Skip to content

cerbos

v0.54.0 Feature

This release adds 2 notable features for engineering teams evaluating rollout.

Published 6d Secrets & Credentials
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

access-control authorization go kubernetes policy security

Affected surfaces

auth rbac crypto_tls

Summary

AI summary

Updates npm, version, and tutorial across a mixed release.

Full changelog

Cerbos 0.54.0

View the full release notes at https://docs.cerbos.dev/cerbos/latest/releases/v0.54.0.html

Changelog

  • 64d274bd87b277971428d81f0693f25454688041 Auto-configure GOMEMLIMIT from the cgroup memory limit (#3259)
  • 3870a7d3dfbf98805a47785e10409a6d8df72d9a Add CI performance regression test (#3174)
  • 6b483c62298962df5fa93a444f7dff3eac580ba2 Add cerbos.audit.v1.PolicySource.Hub.EmbeddedBundle.bundle_id field (#3155)
  • 0bacbd67fc09997cb8bda7b9e75be502c4c24045 Add cerbos compile-store command (#3251)
  • b6fb6438de22609e3bcf0aafbf014e7dcdaca006 Add dimension filters to ruletable index key queries (#3235)
  • f77ba9cfb590746d07b906116ffce054d6da137f Add new documentation homepage and cross linking (#3264)
  • ffc7e76b68f964497b240cd0c3bd2b52789c8f1d Add proxy support for Hub client (#3221)
  • 9e8e948c854e9af45e54538507c8373e78426c6d Add role policy outputs, constants and variables (#3156)
  • 44dd5dead3af6679688dcc934bcdaca5c8e25352 Add v0.54.0 release notes (#3282)
  • 3fb957680de199adf31c1cf916ce7a88af8f01b9 Allow disabling TLS verification for Hub client (#3220)
  • a39c824df3dbef853e48a7ff42fd1dbd04cea719 Build binaries at AMD64 microarchitecture level v2 (#3218)
  • db8f3fb7f5e9c0d4864afd3694068d358bffac46 Bump fast-uri from 3.1.0 to 3.1.2 in /npm/test/registry (#3162)
  • 9d46168cac169db88f60b75ef439802f1e3f34bb Bump github.com/go-git/go-billy/v6 from 6.0.0-20260424211911-732291493fb8 to 6.0.0-alpha.1 (#3178)
  • 305bfbfe50d9307507dd8543fd1e0e9fe9df50d3 Bump github.com/go-git/go-billy/v6 from 6.0.0-20260424211911-732291493fb8 to 6.0.0-alpha.1 in /hack/tools/changelog (#3177)
  • fc7f84f85654cb92ac98b2254f2c02e6e5dd957e Bump golang.org/x/crypto from 0.51.0 to 0.52.0 in /hack/loadtest (#3272)
  • 322a56c14eb1a5c64c0c002113fc0b916a8e5163 Bump golang.org/x/crypto from 0.51.0 to 0.52.0 in /hack/tools/changelog (#3271)
  • 3ae505bb28316aa338337ca8e46d62d4c2d2ed9f De-duplicate and re-allocate rule table objects (#3209)
  • bdaf976f3b148f262916a39602408ecbb7f30e31 Disable telemetry in CI performance regression test (#3277)
  • 69be648e9b46b8a1e50e3d8920cc999ac31de823 Display output errors in passing tests and JUnit report (#3202)
  • 54046f0ef332c93047b44c7630789a206fff05c9 Downgrade to go1.25 (#3237)
  • 588fc4b0f5a06ad1fc919c976dcba8e67f630fa0 Enable incremental rule table marshalling (#3270)
  • 18919615d7e82df533746d6665c8b6683af74da1 Export binary path from npm packages (#3180)
  • 96880d960100f72feedeed2efee50d88f7ef2f80 Expose parser (#3276)
