Open Policy Agent v1.21.0
++++~~~~~~~-******
Changes
- Plugins/rest: Remove unused azureSigningAuthPlugin.host fieldremoved
- Rest: Remove stray debug print in Azure KeyVault signingremoved
- Ast: Count a ref once when an index entry replaces its var entrychanged
- Ast: Index a lookup into a collection in base datachanged
- Ast: Index refs rooted at a local variablechanged
- Ast: Let concrete index values supersede leftover "any" entrieschanged
- Ast: Number the references an index is built onchanged
- Ast: Number the refs a rule requireschanged
- Ast: Number the rules an index holdschanged
- Ast: Keep refs no rule constrains to a value out of the triechanged
- Ast: Stop a rule index path at its last constrained levelchanged
- Ast: Walk a rule tree's children in a stable orderchanged
72 more lines
- Index: Also index suffix matching (endswith, strings.any_suffix_match) + some tweakschanged
- Add startswith and strings.any_prefix_match indexingchanged
- Rego: Benchmark index lookups at every match positionchanged
- Plugins/logs: Make BenchmarkMaskingRuleCountsNop vary the rule countchanged
- Cheaper custom function callschanged
- Fix linear runtime for Array.set due to rehashingchanged
- General performance improvements in compilerchanged
- Startswith, endswith, strings.any_prefix_match and strings.any_suffix_matchadded
- A reference that reads a key out of the object at its ground prefix in base dataadded
- References rooted at a local variable (x := input; x.foo == "a") are indexed theadded
- A rule's path through the trie stops at the last level it constrains, and a referenceadded
- Candidates come back in declaration order, which the indexer documented but did notadded
- Metricsexport: Support custom headers on the OTLP exporteradded
- Plugins/logs: Add trace_id, span_id and request_context to the event ASTadded
- Tracing: Add distributed_tracing.exclude_pathsadded
- Topdown: Add stack traces to evaluation errorsadded
- Download: Fix Trigger() racing a cancelled context into a false successfixed
- Download: Fix ignored OCI downloader settingsfixed
- Download: Resolve OCI bundles behind an image indexfixed
- Runner.CapturePrintOutput setting never readfixed
- Plugins/logs: Fix data race on the cached mask and drop queriesfixed
- Rest: Fix SSO cache path written to wrong fieldfixed
- Ast: Avoid pointer escape in GenericTransformerfixed
- Ast: Fix panic comparing a decimal zero with a non-integral number (#9098) reported andfixed
- Ast: Fix type errors from allowed undefined function callsfixed
- Ast: Resolve local ref heads in the ground-prefix path toofixed
- Rego: Fix EvalDisableInlining always being overriddenfixed
- Topdown: Fix regex cache leak (#9087) reported andfixed
- Topdown: Fix sprintf formatting of floats with zero fractionfixed
- Improved rule indexingother
- Improved rule recursion checkother
- YAML is parsed against the 1.2 core schema (breaking change)other
- Compile: don't panic on non-string table/column mappingsother
- Debug: Adding query stack-trace framing modeother
- Dependencies: Include else bodies and unused ref bindingsother
- Download: Note that ociTarget.Exists is dead codeother
- Download: Stop BundleRequest timer on OCI early returnsother
- Format: don't drop comments after an inline if bodyother
- Plugins/logs: Report upload failures when retrying requeued chunksother
- Repl: Honor DisableUndefinedOutput settingother
- Repl: Recall multi-line statements as one history entryother
- Runtime: Only log diagnostic API access at DEBUGother
- Runtime: Reload the config file on change when --watch is setother
- Runtime: Return the listener error instead of exiting the processother
- Runtime: Revert config file reload on --watchother
- Server: Build the middleware stack in one placeother
- Storage/disk: Split large bundle writes across transactionsother
- Yaml: Reject documents with unreachable contentother
- Ast: Build package exports in a single passother
- Ast: Clear shared output buffer in outputVarsForExprEqother
- Ast: Clear the term cache when a brace operand guess is abandonedother
- Ast: Collect a lookup's candidates in a bitsetother
- Ast: Emphasize top-most differing types in type errorsother
- Ast: Hint at missing future keyword importsother
- Ast: Mark JSON schema builtins nondeterministicother
- Ast: Only compute template string scopes for rules that have oneother
- Ast: Point object parse errors at the offending tokenother
- Ast: Report keywords used as rule namesother
- Ast: Report violations from multiple compiler stagesother
- Ast: Skip the reordered body's output vars where no closure reads themother
- Ast: Type check the in operator against the collection's typesother
- Ast: Type empty object and array literals by their contentsother
- Ast: don't box a slice header on the way out of Transformother
- Ast: don't rebuild modules that have nothing to rewriteother
- Builtins: Reject leading zeroes and empty pre-release/build in semver built-insother
- Compiler: HasherMap returned by getExports never usedother
- Rego: Pass Time and Seed through Partial() like Eval() doesother
- Rego: don't run leaktest checks in a parallel testother
- Topdown: Hoist enumerate callbacks out of the loopother
