This release cycle brings two SpiceDB releases, plus the first stable zed v1.0.0, meaningful query planner progress, and improvements to how AuthZed Cloud surfaces errors during permission system setup.
SpiceDB's development toolchain now supports YAML-based validation files end-to-end. The DevContext server, the VS Code language server, and the zed CLI all understand the format. If your team has been maintaining validation files in YAML, the full workflow now works without workarounds.
The experimental query planner (--experimental-query-plan) received two significant additions this cycle:
Still experimental and not recommended for production, but the gap to general availability continues to close.
A new withDebug flag on LookupResources calls surfaces information about cycles in your relationship graph. If LookupResources is returning unexpected results or timing out, this flag makes it much easier to understand why.
The Postgres Foreign Data Wrapper (FDW) datastore now fully supports cursoring for LookupResources, LookupSubjects, and ReadRelationships. These were previously missing, which prevented proper pagination when using FDW.
zed CLIThe first major version of the zed CLI has now been released (view livestream).
What changed:
zed preview schema compile → zed schema compilezed watch → zed relationship watchzed permission lookup → zed permission lookup-resourcesrevision flag is removed — use the consistency flagsestimated-count flag on bulk-delete is removed — use limitSeveral bug fixes shipped alongside: YAML error line numbers, import behavior with schema=false, hostname-override flag persistence, and clearer error messages for .zed files that contain YAML validation content.
Two new flags make everyday use more practical:
zed relationships read --limit <n> caps how many relationships are returned. Useful when you just need to spot-check data rather than paginate through everything.zed permission lookup-resources --debug exposes cycle information from SpiceDB, making it possible to diagnose data model cycles directly from the CLI.When a breaking schema change is detected, the Go client now includes which permissions are affected. This gives developers more specific information to act on rather than just knowing that a breaking change occurred.
The client now exposes the withDebug flag introduced in SpiceDB v1.52.0, so Go applications can request cycle detection output directly.
When a permission system fails to provision due to a configuration or validation issue, the specific error message is now displayed in the console. Previously, a failed provisioning state showed no detail about the underlying cause. The improvement means less time spent opening a support ticket to find out what went wrong.