This release uses the latest version of Go (1.26.6) to build OPA, fixing stdlib vulnerabilities in code that OPA's HTTP handler and crypto builtins use:

• https://pkg.go.dev/vuln/GO-2026-6218
• https://pkg.go.dev/vuln/GO-2026-6091
• https://pkg.go.dev/vuln/GO-2026-6090
• https://pkg.go.dev/vuln/GO-2026-6089
• https://pkg.go.dev/vuln/GO-2026-6088
• https://pkg.go.dev/vuln/GO-2026-5972
• https://pkg.go.dev/vuln/GO-2026-5026

It is otherwise the same code as v1.19.0.

Note that users building their own OPA binaries and images already control the Golang version, so this is not relevant for them.

Miscellaneous

• build(go): bump to 1.26.6 (authored by @srenatus)

This release uses the latest version of Go (1.26.6) to build OPA, fixing stdlib vulnerabilities in code that OPA's HTTP handler and crypto builtins use:

• https://pkg.go.dev/vuln/GO-2026-6218
• https://pkg.go.dev/vuln/GO-2026-6091
• https://pkg.go.dev/vuln/GO-2026-6090
• https://pkg.go.dev/vuln/GO-2026-6089
• https://pkg.go.dev/vuln/GO-2026-6088
• https://pkg.go.dev/vuln/GO-2026-5972
• https://pkg.go.dev/vuln/GO-2026-5026

It is otherwise the same code as v1.19.0.

Note that users building their own OPA binaries and images already control the Golang version, so this is not relevant for them.

Miscellaneous

• build(go): bump to 1.26.6 (authored by @srenatus)

v1.19.1 Latest

Latest

Compare

Choose a tag to compare

This release contains a mix of new features and bug fixes. Notably:

• A fixed SQL injection vector in the Compile API
• Stricter safety checking for Rego assignments (:=)
• A cgo-free, faster WebAssembly runtime (wazero replaces wasmtime-go)
• Startup warnings for unknown configuration options
• A new strings.split_n built-in function
• A REPL line reader that handles pasted input correctly, migrating existing history files

Fix SQL injection vector in Compile API: Quote SQL filter field identifiers (#8945)

The field names in the SQL emitted by the Compile API come from partially evaluated refs, so a
policy that selects a dynamic key — such as input.fruits[input.column] — puts caller-controlled
text in an identifier position. That text was emitted verbatim, which turns

WHERE fruit.name = 'allowed'

into

WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed'

and an application appending the filter to its query returns rows the policy denies.

Field segments that are not bare identifiers are now quoted at the UCAST-to-SQL boundary, with any
embedded quote character escaped. Ordinary column names stay unquoted, so existing filters keep
their current shape and remain case-insensitive on Postgres.

Authored by @thevilledev

Behavior change: stricter safety for assignment (:=) (#3546)

The assignment operator (:=) is documented as "syntactic sugar for =, local variable creation,
and additional compiler checks," and the safety checker reflects that: after
rewriting, := is treated identically to = (unification), so an assignment's
right-hand side can be made safe by unifying "backwards" through the left-hand
side. This means policies like x := y; x = 7 compile (binding y to 7)
even though y is never assigned, and x := y; obj[x] can silently degrade an
expected constant-time lookup into full iteration.

This change makes the right-hand-side of := be treated as a read that
must be made safe by other expressions, and can no longer be satisfied through
the left-hand-side. Affected policies that previously compiled now fail with a
rego_unsafe_var_error. Reference iteration on the right-hand-side (e.g.
some k; v := obj[k]) is unaffected.

Note: this is a deliberate semantic change, not a fix to match documented
behavior — the intended semantics of := in this case were never specified.

Authored by @sspaink, reported by @tsandall

WebAssembly runtime: wasmtime-go replaced with wazero (#7557)

OPA's WebAssembly runtime — used by the wasm evaluation target and the WASM SDK — now runs on
the pure-Go wazero runtime instead of bytecodealliance/wasmtime-go. This
removes the cgo dependency from this path, so wasm-enabled builds no longer need a C toolchain.

Compiled policy modules are now cached process-wide, so repeated VM creation for the same policy
skips recompilation. On an Apple M4 Max this makes wasm cold start (compile + instantiate + first
eval) about 73% faster, and warm evaluation about 29% faster with ~28% fewer allocations.

Authored by @srenatus, reported by @sspaink

Configuration validation moved to Rego, with warnings on unknown options (#8891)

Top-level configuration validation and default injection (default_decision,
default_authorization_decision, labels) is now expressed as an embedded Rego policy rather than
hand-written Go, as is the validation of server.metrics and metrics_export.

