What flipt-io/flipt shipped
Written by FoxPlug from the repository's own releases; not affiliated with Flipt. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/flipt-io/flipt; Flipt did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 19, 2026
What shipped
- Released v2.14.1 with authorization security fixes that check authentication management and analytics APIs against policy, and log denials at warn level with request context. Release
- Released v1.62.0 with optional audiences for Kubernetes authentication, a UI view showing which flags use each segment, and Prometheus query key escaping. Release
- Added security fixes for v2.14.1 covering authorization on ListFlags, batch evaluation, and unknown evaluation environments. Pull request #6679
- Removed the Slack release announcer and its secret so v1 release jobs no longer fail after publishing. Pull request #6693
- Fixed v1 release builds by installing quill outside the workspace so the darwin build can find it. Pull request #6691
- Ordered release preparation tasks so cleaning no longer deletes freshly built UI assets before the v1 darwin build. Pull request #6689
Why it matters
This week brought v2.14.1 and v1.62.0, both with security fixes for authorization and analytics APIs, plus a new UI view for segment usage and optional Kubernetes authentication audiences in v1. Release builds for v1 were also repaired so artifacts and images can be produced reliably.
Changelog entry
- Release v2.14.1 with authorization security fixes and warn-level denial logging Release
- Release v1.62.0 with optional Kubernetes authentication audiences and segment usage in the UI Release
- Security fixes for v2.14.1 including policy checks on authentication management and analytics APIs Pull request #6679
- Remove Slack release announcer and secret from v1 release jobs Pull request #6693
- Install quill outside the workspace for v1 release builds Pull request #6691
- Order release preparation tasks so clean does not delete built UI assets Pull request #6689
Flipt v2.14.1 and v1.62.0 are out. v2.14.1 includes authorization security fixes and better denial logging. v1.62.0 adds optional Kubernetes auth audiences and a UI showing which flags use each segment. Release builds for v1 were fixed too.
Flipt v2.14.1 and v1.62.0 are now available. v2.14.1 focuses on security: authentication management and analytics APIs are checked against policy, more operations authorize their environment, and authorization denials are logged at warn level with request context. v1.62.0 adds optional audiences for Kubernetes authentication and a UI view showing which flags use each segment, along with Prometheus query key escaping and other security fixes. Release tooling for v1 was also repaired so the darwin build can find quill and freshly built UI assets are no longer deleted before packaging.
Week of October 12, 2026
What shipped
- Released v2.14.0 with opt-in authorization enforcement on evaluation APIs, Pro licensing for the vault, aws, gcp and azure secrets providers, and incoming SCM webhooks for instant environment sync. Release
- Prepared the v2.14.0 release, noting the breaking change that aws, gcp and azure secrets providers now require a Pro license and that license secret references may only use the file provider. Pull request #6674
- Fixed a list-endpoint scope bypass where ListNamespaces could show environments hidden by
viewable_environmentsand undefined list scopes fell back to an unrestricted list. Pull request #6662 - Changed validation and serialization to accept empty variant keys, keep present-empty distinct from absent in the resource API, and reject duplicate variant keys within a single flag. Pull request #6666
- Lowered expected authorization denials from error to warn level and added environment, namespace, auth id and auth method to those log lines, while engine errors remain at error. Pull request #6675
Why it matters
This week brings a new release with authorization enforcement on evaluation APIs and Pro licensing required for several secrets providers, which changes what existing configurations need. It also closes a list-endpoint scope bypass and fixes handling of empty and duplicate variant keys, which affects flag definitions and stored data.
Changelog entry
- Release v2.14.0 with opt-in authorization on evaluation APIs, Pro licensing for vault, aws, gcp and azure secrets providers, and incoming SCM webhooks. Release
- Release notes: aws, gcp and azure secrets providers now require a Pro license; license secret references may only use the file provider. Pull request #6674
- Fix list-endpoint scope bypass in ListNamespaces for environments hidden by
viewable_environmentsand undefined list scopes. Pull request #6662 - Allow empty variant keys in the CUE schema and file format, keep present-empty distinct from absent in the resource API, and reject duplicate variant keys within one flag. Pull request #6666
- Log expected authorization denials at warn level with environment, namespace, auth id and auth method; engine errors stay at error. Pull request #6675
Flipt v2.14.0 is out: opt-in authorization on evaluation APIs, SCM webhooks for instant environment sync, and aws, gcp and azure secrets providers now need a Pro license. Also fixed a list-endpoint scope bypass and empty variant key handling.
