chore(deps): bump the dependencies group with 2 updates

[dependabot]

Bumps the dependencies group with 2 updates: github.com/openfga/openfga and golang.org/x/term.

Updates github.com/openfga/openfga from 1.21.0 to 1.22.0

Release notes

Sourced from github.com/openfga/openfga's releases.

v1.22.0

What's Changed

Added

• Added read-replica (primary/secondary) support to the MySQL datastore backend, matching the existing PostgreSQL behaviour. Configure a secondary connection via --datastore-secondary-uri (or OPENFGA_DATASTORE_SECONDARY_URI); all reads except those requesting HIGHER_CONSISTENCY are routed to the replica while all writes remain on the primary. GetStore, ListStores, ReadAssertions, ReadAuthorizationModel, ReadAuthorizationModels, FindLatestAuthorizationModel, and ReadChanges always hit the replica when configured regardless of requested consistency — callers should be aware of read-after-write risk on a lagging replica. See pkg/storage/mysql/mysql.go. Breaking: mysql.NewWithDB gained a required secondaryDB *sql.DB parameter (pass nil if no replica is configured); sqlcommon.ReadAuthorizationModel and sqlcommon.FindLatestAuthorizationModel were removed and moved to per-backend implementations. #3290 Thanks @​chiragsoni-eternal for the contribution!

Changed

• Various dependency updates. Minimum go version updated to 1.26.0. #3329, #3328, #3324

Fixed

• ReadUserTuple now returns the tuple's timestamp for the Postgres, MySQL, and SQLite datastores; it previously returned a zero timestamp because the query did not select inserted_at. #3194 Thanks @​nikolauspschuetz for the contribution!

Security

• Updated google.golang.org/grpc to v1.83.2 to resolve GO-2026-6443. #3317

New Contributors

• @​chiragsoni-eternal made their first contribution in openfga/openfga#3290
• @​nikolauspschuetz made their first contribution in openfga/openfga#3194

Full Changelog: openfga/openfga@v1.21.0...v1.22.0

Changelog

Sourced from github.com/openfga/openfga's changelog.

[1.22.0] - 2026-10-06

Added

• Added read-replica (primary/secondary) support to the MySQL datastore backend, matching the existing PostgreSQL behaviour. Configure a secondary connection via --datastore-secondary-uri (or OPENFGA_DATASTORE_SECONDARY_URI); all reads except those requesting HIGHER_CONSISTENCY are routed to the replica while all writes remain on the primary. GetStore, ListStores, ReadAssertions, ReadAuthorizationModel, ReadAuthorizationModels, FindLatestAuthorizationModel, and ReadChanges always hit the replica when configured regardless of requested consistency — callers should be aware of read-after-write risk on a lagging replica. See pkg/storage/mysql/mysql.go. Breaking: mysql.NewWithDB gained a required secondaryDB *sql.DB parameter (pass nil if no replica is configured); sqlcommon.ReadAuthorizationModel and sqlcommon.FindLatestAuthorizationModel were removed and moved to per-backend implementations. #3290 Thanks @​chiragsoni-eternal for the contribution!

Changed

• Various dependency updates. Minimum go version updated to 1.26.0. #3329, #3328, #3324

Fixed

• ReadUserTuple now returns the tuple's timestamp for the Postgres, MySQL, and SQLite datastores; it previously returned a zero timestamp because the query did not select inserted_at. #3194 Thanks @​nikolauspschuetz for the contribution!

Security

• Updated google.golang.org/grpc to v1.83.2 to resolve GO-2026-6443. #3317

Commits

• a38d5d0 release: update changelog for release v1.22.0 (#3330)
• 0697932 chore(deps): bump the dependencies group across 1 directory with 19 updates (...
• 952db1d chore(deps): bump chainguard/static (#3328)
• 23c0f26 chore(deps): bump the dependencies group across 1 directory with 9 updates (#...
• 97943bf docs: update CHANGELOG.md for GHSA-h7w8-xr72-cv4r (#3325)
• 16de743 fix(storage): populate timestamp in ReadUserTuple for SQL datastores (#3194)
• b74685e feat[mysql-storage]: added secondary db support in mysql to use read replicas...
• d24bb72 chore: add missing go:generate mockgen directives (#3321)
• b30d537 chore(security): bump google.golang.org/grpc to v1.83.2 (GO-2026-6443) (#3317)
• See full diff in compare view

Updates golang.org/x/term from 0.46.0 to 0.47.0

Commits

• 0851034 go.mod: update golang.org/x dependencies
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8c08b4db-3065-49c4-8efe-8fca288e44ca

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​openfga/​openfga@​v1.21.0 ⏵ v1.22.0	+1
	golang.org/​x/​term@​v0.46.0 ⏵ v0.47.0

View full report