The user-visible effect is that unrecognized configuration options are reported instead of being
silently ignored. A typo such as decision_log instead of decision_logs now logs a warning at
startup:

{"level":"warning","msg":"unknown configuration option \"decision_log\" encountered"}

These are warnings, not errors: OPA starts as before, and sections that are intentionally
user-extensible are left alone, so extra keys there do not warn. Embedders reading configuration
through config.ParseConfig can find the same messages on Config.Warnings.

Authored by @sspaink

Add strings.split_n built-in function (#8344)

Policies often need only the first or last few parts of a split string, but the existing split
built-in always returns every part, so the count has to be worked around with wildcards or a slice.

strings.split_n takes the first n split parts from the front or the back of the string,
depending on whether n is positive or negative:

result := strings.split_n("a.b.c.d", ".", 2)
# result == ["a", "b"]

result := strings.split_n("a.b.c.d", ".", -2)
# result == ["c", "d"]

If abs(n) is larger than the number of parts, all parts are returned. An n of 0 returns an
empty array.

Authored by @wonju-dev, reported by @anderseknert

Improved REPL line editing, with history file migration (#962)

Pasting a tab-indented snippet into the REPL triggered tab-completion on the pasted tab, corrupting
the input (e.g. injecting a completion candidate mid-line and producing a spurious parse error).
Fixing that requires bracketed paste, where the terminal wraps pasted text in markers so the line
reader inserts it literally instead of treating an embedded tab as a completion request. The
previous reader, peterh/liner, has no bracketed-paste support and is unmaintained (last release
2021), so it has been replaced with reeflective/readline.

The new reader persists history as JSON lines instead of one command per line. Existing history
files (~/.opa_history by default, or the path given to --history) are detected and migrated in
place the first time the REPL loads them, so history written by earlier versions of OPA is kept.
OPA's own multi-line buffering is unchanged, and readline's native multi-line editing is left
disabled to avoid changing REPL behavior.

Authored by @sspaink, reported by @aeneasr

Runtime, SDK, Tooling

• cmd: Avoid intermediate buffer when writing bundle (#8909) authored by @anderseknert
• cmd/build: Add --format flag for proto/JSON plan bundles to opa build (#8825) authored by @sspaink
• cmd/check: Report wrapped structured errors individually (#3663) authored by @sspaink, reported by @oren-zohar
• compile: Preserve package annotations in wasm bundle builds (#8854) authored by @srenatus, reported by @me-viper
• format: Keep rule body inline when the head spans multiple lines (#8894) authored by @Kunalbehbud, reported by @charlieegan3
• repl: Use a plain line reader for non-terminal input (#8941) authored by @sspaink
• server: Set ReadHeaderTimeout to 32s on all HTTP servers (#8877) authored by @RinZ27
• server/failtracer: Skip self-referential undefined-ref hints (#8916) authored by @srenatus
• sdk: Allow customizing HTTP RoundTripper per Decision (#8884) authored by @paulo-raca
• sdk: Fix deadlock between OPA.Plugin and manager onCommit (#8873) reported and authored by @sspaink
• tester: Make Result JSON round-trippable (#8014) authored by @vsolano9, reported by @anderseknert
• topdown: Resolve ground refs in --var-values cmd output (#7830) authored by @sspaink, reported by @charlieegan3

Compiler, Topdown and Rego

• ast: Add support for Go 1.27 & jsonv2 (#8947) authored by @anderseknert and @charlieegan3
• ast: Fix aliased comment buffer in annotation parser (#8757) authored by @sspaink, reported by @0hardik1
• ast: Fix non-deterministic type errors when shadowing a built-in (#3729) authored by @sspaink, reported by @srenatus
• ast: Fix leaky future.keywords.not import in Rego v0 (#8953) authored by @johanfylling
• ast: Fix panic when indexing composite literal values in x in [...] (#8918) reported and authored by @srenatus
• ast: Fix TermValueEqual performance regression (#8863) authored by @mchitten
• ast: Improve rule conflict error (#6391) authored by @unichronic, reported by @johanfylling
• ast: Make CogeneratedExprs return deterministic order (#8895) authored by @sspaink
• ast: Reject partial set and -object rules sharing a name (#8860) authored by @sspaink, reported by @shomron
• ast: Restore location on unsafe var errors for rewritten head vars (#8719) authored by @Atishyy27, reported by @anderseknert
• ast: Use more precise return types for object.* builtins (#8692) reported and authored by @anderseknert
• ast+topdown: Let rule external sources distinguish absent from unknown (#8878) authored by @srenatus
• ast+topdown: Parametrized (prefix) external rule sources (#8881) authored by @srenatus
• topdown: Fix "a", "a" in {"a"} not returning true (#8747) authored by @anderseknert
• topdown: Fix format_int precision loss for integers larger than 64 bits (#8857) authored by @Synvoya
• topdown: Fix precision loss for integers larger than 64 bits in arithmetic and aggregates (#6281) authored by @Atishyy27, reported by @tsandall
• topdown: Don't leak internal vars in Partial-Evaluation results (#6378) authored by @sspaink, reported by @nkey0
• topdown/copypropagation: Avoid circular reference in Partial-Evaluation through call (#6428) authored by @sspaink, reported by @nkey0
• topdown+util: Add generic SliceStack/GroupStack, unify refStack/functionMocksStack/saveStack (#8886) authored by @srenatus
• topdown+util: Replace hand-rolled evalFunc/evalBuiltin pools with generic ResettablePool (#8886) authored by @srenatus
• perf: Avoid allocations with custom Atoi and Atoi64 helpers (#8758) authored by @anderseknert
• perf: Lazy init of scalars map in indexer (#8936) authored by @anderseknert
• perf: Reduce allocations in index lookup (#8835) authored by @anderseknert
• planner: Avoid redundant ruletrie.Children() call in Depth() (#8886) authored by @srenatus
• planner: Unify functionMocksStack on generic GroupStack[T] (#8886) authored by @srenatus

