This release includes 1 security fix for security teams reviewing exposed deployments.
Published 9d
Developer Productivity
✓ No known CVEs patched
This release patches 1 known CVE
Topics
cloudnative
ci-cd
devops
devtools
feature-flags
feature-toggles
+9 more
gitops
go
grpc
grpc-gateway
observability
opentelemetry
react
redux
typescript
Affected surfaces
deps
ReleasePort's take
Moderate signal
editorial:auto
9d
The release patches container and Docker dependency CVEs.
Why it matters: Patch immediately to mitigate high‑severity (90) CVE fixes affecting dependencies; unpatched versions expose critical vulnerabilities.
Summary
AI summaryBroad release touches Other, deps, deps-dev, and @erka.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Patches container and Docker dependency CVEs. Patches container and Docker dependency CVEs. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Feature | Medium |
Adds OIDC Single Logout (SLO) support. Adds OIDC Single Logout (SLO) support. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Feature | Medium |
Allows custom authorize parameters in OIDC provider config. Allows custom authorize parameters in OIDC provider config. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Feature | Medium |
Allows copying flags across environments. Allows copying flags across environments. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Feature | Medium |
Allows user to customize PR title. Allows user to customize PR title. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Feature | Medium |
Shows flags referencing segment. Shows flags referencing segment. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Feature | Medium |
Serializes isoneof constraint values as YAML lists. Serializes isoneof constraint values as YAML lists. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Performance | Medium |
Makes flag evaluation faster. Makes flag evaluation faster. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Bugfix | Medium |
Retries non‑fast‑forward update errors in git integration. Retries non‑fast‑forward update errors in git integration. Source: llm_adapter@2026-07-18 Confidence: high |
— |
| Bugfix | Medium |
Adds namespace ETag support across multiple files in storage. Adds namespace ETag support across multiple files in storage. Source: llm_adapter@2026-07-18 Confidence: high |
— |
Full changelog
Changelog
Features
- 5892c8f3f318626117840bfa4fcd5aaad449975e: feat(ext): serialize isoneof constraint values as YAML lists (#6072) (@jgaul3)
- 028f10fa7acb190242a549501d1d330ae99451b4: feat(ui): allow copying flags across environments (#5772) (@AnouarMohamed)
- e4d10134de8e6e4ead7cb9fa9c530cbdda83b228: feat(ui): allow user to customize PR title (#6123) (@jgaul3)
- a60df6720ebeb040e5d0d8ceeaeeeb4c2c4ebfa6: feat(ui): move revision tracking from per-entity to per-environment transport layer (#6108) (@erka)
- 8c1d341d0c89208ae6a6509073c1f5ecec4e671d: feat(ui): show flags referencing segment (#6145) (@ahfoysal)
Bug Fixes
- 2ba78353193a3ff90cdad92d63273160d3081b5e: fix(build): order release preparation tasks (#6219) (@markphelps)
