build(deps): bump github.com/openfga/openfga from 1.8.11 to 1.8.13

[dependabot]

Bumps github.com/openfga/openfga from 1.8.11 to 1.8.13.

Release notes

Sourced from github.com/openfga/openfga's releases.

v1.8.13

Changelog

1.8.13 - 2025-05-22

Added

• New DatastoreThrottle configuration for Check, ListObjects, ListUsers. #2452
• Added pkg migrate to expose .RunMigrations() for programmatic use. #2422
• Performance optimization by allowing datastore query iterator to be shared by multiple consumers. This can be enabled via OPENFGA_SHARED_ITERATOR_ENABLED. #2433, #2410 and #2423
• Upgraded all references of Postgres to v17. #2407

Fixed

• Ensure fanin.Stop and fanin.Drain are called for all clients which may create blocking goroutines. #2441
• Prevent throttled Go routines from "leaking" when a request context has been canceled or deadline exceeded. #2450
• Filter context tuples based on type restrictions for ReadUsersetTuples. CVE-2025-48371

v1.8.12

Changelog

1.8.12 - 2025-05-12

Full changelog

Changed

• DefaultResolveNodeBreadthLimit changed from 100 to 10 in order to reduce connection contention. #2425
• PostgreSQL and MySQL based iterators will load tuples only when needed (lazy loading). #2425

Fixed

• Replace hardcoded Prometheus datasource UID (PBFA97CFB590B2093) with ${DS_PROMETHEUS} in telemetry/grafana/dashboards/openfga.json. This allows the Grafana dashboard to correctly reference the dynamic Prometheus datasource, resolving issues with improper binding. #2287
• Handle case where iterator is stopped more than once for current_iterator_cache_count. #2409
• Fix deadlock when number of SQL datastore connections is less than Resolve Max Breadth. #2425
• Improved panic() handling from go routines: #2379, #2385, #2405, #2428

Changelog

Sourced from github.com/openfga/openfga's changelog.

[1.8.13] - 2025-05-22

Added

• New DatastoreThrottle configuration for Check, ListObjects, ListUsers. #2452
• Added pkg migrate to expose .RunMigrations() for programmatic use. #2422
• Performance optimization by allowing datastore query iterator to be shared by multiple consumers. This can be enabled via OPENFGA_SHARED_ITERATOR_ENABLED. #2433, #2410 and #2423
• Upgraded all references of Postgres to v17. #2407

Fixed

• Ensure fanin.Stop and fanin.Drain are called for all clients which may create blocking goroutines. #2441
• Prevent throttled Go routines from "leaking" when a request context has been canceled or deadline exceeded. #2450
• Filter context tuples based on type restrictions for ReadUsersetTuples. CVE-2025-48371

[1.8.12] - 2025-05-12

Full changelog

Changed

• DefaultResolveNodeBreadthLimit changed from 100 to 10 in order to reduce connection contention. #2425
• PostgreSQL and MySQL based iterators will load tuples only when needed (lazy loading). #2425

Fixed

• Replace hardcoded Prometheus datasource UID (PBFA97CFB590B2093) with ${DS_PROMETHEUS} in telemetry/grafana/dashboards/openfga.json. This allows the Grafana dashboard to correctly reference the dynamic Prometheus datasource, resolving issues with improper binding. #2287
• Handle case where iterator is stopped more than once for current_iterator_cache_count. #2409
• Fix deadlock when number of SQL datastore connections is less than Resolve Max Breadth. #2425
• Improved panic() handling from go routines: #2379, #2385, #2405

Commits

• e5960d4 Merge commit from fork
• b332a8c revert: fanin refactor with additional bounding (#2467)
• bf51791 Revert "feat: add recover log in cached iterator stop goroutine (#2428)" (#2457)
• 1e9aa4c feat: shared iterator measurement unique by method (#2459)
• 36a6b4c fix: shared iterator should not store context cancelled error (#2458)
• ce44aa1 upgrade to Postgres v17 (#2407)
• d863ba6 feat: shared iterator implementation (#2433)
• 1b6a7b9 feat: add datastore throttler (#2452)
• 1d847ec chore(deps): bump the dependencies group with 4 updates (#2455)
• c2f9630 chore(deps): bump the dependencies group with 2 updates (#2456)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[coveralls]

coverage: 56.956% (+0.009%) from 56.947%
when pulling fd9c80f on dependabot/go_modules/github.com/openfga/openfga-1.8.13
into 382becb on main.