The Cerbos PDP v0.54.0 release focuses on performance. This version makes policy evaluations faster and keeps steady-state memory usage low, so most installations should see reduced resource consumption and increased throughput after upgrading. It also introduces a new command for diagnosing policy stores, clearer error reporting across policies and tests, and better runtime observability. For full details, see the release notes.
Performance and memory improvements
Several under-the-hood improvements make policy evaluation faster and reduce the memory footprint of a running PDP. If you run Cerbos in containers, the PDP now automatically configures GOMEMLIMIT from cgroup memory limits when it isn't explicitly set, which helps the runtime stay within its allocated memory instead of relying on you to tune it by hand.
To make this behavior observable, new Go runtime metrics (go_cpu_classes_* and go_gc_gomemlimit_bytes) expose garbage collection activity and memory constraints, so you can see exactly how the PDP is using the resources it has been given.
Diagnose policy stores with cerbos compile-store
Debugging policy issues in non-disk backends has historically been harder than it needed to be. The new cerbos compile-store command compiles the contents of a policy store using your PDP configuration file, which is particularly useful for diagnosing problems with blob and database storage backends. An optional --disable-invalid flag automatically disables invalid policies in database stores, so a single broken policy no longer has to hold up the rest of the store.
Clearer errors, everywhere
Error reporting gets attention in three places in this release.
When an output expression fails to evaluate, the failure is no longer silent. An error field now appears in the OutputEntry response alongside test results, so you can see what went wrong and where.
The YAML parser now maps errors to specific line and column numbers across policies, test suites, and fixtures, which makes tracking down a malformed file much quicker.
CEL runtime errors during policy evaluation are now logged individually and appear in audit log entries, with severity configurable via engine.celErrorLogLevel. Evaluation errors that were previously easy to miss are now visible in the places you already look.
Note. This visibility matters for the next release. From v0.55.0, an expression in a DENY rule that fails to evaluate at runtime will be treated as true rather than false, failing closed instead of open. If any of your policies rely on the current behavior, the decision they produce will change. Use the new CEL error logging in v0.54.0 to find and fix failing expressions before upgrading to v0.55.0.
Breaking changes and deprecations
Support for legacy Cerbos Hub workspaces has been removed, along with the corresponding configuration settings and the cerbosctl hub epdp command.
Note. Helm charts are no longer published to oci://ghcr.io/cerbos/helm-charts/cerbos. Charts are now available exclusively at https://download.cerbos.dev/helm-charts, so update your chart repository references before your next deploy.
Upgrade today
For the complete list of changes, see the full changelog.
Try Cerbos Hub to manage, test, and deploy policies across your PDPs, or book a call to talk through your authorization architecture with our team.
Tagged in
