Pulumi v3.269.0
Pulumi v3.269.0 adds runtime functions to the Go, Node.js and Python SDKs that check whether a resource with a given ID exists without adopting it into the stack. It runs OPA policy packs through a pulumi-language-opa plugin that the CLI downloads on demand. The release also makes pulumi logs and pulumi watch error by default ahead of their removal, and includes 18 fixes across PCL, the CLI and the SDKs.
platform teams Teams running OPA policy packs will get the CLI-downloaded language plugin instead of the old analyzer fallback for runtimes without a language plugin. Scripts that call pulumi logs or pulumi watch will start failing by default and should be checked before the removal lands.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
- +[sdk] Add runtime functions to the Go, Node.js and Python SDKs that check whether a resource with a given ID exists without adopting it into the stackadded
- +[engine] Negotiate OutputValues on Call so SDKs receive per-value return dependenciesadded
- +[auto] Add convert to the generated automation APIs for NodeJS, Python and Goadded
- +[auto] Add refresh to the generated automation APIs for NodeJS, Python and Goadded
- +[auto] Add about commands to the generated automation APIs for NodeJS, Python and Goadded
- +[auto] Add config commands to the generated automation APIs for NodeJS, Python and Goadded
- +[cli/policy] Run OPA policy packs through the pulumi-language-opa language plugin, which the CLI downloads on demand, and stop falling back to a pulumi-analyzer-policy-<runtime> plugin for policy packs whose runtime has no language pluginadded
- +[cli/new] Mark npm as the recommended package manager when prompting in pulumi newadded
- +[sdk/go] Make IDInput and URNInput satisfy StringInput, and AssetInput and ArchiveInput satisfy AssetOrArchiveInputadded
- +[cli/new] Skip the package manager prompt for new Node.js projects when only one package manager is installedadded
- +[cli/new] Use pip without prompting for a toolchain in pulumi new when neither Poetry nor uv is installedadded
- +[cli] Make pulumi logs error by default before its removaladded
19 more lines
- +[cli] Make pulumi watch error by default before its removaladded
- *[pcl] Accept a lookup default of any type and type the result as the unification of the element type and the defaultfixed
- *[pcl] Report a missing lookup default at bind time instead of failing when the program runsfixed
- *[pcl] Accept a tuple literal that holds an output where a function or property expects the input form of a tuple, such as length([secret(x)])fixed
- *[pcl] Fix a panic in the PCL interpreter's entries built-in on a map whose values have different shapes or on an empty mapfixed
- *[cli/policy] Fix pulumi policy group edit so that it adds and removes stacks, Policy Packs, and Insights accountsfixed
- *[pcl] Stop lifting a prompt operand's type-conversion wrapper into an unnecessary apply, which produced invalid Go codefixed
- *[cli/new] Fix switching template source when prefixes matchfixed
- *[cli] Redact secrets carried on output values in plaintext log output and in pulumi logs sharefixed
- *[cli/new] Fix template fetching when changing branchesfixed
- *[cli] Log in through the browser on pulumi login in agent mode instead of creating a new agent accountfixed
- *[programgen/go] Remove redundant ToIDOutput().ToStringOutput() conversions when passing resource IDs to string inputsfixed
- *[programgen/go] Type object literals of outputs as pulumi.StringMap and friends so they compile and export without a castfixed
- *[cli/neo] Honor optional refresh settings in agent previews without persisting refreshed statefixed
- *[cli] Stop finished download and unpack progress bars from reappearing below later output, such as the pulumi new success messagefixed
- *[sdk/python] Fix Output.recover failing to catch faults that arrive through apply or after the program body has returnedfixed
- *[pcl] Recover from failed function calls with recover in the PCL interpreterfixed
- *[pcl] Check assignability of recursive types, such as a schema object that nests itself, without overflowing the stackfixed
- *[pcl] Fix Equals on recursive object types that differ under a cyclefixed
31 lines13 added18 fixedtyped from the source notes
- ·This release fixes a compiler regression introduced in OPA v1.21.0.other
- ·Array literals weren't affected, and neither were literals that contain some other non-ground term.other
2 lines2 othertyped from the source notes
- -Plugins/rest: Remove unused azureSigningAuthPlugin.host fieldremoved