- Topdown: Iterate known keys and save unknown ones during PE (#9139) reported andother
- Topdown: Record evaluated rules during partial evaluationother
- Wasm: Match topdown semantics in strings.replace_nother
80 maintenance lines (dependency bumps, CI, tests, docs)
- Document indexing of refs rooted at a local variablemaintenance
- Add Evolith to the OPA ecosystemmaintenance
- Address a number of broken links in blogmaintenance
- Address incorrect package name in examplemaintenance
- Ecosystem entry for Agent Evidence Admissionmaintenance
- Remove word from missed review to #9172maintenance
- Report builtin availability in other interpretersmaintenance
- Update Agent Evidence Admission repo linksmaintenance
- Update builtin availability in other interpretersmaintenance
- Updates to AI guidelinesmaintenance
- Website: Implement local search based on Pagefindmaintenance
- Website: Use new kapa attr to hide AI chat buttonmaintenance
- Ast: Add util.MapKeys helpermaintenance
- Ast: Enable more gocritic lintersmaintenance
- Ast: Enable unparam lintermaintenance
- Ast: More niceties, less allocs, less codemaintenance
- Ast: Pin BenchmarkObjectConstruction shuffle seedmaintenance
- Ast: Update remaining errors.As call sites to use errors.AsTypemaintenance
- Ast: Use modern Go in place of custom compare codemaintenance
- Ast: Where have all the allocs gone?maintenance
- Add bench-nightly, a three-arm benchlab experiment runnermaintenance
- Pin pigeon in build/tools instead of go run pkg@versionmaintenance
- Bundle: Avoid allocation in getdepthmaintenance
- Bundle: Remove unused writeModules helpermaintenance
- Bundle: Reuse encoder buffer while hashingmaintenance
- Bundle: deep-copy bundle data natively instead of via JSON round-tripmaintenance
- Check: Avoid allocating in checkExprEqmaintenance
- Publish benchmark trend on a schedule instead of per-pushmaintenance
- Run the nightly benchlab experimentmaintenance
- Cmd: Stop binding a fixed port in the run testsmaintenance
- Github: Drop python from the CodeQL language matrixmaintenance
- Nightly: Fix go get smoke testmaintenance
- Some more functional nicetiesmaintenance
- E2e: Wait for diagnostic listeners before running testsmaintenance
- Expanded testing for and/or keywordsmaintenance
- Topdown: Fix BulkStartsWith benchmark input generationmaintenance
- Topdown: Enable more revive lintersmaintenance
- Topdown: Fix flaky TestRegexBuiltinCachemaintenance
- Topdown: Fix linter issuesmaintenance
- Util: Add RoundTripFastmaintenance
- Plugins/logs: Use util.RoundTripFast for decision-log event conversionmaintenance
- Rego: Use util.RoundTripFast for input parsingmaintenance
- Storage: Use util.RoundTripFast for write round-trippingmaintenance
- Util: Decode RoundTrip's fallback into a fresh valuemaintenance
- Workflows: Check the nightly go-get job for retractions via the proxymaintenance
- Workflows: Remove benchmarks from nightlymaintenance
- Workflows: Run Regal's do.rq in the nightly compatibility checkmaintenance
- Workflows: Use OCP@main in nightlymaintenance
- Collapse v0 shim packages into a single file eachmaintenance
- Makefile: Add a benchlab targetmaintenance
- Remove retired go reportmaintenance
- Dependency updates:maintenance
- Bump to 1.27.1maintenance
- Bump github.com/dgraph-io/badger/v4 from 4.9.5 to 4.9.6maintenance
- Bump github.com/gobwas/glob to v1.0.0maintenance
- Bump github.com/huandu/go-sqlbuilder from 1.42.1 to 1.43.0maintenance
- Bump github.com/lestrrat-go/jwx/v3 from 3.1.1 to 3.3.0maintenance
- Bump github.com/olekukonko/tablewriter from 1.1.4 to 1.1.5maintenance
- Bump github.com/prometheus/client_model from 0.6.2 to 0.6.3maintenance
- Bump github.com/santhosh-tekuri/jsonschema/v6 from 6.0.2 to 6.0.3maintenance
- Bump github.com/sirupsen/logrus from 1.9.4 to 1.10.2maintenance
- Bump github.com/vektah/gqlparser/v2 from 2.5.36 to 2.5.37maintenance
- Bump go.opentelemetry.io/contrib/bridges/prometheus from 0.69.0 to 0.71.0maintenance
- Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.71.0maintenance
- Bump go.opentelemetry.io/otel from 1.44.0 to 1.46.0maintenance
- Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.44.0 to 1.46.0maintenance
- Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.44.0 to 1.46.0maintenance
- Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.44.0 to 1.46.0maintenance
- Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.46.0maintenance
- Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.46.0maintenance
- Bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.46.0maintenance
- Bump go.opentelemetry.io/otel/sdk/metric from 1.44.0 to 1.46.0maintenance
- Bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5maintenance
- Bump golang.org/x/sync from 0.22.0 to 0.23.0maintenance
- Bump golang.org/x/term from 0.45.0 to 0.46.0maintenance
- Bump golang.org/x/text from 0.40.0 to 0.42.0maintenance
- Bump golang.org/x/time from 0.15.0 to 0.16.0maintenance
- Bump google.golang.org/grpc from 1.82.1 to 1.83.2maintenance
- Bump google.golang.org/protobuf from 1.36.11 to 1.36.12maintenance
- Drop sigs.k8s.io/yaml (was 1.6.0)maintenance
164 lines2 removed9 added17 changed13 fixed43 other80 maintenancetyped from the source notes