Changelog

Features

• 5892c8f: feat(ext): serialize isoneof constraint values as YAML lists (#6072) (@jgaul3)
• 028f10f: feat(ui): allow copying flags across environments (#5772) (@AnouarMohamed)
• e4d1013: feat(ui): allow user to customize PR title (#6123) (@jgaul3)
• a60df67: feat(ui): move revision tracking from per-entity to per-environment transport layer (#6108) (@erka)
• 8c1d341: feat(ui): show flags referencing segment (#6145) (@ahfoysal)

Bug Fixes

• 2ba7835: fix(build): order release preparation tasks (#6219) (@markphelps)
• a01f91b: fix(evaluation): gate metrics recording behind WithMetrics option (#6042) (@erka)
• 46b0463: fix(git): retry non-fast-forward update errors (#6207) (@jgaul3)
• cc66536: fix(redis): route go-redis internal logs through zap (#6132) (@erka)
• af83034: fix(server): downgrade 'authentication required' gRPC log to WARN (#6198) (@mvanhorn)
• cbcbb8e: fix(storage): add namespace ETag support across multiple files (#6041) (@erka)
• 1fabb3a: fix(ui): lazy init useState in MetadataForm and CopyToNamespacePanel (#6171) (@erka)
• 0f8b428: fix(ui): use per-query revision instead of global localStorage revision (#6106) (@jgaul3)
• 0a0110c: fix: patch container and docker dependency CVEs (#6163) (@markphelps)

Other

• 0cf302a: Update funding information in FUNDING.yml (@markphelps)
• ebfb4bf: chore(deps): bump @codemirror/lint from 6.9.6 to 6.9.7 in /ui (#6026) (@dependabot[bot])
• f712d53: chore(deps): bump @codemirror/search from 6.7.0 to 6.7.1 in /ui (#6067) (@dependabot[bot])
• e0f4a8f: chore(deps): bump @codemirror/state from 6.6.0 to 6.7.0 in /ui (#6098) (@dependabot[bot])
• c660605: chore(deps): bump @codemirror/view from 6.43.0 to 6.43.1 in /ui (#6069) (@dependabot[bot])
• 6d5e6ea: chore(deps): bump @codemirror/view from 6.43.1 to 6.43.5 in /ui (#6140) (@dependabot[bot])
• 591620f: chore(deps): bump @codemirror/view from 6.43.5 to 6.43.6 in /ui (#6175) (@dependabot[bot])
• d2f4345: chore(deps): bump @radix-ui/react-avatar from 1.1.12 to 1.2.1 in /ui (#6100) (@dependabot[bot])
• ce619aa: chore(deps): bump @radix-ui/react-avatar from 1.2.1 to 1.2.2 in /ui (#6177) (@dependabot[bot])
• 14dc993: chore(deps): bump @radix-ui/react-dialog from 1.1.15 to 1.1.16 in /ui (#6028) (@dependabot[bot])
• fa7846f: chore(deps): bump @radix-ui/react-dialog from 1.1.16 to 1.1.17 in /ui (#6062) (@dependabot[bot])
• e42d967: chore(deps): bump @radix-ui/react-dialog from 1.1.18 to 1.1.19 in /ui (#6176) (@dependabot[bot])
• 3c7ae9f: chore(deps): bump @radix-ui/react-dropdown-menu in /ui (#6027) (@dependabot[bot])
• 88139bf: chore(deps): bump @radix-ui/react-slot from 1.2.4 to 1.2.5 in /ui (#6029) (@dependabot[bot])
• 5f849f7: chore(deps): bump @radix-ui/react-switch from 1.3.0 to 1.3.1 in /ui (#6064) (@dependabot[bot])
• 8f9a236: chore(deps): bump @uiw/react-codemirror from 4.25.10 to 4.25.11 in /ui (#6178) (@dependabot[bot])
• 784928a: chore(deps): bump actions/checkout from 6 to 7 (#6061) (@dependabot[bot])
• 53a452e: chore(deps): bump alpine from 3.23.4 to 3.24.0 in /build (#6024) (@dependabot[bot])
• c96e8b8: chore(deps): bump alpine from 3.24.0 to 3.24.1 in /build (#6060) (@dependabot[bot])
• 29d7781: chore(deps): bump code.gitea.io/sdk/gitea from 0.24.1 to 0.25.1 (#6103) (@dependabot[bot])
• d1724cf: chore(deps): bump cuelang.org/go from 0.16.1 to 0.17.0 (#6184) (@dependabot[bot])
• 3d9076e: chore(deps): bump esbuild, @vitejs/plugin-react and vite in /ui (#6020) (@dependabot[bot])
• 005d5c0: chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity (#6105) (@dependabot[bot])
• 35be099: chore(deps): bump github.com/ClickHouse/clickhouse-go/v2 (#6181) (@dependabot[bot])
• 3cfe9d3: chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.12 to 1.42.0 (#6030) (@dependabot[bot])
• 79b12ab: chore(deps): bump github.com/aws/aws-sdk-go-v2/config (#6031) (@dependabot[bot])
• 2de8696: chore(deps): bump github.com/aws/aws-sdk-go-v2/config (#6141) (@dependabot[bot])
• a006e04: chore(deps): bump github.com/aws/aws-sdk-go-v2/config (#6180) (@dependabot[bot])
• f79e2a9: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (#6032) (@dependabot[bot])
• ed5a7d0: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (#6070) (@dependabot[bot])
• dc908b8: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (#6193) (@dependabot[bot])
• 11a8de6: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/secretsmanager (#6102) (@dependabot[bot])
• 6fca3e3: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/secretsmanager from 1.42.4 to 1.43.0 (#6196) (@dependabot[bot])
• 53d6aab: chore(deps): bump github.com/coreos/go-oidc/v3 from 3.18.0 to 3.19.0 (#6135) (@dependabot[bot])
• 4e4adad: chore(deps): bump github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1 (#6183) (@dependabot[bot])
• a5deaf3: chore(deps): bump github.com/go-openapi/jsonpointer (#6195) (@dependabot[bot])
• 9ce5501: chore(deps): bump github.com/jferrl/go-githubauth from 1.6.0 to 1.7.0 (#6197) (@dependabot[bot])
• aaf7d12: chore(deps): bump github.com/ktrysmt/go-bitbucket from 0.9.100 to 0.10.0 (#6134) (@dependabot[bot])
• 45a0153: chore(deps): bump github.com/kubescape/go-git-url from 0.0.31 to 0.0.32 (#6104) (@dependabot[bot])
• f94e213: chore(deps): bump github.com/open-policy-agent/opa from 1.14.1 to 1.17.1 (#6033) (@dependabot[bot])
• cb9fad6: chore(deps): bump github.com/open-policy-agent/opa from 1.17.1 to 1.18.2 (#6200) (@dependabot[bot])
• 3fef45b: chore(deps): bump github.com/prometheus/common from 0.67.5 to 0.69.0 (#6097) (@dependabot[bot])
• 5f00d70: chore(deps): bump github.com/prometheus/common from 0.69.0 to 0.70.0 (#6182) (@dependabot[bot])
• 89f3f5e: chore(deps): bump github.com/redis/go-redis/extra/redisotel/v9 (#6065) (@dependabot[bot])
• 6f0adf3: chore(deps): bump gocloud.dev from 0.45.0 to 0.46.0 (#6194) (@dependabot[bot])
• 84e71b0: chore(deps): bump golang.org/x/net from 0.43.0 to 0.55.0 in /core (#6128) (@dependabot[bot])
• dd4122a: chore(deps): bump golang.org/x/net from 0.48.0 to 0.55.0 in /sdk/go (#6129) (@dependabot[bot])
• abd04a3: chore(deps): bump golang.org/x/net in /rpc/v2/environments (#6144) (@dependabot[bot])
• d542a49: chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 (#6063) (@dependabot[bot])
• 71055f9: chore(deps): bump google.golang.org/api from 0.275.0 to 0.284.0 (#6034) (@dependabot[bot])
• 2952621: chore(deps): bump google.golang.org/api from 0.284.0 to 0.286.0 (#6071) (@dependabot[bot])
• 765ad43: chore(deps): bump google.golang.org/api from 0.286.0 to 0.288.0 (#6199) (@dependabot[bot])
• 840d413: chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 (#6143) (@dependabot[bot])
• 22b8203: chore(deps): bump google.golang.org/grpc in the grpc group (#6216) (@dependabot[bot])
• 5797837: chore(deps): bump react and @types/react in /ui (#6099) (@dependabot[bot])
• 1ef3558: chore(deps): bump react-router from 7.17.0 to 7.18.1 in /ui (#6136) (@dependabot[bot])
• d7f9593: chore(deps): bump the aws-sdk-go-v2 group with 3 updates (#6215) (@dependabot[bot])
• 278f84c: chore(deps): bump the codemirror group in /ui with 2 updates (#6188) (@dependabot[bot])
• 4b022f2: chore(deps): update grpc, gateway, genproto, x/net, x/crypto and oidc to latest (#6167) (@erka)
• eee7845: chore(deps): upgrade build tooling to Node 24 (#6073) (@markphelps)
• 1053341: chore(deps-dev): bump @playwright/test from 1.60.0 to 1.61.1 in /ui (#6096) (@dependabot[bot])
• c043e31: chore(deps-dev): bump @tailwindcss/vite from 4.3.0 to 4.3.1 in /ui (...

