chore: bump github.com/open-policy-agent/opa from 1.17.0 to 1.18.1 (#26858)

mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00

Bumps
[github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa)
from 1.17.0 to 1.18.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-policy-agent/opa/releases">github.com/open-policy-agent/opa's
releases</a>.</em></p>
<blockquote>
<h2>v1.18.1</h2>
<p>This release fixes a memory leak introduced in OPA v1.17.0. It is
advised to update if you notice excess memory usage when running OPA
server.</p>
<h3>Fixes</h3>
<ul>
<li>ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8817">#8817</a>)
authored by <a
href="https://github.com/srenatus"><code>@srenatus</code></a> reported
by <a href="https://github.com/keydon"><code>@keydon</code></a> and <a
href="https://github.com/gorsr01"><code>@gorsr01</code></a></li>
</ul>
<h2>v1.18.0</h2>
<p>This release contains a mix of bugfixes and small features.
Notably:</p>
<ul>
<li>A breaking fix to the outbound <code>User-Agent</code> header so it
conforms to RFC 9110 (see below)</li>
<li>Container-aware resource limits: automatic <code>GOMAXPROCS</code>
is restored and automatic <code>GOMEMLIMIT</code> is now supported</li>
<li>Several <code>opa fmt</code> correctness fixes</li>
<li>Improvements to <code>opa test --coverage</code> (ranges in report,
inline rule head tracking, conjunction-expression coverage)</li>
</ul>
<h3>Breaking: Fix User-Agent according to RFC9110 (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8792">#8792</a>)</h3>
<p>OPA's outbound HTTP requests (bundle, discovery, decision log,
status, <code>http.send</code>, AWS KMS/ECR)
previously sent <code>User-Agent: Open Policy Agent/&lt;version&gt;
(&lt;os&gt;, &lt;arch&gt;)</code>, which is not a valid
RFC 9110 <code>User-Agent</code> value because the <code>product</code>
token cannot contain spaces. The header is now
<code>Open-Policy-Agent/&lt;version&gt; (&lt;os&gt;,
&lt;arch&gt;)</code>. Server-side log filters or WAF rules that
exact-match the old string will need to be updated.</p>
<p>Authored by <a
href="https://github.com/sspaink"><code>@sspaink</code></a>, reported
by <a href="https://github.com/SpecLad"><code>@SpecLad</code></a></p>
<h3>Runtime, SDK, Tooling</h3>
<ul>
<li>bundle: fix per-module rego version lookup (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8797">#8797</a>)
authored by <a
href="https://github.com/sspaink"><code>@sspaink</code></a>, reported
by <a
href="https://github.com/xubinzheng"><code>@xubinzheng</code></a></li>
<li>bundle: improve determinism of <code>file_rego_versions</code>
patterns with overlap (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8733">#8733</a>)
authored by <a
href="https://github.com/philipaconrad"><code>@philipaconrad</code></a></li>
<li>cover: Track inline rule head in post trace walk (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/6531">#6531</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@charlieegan3</code></a>,
reported by <a
href="https://github.com/anderseknert"><code>@anderseknert</code></a></li>
<li>cover: Update report to include ranges (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8748">#8748</a>)
reported and authored by <a
href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li>
<li>cover: Add support for coverage of conjunction exprs (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8809">#8809</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li>
<li>download/oci: Set Accept headers (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8720">#8720</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li>
<li>fmt: preserve the multiline but single entry iterables (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8557">#8557</a>)
authored by <a
href="https://github.com/unichronic"><code>@unichronic</code></a>,
reported by <a
href="https://github.com/anderseknert"><code>@anderseknert</code></a></li>
<li>format: Fix dropped with-clause after comment in object value (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8765">#8765</a>)
authored by <a
href="https://github.com/sspaink"><code>@sspaink</code></a>, reported
by <a
href="https://github.com/srabraham"><code>@srabraham</code></a></li>
<li>format: keep lone <code>with</code> on the closing-bracket line of
multi-line expressions (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8804">#8804</a>)
authored by <a
href="https://github.com/anneheartrecord"><code>@anneheartrecord</code></a>,
reported by <a
href="https://github.com/burnster"><code>@burnster</code></a></li>
<li>oracle: Fix find-definition on expressions inside
<code>ast.Not</code> nodes (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8731">#8731</a>)
authored by <a
href="https://github.com/johanfylling"><code>@johanfylling</code></a></li>
<li>runtime: Restore goautomaxprocs, add automemlimit (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8784">#8784</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li>
</ul>
<h3>Compiler, Topdown and Rego</h3>
<ul>
<li>ast: Apply location to inner <code>ast.Not</code> expressions (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8717">#8717</a>)
authored by <a
href="https://github.com/johanfylling"><code>@johanfylling</code></a>,
