather than silently restarting pagination from the beginning. #3152

Security

  • Update toolchain Go version to 1.26.4 to address the Go standard library vulnerabilities documented in the Go 1.26.4 release notes. #3159
  • Update grpc-health-probe to v0.4.52, rebuilt with Go 1.26.4, so released images no longer ship the Go standard library vulnerabilities fixed in the Go 1.26.4 release notes. #3164 Thanks @​Keralin!

[1.17.0] - 2026-06-02

Added

  • Added a configurable trace sampler via trace.sampler (OPENFGA_TRACE_SAMPLER / OTEL_TRACES_SAMPLER), supporting the standard OpenTelemetry strategies always_on, always_off, traceidratio, parentbased_always_on, parentbased_always_off, and parentbased_traceidratio. This lets OpenFGA honor upstream parent sampling decisions when running as a downstream service. Defaults to traceidratio to preserve existing behavior. #3072 Thanks @​armujahid!

Changed

  • Redesigned cache key generation to use TLV (type-length-value) binary encoding, eliminating collision risk from string concatenation and adding per-process hash seeding to prevent hash-flooding attacks. #3148
Commits
  • 393db3f release: update changelog for release v1.17.1 (#3165)
  • ec685d0 chore: bump grpc-health-probe to v0.4.52 (#3164)
  • c452374 docs: update caching docs (#3163)
  • 4f00251 fix: continuation token deserializer - handle | in type names (#3152)
  • 709b9bd chore(deps): bump the dependencies group across 1 directory with 13 updates (...
  • a4214ad chore(deps): bump the dependencies group across 1 directory with 10 updates (...
  • b49f8b0 fix: use query start time as iterator cache entry LastModified to prevent sta...
  • 2f0a355 chore(deps): bump grpc-ecosystem/grpc-health-probe from v0.4.50 to v0.4.51 in...
  • 1968c52 chore: Bump go toolchain to 1.26.4 (#3159)
  • cfd6ec3 fix: prevent v2Check from falling back for throttling and validation (#3150)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump github.com/openfga/openfga in the dependencies group
4446520 
Bumps the dependencies group with 1 update: [github.com/openfga/openfga](https://github.com/openfga/openfga).


Updates `github.com/openfga/openfga` from 1.16.1 to 1.17.1
- [Release notes](https://github.com/openfga/openfga/releases)
- [Changelog](https://github.com/openfga/openfga/blob/main/CHANGELOG.md)
- [Commits](openfga/openfga@v1.16.1...v1.17.1)

---
updated-dependencies:
- dependency-name: github.com/openfga/openfga
  dependency-version: 1.17.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jun 8, 2026
Copilot AI review requested due to automatic review settings June 8, 2026 12:53
@dependabot dependabot Bot requested a review from a team as a code owner June 8, 2026 12:53
Copilot AI reviewed Jun 8, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@socket-security

socket-security Bot commented Jun 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedgithub.com/​openfga/​openfga@​v1.16.1 ⏵ v1.17.175 +1100100100100

View full report

@curfew-marathon curfew-marathon enabled auto-merge June 8, 2026 16:52
@curfew-marathon curfew-marathon added this pull request to the merge queue Jun 8, 2026
Merged via the queue into main with commit d1fd7d3 Jun 8, 2026
24 checks passed
@curfew-marathon curfew-marathon deleted the dependabot/go_modules/dependencies-f6e44caef2 branch June 8, 2026 16:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@curfew-marathon curfew-marathon curfew-marathon approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@curfew-marathon