OpenFGA v1.18.0

This release focuses heavily on security hardening and data consistency. It addresses two potential authentication vulnerabilities related to OIDC audience validation and timing attacks on preshared keys. It also introduces a critical consistency fix for MySQL users to ensure case-sensitive identifier matching across all supported databases, though this requires a managed migration process.

Mandatory OIDC Audience Validation — This closes a high-risk security gap where OIDC-protected instances would accept any valid token from an issuer without checking the audience, potentially allowing unauthorized access from different applications sharing the same provider. OpenFGA will now fail-safe and refuse to start if this is misconfigured.

Case-Sensitive MySQL Identifiers and Mandatory Migration — MySQL users must plan for downtime. This change ensures that identifiers are treated as case-sensitive, making MySQL behavior consistent with Postgres and SQLite. However, because it requires a table-locking migration, you must manually manage this update rather than using auto-migrations in production.

Constant-Time Preshared Key Comparison — This strengthens the security of your API keys by preventing advanced attackers from using response timing differences to guess your secret keys.