Changelog

Features

• 1bb4f9b: feat(constraints): add bulk edit mode for constraints (#6017) (@jgaul3)
• 95b8f4d: feat(stream): skip sending snapshot when client digest matches (#5909) (@erka)

Bug Fixes

• 2e76ab2: fix: correct typos in error type and authentication config comments (#5937) (@immanuwell)
• a67ffbe: fix(authn): fix JSON struct tag typo in kubernetes auth claims (#5908) (@erka)
• 5501904: fix(config): disable profiling diagnostics by default (#5991) (@erka)
• 9ebef94: fix(credentials): preserve non-default SSH ports in remote URLs (#5945) (@immanuwell)
• 7478088: fix(evaluation): refactor number constraint evaluation to use nil checks consistently (#6018) (@erka)
• dba660d: fix(ofrep): new SSE event stream endpoint and conditional request support (#5957) (@erka)
• 61aa322: fix(ofrep): use correct EventStream.endpoint struct + etag for bulk (#5669) (@erka)
• 3790369: fix(openapi): improve openapi generation (#5823) (@erka)
• 466e094: fix(stream): don't suppress digest reverts in snapshot stream (#5923) (@immanuwell)
• f5bf5e9: fix(streaming): deprecate name and description in evaluation snapshot (#5990) (@erka)
• 8e94ba0: fix(v2): openapi inject missing schemas into gnostic generator (#5825) (@erka)

Other

• 527a520: Allow camel cases in flag keys in the UI (#5917) (@keshane)
• ed86674: chore: release v2.10.0 (#6019) (@markphelps)
• 3b54c70: chore: upgrade dagger to v0.21.0 (#5926) (@erka)
• a41e05a: chore(deps-dev): bump @babel/plugin-transform-modules-systemjs in /ui (#5826) (@dependabot[bot])
• 95fc9c6: chore(deps-dev): bump @babel/preset-typescript in /ui (#5955) (@dependabot[bot])
• be415a4: chore(deps-dev): bump @playwright/test from 1.59.1 to 1.60.0 in /ui (#5875) (@dependabot[bot])
• 2499ead: chore(deps-dev): bump @tailwindcss/vite from 4.2.2 to 4.2.4 in /ui (#5790) (@dependabot[bot])
• a75ea44: chore(deps-dev): bump @tailwindcss/vite from 4.2.4 to 4.3.0 in /ui (#5844) (@dependabot[bot])
• 0f17ccf: chore(deps-dev): bump @types/react from 19.2.14 to 19.2.15 in /ui (#5900) (@dependabot[bot])
• c7d6fb3: chore(deps-dev): bump eslint-plugin-prettier from 5.5.5 to 5.5.6 in /ui (#5952) (@dependabot[bot])
• b879fd2: chore(deps-dev): bump jest-environment-jsdom in /ui (#5845) (@dependabot[bot])
• 0a8eced: chore(deps-dev): bump postcss from 8.5.10 to 8.5.12 in /ui (#5787) (@dependabot[bot])
• 0ca3031: chore(deps-dev): bump postcss from 8.5.12 to 8.5.13 in /ui (#5812) (@dependabot[bot])
• 4a85b2c: chore(deps-dev): bump postcss from 8.5.13 to 8.5.14 in /ui (#5846) (@dependabot[bot])
• 32185eb: chore(deps-dev): bump postcss from 8.5.14 to 8.5.15 in /ui (#5902) (@dependabot[bot])
• dc799c0: chore(deps-dev): bump prettier-plugin-tailwindcss in /ui (#5789) (@dependabot[bot])
• ff890fe: chore(deps-dev): bump prettier-plugin-tailwindcss in /ui (#5811) (@dependabot[bot])
• 260c67a: chore(deps-dev): bump tailwindcss from 4.2.2 to 4.2.4 in /ui (#5783) (@dependabot[bot])
• cfde662: chore(deps-dev): bump tailwindcss from 4.2.4 to 4.3.0 in /ui (#5842) (@dependabot[bot])
• 083cb46: chore(deps-dev): bump ts-jest from 29.4.9 to 29.4.11 in /ui (#5901) (@dependabot[bot])
• 28b9a38: chore(deps): bump @codemirror/lint from 6.9.5 to 6.9.6 in /ui (#5949) (@dependabot[bot])
• 5d0602e: chore(deps): bump @codemirror/search from 6.6.0 to 6.7.0 in /ui (#5788) (@dependabot[bot])
• 6607e40: chore(deps): bump @codemirror/view from 6.41.1 to 6.42.1 in /ui (#5843) (@dependabot[bot])
• 53db85c: chore(deps): bump @codemirror/view from 6.42.1 to 6.43.0 in /ui (#5878) (@dependabot[bot])
• d3c0e7c: chore(deps): bump @radix-ui/react-avatar from 1.1.11 to 1.1.12 in /ui (#5982) (@dependabot[bot])
• 2e19dea: chore(deps): bump @radix-ui/react-popover from 1.1.15 to 1.1.16 in /ui (#5984) (@dependabot[bot])
• d7815ee: chore(deps): bump @radix-ui/react-separator from 1.1.8 to 1.1.9 in /ui (#5981) (@dependabot[bot])
• 8cc2ae6: chore(deps): bump @radix-ui/react-switch from 1.2.6 to 1.3.0 in /ui (#5985) (@dependabot[bot])
• aaf93fd: chore(deps): bump @reduxjs/toolkit from 2.11.2 to 2.12.0 in /ui (#5903) (@dependabot[bot])
• 875e560: chore(deps): bump @uiw/codemirror-theme-tokyo-night in /ui (#5948) (@dependabot[bot])
• d5466a8: chore(deps): bump @uiw/react-codemirror from 4.25.9 to 4.25.10 in /ui (#5899) (@dependabot[bot])
• a5856b2: chore(deps): bump actions/checkout from 4 to 6 (#5947) (@dependabot[bot])
• 3c9d398: chore(deps): bump cloud.google.com/go/secretmanager (#5814) (@dependabot[bot])
• 1ac9867: chore(deps): bump codecov/codecov-action from 6 to 7 (#5980) (@dependabot[bot])
• eb52813: chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.5 to 1.41.6 (#5791) (@dependabot[bot])
• cfbfb36: chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.6 to 1.41.7 (#5813) (@dependabot[bot])
• 6f06360: chore(deps): bump github.com/aws/aws-sdk-go-v2/config (#5847) (@dependabot[bot])
• 1e5d714: chore(deps): bump github.com/aws/aws-sdk-go-v2/config (#5904) (@dependabot[bot])
• cdf33fd: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (#5851) (@dependabot[bot])
• b3f8946: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/secretsmanager (#5879) (@dependabot[bot])
• 3673743: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/secretsmanager (#5986) (@dependabot[bot])
• e930076: chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azcore (#5987) (@dependabot[bot])
• 287324e: chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets from 1.4.0 to 1.5.0 (#5951) (@dependabot[bot])
• 0c94acd: chore(deps): bump github.com/ClickHouse/clickhouse-go/v2 (#5782) (@dependabot[bot])
• 4df0cd9: chore(deps): bump github.com/ClickHouse/clickhouse-go/v2 (#5872) (@dependabot[bot])
• 7b94d80: chore(deps): bump github.com/go-chi/chi/v5 from 5.2.5 to 5.3.0 (#5953) (@dependabot[bot])
• 0def52e: chore(deps): bump github.com/go-git/go-billy/v6 in /core (#5862) (@dependabot[bot])
• f473e49: chore(deps): bump github.com/go-git/go-git/v6 from 6.0.0-alpha.2 to 6.0.0-alpha.4 (#5885) (@dependabot[bot])
• 88f40b4: chore(deps): bump github.com/go-openapi/jsonpointer (#5785) (@dependabot[bot])
• a0f9803: chore(deps): bump github.com/hashicorp/cap from 0.12.0 to 0.13.0 (#5815) (@dependabot[bot])
• 88c1197: chore(deps): bump github.com/jferrl/go-githubauth from 1.5.1 to 1.6.0 (#5786) (@dependabot[bot])
• 2a94313: chore(deps): bump github.com/ktrysmt/go-bitbucket from 0.9.95 to 0.9.100 (#5809) (@dependabot[bot])
• 003d1b0: chore(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22 (#5849) (@dependabot[bot])
• b8a9cc8: chore(deps): bump github.com/redis/go-redis/extra/redisotel/v9 (#5988) (@dependabot[bot])
• 5cd4f48: chore(deps): bump github.com/redis/go-redis/v9 from 9.18.0 to 9.19.0 (#5848) (@dependabot[bot])
• 503a701: chore(deps): bump github.com/testcontainers/testcontainers-go from 0.41.0 to 0.42.0 (#5784) (@dependabot[bot])
• 0b6c25e: chore(deps): bump go.opentelemetry.io/otel in /sdk/go (#5777) (@dependabot[bot])
• d883b1a: chore(deps): bump go.opentelemetry.io/otel in /sdk/go/v2 (#5776) (@dependabot[bot])
• 02616c4: chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 (#5898) (@dependabot[bot])
• 86632ae: chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 (#5905) (@dependabot[bot])
• 53e4cce: chore(deps): bump golang.org/x/term from 0.42.0 to 0.43.0 (#5873) (@dependabot[bot])
• a36adde: chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0 (#5850) (@dependabot[bot])
• d184f76: chore(deps): bump react-dom from 19.2.5 to 19.2.6 in...

