Skip to content

chore(deps): bump github.com/authzed/spicedb from 1.33.1 to 1.52.0#1641

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/authzed/spicedb-1.52.0
Open

chore(deps): bump github.com/authzed/spicedb from 1.33.1 to 1.52.0#1641
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/authzed/spicedb-1.52.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 21, 2026

Bumps github.com/authzed/spicedb from 1.33.1 to 1.52.0.

Release notes

Sourced from github.com/authzed/spicedb's releases.

v1.52.0

What's changed

Added

  • Added support for YAML-based validation files in DevContext (authzed/spicedb#3024)
  • Added support for YAML-based validation files in the Language Server (authzed/spicedb#3024)
  • Enable statistics-based optimizations when --experimental-query-plan is enabled. (authzed/spicedb#3052)
  • Added missing implementations of cursoring for LookupResource, LookupSubjects and ReadRelationships calls in FDW (authzed/spicedb#3016)
  • Add new gRPC Dispatch API and messages for dispatching query plans (authzed/spicedb#3072)
  • Support new withDebug flag in LookupResources calls to identify cycles (authzed/spicedb#3070)

Changed

Fixed

  • Improved error message when expiration is written before caveat in a relationship (authzed/spicedb#3071)
  • On a Postgres setup with read replicas, some requests may silently swallow errors of sort "revision not found in replica" (authzed/spicedb#2979)
  • Use cgroup-aware memory detection for cache and watch buffer sizing in containerized environments (authzed/spicedb#3000)
  • Upgraded the spanner client, which changed the internal implementation to not use a session pool. This means that the --datastore-spanner-max-sessions and --datastore-spanner-min-sessions flags are now deprecated and no-op. We also strongly recommend using Application Default Credentials in favor of a credentials file. (authzed/spicedb#3038)
  • Query Planner: error "ERROR: index \"pk_relation_tuple\" cannot be used for this query (SQLSTATE 42809)" returned when using wildcards (authzed/spicedb#3039)
  • Providing one of (--grpc-tls-cert-path, --grpc-tls-key-path) but not the other is now considered an error state, as both are necessary if you want to use TLS.
  • In a caveat context that uses nested lists of lists, the hashes generated for cache keys could collide because of an issue with the serialization logic. The serialization now uses deterministic protobuf serialization which avoids this issue (authzed/spicedb#3065)

v1.51.1

Fixed

Full Changelog: authzed/spicedb@v1.51.0...v1.51.1

Docker Images

This release is available at authzed/spicedb:v1.51.1, quay.io/authzed/spicedb:v1.51.1, ghcr.io/authzed/spicedb:v1.51.1

v1.51.0

⚠️ Warning: Due to CVE-2026-40091, please use v1.51.1.

Changed

Fixed

  • Fix increase in memory usage brought in v1.50.0 due to replacing protoc-gen-validate with protovalidate (authzed/spicedb#2984)
  • Fix duplicate diagnostics in LSP server when VS Code pulls diagnostics (authzed/spicedb#2977)
  • In DevContext's schema position mapper, only the first occurrence of a caveat parameter could be found (authzed/spicedb#2972)

What's Changed

... (truncated)

Changelog

Sourced from github.com/authzed/spicedb's changelog.

[1.52.0] - 2026-04-30

Added

  • Added support for YAML-based validation files in DevContext (authzed/spicedb#3024)
  • Added support for YAML-based validation files in the Language Server (authzed/spicedb#3024)
  • Enable statistics-based optimizations when --experimental-query-plan is enabled. (authzed/spicedb#3052)
  • Added missing implementations of cursoring for LookupResource, LookupSubjects and ReadRelationships calls in FDW (authzed/spicedb#3016)
  • Add new gRPC Dispatch API and messages for dispatching query plans (authzed/spicedb#3072)
  • Support new withDebug flag in LookupResources calls to identify cycles (authzed/spicedb#3070)