Docs, Website, Ecosystem

• ecosystem: Add agt-policies-africa — African data protection OPA policy pack (#8850) authored by @kingztech2019
• ecosystem: Add Ghostunnel and NATS Plugin to Ecosystem (#8871) authored by @charlieegan3
• ecosystem: Add Sencillo projects to ecosystem (#8818) authored by @hooksie1
• docs: Add kubecon NA page (#8876) authored by @charlieegan3
• docs: Add recommendations to follow Envoy's best practices (#8944) authored by @johanfylling
• docs: Document rule indexer support for in, bare refs; modernize rego (#8822) authored by @srenatus, reported by @tsandall
• docs: Document the compile metadata annotation (#8824) authored by @youdie006, reported by @anderseknert
• docs: Fix broken OAuth2/OIDC policy examples (#8840) authored by @mailnike
• docs: Fix decision_logs buffer_size_limit_events default in prose (#8866) authored by @s3onghyun
• docs: Remove import rego.v1 (#8867) authored by @charlieegan3
• docs: Some minor bug fixes to improve reporting (#8917) authored by @charlieegan3
• docs: The Zed Rego extension link points at github.com/StyraInc/zed-rego (404). The repo now lives at github.com/StyraOSS/zed-rego. (#8883) authored by @mailnike
• docs: Update cheatsheet files (#8868) authored by @charlieegan3
• docs: Update regal and blog links (#8901) authored by @charlieegan3
• docs: Updates examples to use some...in, add link to debugger (#8806) authored by @charlieegan3
• website: Improve partial evaluation / data filtering documentation (#8625) authored by @mmzzuu
• website: Import blog from medium (#8898) authored by @charlieegan3

Miscellaneous

• ast: Add benchmark for rule index ref ordering (#8943) authored by @srenatus
• ast: Various style fixes (#8938) authored by @anderseknert
• build: Add Dockerfile.rego to validate image builds (#8401) authored by @jasdeepbhalla, reported by @anderseknert
• build: Get just the needed commits for CI (#8940) authored by @charlieegan3
• test: Start decommissioning test.WithTempFS (#8908) authored by @anderseknert
• topdown: Add regression test for partial eval local names (#5226) authored by @sspaink, reported by @fab29p
• topdown: Fix Partial-Evaluation test rejected by new conflict check (#8860) authored by @sspaink, reported by @shomron
• topdown: Vendor a method-less text/template to restore whole-binary linker DCE (#7903) authored by @rchildress87, reported by @kruskall
• workflows: Remove cpp from CodeQL language matrix (#8864) authored by @sspaink
• workflows: Prune benchmarks to last 250 runs (#8834) authored by @srenatus
• Dependency updates; notably:
  • build(go): Bump Go from 1.26.4 to 1.26.5 (#8875) authored by @srenatus
  • build(deps): Add github.com/reeflective/readline 1.3.0
  • build(deps): Add golang.org/x/term 0.45.0
  • build(deps): Bump github.com/dgraph-io/badger/v4 from 4.9.2 to 4.9.4
  • build(deps): Bump github.com/go-logr/logr from 1.4.3 to 1.4.4
  • build(deps): Bump github.com/huandu/go-sqlbuilder from 1.41.0 to 1.42.1
  • build(deps): Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.0
  • build(deps): Bump github.com/vektah/gqlparser/v2 from 2.5.34 to 2.5.36
  • build(deps): Bump golang.org/x/sync from 0.21.0 to 0.22.0
  • build(deps): Bump golang.org/x/text from 0.38.0 to 0.40.0
  • build(deps): Bump google.golang.org/grpc from 1.81.1 to 1.82.1
  • build(deps): Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#8889) authored by @ahbarrios
    Addressing GHSA-fxhp-mv3v-67qp
  • build(deps): Drop github.com/peterh/liner
  • build(deps): Drop github.com/KimMachineGun/automemlimit (#8869) authored by @charlieegan3
  • build(deps): Drop go.uber.org/automaxprocs (#8869) authored by @charlieegan3

