chore(main): release service 0.28.0

[opentdf-automation]

🤖 I have created a release beep boop

0.28.0 (2026-10-02)

⚠ BREAKING CHANGES

• core: replace buffered audit with immediate recording (#4092)

Features

• core: DSPX-4995 capture User-Agent on Connect server spans (#4140) (5014566)

Bug Fixes

• core: DSPX-4999 restore database and external-core tracing (#4122) (8232392)
• deps: bump otel to v1.45.0 and align semconv schema to v1.43.0 (#4097) (e5ee699)
• deps: bump SDK to v0.33.0 in /service and /examples (#4109) (5e9e4f5)
• policy: narrow authorization attribute lookups (#3986) (52f2ece)
• policy: record audit outcomes after transaction completion (#4091) (8eefa1b)

Reverts

• policy: DSPX-3888 remove object limit configuration (#4125) (8e99f5b)

Code Refactoring

• core: replace buffered audit with immediate recording (#4092) (d784e4f)

---

This PR was generated with Release Please. See documentation.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 49ac0b64-69e0-44f3-8750-1d63a0ab1d2d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	261.721376ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	138.461078ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	450.405726ms
Throughput	222.02 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m0.477675513s
Average Latency	603.375886ms
Throughput	82.68 requests/second

[github-actions]

X-Test Results

✅ java@main-v0.9.0
✅ go@pull-4095-main
✅ js@main-v0.9.0
✅ go@main-pull-4095
✅ js@main-pull-4095
✅ java@main-pull-4095
✅ go@main-main
✅ go@pull-4095-v0.9.0
✅ java@main-main
govulncheck-failure-3
cukes-report
✅ js@main-main
✅ go@main-v0.9.0
✅ go@pull-4095-pull-4095
bats-test-results
govulncheck-failure-8
govulncheck-failure-1
opentdfplatformMEUN3T.dockerbuild

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	258.190906ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	134.191629ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	428.371783ms
Throughput	233.44 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m1.372110544s
Average Latency	612.124764ms
Throughput	81.47 requests/second

[github-actions]

X-Test Results

✅ java@main-pull-4095
✅ java@main-main
✅ go@main-main
✅ go@main-pull-4095
✅ js@main-v0.9.0
bats-test-results
govulncheck-failure-1
govulncheck-failure-3
✅ go@pull-4095-pull-4095
✅ js@main-pull-4095
opentdfplatform6RPQQR.dockerbuild
govulncheck-failure-8
✅ go@pull-4095-v0.9.0
✅ java@main-v0.9.0
✅ go@pull-4095-main
cukes-report
✅ go@main-v0.9.0
✅ js@main-main

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	241.665814ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	142.280081ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	452.37932ms
Throughput	221.05 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m1.924893226s
Average Latency	617.766162ms
Throughput	80.74 requests/second

[github-actions]

X-Test Results

✅ java@main-pull-4095
✅ go@main-main
✅ go@pull-4095-main
✅ js@main-main
✅ go@pull-4095-pull-4095
✅ js@main-pull-4095
✅ go@main-v0.9.0
✅ go@main-pull-4095
✅ js@main-v0.9.0
govulncheck-failure-1
cukes-report
✅ go@pull-4095-v0.9.0
✅ java@main-main
govulncheck-failure-8
govulncheck-failure-3
opentdfplatformTAS9NC.dockerbuild
bats-test-results
✅ java@main-v0.9.0

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	120.550814ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	59.748802ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	227.917366ms
Throughput	438.76 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	30.166410042s
Average Latency	301.093431ms
Throughput	165.75 requests/second

[github-actions]

X-Test Results

govulncheck-failure-8
govulncheck-failure-1
✅ java@main-pull-4095
✅ js@main-main
bats-test-results
✅ go@pull-4095-v0.9.0
✅ go@pull-4095-pull-4095
opentdfplatformY8W4S9.dockerbuild
✅ java@main-main
✅ js@main-pull-4095
cukes-report
✅ go@main-pull-4095
✅ go@pull-4095-main
✅ go@main-v0.9.0
✅ go@main-main
govulncheck-failure-3
✅ js@main-v0.9.0
✅ java@main-v0.9.0