Flipt v2.14.0 is released. It adds opt-in authorization enforcement on evaluation APIs and incoming SCM webhooks for instant environment sync. Note the breaking change: the aws, gcp and azure secrets providers now require a Pro license, and license secret references may only use the file provider. Alongside the release, we closed a list-endpoint scope bypass so ListNamespaces respects environments hidden by viewable_environments and undefined list scopes no longer fall back to an unrestricted list. Variant keys can now be empty, with present-empty kept distinct from absent in the resource API, and duplicate variant keys within one flag are rejected. Authorization denials that are expected are now logged at warn level with request context.
Week of October 5, 2026
What shipped
- Authorization can now be enforced on the evaluation, snapshot, and OFREP endpoints through opt-in flags, and evaluation requests carry a new evaluate action so namespace-scoped tokens work without management read access. Pull request #6661
- An incoming webhook receiver was added so a push or merge from a Git remote can trigger an environment sync immediately instead of waiting for the poll interval. Pull request #6643
- The vault, aws, gcp and azure secrets providers now require a Pro license, which is checked before the providers are contacted. Pull request #6645
- Environment scopes defined only in the data document are now honored instead of being treated as unrestricted access. Pull request #6639
- Storage now refetches the branch before reporting a head revision conflict, so a save that lands on an instance with an older revision is handled correctly. Pull request #6646
- GitLab SCM now starts without credentials instead of panicking with a nil pointer dereference, matching the behavior of GitHub, Bitbucket and Gitea. Pull request #6644
- The /metrics endpoint now stops being served when metrics are turned off, and appears only when metrics are on with the Prometheus exporter. Pull request #6642
- Pull request CI now skips jobs a pull request cannot affect, such as Go jobs on changes that touch only the ui directory. Pull request #6640
- Per-workflow result gates were added for required status checks so UI-only pull requests can merge when the integration test matrix is skipped. Pull request #6657
Why it matters
This week hardens authorization and access control around evaluation and environment scopes, so deployments relying on policy enforcement or scoped tokens behave as configured. It also adds instant environment sync through incoming SCM webhooks and fixes a set of startup, metrics, and storage edge cases. Together these reduce the chance of a flag change not taking effect quickly or an environment being exposed more widely than intended.
Changelog entry
- Authz: opt-in authorization enforcement on evaluation, snapshot and OFREP endpoints via authorization.exclude.evaluation/ofrep flags, with a new evaluate action for namespace-scoped tokens. Pull request #6661
- Webhook: incoming SCM webhook receiver (Pro) for instant environment sync on push or merge. Pull request #6643
- Secrets: vault, aws, gcp and azure providers now require a Pro license before being built and contacted. Pull request #6645
- Authz: honor environment scopes defined only in the data document instead of treating them as unrestricted. Pull request #6639
- Storage: refetch the branch before reporting a head revision conflict when instances share a Git remote. Pull request #6646
- Scm/gitlab: start without credentials instead of panicking with a nil pointer dereference. Pull request #6644
- Metrics: stop serving /metrics when metrics are disabled; the page registers only when metrics are on with the Prometheus exporter. Pull request #6642
- Ci: skip jobs a pull request cannot affect, so Go jobs do not run on changes with no Go code. Pull request #6640
- Ci: add per-workflow result gates for required status checks so UI-only pull requests can merge. Pull request #6657
Flipt this week: opt-in authz on evaluation, snapshot and OFREP endpoints, incoming SCM webhooks for instant environment sync, Pro licensing for vault, aws, gcp and azure secrets providers, environment scope fixes, GitLab no-credential startup, /metrics off when disabled, and lea