- -Rest: Remove stray debug print in Azure KeyVault signingremoved
- ~Ast: Count a ref once when an index entry replaces its var entrychanged
- ~Ast: Index a lookup into a collection in base datachanged
- ~Ast: Index refs rooted at a local variablechanged
- ~Ast: Let concrete index values supersede leftover "any" entrieschanged
- ~Ast: Number the references an index is built onchanged
- ~Ast: Number the refs a rule requireschanged
- ~Ast: Number the rules an index holdschanged
- ~Ast: Keep refs no rule constrains to a value out of the triechanged
- ~Ast: Stop a rule index path at its last constrained levelchanged
- ~Ast: Walk a rule tree's children in a stable orderchanged
72 more lines
- ~Index: Also index suffix matching (endswith, strings.any_suffix_match) + some tweakschanged
- ~Add startswith and strings.any_prefix_match indexingchanged
- ~Rego: Benchmark index lookups at every match positionchanged
- ~Plugins/logs: Make BenchmarkMaskingRuleCountsNop vary the rule countchanged
- ~Cheaper custom function callschanged
- ~Fix linear runtime for Array.set due to rehashingchanged
- ~General performance improvements in compilerchanged
- +Startswith, endswith, strings.any_prefix_match and strings.any_suffix_matchadded
- +A reference that reads a key out of the object at its ground prefix in base dataadded
- +References rooted at a local variable (x := input; x.foo == "a") are indexed theadded
- +A rule's path through the trie stops at the last level it constrains, and a referenceadded
- +Candidates come back in declaration order, which the indexer documented but did notadded
- +Metricsexport: Support custom headers on the OTLP exporteradded
- +Plugins/logs: Add trace_id, span_id and request_context to the event ASTadded
- +Tracing: Add distributed_tracing.exclude_pathsadded
- +Topdown: Add stack traces to evaluation errorsadded
- *Download: Fix Trigger() racing a cancelled context into a false successfixed
- *Download: Fix ignored OCI downloader settingsfixed
- *Download: Resolve OCI bundles behind an image indexfixed
- *Runner.CapturePrintOutput setting never readfixed
- *Plugins/logs: Fix data race on the cached mask and drop queriesfixed
- *Rest: Fix SSO cache path written to wrong fieldfixed
- *Ast: Avoid pointer escape in GenericTransformerfixed
- *Ast: Fix panic comparing a decimal zero with a non-integral number (#9098) reported andfixed
- *Ast: Fix type errors from allowed undefined function callsfixed
- *Ast: Resolve local ref heads in the ground-prefix path toofixed
- *Rego: Fix EvalDisableInlining always being overriddenfixed
- *Topdown: Fix regex cache leak (#9087) reported andfixed
- *Topdown: Fix sprintf formatting of floats with zero fractionfixed
- ·Improved rule indexingother
- ·Improved rule recursion checkother
- ·YAML is parsed against the 1.2 core schema (breaking change)other
- ·Compile: don't panic on non-string table/column mappingsother
- ·Debug: Adding query stack-trace framing modeother
- ·Dependencies: Include else bodies and unused ref bindingsother
- ·Download: Note that ociTarget.Exists is dead codeother
- ·Download: Stop BundleRequest timer on OCI early returnsother
- ·Format: don't drop comments after an inline if bodyother
- ·Plugins/logs: Report upload failures when retrying requeued chunksother
- ·Repl: Honor DisableUndefinedOutput settingother
- ·Repl: Recall multi-line statements as one history entryother
- ·Runtime: Only log diagnostic API access at DEBUGother
- ·Runtime: Reload the config file on change when --watch is setother
- ·Runtime: Return the listener error instead of exiting the processother
- ·Runtime: Revert config file reload on --watchother
- ·Server: Build the middleware stack in one placeother
- ·Storage/disk: Split large bundle writes across transactionsother
- ·Yaml: Reject documents with unreachable contentother
- ·Ast: Build package exports in a single passother
- ·Ast: Clear shared output buffer in outputVarsForExprEqother
- ·Ast: Clear the term cache when a brace operand guess is abandonedother
- ·Ast: Collect a lookup's candidates in a bitsetother
- ·Ast: Emphasize top-most differing types in type errorsother
- ·Ast: Hint at missing future keyword importsother
- ·Ast: Mark JSON schema builtins nondeterministicother
- ·Ast: Only compute template string scopes for rules that have oneother
- ·Ast: Point object parse errors at the offending tokenother
- ·Ast: Report keywords used as rule namesother
- ·Ast: Report violations from multiple compiler stagesother
- ·Ast: Skip the reordered body's output vars where no closure reads themother