- a01f91beedef2b2b7b56c7cfe6e7fbda4e82668f: fix(evaluation): gate metrics recording behind WithMetrics option (#6042) (@erka)
- 46b046307e389ff112ae04ec4920b4383a8247de: fix(git): retry non-fast-forward update errors (#6207) (@jgaul3)
- cc6653614a4d7d8207c4954eabdc2635c3c25c92: fix(redis): route go-redis internal logs through zap (#6132) (@erka)
- af830342b536e31d300379c18003d92b4b4b0435: fix(server): downgrade 'authentication required' gRPC log to WARN (#6198) (@mvanhorn)
- cbcbb8e2dd5da134467cfdd4b2c6b670d974d1a1: fix(storage): add namespace ETag support across multiple files (#6041) (@erka)
- 1fabb3a67c0df5865d7beb7ff3084ec276a3d661: fix(ui): lazy init useState in MetadataForm and CopyToNamespacePanel (#6171) (@erka)
- 0f8b428fc5d348442fcd15948006e6aa36346d57: fix(ui): use per-query revision instead of global localStorage revision (#6106) (@jgaul3)
- 0a0110c7562f2eb89d6daf250a50045461991529: fix: patch container and docker dependency CVEs (#6163) (@markphelps)
Other
- 0cf302aeae9196a9398842904e096fbee5ec8b09: Update funding information in FUNDING.yml (@markphelps)
- ebfb4bff46471e026a0ad047c2e04191f00282e4: chore(deps): bump @codemirror/lint from 6.9.6 to 6.9.7 in /ui (#6026) (@dependabot[bot])
- f712d53c3574df4e498fe23c655a0a2fba58468d: chore(deps): bump @codemirror/search from 6.7.0 to 6.7.1 in /ui (#6067) (@dependabot[bot])
- e0f4a8f1de22c829130903dab01677880ba382e3: chore(deps): bump @codemirror/state from 6.6.0 to 6.7.0 in /ui (#6098) (@dependabot[bot])
- c6606056d0184730c7050d02e98275b7f079a157: chore(deps): bump @codemirror/view from 6.43.0 to 6.43.1 in /ui (#6069) (@dependabot[bot])
- 6d5e6eac9f4f7be2bdbab258ce1d5c5f305159fe: chore(deps): bump @codemirror/view from 6.43.1 to 6.43.5 in /ui (#6140) (@dependabot[bot])
- 591620f8a93040dcde5507ce7bc83ad30d2532f8: chore(deps): bump @codemirror/view from 6.43.5 to 6.43.6 in /ui (#6175) (@dependabot[bot])
- d2f43458159fdb0e94c72ca51b0b920748d6138f: chore(deps): bump @radix-ui/react-avatar from 1.1.12 to 1.2.1 in /ui (#6100) (@dependabot[bot])
- ce619aa19d167d75d8c5d900138dacc1037ed29a: chore(deps): bump @radix-ui/react-avatar from 1.2.1 to 1.2.2 in /ui (#6177) (@dependabot[bot])
- 14dc993beaac2fd090cccede3d82c8be4cb0b8d1: chore(deps): bump @radix-ui/react-dialog from 1.1.15 to 1.1.16 in /ui (#6028) (@dependabot[bot])
- fa7846fa285b109fc5a891d40ab97130fc9abfbb: chore(deps): bump @radix-ui/react-dialog from 1.1.16 to 1.1.17 in /ui (#6062) (@dependabot[bot])
- e42d9676c5087cce7e266611723d37e3b855757a: chore(deps): bump @radix-ui/react-dialog from 1.1.18 to 1.1.19 in /ui (#6176) (@dependabot[bot])
- 3c7ae9fc9d4b8da5740ca37f4aa96483a126fc12: chore(deps): bump @radix-ui/react-dropdown-menu in /ui (#6027) (@dependabot[bot])
- 88139bf296fb5250133cac264179925623c1a9ec: chore(deps): bump @radix-ui/react-slot from 1.2.4 to 1.2.5 in /ui (#6029) (@dependabot[bot])
- 5f849f75fe53077f6e5dc04516b0e3675af33f08: chore(deps): bump @radix-ui/react-switch from 1.3.0 to 1.3.1 in /ui (#6064) (@dependabot[bot])
- 8f9a2363716e59bd0f77ff03bc43b5ddf3c1afc8: chore(deps): bump @uiw/react-codemirror from 4.25.10 to 4.25.11 in /ui (#6178) (@dependabot[bot])
