Skip to content

chore(deps): update dependency open-policy-agent/opa to v1.5.1 (dockerfile) (main) #151

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
ivankatliarchuk wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update dependency open-policy-agent/opa to v1.5.1 (dockerfile) (main) #151

ivankatliarchuk wants to merge 1 commit into from

Conversation

@ivankatliarchuk
Copy link
Member

@ivankatliarchuk ivankatliarchuk commented Jan 25, 2025 •
edited
Loading

This PR contains the following updates:

Package Update Change
open-policy-agent/opa minor 1.0.0 -> 1.5.1

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

open-policy-agent/opa (open-policy-agent/opa)

v1.5.1

Compare Source

This is a bug fix release addressing a regression to the walk built-in function, introduced in v1.5.0. See #​7656 (authored by @​anderseknert reported by @​robmyersrobmyers)

v1.5.0

Compare Source

This release contains a mix of new features, performance improvements, and bugfixes. Among others:

  • Support for AWS SSO credentials provider
  • Support for signing client assertions with Azure Keyvault
  • Faster object.get, walk and builtin-function evaluation
  • Improved guardrails in the parser
  • Improvements to decision logging
Modernized OPA Website (#​7037)

The OPA website has been modernized with a new design and improved user experience.

The new site is based on Docusaurus and React which makes it easier to build live functionality and add non-documentation resources. This lays the groundwork for even more improvements in the future!

Documentation for older OPA versions are still available in the version archive.

Authored by @​charlieegan3

Runtime, Tooling, SDK
Planner, Topdown and Rego
Docs, Website, Ecosystem
Miscellaneous
  • github_actions: Adding monthly check for broken hyperlinks (#​7537) authored by @​sspaink
  • perf: Extended interning (#​7636) authored by @​anderseknert
  • perf: Ref.String() shortcut on single var term ref (#​7595) authored by @​anderseknert
  • refactor: Don't return error from opaTest (#​7560) authored by @​sspaink
  • refactor: Remove internal/gqlparser and use upstream dependency instead. (#​7520) authored by @​robmyersrobmyers
  • test: Fix flaky TestContextErrorHandling (#​7587) authored by @​sspaink
  • Apply modernize linter fixes (#​7599) authored by @​anderseknert
  • Use any in place of interface{} (#​7566) authored by @​anderseknert
  • Dependency updates; notably:
    • build: bump go from 1.24.0 to 1.24.3
    • build(deps): bump containerd to v2.1.1 (#​7627) authored by @​johanfylling reported by @​robmyersrobmyers
    • build(deps): bump github.com/fsnotify/fsnotify from 1.8.0 to 1.9.0
    • build(deps): bump github.com/prometheus/client_golang from 1.21.1 to 1.22.0
    • build(deps): bump github.com/prometheus/client_model from 0.6.1 to 0.6.2
    • build(deps): bump golang.org/x/net from 0.38.0 to 0.39.0
    • build(deps): bump google.golang.org/grpc from 1.71.1 to 1.72.0

v1.4.2

Compare Source

This is a bug fix release addressing the missing capabilities/v1.4.1.json in the v1.4.1 release.

v1.4.1

Compare Source

⚠️ Please skip this release and go straight to v1.4.2 ⚠️
This release is broken due to a mistake during the release process and the artifacts are missing a crucial capabilities file.
Sorry for any inconvenience.

This is a security fix release for the fixes published in Go 1.24.1 and 1.24.2

  • build: bump go to 1.24.2 (#​7544) (authored by @​sspaink)
    Addressing CVE-2025-22870 and CVE-2025-22871 vulnerabilities in the Go runtime.

v1.4.0

Compare Source

This release contains a security fix addressing CVE-2025-46569.
It also includes a mix of new features, bugfixes, and dependency updates.

Security Fix: CVE-2025-46569 - OPA server Data API HTTP path injection of Rego (GHSA-6m8w-jc87-6cr7)

A vulnerability in the OPA server's Data API allows an attacker to craft the HTTP path in a way that injects Rego code into the query that is evaluated.
The evaluation result cannot be made to return any other data than what is generated by the requested path, but this path can be misdirected, and the injected Rego code can be crafted to make the query succeed or fail; opening up for oracle attacks or, given the right circumstances, erroneous policy decision results.
Furthermore, the injected code can be crafted to be computationally expensive, resulting in a Denial Of Service (DoS) attack.