Changelog

Features

• 2917a74: feat(license): support configurable machine fingerprint for containers (#5427) (@markphelps)
• 7507f24: feat(secrets): add AWS Secrets Manager provider (#5411) (@markphelps)
• 0d039fd: feat(secrets): add Azure Key Vault provider (#5428) (@markphelps)
• 0b24646: feat(secrets): add GCP Secret Manager provider (#5404) (@markphelps)
• 78d53c3: feat: add devcontainer setup for Flipt v2 development (#5542) (@markphelps)
• 0f8b6d0: feat: implement SSE for real-time UI and ofrep evaluation updates (#5617) (@erka)
• dd02c14: feat: normalize rollout distribution buckets (#5581) (@erka)
• eddfb54: feat: publish v2 protobufs to buf.io/v2 (#5589) (@markphelps)

Bug Fixes

• 3462b64: fix(authn): add HttpOnly and Secure attrs when clearing auth cookies (#5655) (@erka)
• 787fb07: fix(authn): forward state and token cookies to distinct metadata keys (#5479) (@erka)
• a146a1c: fix(authn): oauth pcke challenge for github and a correct oidc nonce (#5647) (@erka)
• 5f76d22: fix(authn): use UserInfo claims as fallback for missing OIDC fields (#5692) (@erka)
• 2b10714: fix(ci): bump Go version to 1.26 in nightly release workflow (#5407) (@markphelps)
• 2048b01: fix(config): relax schema to allow installation_id from environment vars (#5425) (@erka)
• 4403ac4: fix(sdk): add Content-Type header and improve error messages in generated HTTP client (#5560) (@erka)
• ac78eea: fix(ui): Toggle remove bg-brand class for unchecked state (#5430) (@naftali100)
• 660efb9: fix(ui): sanitize generated keys and show key validation errors on first edit (#5434) (@erka)
• 1dbb161: fix(ui): skip API environments calls and SSE stream when user is not authenticated (#5670) (@erka)
• 2a8dc05: fix(ui): use 0 as default threshold percentage in quick edit form (#5408) (@erka)
• 047693e: fix: address CodeQL warning about insecure TLS configuration (#5614) (@erka)
• fc7fec7: fix: bump node version from 18 to 20 in CI workflows (#5501) (@markphelps)
• c970ef1: fix: preserve trailing separators in key generation (#5594) (@markphelps)
• 04a99ca: fix: set EnvironmentKey on evaluation requests in environment integration tests (#5499) (@markphelps)
• c185679: fix: snapshot publisher subs and correct constraint short-circuiting (#5565) (@erka)

Other

• c4dd764: Revise pricing for licenses in README (@markphelps)
• aecd740: build: update goreleaser to v2.14 and fix quill/dockerfile paths (#5588) (@erka)
• ee21988: chore(deps): bump @codemirror/lint from 6.9.4 to 6.9.5 in /ui (#5607) (@dependabot[bot])
• 09fa42b: chore(deps): bump @codemirror/view from 6.39.11 to 6.39.15 in /ui (#5417) (@dependabot[bot])
• a0f07da: chore(deps): bump @codemirror/view from 6.39.15 to 6.39.16 in /ui (#5532) (@dependabot[bot])
• d57ef45: chore(deps): bump @codemirror/view from 6.39.16 to 6.40.0 in /ui (#5574) (@dependabot[bot])
• dcac005: chore(deps): bump @codemirror/view from 6.40.0 to 6.41.0 in /ui (#5680) (@dependabot[bot])
• 2aa34b3: chore(deps): bump @codemirror/view from 6.41.0 to 6.41.1 in /ui (#5757) (@dependabot[bot])
• e8b746f: chore(deps): bump @mui/material from 7.3.8 to 7.3.9 in /ui (#5525) (@dependabot[bot])
• b22c35f: chore(deps): bump @mui/x-charts from 8.27.0 to 8.27.4 in /ui (#5526) (@dependabot[bot])
• 650f89e: chore(deps): bump @mui/x-charts from 8.27.4 to 8.27.5 in /ui (#5572) (@dependabot[bot])
• 4a5dcaf: chore(deps): bump @mui/x-charts from 8.27.5 to 8.28.0 in /ui (#5606) (@dependabot[bot])
• c2c288b: chore(deps): bump @mui/x-charts from 8.28.0 to 8.28.2 in /ui (#5681) (@dependabot[bot])
• 99d6101: chore(deps): bump @tootallnate/once and jest-environment-jsdom in /ui (#5478) (@dependabot[bot])
• 6fec5f3: chore(deps): bump @uiw/codemirror-theme-tokyo-night in /ui (#5470) (@dependabot[bot])
• 792e85a: chore(deps): bump @uiw/codemirror-theme-tokyo-night in /ui (#5571) (@dependabot[bot])
• 2e0e3ed: chore(deps): bump @uiw/codemirror-theme-tokyo-night in /ui (#5636) (@dependabot[bot])
• 538d8a7: chore(deps): bump @uiw/react-codemirror from 4.25.4 to 4.25.5 in /ui (#5469) (@dependabot[bot])
• d3cdea1: chore(deps): bump @uiw/react-codemirror from 4.25.5 to 4.25.8 in /ui (#5573) (@dependabot[bot])
• 0aea5d5: chore(deps): bump @uiw/react-codemirror from 4.25.8 to 4.25.9 in /ui (#5634) (@dependabot[bot])
• 29442dc: chore(deps): bump actions/create-github-app-token from 2 to 3 (#5566) (@dependabot[bot])
• 35dbdb6: chore(deps): bump actions/download-artifact from 7 to 8 (#5463) (@dependabot[bot])
• 6211058: chore(deps): bump actions/github-script from 8 to 9 (#5720) (@dependabot[bot])
• e592577: chore(deps): bump actions/upload-artifact from 6 to 7 (#5462) (@dependabot[bot])
• c7e04e6: chore(deps): bump alpine from 3.23.3 to 3.23.4 in /build (#5751) (@dependabot[bot])
• eb0cb71: chore(deps): bump cloud.google.com/go/secretmanager (#5677) (@dependabot[bot])
• f77c7d0: chore(deps): bump code.gitea.io/sdk/gitea from 0.23.2 to 0.24.1 (#5630) (@dependabot[bot])
• 45d98a5: chore(deps): bump codecov/codecov-action from 5 to 6 (#5628) (@dependabot[bot])
• 4c55040: chore(deps): bump cuelang.org/go from 0.15.4 to 0.16.0 (#5530) (@dependabot[bot])
• db200c7: chore(deps): bump cuelang.org/go from 0.16.0 to 0.16.1 (#5726) (@dependabot[bot])
• 2ebdf22: chore(deps): bump docker/login-action from 3 to 4 (#5522) (@dependabot[bot])
• a07b735: chore(deps): bump docker/setup-buildx-action from 3 to 4 (#5521) (@dependabot[bot])
• 847e33d: chore(deps): bump docker/setup-qemu-action from 3 to 4 (#5523) (@dependabot[bot])
• f4b8694: chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azcore (#5467) (@dependabot[bot])
• 831b5ac: chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azcore (#5758) (@dependabot[bot])
• 69cf928: chore(deps): bump github.com/ProtonMail/go-crypto from 1.3.0 to 1.4.0 (#5465) (@dependabot[bot])
• 54c0736: chore(deps): bump github.com/ProtonMail/go-crypto from 1.4.0 to 1.4.1 (#5629) (@dependabot[bot])
• d940f16: chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.3 to 1.41.4 (#5575) (@dependabot[bot])
• 0d004b9: chore(deps): bump github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream (#5694) (@dependabot[bot])
• 9560dd3: chore(deps): bump github.com/aws/aws-sdk-go-v2/config (#5466) (@dependabot[bot])
• 4c1a19c: chore(deps): bump github.com/aws/aws-sdk-go-v2/config (#5610) (@dependabot[bot])
• b1280c9: chore(deps): bump github.com/aws/aws-sdk-go-v2/config (#5637) (@dependabot[bot])
• dcc8395: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (#5533) (@dependabot[bot])
• ffac1f9: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (#5701) (@dependabot[bot])
• b490116: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/secretsmanager (#5464) (@dependabot[bot])
• b97da9d: chore(deps): bump github.com/coreos/go-oidc/v3 from 3.17.0 to 3.18.0 (#5752) (@dependabot[bot])
• 25005a8: chore(deps): bump github.com/docker/cli (#5481) (@dependabot[bot])
• a46c7eb: chore(deps): bump github.com/docker/go-connections from 0.6.0 to 0.7.0 (#5756) (@dependabot[bot])
• 1c199c1: chore(deps): bump github.com/fatih/color from 1.18.0 to 1.19.0 (#5611) (@dependabot[bot])
• 838efea: chore(deps): bump github.com/go-git/go-git/v6 from 6.0.0-20260216160506-e6a3f881772f to 6.0.0-alpha.1 (#5675) (@dependabot[bot])
• ee47d2f: chore(deps): bump github.com/go-git/go-git/v6 from 6.0.0-alpha.1 to 6.0.0-alpha.2 (#5746) (@dependabot[bot])
• ac4c478: chore(deps): bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5 (#5657) (@dependabot[bot])
• f783b94:...