- 784928a4bea9ea8419aa8538848e1b03f621a9f4: chore(deps): bump actions/checkout from 6 to 7 (#6061) (@dependabot[bot])
- 53a452e9271e146bb19dc9030f5d97d4dbb2f471: chore(deps): bump alpine from 3.23.4 to 3.24.0 in /build (#6024) (@dependabot[bot])
- c96e8b84b1a58d7e81aa734ac6cdd9db46601383: chore(deps): bump alpine from 3.24.0 to 3.24.1 in /build (#6060) (@dependabot[bot])
- 29d77816010874dbf791345c656e6345df43c16b: chore(deps): bump code.gitea.io/sdk/gitea from 0.24.1 to 0.25.1 (#6103) (@dependabot[bot])
- d1724cf5ceab9344ab138a545059761dbb954d35: chore(deps): bump cuelang.org/go from 0.16.1 to 0.17.0 (#6184) (@dependabot[bot])
- 3d9076e39f7630ae16a349d44503765a13708068: chore(deps): bump esbuild, @vitejs/plugin-react and vite in /ui (#6020) (@dependabot[bot])
- 005d5c05f4a4ddde7b1a5cb7a0c0fa3e8324fc54: chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity (#6105) (@dependabot[bot])
- 35be099c24718f03b61ea2876daa21d235113417: chore(deps): bump github.com/ClickHouse/clickhouse-go/v2 (#6181) (@dependabot[bot])
- 3cfe9d3c6a1a4e56de02da92e51ed379abd7e7cf: chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.12 to 1.42.0 (#6030) (@dependabot[bot])
- 79b12abb93e76298b059b3aae19199b91b0b3187: chore(deps): bump github.com/aws/aws-sdk-go-v2/config (#6031) (@dependabot[bot])
- 2de8696813fa0b35f43b4885380715265f4f2f34: chore(deps): bump github.com/aws/aws-sdk-go-v2/config (#6141) (@dependabot[bot])
- a006e0412234a4bee1aa343129566ac47a2f63c6: chore(deps): bump github.com/aws/aws-sdk-go-v2/config (#6180) (@dependabot[bot])
- f79e2a912229ef6aa6dbe336ecb640b0dc880ef6: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (#6032) (@dependabot[bot])
- ed5a7d03ebc8b1b490b4a3ea335942bdfe23d19d: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (#6070) (@dependabot[bot])
- dc908b8f184a7131f7692403d835159344ad7aab: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (#6193) (@dependabot[bot])
- 11a8de628d4daf994a6ed6deddf57616b22470b9: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/secretsmanager (#6102) (@dependabot[bot])
- 6fca3e3d3f53dabe272f3b1021f38cf8c066541c: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/secretsmanager from 1.42.4 to 1.43.0 (#6196) (@dependabot[bot])
- 53d6aabea29bb42d7a7dbc5793c6231e6f4c5ecb: chore(deps): bump github.com/coreos/go-oidc/v3 from 3.18.0 to 3.19.0 (#6135) (@dependabot[bot])
- 4e4adad3d9e60ce6a9303e329330081faff422d2: chore(deps): bump github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1 (#6183) (@dependabot[bot])
- a5deaf37a2474e2fba00e89f623052644ee87032: chore(deps): bump github.com/go-openapi/jsonpointer (#6195) (@dependabot[bot])
- 9ce5501fdc04fd9d63fb9718769fb7b76e356836: chore(deps): bump github.com/jferrl/go-githubauth from 1.6.0 to 1.7.0 (#6197) (@dependabot[bot])
- aaf7d122452ca939b84990b5eaf3bbfd985946b9: chore(deps): bump github.com/ktrysmt/go-bitbucket from 0.9.100 to 0.10.0 (#6134) (@dependabot[bot])
- 45a0153d5c25a8db0a4957341bf4d411c99b0e8d: chore(deps): bump github.com/kubescape/go-git-url from 0.0.31 to 0.0.32 (#6104) (@dependabot[bot])
- f94e213479735ba00d8e1a41d041b4f60629883d: chore(deps): bump github.com/open-policy-agent/opa from 1.14.1 to 1.17.1 (#6033) (@dependabot[bot])
