Skip to content

Update dependency open-policy-agent/opa to v1.14.0#472

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/open-policy-agent-opa-1.x
Open

Update dependency open-policy-agent/opa to v1.14.0#472
renovate[bot] wants to merge 1 commit intomainfrom
renovate/open-policy-agent-opa-1.x

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Jan 12, 2026 •
edited
Loading

This PR contains the following updates:

Package Update Change
open-policy-agent/opa minor v1.11.0 → v1.14.0

Release Notes

open-policy-agent/opa (open-policy-agent/opa)

v1.14.0

Compare Source

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • Improved rule indexing of variable assignments and x in {...} expressions
  • Support for --h2c with unix domain socket for opa run
  • A new glossary tooltip for technical terms in the docs
  • Fixes published in the v1.13.1 and v1.13.2 releases
Improved rule indexing of variable assignments and x in {...} expressions (#​1841)

With this change, the rule indexer will index expressions like:

allow if input.role in {"admin", "user"}

On lookup, the rule body will only be returned if input.role is either one of "admin" or "user".

The reverse case is also indexed:

allow if "admin" in input.roles

in which the searched collection is unknown.

Authored by @​srenatus reported by @​nischalsheth

Runtime, SDK, Tooling
Compiler, Topdown and Rego
Docs, Website, Ecosystem
Miscellaneous
  • maintainers: Moving nilekhc to emeritus, and renew maintainer terms (#​8276) authored by @​JaydipGabani
  • ast: Add public method to extend the compliance test cases with IR plans (#​7556) authored by @​sspaink reported by @​shomron
  • ast: Tiny nitpicky cleanup (#​8309) authored by @​srenatus
  • chore: Clean up bundle storage tests (#​8267) authored by @​anderseknert
  • chore: Remove unnecessary comment from bundle JWT verification impl (#​8354) authored by @​johanfylling
  • ci: Bump golangci-lint (v2.9.0), fix issues (#​8314) authored by @​srenatus
  • ci: Harden and update all GH Actions workflows (#​8356, #​8377, #​8368 authored by @​philipaconrad and @​srenatus
  • go: Cleanup old build flags (#​8314) authored by @​srenatus
  • rego: Remove superfluous package import of plugins (#​6754) authored by @​srenatus reported by @​oxisto
  • tests: Extract runtime Info to new package (#​8362) authored by @​charlieegan3
  • tests: Fix BenchmarkFunctionArgumentCounts query (#​8327) authored by @​alex60217101990
  • tests: Disable rule indexing for benchmark (#​8375) authored by @​srenatus
  • workflows: Add nightly vuln checks for released versions/images (#​8336 #​8339) authored by @​srenatus
  • Dependency updates; notably:
    • build: bump golang from 1.25.6 to 1.26.0
    • build(deps): build(deps): bump go.opentelemetry.io deps from 1.39.0/0.64.0 to 1.40.0/0.65.0
      Applying fix for GHSA-9h8m-3fm2-qjrq
    • build(deps): bump github.com/dgraph-io/badger/v4 from 4.9.0 to 4.9.1
    • build(deps): bump github.com/huandu/go-sqlbuilder from 1.39.0 to 1.39.1
    • build(deps): bump golang.org/x/net from 0.49.0 to 0.50.0
    • build(deps): bump golang.org/x/text from 0.33.0 to 0.34.0
    • build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.1
    • build(deps): bump go.opentelemetry.io deps from 1.39.0/0.64.0 to 1.40.0/0.65.0

v1.13.2

Compare Source

This release updates the version of Go used to build the OPA binaries and images to 1.25.7.
That version of the Go standard library contains a fix for GO-2026-4337.

Full Changelog: open-policy-agent/opa@v1.13.1...v1.13.2

v1.13.1

Compare Source

v1.13.1

This bug fix release addresses an issue found in the new array.flatten built-in function

v1.13.0

Compare Source

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • A new immediate upload trigger mode in the Decision Logger
  • A new array.flatten built-in function
  • Numerous performance improvements
Immediate Upload Trigger Mode in Decision Logger (#​8110)

An immediate trigger mode has been added to the Decision Logger; enabled by setting the decision_logs.reporting.trigger configuration option to immediate.
When enabled, log events are pushed to the log service as soon as the configured upload chunk size criteria is met; or, at latest, when the configured upload delay is reached.