- ·Ast: Type check the in operator against the collection's typesother
- ·Ast: Type empty object and array literals by their contentsother
- ·Ast: don't box a slice header on the way out of Transformother
- ·Ast: don't rebuild modules that have nothing to rewriteother
- ·Builtins: Reject leading zeroes and empty pre-release/build in semver built-insother
- ·Compiler: HasherMap returned by getExports never usedother
- ·Rego: Pass Time and Seed through Partial() like Eval() doesother
- ·Rego: don't run leaktest checks in a parallel testother
- ·Topdown: Hoist enumerate callbacks out of the loopother
- ·Topdown: Iterate known keys and save unknown ones during PE (#9139) reported andother
- ·Topdown: Record evaluated rules during partial evaluationother
- ·Wasm: Match topdown semantics in strings.replace_nother
80 maintenance lines (dependency bumps, CI, tests, docs)
- ·Document indexing of refs rooted at a local variablemaintenance
- ·Add Evolith to the OPA ecosystemmaintenance
- ·Address a number of broken links in blogmaintenance
- ·Address incorrect package name in examplemaintenance
- ·Ecosystem entry for Agent Evidence Admissionmaintenance
- ·Remove word from missed review to #9172maintenance
- ·Report builtin availability in other interpretersmaintenance
- ·Update Agent Evidence Admission repo linksmaintenance
- ·Update builtin availability in other interpretersmaintenance
- ·Updates to AI guidelinesmaintenance
- ·Website: Implement local search based on Pagefindmaintenance
- ·Website: Use new kapa attr to hide AI chat buttonmaintenance
- ·Ast: Add util.MapKeys helpermaintenance
- ·Ast: Enable more gocritic lintersmaintenance
- ·Ast: Enable unparam lintermaintenance
- ·Ast: More niceties, less allocs, less codemaintenance
- ·Ast: Pin BenchmarkObjectConstruction shuffle seedmaintenance
- ·Ast: Update remaining errors.As call sites to use errors.AsTypemaintenance
- ·Ast: Use modern Go in place of custom compare codemaintenance
- ·Ast: Where have all the allocs gone?maintenance
- ·Add bench-nightly, a three-arm benchlab experiment runnermaintenance
- ·Pin pigeon in build/tools instead of go run pkg@versionmaintenance
- ·Bundle: Avoid allocation in getdepthmaintenance
- ·Bundle: Remove unused writeModules helpermaintenance
- ·Bundle: Reuse encoder buffer while hashingmaintenance
- ·Bundle: deep-copy bundle data natively instead of via JSON round-tripmaintenance
- ·Check: Avoid allocating in checkExprEqmaintenance
- ·Publish benchmark trend on a schedule instead of per-pushmaintenance
- ·Run the nightly benchlab experimentmaintenance
- ·Cmd: Stop binding a fixed port in the run testsmaintenance
- ·Github: Drop python from the CodeQL language matrixmaintenance
- ·Nightly: Fix go get smoke testmaintenance
- ·Some more functional nicetiesmaintenance
- ·E2e: Wait for diagnostic listeners before running testsmaintenance
- ·Expanded testing for and/or keywordsmaintenance
- ·Topdown: Fix BulkStartsWith benchmark input generationmaintenance
- ·Topdown: Enable more revive lintersmaintenance
- ·Topdown: Fix flaky TestRegexBuiltinCachemaintenance
- ·Topdown: Fix linter issuesmaintenance
- ·Util: Add RoundTripFastmaintenance
- ·Plugins/logs: Use util.RoundTripFast for decision-log event conversionmaintenance
- ·Rego: Use util.RoundTripFast for input parsingmaintenance
- ·Storage: Use util.RoundTripFast for write round-trippingmaintenance
- ·Util: Decode RoundTrip's fallback into a fresh valuemaintenance
- ·Workflows: Check the nightly go-get job for retractions via the proxymaintenance
- ·Workflows: Remove benchmarks from nightlymaintenance
- ·Workflows: Run Regal's do.rq in the nightly compatibility checkmaintenance
- ·Workflows: Use OCP@main in nightlymaintenance
- ·Collapse v0 shim packages into a single file eachmaintenance
- ·Makefile: Add a benchlab targetmaintenance
- ·Remove retired go reportmaintenance
- ·Dependency updates:maintenance
- ·Bump to 1.27.1maintenance
- ·Bump github.com/dgraph-io/badger/v4 from 4.9.5 to 4.9.6maintenance
- ·Bump github.com/gobwas/glob to v1.0.0maintenance
- ·Bump github.com/huandu/go-sqlbuilder from 1.42.1 to 1.43.0maintenance
- ·Bump github.com/lestrrat-go/jwx/v3 from 3.1.1 to 3.3.0maintenance
- ·Bump github.com/olekukonko/tablewriter from 1.1.4 to 1.1.5maintenance
- ·Bump github.com/prometheus/client_model from 0.6.2 to 0.6.3maintenance
- ·Bump github.com/santhosh-tekuri/jsonschema/v6 from 6.0.2 to 6.0.3maintenance
- ·Bump github.com/sirupsen/logrus from 1.9.4 to 1.10.2maintenance
- ·Bump github.com/vektah/gqlparser/v2 from 2.5.36 to 2.5.37maintenance
- ·Bump go.opentelemetry.io/contrib/bridges/prometheus from 0.69.0 to 0.71.0maintenance