- cb9fad6050f45288fd10018a5c74c0352e13a2ce: chore(deps): bump github.com/open-policy-agent/opa from 1.17.1 to 1.18.2 (#6200) (@dependabot[bot])
- 3fef45ba6511bcc3bb727e064953068952363df6: chore(deps): bump github.com/prometheus/common from 0.67.5 to 0.69.0 (#6097) (@dependabot[bot])
- 5f00d704acb8e5d25babe1917d00377eee20a1e9: chore(deps): bump github.com/prometheus/common from 0.69.0 to 0.70.0 (#6182) (@dependabot[bot])
- 89f3f5e6aaf6bf90babd4e384b23c855e10d1cf6: chore(deps): bump github.com/redis/go-redis/extra/redisotel/v9 (#6065) (@dependabot[bot])
- 6f0adf37b1c58db1b2a6a204eeb555cf802611c0: chore(deps): bump gocloud.dev from 0.45.0 to 0.46.0 (#6194) (@dependabot[bot])
- 84e71b097d184edece0f6bbdb386c1270cf62826: chore(deps): bump golang.org/x/net from 0.43.0 to 0.55.0 in /core (#6128) (@dependabot[bot])
- dd4122abc1748f6ed46fcb9a5b1871b023823ec0: chore(deps): bump golang.org/x/net from 0.48.0 to 0.55.0 in /sdk/go (#6129) (@dependabot[bot])
- abd04a30cfd678e2801e8ff26d91548d0d2d4c3e: chore(deps): bump golang.org/x/net in /rpc/v2/environments (#6144) (@dependabot[bot])
- d542a49f09760262b6a25b4ad12312257819cd50: chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 (#6063) (@dependabot[bot])
- 71055f95f440ddb4b7989e99a874d91b58fda065: chore(deps): bump google.golang.org/api from 0.275.0 to 0.284.0 (#6034) (@dependabot[bot])
- 29526211f69c57ce32b70fe59ffccf3215500e06: chore(deps): bump google.golang.org/api from 0.284.0 to 0.286.0 (#6071) (@dependabot[bot])
- 765ad430a9c7f6d0881c7552797d4ff92888a710: chore(deps): bump google.golang.org/api from 0.286.0 to 0.288.0 (#6199) (@dependabot[bot])
- 840d413ffb7eb66d2add32b38ae25aa5a8a918cb: chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 (#6143) (@dependabot[bot])
- 22b82033c0cb44506a42d62c907d3a531a3a8a50: chore(deps): bump google.golang.org/grpc in the grpc group (#6216) (@dependabot[bot])
- 579783742b2a9e98ff506a651636a4e7163d5626: chore(deps): bump react and @types/react in /ui (#6099) (@dependabot[bot])
- 1ef35581c9d84412aaad45842cd97da9793b331f: chore(deps): bump react-router from 7.17.0 to 7.18.1 in /ui (#6136) (@dependabot[bot])
- d7f959309f68b212f30d16621a16f51efba528e2: chore(deps): bump the aws-sdk-go-v2 group with 3 updates (#6215) (@dependabot[bot])
- 278f84c4e7c429003cc0a27f60d83e0473cbeafb: chore(deps): bump the codemirror group in /ui with 2 updates (#6188) (@dependabot[bot])
- 4b022f2192ac95ce88fb107fe1b4f38f40a6e7b3: chore(deps): update grpc, gateway, genproto, x/net, x/crypto and oidc to latest (#6167) (@erka)
- eee7845370cf5052fa8421b29889c3b1b1c18d2d: chore(deps): upgrade build tooling to Node 24 (#6073) (@markphelps)
- 1053341e85ffdb592d89708aa7e58abaab9b62d7: chore(deps-dev): bump @playwright/test from 1.60.0 to 1.61.1 in /ui (#6096) (@dependabot[bot])
- c043e319a30ac9f69f89bbbe0117245a36ce3c47: chore(deps-dev): bump @tailwindcss/vite from 4.3.0 to 4.3.1 in /ui (#6068) (@dependabot[bot])
- 727242d26270275bcbaed7020b2f4bb45c3b3a2b: chore(deps-dev): bump @tailwindcss/vite from 4.3.1 to 4.3.2 in /ui (#6190) (@dependabot[bot])