Changelog

Features

• 2917a74: feat(license): support configurable machine fingerprint for containers (#5427) (@markphelps)
• 7507f24: feat(secrets): add AWS Secrets Manager provider (#5411) (@markphelps)
• 0d039fd: feat(secrets): add Azure Key Vault provider (#5428) (@markphelps)
• 0b24646: feat(secrets): add GCP Secret Manager provider (#5404) (@markphelps)

Bug Fixes

• 787fb07: fix(authn): forward state and token cookies to distinct metadata keys (#5479) (@erka)
• 2b10714: fix(ci): bump Go version to 1.26 in nightly release workflow (#5407) (@markphelps)
• 2048b01: fix(config): relax schema to allow installation_id from environment vars (#5425) (@erka)
• ac78eea: fix(ui): Toggle remove bg-brand class for unchecked state (#5430) (@naftali100)
• 660efb9: fix(ui): sanitize generated keys and show key validation errors on first edit (#5434) (@erka)
• 2a8dc05: fix(ui): use 0 as default threshold percentage in quick edit form (#5408) (@erka)
• fc7fec7: fix: bump node version from 18 to 20 in CI workflows (#5501) (@markphelps)
• 04a99ca: fix: set EnvironmentKey on evaluation requests in environment integration tests (#5499) (@markphelps)

Other

• 8d0529c: Merge branch 'v2' into release/v2.8.0 (@markphelps)
• 09fa42b: chore(deps): bump @codemirror/view from 6.39.11 to 6.39.15 in /ui (#5417) (@dependabot[bot])
• 99d6101: chore(deps): bump @tootallnate/once and jest-environment-jsdom in /ui (#5478) (@dependabot[bot])
• 6fec5f3: chore(deps): bump @uiw/codemirror-theme-tokyo-night in /ui (#5470) (@dependabot[bot])
• 538d8a7: chore(deps): bump @uiw/react-codemirror from 4.25.4 to 4.25.5 in /ui (#5469) (@dependabot[bot])
• 35dbdb6: chore(deps): bump actions/download-artifact from 7 to 8 (#5463) (@dependabot[bot])
• e592577: chore(deps): bump actions/upload-artifact from 6 to 7 (#5462) (@dependabot[bot])
• f4b8694: chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azcore (#5467) (@dependabot[bot])
• 69cf928: chore(deps): bump github.com/ProtonMail/go-crypto from 1.3.0 to 1.4.0 (#5465) (@dependabot[bot])
• 9560dd3: chore(deps): bump github.com/aws/aws-sdk-go-v2/config (#5466) (@dependabot[bot])
• b490116: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/secretsmanager (#5464) (@dependabot[bot])
• 25005a8: chore(deps): bump github.com/docker/cli (#5481) (@dependabot[bot])
• ca340bf: chore(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 (#5422) (@dependabot[bot])
• 602d823: chore(deps): bump github.com/ktrysmt/go-bitbucket from 0.9.91 to 0.9.93 (#5419) (@dependabot[bot])
• cafe15b: chore(deps): bump github.com/ktrysmt/go-bitbucket from 0.9.93 to 0.9.94 (#5461) (@dependabot[bot])
• 4dde011: chore(deps): bump github.com/open-policy-agent/opa from 1.13.1 to 1.13.2 (#5415) (@dependabot[bot])
• 129add5: chore(deps): bump github.com/redis/go-redis/extra/redisotel/v9 (#5421) (@dependabot[bot])
• 4405de7: chore(deps): bump github.com/redis/go-redis/v9 from 9.17.3 to 9.18.0 (#5418) (@dependabot[bot])
• eac1bb0: chore(deps): bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 in /sdk/go/v2 (#5436) (@dependabot[bot])
• ffb4a67: chore(deps): bump google.golang.org/protobuf v1.36.9 to v1.36.11 (#5412) (@erka)
• 927e347: chore(deps): bump goreleaser/goreleaser-action from 6 to 7 (#5414) (@dependabot[bot])
• 0f1741a: chore(deps): bump lucide-react from 0.564.0 to 0.575.0 in /ui (#5416) (@dependabot[bot])
• d6db2df: chore(deps): bump react-router from 7.13.0 to 7.13.1 in /ui (#5471) (@dependabot[bot])
• 4fc0b65: chore(deps): bump rollup from 4.41.1 to 4.59.0 in /ui (#5431) (@dependabot[bot])
• cbb5543: chore(deps): security updates in build/go and sdk/go modules (#5438) (@erka)
• 30d966b: chore(deps-dev): bump @tailwindcss/vite from 4.1.18 to 4.2.0 in /ui (#5424) (@dependabot[bot])
• 687a358: chore(deps-dev): bump knip from 5.83.1 to 5.85.0 in /ui (#5423) (@dependabot[bot])
• b6de905: chore(deps-dev): bump minimatch from 3.1.2 to 3.1.5 in /ui (#5437) (@dependabot[bot])
• 83ff56c: chore(deps-dev): bump tailwindcss from 4.1.18 to 4.2.0 in /ui (#5420) (@dependabot[bot])
• 641754c: chore(ui): migrate to React.ComponentRef and cleanup (#5435) (@erka)
• 7b808e8: chore: release v2.8.0 (@markphelps)
• 48846d8: chore: update changelog for v2.8.0 with recent v2 commits (@markphelps)
• e7d6790: docs: update README to reflect cloud secrets provider support (@markphelps)

Installation

Docker Images 🐳

  docker pull docker.flipt.io/flipt/flipt:v2.8.0

  docker pull ghcr.io/flipt-io/flipt:v2.8.0

Thank you!

We hope you ❤️ this release! Feel free to open issues/discussions or reach out to us on Discord if you have any questions or feedback.