Users are only impacted if all of the following apply:

  • OPA is deployed as a standalone server (rather than being used as a Go library)
  • The OPA server is exposed outside of the local host in an untrusted environment.
  • The configured authorization policy does not do exact matching of the input.path attribute when deciding if the request should be allowed.

or, if all of the following apply:

  • OPA is deployed as a standalone server.
  • The service connecting to OPA allows 3rd parties to insert unsanitised text into the path of the HTTP request to OPA’s Data API.

Note: With no Authorization Policy configured for restricting API access (the default configuration), the RESTful Data API provides access for managing Rego policies; and the RESTful Query API facilitates advanced queries.
Full access to these APIs provides both simpler, and broader access than what the security issue describes here can facilitate.
As such, OPA servers exposed to a network are not considered affected by the attack described here if they are knowingly not restricting access through an Authorization Policy.

This issue affects all versions of OPA prior to 1.4.0.

See the Security Advisory for more details.

Reported by @​GamrayW, @​HyouKash, @​AdrienIT, authored by @​johanfylling

Runtime, Tooling, SDK
Topdown and Rego
Docs, Website, Ecosystem
Miscellaneous
  • Dependency updates; notably:
    • build(deps): bump github.com/hypermodeinc/badger from v4.6.0 to v4.7.0
    • build(deps): bump github.com/spf13/viper from 1.18.2 to 1.20.1
    • build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
    • build(deps): bump google.golang.org/grpc from 1.71.0 to 1.71.1
    • build(deps): bump oras.land/oras-go/v2 from 2.3.1 to 2.5.0

v1.3.0

Compare Source

This release contains a mix of features, bugfixes, and dependency updates.

New Buffer Option for Decision Logs (#​5724)

A new, optional, buffering mechanism has been added to decision logging.
The default buffer is designed around making precise memory footprint guarantees, which can produce lock contention at high loads, negatively impacting query performance.
The new event-based buffer is designed to reduce lock contention and improve performance at high loads, but sacrifices the memory footprint guarantees of the default buffer.

The new event-based buffer is enabled by setting the decision_logs.reporting.buffer_type configuration option to event.

For more details, see the decision log plugin README.

Reported by @​mjungsbluth, authored by @​sspaink

OpenTelemetry: HTTP Support and Expanded Batch Span Configuration (#​7412)

Distributed tracing through OpenTelemetry has been extended to support HTTP collectors (enabled by setting the distributed_tracing.type configuration option to http).
Additionally, configuration has been expanded with fine-grained batch span processor options.

Authored and reported by @​sqyang94

Runtime, Tooling, SDK
Docs, Website, Ecosystem
Miscellaneous
  • Enable unused-receiver linter (revive) (#​7448) authored by @​anderseknert
  • Dependency updates; notably:
    • build(deps): bump github.com/containerd/containerd from 1.7.26 to 1.7.27
    • build(deps): bump github.com/dgraph-io/badger/v4 from 4.5.1 to 4.6.0
    • build(deps): bump github.com/opencontainers/image-spec from 1.1.0 to 1.1.1
    • build(deps): bump github.com/prometheus/client_golang 1.21.0 to 1.21.1
    • build(deps): bump golang.org/x/net from 0.35.0 to 0.37.0
    • build(deps): bump golang.org/x/time from 0.10.0 to 0.11.0
    • build(deps): bump google.golang.org/grpc from 1.70.0 to 1.71.0
    • build(deps): bump go.opentelemetry.io deps to 1.35.0/0.60.0

v1.2.0

Compare Source

This release contains a mix of features, performance improvements, and bugfixes.

