opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

chore: bump github.com/open-policy-agent/opa from 1.18.1 to 1.19.0 (#27832)

Browse Source 
Bumps
[github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa)
from 1.18.1 to 1.19.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-policy-agent/opa/releases">github.com/open-policy-agent/opa's
releases</a>.</em></p>
<blockquote>
<h2>v1.19.0</h2>
<p>This release contains a mix of new features and bug fixes.
Notably:</p>
<ul>
<li>A fixed SQL injection vector in the Compile API</li>
<li>Stricter safety checking for Rego assignments (<code>:=</code>)</li>
<li>A cgo-free, faster WebAssembly runtime (wazero replaces
wasmtime-go)</li>
<li>Startup warnings for unknown configuration options</li>
<li>A new <code>strings.split_n</code> built-in function</li>
<li>A REPL line reader that handles pasted input correctly, migrating
existing history files</li>
</ul>
<h3>Fix SQL injection vector in Compile API: Quote SQL filter field
identifiers (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8945">#8945</a>)</h3>
<p>The field names in the SQL emitted by the Compile API come from
partially evaluated refs, so a
policy that selects a dynamic key — such as
<code>input.fruits[input.column]</code> — puts caller-controlled
text in an identifier position. That text was emitted verbatim, which
turns</p>
<pre lang="sql"><code>WHERE fruit.name = 'allowed'
</code></pre>
<p>into</p>
<pre lang="sql"><code>WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed'
</code></pre>
<p>and an application appending the filter to its query returns rows the
policy denies.</p>
<p>Field segments that are not bare identifiers are now quoted at the
UCAST-to-SQL boundary, with any
embedded quote character escaped. Ordinary column names stay unquoted,
so existing filters keep
their current shape and remain case-insensitive on Postgres.</p>
<p>Authored by <a
href="https://github.com/thevilledev"><code>@​thevilledev</code></a></p>
<h3>Behavior change: stricter safety for assignment (<code>:=</code>)
(<a
href="https://redirect.github.com/open-policy-agent/opa/issues/3546">#3546</a>)</h3>
<p>The assignment operator (<code>:=</code>) is documented as
&quot;syntactic sugar for <code>=</code>, local variable creation,
and additional compiler checks,&quot; and the safety checker reflects
that: after
rewriting, <code>:=</code> is treated identically to <code>=</code>
(unification), so an assignment's
right-hand side can be made safe by unifying &quot;backwards&quot;
through the left-hand
side. This means policies like <code>x := y; x = 7</code> compile
(binding <code>y</code> to <code>7</code>)
even though <code>y</code> is never assigned, and <code>x := y;
obj[x]</code> can silently degrade an
expected constant-time lookup into full iteration.</p>
<p>This change makes the right-hand-side of <code>:=</code> be treated
as a read that
must be made safe by other expressions, and can no longer be satisfied
through
the left-hand-side. Affected policies that previously compiled now fail
with a
<code>rego_unsafe_var_error</code>. Reference iteration on the
right-hand-side (e.g.
<code>some k; v := obj[k]</code>) is unaffected.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md">github.com/open-policy-agent/opa's
changelog</a>.</em></p>
<blockquote>
<h2>1.19.0</h2>
<p>This release contains a mix of new features and bug fixes.