• Discord
• Github Discussions
• Github Issues
• Website

Changelog

Features

• 3fef0d1: feat(metrics): add Git sync observability metrics to feature flag backend (#4673) (@rohitnarayan)

Bug Fixes

• 4f42a5c: fix(authn): forward state and token cookies to distinct metadata keys (#5480) (@erka)
• 3a77d15: fix(evaluation): add segments to the boolean evaluation response (#4765) (@erka)
• 600d55d: fix(deps): update aws-sdk-go-v2 monorepo (#4833) (@renovate[bot])
• 4821900: fix(deps): update aws-sdk-go-v2 monorepo (#4902) (@renovate[bot])
• b6ef413: fix(deps): update aws-sdk-go-v2 monorepo (#4931) (@renovate[bot])
• 96cdbb3: fix(deps): update aws-sdk-go-v2 monorepo (#4938) (@renovate[bot])
• 2afa79d: fix(deps): update aws-sdk-go-v2 monorepo (#4974) (@renovate[bot])
• 97c0031: fix(deps): update aws-sdk-go-v2 monorepo (#4997) (@renovate[bot])
• d014ecc: fix(deps): update aws-sdk-go-v2 monorepo (#5029) (@renovate[bot])
• a76f996: fix(deps): update aws-sdk-go-v2 monorepo (#5034) (@renovate[bot])
• 3f84b8b: fix(deps): update aws-sdk-go-v2 monorepo (#5056) (@renovate[bot])
• c4bf640: fix(deps): update aws-sdk-go-v2 monorepo (#5068) (@renovate[bot])
• 23ddffb: fix(deps): update aws-sdk-go-v2 monorepo (#5093) (@renovate[bot])
• 2721e69: fix(deps): update aws-sdk-go-v2 monorepo (#5122) (@renovate[bot])
• 03f5921: fix(deps): update aws-sdk-go-v2 monorepo (#5159) (@renovate[bot])
• e8f0c6e: fix(deps): update aws-sdk-go-v2 monorepo (#5170) (@renovate[bot])
• bd81f3f: fix(deps): update aws-sdk-go-v2 monorepo (#5206) (@renovate[bot])
• 7e75de7: fix(deps): update aws-sdk-go-v2 monorepo (#5252) (@renovate[bot])
• acb2b95: fix(deps): update aws-sdk-go-v2 monorepo (#5446) (@renovate[bot])
• bd58630: fix(deps): update aws-sdk-go-v2 monorepo (#5484) (@renovate[bot])
• 70bee0f: fix(deps): update dependency @codemirror/view to v6.38.1 (#4616) (@renovate[bot])
• 5a378de: fix(deps): update dependency @codemirror/view to v6.38.2 (#4690) (@renovate[bot])
• 1242db2: fix(deps): update dependency @fortawesome/react-fontawesome to v0.2.6 (#4617) (@renovate[bot])
• cdc2bfd: fix(deps): update dependency @reduxjs/toolkit to v2.9.0 (#4691) (@renovate[bot])
• c0c7085: fix(deps): update dependency @uiw/codemirror-theme-tokyo-night to v4.25.1 (#4647) (@renovate[bot])
• c8eb40d: fix(deps): update dependency @uiw/react-codemirror to v4.25.1 (#4648) (@renovate[bot])
• a7677c5: fix(deps): update dependency lucide-react to ^0.542.0 (#4649) (@renovate[bot])
• 6790974: fix(deps): update dependency lucide-react to ^0.543.0 (#4718) (@renovate[bot])
• f1e9d2a: fix(deps): update dependency lucide-react to ^0.544.0 (#4834) (@renovate[bot])
• 0f77b5d: fix(deps): update dependency lucide-react to ^0.545.0 (#4860) (@renovate[bot])
• 96fcf89: fix(deps): update dependency lucide-react to ^0.546.0 (#4903) (@renovate[bot])
• ff19fbf: fix(deps): update dependency lucide-react to ^0.548.0 (#4944) (@renovate[bot])
• e83b0ee: fix(deps): update dependency lucide-react to ^0.552.0 (#4976) (@renovate[bot])
• 7661b67: fix(deps): update dependency lucide-react to ^0.553.0 (#5010) (@renovate[bot])
• e044b01: fix(deps): update dependency lucide-react to ^0.554.0 (#5045) (@renovate[bot])
• aace2ec: fix(deps): update dependency lucide-react to ^0.555.0 (#5096) (@renovate[bot])
• 18a0955: fix(deps): update dependency lucide-react to ^0.556.0 (#5137) (@renovate[bot])
• 3b75443: fix(deps): update dependency lucide-react to ^0.559.0 (#5172) (@renovate[bot])
• dff2fc2: fix(deps): update dependency lucide-react to ^0.560.0 (#5174) (@renovate[bot])
• 6b209d6: fix(deps): update dependency lucide-react to ^0.561.0 (#5177) (@renovate[bot])
• f5e688d: fix(deps): update dependency lucide-react to ^0.562.0 (#5209) (@renovate[bot])
• 340e6e2: fix(deps): update dependency lucide-react to ^0.563.0 (#5310) (@renovate[bot])
• 448f2c0: fix(deps): update dependency lucide-react to ^0.575.0 (#5452) (@renovate[bot])
• a6d19d4: fix(deps): update dependency lucide-react to ^0.577.0 (#5486) (@renovate[bot])
• 14c206d: fix(deps): update dependency react-router to v7.8.2 (#4650) (@renovate[bot])
• 2384907: fix(deps): update dependency yup to v1.7.0 (#4651) (@renovate[bot])
• e378544: fix(deps): update dependency zod to v3.25.76 (#4625) (@renovate[bot])
• 72f2dbf: fix(deps): update github.com/open-policy-agent/contrib/logging/plugins/ozap digest to 0449b9c (#4642) (@renovate[bot])
• 62207f3: fix(deps): update github.com/open-policy-agent/contrib/logging/plugins/ozap digest to 072ce8a (#5066) (@renovate[bot])
• 563759a: fix(deps): update github.com/open-policy-agent/contrib/logging/plugins/ozap digest to 0f81d9a (#4685) (@renovate[bot])
• 7732ca9: fix(deps): update github.com/open-policy-agent/contrib/logging/plugins/ozap digest to 7262287 (#4624) (@renovate[bot])
• af5373a: fix(deps): update github.com/tursodatabase/libsql-client-go digest to 236aa1f (#5199) (@renovate[bot])
• 87d3e4b: fix(deps): update github.com/tursodatabase/libsql-client-go digest to b69dd6e (#5135) (@renovate[bot])
• 0565885: fix(deps): update golang.org/x/exp digest to 27f1f14 (#4829) (@renovate[bot])
• ddfe93a: fix(deps): update golang.org/x/exp digest to 3dfff04 (#5439) (@renovate[bot])
• 45b267a: fix(deps): update golang.org/x/exp digest to 716be56 (#5266) (@renovate[bot])
• 449e7b7: fix(deps): update golang.org/x/exp digest to 8475f28 (#5167) (@renovate[bot])
• 3a54866: fix(deps): update golang.org/x/exp digest to 87e1e73 (#5092) (@renovate[bot])
• ffc5475: fix(deps): update golang.org/x/exp digest to 90e834f (#4908) (@renovate[bot])
• d29502e: fix(deps): update golang.org/x/exp digest to 944ab1f (#5200) (@renovate[bot])
• 81a4125: fix(deps): update golang.org/x/exp digest to a4bb9ff (#4935) (@renovate[bot])
• 34388da: fix(deps): update golang.org/x/exp digest to d2f985d (#4876) (@renovate[bot])
• 85b1ee5: fix(deps): update golang.org/x/exp digest to df92998 (#4794) (@renovate[bot])
• c85bed8: fix(deps): update golang.org/x/exp digest to e25ba8c (#5036) (@renovate[bot])
• a05e265: fix(deps): update google.golang.org/genproto/googleapis/api digest to 0a764e5 (#5201) (@renovate[bot])
• 3087f30: fix(deps): update google.golang.org/genproto/googleapis/api digest to 3a174f9 (#4929) (@renovate[bot])
• 7540827: fix(deps): update google.golang.org/genproto/googleapis/api digest to 3f89685 (#5276) (@renovate[bot])
• 0273a8a: fix(deps): update google.golang.org/genproto/googleapis/api digest to 4626949 (#4897) (@renovate[bot])
• f1f2b3b: fix(deps): update google.golang.org/genproto/googleapis/api digest to 49b9836 (#4864) (@renovate[bot])
• 90eac39: fix(deps): update google.golang.org/genproto/googleapis/api digest to 546029d (#5353) (@renovate[bot])
• 15ce417: fix(deps): update google.golang.org/genproto/googleapis/api digest to 57b25ae (#4795) (@renovate[bot])
• a0d420f: fix(deps): update google.golang.org/genproto/googleapis/api digest to 65f7160 (#4858) (@renovate[bot])
• ecc3788: fix(deps): update google.golang.org/genproto/googleapis/api digest to 79d6a2a (#5088) (@renovate[bot])
• e6cb184: fix(deps): update google.golang.org/genproto/googleapis/api digest to 7c0ddcb (#4830) (@renovate[bot])
• 26ed1e0: fix(deps): update google.golang.org/genproto/googleapis/api digest to 83f4791 (#5023) (@renovate[bot])
• 438b527: fix(deps): update google.golang.org/genproto/googleapis/api digest to 8636f87 (#5323) (@renovate[bot])
• 294762d: fix(deps): update google.golang.org/genproto/googleapis/api digest to 88f65dc (#4923) (@renovate[bot])
• 52b82f2...