reported by <a
href="https://github.com/anderseknert"><code>@anderseknert</code></a></li>
<li>ast: Clean up code for value comparisons (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8737">#8737</a>)
authored by <a
href="https://github.com/anderseknert"><code>@anderseknert</code></a></li>
<li>ast: Fix PE regression for <code>future.keywords.not</code> negation
inside <code>every</code> (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8781">#8781</a>)
authored by <a
href="https://github.com/johanfylling"><code>@johanfylling</code></a></li>
<li>internal/edittree: Add recursive tree node recycling (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8693">#8693</a>)
authored by <a
href="https://github.com/philipaconrad"><code>@philipaconrad</code></a></li>
<li>internal: compile,planner: improve determinism of
<code>plan</code>/<code>wasm</code> bundle builds (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8732">#8732</a>)
authored by <a
href="https://github.com/philipaconrad"><code>@philipaconrad</code></a></li>
<li>perf: avoid allocations in <code>object.get</code> (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8729">#8729</a>)
authored by <a
href="https://github.com/anderseknert"><code>@anderseknert</code></a></li>
<li>topdown: Fix PE not namespacing vars in comprehensions nested inside
<code>every</code> (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8816">#8816</a>)
authored by <a
href="https://github.com/johanfylling"><code>@johanfylling</code></a></li>
<li>topdown: remove <code>dst.Compare(src)</code> shortcut (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8739">#8739</a>)
authored by <a
href="https://github.com/srenatus"><code>@srenatus</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md">github.com/open-policy-agent/opa's
changelog</a>.</em></p>
<blockquote>
<h1>Change Log</h1>
<p>All notable changes to this project will be documented in this file.
This
project adheres to <a href="http://semver.org/">Semantic
Versioning</a>.</p>
<h2>Unreleased</h2>
<h2>1.18.0</h2>
<p>This release contains a mix of bugfixes and small features.
Notably:</p>
<ul>
<li>A breaking fix to the outbound <code>User-Agent</code> header so it
conforms to RFC 9110 (see below)</li>
<li>Container-aware resource limits: automatic <code>GOMAXPROCS</code>
is restored and automatic <code>GOMEMLIMIT</code> is now supported</li>
<li>Several <code>opa fmt</code> correctness fixes</li>
<li>Improvements to <code>opa test --coverage</code> (ranges in report,
inline rule head tracking, conjunction-expression coverage)</li>
</ul>
<h3>Breaking: Fix User-Agent according to RFC9110 (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8792">#8792</a>)</h3>
<p>OPA's outbound HTTP requests (bundle, discovery, decision log,
status, <code>http.send</code>, AWS KMS/ECR)
previously sent <code>User-Agent: Open Policy Agent/&lt;version&gt;
(&lt;os&gt;, &lt;arch&gt;)</code>, which is not a valid
RFC 9110 <code>User-Agent</code> value because the <code>product</code>
token cannot contain spaces. The header is now
<code>Open-Policy-Agent/&lt;version&gt; (&lt;os&gt;,
&lt;arch&gt;)</code>. Server-side log filters or WAF rules that
exact-match the old string will need to be updated.</p>
<p>Authored by <a
href="https://github.com/sspaink"><code>@sspaink</code></a>, reported
by <a href="https://github.com/SpecLad"><code>@SpecLad</code></a></p>
<h3>Runtime, SDK, Tooling</h3>
<ul>
<li>bundle: fix per-module rego version lookup (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8797">#8797</a>)
authored by <a
href="https://github.com/sspaink"><code>@sspaink</code></a>, reported
by <a
href="https://github.com/xubinzheng"><code>@xubinzheng</code></a></li>
<li>bundle: improve determinism of <code>file_rego_versions</code>
patterns with overlap (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8733">#8733</a>)
authored by <a
href="https://github.com/philipaconrad"><code>@philipaconrad</code></a></li>
<li>cover: Track inline rule head in post trace walk (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/6531">#6531</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@charlieegan3</code></a>,
reported by <a
href="https://github.com/anderseknert"><code>@anderseknert</code></a></li>
<li>cover: Update report to include ranges (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8748">#8748</a>)
reported and authored by <a
href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li>
<li>cover: Add support for coverage of conjunction exprs (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8809">#8809</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li>
<li>download/oci: Set Accept headers (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8720">#8720</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li>
<li>fmt: preserve the multiline but single entry iterables (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8557">#8557</a>)
authored by <a
href="https://github.com/unichronic"><code>@unichronic</code></a>,
reported by <a
href="https://github.com/anderseknert"><code>@anderseknert</code></a></li>
<li>format: Fix dropped with-clause after comment in object value (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8765">#8765</a>)
