What flipt-io/flipt shipped
Written by FoxPlug from the repository's own releases; not affiliated with Flipt. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/flipt-io/flipt; Flipt did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Authorization can now be enforced on the evaluation, snapshot, and OFREP endpoints through opt-in flags, and evaluation requests carry a new evaluate action so namespace-scoped tokens work without management read access. Pull request #6661
- An incoming webhook receiver was added so a push or merge from a Git remote can trigger an environment sync immediately instead of waiting for the poll interval. Pull request #6643
- The vault, aws, gcp and azure secrets providers now require a Pro license, which is checked before the providers are contacted. Pull request #6645
- Environment scopes defined only in the data document are now honored instead of being treated as unrestricted access. Pull request #6639
- Storage now refetches the branch before reporting a head revision conflict, so a save that lands on an instance with an older revision is handled correctly. Pull request #6646
- GitLab SCM now starts without credentials instead of panicking with a nil pointer dereference, matching the behavior of GitHub, Bitbucket and Gitea. Pull request #6644
- The /metrics endpoint now stops being served when metrics are turned off, and appears only when metrics are on with the Prometheus exporter. Pull request #6642
- Pull request CI now skips jobs a pull request cannot affect, such as Go jobs on changes that touch only the ui directory. Pull request #6640
- Per-workflow result gates were added for required status checks so UI-only pull requests can merge when the integration test matrix is skipped. Pull request #6657
Why it matters
This week hardens authorization and access control around evaluation and environment scopes, so deployments relying on policy enforcement or scoped tokens behave as configured. It also adds instant environment sync through incoming SCM webhooks and fixes a set of startup, metrics, and storage edge cases. Together these reduce the chance of a flag change not taking effect quickly or an environment being exposed more widely than intended.
Changelog entry
- Authz: opt-in authorization enforcement on evaluation, snapshot and OFREP endpoints via authorization.exclude.evaluation/ofrep flags, with a new evaluate action for namespace-scoped tokens. Pull request #6661
- Webhook: incoming SCM webhook receiver (Pro) for instant environment sync on push or merge. Pull request #6643
- Secrets: vault, aws, gcp and azure providers now require a Pro license before being built and contacted. Pull request #6645
- Authz: honor environment scopes defined only in the data document instead of treating them as unrestricted. Pull request #6639
- Storage: refetch the branch before reporting a head revision conflict when instances share a Git remote. Pull request #6646
- Scm/gitlab: start without credentials instead of panicking with a nil pointer dereference. Pull request #6644
- Metrics: stop serving /metrics when metrics are disabled; the page registers only when metrics are on with the Prometheus exporter. Pull request #6642
- Ci: skip jobs a pull request cannot affect, so Go jobs do not run on changes with no Go code. Pull request #6640
- Ci: add per-workflow result gates for required status checks so UI-only pull requests can merge. Pull request #6657
Flipt this week: opt-in authz on evaluation, snapshot and OFREP endpoints, incoming SCM webhooks for instant environment sync, Pro licensing for vault, aws, gcp and azure secrets providers, environment scope fixes, GitLab no-credential startup, /metrics off when disabled, and lea
Flipt shipped a week of access control and sync work. Authorization can now be enforced on the evaluation, snapshot and OFREP endpoints through opt-in flags, and evaluation requests carry a new evaluate action so namespace-scoped tokens work without management read access. Incoming SCM webhooks let a push or merge trigger an environment sync immediately instead of waiting for the poll interval. The vault, aws, gcp and azure secrets providers now require a Pro license, checked before the providers are contacted. Environment scopes defined only in the data document are honored, storage refetches the branch before reporting a head revision conflict, GitLab starts without credentials instead of panicking, /metrics is no longer served when metrics are off, and pull request CI skips jobs a chang
Week of September 28, 2026
What shipped
- Released v2.13.1 with fixes for analytics boolean storage, management authorization hardening, and evaluation flag key handling. Release
- Fixed boolean evaluation to always return the flag key, resolving an issue where disabled flags with no rollouts returned empty keys. Pull request #6622
- Hardened management authorization and fixed cross-origin protection for evaluation routes with auth excluded. Pull request #6638
- Fixed false non-fast-forward push rejections in Git storage by pushing already-built commits with shallow markers cleared. Pull request #6637
- Fixed branched environment recovery after initial snapshot failure by setting currentBranch and base before caching. Pull request #6603
- Fixed Git storage to return errors when HEAD cannot be resolved instead of falling through to remote-tracking branches. Pull request #6611
- Configured Dependabot to skip major version updates and group minor/patch updates into single PRs per ecosystem. Pull request #6633
- Reduced Renovate automation on the v1 maintenance branch to security-only updates to lower CI overhead. Pull request #6617
Why it matters
This release addresses evaluation correctness for boolean flags and tightens authorization controls. Git storage reliability improvements fix issues with push rejection handling and environment snapshot publishing, benefiting users with complex deployment topologies.