- ·Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.71.0maintenance
- ·Bump go.opentelemetry.io/otel from 1.44.0 to 1.46.0maintenance
- ·Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.44.0 to 1.46.0maintenance
- ·Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.44.0 to 1.46.0maintenance
- ·Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.44.0 to 1.46.0maintenance
- ·Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.46.0maintenance
- ·Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.46.0maintenance
- ·Bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.46.0maintenance
- ·Bump go.opentelemetry.io/otel/sdk/metric from 1.44.0 to 1.46.0maintenance
- ·Bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5maintenance
- ·Bump golang.org/x/sync from 0.22.0 to 0.23.0maintenance
- ·Bump golang.org/x/term from 0.45.0 to 0.46.0maintenance
- ·Bump golang.org/x/text from 0.40.0 to 0.42.0maintenance
- ·Bump golang.org/x/time from 0.15.0 to 0.16.0maintenance
- ·Bump google.golang.org/grpc from 1.82.1 to 1.83.2maintenance
- ·Bump google.golang.org/protobuf from 1.36.11 to 1.36.12maintenance
- ·Drop sigs.k8s.io/yaml (was 1.6.0)maintenance
164 lines2 removed9 added17 changed13 fixed43 other80 maintenancetyped from the source notes
21 maintenance lines (dependency bumps, CI, tests, docs)
- ·Bump to 1.27.1 (3652eeb)maintenance
- ·Dependency updates; notably:maintenance
- ·Bump github.com/dgraph-io/badger/v4 from 4.9.5 to 4.9.6maintenance
- ·Bump github.com/lestrrat-go/jwx/v3 from 3.1.1 to 3.2.0maintenance
- ·Bump github.com/santhosh-tekuri/jsonschema/v6 from 6.0.2 to 6.0.3maintenance
- ·Bump github.com/sirupsen/logrus from 1.9.4 to 1.10.2maintenance
- ·Bump go.opentelemetry.io/contrib/bridges/prometheus from 0.69.0 to 0.71.0maintenance
- ·Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.71.0maintenance
- ·Bump go.opentelemetry.io/otel from 1.44.0 to 1.46.0maintenance
- ·Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.44.0 to 1.46.0maintenance
- ·Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.44.0 to 1.46.0maintenance
- ·Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.44.0 to 1.46.0maintenance
- ·Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.46.0maintenance
- ·Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.46.0maintenance
- ·Bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.46.0maintenance
- ·Bump go.opentelemetry.io/otel/sdk/metric from 1.44.0 to 1.46.0maintenance
- ·Bump go.opentelemetry.io/otel/trace from 1.44.0 to 1.46.0maintenance
- ·Bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5maintenance
- ·Bump golang.org/x/text from 0.40.0 to 0.41.0maintenance
- ·Bump google.golang.org/grpc from 1.82.1 to 1.83.2maintenance
- ·Bump google.golang.org/protobuf from 1.36.11 to 1.36.12maintenance
21 lines21 maintenancetyped from the source notes
- ·This release includes a bug fix for a regression introduced in v1.20.0 inother
- ·Comparing a number to some float values.other
- ·Thanks @kmadan for reporting the issue and submitting a fix!other
3 lines3 othertyped from the source notes
- -Ast: Remove a few unnecessary allocationsremoved
- ~Allocate less in ast.NewObjectchanged
- ~Heap allocation huntingchanged
- ~Improved UUID implementationchanged
- +New Rego keywords: and and or, for combining conditions inside a single rule bodyadded
- +Debug: Allow configuring variable value length limitadded
- +Format: Add support for formatting and/or logical expressions (#8683) reported andadded
- +Oracle: Support and/or logical keywords (#8819) reported andadded
- +Repl: Add support for and/or imports (#9066) reported andadded
- +Repl: Allow interactive ref head rule definitionsadded
- +Runtime: Allow registering hooks, and pass them to discoveryadded
- +Ast: Allow non-infix and()/or() set built-in callsadded
58 more lines
- +Ir: Add end locations in plan statementsadded
- +Ir: Add list of unplanned rules to plan dataadded
- +Ast: Add Equal implementation for *objectadded
- +Ast: Add sync pool for strings.Readeradded
- *Bundle: Fix roots containing percent-encoded charactersfixed
- *Loader: Fix loading absolute paths on Windowsfixed
- *Plugins: Avoid predictable OCI temp storefixed
- *Plugins: Fix overly verbose return of errorsfixed
- *Ast: Correct regression in Ruleset Addfixed
- *Ast: Fix future.keywords wildcard import not including the not keywordfixed
- *Ast: Fix panic for shadowed root document calls in Rego v0 (#9067) reported andfixed
- *Topdown: Fix false modulo by zero for multiples of 2^64fixed
- *Topdown: Fix negation inlining limit overflowingfixed