Authored by @​sspaink

Runtime, SDK, Tooling
Compiler, Topdown and Rego
Performance
Docs, Website, Ecosystem
Miscellaneous
  • Decoupled the Rego job check from the Go job checks in the Github PR workflow (#​8203) authored by @​SeanLedford
  • build: Format pr_check.rego with opa fmt (#​8201) authored by @​thevilledev
  • build: Migrate PR check to OPA policy (#​8183) authored by @​SeanLedford
  • build: Run go get against main to spot redacted (#​8146) authored by @​charlieegan3
  • deps: Switch to maintained go.yaml.in/yaml/v3 yaml library (#​8182) authored by @​mrueg
  • test/cases: Increase yaml test coverage for some regex and string builtins (#​8152) authored by @​srenatus
  • Dependency updates; notably:
    • build: bump golang from 1.25.5 to 1.25.6 (#​8224) authored by @​srenatus
    • build(deps): bump go.opentelemetry.io deps from 1.38.0/0.63.0 to 1.39.0/0.64.0
    • build(deps): bump klauspost/compress from v1.18.1 to v1.18.2 (#​8184) authored by @​srenatus
      because of redaction warning
    • build(deps): bump github.com/go-ini/ini from v1.67.0 to gopkg.in/ini.v1 v1.67.1 (#​8208) authored by @​gabrpt

v1.12.3

Compare Source

v1.12.3

This is a bug fix release addressing two issues:

Bundle polling is being misconfigured when discovery bundle is updated (#​8215)

This is an issue where the polling interval for discovery (discovery.polling.min_delay_seconds and discovery.polling.max_delay_seconds) were misinterpreted on reconfiguration, causing extremely long update intervals.

Reported by @​loganmiller-chime, authored by @​sspaink

Decision log size buffer buffer_size_limit_bytes misconfigured during reconfiguration (#​8213)

This is a regression in the decision log, where the decision_logs.reporting.buffer_size_limit_bytes was mistakenly assigned the value of decision_logs.reporting.upload_size_limit_bytes during reconfiguration.
This issue is only present when decision_logs.reporting.buffer_type is set to size, which is the default value.

Authored by @​sspaink

v1.12.2

Compare Source

This bug fix release address issues found in the new string interpolation feature

v1.12.1

Compare Source

This bug fix release reverts a change to regex.replace that unintentionally changed its behaviour for anchored regular expressions.

  • Revert "topdown: make regex.replace respect cancellation" (authored by @​srenatus)

v1.12.0

Compare Source

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • Support for String Interpolation in the Rego language
  • Faster compilation and runtime
  • Fixes published in the v1.11.1 release
String Interpolation (#​4733)

The Rego language has been extended to support String Interpolation,
which provides a readable means to compose strings containing dynamic values determined at evaluation time.

An interpolated string is composed of a template-string containing zero or more template-expressions that evaluates to a value at evaluation time.
The $ character prefix identifies a template-string, and template-expressions are declared by being enclosed in curly-braces ({, }).

Additionally, undefined template-expression values don't halt evaluation; instead, <undefined> will be injected into the generated string.

package interpolation

allowed_roles := ["admin", "employee"]

default role := "guest"
role := input.role

deny contains $"User {input.username}'s role was '{role}', but must be one of {allowed_roles}" if {
  not role in allowed_roles
}
{
  "deny": [
    "User <undefined>'s role was 'guest', but must be one of [\"admin\", \"employee\"]"
  ],
}

String interpolation is a more readable and less error-prone substitute for the sprintf built-in function.

Authored by @​johanfylling reported by @​anderseknert

[!TIP]
Help us out!