Changelog entry
- Fix(analytics): store boolean evaluation values as true/false Release
- Fix(authz): harden management authorization Release
- Fix(evaluation): always return flag key for boolean evaluation Release
- Fix(git): recover from false non-fast-forward push rejections Pull request #6637
- Fix(git): recover branched environments after initial snapshot failure Pull request #6603
- Fix(storage/git): return error when HEAD cannot be resolved Pull request #6611
V2.13.1 shipped with fixes for boolean evaluation flag keys, hardened authorization, and improved Git storage stability for branched environments.
Flipt v2.13.1 is now available with several important reliability fixes. We hardened management authorization, fixed boolean flag evaluations to properly return flag keys, and resolved Git storage issues affecting branched environment snapshots and push operations. These updates improve consistency for complex deployment scenarios.
Week of September 21, 2026
What shipped
- Browser-based evaluation now works correctly behind externally managed origins by exempting evaluation and OFREP POST routes from cross-origin protection when authentication is excluded. Pull request #6608
- Management authorization is hardened with corrected branch operations and fail-closed list filtering for missing or denied scopes. Pull request #6567
- Three bugs in environment storage are fixed, including preventing pushed branches from replacing static environments and correcting stale-revision push retries. Pull request #6592
- Multi-document namespaces now preserve full SHA1 digests instead of truncating to 32 characters, fixing server-issued digest validation in streams. Pull request #6593
- Boolean evaluations now emit match attributes and format variants as true/false, with gRPC server spans enabled for ClickHouse analytics. Pull request #6604
- Authorization data decoding and context ticker leaks are fixed, preventing resource exhaustion during polling. Pull request #6561
- Deep links are restored after OIDC login in v2, fixing redirect loops that sent users back to login instead of their requested page. Pull request #6586
- Git storage now stores evaluation snapshots before publishing them, fixing a race condition in snapshot handling. Pull request #6605
Why it matters
This week addresses critical bugs in authentication flows, authorization enforcement, and multi-document snapshot handling. Browser-based evaluation, analytics accuracy, and environment management are now more reliable. These fixes resolve issues that affected real deployments across OIDC integration, cross-origin scenarios, and stream validation.
Changelog entry
- Fix: respect auth exclusion in cross-origin protection - Evaluation and OFREP POST routes are now exempt from cross-origin protection when authentication is excluded, fixing 403 errors for browser-based evaluation Pull request #6608
- Fix(authz): harden management authorization - Corrected authorization actions for branch create, propose, and delete; list filtering now fails closed for missing or denied scopes Pull request #6567
- Fix: guard branched environments and stale-revision push retries - Prevents pushed branches from replacing static environments and fixes stale-revision push retry handling Pull request #6592
- Fix(snapshot): keep full sha1 digest for multi-doc namespaces - Preserved full SHA1 digest instead of truncating to 32 characters for proper stream validation Pull request #6593
- Fix(analytics): store boolean evaluation values as true/false - Boolean evaluations now emit match attributes with proper true/false formatting; gRPC spans enabled for ClickHouse Pull request #6604
- Fix: auth data decoding and ticker leaks - Authorization data only returned on successful JSON unmarshaling; context cancellation now stops authorization and Git polling tickers Pull request #6561
- Fix(ui): restore deep link after OIDC login in v2 - Users are now redirected to their originally requested page after OIDC login instead of the homepage Pull request #6586
- Fix(storage/git): store evaluation snapshot before publishing it - Evaluation snapshots are now persisted before publication, eliminating a race condition Pull request #6605
This week: fixed browser evaluation behind external origins, hardened authorization for branch operations, and corrected SHA1 digest handling for multi-doc namespaces. Also patched ticker leaks and OIDC redirect loops.
