Update openpolicyagent/opa Docker tag to v1.19.0 (main) - #1858
Open
renovate[bot] wants to merge 1 commit into
Open
Update openpolicyagent/opa Docker tag to v1.19.0 (main)#1858renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
Bot
added
the
v3.x
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1858 +/- ##
=======================================
Coverage 85.20% 85.20%
=======================================
Files 105 105
Lines 13777 13777
=======================================
Hits 11739 11739
Misses 1514 1514
Partials 524 524 Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.18.2→1.19.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
open-policy-agent/opa (openpolicyagent/opa)
v1.19.0Compare Source
This release contains a mix of new features and bug fixes. Notably:
:=)strings.split_nbuilt-in functionFix SQL injection vector in Compile API: Quote SQL filter field identifiers (#8945)
The field names in the SQL emitted by the Compile API come from partially evaluated refs, so a
policy that selects a dynamic key — such as
input.fruits[input.column]— puts caller-controlledtext in an identifier position. That text was emitted verbatim, which turns
into
and an application appending the filter to its query returns rows the policy denies.
Field segments that are not bare identifiers are now quoted at the UCAST-to-SQL boundary, with any
embedded quote character escaped. Ordinary column names stay unquoted, so existing filters keep
their current shape and remain case-insensitive on Postgres.
Authored by @thevilledev
Behavior change: stricter safety for assignment (
:=) (#3546)The assignment operator (
:=) is documented as "syntactic sugar for=, local variable creation,and additional compiler checks," and the safety checker reflects that: after
rewriting,
:=is treated identically to=(unification), so an assignment'sright-hand side can be made safe by unifying "backwards" through the left-hand
side. This means policies like
x := y; x = 7compile (bindingyto7)even though
yis never assigned, andx := y; obj[x]can silently degrade anexpected constant-time lookup into full iteration.
This change makes the right-hand-side of
:=be treated as a read thatmust be made safe by other expressions, and can no longer be satisfied through
the left-hand-side. Affected policies that previously compiled now fail with a
rego_unsafe_var_error. Reference iteration on the right-hand-side (e.g.some k; v := obj[k]) is unaffected.Note: this is a deliberate semantic change, not a fix to match documented
behavior — the intended semantics of
:=in this case were never specified.Authored by @sspaink, reported by @tsandall
WebAssembly runtime: wasmtime-go replaced with wazero (#7557)
OPA's WebAssembly runtime — used by the
wasmevaluation target and the WASM SDK — now runs onthe pure-Go wazero runtime instead of
bytecodealliance/wasmtime-go. Thisremoves the cgo dependency from this path, so
wasm-enabled builds no longer need a C toolchain.Compiled policy modules are now cached process-wide, so repeated VM creation for the same policy
skips recompilation. On an Apple M4 Max this makes wasm cold start (compile + instantiate + first
eval) about 73% faster, and warm evaluation about 29% faster with ~28% fewer allocations.
Authored by @srenatus, reported by @sspaink
Configuration validation moved to Rego, with warnings on unknown options (#8891)
Top-level configuration validation and default injection (
default_decision,default_authorization_decision,labels) is now expressed as an embedded Rego policy rather thanhand-written Go, as is the validation of
server.metricsandmetrics_export.The user-visible effect is that unrecognized configuration options are reported instead of being
silently ignored. A typo such as
decision_loginstead ofdecision_logsnow logs a warning atstartup:
{"level":"warning","msg":"unknown configuration option \"decision_log\" encountered"}These are warnings, not errors: OPA starts as before, and sections that are intentionally
user-extensible are left alone, so extra keys there do not warn. Embedders reading configuration
through
config.ParseConfigcan find the same messages onConfig.Warnings.Authored by @sspaink
Add
strings.split_nbuilt-in function (#8344)Policies often need only the first or last few parts of a split string, but the existing
splitbuilt-in always returns every part, so the count has to be worked around with wildcards or a slice.
strings.split_ntakes the firstnsplit parts from the front or the back of the string,depending on whether
nis positive or negative:If
abs(n)is larger than the number of parts, all parts are returned. Annof0returns anempty array.
Authored by @wonju-dev, reported by @anderseknert
Improved REPL line editing, with history file migration (#962)
Pasting a tab-indented snippet into the REPL triggered tab-completion on the pasted tab, corrupting
the input (e.g. injecting a completion candidate mid-line and producing a spurious parse error).
Fixing that requires bracketed paste, where the terminal wraps pasted text in markers so the line
reader inserts it literally instead of treating an embedded tab as a completion request. The
previous reader,
peterh/liner, has no bracketed-paste support and is unmaintained (last release2021), so it has been replaced with
reeflective/readline.The new reader persists history as JSON lines instead of one command per line. Existing history
files (
~/.opa_historyby default, or the path given to--history) are detected and migrated inplace the first time the REPL loads them, so history written by earlier versions of OPA is kept.
OPA's own multi-line buffering is unchanged, and
readline's native multi-line editing is leftdisabled to avoid changing REPL behavior.
Authored by @sspaink, reported by @aeneasr
Runtime, SDK, Tooling
--formatflag for proto/JSON plan bundles toopa build(#8825) authored by @sspainkReadHeaderTimeoutto32son all HTTP servers (#8877) authored by @RinZ27RoundTripperperDecision(#8884) authored by @paulo-raca--var-valuescmd output (#7830) authored by @sspaink, reported by @charlieegan3Compiler, Topdown and Rego
future.keywords.notimport in Rego v0 (#8953) authored by @johanfyllingx in [...](#8918) reported and authored by @srenatusTermValueEqualperformance regression (#8863) authored by @mchittenCogeneratedExprsreturn deterministic order (#8895) authored by @sspainkobject.*builtins (#8692) reported and authored by @anderseknert"a", "a" in {"a"}not returningtrue(#8747) authored by @anderseknertformat_intprecision loss for integers larger than 64 bits (#8857) authored by @SynvoyaSliceStack/GroupStack, unify refStack/functionMocksStack/saveStack (#8886) authored by @srenatusruletrie.Children()call inDepth()(#8886) authored by @srenatusfunctionMocksStackon genericGroupStack[T](#8886) authored by @srenatusDocs, Website, Ecosystem
in, bare refs; modernize rego (#8822) authored by @srenatus, reported by @tsandallMiscellaneous
test.WithTempFS(#8908) authored by @anderseknertAddressing GHSA-fxhp-mv3v-67qp
Configuration
📅 Schedule: (UTC)
* 0-3 * * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.