Parameterized Rego Tests (#​2176)

Rego tests now support parameterization, allowing a single test rule to include multiple, hierarchical, named test cases.
This feature is useful for data-driven testing, where a single test rule can be used for multiple test cases with different inputs and expected outputs.

package example_test

test_concat[note] if {
	some note, tc in {
		"empty + empty": {
			"a": [],
			"b": [],
			"exp": [],
		},
		"empty + filled": {
			"a": [],
			"b": [1, 2],
			"exp": [1, 2],
		},
		"filled + filled": {
			"a": [1, 2],
			"b": [3, 4],
			"exp": [1, 2, 3], # Faulty expectation, this test case will fail
		},
	}

	act := array.concat(tc.a, tc.b)
	act == tc.exp
}
$ opa test example_test.rego
example_test.rego:
data.example_test.test_concat: FAIL (263.375µs)
  empty + empty: PASS
  empty + filled: PASS
  filled + filled: FAIL
--------------------------------------------------------------------------------
FAIL: 1/1

See the documentation for more information.

Authored by @​johanfylling, reported by @​anderseknert

Performance Improvements
Topdown and Rego
Runtime, Tooling, SDK
Docs, Website, Ecosystem
Miscellaneous
  • build+test: Add make test-short task (#​7364) (authored by @​anderseknert)
  • build: Add gocritic linter (#​7377) authored by @​anderseknert
  • build: Add nilness linter from govet (#​7335) authored by @​anderseknert
  • build: Add perfsprint linter (#​7334) authored by @​anderseknert
  • ci: Tagging release binaries with build version (#​7395, #​7397, #​7400) authored by @​johanfylling
  • test: fix race in TestIntraQueryCache_ClientError and TestInterQueryCache_ClientError (#​7280) authored by @​Juneezee
  • misc: Use Go 1.22+ int ranges (#​7328) authored by @​anderseknert
  • Dependency updates; notably:
    • build: bump go from 1.23.5 to 1.24.0
    • build(deps): bump github.com/agnivade/levenshtein from 1.2.0 to 1.2.1
    • build(deps): bump github.com/containerd/containerd from 1.7.25 to 1.7.26
    • build(deps): bump github.com/google/go-cmp from 0.6.0 to 0.7.0
    • build(deps): bump github.com/prometheus/client_golang
    • build(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.1
    • build(deps): bump github.com/spf13/pflag from 1.0.5 to 1.0.6
    • build(deps): bump golang.org/x/net from 0.34.0 to 0.35.0
    • build(deps): bump golang.org/x/time from 0.9.0 to 0.10.0
    • build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.1
    • Bump golangci-lint from v1.60.1 to 1.64.5

v1.1.0

Compare Source

This release contains a mix of features, performance improvements, and bugfixes.

Performance Improvements
Topdown and Rego
Runtime, Tooling, SDK
Docs, Website, Ecosystem
Miscellaneous
  • ci(nightly): Remove vendor w/o modproxy check (#​7292) authored by @​srenatus
  • Dependency updates; notably:
    • build(go): bump to 1.23.5 (7279) authored by @​srenatus
    • build(deps): upgrade github.com/dgraph-io/badger to v4 (4.5.1) (#​7239) authored by @​Juneezee
    • build(deps): bump github.com/containerd/containerd from 1.7.24 to 1.7.25
    • build(deps): bump github.com/tchap/go-patricia/v2 from 2.3.1 to 2.3.2
    • build(deps): bump golang.org/x/net from 0.33.0 to 0.34.0
    • build(deps): bump golang.org/x/time from 0.8.0 to 0.9.0
    • build(deps): bump google.golang.org/grpc from 1.69.2 to 1.70.0
    • build(deps): bump go.opentelemetry.io deps to 1.34.0/0.59.0

v1.0.1

Compare Source

This is a bug fix release addressing the following issues:

  • build(go): bump to 1.23.5 (authored by @​srenatus).
    Addressing CVE-2024-45341 and CVE-2024-45336 vulnerabilities in the Go runtime.
  • bundle: Add info about the correct rego version to parse modules on the store, co-authored by @​ashutosh-narkar and @​johanfylling in #​7278.
    Fixing an issue where the rego-version for individual modules was lost during bundle deactivation (bundle lifecycle) if this version diverged from the active runtime rego-version.
    This could cause reloading of v0 bundles to fail when OPA was not running with the --v0-compatible flag.

