Fixed
- Expiration: Non-terminal sibling relations can no longer result in incorrect Check responses for a relationship whose expiration time was in the past. (GHSA-w278-32qg-48q5)
- Caching: dispatch, cluster dispatch, relationship chunk and full relation cache entries again expire one TTL after they are written, as they did before v1.54.0. Since the move to Otter, every read pushed an entry's expiration out by another TTL, so a result that was read more often than the TTL never expired. On MySQL, where the revision only advances on writes, an expired relationship could then keep granting a permission indefinitely, even with
fully_consistent, until the next write. The namespace cache, whose entries cannot go stale, still extends its TTL on reads. (#3431) - CockroachDB: the GC window is now derived from the zone configuration that applies to SpiceDB's relationship table instead of the cluster-wide
RANGE default. SpiceDB readsSHOW ZONE CONFIGURATION FROM TABLE relation_tuple(orrelation_tuple_with_integrity), for which CockroachDB resolves table, database andRANGE defaultprecedence, and caps--datastore-gc-windowat that TTL. Previously a database configured withALTER DATABASE ... CONFIGURE ZONE USING gc.ttlseconds = 86400on a cluster with the default 4hRANGE defaultrejected revisions older than 4h as stale, and a database configured below a longerRANGE defaultkept a window wider than the data's real TTL, so reads past it failed with CockroachDB's GC threshold error instead of being rejected as stale. If the table's zone configuration cannot be read, theRANGE defaultvalue is used as before. A single-digitgc.ttlsecondsis now also parsed correctly. (#3423) - Schema validation: schemas that transitively include wildcard subjects are now consistently rejected, even when unrelated definitions reuse the same relation names. (#3421)
Full Changelog: v1.57.0...v1.57.1
Docker Images
This release is available at authzed/spicedb:v1.57.1, quay.io/authzed/spicedb:v1.57.1, ghcr.io/authzed/spicedb:v1.57.1