Flipt shipped a week of access control and sync work. Authorization can now be enforced on the evaluation, snapshot and OFREP endpoints through opt-in flags, and evaluation requests carry a new evaluate action so namespace-scoped tokens work without management read access. Incoming SCM webhooks let a push or merge trigger an environment sync immediately instead of waiting for the poll interval. The vault, aws, gcp and azure secrets providers now require a Pro license, checked before the providers are contacted. Environment scopes defined only in the data document are honored, storage refetches the branch before reporting a head revision conflict, GitLab starts without credentials instead of panicking, /metrics is no longer served when metrics are off, and pull request CI skips jobs a chang
Week of September 28, 2026
What shipped
- Released v2.13.1 with fixes for analytics boolean storage, management authorization hardening, and evaluation flag key handling. Release
- Fixed boolean evaluation to always return the flag key, resolving an issue where disabled flags with no rollouts returned empty keys. Pull request #6622
- Hardened management authorization and fixed cross-origin protection for evaluation routes with auth excluded. Pull request #6638
- Fixed false non-fast-forward push rejections in Git storage by pushing already-built commits with shallow markers cleared. Pull request #6637
- Fixed branched environment recovery after initial snapshot failure by setting currentBranch and base before caching. Pull request #6603
- Fixed Git storage to return errors when HEAD cannot be resolved instead of falling through to remote-tracking branches. Pull request #6611
- Configured Dependabot to skip major version updates and group minor/patch updates into single PRs per ecosystem. Pull request #6633
- Reduced Renovate automation on the v1 maintenance branch to security-only updates to lower CI overhead. Pull request #6617
Why it matters
This release addresses evaluation correctness for boolean flags and tightens authorization controls. Git storage reliability improvements fix issues with push rejection handling and environment snapshot publishing, benefiting users with complex deployment topologies.
Changelog entry
- Fix(analytics): store boolean evaluation values as true/false Release
- Fix(authz): harden management authorization Release
- Fix(evaluation): always return flag key for boolean evaluation Release
- Fix(git): recover from false non-fast-forward push rejections Pull request #6637
- Fix(git): recover branched environments after initial snapshot failure Pull request #6603
- Fix(storage/git): return error when HEAD cannot be resolved Pull request #6611
V2.13.1 shipped with fixes for boolean evaluation flag keys, hardened authorization, and improved Git storage stability for branched environments.
Flipt v2.13.1 is now available with several important reliability fixes. We hardened management authorization, fixed boolean flag evaluations to properly return flag keys, and resolved Git storage issues affecting branched environment snapshots and push operations. These updates improve consistency for complex deployment scenarios.
Week of September 21, 2026
What shipped
- Browser-based evaluation now works correctly behind externally managed origins by exempting evaluation and OFREP POST routes from cross-origin protection when authentication is excluded. Pull request #6608
- Management authorization is hardened with corrected branch operations and fail-closed list filtering for missing or denied scopes. Pull request #6567
- Three bugs in environment storage are fixed, including preventing pushed branches from replacing static environments and correcting stale-revision push retries. Pull request #6592
- Multi-document namespaces now preserve full SHA1 digests instead of truncating to 32 characters, fixing server-issued digest validation in streams. Pull request #6593
- Boolean evaluations now emit match attributes and format variants as true/false, with gRPC server spans enabled for ClickHouse analytics. Pull request #6604
- Authorization data decoding and context ticker leaks are fixed, preventing resource exhaustion during polling. Pull request #6561
- Deep links are restored after OIDC login in v2, fixing redirect loops that sent users back to login instead of their requested page. Pull request #6586
- Git storage now stores evaluation snapshots before publishing them, fixing a race condition in snapshot handling. Pull request #6605
Why it matters
This week addresses critical bugs in authentication flows, authorization enforcement, and multi-document snapshot handling. Browser-based evaluation, analytics accuracy, and environment management are now more reliable. These fixes resolve issues that affected real deployments across OIDC integration, cross-origin scenarios, and stream validation.