New Rego language features are exciting, and we want to maximize their usefulness. If you come across tools and integrations in the community where string interpolation isn't properly handled, such as syntax highlighting, please reach out and let us know.

Runtime, SDK, Tooling
Compiler, Topdown and Rego
Docs, Website, Ecosystem
Miscellaneous

v1.11.1

Compare Source

This is a bugfix release:

Memory exhaustion via forged gzip header

A crafted HTTP request any of OPA's HTTP endpoints would lead OPA to use a large amount of memory, triggering
an out-of-memory process exit.

This weakness in OPA's HTTP API gzip handling is as old as the gzip handling itself. A configurable limit was introduced in v0.67.0, but it has been shown that this security measure wasn't sufficient to avoid running out of memory in memory-constrained setups.

Thanks to @​thevilledev for reporting and fixing this issue.

It only applies to OPA running as server (as a binary or in a container, as "sidecar"). To trigger an OOM process exit using this weakness, an adversary must be able to send an HTTP request directly to OPA. This would be the case if they are in the same network, there is no proxy in front of OPA, or if OPA was exposed to the internet, which is advised against.

By the nature of HTTP encodings, this would be effective before token-based authentication and authorization policies, so these measures do not protect against the attack vector.

If all OPA endpoints are using TLS-based authentication (mutual TLS, "mTLS"), then an adversary cannot do harm with this method.

Please note that while we're taking all of these issues seriously, OPA isn't designed for adversary environments. It's strongly advised not to expose any of its endpoints to the public internet. Furthermore, available security measures should be applied regardless, for a defense in depth approach. See the documentation for the available means of authentication and authorization in OPA.

Please also check out our Security Policy for reporting critical issues and bugs.

Decision Logs dropped (introduced in OPA v1.9.0)

When the decision logs buffer was uploaded, the buffer limit inadvertently got reset to the default upload limit (32kb).
This causes logs to be dropped that shouldn't have been dropped.

This default is overridden by the configuration value decision_logs.reporting.upload_size_limit_bytes, see the docs on decision logs.

There's a Prometheus metric for dropped events, counter_decision_logs_dropped_buffer_size_limit_bytes_exceeded,
and you can check that for unexpectedly high counts.

Reported by @​johanneslarsson #​8123, fixed by @​sspaink.

The release is otherwise identical to v1.11.0.

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from a team as a code owner January 12, 2026 01:32
@renovate renovate bot changed the title Update dependency open-policy-agent/opa to v1.12.2 Update dependency open-policy-agent/opa to v1.12.3 Jan 15, 2026
@renovate renovate bot force-pushed the renovate/open-policy-agent-opa-1.x branch from be5d10a to 5fefff1 Compare January 15, 2026 00:50
@renovate renovate bot changed the title Update dependency open-policy-agent/opa to v1.12.3 Update dependency open-policy-agent/opa to v1.13.0 Jan 29, 2026
@renovate renovate bot force-pushed the renovate/open-policy-agent-opa-1.x branch from 5fefff1 to 450534b Compare January 29, 2026 18:57
@renovate renovate bot changed the title Update dependency open-policy-agent/opa to v1.13.0 Update dependency open-policy-agent/opa to v1.13.1 Jan 29, 2026
@renovate renovate bot force-pushed the renovate/open-policy-agent-opa-1.x branch from 450534b to 944a589 Compare January 29, 2026 21:40
@renovate renovate bot changed the title Update dependency open-policy-agent/opa to v1.13.1 Update dependency open-policy-agent/opa to v1.13.2 Feb 19, 2026
@renovate renovate bot force-pushed the renovate/open-policy-agent-opa-1.x branch from 944a589 to 52bdc16 Compare February 19, 2026 20:05
@renovate renovate bot force-pushed the renovate/open-policy-agent-opa-1.x branch from 52bdc16 to 2158bbe Compare February 26, 2026 18:51
@renovate renovate bot changed the title Update dependency open-policy-agent/opa to v1.13.2 Update dependency open-policy-agent/opa to v1.14.0 Feb 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants