Open Policy Agent 1.22.0
++++++++~********
Changes
- Ast: Make IntNumberTerm inlinablechanged
- New rego.v2 importadded
- Debug: Add JSON tags to debugger struct fieldsadded
- Format: Allow early exit on the fail conditionadded
- Metrics_export: Support resource attributes on exported metricsadded
- Plugins/logs: Support masking array-rooted input and result (#9356) reported andadded
- Runtime: Allow configuring the HTTP access log leveladded
- Ast: Add rego.v2 import (#9224) reported andadded
- Ast: Add location to import aliasesadded
- Bundle: Avoid using filepath in FS directory loaderfixed
- Bundle: Resolve wasm manifest paths against the base dirfixed
- Server: Resolve encoded request paths consistently in authorizer and handlersfixed
76 more lines
- Reject some-in bindings that also appear in the domainfixed
- Topdown: Fix net.cidr_contains false negatives on IPv6 subnets ending at ::ffff:ffff:ffff (#9396) reported andfixed
- Topdown: Fix partial eval panic on negated everyfixed
- Topdown: Fix substring overflow with huge lengthfixed
- Util: Correct JSON number comparison orderingfixed
- Configurable log level for HTTP access logsother
- Stricter handling of bundle signature filenames (breaking change)other
- Partial evaluation unrolls every over a known domainother
- Bundle: Canonicalize data.yml for bundle signatures (#9301) reported andother
- Bundle: Name the missing key when a signing block has a keyid but no keysother
- Bundle: Stricter bundle signatures filename handling. (#9289) reported andother
- Bundle: don't parse policies that activation deletesother
- Cmd/version: Note that the _static binaries are deprecatedother
- Cmd: Replace spf13/viper with os.LookupEnvother
- Compile: Escape slashes in annotation entrypoint pathsother
- Compile: Report untranslatable policies as fragment errorsother
- Compile: mirror, not negate, a comparison with the unknown on the rightother
- Format: Adding ast.RegoV2 enum to Go APIother
- Loader: Skip duplicate files and name the conflicting path in merge errorsother
- Metrics: Replace rcrowley/go-metrics with in-tree sample (#7536) reported andother
- Metrics: Tweak sample codeother
- Plugins/bundle: Optionally send superseded etags in If-None-Matchother
- Plugins/logs: Export decision log buffer size and upload counters to Prometheusother
- Plugins/logs: Include metrics and error in mask and drop policy input (#9357) reported andother
- Plugins/logs: Keep full chunks in the size buffer with manual triggerother
- Plugins/status: Export decision log status and drop counters to Prometheusother
- Runtime: Restart the serve routine to apply config file changesother
- Sdk: Convert ND builtins cache so decision log mask rules apply (#9355) reported andother
- Server/types: Skip the extras decode when all top-level keys are knownother
- Server: Create TLS file watcher before returning listenersother
- Server: Expose compile request body to the authorizerother
- Server: Expose query API request body to the authorizerother
- Server: Name not activated bundles in /health?bundles errorother
- Server: Report size and limit when request body is too largeother
- Tester: Only trace tests that have test cases (#9409) reported andother
- Ast/parser: Set generated on true bodiesother
- Ast/scanner: Report non-breaking spaces as illegal charactersother
- Ast: Attach annotations to statements in n log n timeother
- Ast: Attach rule annotations in linear timeother
- Ast: Bind hoisted vars in implicit not/and/or bodiesother
- Ast: Compare numbers of up to 15 digits as exact decimalsother
- Ast: Decode related-resource URI referencesother
- Ast: Hint why same-kind composites fail to unifyother
- Ast: Index references holding a local bound to a scalarother
- Ast: Keep the number range check off the plain number pathother
- Ast: Narrow ref vars with known values in the rule graphother
- Ast: Only narrow ref vars with bindings ahead of the refother
- Ast: Reject trailing minus in package declarationother
- Ast: Report dynamic recursion as 'may be recursive'other
- Ast: Report reserved names used as import aliasesother
- Ast: Treat SomeDecl/Every exprs as non-ground in Expr.IsGroundother
- Ast: rego_v2 capability implies template_strings and keywords_in_refsother
- Ast: ast, topdown: reject numbers with an out-of-range exponentother
- Ast: don't keep the statements a module was parsed fromother
- Ast: don't set a location on the interned zero term when parsing unary minusother
- Ast: don't state recursion conditions a builtin's result type rules outother
- Eval: Eliminate allocations in evalNotother
- Index: Two correctness tweaksother
- Internal/compiler: Limit authz schema check to the authz packageother
- Rego: Preserve eval options when preparing with partial evalother
- Topdown: Allocate base cache children on first insertother
- Topdown: Cache parsed JWT verification keysother
- Topdown: Cache the tries of any_prefix_match and any_suffix_matchother
- Topdown: Do arithmetic in the narrowest exact representationother
- Topdown: List all conflicting rules in eval_conflict_error (#9247) reported andother
- Topdown: Look up ground values in sets instead of scanningother
- Topdown: Match one string against strings.any_*_match search strings in placeother
- Topdown: Memoize opa.runtime redactionother
- Topdown: Replace go-patricia with sorted binary searchother
- Topdown: Skip label tracking when the policy has no labelsother
- Topdown: Skip rune conversion in indexof_n for ASCIIother
- Topdown: Unroll every over a known domainother
- Topdown: Various tweaksother
- Topdown: don't panic reversing strings that aren't valid UTF-8other
- Topdown: don't use set lookup fast path for unresolved refsother
- Wasm: Mark eq and assign as wasm-enabledother
26 maintenance lines (dependency bumps, CI, tests, docs)
- Update OPA MCP install optionsmaintenance
- Add OPA-AuthZEN to the OPA ecosystemmaintenance
- Clarify tls_use_system_certs false behavior (#9358) reported andmaintenance
- Explain peak memory during bundle updatesmaintenance
- Add James Alseth as a conftest maintainermaintenance
- Dependency updates; notably:maintenance
- Bump github.com/vektah/gqlparser/v2 from 2.5.37 to 2.5.58maintenance
- Bump google.golang.org/grpc from 1.83.2 to 1.84.0maintenance
- Bump go (1.27.1 -> 1.27.3) (#9340,maintenance
- Remove claude agents.md hookmaintenance
- Ast: Add regression test for rule conflict reportingmaintenance
- Ast: Reword comments that were only relevant at reviewmaintenance
- Capabilities: Integrate patch release v1.21.1maintenance
- Capabilities: Integrate patch release v1.21.3maintenance
- Cmd: Give the malformed remote bundle exec tests a longer timeoutmaintenance
- E2e: Go mod tidymaintenance
- Golangci-lint v2.13 -> v2.14maintenance
- Internal: Make better use of helpersmaintenance
- Nightly: Raise the go get smoke test timeout to 30 minutesmaintenance
- Nightly: Test opa-envoy-plugin main instead of the latest releasemaintenance
- Runtime: Serve TestTracingExcludePaths requests in-processmaintenance
- Runtime: Serve test servers without StartServermaintenance
- Topdown: Benchmark anyStartsWithAny across input shapesmaintenance
- Topdown: Benchmark naked refs to large base-doc arraysmaintenance
- Topdown: Enable more revive linter rulesmaintenance
- Topdown: Start the partial-eval test server on first usemaintenance
114 lines8 added1 changed8 fixed71 other26 maintenancetyped from the source notes