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	244.741099ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	132.53895ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	422.817641ms
Throughput	236.51 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	59.092897448s
Average Latency	589.727535ms
Throughput	84.61 requests/second

[github-actions]

X-Test Results

✅ go@main-v0.9.0
✅ java@main-pull-4095
✅ go@pull-4095-main
cukes-report
govulncheck-failure-1
✅ java@main-v0.9.0
opentdfplatformUQO7G4.dockerbuild
✅ go@pull-4095-pull-4095
✅ go@pull-4095-v0.9.0
✅ go@main-main
✅ js@main-pull-4095
✅ go@main-pull-4095
✅ js@main-main
✅ java@main-main
bats-test-results
govulncheck-failure-8
govulncheck-failure-3
✅ js@main-v0.9.0

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	239.363876ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	130.983948ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	428.862018ms
Throughput	233.18 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	59.314446737s
Average Latency	591.653662ms
Throughput	84.30 requests/second

[github-actions]

X-Test Results

✅ go@pull-4095-main
✅ go@pull-4095-v0.9.0
✅ go@main-pull-4095
✅ go@main-main
✅ java@main-v0.9.0
✅ java@main-main
✅ js@main-main
govulncheck-failure-1
govulncheck-failure-3
opentdfplatformM67X9M.dockerbuild
govulncheck-failure-8
✅ go@main-v0.9.0
✅ java@main-pull-4095
bats-test-results
cukes-report
✅ js@main-pull-4095
✅ go@pull-4095-pull-4095
✅ js@main-v0.9.0

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	233.068638ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	138.261974ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	422.472697ms
Throughput	236.70 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m0.249170648s
Average Latency	601.196328ms
Throughput	82.99 requests/second

[github-actions]

X-Test Results

✅ java@main-pull-4095
✅ go@main-pull-4095
✅ go@main-v0.9.0
✅ js@main-pull-4095
opentdfplatform67QUZC.dockerbuild
✅ go@pull-4095-v0.9.0
✅ go@pull-4095-pull-4095
✅ js@main-main
✅ js@main-v0.9.0
✅ go@main-main
✅ java@main-v0.9.0
govulncheck-failure-1
bats-test-results
govulncheck-failure-8
✅ go@pull-4095-main
✅ java@main-main
govulncheck-failure-3

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	150.57664ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	83.357297ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	297.382103ms
Throughput	336.27 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.166297213s
Average Latency	390.946962ms
Throughput	127.66 requests/second

[github-actions]

X-Test Results

✅ go@main-v0.9.0
✅ go@pull-4095-v0.9.0
✅ go@main-pull-4095
✅ go@pull-4095-pull-4095
✅ js@main-main
✅ java@main-pull-4095
✅ js@main-v0.9.0
govulncheck-failure-3
bats-test-results
✅ go@main-main
opentdfplatformQ826HK.dockerbuild
✅ go@pull-4095-main
✅ java@main-main
✅ js@main-pull-4095
✅ java@main-v0.9.0
govulncheck-failure-1
govulncheck-failure-8

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	188.170183ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	106.575493ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	395.596535ms
Throughput	252.78 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	49.779917844s
Average Latency	496.589075ms
Throughput	100.44 requests/second

[github-actions]

X-Test Results

cukes-report
✅ java@main-v0.9.0
✅ java@main-main
bats-test-results
✅ js@main-pull-4095
✅ go@main-pull-4095
opentdfplatform7IXXMH.dockerbuild
✅ go@main-main
✅ java@main-pull-4095
✅ go@main-v0.9.0
✅ go@pull-4095-main
✅ js@main-v0.9.0
✅ go@pull-4095-v0.9.0
✅ go@pull-4095-pull-4095
govulncheck-failure-1
✅ js@main-main
govulncheck-failure-3
govulncheck-failure-8