Changelog entry
- Fix: respect auth exclusion in cross-origin protection - Evaluation and OFREP POST routes are now exempt from cross-origin protection when authentication is excluded, fixing 403 errors for browser-based evaluation Pull request #6608
- Fix(authz): harden management authorization - Corrected authorization actions for branch create, propose, and delete; list filtering now fails closed for missing or denied scopes Pull request #6567
- Fix: guard branched environments and stale-revision push retries - Prevents pushed branches from replacing static environments and fixes stale-revision push retry handling Pull request #6592
- Fix(snapshot): keep full sha1 digest for multi-doc namespaces - Preserved full SHA1 digest instead of truncating to 32 characters for proper stream validation Pull request #6593
- Fix(analytics): store boolean evaluation values as true/false - Boolean evaluations now emit match attributes with proper true/false formatting; gRPC spans enabled for ClickHouse Pull request #6604
- Fix: auth data decoding and ticker leaks - Authorization data only returned on successful JSON unmarshaling; context cancellation now stops authorization and Git polling tickers Pull request #6561
- Fix(ui): restore deep link after OIDC login in v2 - Users are now redirected to their originally requested page after OIDC login instead of the homepage Pull request #6586
- Fix(storage/git): store evaluation snapshot before publishing it - Evaluation snapshots are now persisted before publication, eliminating a race condition Pull request #6605
This week: fixed browser evaluation behind external origins, hardened authorization for branch operations, and corrected SHA1 digest handling for multi-doc namespaces. Also patched ticker leaks and OIDC redirect loops.
Flipt's latest release addresses seven critical fixes spanning authentication, authorization, and storage. Browser-based evaluation now respects cross-origin boundaries correctly, branch authorization is hardened to prevent unintended replacements, and multi-document snapshots maintain full digest integrity. We've also eliminated resource leaks in authorization polling and restored OIDC login deep links. These changes improve reliability for production deployments using external identity providers and distributed flag management.
Week of September 14, 2026
What shipped
- Released v2.13.0 with per-service health readiness for gRPC management and evaluation, custom OIDC discovery URLs, claims mapping for non-standard ID tokens, and validation fixes. Release
- Added gRPC health services for management and evaluation that track snapshot readiness, starting at UNKNOWN and moving to SERVING when environments are ready. Pull request #6559
- Added support for custom discovery URLs in OIDC provider configuration for providers whose discovery documents are at non-standard paths. Pull request #6525
- Added
claims_mappingconfiguration to map non-standard OIDC provider claims to Flipt's expected session fields like email, name, picture, and sub. Pull request #6519 - Restored validation for versionless legacy feature files by retrying validation with an explicit version 1.5 when the original document lacks a version field. Pull request #6547
- Hardened offline license validation with deterministic test fixtures covering valid and invalid scenarios including file-key pairing, signature, TTL, and expiry checks. Pull request #6539
- Fixed boolean flag evaluation to return FLAG_DISABLED for disabled flags with no rollouts instead of DEFAULT_EVALUATION_REASON. Pull request #6515
- Fixed segment picker in flag rollouts to search by display name in addition to key when filtering options. Pull request #6550
- Restored deep links after OIDC login instead of always redirecting to the dashboard. Pull request #6518
- Configured Dependabot to skip vulnerability checks in examples and _tools directories to reduce noise. Pull request #6548
Why it matters
V2.13.0 brings enterprise authentication improvements for non-standard OIDC setups, health readiness tracking for service orchestration, and fixes for flag evaluation consistency. These changes address real operational needs in production deployments and improve reliability for teams using feature flags across distributed systems.
Changelog entry
- Feat(grpc): per-service health readiness for management and evaluation Release
- Fix(build): repair the go:modernize task Release
- Fix(evaluation): return FLAG_DISABLED for disabled boolean flag with no rollouts Release
- Feat(authn/oidc): support custom discovery URL for OIDC providers Pull request #6525
- Feat(authn/oidc): add
claims_mappingfor non-standard ID token claims Pull request #6519 - Fix: preserve validation of versionless legacy feature files Pull request #6547
- Fix(license): enforce expiry consistently and harden offline license validation Pull request #6539
- Fix(ui): match Combobox options by display name, not only key Pull request #6550
- Fix(ui): restore deep link after OIDC login instead of landing on dashboard Pull request #6518
- Ci: exclude examples and _tools from dependabot vulnerabilities checks Pull request #6548
Flipt v2.13.0 ships with custom OIDC discovery URLs, claims mapping for non-standard ID tokens, gRPC health readiness tracking, and fixes for flag evaluation and legacy file validation.
We released Flipt v2.13.0 today. This version adds support for custom OIDC discovery URLs and claims mapping to handle non-standard ID token claims from enterprise identity providers. We also shipped per-service gRPC health readiness tracking for management and evaluation services, hardened offline license validation, and fixed evaluation consistency for disabled flags. These improvements help teams integrate with diverse authentication systems and deploy Flipt reliably in orchestrated environments.