Skip to content

chore(deps): update openpolicyagent/opa docker tag to v1.13.2#23

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/openpolicyagent-opa-1.x
Open

chore(deps): update openpolicyagent/opa docker tag to v1.13.2#23
renovate[bot] wants to merge 1 commit intomainfrom
renovate/openpolicyagent-opa-1.x

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Jul 31, 2025 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
openpolicyagent/opa (source) minor 1.6.0 → 1.13.2

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

open-policy-agent/opa (openpolicyagent/opa)

v1.13.2

Compare Source

This release updates the version of Go used to build the OPA binaries and images to 1.25.7.
That version of the Go standard library contains a fix for GO-2026-4337.

v1.13.1

Compare Source

This bug fix release addresses an issue found in the new array.flatten built-in function

v1.13.0

Compare Source

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • A new immediate upload trigger mode
  • A new array.flatten built-in function
  • Numerous performance improvements
Immediate Upload Trigger Mode in Decision Logger (#​8110)

An immediate trigger mode has been added to the Decision Logger; enabled by setting the decision_logs.reporting.trigger configuration option to immediate.
When enabled, log events are pushed to the log service as soon as the configured upload chunk size criteria is met; or, at latest, when the configured upload delay is reached.

Authored by @​sspaink

Runtime, SDK, Tooling
Compiler, Topdown and Rego
Performance
Docs, Website, Ecosystem
Miscellaneous
  • Decoupled the Rego job check from the Go job checks in the Github PR workflow (#​8203) authored by @​SeanLedford
  • build: Format pr_check.rego with opa fmt (#​8201) authored by @​thevilledev
  • build: Migrate PR check to OPA policy (#​8183) authored by @​SeanLedford
  • build: Run go get against main to spot redacted (#​8146) authored by @​charlieegan3
  • deps: Switch to maintained go.yaml.in/yaml/v3 yaml library (#​8182) authored by @​mrueg
  • test/cases: Increase yaml test coverage for some regex and string builtins (#​8152) authored by @​srenatus
  • Dependency updates; notably:
    • build: bump golang from 1.25.5 to 1.25.6 (#​8224) authored by @​srenatus
    • build(deps): bump go.opentelemetry.io deps from 1.38.0/0.63.0 to 1.39.0/0.64.0
    • build(deps): bump klauspost/compress from v1.18.1 to v1.18.2 (#​8184) authored by @​srenatus
      because of redaction warning
    • build(deps): bump github.com/go-ini/ini from v1.67.0 to gopkg.in/ini.v1 v1.67.1 (#​8208) authored by @​gabrpt

v1.12.3

Compare Source

This is a bug fix release addressing two issues:

Bundle polling is being misconfigured when discovery bundle is updated (#​8215)

This is an issue where the polling interval for discovery (discovery.polling.min_delay_seconds and
discovery.polling.max_delay_seconds) were misinterpreted on reconfiguration, causing extremely long update intervals.

Reported by @​loganmiller-chime, authored by @​sspaink

Decision log size buffer

buffer_size_limit_bytes misconfigured during reconfiguration (#​8213)

This is a regression in the decision log, where the decision_logs.reporting.buffer_size_limit_bytes was mistakenly
assigned the value of decision_logs.reporting.upload_size_limit_bytes during reconfiguration.
This issue is only present when decision_logs.reporting.buffer_type is set to size, which is the default value.

Authored by @​sspaink

v1.12.2

Compare Source

This bug fix release address issues found in the new string interpolation feature

v1.12.1

Compare Source

This bug fix release reverts a change to regex.replace that unintentionally changed its behaviour for anchored regular expressions.

  • Revert "topdown: make regex.replace respect cancellation" (authored by @​srenatus)

v1.12.0

Compare Source

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • Support for string interpolation in the Rego language
  • Faster compilation and runtime
  • Fixes published in the v1.11.1 release
String Interpolation (#​4733)

The Rego language has been extended to support String Interpolation,
which provides a readable means to compose strings containing dynamic values determined at evaluation time.

An interpolated string is composed of a template-string containing zero or more template-expressions that evaluates to a value at evaluation time.
The $ character prefix identifies a template-string, and template-expressions are declared by being enclosed in curly-braces ({, }).