- *Topdown: Fix sum overflow when integer elements fit int64 but the sum does notfixed
- *Ast: Avoid excessive save/restore calls in parserfixed
- *Ast: Fix performance regression in InterfaceToValuefixed
- ·Allow_net now restricts remote JSON Schema $ref fetching from json.match_schema and json.verify_schemaother
- ·Coverage reports can now explain why a range is not coveredother
- ·Much faster partial evaluation for dynamically composed policiesother
- ·Rego Keywords: and, or — the full referenceother
- ·Precedence and grouping — how the operators group, and where parentheses are neededother
- ·Combining with notother
- ·Incremental rules — the idiom when the alternatives must produce a valueother
- ·Compile: Validate plan-addons existother
- ·Config: Migrate server.encoding and server.decoding validation to Regoother
- ·Format: Converge object comprehension layout (#9075) reported andother
- ·Format: Don't group rules that aren't written on one lineother
- ·Format: Don't unwrap one-line rule body braces from a single set termother
- ·Format: Honor line breaks before explicit and/or operand bodiesother
- ·Format: Keep parens around a nested not operandother
- ·Format: Wrap set union | infix in parens when output would be re-interpreted as comprehensionother
- ·Format: Write added imports before rulesother
- ·Rego: Pass capabilities to the parser in (*Rego).compileModulesother
- ·Server: Decouple decision logging from request context cancellationother
- ·Wasm: Address regression causing memory corruptionother
- ·Ast: Don't index away rules with a nested print callother
- ·Ast: Don't leak generated locals for calls in ref type errorsother
- ·Ast: Don't leak generated locals in ref type errorsother
- ·Ast: Don't report type errors for documents replaced by withother
- ·Ast: Index rules with and/or expressionsother
- ·Ast: Name the enclosing rule in unsafe var errors on shared linesother
- ·Ast: Only re-parse brace-led set terms as rule bodiesother
- ·Ast: Print undeclared var namesother
- ·Ast: Reject print calls as and/or operandsother
- ·Ast: Reject assignments in implicit not, and and or bodiesother
- ·Ast: Reject bare ambiguous { ... | ... } not operandsother
- ·Topdown,tester: Don't put shared interned refs into mutable ASTsother
- ·Topdown: A few tracing/profiling improvementsother
- ·Topdown: Clean up http.send implementationother
- ·Topdown: Don't yield a key in both base and virtual docs twiceother
- ·Topdown: Error on built-in calls with unevaluated operandsother
- ·Topdown: Save enumerated refs over unknown dataother
- ·Topdown: Speed up partial evaluation of dynamically composed policiesother
- ·Topdown: Treat an empty JSON Schema enum as unsatisfiableother
- ·Ast: Bucket built-in name lookup by ref shapeother
- ·Ast: Use pointer comparison in Equal methodsother
- ·Eval: Catch booleans trying to escape to the heapother
- ·Topdown: Various io.Writer improvementsother
39 maintenance lines (dependency bumps, CI, tests, docs)
- ·Ecosystem: Add Scanara to the ecosystem pagemaintenance
- ·Ecosystem: Describe what GOPAL actually coversmaintenance
- ·Policy-reference: Add examples for common built-insmaintenance
- ·Website: Refresh Apache APISIX ecosystem resourcesmaintenance
- ·Add endswith and replace built-in examplesmaintenance
- ·Add split and lower built-in examplesmaintenance
- ·Clarify glob.match indexing requirementsmaintenance
- ·Document and/or keywords (#8682) reported andmaintenance
- ·Highlight and/or keywords in Rego syntaxmaintenance
- ·Improve to_number built-in descriptionmaintenance
- ·Keep snippets highlighted while they are editedmaintenance
- ·Ast: Annotations code cleanupmaintenance
- ·Ast: Enable modernize linter for golangci-lintmaintenance
- ·Ast: Enable static check of consistent receiver namesmaintenance
- ·Ast: Move global builtin.Ref() vars to a single locationmaintenance
- ·Ast: Move interning experiment behind noisy tagmaintenance
- ·Ast: Replace use of sort package with modern alternativesmaintenance
- ·Ast: Use slices.CompareFunc for imports and annotationsmaintenance
- ·Build/release: Create new release toolmaintenance
- ·Modernize for the Go 1.26 standard librarymaintenance
- ·Bundle: Use util.WithPrefixmaintenance
- ·Migrate proto-check to bufbuild/buf-actionmaintenance
- ·Serialize benchmarks workflow to avoid racing writes to benchmarks branchmaintenance
- ·Enable all usetesting optionsmaintenance
- ·Remove intrange linter, as it's covered by modernizemaintenance
- ·Releng: Sample benchmarks from 15 processes, not 3maintenance
- ·Releng: Update post-merge benchmark regression checkmaintenance
