Cerbos v0.31.0

This release introduces the runtime.effectiveDerivedRoles variable which can be used in policy condition expressions to inspect the set of activated derived roles in the current policy execution context. This feature makes it easier to write advanced policy rules without duplicating the logic used to define derived roles. Refer to documentation for more information.

Cerbos server now automatically detects when the TLS certificates change on disk and reloads them without requiring a service restart. This makes automated certificate rotation painless and encourages better security practices through short-lived certificates.

Lenient scope search can now be enabled for policy test suites either globally or on a per-test basis.

You can now configure Cerbos to not reject legacy JWTs that don’t have kid or alg claims. The default behaviour of Cerbos is to reject such tokens because they are considered insecure.

In light of the the recently discovered HTTP/2 rapid reset vulnerability affecting all public HTTP/2 implementations, Cerbos now includes a configuration option to limit the number of maximum concurrent streams per gRPC connection. The default is 1024 concurrent streams. You can set server.advanced.grpc.maxConcurrentStreams configuration to 0 to get back the previous behaviour of virtually unlimited concurrent streams.

The Cerbos Go SDK is now a separate Go module available at github.com/cerbos/cerbos-sdk-go. This makes the SDK leaner and more secure with fewer dependencies to manage. The client package available from github.com/cerbos/cerbos/client is now deprecated and will be removed in a future release. Migration in most cases would just require updating the import paths. Refer to the README at https://github.com/cerbos/cerbos-sdk-go or Go docs for more information.