This release contains a mix of new features and bug fixes. Notably:

• A fixed SQL injection vector in the Compile API
• Stricter safety checking for Rego assignments (:=)
• A cgo-free, faster WebAssembly runtime (wazero replaces wasmtime-go)
• Startup warnings for unknown configuration options
• A new strings.split_n built-in function
• A REPL line reader that handles pasted input correctly, migrating existing history files

Fix SQL injection vector in Compile API: Quote SQL filter field identifiers (#8945)

The field names in the SQL emitted by the Compile API come from partially evaluated refs, so a policy that selects a dynamic key — such as input.fruits[input.column] — puts caller-controlled text in an identifier position. That text was emitted verbatim, which turns

WHERE fruit.name = 'allowed'

into

WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed'

and an application appending the filter to its query returns rows the policy denies.

Field segments that are not bare identifiers are now quoted at the UCAST-to-SQL boundary, with any embedded quote character escaped. Ordinary column names stay unquoted, so existing filters keep their current shape and remain case-insensitive on Postgres.

Authored by @thevilledev

Behavior change: stricter safety for assignment (:=) (#3546)

The assignment operator (:=) is documented as "syntactic sugar for =, local variable creation, and additional compiler checks," and the safety checker reflects that: after rewriting, := is treated identically to = (unification), so an assignment's right-hand side can be made safe by unifying "backwards" through the left-hand side. This means policies like x := y; x = 7 compile (binding y to 7) even though y is never assigned, and x := y; obj[x] can silently degrade an expected constant-time lookup into full iteration.

This change makes the right-hand-side of := be treated as a read that must be made safe by other expressions, and can no longer be satisfied through the left-hand-side. Affected policies that previously compiled now fail with a rego_unsafe_var_error. Reference iteration on the right-hand-side (e.g. some k; v := obj[k]) is unaffected.

Note: this is a deliberate semantic change, not a fix to match documented behavior — the intended semantics of := in this case were never specified.

Authored by @sspaink, reported by @tsandall

WebAssembly runtime: wasmtime-go replaced with wazero (#7557)

OPA's WebAssembly runtime — used by the wasm evaluation target and the WASM SDK — now runs on the pure-Go wazero runtime instead of bytecodealliance/wasmtime-go. This removes the cgo dependency from this path, so wasm-enabled builds no longer need a C toolchain.

Compiled policy modules are now cached process-wide, so repeated VM creation for the same policy skips recompilation. On an Apple M4 Max this makes wasm cold start (compile + instantiate + first eval) about 73% faster, and warm evaluation about 29% faster with ~28% fewer allocations.

Authored by @srenatus, reported by @sspaink

Configuration validation moved to Rego, with warnings on unknown options (#8891)

Top-level configuration validation and default injection (default_decision, default_authorization_decision, labels) is now expressed as an embedded Rego policy rather than hand-written Go, as is the validation of server.metrics and metrics_export.

The user-visible effect is that unrecognized configuration options are reported instead of being silently ignored. A typo such as decision_log instead of decision_logs now logs a warning at startup:

{"level":"warning","msg":"unknown configuration option \"decision_log\" encountered"}

These are warnings, not errors: OPA starts as before, and sections that are intentionally user-extensible are left alone, so extra keys there do not warn. Embedders reading configuration through config.ParseConfig can find the same messages on Config.Warnings.

Authored by @sspaink

Add strings.split_n built-in function (#8344)

Policies often need only the first or last few parts of a split string, but the existing split built-in always returns every part, so the count has to be worked around with wildcards or a slice.

strings.split_n takes the first n split parts from the front or the back of the string, depending on whether n is positive or negative:

result := strings.split_n("a.b.c.d", ".", 2)
# result == ["a", "b"]

result := strings.split_n("a.b.c.d", ".", -2)
# result == ["c", "d"]

If abs(n) is larger than the number of parts, all parts are returned. An n of 0 returns an empty array.

Authored by @wonju-dev, reported by @anderseknert

Improved REPL line editing, with history file migration (#962)

Pasting a tab-indented snippet into the REPL triggered tab-completion on the pasted tab, corrupting the input (e.g. injecting a completion candidate mid-line and producing a spurious parse error). Fixing that requires bracketed paste, where the terminal wraps pasted text in markers so the line reader inserts it literally instead of treating an embedded tab as a completion request. The previous reader, peterh/liner, has no bracketed-paste support and is unmaintained (last release 2021), so it has been replaced with reeflective/readline.