Notably:</p>
<ul>
<li>A fixed SQL injection vector in the Compile API</li>
<li>Stricter safety checking for Rego assignments (<code>:=</code>)</li>
<li>A cgo-free, faster WebAssembly runtime (wazero replaces
wasmtime-go)</li>
<li>Startup warnings for unknown configuration options</li>
<li>A new <code>strings.split_n</code> built-in function</li>
<li>A REPL line reader that handles pasted input correctly, migrating
existing history files</li>
</ul>
<h3>Fix SQL injection vector in Compile API: Quote SQL filter field
identifiers (<a
href="https://redirect.github.com/open-policy-agent/opa/pull/8945">#8945</a>)</h3>
<p>The field names in the SQL emitted by the Compile API come from
partially evaluated refs, so a
policy that selects a dynamic key — such as
<code>input.fruits[input.column]</code> — puts caller-controlled
text in an identifier position. That text was emitted verbatim, which
turns</p>
<pre lang="sql"><code>WHERE fruit.name = 'allowed'
</code></pre>
<p>into</p>
<pre lang="sql"><code>WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed'
</code></pre>
<p>and an application appending the filter to its query returns rows the
policy denies.</p>
<p>Field segments that are not bare identifiers are now quoted at the
UCAST-to-SQL boundary, with any
embedded quote character escaped. Ordinary column names stay unquoted,
so existing filters keep
their current shape and remain case-insensitive on Postgres.</p>
<p>Authored by <a
href="https://github.com/thevilledev"><code>@​thevilledev</code></a></p>
<h3>Behavior change: stricter safety for assignment (<code>:=</code>)
(<a
href="https://redirect.github.com/open-policy-agent/opa/issues/3546">#3546</a>)</h3>
<p>The assignment operator (<code>:=</code>) is documented as
&quot;syntactic sugar for <code>=</code>, local variable creation,
and additional compiler checks,&quot; and the safety checker reflects
that: after
rewriting, <code>:=</code> is treated identically to <code>=</code>
(unification), so an assignment's
right-hand side can be made safe by unifying &quot;backwards&quot;
through the left-hand
side. This means policies like <code>x := y; x = 7</code> compile
(binding <code>y</code> to <code>7</code>)
even though <code>y</code> is never assigned, and <code>x := y;
obj[x]</code> can silently degrade an
expected constant-time lookup into full iteration.</p>
<p>This change makes the right-hand-side of <code>:=</code> be treated
as a read that
must be made safe by other expressions, and can no longer be satisfied
through
the left-hand-side. Affected policies that previously compiled now fail
with a
<code>rego_unsafe_var_error</code>. Reference iteration on the
right-hand-side (e.g.
<code>some k; v := obj[k]</code>) is unaffected.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/open-policy-agent/opa/commit/1e32c796e8979b1bda2f768138500b1deb95ff24"><code>1e32c79</code></a>
Prepare v1.19.0 release (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8955">#8955</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/db035b09fc8b4b7f1b37558c4fde033209e17cc8"><code>db035b0</code></a>
Add support for Go 1.27 &amp; jsonv2 (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8947">#8947</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/27fe5ceac871d020e10dd4a92d4eb6fa7070400a"><code>27fe5ce</code></a>
ast: Fix leaky <code>future.keywords.not</code> import in Rego v0 (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8953">#8953</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/ab2187089a8dea0d7f1ea611fe8f62db874498b7"><code>ab21870</code></a>
