build(deps): bump github.com/openfga/openfga from 1.18.1 to 1.18.3

[dependabot]

Bumps github.com/openfga/openfga from 1.18.1 to 1.18.3.

Release notes

Sourced from github.com/openfga/openfga's releases.

v1.18.3

What's Changed

Fixed

• Fixed experimental weighted_graph_check intermittently returning false when evaluating relations that cross two or more distinct recursive TTUs which share the same tupleset relation. #3244

Full Changelog: openfga/openfga@v1.18.2...v1.18.3

v1.18.2

What's Changed

Added

• Extended experimental weighted_graph_check diagnostic logging to cover the wildcard_with_exclusion and userset_with_exclusion shapes: the log now fires when v2 Check rejects one of these shapes and Check falls back to v1, and when v2 Check is skipped entirely because the weighted graph fails to build. These logs surface authorization models that may be affected by a future v1 deprecation, and no operator action is required. #3204

Changed

• Matched experimental weighted_graph_check cache metrics with original Check cache metrics: iterator cache metrics renamed to tuples_cache_total_count, tuples_cache_hit_count, tuples_cache_discard_count, tuples_cache_size; query cache metrics added as check_cache_total_count, check_cache_hit_count, check_cache_invalid_hit_count. #3184

Fixed

• Fixed experimental weighted_graph_check incorrectly returning false for models with two or more independently-recursive relations where satisfying the outer recursive relation requires resolving through an unrelated, nested recursive relation (e.g. descendant_principal: member or descendant_principal from child_group where member transitively reaches a separately-recursive admin: direct_admin or admin from parent_group). FlattenNode now only excludes edges belonging to the specific recursive relation currently being unwound, instead of excluding every recursive edge in the graph. Thanks to @​yxshwanth for the contribution! #3195
• Tuple condition validation now checks that a condition is bound to the specific type-restriction facet (concrete user, typed wildcard, or userset) that matches the tuple's user, not just the user type and condition name. Previously a relation such as define viewer: [user, user:* with cond] would accept a tuple like document:1#viewer@user:alice carrying cond, even though cond is only defined on the user:* facet. Because this validation also runs when reading tuples during query resolution, such tuples are now consistently rejected across Check and ListObjects. See internal/validation/validation.go. #3218
• Converted the FlattenNode function of the internal/modelgraph package from a recursive algorithm to an iterative one. This more robustly handles deep relationship nesting. #3224
• Fixed experimental weighted_graph_check returning incorrect results for multi-branch recursion on the same relation; e.g., member: [user] or member from parent or member from child. #3239

Security

• Update toolchain Go version to 1.26.5 and rebuild the embedded grpc-health-probe (bumped to v0.4.53, built with Go 1.26.5) so released images no longer ship the Go standard library vulnerabilities documented in the Go 1.26.5 release notes, including CVE-2026-39822. #3219

New Contributors

• @​yxshwanth made their first contribution in openfga/openfga#3225

Full Changelog: openfga/openfga@v1.18.1...v1.18.2

Changelog

Sourced from github.com/openfga/openfga's changelog.

[1.18.3] - 2026-08-05

Fixed

• Fixed experimental weighted_graph_check intermittently returning false when evaluating relations that cross two or more distinct recursive TTUs which share the same tupleset relation. #3244

[1.18.2] - 2026-08-03

Added

• Extended experimental weighted_graph_check diagnostic logging to cover the wildcard_with_exclusion and userset_with_exclusion shapes: the log now fires when v2 Check rejects one of these shapes and Check falls back to v1, and when v2 Check is skipped entirely because the weighted graph fails to build. These logs surface authorization models that may be affected by a future v1 deprecation, and no operator action is required. #3204

Changed

• Matched experimental weighted_graph_check cache metrics with original Check cache metrics: iterator cache metrics renamed to tuples_cache_total_count, tuples_cache_hit_count, tuples_cache_discard_count, tuples_cache_size; query cache metrics added as check_cache_total_count, check_cache_hit_count, check_cache_invalid_hit_count. #3184

Fixed

• Fixed experimental weighted_graph_check incorrectly returning false for models with two or more independently-recursive relations where satisfying the outer recursive relation requires resolving through an unrelated, nested recursive relation (e.g. descendant_principal: member or descendant_principal from child_group where member transitively reaches a separately-recursive admin: direct_admin or admin from parent_group). FlattenNode now only excludes edges belonging to the specific recursive relation currently being unwound, instead of excluding every recursive edge in the graph. Thanks to @​yxshwanth for the contribution! #3195
• Tuple condition validation now checks that a condition is bound to the specific type-restriction facet (concrete user, typed wildcard, or userset) that matches the tuple's user, not just the user type and condition name. Previously a relation such as define viewer: [user, user:* with cond] would accept a tuple like document:1#viewer@user:alice carrying cond, even though cond is only defined on the user:* facet. Because this validation also runs when reading tuples during query resolution, such tuples are now consistently rejected across Check and ListObjects. See internal/validation/validation.go. #3218
• Converted the FlattenNode function of the internal/modelgraph package from a recursive algorithm to an iterative one. This more robustly handles deep relationship nesting. #3224
• Fixed experimental weighted_graph_check returning incorrect results for multi-branch recursion on the same relation; e.g., member: [user] or member from parent or member from child. #3239

Security

• Update toolchain Go version to 1.26.5 and rebuild the embedded grpc-health-probe (bumped to v0.4.53, built with Go 1.26.5) so released images no longer ship the Go standard library vulnerabilities documented in the Go 1.26.5 release notes, including CVE-2026-39822. #3219

Commits

• 81c6202 release: update changelog for release v1.18.3 (#3245)
• 015b4f6 fix: prevent false negatives when sibling recursive TTUs share a tupleset (#3...
• 560d5d3 release: update changelog for release v1.18.2 (#3242)
• 662e6b6 fix: update openfga/language to fix weighted_graph_check multi-branch recur...
• 2c19e26 refactor: convert FlattenNode from a recursive algorithm to an iterative one ...
• 168de21 fix: only skip the targeted recursive relation when flattening v2 Check graph...
• 1586caa fix: validate tuple condition against the correct type-restriction facet (#3218)
• da9354f chore(deps): bump the dependencies group across 1 directory with 10 updates (...
• 2a4ab89 chore: bump go toolchain to 1.26.5 to address CVE-2026-39822 (#3219)
• 4539162 chore(deps): bump the dependencies group across 1 directory with 17 updates (...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)