OpenFGA v0.3.1 is out with security fixes and more config options

[rhamzeh]

Hey everyone!

We just released OpenFGA v0.3.1 with an important security fix.
If you are already using OpenFGA with authorization model schema 1.1 released last week, it is important that you update to this release as soon as you can.

This release includes experimental support for an optimized version of ListObjects which you can enable through the new --experimentals flag. Known issues include:

• Incomplete support for Type-bound Public Access (* and type:*)
• No support for and and but not
  (Note: Experimentals are for testing upcoming OpenFGA features, they are not production ready and could break or change in any upcoming version).

If you are running through docker:

• If you are targeting latest, make sure to update by running docker pull openfga/openfga
• If you are targeting pinned releases, make sure to set your pinned version to: openfga/openfga:v0.3.1

Changes in this release

Added

• Datastore configuration flags to control connection pool settings
  --datastore-max-open-conns
--datastore-max-idle-conns
--datastore-conn-max-idle-time
--datastore-conn-max-lifetime
  These flags can be used to fine-tune database connections for your specific deployment of OpenFGA.

• Log level configuration flags
  --log-level (can be one of ['none', 'debug', 'info', 'warn', 'error', 'panic', 'fatal'])

• Support for Experimental Feature flags
  A new flag --experimentals has been added to enable certain experimental features in OpenFGA. For more information see Experimental Features.

Security

• Patches CVE-2022-23542 - relationship reads now respect type restrictions from prior models [fix: filter reads by type restriction in direct relationship lookups openfga#422]