# Cerbos v0.36.0

## Highlights

To reduce the overhead of writing large audit log entries to slow sinks (files and `stdout`, for example), Cerbos now writes audit logs in the background. If you send very large batch requests containing a lot of data to Cerbos, this should help improve the response times.

A community contribution from @rcrowe makes the Kafka audit backend use system CA certificates if none are provided explicitly in configuration. It also addresses a case where asynchronous Kafka writes start blocking when the downstream brokers are down.

The new [`cerbosctl inspect`](https://docs.cerbos.dev/cerbos/prerelease/cli/cerbosctl#inspect-policies) command provides command-line access to the `inspect` Admin API endpoint introduced in the previous release. Currently it supports listing actions covered by each policy. More policy inspection options are planned for future releases.

### Cerbos Hub integration

Early adopters of the [Cerbos Hub](/content/product-cerbos-hub/index.html) audit log collection feature can now filter out audit log entries locally before they are sent to Hub.

For consistency, the `bundle` storage driver has been renamed to `hub`. To migrate, change `storage.driver: bundle` to `storage.driver: hub` and rename any configuration values starting with `storage.bundle` to `storage.hub`.

Embedded PDP users can use the `cerbosctl hub epdp list-candidates` command to scan a policy repo and list the set of policies that would be included in a Cerbos Embedded PDP bundle.

## Changelog

### Bug Fixes

- Default expectation to `EFFECT_DENY` for unspecified actions in tests ( [#2116](https://github.com/cerbos/cerbos/pull/2116))

- Eagerly establish gRPC connection to avoid initial delay ( [#2105](https://github.com/cerbos/cerbos/pull/2105))

- Handle folded strings and indented newlines in YAML correctly ( [#2128](https://github.com/cerbos/cerbos/pull/2128))

- Ignore context cancellation when writing audit log entries ( [#2113](https://github.com/cerbos/cerbos/pull/2113))

- Include implicit `EFFECT_DENY` in test failure details ( [#2117](https://github.com/cerbos/cerbos/pull/2117))

- Kafka TLS using system CA ( [#2120](https://github.com/cerbos/cerbos/pull/2120))

- Stop blocking Kafka audit publishing when an outage occurs ( [#2122](https://github.com/cerbos/cerbos/pull/2122))

### Features

- Add cerbosctl hub epdp list-candidates command ( [#2078](https://github.com/cerbos/cerbos/pull/2078))

- Add cerbosctl inspect policies command ( [#2101](https://github.com/cerbos/cerbos/pull/2101))

### Enhancements

- Add audit log filtering to Hub backend ( [#2073](https://github.com/cerbos/cerbos/pull/2073))

- Apply perf patch to YAML parser ( [#2132](https://github.com/cerbos/cerbos/pull/2132))

- Write audit logs asynchronously ( [#2104](https://github.com/cerbos/cerbos/pull/2104))

### Documentation

- Add documentation for Dagger Cerbos module ( [#2106](https://github.com/cerbos/cerbos/pull/2106))

- Document Hub features ( [#2133](https://github.com/cerbos/cerbos/pull/2133))

- Document how to verify cosign signatures ( [#2094](https://github.com/cerbos/cerbos/pull/2094))

### Chores

- Add 0.35.1 release notes ( [#2090](https://github.com/cerbos/cerbos/pull/2090))

- Bump github.com/docker/docker from 26.0.0+incompatible to 26.0.2+incompatible in /tools ( [#2108](https://github.com/cerbos/cerbos/pull/2108))

- Bump github.com/sigstore/cosign/v2 from 2.2.1 to 2.2.4 in /tools ( [#2097](https://github.com/cerbos/cerbos/pull/2097))

- Bump golang.org/x/net from 0.21.0 to 0.23.0 in /api/genpb ( [#2110](https://github.com/cerbos/cerbos/pull/2110))

- Bump version to 0.36.0

- Check results of npm package tests ( [#2098](https://github.com/cerbos/cerbos/pull/2098))

- Fix E2E tests combining the host address with extra colon ( [#2114](https://github.com/cerbos/cerbos/pull/2114))

- Handle panics during parsing ( [#2129](https://github.com/cerbos/cerbos/pull/2129))

- Remove deprecated audit log fields from filter ( [#2121](https://github.com/cerbos/cerbos/pull/2121))

- Remove unmaintained Netlify action ( [#2093](https://github.com/cerbos/cerbos/pull/2093))

- Remove usage of deprecated MySQL native authentication plugin ( [#2131](https://github.com/cerbos/cerbos/pull/2131))

- Rename bundle driver to hub ( [#2130](https://github.com/cerbos/cerbos/pull/2130))

- Test npm packages against pnpm v9 ( [#2102](https://github.com/cerbos/cerbos/pull/2102))

- Update cloud-platforms.adoc ( [#2109](https://github.com/cerbos/cerbos/pull/2109))

- Update github actions deps ( [#2125](https://github.com/cerbos/cerbos/pull/2125))

- Update go deps ( [#2099](https://github.com/cerbos/cerbos/pull/2099))

- Update go deps ( [#2111](https://github.com/cerbos/cerbos/pull/2111))

- Update go deps ( [#2124](https://github.com/cerbos/cerbos/pull/2124))

- Update go deps ( [#2139](https://github.com/cerbos/cerbos/pull/2139))

- Update go deps ( [#2135](https://github.com/cerbos/cerbos/pull/2135))

- Update go deps to v2 (major) ( [#2138](https://github.com/cerbos/cerbos/pull/2138))

- Update golangci/golangci-lint-action action to v5 ( [#2127](https://github.com/cerbos/cerbos/pull/2127))

- Update golangci/golangci-lint-action action to v5.3.0 ( [#2136](https://github.com/cerbos/cerbos/pull/2136))

- Update node.js deps ( [#2100](https://github.com/cerbos/cerbos/pull/2100))

- Update node.js deps ( [#2126](https://github.com/cerbos/cerbos/pull/2126))

- Update node.js deps ( [#2137](https://github.com/cerbos/cerbos/pull/2137))

- Update pnpm to v9.0.5 ( [#2112](https://github.com/cerbos/cerbos/pull/2112))

- Update storage type for Jaeger chart ( [#2096](https://github.com/cerbos/cerbos/pull/2096))

- Update to go1.22.3 ( [#2143](https://github.com/cerbos/cerbos/pull/2143))

- Use latest Cerbos SDK ( [#2140](https://github.com/cerbos/cerbos/pull/2140))

- Use new hub configuration for env var override ( [#2142](https://github.com/cerbos/cerbos/pull/2142))