- ·Server_test: Adjust test to avoid flakey decision log test outcomemaintenance
- ·Clean up irrelevant nolint directivesmaintenance
- ·Restore print-based and/or short-circuit testsmaintenance
- ·Topdown: Add uri built-in compliance cases for parser edge casesmaintenance
- ·Topdown: Cover uuid.parse input format leniencymaintenance
- ·Topdown: Modernize fixes and some string building improvementsmaintenance
- ·Util: Don't return a nil slice from StringToByteSlice("")maintenance
- ·Dependency updates; notably:maintenance
- ·Bump the build toolchain to Go 1.27, and the go.mod language version to 1.26maintenance
- ·Bump github.com/dgraph-io/badger/v4 from 4.9.4 to 4.9.5maintenance
- ·Bump github.com/prometheus/client_golang from 1.24.0 to 1.24.1maintenance
- ·Bump go.opentelemetry.io/proto/otlp from 1.10.0 to 1.11.0maintenance
109 lines1 removed12 added3 changed12 fixed42 other39 maintenancetyped from the source notes
1 maintenance lines (dependency bumps, CI, tests, docs)
- ·Bump to 1.26.6 (authored by @srenatus)maintenance
1 line1 maintenancetyped from the source notes
- ~Tester: Make Result JSON round-trippablechanged
- ~Ast: Improve rule conflict errorchanged
- ~Ast: Make CogeneratedExprs return deterministic orderchanged
- ~Avoid allocations with custom Atoi and Atoi64 helperschanged
- ~Lazy init of scalars map in indexerchanged
- ~Reduce allocations in index lookupchanged
- +Cmd/build: Add --format flag for proto/JSON plan bundles to opa buildadded
- +Sdk: Allow customizing HTTP RoundTripper per Decisionadded
- +Ast: Add support for Go 1.27 & jsonv2added
- +Topdown+util: Add generic SliceStack/GroupStack, unify refStack/functionMocksStack/saveStackadded
- *Cmd: Avoid intermediate buffer when writing bundlefixed
- *Sdk: Fix deadlock between OPA.Plugin and manager onCommit (#8873) reported andfixed
31 more lines
- *Topdown: Resolve ground refs in --var-values cmd outputfixed
- *Ast: Fix aliased comment buffer in annotation parserfixed
- *Ast: Fix non-deterministic type errors when shadowing a built-infixed
- *Ast: Fix leaky future.keywords.not import in Rego v0fixed
- *Ast: Fix panic when indexing composite literal values in x in [...] (#8918) reported andfixed
- *Ast: Fix TermValueEqual performance regressionfixed
- *Topdown: Fix "a", "a" in {"a"} not returning truefixed
- *Topdown: Fix format_int precision loss for integers larger than 64 bitsfixed
- *Topdown: Fix precision loss for integers larger than 64 bits in arithmetic and aggregatesfixed
- *Topdown/copypropagation: Avoid circular reference in Partial-Evaluation through callfixed
- *Planner: Avoid redundant ruletrie.Children() call in Depth()fixed
- ·A fixed SQL injection vector in the Compile APIother
- ·Stricter safety checking for Rego assignments (:=)other
- ·A cgo-free, faster WebAssembly runtime (wazero replaces wasmtime-go)other
- ·Startup warnings for unknown configuration optionsother
- ·A new strings.split_n built-in functionother
- ·A REPL line reader that handles pasted input correctly, migrating existing history filesother
- ·Cmd/check: Report wrapped structured errors individuallyother
- ·Compile: Preserve package annotations in wasm bundle buildsother
- ·Format: Keep rule body inline when the head spans multiple linesother
- ·Repl: Use a plain line reader for non-terminal inputother
- ·Server: Set ReadHeaderTimeout to 32s on all HTTP serversother
- ·Server/failtracer: Skip self-referential undefined-ref hintsother
- ·Ast: Reject partial set and -object rules sharing a nameother
- ·Ast: Restore location on unsafe var errors for rewritten head varsother
- ·Ast: Use more precise return types for object.* builtins (#8692) reported andother
- ·Ast+topdown: Let rule external sources distinguish absent from unknownother
- ·Ast+topdown: Parametrized (prefix) external rule sourcesother
- ·Topdown: Don't leak internal vars in Partial-Evaluation resultsother
- ·Topdown+util: Replace hand-rolled evalFunc/evalBuiltin pools with generic ResettablePoolother
- ·Planner: Unify functionMocksStack on generic GroupStack[T]other
43 maintenance lines (dependency bumps, CI, tests, docs)
- ·Ecosystem: Add agt-policies-africa — African data protection OPA policy packmaintenance
- ·Ecosystem: Add Ghostunnel and NATS Plugin to Ecosystemmaintenance
- ·Ecosystem: Add Sencillo projects to ecosystemmaintenance
- ·Add kubecon NA pagemaintenance
- ·Add recommendations to follow Envoy's best practicesmaintenance
- ·Document rule indexer support for in, bare refs; modernize regomaintenance
- ·Document the compile metadata annotationmaintenance