Changelog

Features

• f238264: feat(oidc): optionally merge userinfo claims into auth session (#5364) (@gzxu)
• c4446a8: feat(oidc): support configurable token signing algorithms (#5362) (@gzxu)
• 6b4811e: feat: Support SigV4 for analytics Prometheus storage (#5388) (@markphelps)
• 492ce41: feat: add GitHub App authentication support (#5327) (@erka)

Bug Fixes

• 8ac6346: fix(git): complete ref update after fetch for both bare and normal repositories (#5144) (@erka)
• aa2e232: fix: handle annual license key format in activation wizard (#5335) (@markphelps)
• d1704d4: fix: improve GitHub auth error message for security requirements (#5331) (@erka)
• 2470bbe: fix: replace default git commit email (#5383) (@erka)
• da550d9: fix: support ssh URLs with non-standard ports in git (#5298) (@erka)

Other

• b6f833c: Add Open Collective funding option (@markphelps)
• b626729: chore(deps): bump @codemirror/lint from 6.9.1 to 6.9.2 in /ui (#5313) (@dependabot[bot])
• 65ab2d5: chore(deps): bump @codemirror/lint from 6.9.2 to 6.9.4 in /ui (#5395) (@dependabot[bot])
• 2240bc8: chore(deps): bump @codemirror/search from 6.5.11 to 6.6.0 in /ui (#5375) (@dependabot[bot])
• da05848: chore(deps): bump @codemirror/state from 6.5.2 to 6.5.3 in /ui (#5260) (@dependabot[bot])
• c3aff3b: chore(deps): bump @codemirror/state from 6.5.3 to 6.5.4 in /ui (#5320) (@dependabot[bot])
• a701328: chore(deps): bump @codemirror/view from 6.38.1 to 6.39.9 in /ui (#5259) (@dependabot[bot])
• a7bb107: chore(deps): bump @codemirror/view from 6.39.9 to 6.39.11 in /ui (#5315) (@dependabot[bot])
• e3327b3: chore(deps): bump @mui/material from 7.3.6 to 7.3.7 in /ui (#5258) (@dependabot[bot])
• 2ed073a: chore(deps): bump @mui/material from 7.3.7 to 7.3.8 in /ui (#5394) (@dependabot[bot])
• 3637ba6: chore(deps): bump @mui/x-charts from 8.23.0 to 8.25.0 in /ui (#5291) (@dependabot[bot])
• 17ed13d: chore(deps): bump @mui/x-charts from 8.25.0 to 8.26.0 in /ui (#5341) (@dependabot[bot])
• 50ab7fd: chore(deps): bump @reduxjs/toolkit from 2.9.1 to 2.11.2 in /ui (#5261) (@dependabot[bot])
• 1c11f33: chore(deps): bump @uiw/codemirror-theme-tokyo-night in /ui (#5294) (@dependabot[bot])
• aa5259f: chore(deps): bump @uiw/react-codemirror from 4.25.2 to 4.25.4 in /ui (#5319) (@dependabot[bot])
• 48770d4: chore(deps): bump alpine from 3.23.2 to 3.23.3 in /build (#5339) (@dependabot[bot])
• ee37ee5: chore(deps): bump code.gitea.io/sdk/gitea from 0.22.1 to 0.23.2 (#5378) (@dependabot[bot])
• 8767f6c: chore(deps): bump cuelang.org/go from 0.15.3 to 0.15.4 (#5340) (@dependabot[bot])
• 1d0fb90: chore(deps): bump github.com/ClickHouse/clickhouse-go/v2 (#5343) (@dependabot[bot])
• 8655e10: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (#5263) (@dependabot[bot])
• fd0033e: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (#5396) (@dependabot[bot])
• 9630cf5: chore(deps): bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.4 (#5288) (@dependabot[bot])
• 2607368: chore(deps): bump github.com/go-chi/chi/v5 from 5.2.4 to 5.2.5 (#5379) (@dependabot[bot])
• 14c4da0: chore(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 (#5316) (@dependabot[bot])
• cd755ec: chore(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 (#5345) (@dependabot[bot])
• 9d850f6: chore(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 (#5390) (@dependabot[bot])
• ecc1e6d: chore(deps): bump github.com/jferrl/go-githubauth from 1.5.0 to 1.5.1 (#5398) (@dependabot[bot])
• 0ca48ec: chore(deps): bump github.com/ktrysmt/go-bitbucket from 0.9.88 to 0.9.89 (#5376) (@dependabot[bot])
• e88dcfd: chore(deps): bump github.com/ktrysmt/go-bitbucket from 0.9.89 to 0.9.91 (#5397) (@dependabot[bot])
• dab1426: chore(deps): bump github.com/open-policy-agent/opa from 1.12.1 to 1.12.2 (#5265) (@dependabot[bot])
• bb85b0d: chore(deps): bump github.com/open-policy-agent/opa from 1.12.2 to 1.12.3 (#5292) (@dependabot[bot])
• 84028d0: chore(deps): bump github.com/open-policy-agent/opa from 1.12.3 to 1.13.1 (#5342) (@dependabot[bot])
• fbd713e: chore(deps): bump github.com/prometheus/common from 0.67.4 to 0.67.5 (#5257) (@dependabot[bot])
• 0cfb239: chore(deps): bump github.com/redis/go-redis/extra/redisotel/v9 (#5317) (@dependabot[bot])
• e6c93a2: chore(deps): bump golang.org/x/net from 0.48.0 to 0.49.0 (#5290) (@dependabot[bot])
• f40683f: chore(deps): bump golang.org/x/oauth2 from 0.34.0 to 0.35.0 (#5377) (@dependabot[bot])
• a81d95c: chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0 (#5264) (@dependabot[bot])
• 6dd5b82: chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.1 (#5399) (@dependabot[bot])
• 4038bbd: chore(deps): bump lodash from 4.17.21 to 4.17.23 in /ui (#5302) (@dependabot[bot])
• b7d3695: chore(deps): bump lodash-es from 4.17.21 to 4.17.23 in /ui (#5301) (@dependabot[bot])
• 7072840: chore(deps): bump lucide-react from 0.542.0 to 0.562.0 in /ui (#5295) (@dependabot[bot])
• 2f6b80c: chore(deps): bump lucide-react from 0.563.0 to 0.564.0 in /ui (#5392) (@dependabot[bot])
• c35c855: chore(deps): bump react-chartjs-2 from 5.3.0 to 5.3.1 in /ui (#5262) (@dependabot[bot])
• 0921bae: chore(deps): bump react-dom from 19.2.3 to 19.2.4 in /ui (#5344) (@dependabot[bot])
• 584bf2d: chore(deps): bump react-router from 7.12.0 to 7.13.0 in /ui (#5391) (@dependabot[bot])
• d9594f6: chore(deps): bump suzuki-shunsuke/github-action-renovate-config-validator from 1.1.1 to 2.0.0 (#5286) (@dependabot[bot])
• fcc79ea: chore(deps): bump tailwind-merge from 2.6.0 to 2.6.1 in /ui (#5370) (@dependabot[bot])
• e83278e: chore(deps): bump the opentelemetry group with 14 updates (#5374) (@dependabot[bot])
• 9be627b: chore(deps-dev): bump @playwright/test from 1.57.0 to 1.58.2 in /ui (#5373) (@dependabot[bot])
• 13d1ead: chore(deps-dev): bump @types/react from 19.2.7 to 19.2.14 in /ui (#5393) (@dependabot[bot])
• 191ca6d: chore(deps-dev): bump @types/react-dom from 19.2.2 to 19.2.3 in /ui (#5289) (@dependabot[bot])
• ab5d2a2: chore(deps-dev): bump eslint-plugin-prettier from 5.5.4 to 5.5.5 in /ui (#5371) (@dependabot[bot])
• bf88830: chore(deps-dev): bump knip from 5.68.0 to 5.82.0 in /ui (#5293) (@dependabot[bot])
• c9d58f8: chore(deps-dev): bump knip from 5.82.0 to 5.82.1 in /ui (#5318) (@dependabot[bot])
• 59799a3: chore(deps-dev): bump knip from 5.82.1 to 5.83.1 in /ui (#5372) (@dependabot[bot])
• e4707a9: chore(deps-dev): bump playwright from 1.57.0 to 1.58.1 in /ui (#5348) (@dependabot[bot])
• 6660103: chore(deps-dev): bump prettier from 3.6.2 to 3.8.1 in /ui (#5347) (@dependabot[bot])
• f65f27f: chore: add Claude Code release and changelog commands (#5401) (@markphelps)
• 521f9d3: chore: add deepwiki badge (@markphelps)
• 3621616: chore: bump devenv to v 1.11.2 (#5300) (@erka)
• 7a6abee: chore: bump go to 1.26.0 (#5386) (@erka)
• 97e47bd: chore: bump go-git to v6.0.0-20260216160506-e6a3f881772f (#5381) (@erka)
• 97186d0: chore: release v2.7.0 (#5402) (@markphelps)
• 031c18c: chore: ui fmt (@markphelps)
• 00744df: chore: update changelog for 2.6 (#5367) (@markphelps)
• 32fa455: refactor: migrate from go-grpc-prometheus to go-grpc-middleware/providers/prometheus (#5272) (@erka)

Installation

Docker Images 🐳

  docker pull docker.flipt.io/flipt/flipt:v2.7.0

  docker pull ghcr.io/flipt-io/flipt:v2.7.0

Thank you!