- f228539224fd1de3d735b1787e02ecf7712582b7: chore(deps-dev): bump @types/node from 24.13.2 to 24.13.3 in /ui (#6189) (@dependabot[bot])
- b4ed2dfea91432a503141dc0b86cfea7cda3918a: chore(deps-dev): bump @vitejs/plugin-react from 6.0.2 to 6.0.3 in /ui (#6192) (@dependabot[bot])
- b5075817365360ebd0a1d5522f820b9f116a69b5: chore(deps-dev): bump postcss from 8.5.16 to 8.5.19 in /ui (#6201) (@dependabot[bot])
- a6fe495bf01cc6a7655979cd6cad66b782ddc2f2: chore(deps-dev): bump prettier from 3.8.3 to 3.8.4 in /ui (#6025) (@dependabot[bot])
- 83b6b2b13fd301a8256af02901373ff07ba4c7ff: chore(deps-dev): bump prettier from 3.8.4 to 3.9.4 in /ui (#6138) (@dependabot[bot])
- 5b512c6dee9c65385a817186a9d516ea2b0530df: chore(deps-dev): bump prettier from 3.9.4 to 3.9.5 in /ui (#6191) (@dependabot[bot])
- 4bcf06d7c5750f65c65a79ea0e9a74913924fdce: chore(deps-dev): bump prettier-plugin-tailwindcss in /ui (#6210) (@dependabot[bot])
- 6c59be81308f085365c2da9a31fe4daa98165340: chore(deps-dev): bump tailwindcss from 4.3.1 to 4.3.2 in /ui (#6139) (@dependabot[bot])
- 8c85819e9596571e1d53cbba01a1a9d47733548f: chore(deps-dev): bump vite from 8.0.16 to 8.1.2 in /ui (#6101) (@dependabot[bot])
- 74642757466c9d47f430dfb8a834bd8cbe512497: chore(deps-dev): bump vite from 8.1.2 to 8.1.3 in /ui (#6137) (@dependabot[bot])
- 41aed2dd778eef9111b89a47d3bc1f9c3590db4f: chore(deps-dev): bump vite from 8.1.3 to 8.1.4 in /ui (#6179) (@dependabot[bot])
- 99d236930d8a3017156216ecf56b98c99e74c48d: chore(sdk/go): add ClientTokenProvider as migration bridge (#6168) (@erka)
- 555c557b2f8107c003fbd1378a2342ba6dac60a2: chore(ui): consolidate Radix UI packages into radix-ui umbrella (#6208) (@erka)
- 1a4ee81a103a25572507c1529c6040d594c1476d: chore: release v2.11.0 (#6218) (@markphelps)
- d7c59f1a0f0df11e4ae456ad69150f7c10142c11: ci: add issue health workflow (#6074) (@markphelps)
- 4ca41912934ee75c19a2b4a3797741576f23a426: ci: pin goreleaser previous tag to semver predecessor (#6082) (@markphelps)
- acda1ab153efd8dc29aa6adb011a997b14a48b87: docs(release): tag the squashed merge commit and verify reachability (#6083) (@markphelps)
- a3e5c1cbae296835cb7bfa561520d6ffbf6aff48: feat(authn/oidc): add OIDC Single Logout (SLO) support (#6125) (@erka)
- 97d90576896618d7c68a86176efaf17ff7daf24a: feat(authn/oidc): support custom authorize parameters in OIDC provider config (#6126) (@erka)
- bfc8612b09a02db185277804f45d08bc61f48567: perf: make flag evaluation faster (#6023) (@erka)
- 1dffab8f8ad7c154f76a8534926fd7c37700f44c: refactor(ui): replace Searchbox debounce with useDeferredValue in tables (#6173) (@erka)
Installation
Docker Images :whale:
docker pull docker.flipt.io/flipt/flipt:v2.11.0
docker pull ghcr.io/flipt-io/flipt:v2.11.0
Thank you!
We hope you :heart: this release! Feel free to open issues/discussions or reach out to us on Discord if you have any questions or feedback.
Security Fixes
- Patch container and Docker dependency CVEs (#6163)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Flipt
Feature flag solution with support for multiple data backends (alternative to LaunchDarkly).
Beta — feedback welcome: [email protected]