Sourced from github.com/open-policy-agent/opa's releases.
v1.16.2
This release updates the version of Go used to build the OPA binaries and images to 1.26.3; addressing a number of vulnerabilities.
v1.16.1
This is a patch release addressing a regression in the plugin manager that may cause the service to hang on shutdown (#8590).
v1.16.0
[!WARNING]
A regression has been found in the plugin manager, which may cause the service to hang on shutdown. Users are advised to go directly to v1.16.1.
This release contains a mix of new features, performance improvements, and bugfixes. Notably:
- New
uri.parseanduri.is_validbuilt-in functions- Data API Request/Response Metadata
- Prometheus metrics exported via OTLP
- Formatter improvements
NOTE:
In v1.15.x, OPA was dropping logs for bundle downloads,
print()calls and other plugin-originated logs. Users are advised to update, v1.16.0 fixes this bug in (#8544).New
uri.parseanduri.is_validbuilt-in functions (#8263)Two new built-in functions have been added:
uri.parsefor parsing a given URI, anduri.is_validfor verifying the structure of a given URI.uri.parse
Parses a URI and returns an object containing its components according to RFC 3986. Empty components are omitted.
package exampletest_uri if { uri.parse("https://example.com:8080/api?q=1#top") == { "scheme": "https", "hostname": "example.com", "port": "8080", "path": "/api", "raw_path": "/api", "raw_query": "q=1", "fragment": "top", } }
... (truncated)
Sourced from github.com/open-policy-agent/opa's changelog.
1.17.0
This release contains a mix of new features, performance improvements, and bugfixes. Notably:
- A new
future.keywords.notimport that adds improved semantics to thenotkeyword.- Rule Labels in Decision Logs
- Published json schema for IR and bundle manifest
- Dropped automaxprocs and x/net dependencies
Improved Negation Semantics (#8387)
This OPA release introduces a new
future.keywords.notimport that fixes a long-standing semantic issue with negation in Rego.Without the import, the compiler expands a negated composite expression like
not f(g(input.x))into a series of sub-expressions evaluated before thenot:__local0__ = input.x g(__local0__, __local1__) not f(__local1__)If any sub-expression fails — for example,
input.xis undefined orgproduces an undefined result — the entire rule fails rather than thenotsucceeding. This is unintuitive: the user's intent is "the condition does not hold," but an undefined intermediate value causes a silent failure instead of the expectednotresult.With
import future.keywords.not, composite-expression negation wraps the full compiler expansion in an implicit body:not { __local0__ = input.x; g(__local0__, __local1__); f(__local1__) }Now, if any sub-expression is undefined or fails, the body is unsatisfiable and the
notexpression succeeds; matching the intuition that "the condition does not hold."NOTE:
Users are recommended to import
future.keywords.notwhenever thenotkeyword is used in a policy.Authored by
@johanfyllingRule Labels in Decision Logs (#2089)
Rule annotations now support a
labelsfield. Labels from all successfully evaluated rules are collected and included in each decision log entry as a top-levelrule_labels
... (truncated)
64a3625
Release v1.17.0 (#8710)68c9de5
benchmarks: tweak per-PR benchmark regression check based on
pr-check7fe3066
server: remove dead code (s.partials) (#8708)37830be
ast,storage/inmem: Add inmem.NewFromASTObject and add
missing string case t...1661f22
ast: add some schema $ref tests3e22f56
benchmarks: only run for go changes13aaeab
benchmarks: move env vars, remove zizmor-ignore comment93e1708
benchmarks: fix PR message, skip tests4ce3991
benchmarks: use go tool machinery, add benchstat41df8df
benchmarks: use benchlab for per-PR feedback