We hope you ❤️ this release! Feel free to open issues/discussions or reach out to us on Discord if you have any questions or feedback.

• Discord
• [Github Discussions](https://github....

Changelog

Features

• f238264: feat(oidc): optionally merge userinfo claims into auth session (#5364) (@gzxu)
• c4446a8: feat(oidc): support configurable token signing algorithms (#5362) (@gzxu)
• 492ce41: feat: add GitHub App authentication support (#5327) (@erka)

Bug Fixes

• 8ac6346: fix(git): complete ref update after fetch for both bare and normal repositories (#5144) (@erka)
• aa2e232: fix: handle annual license key format in activation wizard (#5335) (@markphelps)
• d1704d4: fix: improve GitHub auth error message for security requirements (#5331) (@erka)
• da550d9: fix: support ssh URLs with non-standard ports in git (#5298) (@erka)

Other

• b6f833c: Add Open Collective funding option (@markphelps)
• b626729: chore(deps): bump @codemirror/lint from 6.9.1 to 6.9.2 in /ui (#5313) (@dependabot[bot])
• da05848: chore(deps): bump @codemirror/state from 6.5.2 to 6.5.3 in /ui (#5260) (@dependabot[bot])
• c3aff3b: chore(deps): bump @codemirror/state from 6.5.3 to 6.5.4 in /ui (#5320) (@dependabot[bot])
• a701328: chore(deps): bump @codemirror/view from 6.38.1 to 6.39.9 in /ui (#5259) (@dependabot[bot])
• a7bb107: chore(deps): bump @codemirror/view from 6.39.9 to 6.39.11 in /ui (#5315) (@dependabot[bot])
• e3327b3: chore(deps): bump @mui/material from 7.3.6 to 7.3.7 in /ui (#5258) (@dependabot[bot])
• 3637ba6: chore(deps): bump @mui/x-charts from 8.23.0 to 8.25.0 in /ui (#5291) (@dependabot[bot])
• 17ed13d: chore(deps): bump @mui/x-charts from 8.25.0 to 8.26.0 in /ui (#5341) (@dependabot[bot])
• 50ab7fd: chore(deps): bump @reduxjs/toolkit from 2.9.1 to 2.11.2 in /ui (#5261) (@dependabot[bot])
• 1c11f33: chore(deps): bump @uiw/codemirror-theme-tokyo-night in /ui (#5294) (@dependabot[bot])
• aa5259f: chore(deps): bump @uiw/react-codemirror from 4.25.2 to 4.25.4 in /ui (#5319) (@dependabot[bot])
• 48770d4: chore(deps): bump alpine from 3.23.2 to 3.23.3 in /build (#5339) (@dependabot[bot])
• 8767f6c: chore(deps): bump cuelang.org/go from 0.15.3 to 0.15.4 (#5340) (@dependabot[bot])
• 1d0fb90: chore(deps): bump github.com/ClickHouse/clickhouse-go/v2 (#5343) (@dependabot[bot])
• 8655e10: chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (#5263) (@dependabot[bot])
• 9630cf5: chore(deps): bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.4 (#5288) (@dependabot[bot])
• 14c4da0: chore(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 (#5316) (@dependabot[bot])
• cd755ec: chore(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 (#5345) (@dependabot[bot])
• dab1426: chore(deps): bump github.com/open-policy-agent/opa from 1.12.1 to 1.12.2 (#5265) (@dependabot[bot])
• bb85b0d: chore(deps): bump github.com/open-policy-agent/opa from 1.12.2 to 1.12.3 (#5292) (@dependabot[bot])
• 84028d0: chore(deps): bump github.com/open-policy-agent/opa from 1.12.3 to 1.13.1 (#5342) (@dependabot[bot])
• fbd713e: chore(deps): bump github.com/prometheus/common from 0.67.4 to 0.67.5 (#5257) (@dependabot[bot])
• 0cfb239: chore(deps): bump github.com/redis/go-redis/extra/redisotel/v9 (#5317) (@dependabot[bot])
• e6c93a2: chore(deps): bump golang.org/x/net from 0.48.0 to 0.49.0 (#5290) (@dependabot[bot])
• a81d95c: chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0 (#5264) (@dependabot[bot])
• 4038bbd: chore(deps): bump lodash from 4.17.21 to 4.17.23 in /ui (#5302) (@dependabot[bot])
• b7d3695: chore(deps): bump lodash-es from 4.17.21 to 4.17.23 in /ui (#5301) (@dependabot[bot])
• 7072840: chore(deps): bump lucide-react from 0.542.0 to 0.562.0 in /ui (#5295) (@dependabot[bot])
• c35c855: chore(deps): bump react-chartjs-2 from 5.3.0 to 5.3.1 in /ui (#5262) (@dependabot[bot])
• 0921bae: chore(deps): bump react-dom from 19.2.3 to 19.2.4 in /ui (#5344) (@dependabot[bot])
• d9594f6: chore(deps): bump suzuki-shunsuke/github-action-renovate-config-validator from 1.1.1 to 2.0.0 (#5286) (@dependabot[bot])
• 191ca6d: chore(deps-dev): bump @types/react-dom from 19.2.2 to 19.2.3 in /ui (#5289) (@dependabot[bot])
• bf88830: chore(deps-dev): bump knip from 5.68.0 to 5.82.0 in /ui (#5293) (@dependabot[bot])
• c9d58f8: chore(deps-dev): bump knip from 5.82.0 to 5.82.1 in /ui (#5318) (@dependabot[bot])
• e4707a9: chore(deps-dev): bump playwright from 1.57.0 to 1.58.1 in /ui (#5348) (@dependabot[bot])
• 6660103: chore(deps-dev): bump prettier from 3.6.2 to 3.8.1 in /ui (#5347) (@dependabot[bot])
• 521f9d3: chore: add deepwiki badge (@markphelps)
• 3621616: chore: bump devenv to v 1.11.2 (#5300) (@erka)
• 031c18c: chore: ui fmt (@markphelps)
• 7d099d5: chore: update changelog for 2.6 (@markphelps)
• 32fa455: refactor: migrate from go-grpc-prometheus to go-grpc-middleware/providers/prometheus (#5272) (@erka)

Installation

Docker Images 🐳

  docker pull docker.flipt.io/flipt/flipt:v2.6.0

  docker pull ghcr.io/flipt-io/flipt:v2.6.0

Thank you!

We hope you ❤️ this release! Feel free to open issues/discussions or reach out to us on Discord if you have any questions or feedback.

• Discord
• Github Discussions
• Github Issues
• Website

Changelog

Features

• c15f032: feat(server): add configurable flag metadata in ListFlags responses (#4934) (@erka)
• 485b5d3: feat(authn): add fallback name and email for GitHub auth (#5154) (@erka)
• 3226e78: feat(ci): add automated DCO check comment workflow (@markphelps)
• 214ab5e: feat(ci): add thank you message to DCO comment (@markphelps)
• f2f0cdf: feat(ci): skip DCO comment for bot-authored PRs (@markphelps)
• 6126a45: feat(credentials): normalize SSH remote URLs with SSH credentials (#5130) (@markphelps)
• 24e9764: feat(storage): add fetch_policy configuration option (#4920) (@erka)
• da0eb5c: feat: add custom commit and PR templates in server config (#5091) (@markphelps)
• 8d43e59: feat: add flipt license CLI command for Pro license management (@markphelps)
• c540c46: feat: allow purchasing license (open browser) (@markphelps)
• 0d67a97: feat: migrate otelgrpc to stats handlers and update dependencies (#4895) (@erka)
• aa14d8c: feat: redo quickstart look and feel; fix resizability in TUI; add license subcommands (@markphelps)
• 2c4b3fe: feat: return error from GetFromContext when environment not found (#4745) (@markphelps)

