# Formbricks 6.0 makes SpiceDB mandatory for self-hosted surveys — and ends legacy follow-ups in December Formbricks 6.0 moves authorization entirely to AuthZed SpiceDB, requiring a controlled self-hosted migration and verification; it also adds response-level Embedded Data and sets December 1 for the old survey follow-up feature to stop. The consequential change in Formbricks 6 isn't its new charts: self-hosted operators need a separate authorization service, a maintenance window and verified migration before enabling v6 traffic. Existing follow-up automations also have a December deadline. - Status: Active - Published: 2026-10-10T09:44:55+13:00 - Updated: 2026-10-10T09:44:55+13:00 - Categories: Web Development, SaaS, Cloud & Infrastructure, Product & Growth, Deployment & DevOps, SaaS Operations, Developer Tools - Tags: authorization, database migration, Formbricks, self-hosting, SpiceDB, survey automation - Canonical HTML: https://beyondthe.news/dossiers/formbricks-6-spicedb-mandatory-self-hosted-migration-followups ## What changed Formbricks 6.0, released in September and presented in its October 5 product announcement, replaces its legacy authorization evaluator with AuthZed SpiceDB as the sole runtime decision engine. PostgreSQL still holds roles and grants, but authorization decisions require a prepared SpiceDB relationship graph; there is no fallback. Operators moving self-hosted v5 installations must stop writers, take coordinated backups, prepare the graph with the target image, pass independent audits and explicitly acknowledge the migration before starting v6. Separately, Embedded Data V1 lets survey responses carry plan, device and experiment context for segmented analysis. Formbricks says legacy Survey Follow-ups stop working December 1, 2026, and should be moved to Workflows. ## Why it matters This is a change to production availability and upgrade risk, not just a new release of an open-source feedback tool. A self-hosted survey service collecting live responses cannot safely treat v6 as a routine image update: authorization now depends on another stateful component and an ordered migration, and failed checks should leave maintenance in place. SaaS teams using Formbricks to collect product feedback can use Embedded Data to connect responses to customer cohorts, but must also migrate any follow-up email automations before the announced cutoff. ## Authorization becomes an external runtime dependency Formbricks documents SpiceDB as the only authorization decision engine in v6. PostgreSQL remains the source of role/grant truth, with relationships prepared into SpiceDB. Missing or incorrectly configured SpiceDB can block startup or protected operations rather than silently reverting to the previous evaluator. The release also tightens consistency requirements and changes some deployment configuration. ## Self-hosted upgrades need a rehearsed maintenance window The official upgrade guide requires stopping every writer, including workers, imports and external integrations, and suspending controllers that might restart them. Operators then take a recoverable coordinated backup, run the target image's formbricks-authzed-prepare command and wait for migration, reconciliation and two independent clean authorization audits. The guide explicitly warns that a Helm rollback alone may not restore a changed database/graph state. It also says to use a tested source/target release pair; the 6.0.0 release note does not identify a tested pair, so operators should confirm their exact supported combination before upgrading. ## Embedded Data makes survey feedback segmentable The new setEmbeddedData() SDK path can attach account, plan, experiment and other context to individual responses. Formbricks lists 28 built-in fields and supports chart splits by device, country, page and other attributes. This is useful for comparing NPS, CSAT or drop-off across cohorts rather than treating survey totals as one undifferentiated metric. ## Existing follow-up emails have a fixed cutoff Formbricks' October 5 announcement says legacy Survey Follow-ups continue until December 1, 2026, then stop working. Workflows is the replacement for conditional email actions. Teams should inventory existing follow-up rules, rebuild and test equivalent workflow conditions and delivery before the cutoff. ## Patch-level security matters while planning migration After 6.0.0, Formbricks released 6.0.1 and 6.0.2 with authorization/security and dependency hardening. A published CVE record describes a stored-XSS permissions flaw fixed in 6.0.1 and 5.4.4. Teams should compare the latest supported patch with their environment, rather than using the original 6.0.0 image as an upgrade target. ## Key details - Formbricks 6.0.0 release: September 21, 2026; product announcement: October 5. - AuthZed SpiceDB becomes mandatory and the sole runtime authorization evaluator. - Existing v5 self-hosted installations require maintenance, writer shutdown, backups, graph preparation and verification; no Cloud bridge release is required. - The migration guide warns to confirm tested source/target release pairs and not to bypass failed readiness gates. - Embedded Data V1 adds response metadata and segmented survey analytics. - Legacy Survey Follow-ups stop December 1, 2026; Workflows is the replacement. - 6.0.2 is the latest listed v6 patch as checked October 9; security fixes were also released in 6.0.1. ## Builder takeaways - Inventory Formbricks versions, deployment dependencies and live survey write paths before scheduling v6. - Rehearse upgrade and restoration against a copied environment; pin exact image and chart versions and verify tested pairs. - Prepare SpiceDB and test allow/deny, scoped API keys, revocation and cross-tenant isolation before resuming traffic. - Migrate legacy follow-up emails to Workflows before December 1 and verify delivery with real test responses. - Use Embedded Data carefully: define field naming, consent and privacy rules before attaching account-level context to feedback. ## What to watch - Formbricks publishes tested v5-to-v6 upgrade pairs and any streamlined self-hosted migration tooling. - Subsequent v6 patches and security advisories, particularly for authorization and dependency changes. - Whether the December 1 Survey Follow-ups cutoff or Workflows migration instructions change. - Whether the new Embedded Data analytics expose material limitations for self-hosted and free users. ## Uncertainties - The 6.0.0 release notes reference tested upgrade pairs but leave the example pair blank; operators should verify their exact path independently. - The announcement does not quantify adoption or operational downtime of real-world self-hosted migrations. - Security patch advisories describe fixes, not evidence that any specific deployment was exploited. - Formbricks' Embedded Data and analytics benefits are product capabilities, not independently measured retention or conversion gains. ## Sources - [Formbricks 6.0 release](https://github.com/formbricks/formbricks/releases/tag/6.0.0) — Formbricks / GitHub · primary release notes · 2026-09-21T00:00:00+12:00. SpiceDB dependency, breaking changes, API changes and maintenance policy. - [Upgrade to Formbricks v6](https://formbricks.com/docs/self-hosting/advanced/v6-maintenance-upgrade) — Formbricks · primary migration documentation · 2026-10-09T00:00:00+13:00. Exact maintenance, preparation, validation, rollback and tested-pair constraints; current docs checked Oct 9. - [Formbricks 6.0: Embedded Data, AI surveys, and better charts](https://formbricks.com/blog/formbricks-6-0) — Formbricks · primary product announcement · 2026-10-05T00:00:00+13:00. Embedded Data, segmented charts and December 1 follow-ups sunset. - [Formbricks 6.0.2 release](https://github.com/formbricks/formbricks/releases/tag/6.0.2) — Formbricks / GitHub · primary release notes · 2026-10-01T00:00:00+13:00. Latest v6 patch security and container hardening. - [Formbricks 6.0.0 release mirror](https://newreleases.io/project/github/formbricks/formbricks/release/6.0.0) — newreleases.io · independent release mirror · 2026-09-21T00:00:00+12:00. Independent publication of the same upstream release text; not an independent deployment test.