  • 35f56caf8a3b57ab3e236fcb81db2b26595342de Extend the load-test framework to measure PDP memory demand and GC behaviour under load (#3258)
  • 2acd6f274cd9da7847ff73708d36fa0dc4876955 Fix E2E SDK test (#3239)
  • 2a7007cd2803912b818fb87689e2d45ac2fa2305 Fix Siteline edge function (#3186)
  • 79d90ebd73e2b73d1020356ca561c3fb33422cad Fix npm package templates (#3181)
  • f09accf33417601075ad58fa0d10f2f6c1a6c25f Fix panic in E2E blob test (#3242)
  • 1bda68492eb4d99cdedfa2384a62dbca090df248 Fix parser bugs (#3223)
  • 33522621779b22eaf3dea11c8855cd32c1b1498d Fix typo in performance regression check workflow (#3179)
  • f2c6387afda9fef38712d9082798b940136beb31 Handle permission denied error from Hub API (#3248)
  • 9ea7f615e9dbf2f944480608a09655543bdef890 Ignore helm/* tags when building snapshots (#3152)
  • 218362c8d43a1ec6e469aece428f809f16efb956 Import GPG key for Helm Secrets before installation (#3219)
  • 5ac3bd8fca840954bd4edfb7f97c7395bd32fc04 Iterable stores (#3253)
  • ae6972a6df0cf6262ee557a428856c15d68d64ac Lazy load sparse bitmaps (#3200)
  • 16888ec212c7fccffbd127c14265411bf36c26a1 Lock file maintenance (npm) (#3168)
  • 6b499936d212b21e2e8e25ed82e08fe03afc58f2 Lock file maintenance (npm) (#3195)
  • 72a094b6be500b534f21da55d6e4763bfe1958c4 Lock file maintenance (npm) (#3226)
  • bed9c7d723b6cb280d17d803a90a22fb3439b65f Log CEL runtime errors and record them in audit entries (#3260)
  • cd8a94cdd9a118156d6fde839ac9bc3de42a691e More compact fqnBindings dimension (#3154)
  • 8465b2ece823a4e0796cde391621e8cfa8ded731 Notify Slack on workflow cancellations as well (#3157)
  • e3299f38e28a51f39f59669295c46378d8b4d2b2 Omit rule table marshalling from EPDP build (#3278)
  • 21443ae38d7573ad2662f092e27da55cd037ba96 Pace GC during rule table builds (#3224)
  • 704e54b1cbe20de3decdf8c0254baec1ec987539 Perform shallow merges when resolving YAML merge key (<<) (#3234)
  • 18f118cae1391266df275b8e29f766c11b36d458 Pick up newly created policy subdirectories and their contents in dirwatch (#3247)
  • 1f50c3c7e91a28b87941c42d3fe2ec9a7c840d6d Prevent Renovate from updating the Helm chart values file (#3161)
  • 037b22a9a42d53d38db30a12a80bcf89dd3e97e9 Reduce memory usage when compiling rule table bundles (#3263)
  • 27b19cda7d6af1c957e426de356fc742bcdae17f Remove Hub client bundle type config (#3249)
  • 1f4ac98d42e698413750662672c661f271c92244 Remove bundle v1 (#3275)
  • 858dc364b1839d2f25779ce37e5ad46b1925d1a9 Retain CheckedExpr(s) in bundles (#3265)
  • 40fa6dde324510646c7cb7ff94297a03803835a5 Return an error when empty expressions are provided in outputs (#3194)
  • 2944c3504af02e7a751e0a645e48b8fbdeee82a2 Shrink rule table memory with interned bindings and structured eval keys (#3228)
  • be4bdf4a4289f27baf94db39904f8e8441f896b6 Sort validation errors by position (#3252)
  • 8eec00c5d97db31906795d22105f49ef0d709425 Sort validation errors encountered when parsing files (#3250)