- ·Fix broken OAuth2/OIDC policy examplesmaintenance
- ·Fix decision_logs buffer_size_limit_events default in prosemaintenance
- ·Remove import rego.v1maintenance
- ·Some minor bug fixes to improve reportingmaintenance
- ·The Zed Rego extension link points at github.com/StyraInc/zed-rego (404). The repo now lives at github.com/StyraOSS/zed-rego.maintenance
- ·Update cheatsheet filesmaintenance
- ·Update regal and blog linksmaintenance
- ·Updates examples to use some...in, add link to debuggermaintenance
- ·Website: Improve partial evaluation / data filtering documentationmaintenance
- ·Website: Import blog from mediummaintenance
- ·Ast: Add benchmark for rule index ref orderingmaintenance
- ·Ast: Various style fixesmaintenance
- ·Add Dockerfile.rego to validate image buildsmaintenance
- ·Get just the needed commits for CImaintenance
- ·Start decommissioning test.WithTempFSmaintenance
- ·Topdown: Add regression test for partial eval local namesmaintenance
- ·Topdown: Fix Partial-Evaluation test rejected by new conflict checkmaintenance
- ·Topdown: Vendor a method-less text/template to restore whole-binary linker DCEmaintenance
- ·Workflows: Remove cpp from CodeQL language matrixmaintenance
- ·Workflows: Prune benchmarks to last 250 runsmaintenance
- ·Dependency updates; notably:maintenance
- ·Bump Go from 1.26.4 to 1.26.5maintenance
- ·Add github.com/reeflective/readline 1.3.0maintenance
- ·Add golang.org/x/term 0.45.0maintenance
- ·Bump github.com/dgraph-io/badger/v4 from 4.9.2 to 4.9.4maintenance
- ·Bump github.com/go-logr/logr from 1.4.3 to 1.4.4maintenance
- ·Bump github.com/huandu/go-sqlbuilder from 1.41.0 to 1.42.1maintenance
- ·Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.0maintenance
- ·Bump github.com/vektah/gqlparser/v2 from 2.5.34 to 2.5.36maintenance
- ·Bump golang.org/x/sync from 0.21.0 to 0.22.0maintenance
- ·Bump golang.org/x/text from 0.38.0 to 0.40.0maintenance
- ·Bump google.golang.org/grpc from 1.81.1 to 1.82.1maintenance
- ·Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2maintenance
- ·Drop github.com/peterh/linermaintenance
- ·Drop github.com/KimMachineGun/automemlimitmaintenance
- ·Drop go.uber.org/automaxprocsmaintenance
86 lines4 added6 changed13 fixed20 other43 maintenancetyped from the source notes
- *Fix regression in fix of #8557 (#8845) (authored by @anderseknert)fixed
- ·This release includes a bug fix for a opa fmt regression introduced in v1.18.0.other
2 lines1 fixed1 othertyped from the source notes
- *Ast: fix AnnotationSet memory leak via runtime.AddCleanup cyclefixed
- ·This release fixes a memory leak introduced in OPA v1.17.0. It is advised to update if you notice excess memory usage when running OPA server.other
2 lines1 fixed1 othertyped from the source notes
- -Topdown: remove dst.Compare(src) shortcutremoved
- ~Bundle: improve determinism of file_rego_versions patterns with overlapchanged
- ~Avoid allocations in object.getchanged
- +Cover: Add support for coverage of conjunction exprsadded
- +Internal/edittree: Add recursive tree node recyclingadded
- *Bundle: fix per-module rego version lookupfixed
- *Format: Fix dropped with-clause after comment in object valuefixed
- *Oracle: Fix find-definition on expressions inside ast.Not nodesfixed
- *Ast: Fix PE regression for future.keywords.not negation inside everyfixed
- *Topdown: Fix PE not namespacing vars in comprehensions nested inside everyfixed
- ·A breaking fix to the outbound User-Agent header so it conforms to RFC 9110 (see below)other
- ·Container-aware resource limits: automatic GOMAXPROCS is restored and automatic GOMEMLIMIT is now supportedother
11 more lines
- ·Several opa fmt correctness fixesother
- ·Improvements to opa test --coverage (ranges in report, inline rule head tracking, conjunction-expression coverage)other
- ·Cover: Track inline rule head in post trace walkother
- ·Download/oci: Set Accept headersother
- ·Fmt: preserve the multiline but single entry iterablesother
- ·Format: keep lone with on the closing-bracket line of multi-line expressionsother
- ·Runtime: Restore goautomaxprocs, add automemlimitother
- ·Ast: Apply location to inner ast.Not expressionsother
- ·Ast: Clean up code for value comparisonsother
- ·Internal: compile,planner: improve determinism of plan/wasm bundle buildsother
- ·Topdown: skip strconv.ParseInt in format_int base-10 fast pathother
56 maintenance lines (dependency bumps, CI, tests, docs)
- ·Cover: Update report to include ranges (#8748) reported andmaintenance
- ·Remove broken linksmaintenance
- ·PoC for kapa.ai (#8125) reported andmaintenance