Flipt's latest release addresses seven critical fixes spanning authentication, authorization, and storage. Browser-based evaluation now respects cross-origin boundaries correctly, branch authorization is hardened to prevent unintended replacements, and multi-document snapshots maintain full digest integrity. We've also eliminated resource leaks in authorization polling and restored OIDC login deep links. These changes improve reliability for production deployments using external identity providers and distributed flag management.
Week of September 14, 2026
What shipped
- Released v2.13.0 with per-service health readiness for gRPC management and evaluation, custom OIDC discovery URLs, claims mapping for non-standard ID tokens, and validation fixes. Release
- Added gRPC health services for management and evaluation that track snapshot readiness, starting at UNKNOWN and moving to SERVING when environments are ready. Pull request #6559
- Added support for custom discovery URLs in OIDC provider configuration for providers whose discovery documents are at non-standard paths. Pull request #6525
- Added
claims_mappingconfiguration to map non-standard OIDC provider claims to Flipt's expected session fields like email, name, picture, and sub. Pull request #6519 - Restored validation for versionless legacy feature files by retrying validation with an explicit version 1.5 when the original document lacks a version field. Pull request #6547
- Hardened offline license validation with deterministic test fixtures covering valid and invalid scenarios including file-key pairing, signature, TTL, and expiry checks. Pull request #6539
- Fixed boolean flag evaluation to return FLAG_DISABLED for disabled flags with no rollouts instead of DEFAULT_EVALUATION_REASON. Pull request #6515
- Fixed segment picker in flag rollouts to search by display name in addition to key when filtering options. Pull request #6550
- Restored deep links after OIDC login instead of always redirecting to the dashboard. Pull request #6518
- Configured Dependabot to skip vulnerability checks in examples and _tools directories to reduce noise. Pull request #6548
Why it matters
V2.13.0 brings enterprise authentication improvements for non-standard OIDC setups, health readiness tracking for service orchestration, and fixes for flag evaluation consistency. These changes address real operational needs in production deployments and improve reliability for teams using feature flags across distributed systems.
Changelog entry
- Feat(grpc): per-service health readiness for management and evaluation Release
- Fix(build): repair the go:modernize task Release
- Fix(evaluation): return FLAG_DISABLED for disabled boolean flag with no rollouts Release
- Feat(authn/oidc): support custom discovery URL for OIDC providers Pull request #6525
- Feat(authn/oidc): add
claims_mappingfor non-standard ID token claims Pull request #6519 - Fix: preserve validation of versionless legacy feature files Pull request #6547
- Fix(license): enforce expiry consistently and harden offline license validation Pull request #6539
- Fix(ui): match Combobox options by display name, not only key Pull request #6550
- Fix(ui): restore deep link after OIDC login instead of landing on dashboard Pull request #6518
- Ci: exclude examples and _tools from dependabot vulnerabilities checks Pull request #6548
Flipt v2.13.0 ships with custom OIDC discovery URLs, claims mapping for non-standard ID tokens, gRPC health readiness tracking, and fixes for flag evaluation and legacy file validation.
We released Flipt v2.13.0 today. This version adds support for custom OIDC discovery URLs and claims mapping to handle non-standard ID token claims from enterprise identity providers. We also shipped per-service gRPC health readiness tracking for management and evaluation services, hardened offline license validation, and fixed evaluation consistency for disabled flags. These improvements help teams integrate with diverse authentication systems and deploy Flipt reliably in orchestrated environments.