Skip to content

Cyoda-go

v0.8.2 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 18d Relational Databases
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Broad release touches openapi, ci, feat, and PATCH.

Full changelog

Contract-true OpenAPI, richer entity queries, and transaction-joined compute callbacks.

This release sharpens the API/OpenAPI contract and deepens the entity data layer. Highlights:

  • Search result sorting — order results by any scalar data or meta field, canonical across every backend.
  • Partial entity updates (PATCH) — RFC 7386 merge-patch; stop destroying fields you didn't send.
  • Composite unique keys — declare multi-field uniqueness on an entity model, enforced on create/update.
  • Faster PostgreSQL search — predicates push down into SQL instead of loading and filtering in memory.
  • Transaction-joined compute callbacks — processor/criteria callbacks join the originating workflow transaction.
  • Renderer annotations on processors & criteria — display metadata on every workflow element (schema 1.2).
  • Contract-true OpenAPI — error codes, response envelopes, and body shapes reconciled with the server.

⚠️ This release tightens several contracts (edge-message meta-datametaData, changeType spelling, search limit enforcement, and more). Review the breaking-changes section before upgrading.

📖 Read the full release notes — and explore the docs — at docs.cyoda.net. The documentation portal has guides, configuration schemas, API references, and architecture deep-dives to help you get the most out of Cyoda. · Changelog: https://github.com/Cyoda/cyoda-go/blob/main/CHANGELOG.md

Ships against cyoda-go-spi v0.8.2. Helm chart: cyoda-0.8.2.


What's Changed

  • chore(helm): bump chart appVersion to v0.8.1 by @github-actions[bot] in https://github.com/Cyoda/cyoda-go/pull/338
  • fix(ci): use client-id for Homebrew tap App token (app-id deprecated) by @pschleger in https://github.com/Cyoda/cyoda-go/pull/339
  • feat: entity partial-update (PATCH / RFC 7386 merge patch) by @pschleger in https://github.com/Cyoda/cyoda-go/pull/344
  • chore: self-injecting skill gates (test-coverage + independent design review) by @pschleger in https://github.com/Cyoda/cyoda-go/pull/345
  • ci: auto-close referenced issues on merge into a release branch by @pschleger in https://github.com/Cyoda/cyoda-go/pull/346
  • docs(versioning): adopt 0.x patch-for-features convention; decouple SPI version from binary by @pschleger in https://github.com/Cyoda/cyoda-go/pull/348
  • fix: canonicalize point-in-time read semantics (inclusive <=, no rounding) by @pschleger in https://github.com/Cyoda/cyoda-go/pull/350
  • feat(postgres): search predicate pushdown (spi.Searcher) by @pschleger in https://github.com/Cyoda/cyoda-go/pull/351
  • feat: composite unique keys (scalar fields) — engine-internal UNIQUE constraint by @pschleger in https://github.com/Cyoda/cyoda-go/pull/355
  • fix(sqlite): same-tx delete+reclaim of a composite unique-key value by @pschleger in https://github.com/Cyoda/cyoda-go/pull/356
  • feat(search): client-controllable result sorting by field paths (#347) by @pschleger in https://github.com/Cyoda/cyoda-go/pull/366
  • feat(287): compute-node callbacks join the originating transaction by @pschleger in https://github.com/Cyoda/cyoda-go/pull/368
  • feat(openapi): contract status markers + live-or-marked conformance gate (Spec 1, ADR 0003) by @pschleger in https://github.com/Cyoda/cyoda-go/pull/370
  • feat(openapi): entity-group contract reconciliation — meta, conditional delete, PIT, error-code matrix (E1–E9 minus E6) by @pschleger in https://github.com/Cyoda/cyoda-go/pull/371
  • fix(test): make multinode cluster launch resilient to the port-collision flake by @pschleger in https://github.com/Cyoda/cyoda-go/pull/375
  • feat(openapi): stats/audit/search reconciliation — unknown-model 404 unification, fictional-surface removal, limit-cap coherence by @pschleger in https://github.com/Cyoda/cyoda-go/pull/373
  • ci: gofmt the tree + add a gofmt gate by @pschleger in https://github.com/Cyoda/cyoda-go/pull/374
  • feat(openapi): entity-model & workflow reconciliation + #369 documentation catch-up by @pschleger in https://github.com/Cyoda/cyoda-go/pull/376
  • feat(openapi): auth/OIDC reconciliation — ProblemDetail envelope, 409 duplicate, config-conditional 501 (#369 group 3) by @pschleger in https://github.com/Cyoda/cyoda-go/pull/378
  • feat(openapi): message reconciliation — flat metaData, ProblemDetail binding-400, body-shape fixes (#369) by @pschleger in https://github.com/Cyoda/cyoda-go/pull/380
  • feat(openapi): dead-surface disposition — SQL-Schema drift fixes, CQL cleanup, marker-backing invariant (#369) by @pschleger in https://github.com/Cyoda/cyoda-go/pull/383
  • chore(security): bump goldmark v1.7.13 → v1.7.17 (govulncheck GO-2026-5320) by @pschleger in https://github.com/Cyoda/cyoda-go/pull/388
  • fix(messaging)!: rename edge-message request field meta-data → metaData; add help topic by @pschleger in https://github.com/Cyoda/cyoda-go/pull/387
  • chore(security): bump Go toolchain 1.26.4 → 1.26.5 (govulncheck GO-2026-5856) by @pschleger in https://github.com/Cyoda/cyoda-go/pull/389
  • feat(workflow): renderer annotations on processors & criteria by @pschleger in https://github.com/Cyoda/cyoda-go/pull/385
  • chore(ci): bump azure/setup-helm v5.0.0 → v5.0.1 by @pschleger in https://github.com/Cyoda/cyoda-go/pull/390
  • release: v0.8.2 milestone bundle by @pschleger in https://github.com/Cyoda/cyoda-go/pull/391

Full Changelog: https://github.com/Cyoda/cyoda-go/compare/v0.8.1...v0.8.2

Breaking Changes

  • Rename edge‑message request field `meta-data` to `metaData`
  • Enforce stricter contract validation (error codes, response envelopes, search limit enforcement)
  • Deprecate `app-id` in Homebrew tap; use `client-id`

Security Fixes

  • dep: goldmark v1.7.13 → v1.7.17 (GO-2026-5320)
  • Go toolchain bump from 1.26.4 to 1.26.5 (GO-2026-5856)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Cyoda-go

Get notified when new releases ship.

Sign up free

About Cyoda-go

All releases →

Related context

Beta — feedback welcome: [email protected]