format: Keep rule body inline when the head spans multiple lines (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8904">#8904</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/95090fa4eb7a8afe2d7a08742086be0344e9e065"><code>95090fa</code></a>
Add strings.split_n built-in function (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8915">#8915</a>)</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/12a86ed2a70384eb24754d7be115c90f98736011"><code>12a86ed</code></a>
build(deps): bump find-my-way and prisma in /e2e/api/compile/prisma</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/18815e2b02711650be1c55148e67de5b4e614a6f"><code>18815e2</code></a>
build(deps): bump the dependencies group across 2 directories with 5
updates</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/f1e2ac07e4ad18be65495451ba648a85af0e583b"><code>f1e2ac0</code></a>
build(deps): bump postcss from 8.5.15 to 8.5.23 in /docs</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/d9c7856eaea45ed0ee8c3709d8ef0151b17ba43c"><code>d9c7856</code></a>
build(deps): bump js-yaml from 5.2.1 to 5.2.2 in /docs</li>
<li><a
href="https://github.com/open-policy-agent/opa/commit/69d2cc04a0de02892e4bad95cc416b9baa9a0b3b"><code>69d2cc0</code></a>
tester: make Result JSON round-trippable (<a
href="https://redirect.github.com/open-policy-agent/opa/issues/8946">#8946</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-policy-agent/opa/compare/v1.18.1...v1.19.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/open-policy-agent/opa&package-manager=go_modules&previous-version=1.18.1&new-version=1.19.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This commit is contained in:
dependabot[bot]
2026-08-04 11:19:39 +00:00
committed by GitHub
parent f483e89062
commit f4ad3549bc
2 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+3 -3
View File
@@ -186,7 +186,7 @@ require (
github.com/go-chi/cors v1.2.1
github.com/go-chi/httprate v0.16.0
github.com/go-jose/go-jose/v4 v4.1.4
github.com/go-logr/logr v1.4.3
github.com/go-logr/logr v1.4.4
github.com/go-playground/validator/v10 v10.30.0
github.com/gofrs/flock v0.13.0
github.com/gohugoio/hugo v0.163.3
@@ -219,7 +219,7 @@ require (
github.com/mocktools/go-smtp-mock/v2 v2.5.0
github.com/muesli/termenv v0.16.0
github.com/natefinch/atomic v1.0.1
github.com/open-policy-agent/opa v1.18.1
github.com/open-policy-agent/opa v1.19.0
github.com/ory/dockertest/v3 v3.12.0
github.com/pion/udp v0.1.4
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
@@ -673,7 +673,7 @@ require (
github.com/ulikunitz/xz v0.5.15 // indirect
github.com/urfave/cli/v2 v2.27.5 // indirect
github.com/valyala/fastjson v1.6.10 // indirect
github.com/vektah/gqlparser/v2 v2.5.34 // indirect
github.com/vektah/gqlparser/v2 v2.5.36 // indirect
github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
go.sum
+8 -10
View File
@@ -264,8 +264,6 @@ github.com/brianvoe/gofakeit/v7 v7.15.0 h1:kGLYAWN8tnmxq2PelKVK6zwpM7kMxdz9SGPH3
github.com/brianvoe/gofakeit/v7 v7.15.0/go.mod h1:QXuPeBw164PJCzCUZVmgpgHJ3Llj49jSLVkKPMtxtxA=
github.com/buger/jsonparser v1.1.2 h1:frqHqw7otoVbk5M8LlE/L7HTnIq2v9RX6EJ48i9AxJk=
github.com/buger/jsonparser v1.1.2/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
github.com/bytecodealliance/wasmtime-go/v44 v44.0.0 h1:WRZXnLPIer/TWs5aYPaMlmVcOlzmR6Ur6wjLRIQOhTQ=
github.com/bytecodealliance/wasmtime-go/v44 v44.0.0/go.mod h1:GP93piU+39CoFVCQ5xfHrPOUtL0APlMnkbblJ2d3YY0=
github.com/cakturk/go-netstat v0.0.0-20200220111822-e5b49efee7a5 h1:BjkPE3785EwPhhyuFkbINB+2a1xATwk8SNDWnJiD41g=