The new reader persists history as JSON lines instead of one command per line. Existing history files (~/.opa_history by default, or the path given to --history) are detected and migrated in place the first time the REPL loads them, so history written by earlier versions of OPA is kept. OPA's own multi-line buffering is unchanged, and readline's native multi-line editing is left disabled to avoid changing REPL behavior.

Authored by @sspaink, reported by @aeneasr

Runtime, SDK, Tooling

• cmd: Avoid intermediate buffer when writing bundle (#8909) authored by @anderseknert
• cmd/build: Add --format flag for proto/JSON plan bundles to opa build (#8825) authored by @sspaink
• cmd/check: Report wrapped structured errors individually (#3663) authored by @sspaink, reported by @oren-zohar
• compile: Preserve package annotations in wasm bundle builds (#8854) authored by @srenatus, reported by @me-viper
• format: Keep rule body inline when the head spans multiple lines (#8894) authored by @Kunalbehbud, reported by @charlieegan3
• repl: Use a plain line reader for non-terminal input (#8941) authored by @sspaink
• server: Set ReadHeaderTimeout to 32s on all HTTP servers (#8877) authored by @RinZ27
• server/failtracer: Skip self-referential undefined-ref hints (#8916) authored by @srenatus
• sdk: Allow customizing HTTP RoundTripper per Decision (#8884) authored by @paulo-raca
• sdk: Fix deadlock between OPA.Plugin and manager onCommit (#8873) reported and authored by @sspaink
• tester: Make Result JSON round-trippable (#8014) authored by @vsolano9, reported by @anderseknert
• topdown: Resolve ground refs in --var-values cmd output (#7830) authored by @sspaink, reported by @charlieegan3

Compiler, Topdown and Rego

• ast: Add support for Go 1.27 & jsonv2 (#8947) authored by @anderseknert and @charlieegan3
• ast: Fix aliased comment buffer in annotation parser (#8757) authored by @sspaink, reported by @0hardik1
• ast: Fix non-deterministic type errors when shadowing a built-in (#3729) authored by @sspaink, reported by @srenatus
• ast: Fix leaky future.keywords.not import in Rego v0 (#8953) authored by @johanfylling
• ast: Fix panic when indexing composite literal values in x in [...] (#8918) reported and authored by @srenatus
• ast: Fix TermValueEqual performance regression (#8863) authored by @mchitten
• ast: Improve rule conflict error (#6391) authored by @unichronic, reported by @johanfylling
• ast: Make CogeneratedExprs return deterministic order (#8895) authored by @sspaink
• ast: Reject partial set and -object rules sharing a name (#8860) authored by @sspaink, reported by @shomron
• ast: Restore location on unsafe var errors for rewritten head vars (#8719) authored by @Atishyy27, reported by @anderseknert
• ast: Use more precise return types for object.* builtins (#8692) reported and authored by @anderseknert
• ast+topdown: Let rule external sources distinguish absent from unknown (#8878) authored by @srenatus
• ast+topdown: Parametrized (prefix) external rule sources (#8881) authored by @srenatus
• topdown: Fix "a", "a" in {"a"} not returning true (#8747) authored by @anderseknert
• topdown: Fix format_int precision loss for integers larger than 64 bits (#8857) authored by @Synvoya
• topdown: Fix precision loss for integers larger than 64 bits in arithmetic and aggregates (#6281) authored by @Atishyy27, reported by @tsandall
• topdown: Don't leak internal vars in Partial-Evaluation results (#6378) authored by @sspaink, reported by @nkey0
• topdown/copypropagation: Avoid circular reference in Partial-Evaluation through call (#6428) authored by @sspaink, reported by @nkey0
• topdown+util: Add generic SliceStack/GroupStack, unify refStack/functionMocksStack/saveStack (#8886) authored by @srenatus
• topdown+util: Replace hand-rolled evalFunc/evalBuiltin pools with generic ResettablePool (#8886) authored by @srenatus
• perf: Avoid allocations with custom Atoi and Atoi64 helpers (#8758) authored by @anderseknert
• perf: Lazy init of scalars map in indexer (#8936) authored by @anderseknert
• perf: Reduce allocations in index lookup (#8835) authored by @anderseknert
• planner: Avoid redundant ruletrie.Children() call in Depth() (#8886) authored by @srenatus
• planner: Unify functionMocksStack on generic GroupStack[T] (#8886) authored by @srenatus