Additionally, undefined template-expression values don't halt evaluation; instead, <undefined> will be injected into the generated string.

package interpolation

allowed_roles := ["admin", "employee"]

default role := "guest"
role := input.role

deny contains $"User {input.username}'s role was '{role}', but must be one of {allowed_roles}" if {
  not role in allowed_roles
}
{
  "deny": [
    "User <undefined>'s role was 'guest', but must be one of [\"admin\", \"employee\"]"
  ],
}

String interpolation is a more readable and less error-prone substitute for the sprintf built-in function.

Authored by @​johanfylling reported by @​anderseknert

Help us out!

New Rego language features are exciting, and we want to maximize their usefulness. If you come across tools and integrations in the community where string interpolation isn't properly handled, such as syntax highlighting, please reach out and let us know.

Runtime, SDK, Tooling
Compiler, Topdown and Rego
Docs, Website, Ecosystem
Miscellaneous

v1.11.1

Compare Source

This is a bugfix release:

Memory exhaustion via forged gzip header

A crafted HTTP request any of OPA's HTTP endpoints would lead OPA to use a large amount of memory, triggering
an out-of-memory process exit.

This weakness in OPA's HTTP API gzip handling is as old as the gzip handling itself.
A configurable limit was introduced in v0.67.0, but it has been shown that this security measure wasn't sufficient to avoid running out of memory in memory-constrained setups.
Thanks to @​thevilledev for reporting and fixing this issue.

It only applies to OPA running as server (as a binary or in a container, as "sidecar").
To trigger an OOM process exit using this weakness, an adversary must be able to send an HTTP request directly to OPA.
This would be the case if they are in the same network, there is no proxy in front of OPA, or if OPA was exposed to the internet, which is advised against.

By the nature of HTTP encodings, this would be effective before token-based authentication and authorization policies, so these measures do not protect against the attack vector.
If all OPA endpoints are using TLS-based authentication (mutual TLS, "mTLS"), then an adversary cannot do harm with this method.

Please note that while we're taking all of these issues seriously, OPA isn't designed for adversary environments.
It's strongly advised not to expose any of its endpoints to the public internet.
Furthermore, available security measures should be applied regardless, for a defense in depth approach.
See the documentation for the available means of authentication and authorization in OPA.

Please also check out our Security Policy for reporting critical issues and bugs.

Decision Logs dropped (introduced in OPA v1.9.0)

When the decision logs buffer was uploaded, the buffer limit inadvertently got reset to the default upload limit (32kb).
This causes logs to be dropped that shouldn't have been dropped.

This default is overridden by the configuration value decision_logs.reporting.upload_size_limit_bytes, see the docs on decision logs.

There's a Prometheus metric for dropped events, counter_decision_logs_dropped_buffer_size_limit_bytes_exceeded,
and you can check that for unexpectedly high counts.

Reported by @​johanneslarsson #​8123, fixed by @​sspaink.

The release is otherwise identical to v1.11.0.

v1.11.0

Compare Source

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • More efficient connection management in the http.send built-in function
  • More performant loading of large bundles containing multiple Rego files
Immutable Releases

Starting with this release, OPA releases are immutable for increased security.

Runtime, SDK, Tooling
Compiler, Topdown and Rego
Docs, Website, Ecosystem
Miscellaneous
  • Bump golangci-lint, more gocritic linters (#​8052) authored by @​anderseknert
  • Tidy up and unify sync pool handling (#​8068) authored by @​anderseknert
  • builtins: Add StringOperandByteSlice helper (#​8048) authored by @​anderseknert
  • test: Add test cases for consistent cache behavior (#​8015) authored by @​DFrenkel
  • util/performance: Remove math.Log10, remove unused KeysCount (#​8041) authored by @​srenatus
  • workflow: Add Benchmarks workflow (#​8072) authored by @​srenatus
  • workflows/pull-request: Update macos versions (#​8030) authored by @​srenatus
  • Dependency updates; notably:
    • build: golang 1.25.3 -> 1.25.4 (#​8051) authored by @​srenatus
    • build(deps): Bump github.com/bytecodealliance/wasmtime-go from v37.0.0 to v39.0.1 (#​8075) authored by @​srenatus
    • build(deps): Bump github.com/containerd/containerd/v2 from 2.1.4 to 2.2.0
    • build(deps): Bump github.com/huandu/go-sqlbuilder from 1.37.0 to 1.38.1
    • build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.0.11 to 3.0.12
    • build(deps): Bump github.com/vektah/gqlparser/v2 from 2.5.30 to 2.5.31 (#​8027) authored by @​johanfylling
    • build(deps): Bump golang.org/x/crypto from 0.43.0 to 0.45.0
    • build(deps): Bump golang.org/x/net from 0.44.0 to 0.45.0
    • build(deps): Bump golang.org/x/time from 0.13.0 to 0.14.0
    • build(deps): Bump google.golang.org/grpc from 1.75.1 to 1.76.0
    • build(deps): Bump google.golang.org/protobuf from 1.36.9 to 1.36.10

v1.10.1

Compare Source

This is a bugfix release for the split builtin: In v1.10.0, it was looping infinitely when used with an empty-string delimiter (#​8018).