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	187.95066ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	111.539129ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	406.226254ms
Throughput	246.17 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	55.19599772s
Average Latency	550.883943ms
Throughput	90.59 requests/second

[github-actions]

X-Test Results

✅ go@main-main
✅ java@main-pull-4095
✅ java@main-v0.9.0
opentdfplatformJH12CK.dockerbuild
✅ go@main-v0.9.0
✅ js@main-main
govulncheck-failure-3
cukes-report
✅ go@pull-4095-main
bats-test-results
✅ js@main-v0.9.0
govulncheck-failure-8
✅ java@main-main
✅ go@main-pull-4095
✅ js@main-pull-4095
govulncheck-failure-1
✅ go@pull-4095-v0.9.0
✅ go@pull-4095-pull-4095

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	149.446847ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	90.889812ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	303.102051ms
Throughput	329.92 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.568163124s
Average Latency	454.789893ms
Throughput	109.73 requests/second

[github-actions]

X-Test Results

✅ go@main-main
✅ go@pull-4095-v0.9.0
✅ go@main-v0.9.0
✅ js@main-v0.9.0
✅ java@main-pull-4095
✅ js@main-pull-4095
✅ go@pull-4095-main
✅ go@main-pull-4095
opentdfplatformYC9FCQ.dockerbuild
govulncheck-failure-8
✅ java@main-main
✅ go@pull-4095-pull-4095
✅ java@main-v0.9.0
bats-test-results
govulncheck-failure-3
cukes-report
✅ js@main-main
govulncheck-failure-1

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	145.145584ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	82.079083ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	297.561195ms
Throughput	336.07 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.102291093s
Average Latency	420.030353ms
Throughput	118.76 requests/second

[github-actions]

X-Test Results

✅ go@main-v0.9.0
✅ go@pull-4095-pull-4095
✅ js@main-pull-4095
✅ java@main-pull-4095
✅ go@pull-4095-v0.9.0
bats-test-results
opentdfplatformYQ62XU.dockerbuild
✅ js@main-main
govulncheck-failure-1
✅ js@main-v0.9.0
authorization-scale-report
✅ go@pull-4095-main
✅ java@main-v0.9.0
govulncheck-failure-8
✅ go@main-main
cukes-report
✅ go@main-pull-4095
govulncheck-failure-3
✅ java@main-main

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	263.543602ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	147.428816ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	459.00421ms
Throughput	217.86 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m7.298148881s
Average Latency	671.634143ms
Throughput	74.30 requests/second

[github-actions]

X-Test Results

✅ go@main-v0.9.0
✅ js@main-pull-4095
govulncheck-failure-3
opentdfplatform9OV50A.dockerbuild
✅ js@main-v0.9.0
✅ java@main-main
✅ go@main-pull-4095
✅ go@pull-4095-pull-4095
✅ go@pull-4095-main
✅ java@main-v0.9.0
✅ java@main-pull-4095
✅ go@main-main
bats-test-results
govulncheck-failure-8
govulncheck-failure-1
✅ go@pull-4095-v0.9.0
cukes-report
✅ js@main-main

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	223.218036ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	125.533915ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	401.091857ms
Throughput	249.32 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.510133258s
Average Latency	444.243098ms
Throughput	112.33 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• otdfctl
• service
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go@main-main
✅ go@pull-4095-pull-4095
✅ go@main-v0.9.0
cukes-report
✅ js@main-main
✅ go@pull-4095-main
✅ go@main-pull-4095
authorization-scale-report
✅ js@main-pull-4095
✅ java@main-pull-4095
✅ go@pull-4095-v0.9.0
✅ java@main-main
✅ java@main-v0.9.0
opentdfplatformMW4Y12.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
✅ js@main-v0.9.0
govulncheck-failure-1
bats-test-results

[opentdf-automation]

🤖 Created releases:

• service/v0.28.0

🌻