Added

• model: add weighted graph validation (#788) (bd4b95d)

Miscellaneous

• release 0.9.0 (138ce22)

Security

• Fixed GHSA-6mmf-c7m2-3pv9, where a configuration file in the current working directory could override the server endpoint and token issuer. Thank you to @bugbunny-research for the report. (1edf486)

What's Changed

• chore(deps): bump the dependencies group with 2 updates by @dependabot[bot] in #781
• chore: bump go toolchain to 1.27.3 by @SoulPancake in #783
• chore(deps): bump docker/login-action from 4.6.0 to 4.7.0 in the dependencies group by @dependabot[bot] in #785
• chore(deps): bump github.com/openfga/openfga from 1.22.0 to 1.22.1 in the dependencies group by @dependabot[bot] in #786
• chore: add RELEASING.md by @SoulPancake in #787
• chore(deps): bump github.com/spf13/pflag from 1.0.10 to 1.1.0 in the dependencies group by @dependabot[bot] in #793
• chore(deps): bump the dependencies group with 2 updates by @dependabot[bot] in #794
• feat(model): add weighted graph validation by @aaguiarz in #788
• chore: bump go toolchain to 1.27.4 by @SoulPancake in #796
• chore(deps): bump openfga/go-sdk to v0.8.4 by @SoulPancake in #797
• release: v0.9.0 by @openfga-releaser-bot[bot] in #798

Full Changelog: v0.8.2...v0.9.0

Added

• mapping: add sync command (#774) (9f28d9e)

Changed

• mapping: deprecate run in favour of evaluate (#775) (5802421)

What's Changed

• chore(deps): bump github.com/openfga/go-sdk from 0.8.2 to 0.8.3 in the dependencies group by @dependabot[bot] in #770
• chore(deps): bump anchore/sbom-action/download-syft from 0.24.2 to 0.24.3 in the dependencies group by @dependabot[bot] in #772
• chore(deps): bump github.com/openfga/language/pkg/go from 0.3.2-0.20260818192608-0d2ad7fb7c40 to 0.3.2 in the dependencies group by @dependabot[bot] in #771
• refactor(mapping): add evaluate command, deprecate run by @ewanharris in #775
• refactor(tests): split mapping-test-cases.yaml by subcommand by @ewanharris in #776
• feat(mapping): add sync command by @ewanharris in #774
• chore: update to mapper tagged release by @ewanharris in #777
• chore(deps): bump the dependencies group with 2 updates by @dependabot[bot] in #779
• chore(deps): bump the dependencies group with 2 updates by @dependabot[bot] in #778
• release: v0.8.2 by @openfga-releaser-bot[bot] in #780

Full Changelog: v0.8.1...v0.8.2

Added

• support for dynamic conditions (#768) (5fae37b)

What's Changed

• chore(deps): bump golang.org/x/term from 0.45.0 to 0.46.0 in the dependencies group by @dependabot[bot] in #766
• chore(deps): bump the dependencies group with 2 updates by @dependabot[bot] in #767
• feat: support for dynamic conditions by @aaguiarz in #768
• release: v0.8.1 by @openfga-releaser-bot[bot] in #769

Full Changelog: v0.8.0...v0.8.1

⚠ BREAKING CHANGES

• File references that resolve outside the store file's directory are rejected by default. Pass --allow-external-files to fga store import or fga model test to opt back in.

Added

• add --name filter to store list (#745) (4e0b6f6)
• add fga mapping init command (#755) (364fae5)
• add fga mapping run command (#761) (efaa114)
• add fga mapping test command (#754) (869e1cd)
• add fga mapping validate command (#753) (3e643cc)
• mapping: add interactive explorer to mapping run (#763) (03a3e65)
• update language package for $expression support (#762) (79bce9b) , Thanks @senojj

Fixed

• contain store YAML file references to the store file's directory (#737) (cef729e)
• skip non-regular files matched by glob in model test (#742) (73d22a2)
• tuple: inline pointer literal to satisfy modernize linter (#757) (ba5d115)

What's Changed

• fix!: contain store YAML file references to the store file's directory by @SoulPancake in #737
• chore: Update Go toolchain version to 1.26.6 for vuln by @SoulPancake in #743
• chore(deps): bump the dependencies group with 2 updates by @dependabot[bot] in #744
• fix: skip non-regular files matched by glob in model test by @terry-writer in #742
• chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 in the dependencies group by @dependabot[bot] in #746
• chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 in the dependencies group by @dependabot[bot] in #747
• chore(deps): bump github.com/openfga/openfga from 1.18.3 to 1.19.0 in the dependencies group by @dependabot[bot] in #748
• chore(deps): bump anchore/sbom-action/download-syft from 0.24.0 to 0.24.2 in the dependencies group by @dependabot[bot] in #749
• chore(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0 in the dependencies group by @dependabot[bot] in #751
• chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 by @dependabot[bot] in #752
• refactor: inline pointer literal to satisfy modernize linter by @ewanharris in #757
• feat: add fga mapping validate command by @ewanharris in #753
• feat: add fga mapping test command by @ewanharris in #754
• feat: add fga mapping init command by @ewanharris in #755
• chore(deps): bump the dependencies group with 2 updates by @dependabot[bot] in #758
• feat: add fga mapping run command by @ewanharris in #761
• feat: add --name filter to store list by @ChrisJr404 in #745
• feat: update language package for $expression support by @senojj in #762
• chore: upgrade Go to 1.27.1 and golangci-lint to 2.13.2 by @curfew-marathon in #750
• feat(mapping): add interactive explorer to mapping run by @ewanharris in #763
• release: v0.8.0 by @openfga-releaser-bot[bot] in #764