Reported by @​SignalRichard, authored by @​srenatus

The release is otherwise identical to v1.10.0.

v1.10.0

Compare Source

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • Non-static arm64 executables for linux and darwin
  • Performance improvements to the formatter, compiler, and runtime
  • A new --fail-on-empty flag for opa test
  • Support for IS NOT NULL query statements in the Compile API
Non-static OPA binaries for linux/arm64 and darwin/arm64

Starting with this release, OPA will ship non-static arm64 executables for linux and darwin.
Furthermore, the openpolicyagent/opa:latest docker image is a multi-platform image with arm64 support.

Runtime, Tooling
Compiler, Topdown and Rego
Docs, Website, Ecosystem
Miscellaneous
Optionally fail when opa test did not run any tests

With the new --fail-on-empty flag, accidentally running opa test in a directory without any tests or
with a -r that did not match any test names, can be caught by making the test fail instead.

v1.9.0

Compare Source

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • Compile API extensions ported from EOPA
  • Improved rule indexing
Compile Rego Queries Into SQL Filters (#​7887)

Compile API extensions with support for SQL filter generation previously exclusive to EOPA has been ported into OPA.

Example

With OPA running with this policy, we'll compile the query data.filters.include into SQL filters:

package filters

# METADATA

# scope: document
# compile:

#   unknowns: [input.fruits]
include if input.fruits.name == input.favorite
Example Request
POST /v1/compile/filters/include HTTP/1.1
Content-Type: application/json
Accept: application/vnd.opa.sql.postgresql+json

{
  "input": {
    "favorite": "pineapple"
  }
}
Example Response
HTTP/1.1 200 OK
Content-Type: application/vnd.opa.sql.postgresql+json

{
  "result": {
    "query": "WHERE fruits.name = E'pineapple'"
  }
}

See the documentation for more details.

Authored by @​srenatus and @​philipaconrad

Improved Rule Indexing For "Naked" Refs (#​7897)

OPA's rule indexer is a means by which OPA can optimize evaluation performance.
Briefly, the indexer can in some cases determine that a rule won't successfully evaluate before it's evaluated based on the query input.
The indexer previously only considered terms in certain compound expressions, ignoring single terms; e.g. an expression containing a sole "naked" ref. This has now changed!

Example

Given a policy with an allow rule containing two "naked" refs: input.foo and input.bar:

package example

allow if {
    input.foo
    input.bar
}

and the input document:

{
    "foo": 1
}

before this improvement, when evaluating the query data.example.allow, we get the trace log:

query:1           Enter data.example.allow = _
query:1           | Eval data.example.allow = _
query:1           | Index data.example.allow (matched 1 rule, early exit)
policy.rego:3     | Enter data.example.allow
policy.rego:5     | | Eval input.foo
policy.rego:6     | | Eval input.bar
policy.rego:6     | | Fail input.bar
policy.rego:5     | | Redo input.foo
query:1           | Fail data.example.allow = _

Here, we can see that the allow rule is evaluated, but fails on the input.bar expression, as it's referencing an undefined value.

With the improvement to the indexer, we instead get:

query:1     Enter data.example.allow = _
query:1     | Eval data.example.allow = _
query:1     | Index data.example.allow (matched 0 rules, early exit)
query:1     | Fail data.example.allow = _

Where we can see that the allow rule was never evaluated, since the input doesn't meet the conditions established by the indexer; i.e. both input.foo and input.bar must have defined values.