Docs, Website, Ecosystem

• ecosystem: Add agt-policies-africa — African data protection OPA policy pack (#8850) authored by @kingztech2019
• ecosystem: Add Ghostunnel and NATS Plugin to Ecosystem (#8871) authored by @charlieegan3
• ecosystem: Add Sencillo projects to ecosystem (#8818) authored by @hooksie1
• docs: Add kubecon NA page (#8876) authored by @charlieegan3
• docs: Add recommendations to follow Envoy's best practices (#8944) authored by @johanfylling
• docs: Document rule indexer support for in, bare refs; modernize rego (#8822) authored by @srenatus, reported by @tsandall
• docs: Document the compile metadata annotation (#8824) authored by @youdie006, reported by @anderseknert
• docs: Fix broken OAuth2/OIDC policy examples (#8840) authored by @mailnike
• docs: Fix decision_logs buffer_size_limit_events default in prose (#8866) authored by @s3onghyun
• docs: Remove import rego.v1 (#8867) authored by @charlieegan3
• docs: Some minor bug fixes to improve reporting (#8917) authored by @charlieegan3
• docs: The Zed Rego extension link points at github.com/StyraInc/zed-rego (404). The repo now lives at github.com/StyraOSS/zed-rego. (#8883) authored by @mailnike
• docs: Update cheatsheet files (#8868) authored by @charlieegan3
• docs: Update regal and blog links (#8901) authored by @charlieegan3
• docs: Updates examples to use some...in, add link to debugger (#8806) authored by @charlieegan3
• website: Improve partial evaluation / data filtering documentation (#8625) authored by @mmzzuu
• website: Import blog from medium (#8898) authored by @charlieegan3

Miscellaneous

• ast: Add benchmark for rule index ref ordering (#8943) authored by @srenatus
• ast: Various style fixes (#8938) authored by @anderseknert
• build: Add Dockerfile.rego to validate image builds (#8401) authored by @jasdeepbhalla, reported by @anderseknert
• build: Get just the needed commits for CI (#8940) authored by @charlieegan3
• test: Start decommissioning test.WithTempFS (#8908) authored by @anderseknert
• topdown: Add regression test for partial eval local names (#5226) authored by @sspaink, reported by @fab29p
• topdown: Fix Partial-Evaluation test rejected by new conflict check (#8860) authored by @sspaink, reported by @shomron
• topdown: Vendor a method-less text/template to restore whole-binary linker DCE (#7903) authored by @rchildress87, reported by @kruskall
• workflows: Remove cpp from CodeQL language matrix (#8864) authored by @sspaink
• workflows: Prune benchmarks to last 250 runs (#8834) authored by @srenatus
• Dependency updates; notably:
  • build(go): Bump Go from 1.26.4 to 1.26.5 (#8875) authored by @srenatus
  • build(deps): Add github.com/reeflective/readline 1.3.0
  • build(deps): Add golang.org/x/term 0.45.0
  • build(deps): Bump github.com/dgraph-io/badger/v4 from 4.9.2 to 4.9.4
  • build(deps): Bump github.com/go-logr/logr from 1.4.3 to 1.4.4
  • build(deps): Bump github.com/huandu/go-sqlbuilder from 1.41.0 to 1.42.1
  • build(deps): Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.0
  • build(deps): Bump github.com/vektah/gqlparser/v2 from 2.5.34 to 2.5.36
  • build(deps): Bump golang.org/x/sync from 0.21.0 to 0.22.0
  • build(deps): Bump golang.org/x/text from 0.38.0 to 0.40.0
  • build(deps): Bump google.golang.org/grpc from 1.81.1 to 1.82.1
  • build(deps): Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#8889) authored by @ahbarrios Addressing GHSA-fxhp-mv3v-67qp
  • build(deps): Drop github.com/peterh/liner
  • build(deps): Drop github.com/KimMachineGun/automemlimit (#8869) authored by @charlieegan3
  • build(deps): Drop go.uber.org/automaxprocs (#8869) authored by @charlieegan3

v1.19.0

Compare

Choose a tag to compare

This release includes a bug fix for a opa fmt regression introduced in v1.18.0.

The original fix for #8557 had the formatter enforce newlines in single-item collections (arrays, objects, sets) rather than merely honoring existing ones. As a result, running opa fmt on already-formatted policies could introduce a large number of unwanted changes. This patch release restores the intended behavior: only newlines already present in the source determine whether a single-item collection is formatted on one line or across multiple lines.

Fixes

• Fix regression in fix of #8557 (#8845) (authored by @anderseknert)

This release includes a bug fix for a opa fmt regression introduced in v1.18.0.

The original fix for #8557 had the formatter enforce newlines in single-item collections (arrays, objects, sets) rather than merely honoring existing ones. As a result, running opa fmt on already-formatted policies could introduce a large number of unwanted changes. This patch release restores the intended behavior: only newlines already present in the source determine whether a single-item collection is formatted on one line or across multiple lines.

