This release contains a mix of new features, performance improvements and bug fixes. Notably: New rego.v2 import Configurable log level for HTTP access logs Stricter handling of bundle signature filenames (breaking change) Partial evaluation unrolls every over a known domain Configurable log level for HTTP access logs Added --log-level-request (default info) to control the level at which the HTTP…
This release builds the OPA binary artifacts with the latest version of Go (v1.27.3). See: https://groups.google.com/g/golang-announce/c/66pojueaQek
v1.21.3 Bundle signature verification could be side-stepped (GHSA-g2pf-6v5v-qcc8) An attacker able to alter bundle bytes could supply arbitrary policy and data to an OPA that was configured to verify bundle signatures. This could happen if the attacker controls any of: OPA bundle/discovery service (including an artifact store it uses) MitM between OPA and bundle/discovery service write access to a…
This release builds the OPA binary artifacts with the latest version of Go (v1.27.2), its standard library, and the golang.org/x/net dependency (v0.60.0). See these security advisories: https://groups.google.com/g/golang-announce/c/U2fTuyDJznI https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs Furthermore, it addresses a mismatch in how encoded slashes were handled in the input to a basic a…
This release fixes a compiler regression introduced in OPA v1.21.0. Fix some … in/every in comprehensions nested in object and set literals (#9280) A comprehension using some … in or every in its body, nested inside an object or set literal, was wrongly treated as ground, so the compiler skipped rewriting it. some … in then failed with rego_unsafe_var_error; every caused a compiler panic: package…
This release contains a mix of new features and bug fixes. Notably: Improved rule indexing Improved rule recursion check YAML is parsed against the 1.2 core schema (breaking change) Rules with general refs no longer collide in the recursion check (#6813) Before, this was a recursion error: package play p[x].foo.bar if { x := "a" not p[x].foo.baz } p[x].foo.baz if { x := "a" false } Rules with a va…
This release includes a bug fix for a parser regression introduced in v1.20.0, and dependency updates. Fix stale parse errors on statements starting with { (#9140) When the and/or keywords added in v1.20.0 are imported, a statement that starts with { is first read as an explicit operand body, and re-read as a term (a comprehension, for example) if no and or or follows. Errors recorded during the a…
This release contains a mix of new features and bug fixes. Notably: New Rego keywords: and and or, for combining conditions inside a single rule body allow_net now restricts remote JSON Schema $ref fetching from json.match_schema and json.verify_schema Coverage reports can now explain why a range is not covered Much faster partial evaluation for dynamically composed policies New Rego keywords: and…
This release includes a bug fix for a regression introduced in v1.20.0 in comparing a number to some float values. Thanks @kmadan for reporting the issue and submitting a fix!
This release uses the latest version of Go (1.26.6) to build OPA, fixing stdlib vulnerabilities in code that OPA's HTTP handler and crypto builtins use: https://pkg.go.dev/vuln/GO-2026-6218 https://pkg.go.dev/vuln/GO-2026-6091 https://pkg.go.dev/vuln/GO-2026-6090 https://pkg.go.dev/vuln/GO-2026-6089 https://pkg.go.dev/vuln/GO-2026-6088 https://pkg.go.dev/vuln/GO-2026-5972 https://pkg.go.dev/vuln/G…
This release contains a mix of new features and bug fixes. Notably: A fixed SQL injection vector in the Compile API Stricter safety checking for Rego assignments (:=) A cgo-free, faster WebAssembly runtime (wazero replaces wasmtime-go) Startup warnings for unknown configuration options A new strings.split_n built-in function A REPL line reader that handles pasted input correctly, migrating existin…
This release includes a bug fix for a opa fmt regression introduced in v1.18.0. The original fix for #8557 had the formatter enforce newlines in single-item collections (arrays, objects, sets) rather than merely honoring existing ones. As a result, running opa fmt on already-formatted policies could introduce a large number of unwanted changes. This patch release restores the intended behavior: on…
This release fixes a memory leak introduced in OPA v1.17.0. It is advised to update if you notice excess memory usage when running OPA server. Fixes ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle (#8817) authored by @srenatus reported by @keydon and @gorsr01
This release contains a mix of bugfixes and small features. Notably: A breaking fix to the outbound User-Agent header so it conforms to RFC 9110 (see below) Container-aware resource limits: automatic GOMAXPROCS is restored and automatic GOMEMLIMIT is now supported Several opa fmt correctness fixes Improvements to opa test --coverage (ranges in report, inline rule head tracking, conjunction-express…
This release uses the latest version of Go (1.26.4) to build OPA, fixing stdlib vulnerabilities in code that OPA's HTTP handler and crypto builtins use: https://pkg.go.dev/vuln/GO-2026-5039 https://pkg.go.dev/vuln/GO-2026-5037 It is otherwise the same code as v1.17.0. Note that users building their own OPA binaries and images already control the Golang version, so this is not relevant for them. Mi…
This release contains a mix of new features, performance improvements, and bugfixes. Notably: A new future.keywords.not import that adds improved semantics to the not keyword. Rule Labels in Decision Logs Published json schema for IR and bundle manifest Dropped automaxprocs and x/net dependencies Improved Negation Semantics (#8387) This OPA release introduces a new future.keywords.not import that…
This release updates the version of Go used to build the OPA binaries and images to 1.26.3; addressing a number of vulnerabilities.
This is exactly what wasmtime does, maybe it works with immutable github releases. Signed-off-by: Stephan Renatus stephan.renatus@gmail.com
Warning A regression has been found in the plugin manager, which may cause the service to hang on shutdown. Users are advised to go directly to v1.16.1. This release contains a mix of new features, performance improvements, and bugfixes. Notably: New uri.parse and uri.is_valid built-in functions Data API Request/Response Metadata Prometheus metrics exported via OTLP Formatter improvements NOTE: In…
This is a patch release addressing a regression in the plugin manager that may cause the service to hang on shutdown (#8590).
This release updates the version of Go used to build the OPA binaries and images to 1.26.2. This version of Go contains multiple security fixes.
This patch release fixes a backwards-incompatible change in the v1/logging.Logger interface that inadvertently made it into Release v1.15.0. When using OPA as Go module, and when providing custom Logger implementations, this change would break your build. TipUsers of the binaries or Docker images can ignore this, the code is otherwise the same as v1.15.0. Miscellaneous logging: make WithContext()…