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@ivankatliarchuk ivankatliarchuk self-assigned this Jan 25, 2025
@github-actions
Copy link

github-actions bot commented Jan 25, 2025

@ivankatliarchuk: There are no 'kind' label on this PR. You need a 'kind' label.
Label can be added by writing in a comment ⬇️

  • /kind feature
  • /kind fix
  • /kind chore
  • /kind docs
  • /kind refactor
  • /kind github
  • /kind security
  • /kind question
Details

I am a bot created to help the cloudkats developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the DeFiCh/oss-governance-bot repository.

@ivankatliarchuk ivankatliarchuk changed the title chore(deps): update dependency open-policy-agent/opa to v1.0.1 (dockerfile) (main) chore(deps): update dependency open-policy-agent/opa to v1.1.0 (dockerfile) (main) Jan 31, 2025
@ivankatliarchuk ivankatliarchuk force-pushed the renovate/main-open-policy-agent-opa-1.x branch from 3f7c3a8 to d31a972 Compare January 31, 2025 04:26
@ivankatliarchuk ivankatliarchuk force-pushed the renovate/main-open-policy-agent-opa-1.x branch from d31a972 to 8aca0b8 Compare March 4, 2025 04:33
@ivankatliarchuk ivankatliarchuk changed the title chore(deps): update dependency open-policy-agent/opa to v1.1.0 (dockerfile) (main) chore(deps): update dependency open-policy-agent/opa to v1.2.0 (dockerfile) (main) Mar 4, 2025
@ivankatliarchuk ivankatliarchuk changed the title chore(deps): update dependency open-policy-agent/opa to v1.2.0 (dockerfile) (main) chore(deps): update dependency open-policy-agent/opa to v1.3.0 (dockerfile) (main) Mar 31, 2025
@ivankatliarchuk ivankatliarchuk force-pushed the renovate/main-open-policy-agent-opa-1.x branch from 8aca0b8 to 34f6f80 Compare March 31, 2025 04:30
@ivankatliarchuk ivankatliarchuk force-pushed the renovate/main-open-policy-agent-opa-1.x branch from 34f6f80 to bd4c413 Compare May 5, 2025 04:29
@ivankatliarchuk ivankatliarchuk changed the title chore(deps): update dependency open-policy-agent/opa to v1.3.0 (dockerfile) (main) chore(deps): update dependency open-policy-agent/opa to v1.4.0 (dockerfile) (main) May 5, 2025
@ivankatliarchuk ivankatliarchuk force-pushed the renovate/main-open-policy-agent-opa-1.x branch from bd4c413 to d5faefc Compare May 5, 2025 18:39
@ivankatliarchuk ivankatliarchuk changed the title chore(deps): update dependency open-policy-agent/opa to v1.4.0 (dockerfile) (main) chore(deps): update dependency open-policy-agent/opa to v1.4.2 (dockerfile) (main) May 5, 2025
@ivankatliarchuk ivankatliarchuk force-pushed the renovate/main-open-policy-agent-opa-1.x branch from d5faefc to 439fd1b Compare June 2, 2025 04:41
@ivankatliarchuk ivankatliarchuk changed the title chore(deps): update dependency open-policy-agent/opa to v1.4.2 (dockerfile) (main) chore(deps): update dependency open-policy-agent/opa to v1.5.0 (dockerfile) (main) Jun 2, 2025
@ivankatliarchuk ivankatliarchuk force-pushed the renovate/main-open-policy-agent-opa-1.x branch from 439fd1b to c05c78c Compare June 8, 2025 04:39
@ivankatliarchuk ivankatliarchuk changed the title chore(deps): update dependency open-policy-agent/opa to v1.5.0 (dockerfile) (main) chore(deps): update dependency open-policy-agent/opa to v1.5.1 (dockerfile) (main) Jun 8, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@ivankatliarchuk ivankatliarchuk

Labels

datasource::github-releases deps manager:regex needs/kind renovate Universal dependency update tool rule::1 type::patch

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ivankatliarchuk