Authored by @​srenatus

Runtime, Tooling
Compiler, Topdown and Rego
Docs, Website
Miscellaneous

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/openpolicyagent-opa-1.x branch from bb72e13 to 7515d85 Compare August 31, 2025 11:32
@renovate renovate bot changed the title chore(deps): update openpolicyagent/opa docker tag to v1.7.1 chore(deps): update openpolicyagent/opa docker tag to v1.8.0 Aug 31, 2025
@renovate renovate bot force-pushed the renovate/openpolicyagent-opa-1.x branch from 7515d85 to 56da7d2 Compare September 26, 2025 11:03
@renovate renovate bot changed the title chore(deps): update openpolicyagent/opa docker tag to v1.8.0 chore(deps): update openpolicyagent/opa docker tag to v1.9.0 Sep 26, 2025
@renovate renovate bot force-pushed the renovate/openpolicyagent-opa-1.x branch from 56da7d2 to 8e0dd7a Compare October 31, 2025 21:53
@renovate renovate bot changed the title chore(deps): update openpolicyagent/opa docker tag to v1.9.0 chore(deps): update openpolicyagent/opa docker tag to v1.10.0 Oct 31, 2025
@renovate renovate bot force-pushed the renovate/openpolicyagent-opa-1.x branch from 8e0dd7a to 6190ea4 Compare November 5, 2025 18:44
@renovate renovate bot changed the title chore(deps): update openpolicyagent/opa docker tag to v1.10.0 chore(deps): update openpolicyagent/opa docker tag to v1.10.1 Nov 5, 2025
@renovate renovate bot force-pushed the renovate/openpolicyagent-opa-1.x branch from 6190ea4 to cd41f72 Compare November 26, 2025 17:58
@renovate renovate bot changed the title chore(deps): update openpolicyagent/opa docker tag to v1.10.1 chore(deps): update openpolicyagent/opa docker tag to v1.11.0 Nov 26, 2025
@renovate renovate bot force-pushed the renovate/openpolicyagent-opa-1.x branch from cd41f72 to b7ddc28 Compare December 17, 2025 02:52
@renovate renovate bot changed the title chore(deps): update openpolicyagent/opa docker tag to v1.11.0 chore(deps): update openpolicyagent/opa docker tag to v1.11.1 Dec 17, 2025
@renovate renovate bot changed the title chore(deps): update openpolicyagent/opa docker tag to v1.11.1 chore(deps): update openpolicyagent/opa docker tag to v1.12.0 Dec 18, 2025
@renovate renovate bot force-pushed the renovate/openpolicyagent-opa-1.x branch 2 times, most recently from c2a5e71 to 1e43fe4 Compare December 18, 2025 23:28
@renovate renovate bot changed the title chore(deps): update openpolicyagent/opa docker tag to v1.12.0 chore(deps): update openpolicyagent/opa docker tag to v1.12.1 Dec 18, 2025
@renovate renovate bot force-pushed the renovate/openpolicyagent-opa-1.x branch from 1e43fe4 to e534544 Compare January 6, 2026 18:47
@renovate renovate bot changed the title chore(deps): update openpolicyagent/opa docker tag to v1.12.1 chore(deps): update openpolicyagent/opa docker tag to v1.12.2 Jan 6, 2026
@renovate renovate bot force-pushed the renovate/openpolicyagent-opa-1.x branch from e534544 to 1a1175e Compare January 14, 2026 23:37
@renovate renovate bot changed the title chore(deps): update openpolicyagent/opa docker tag to v1.12.2 chore(deps): update openpolicyagent/opa docker tag to v1.12.3 Jan 14, 2026
@renovate renovate bot force-pushed the renovate/openpolicyagent-opa-1.x branch from 1a1175e to 3ffa927 Compare January 29, 2026 19:10
@renovate renovate bot changed the title chore(deps): update openpolicyagent/opa docker tag to v1.12.3 chore(deps): update openpolicyagent/opa docker tag to v1.13.0 Jan 29, 2026
@renovate renovate bot force-pushed the renovate/openpolicyagent-opa-1.x branch from 3ffa927 to ef1a4e6 Compare January 29, 2026 22:44
@renovate renovate bot changed the title chore(deps): update openpolicyagent/opa docker tag to v1.13.0 chore(deps): update openpolicyagent/opa docker tag to v1.13.1 Jan 29, 2026
@renovate renovate bot force-pushed the renovate/openpolicyagent-opa-1.x branch from ef1a4e6 to 1b8415a Compare February 18, 2026 11:52
@renovate renovate bot changed the title chore(deps): update openpolicyagent/opa docker tag to v1.13.1 chore(deps): update openpolicyagent/opa docker tag to v1.13.2 Feb 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

Comments