- ·Update OPA MCP entry with video, blog, and distribution linksmaintenance
- ·Contributing: add formattingmaintenance
- ·Add SDK references for evaluating IR plansmaintenance
- ·Add depkeep to enterprise supportmaintenance
- ·Add notes about use of GOMEMLIMITmaintenance
- ·Add we/our/us check to spell checkmaintenance
- ·Update built-in index page titlesmaintenance
- ·Update documentation to be more consistent and sound more like reference docsmaintenance
- ·Update regal docs for 0.41.1 releasemaintenance
- ·Update to agents.md regarding security dependences 'fixes'maintenance
- ·Clarify environment variable substitution behaviourmaintenance
- ·Remove duplicated word in Rego style guidemaintenance
- ·Website: Add .md alternate content types for llmsmaintenance
- ·Website: Add support page disclaimer and sort by date addedmaintenance
- ·Website: Fix build from missing dateAddedmaintenance
- ·Website: Update docusaurusmaintenance
- ·Website: Update homepage AI example to tool callsmaintenance
- ·Website: Various updates to node and website depsmaintenance
- ·Website: add ossrisk to ecosystemmaintenance
- ·Benchmarks: smaller tweaksmaintenance
- ·Benchmarks: split off script, emit markdown tablemaintenance
- ·Benchmarks: use details+summary comments for benchlab resultsmaintenance
- ·Capabilities: Integrate 1.17.1 patch releasemaintenance
- ·Tidy go.mod to remove untagged versionsmaintenance
- ·E2e: Add proto schemas for the IR plan and bundle manifest (#8766) reported andmaintenance
- ·Gha: deduplicate change-detection output in pr CI checksmaintenance
- ·Nightly: use regal@mainmaintenance
- ·Workflow: remove tests from docker (edge) image buildmaintenance
- ·Workflows: bring back docker edge tags for post-mergemaintenance
- ·Workflows: use go-version-file with actions/setup-gomaintenance
- ·Dependency updates; notably:maintenance
- ·Add github.com/KimMachineGun/automemlimit v0.7.5maintenance
- ·Add go.uber.org/automaxprocs v1.6.0maintenance
- ·Bump github.com/dgraph-io/badger/v4 from v4.9.1 to v4.9.2maintenance
- ·Bump github.com/vektah/gqlparser/v2 from v2.5.33 to v2.5.34maintenance
- ·Bump go.opentelemetry.io/contrib/bridges/prometheus from v0.68.0 to v0.69.0maintenance
- ·Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from v0.68.0 to v0.69.0maintenance
- ·Bump go.opentelemetry.io/otel from v1.43.0 to v1.44.0maintenance
- ·Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from v1.43.0 to v1.44.0maintenance
- ·Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from v1.43.0 to v1.44.0maintenance
- ·Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from v1.43.0 to v1.44.0maintenance
- ·Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from v1.43.0 to v1.44.0maintenance
- ·Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from v1.43.0 to v1.44.0maintenance
- ·Bump go.opentelemetry.io/otel/sdk from v1.43.0 to v1.44.0maintenance
- ·Bump go.opentelemetry.io/otel/sdk/metric from v1.43.0 to v1.44.0maintenance
- ·Bump go.opentelemetry.io/otel/trace from v1.43.0 to v1.44.0maintenance
- ·Bump golang.org/x/sync from v0.20.0 to v0.21.0maintenance
- ·Bump golang.org/x/text from v0.37.0 to v0.38.0maintenance
- ·Bump google.golang.org/grpc from v1.81.0 to v1.81.1maintenance
- ·Bump gopkg.in/ini.v1 from v1.67.2 to v1.67.3maintenance
- ·Bump oras.land/oras-go/v2 from v2.6.0 to v2.6.1maintenance
- ·Bump golang.org/x/crypto to v0.52.0 and golang.org/x/net to v0.55.0maintenance
- ·Bump go 1.26.3 -> 1.26.4maintenance
79 lines1 removed2 added2 changed5 fixed13 other56 maintenancetyped from the source notes
20 older releases
| v1.17.1 | 2026-06-08 | patch | 1 lines |
| v1.17.0 | 2026-05-28 | minor | +++~-- 36 lines |
| v1.16.2 | 2026-05-12 | patch | no itemized notes |
| v1.16.1 | 2026-05-01 | patch | 1 lines |
| v1.16.0 | 2026-04-30 | minor | security ++++++~-*********! 65 lines |
| v1.15.2 | 2026-04-08 | patch | security ! 2 lines |
| v1.15.1 | 2026-03-30 | patch | 4 lines |
| v1.15.0 | 2026-03-26 | minor | security +++~*! 34 lines |
| v1.14.1 | 2026-03-09 | patch | ~~ 4 lines |
| v1.14.0 | 2026-02-26 | minor | ++++++~~~*** 63 lines |
| v1.13.2 | 2026-02-18 | patch | 2 lines |
| v1.13.1 | 2026-01-29 | patch | * 2 lines |
| v1.13.0 | 2026-01-29 | minor | +++~~~~~~~~~~~~~-** 59 lines |
| v1.12.3 | 2026-01-14 | patch | 1 lines |
| v1.12.2 | 2026-01-06 | patch | +*** 4 lines |
| v1.12.1 | 2025-12-18 | patch | 2 lines |
| v1.12.0 | 2025-12-18 | minor | ++~~~~~~~** 32 lines |
| v1.11.1 | 2025-12-16 | patch | security !! 11 lines |
| v1.11.0 | 2025-11-26 | minor | security ++++**! 44 lines |
| v1.10.1 | 2025-11-05 | patch | 3 lines |