Bug Fixes

• 9d5ed92: fix(analytics): return all batch data for requested flags (#4756) (@erka)
• fc1e873: fix(auth): allow to exclude auth for ofrep endpoint (#4753) (@erka)
• 0488bfe: fix(build): move ARG declaration after FROM in Dockerfile (#4772) (@markphelps)
• dc81622: fix(build): update Dagger build to work without go.work files (#4817) (@markphelps)
• de35d38: fix(ci): correct YAML indentation in comment body (@markphelps)
• 7121560: fix(ci): find PRs from forks using commit-based lookup in contributor workflow (@Copilot)
• 14e14eb: fix(ci): use context.payload instead of github.event (@markphelps)
• 6b788df: fix(ci): use workflow_run trigger for fork PR support (@markphelps)
• cdce547: fix(config): set schema default Redis mode to "single" instead of empty string (#4926) (@erka)
• 571dd72: fix(config): use snake_case for fetch policy in json schema (#4957) (@erka)
• ea44e44: fix(deps): update golang.org/x/exp digest to df92998 (#4727) (@renovate[bot])
• 7eb5367: fix(deps): update module github.com/99designs/gqlgen to v0.17.79 (#4735) (@renovate[bot])
• 8e47e96: fix(deps): update module github.com/charmbracelet/bubbletea to v1.3.9 (#4736) (@renovate[bot])
• 238dacc: fix(deps): update module github.com/go-git/go-billy/v6 to v6.0.0-20250906064328-0118fd22f1d9 (#4737) (@renovate[bot])
• 4abf916: fix(deps): update module github.com/go-jose/go-jose/v4 to v4.1.2 (#4739) (@renovate[bot])
• be4965a: fix(deps): update module github.com/google/gnostic to v0.7.1 (#4740) (@renovate[bot])
• 54e6900: fix(deps): update module github.com/ktrysmt/go-bitbucket to v0.9.87 (#4741) (@renovate[bot])
• d50c115: fix(deps): update module github.com/open-feature/go-sdk-contrib/providers/ofrep to v0.1.6 (#4742) (@renovate[bot])
• b928b68: fix(environments): remove deleted branches from UI when synced from Git (#4770) (@markphelps)
• cfe5926: fix(evaluation): add segments to the boolean evaluation response (#4766) (@erka)
• d9236db: fix(evaluation): extract environment fallback logic to helper method (#4959) (@erka)
• 4ab9d6b: fix(otel): add missing otel events for batch evaluation (#4875) (@erka)
• cda230e: fix(proto): generate openapi for v2 api with gnostic (#4847) (@erka)
• 1c942c2: fix(storage): handle DNS and IO resolution errors in git repository connection checks (#4965) (@erka)
• 1150cec: fix(storage): prevent deletion of segments in use by flags (#4879) (@erka)
• dfd9704: fix(storage): sync git remote URLs with Flipt config (#4975) (@erka)
• eb1ee16: fix(streaming): accept http/2 connections (#4715) (@causton81)
• bed13b0: fix(ui): prevent Enter key from submitting form in Tags component (#4896) (@markphelps)
• ac46bc1: fix(ui): refetch environments when window regains focus or reconnects (#4774) (@markphelps)
• 96c9e8b: fix(v2): validate segment references when creating flags (#4749) (@markphelps)
• 155c7eb: fix: add replace directive for stdoutlog to force v0.14.0 (@markphelps)
• f38a33b: fix: add replace directives for stdout OpenTelemetry exporters (@markphelps)
• 351a794: fix: apply tracing stats handler to both gRPC server and in-process channel (#4971) (@erka)
• 0fb62f6: fix: correct license activation TUI success screen spacing (@markphelps)
• 10843cb: fix: correct license activation TUI to use form layout pattern (@markphelps)
• e425ef8: fix: enable submit button based on form state in NamespaceForm (#4991) (@Yashh56)
• f0617b1: fix: ensure compatibility with SDKs with default environment (#4857) (@erka)
• 4d02b95: fix: get environment key from streaming subscribe request (#4733) (@markphelps)
• 065b120: fix: pass correct server parameter to skipped() in EmailMatchingUnaryInterceptor (@markphelps)
• 63e2ff8: fix: prevent install script failure with TERM=dumb in minimal terminals (#4928) (@Copilot)
• cc0402b: fix: read CHANGELOG.md from tagged commit during release (@markphelps)
• fc3ed3d: fix: reduce excessive vertical spacing in TUI content sections (@markphelps)
• 5b43a4a: fix: reduce memory usage with otel and clickhouse (#4755) (@erka)
• 794dc82: fix: remove conflicting dag import in build/main.go (@markphelps)
• de6527c: fix: remove direct Keygen references from user messages (@markphelps)
• 19822af: fix: remove duplicate error messages in license commands (@markphelps)
• 0f104cb: fix: replace panic with proper error handling in EmailMatchingUnaryInterceptor (#4744) (@markphelps)
• 7e5bc49: fix: resolve secrets in OIDC provider configuration (#5153) (@markphelps)
• d4d93da: fix: simplify Pro feature descriptions (@markphelps)
• 118be4c: fix: simplify license activation to preserve entire config (@markphelps)
• c64ec18: fix: update OpenTelemetry stdout exporters to compatible versions (@markphelps)
• 2a4a954: fix: update Pro feature descriptions to match documentation (@markphelps)
• 4352158: fix: update release prompt to extract changelog from CHANGELOG.md (@markphelps)
• fa65947: fix: update semconv to v1.37.0 to resolve schema URL conflict (@markphelps)
• 4b574a6: fix: use static v2-nightly version for nightly builds (@markphelps)

Other

• 939e256: Add health checks for Gitea and Flipt services to resolve flaky tests (@Copilot)
• 0ee3d84: Add initial sleep before polling service readiness (@Copilot)
• 7d61b1f: Add metadata to the flags list API. (#4848) (@erfantarighi)
• c3b44b4: Added UT for test coverage (@ptejasvini)
• 9e41bea: Fixed UT failures (@ptejasvini)
• 54346b8: Initial plan (@Copilot)
• ca55faa: Initial plan (@Copilot)
• 1e4d866: Merge branch 'v2' into copilot/fix-97e228f2-b06c-403b-9d34-3a60f125f6e8 (@markphelps)
• 21288de: Merge branch 'v2' into license-cli-command (@markphelps)
• e05d00d: Merge branch 'v2' into markphelps/dco-yaml-fix (@markphelps)
• 887daa1: Merge branch 'v2' into markphelps/dco-yaml-fix (@markphelps)
• b33a877: Merge pull request #4683 from flipt-io/release/2.1 (@markphelps)
• 6cfab3b: Merge pull request #4764 from flipt-io/fix-changelog-from-tag (@markphelps)
• 89bb754: Merge pull request #4767 from flipt-io/license-cli-command (@markphelps)
• b098687: Merge pull request #4775 from ptejasvini/ptejasvini1_flipt (@markphelps)
• ce4ed8c...

Added

• OpenTelemetry modernization: Migrate from deprecated gRPC interceptors to modern stats handler API for improved tracing instrumentation (#4895)

Fixed

• Git remote synchronization: Automatically sync git remote URLs with Flipt configuration to ensure repository connections stay current (#4975)
• Git connection error handling: Properly detect and handle DNS resolution errors and I/O timeouts when checking git repository connections, allowing lenient fetch policy to work correctly when remotes are temporarily unreachable (#4965)
• Distributed tracing coverage: Apply OpenTelemetry stats handler to both the main gRPC server and in-process channel for complete tracing coverage (#4971)
• UI form submission: Enable namespace form submit button based on form validation state for better user experience (#4991)

Dependencies

• Updated various dependencies including OpenTelemetry, AWS SDK, gRPC ecosystem, and UI libraries

Installation

Docker Images 🐳

  docker pull docker.flipt.io/flipt/flipt:v2.4.0

  docker pull ghcr.io/flipt-io/flipt:v2.4.0

Thank you!

We hope you ❤️ this release! Feel free to open issues/discussions or reach out to us on Discord if you have any questions or feedback.

• Discord
• Github Discussions
• Github Issues
• Website

Changelog

Bug Fixes

• 571dd72: fix(config): use snake_case for fetch policy in json schema (#4957) (@erka)
• d9236db: fix(evaluation): extract environment fallback logic to helper method (#4959) (@erka)

Other

• 0f05cb9: Merge branch 'v2' into release/2.3 (@markphelps)
• b9d7140: chore: prep for v2.3.0 release (#4956) (@markphelps)
• 89759fe: chore: update changelog (@markphelps)

Installation

Docker Images 🐳

  docker pull docker.flipt.io/flipt/flipt:v2.3.1

  docker pull ghcr.io/flipt-io/flipt:v2.3.1

Thank you!

We hope you ❤️ this release! Feel free to open issues/discussions or reach out to us on Discord if you have any questions or feedback.

• Discord
• Github Discussions
• Github Issues
• Website