authored by <a
href="https://github.com/sspaink"><code>@sspaink</code></a>, reported
by <a
href="https://github.com/srabraham"><code>@srabraham</code></a></li>
<li>format: keep lone <code>with</code> on the closing-bracket line of
multi-line expressions (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8804">#8804</a>)
authored by <a
href="https://github.com/anneheartrecord"><code>@anneheartrecord</code></a>,
reported by <a
href="https://github.com/burnster"><code>@burnster</code></a></li>
<li>oracle: Fix find-definition on expressions inside
<code>ast.Not</code> nodes (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8731">#8731</a>)
authored by <a
href="https://github.com/johanfylling"><code>@johanfylling</code></a></li>
<li>runtime: Restore goautomaxprocs, add automemlimit (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8784">#8784</a>)
authored by <a
href="https://github.com/charlieegan3"><code>@charlieegan3</code></a></li>
</ul>
<h3>Compiler, Topdown and Rego</h3>
<ul>
<li>ast: Apply location to inner <code>ast.Not</code> expressions (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8717">#8717</a>)
authored by <a
href="https://github.com/johanfylling"><code>@johanfylling</code></a>,
reported by <a
href="https://github.com/anderseknert"><code>@anderseknert</code></a></li>
<li>ast: Clean up code for value comparisons (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8737">#8737</a>)
authored by <a
href="https://github.com/anderseknert"><code>@anderseknert</code></a></li>
<li>ast: Fix PE regression for <code>future.keywords.not</code> negation
inside <code>every</code> (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8781">#8781</a>)
authored by <a
href="https://github.com/johanfylling"><code>@johanfylling</code></a></li>
<li>internal/edittree: Add recursive tree node recycling (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8693">#8693</a>)
authored by <a
href="https://github.com/philipaconrad"><code>@philipaconrad</code></a></li>
<li>internal: compile,planner: improve determinism of
<code>plan</code>/<code>wasm</code> bundle builds (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8732">#8732</a>)
authored by <a
href="https://github.com/philipaconrad"><code>@philipaconrad</code></a></li>
<li>perf: avoid allocations in <code>object.get</code> (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8729">#8729</a>)
authored by <a
href="https://github.com/anderseknert"><code>@anderseknert</code></a></li>
<li>topdown: Fix PE not namespacing vars in comprehensions nested inside
<code>every</code> (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8816">#8816</a>)
authored by <a
href="https://github.com/johanfylling"><code>@johanfylling</code></a></li>
<li>topdown: remove <code>dst.Compare(src)</code> shortcut (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8739">#8739</a>)
authored by <a
href="https://github.com/srenatus"><code>@srenatus</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/open-policy-agent/opa/commit/acc8bf9f88bbef57c500dbdd7231509e48ade525"><code>acc8bf9</code></a>
Release v1.18.1</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/713dc6a42757e4b175ec8f74d58e341f89004467"><code>713dc6a</code></a>
ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/cc2c5c60a4c486f15a5e8de457e96ed0fefaf5fe"><code>cc2c5c6</code></a>
Prepare v1.18 release (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8820">#8820</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/e72a98fb10b43cfc4067568de8909c669e8a1b79"><code>e72a98f</code></a>
format: keep lone <code>with</code> on the closing-bracket line of
multi-line expression...</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/03646dde18924c2c74a13526e4cea408dcbb4481"><code>03646dd</code></a>
topdown: Fix PE not namespacing vars in comprehensions nested inside
<code>every</code> ...</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/bf2bb5261cf84958c295dd74e763837e2c021fd8"><code>bf2bb52</code></a>
benchmarks: split off script, emit markdown table</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/02ce276093b85d101172045f0307d53f5f9cc89d"><code>02ce276</code></a>
version: fix ill-formed User-Agent header (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8796">#8796</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/1fdbb77dd6b7aaf65dffd8c23563df72a59639a3"><code>1fdbb77</code></a>
build(deps): bump the dependencies group across 2 directories with 6
updates</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/954196aaa43841958547b1a0ba564e591d342a67"><code>954196a</code></a>
cover: Add support for coverage of conjunction exprs (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8809">#8809</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/dec8333b32aed9189721220f3e8101460ebb170f"><code>dec8333</code></a>
deduplicate change-detection output in pr CI checks (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8808">#8808</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-policy-agent/opa/compare/v1.17.0...v1.18.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/open-policy-agent/opa&package-manager=go_modules&previous-version=1.17.0&new-version=1.18.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