  • 19e1d6b2b9745b0787fc6ad3961bafbd8da5c254 Stop publishing the Helm chart to OCI registry (#3145)
  • 518c3e6dd340336614f9adbb9dab135ed583baab Streaming source stores (#3245)
  • 9e7879aecce5ca2f470b972af0b0cbc026753dda Surface JWKS and JWT errors (#3225)
  • bcb36fe18ec9fd9b5be3ec7ad821019c87d7fee5 Surface errors evaluating outputs (#3192)
  • b52d4ac4287f214097aa527ebf066e3a3dd16162 Test against pnpm v11 (#3153)
  • 265328e868aa6d938eba6ded7614cb0dedbef1df Update E2E secrets plugin install command for Helm v4 (#3214)
  • 84a8cc5c50b7c1bcff2498eb5034107915e477c3 Update GitHub Actions deps (#3183)
  • 332cf34d2fbc8fff60f901e58ddbeb45a5b42c50 Update GitHub Actions deps (#3204)
  • 9f7b8bba689631a47cbf83c90526e69e29309344 Update GitHub Actions deps (#3213)
  • 1bd3a2916be9a22b46da3c2ee9c85fb519145cc7 Update Go deps (#3147)
  • c55c53ce779909a5c56d643bc59ec6cb074e8cc7 Update Go deps (#3163)
  • 8b3083cec0985d3eb6511ccd900f850adc165810 Update Go deps (#3173)
  • 5480bb76a6e0e82546bf47a3eb3796448cce0b1b Update Go deps (#3184)
  • 94022b445fb7a7fab9a43160601bf55acf62962e Update Go deps (#3197)
  • 5b78d9073354223749cae9d6c2291a853c41716a Update Go deps (#3205)
  • 51e2f3715e562e1a6098f5502ef195b9a2cab4e0 Update Go deps (#3215)
  • e063c32b09ae32970b8d596c8c0f079a9e11cf0e Update Go deps (#3230)
  • dec07ce7b7d5d6aef5c96a321372ae9fe690aa4c Update Go deps (#3255)
  • cc1b248daf14bfca1913fed901d6f60816aed791 Update Go deps (#3262)
  • 24700b54e38f303f36d0dc495788de99da92ed21 Update Go deps (#3274)
  • f4e943f29fe581cf581ad548c27134d4c5137a35 Update Go deps (#3279)
  • 6f1c37112357010fd9f5bb257c854fef3aaebc56 Update Go deps (#3281)
  • 83ba733a037563444cb2f4cddd6ef730f6d3e31e Update Go toolchain version to Go 1.26.4 (#3211)
  • e7bdca32adec0b80ac598235651ec2bb0e8b823d Update Go tools (#3144)
  • 76dd31c62484195a4f753b3aac3c146c739c4dac Update Helm release seaweedfs to v4.22.0 (#3148)
  • 2ae4afc2a4bda97a8468a82f5c4ccd2d7193ac5e Update Helm release seaweedfs to v4.23.0 (#3166)
  • 84a1911122ca3fc10a1de3f065b155ab16774f31 Update Helm release seaweedfs to v4.26.0 (#3198)
  • 87c229ddb3e1f201f758182f56d378be15c57880 Update Helm release seaweedfs to v4.29.0 (#3206)
  • 3aa45deee3f295dad6f3168e6124022bcda2c6b9 Update Helm release seaweedfs to v4.31.0 (#3216)
  • 872bb540c63c0c087b8a5ca4c0a6f79391f8f079 Update Helm release seaweedfs to v4.32.0 (#3231)
  • a360f5bacbb69460ae24dc6497c063e2db76f2d7 Update Node.js deps (#3149)
  • 2544f141eddf8a9df97025ea4055cde1512d6f9a Update Node.js deps (#3164)
  • 166d8ea134508eaf25b6802471ca9a696237f5b8 Update Node.js deps (#3185)
  • 7188c999efa307c3ac2ac979051e28069c492015 Update Node.js deps (#3199)
  • 003df7ef209b68066a5fd4b297ef9fb18860dfa8 Update Node.js deps (#3207)
  • 51c9722ecfd637123b258620dd0ff2ccec6ca797 Update Node.js deps (#3217)
  • 745d1095917d08fe97e89022f711c252811e7b1d Update aws-actions/amazon-ecr-login action to v2.1.6 (#3241)