Fixes

• Fix regression in fix of #8557 (#8845) (authored by @anderseknert)

v1.18.2

Compare

Choose a tag to compare

This release fixes a memory leak introduced in OPA v1.17.0. It is advised to update if you notice excess memory usage when running OPA server.

Fixes

• ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle (#8817) authored by @srenatus reported by @keydon and @gorsr01

This release fixes a memory leak introduced in OPA v1.17.0. It is advised to update if you notice excess memory usage when running OPA server.

Fixes

• ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle (#8817) authored by @srenatus reported by @keydon and @gorsr01

v1.18.1

Compare

Choose a tag to compare

This release contains a mix of bugfixes and small features. Notably:

• A breaking fix to the outbound User-Agent header so it conforms to RFC 9110 (see below)
• Container-aware resource limits: automatic GOMAXPROCS is restored and automatic GOMEMLIMIT is now supported
• Several opa fmt correctness fixes
• Improvements to opa test --coverage (ranges in report, inline rule head tracking, conjunction-expression coverage)

Breaking: Fix User-Agent according to RFC9110 (#8792)

OPA's outbound HTTP requests (bundle, discovery, decision log, status, http.send, AWS KMS/ECR)
previously sent User-Agent: Open Policy Agent/<version> (<os>, <arch>), which is not a valid
RFC 9110 User-Agent value because the product token cannot contain spaces. The header is now
Open-Policy-Agent/<version> (<os>, <arch>). Server-side log filters or WAF rules that
exact-match the old string will need to be updated.

Authored by @sspaink, reported by @SpecLad

Runtime, SDK, Tooling

• bundle: fix per-module rego version lookup (#8797) authored by @sspaink, reported by @xubinzheng
• bundle: improve determinism of file_rego_versions patterns with overlap (#8733) authored by @philipaconrad
• cover: Track inline rule head in post trace walk (#6531) authored by @charlieegan3, reported by @anderseknert
• cover: Update report to include ranges (#8748) reported and authored by @charlieegan3
• cover: Add support for coverage of conjunction exprs (#8809) authored by @charlieegan3
• download/oci: Set Accept headers (#8720) authored by @charlieegan3
• fmt: preserve the multiline but single entry iterables (#8557) authored by @unichronic, reported by @anderseknert
• format: Fix dropped with-clause after comment in object value (#8765) authored by @sspaink, reported by @srabraham
• format: keep lone with on the closing-bracket line of multi-line expressions (#8804) authored by @anneheartrecord, reported by @burnster
• oracle: Fix find-definition on expressions inside ast.Not nodes (#8731) authored by @johanfylling
• runtime: Restore goautomaxprocs, add automemlimit (#8784) authored by @charlieegan3

Compiler, Topdown and Rego

• ast: Apply location to inner ast.Not expressions (#8717) authored by @johanfylling, reported by @anderseknert
• ast: Clean up code for value comparisons (#8737) authored by @anderseknert
• ast: Fix PE regression for future.keywords.not negation inside every (#8781) authored by @johanfylling
• internal/edittree: Add recursive tree node recycling (#8693) authored by @philipaconrad
• internal: compile,planner: improve determinism of plan/wasm bundle builds (#8732) authored by @philipaconrad
• perf: avoid allocations in object.get (#8729) authored by @anderseknert
• topdown: Fix PE not namespacing vars in comprehensions nested inside every (#8816) authored by @johanfylling
• topdown: remove dst.Compare(src) shortcut (#8739) authored by @srenatus
• topdown: skip strconv.ParseInt in format_int base-10 fast path (#8801) authored by @srenatus

Docs, Website, Ecosystem

• docs/chore: Remove broken links (#8714) authored by @charlieegan3, reported by @github-actions
• docs: PoC for kapa.ai (#8125) reported and authored by @charlieegan3
• docs(ecosystem): update OPA MCP entry with video, blog, and distribution links (#8712) authored by @OrygnsCode
• docs/contributing: add formatting (#8740) authored by @mmzzuu
• docs: Add SDK references for evaluating IR plans (#8783) authored by @charlieegan3
• docs: Add depkeep to enterprise support (#8685) authored by @pkuzco
• docs: Add notes about use of GOMEMLIMIT (#8771) authored by @charlieegan3
• docs: Add we/our/us check to spell check (#8787) authored by @charlieegan3
• docs: Update built-in index page titles (#8728) authored by @charlieegan3
• docs: Update documentation to be more consistent and sound more like reference docs (#8786) authored by @charlieegan3
• docs: Update regal docs for 0.41.1 release (#8730) authored by @charlieegan3
• docs: Update to agents.md regarding security dependences 'fixes' (#8754) authored by @charlieegan3
• docs: clarify environment variable substitution behaviour (#8713) authored by @taurelius
• docs: remove duplicated word in Rego style guide (#8800) authored by @s3onghyun
• website: Add .md alternate content types for llms (#8725) authored by @charlieegan3
• website: Add support page disclaimer and sort by date added (#8736) authored by @charlieegan3
• website: Fix build from missing dateAdded (#8764) authored by @charlieegan3
• website: Update docusaurus (#8756) authored by @charlieegan3
• website: Update homepage AI example to tool calls (#8755) authored by @charlieegan3
• website: Various updates to node and website deps (#8768) authored by @charlieegan3
• website: add ossrisk to ecosystem (#8780) authored by @pkuzco

