Open Policy Agent v1.11.1

Changes

• !If all OPA endpoints are using TLS-based authentication (mutual TLS, "mTLS"), then an adversary cannot do harm with this method.security
• !Please also check out our Security Policy for reporting critical issues and bugs.security
• ·A crafted HTTP request any of OPA's HTTP endpoints would lead OPA to use a large amount of memory, triggeringother
• ·Thanks to @thevilledev for reporting and fixing this issue.other
• ·By the nature of HTTP encodings, this would be effective before token-based authentication and authorization policies, so these measures do not protect against the attack vector.other
• ·When the decision logs buffer was uploaded, the buffer limit inadvertently got reset to the default upload limit (32kb).other
• ·This causes logs to be dropped that shouldn't have been dropped.other
• ·This default is overridden by the configuration value decision_logs.reporting.upload_size_limit_bytes, see the docs on decision logs.other
• ·There's a Prometheus metric for dropped events, counter_decision_logs_dropped_buffer_size_limit_bytes_exceeded,other
• ·Reported by @johanneslarsson #8123, fixed by @sspaink.other
• ·The release is otherwise identical to v1.11.0.other