Changed

Fixed

  • Improved error message when expiration is written before caveat in a relationship (authzed/spicedb#3071)
  • On a Postgres setup with read replicas, some requests may silently swallow errors of sort "revision not found in replica" (authzed/spicedb#2979)
  • Use cgroup-aware memory detection for cache and watch buffer sizing in containerized environments (authzed/spicedb#3000)
  • Upgraded the spanner client, which changed the internal implementation to not use a session pool. This means that the --datastore-spanner-max-sessions and --datastore-spanner-min-sessions flags are now deprecated and no-op. We also strongly recommend using Application Default Credentials in favor of a credentials file. (authzed/spicedb#3038)
  • Query Planner: error "ERROR: index \"pk_relation_tuple\" cannot be used for this query (SQLSTATE 42809)" returned when using wildcards (authzed/spicedb#3039)
  • Providing one of (--grpc-tls-cert-path, --grpc-tls-key-path) but not the other is now considered an error state, as both are necessary if you want to use TLS.
  • In a caveat context that uses nested lists of lists, the hashes generated for cache keys could collide because of an issue with the serialization logic. The serialization now uses deterministic protobuf serialization which avoids this issue (authzed/spicedb#3065)

[1.51.1] - 2026-04-14

Fixed

[1.51.0] - 2026-03-24 [YANKED]

⚠️ Warning: Due to CVE-2026-40091, please use v1.51.1.

Changed

Fixed

  • Fix duplicate diagnostics in LSP server when VS Code pulls diagnostics (authzed/spicedb#2977)
  • In DevContext's schema position mapper, only the first occurrence of a caveat parameter could be found (authzed/spicedb#2972)
  • Fix increase in memory usage brought in v1.50.0 due to replacing protoc-gen-validate with protovalidate (authzed/spicedb#2984)

[1.50.0] - 2026-03-19 [YANKED]

⚠️ Warning: Due to an increase in memory usage and CVE-2026-40091, please use v1.51.1.

Added

  • New pkg/query/queryopt package for building optimizations into the query plan

Changed

  • Updated CI so that Postgres tests run against v18 which is GA and not against v13 which is EOL (authzed/spicedb#2926)
  • Added tracing to request validation (authzed/spicedb#2950)
  • Query Planner optimization: in Check requests, prune branches that cannot lead to the subject type specified (authzed/spicedb#2968)
  • Added lr and ls to --experimental-query-plan for those endpoints, as well as in-memory statistics for optimizing the plans (authzed/spicedb#2929)

... (truncated)

Commits
  • 76fc153 feat: Add debug output to MaxRecursionDepthError when debug header is set (#3...
  • e677c6a feat: introduce protobuf and gRPC for dispatching query plans (#3072)
  • 259732a chore: add cyclic tests to query planner (#3075)
  • 75b2b72 fix: improve error when expiration is before caveat (#3071)
  • 5804d74 chore: fix flaking middleware tests (#3066)
  • cd1e2b9 fix: avoid hash collision in caveat context (#3065)
  • 312216f chore: refactor complete method to pull out validation and more strictly vali...
  • a813585 chore: update changelog
  • 86c18e9 perf: have the changes functions return an iter
  • b371613 chore: fix docker-composes (Envoy not starting) (#3056)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump github.com/authzed/spicedb from 1.33.1 to 1.52.0
8305081 
Bumps [github.com/authzed/spicedb](https://github.com/authzed/spicedb) from 1.33.1 to 1.52.0.
- [Release notes](https://github.com/authzed/spicedb/releases)
- [Changelog](https://github.com/authzed/spicedb/blob/main/CHANGELOG.md)
- [Commits](authzed/spicedb@v1.33.1...v1.52.0)

---
updated-dependencies:
- dependency-name: github.com/authzed/spicedb
  dependency-version: 1.52.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels May 21, 2026
@vercel
Copy link
Copy Markdown

vercel Bot commented May 21, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
frontier Ready Ready Preview, Comment May 21, 2026 8:32pm

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants