Skip to content

v0.16.0

Release Date: 2026-10-14

This release has two themes: connection sharing and dependency tracking (reconnect, bindings and grants over the connections API) and the rename of the connection library from connectionforge to connectforge. The rename is breaking for anyone who deployed v0.15.0 with connections enabled; see the upgrade notes.

Highlights

  • Reconnect. POST .../connections/{id}/reconnect replaces a connection's credential in place when a token expires or is revoked, keeping its bindings and grants.
  • Bindings. GET, PUT and DELETE .../connections/{id}/bindings record which features depend on a connection, so disconnecting shows what would stop working.
  • Grants. GET, PUT and DELETE .../connections/{id}/grants/{principal} give a principal a viewer, contributor or maintainer role on one connection. They are the platform's resource grants (ADR-008) on the new systemforge_connection resource type, not a second authority.
  • Renamed library. connections now depends on github.com/plexusone/connectforge v0.3.0. See Connections and ADR-017.

Upgrade notes

  1. Update imports. Code that imports github.com/plexusone/connectionforge must import github.com/plexusone/connectforge. The API is otherwise unchanged.
  2. Deployments that enabled connections in v0.15.0 need a data step. The tables are now named connectforge_* and credentials are sealed under the connectforge.credential key purpose. systemauth migrate creates the new tables; it does not copy rows from connectionforge_*, and existing credentials, sealed under the old purpose, are not readable under the new one. Before upgrading, either re-create the connections after migrating or rename the tables and re-seal credentials under the new purpose. Deployments that never enabled connections are unaffected.
  3. Run systemauth migrate. On PostgreSQL it also enables row-level security on the new tables.
  4. New roles, no new scopes. Grants reuse systemforge:connections:read and :write. Members still hold only view on a connection until it is granted to them.

Known limits

  • Disconnecting does not yet require acknowledging the bindings it would stop; list them with GET .../bindings first.
  • OAuth authorization, its callback and credential replacement through a provider flow are not yet supported.