Back to blog
2026-10-30 Thijs Creemers

Release: v1.1.0 — who can do what, and why

1.1.0 is out. Install 1.1.1 rather than 1.1.0: it fixes a security issue in the admin.

The short version: your app can now decide who may do what, and when someone asks "why can’t I open this page?", the admin gives you the answer instead of a log search.

What you get

  • Permissions, roles and scopes. Modules declare them, groups hold them, routes check them. New apps enforce from the first run; existing apps stay off until you switch.

  • Explain. Pick a user and a permission, and the admin tells you yes or no, and which group made it so.

  • Preview before save. Every group or role change shows who gains and who loses which rights, before anything is written.

  • Grant wizard. Give someone one permission without handing them three others by accident.

  • Access that ends. A membership can expire on a date you set.

  • A rights timeline per user, so "who gave them that?" has an answer.

The confirmation page for giving the Shop staff group the product/editor role, listing the three members it affects and that each gains product/read and product/write
Figure 1. Adding a role to a group: who gains what, before you confirm.
The Explain page for Ada Visser and the permission product/write, answering Yes and showing it comes from the Shop staff group with the product/editor role everywhere
Figure 2. Explain: Ada may write products, through Shop staff and its product/editor role.

Plus two new libraries, wagoe-webhooks and wagoe-test, and the security fixes from the release candidate. The rc-1 post has the full list.

Since the release candidate

Ten fixes, most of them in the access pages. Previews no longer over-count what a change gives, the rights timeline no longer hides older changes, and users without a role now read "No role" instead of "User". OpenTelemetry is bumped to 1.67.0 because 1.66.0 has a known vulnerability.

Upgrade

curl -fsSL https://get.wagoe.org | bash

Then, in your app: pin 1.1.1 for every com.wagoe/* dependency, run bb migrate up, and run wagoe upgrade to see what it can rewrite for you. Your app keeps authorization :off until you choose otherwise; bb upgrade authorization check names everyone who would lose access before you do.

Coming from 1.0.1? Read UPGRADING.md first. Most apps need three steps; the rest is there if yours doesn’t.