This commit is contained in:

dependabot[bot]

2026-06-30 11:17:30 +00:00

committed by

GitHub

parent d440e71109

commit 33780758c1

2 changed files with 11 additions and 13 deletions

									
										go.mod
									
		+3
		-3
	
												View File
												
				@@ -206,7 +206,7 @@ require (

					github.com/mocktools/go-smtp-mock/v2 v2.5.0

					github.com/muesli/termenv v0.16.0

					github.com/natefinch/atomic v1.0.1

					github.com/open-policy-agent/opa v1.17.0

					github.com/open-policy-agent/opa v1.18.1

					github.com/ory/dockertest/v3 v3.12.0

					github.com/pion/udp v0.1.4

					github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c

				@@ -492,7 +492,7 @@ require (

					google.golang.org/genproto v0.0.0-20260610212136-7ab31c22f7ad // indirect

					google.golang.org/genproto/googleapis/api v0.0.0-20260610212136-7ab31c22f7ad // indirect

					google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad // indirect

					gopkg.in/ini.v1 v1.67.2 // indirect

					gopkg.in/ini.v1 v1.67.3 // indirect

					howett.net/plist v1.0.1 // indirect

					kernel.org/pub/linux/libs/security/libcap/psx v1.2.77 // indirect

					sigs.k8s.io/yaml v1.6.0 // indirect

				@@ -654,7 +654,7 @@ require (

					github.com/ulikunitz/xz v0.5.15 // indirect

					github.com/urfave/cli/v2 v2.27.5 // indirect

					github.com/valyala/fastjson v1.6.10 // indirect

					github.com/vektah/gqlparser/v2 v2.5.33 // indirect

					github.com/vektah/gqlparser/v2 v2.5.34 // indirect

					github.com/xhit/go-str2duration/v2 v2.1.0 // indirect

					github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect

					github.com/yosida95/uritemplate/v3 v3.0.2 // indirect