github.com/cakturk/go-netstat v0.0.0-20200220111822-e5b49efee7a5/go.mod h1:jtAfVaU/2cu1+wdSRPWE2c1N2qeAA3K4RH9pYgqwets=
github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
@@ -420,8 +418,8 @@ github.com/dblohm7/wingoes v0.0.0-20240820181039-f2b84150679e h1:L+XrFvD0vBIBm+W
github.com/dblohm7/wingoes v0.0.0-20240820181039-f2b84150679e/go.mod h1:SUxUaAK/0UG5lYyZR1L1nC4AaYYvSSYTWQSH3FPcxKU=
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 h1:5RVFMOWjMyRy8cARdy79nAmgYw3hK/4HUq48LQ6Wwqo=
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=
github.com/dgraph-io/badger/v4 v4.9.2 h1:Wb5qw8gElqwV1a8msHTeQKova9b1V10heFKMIiPd80E=
github.com/dgraph-io/badger/v4 v4.9.2/go.mod h1:nJjaJTUOSsQEBhsq209FmwCvMJzEA3e74RjZw6V2pQI=
github.com/dgraph-io/badger/v4 v4.9.4 h1:bcw+waCpzRZ2nmcSPbnPvDVhiEsn98TKmvnAhK7r7LM=
github.com/dgraph-io/badger/v4 v4.9.4/go.mod h1:nJjaJTUOSsQEBhsq209FmwCvMJzEA3e74RjZw6V2pQI=
github.com/dgraph-io/ristretto/v2 v2.4.0 h1:I/w09yLjhdcVD2QV192UJcq8dPBaAJb9pOuMyNy0XlU=
github.com/dgraph-io/ristretto/v2 v2.4.0/go.mod h1:0KsrXtXvnv0EqnzyowllbVJB8yBonswa2lTCK2gGo9E=
github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
@@ -539,8 +537,8 @@ github.com/go-json-experiment/json v0.0.0-20260601182631-00ed12fed2a6/go.mod h1:
github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
github.com/go-logr/logr v1.2.1/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
github.com/go-logr/stdr v1.2.0/go.mod h1:YkVgnZu1ZjjL7xTxrfm/LLZBfkhTqSR1ydtm6jTKKwI=
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
@@ -985,8 +983,8 @@ github.com/olekukonko/ll v0.1.6 h1:lGVTHO+Qc4Qm+fce/2h2m5y9LvqaW+DCN7xW9hsU3uA=
github.com/olekukonko/ll v0.1.6/go.mod h1:NVUmjBb/aCtUpjKk75BhWrOlARz3dqsM+OtszpY4o88=
github.com/olekukonko/tablewriter v1.1.4 h1:ORUMI3dXbMnRlRggJX3+q7OzQFDdvgbN9nVWj1drm6I=
github.com/olekukonko/tablewriter v1.1.4/go.mod h1:+kedxuyTtgoZLwif3P1Em4hARJs+mVnzKxmsCL/C5RY=
github.com/open-policy-agent/opa v1.18.1 h1:PQXN8BZN0zRf5NcI7yt1LfQ7pF1pLgWVAGNM3WgJI/4=
github.com/open-policy-agent/opa v1.18.1/go.mod h1:9GY+hER4ZEXtxPlMjftVbqJJY9xLtCD3Q0oufRCfAKo=
github.com/open-policy-agent/opa v1.19.0 h1:+j2OCsjMezZEML2T1lI9giJdGJS/PL1XFKgkHPGIhpo=
github.com/open-policy-agent/opa v1.19.0/go.mod h1:pb6Y6klyf7X7X8uXNDflruA9dQC2gMqWROXI5w/kvv0=
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/sampling v0.145.0 h1:7rdLY2Ewa1WVnjMfJTEKwQ5uPDHYeA1tqNPNROi957U=
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/sampling v0.145.0/go.mod h1:jYlQAaJO4ZyJAW2jcKAbjN+nt5BRCyu49mlZv4Rui7U=
github.com/open-telemetry/opentelemetry-collector-contrib/processor/probabilisticsamplerprocessor v0.145.0 h1:12mxn+8YLeAjMZ1kLGulBcvHrdhRNUmxLVIDnaLkJbQ=
@@ -1228,8 +1226,8 @@ github.com/valyala/fastjson v1.6.10 h1:/yjJg8jaVQdYR3arGxPE2X5z89xrlhS0eGXdv+ADT
github.com/valyala/fastjson v1.6.10/go.mod h1:e6FubmQouUNP73jtMLmcbxS6ydWIpOfhz34TSfO3JaE=
github.com/vbatts/tar-split v0.12.2 h1:w/Y6tjxpeiFMR47yzZPlPj/FcPLpXbTUi/9H7d3CPa4=
github.com/vbatts/tar-split v0.12.2/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA=
github.com/vektah/gqlparser/v2 v2.5.34 h1:MEea5P0qhdcqfBL45ghKE+qr9laidVHTMHjav5h7ckk=
github.com/vektah/gqlparser/v2 v2.5.34/go.mod h1:mFdHLGCio7OGX1fby9ZjTW6FN+qxgmbnBcRIeeScE5s=
github.com/vektah/gqlparser/v2 v2.5.36 h1:CN9mKVHgMkc+XftdOWIhb4HEL8wKSYkFAqhf8booa7s=
github.com/vektah/gqlparser/v2 v2.5.36/go.mod h1:cAJ9qwVgPaUkWv6Gn8vn0mqOE0Ui5Pn56wNy5396XWo=
github.com/vishvananda/netlink v1.2.1-beta.2 h1:Llsql0lnQEbHj0I1OuKyp8otXp0r3q0mPkuhwHfStVs=
github.com/vishvananda/netlink v1.2.1-beta.2/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=