  • 5629165ad4cd0ea8f06b8a80e089e187e058b2ca Update aws-actions/configure-aws-credentials action to v6.1.1 (#3165)
  • b87691c04015bb76abfff48eb6bceec22183c3b2 Update aws-actions/setup-sam action to v3 (#3167)
  • 94aa8ec098387380c7761b7315c9375e070ff3c6 Update cerbos/actions to 148106e (#3169)
  • a7f4f2ed3ba7a3fbd4434357848f5c335b8bfb00 Update cerbos/actions to 3a471f8 (#3182)
  • 3306f4f18cd3b09a116d7f9b03970b5a4fddf8c6 Update cerbos/actions to 3e51316 (#3240)
  • f7f4efb14b068b4003acc91e87958afb32642ebb Update cerbos/actions to 40e604d (#3229)
  • 2d0fddea91b2239fae648ce19a6e72b91c36b484 Update cerbos/actions to 52f1500 (#3273)
  • faad5a059dba588ddac763e443df68d4fd29d216 Update cerbos/actions to 6e17328 (#3146)
  • 9ab1f384de803eab88b31b4067227e9c526cf4e1 Update cerbos/actions to 77b46c5 (#3280)
  • 080e00e2b4de4fa68f9e250ba5c45663c3d1cc73 Update cerbos/actions to 81c84b6 (#3203)
  • 2727a6c3721b93190e1685c27889638143ff97a6 Update cerbos/actions to aa71e4b (#3212)
  • 98924b526d15fe6b074a6fa72406f7caa2a9e7df Update cerbos/actions to b65bfbd (#3160)
  • 3ed5cb980e27a3099c04d1d33b800d31bd9b5ded Update cerbos/actions to b9f76b0 (#3196)
  • a9322b6665972b3a6be41ceb532a96ccc764ee3c Update cerbos/actions to d2c46d8 (#3261)
  • ed0f74c255dbe7553fc7f478c99123f51c8db571 Update cerbos/actions to d5b4989 (#3254)
  • 6bc6e7391d6616afc4c48054dcb3f4861ec9a84a Update dawidd6/action-download-artifact action to v21 (#3150)
  • 45e4e1a0d58275bac6abee6299238823c0e54be5 Update golang.org/x/crypto to v0.52.0 (#3193)
  • a7aa5ad4796f07c466aea12a4a95239dfd2aebac Update module github.com/go-git/go-git/v6 to v6.0.0-alpha.3 [SECURITY] (#3172)
  • 1fcf1426b0a67c1ac94f613b7ef80b6683994c05 Update module github.com/go-git/go-git/v6 to v6.0.0-alpha.4 [SECURITY] (#3188)
  • 54356e05789d1c4015b65314129e5358d95086b8 Update pnpm to v11.5.2 (#3227)
  • 9537aa61a64841921c45ad6e31338d0130b81de8 Upgrade golang.org/x/net to v0.55.0 (#3201)
  • 7b1bba163375ee6c6559932e2e309026f307454c Use parser everywhere (#3232)
  • 1514151a20ef341612afbcf7b23f912a801dca74 add filtered query APIs to ruletable index (#3176)
  • 6b40a5f9fa6305a7014a8ea274afefaaa7771679 chore(release): Prepare release 0.54.0
  • 78e2e5a7c94f44df8b8fcc4b077fd5c2447b8d22 chore(version): Bump version to 0.54.0
  • cf85ce6cd99e0582b6f3a3013044d0b3a691aa38 docs(tutorial): fix typo in sentence (#3208)
  • 2b48279646c18cd3e601b88d1406b809aa1f5f25 scope role-policy deny synthesis to per-resource actions (#3158)
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track cerbos

Get notified when new releases ship.

Sign up free

About cerbos

Cerbos is the open core, language-agnostic, scalable authorization solution that makes user permissions and authorization simple to implement and manage by writing context-aware access control policies for your application resources.

All releases →

Related context

Beta — feedback welcome: [email protected]