New Contributors

• @terry-writer made their first contribution in #742
• @ChrisJr404 made their first contribution in #745
• @senojj made their first contribution in #762

Full Changelog: v0.7.20...v0.8.0

Fixed

• remove go-safecast dependency (#738) (379f941)

What's Changed

• chore: pin dev dockerfile go base image and distroless base image by @SoulPancake in #726
• chore(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 in the dependencies group by @dependabot[bot] in #727
• chore(deps): bump the dependencies group with 3 updates by @dependabot[bot] in #728
• chore: upgrade golangci-lint to 2.12.2 by @curfew-marathon in #729
• chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 by @dependabot[bot] in #730
• chore(deps): bump the dependencies group with 3 updates by @dependabot[bot] in #732
• chore(deps): bump github.com/google/cel-go from 0.28.1 to 0.29.0 by @dependabot[bot] in #733
• chore(deps): bump the dependencies group with 2 updates by @dependabot[bot] in #731
• ci: add release-please-develop pre-release workflow by @SoulPancake in #734
• chore(deps): bump docker/login-action from 4.5.1 to 4.6.0 in the dependencies group by @dependabot[bot] in #735
• fix: remove go-safecast dependency by @Siddhant-K-code in #738
• chore(deps): bump github.com/openfga/openfga from 1.18.1 to 1.18.3 in the dependencies group by @dependabot[bot] in #740
• release: v0.7.20 by @openfga-releaser-bot[bot] in #741

New Contributors

• @curfew-marathon made their first contribution in #729

Full Changelog: v0.7.19...v0.7.20

Fixed

• publish distroless Docker image with dockers v2 (#716) (e39700a)

Changed

• bump github.com/openfga/language/pkg/go from 0.3.0 to 0.3.1 (042151f)

What's Changed

• chore: pin reusable release workflows by @SoulPancake in #717
• chore(deps): bump the dependencies group with 2 updates by @dependabot[bot] in #718
• fix: publish distroless Docker image with dockers v2 by @Siddhant-K-code in #716
• chore(deps): bump the dependencies group with 2 updates by @dependabot[bot] in #721
• chore(deps): bump the dependencies group with 2 updates by @dependabot[bot] in #720
• chore(deps): bump github.com/openfga/language/pkg/go from 0.3.0 to 0.3.1 in the dependencies group by @dependabot[bot] in #722
• fix(docs): fix formatting inconsistency, outdated Go version, and grammar by @archy-rock3t-cloud in #663
• release: v0.7.18 by @openfga-releaser-bot[bot] in #723
• fix: set up buildx driver for dockers_v2 sbom attestation in release by @SoulPancake in #724
• release: v0.7.19 by @openfga-releaser-bot[bot] in #725

New Contributors

• @archy-rock3t-cloud made their first contribution in #663, Thanks @archy-rock3t-cloud

Full Changelog: v0.7.17...v0.7.19

Changed

• drop gocsv to stdlib encoding/csv (#704) (436b74f)

What's Changed

• fix: attach SLSA provenance to draft release via gh release upload by @SoulPancake in #713
• chore(deps): bump the dependencies group with 2 updates by @dependabot[bot] in #714
• refactor: drop gocsv to stdlib encoding/csv by @SoulPancake in #704
• release: v0.7.17 by @openfga-releaser-bot[bot] in #715

Full Changelog: v0.7.16...v0.7.17

Added

• Add a size field to fga model get and size_kb to fga model validate output, reporting the protobuf-serialized size of an authorization model in KB. (#712)

Changed

• replace go-multierror with stdlib, remove dep (#705) (2e9afa2)
• Update bundled OpenFGA to v1.18.0

What's Changed

• chore(deps): bump the dependencies group with 3 updates by @dependabot[bot] in #698
• chore(deps): bump github.com/openfga/openfga from 1.16.0 to 1.16.1 in the dependencies group by @dependabot[bot] in #700
• chore: skip github release to push gpg signed tag by @SoulPancake in #699
• chore: bump go toolchain for vulnerabilities by @SoulPancake in #701
• chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the dependencies group by @dependabot[bot] in #703
• chore(deps): bump github.com/openfga/openfga from 1.16.1 to 1.17.1 in the dependencies group by @dependabot[bot] in #702
• chore(deps): bump github.com/openfga/go-sdk from 0.8.1 to 0.8.2 in the dependencies group by @dependabot[bot] in #706
• refactor: replace go-multierror with stdlib, remove dep by @SoulPancake in #705
• chore(deps): update bundled openfga to v1.18.0 by @SoulPancake in #709
• feat: report serialized model size in fga model get and validate by @rhamzeh in #712
• release: v0.7.16 by @openfga-releaser-bot[bot] in #710

Full Changelog: v0.7.15...v0.7.16

0.7.15 (2026-05-20)

Changed

• Update bundled OpenFGA to v1.16.0

Fixed

• Bumped the openfga/go-sdk version to include a fix for a retry logic bug (see #677, fixed by openfga/go-sdk#319).