Miscellaneous

• benchmarks: smaller tweaks (#8759) authored by @srenatus
• benchmarks: split off script, emit markdown table (#8812) authored by @srenatus
• benchmarks: use details+summary comments for benchlab results (#8811) authored by @srenatus
• capabilities: Integrate 1.17.1 patch release (#8798) authored by @sspaink
• chore: tidy go.mod to remove untagged versions (#8791) authored by @thaJeztah
• e2e: Add proto schemas for the IR plan and bundle manifest (#8766) reported and authored by @sspaink
• gha: deduplicate change-detection output in pr CI checks (#8808) authored by @sspaink
• nightly: use regal@main (#8735) authored by @srenatus
• workflow: remove tests from docker (edge) image build (#8721) authored by @srenatus
• workflows: bring back docker edge tags for post-merge (#8718) authored by @srenatus
• workflows: use go-version-file with actions/setup-go (#8751) authored by @srenatus
• Dependency updates; notably:
  • build(deps): Add github.com/KimMachineGun/automemlimit v0.7.5
  • build(deps): Add go.uber.org/automaxprocs v1.6.0
  • build(deps): Bump github.com/dgraph-io/badger/v4 from v4.9.1 to v4.9.2
  • build(deps): Bump github.com/vektah/gqlparser/v2 from v2.5.33 to v2.5.34
  • build(deps): Bump go.opentelemetry.io/contrib/bridges/prometheus from v0.68.0 to v0.69.0
  • build(deps): Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from v0.68.0 to v0.69.0
  • build(deps): Bump go.opentelemetry.io/otel from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/sdk from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/sdk/metric from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/trace from v1.43.0 to v1.44.0
  • build(deps): Bump golang.org/x/sync from v0.20.0 to v0.21.0
  • build(deps): Bump golang.org/x/text from v0.37.0 to v0.38.0
  • build(deps): Bump google.golang.org/grpc from v1.81.0 to v1.81.1
  • build(deps): Bump gopkg.in/ini.v1 from v1.67.2 to v1.67.3
  • build(deps): Bump oras.land/oras-go/v2 from v2.6.0 to v2.6.1
  • build(deps): bump golang.org/x/crypto to v0.52.0 and golang.org/x/net to v0.55.0 (#8745) authored by @BGebken
  • build: bump go 1.26.3 -> 1.26.4 (#8726) authored by @srenatus

This release contains a mix of bugfixes and small features. Notably:

• A breaking fix to the outbound User-Agent header so it conforms to RFC 9110 (see below)
• Container-aware resource limits: automatic GOMAXPROCS is restored and automatic GOMEMLIMIT is now supported
• Several opa fmt correctness fixes
• Improvements to opa test --coverage (ranges in report, inline rule head tracking, conjunction-expression coverage)

Breaking: Fix User-Agent according to RFC9110 (#8792)

OPA's outbound HTTP requests (bundle, discovery, decision log, status, http.send, AWS KMS/ECR) previously sent User-Agent: Open Policy Agent/<version> (<os>, <arch>), which is not a valid RFC 9110 User-Agent value because the product token cannot contain spaces. The header is now Open-Policy-Agent/<version> (<os>, <arch>). Server-side log filters or WAF rules that exact-match the old string will need to be updated.

Authored by @sspaink, reported by @SpecLad

Runtime, SDK, Tooling

• bundle: fix per-module rego version lookup (#8797) authored by @sspaink, reported by @xubinzheng
• bundle: improve determinism of file_rego_versions patterns with overlap (#8733) authored by @philipaconrad
• cover: Track inline rule head in post trace walk (#6531) authored by @charlieegan3, reported by @anderseknert
• cover: Update report to include ranges (#8748) reported and authored by @charlieegan3
• cover: Add support for coverage of conjunction exprs (#8809) authored by @charlieegan3
• download/oci: Set Accept headers (#8720) authored by @charlieegan3
• fmt: preserve the multiline but single entry iterables (#8557) authored by @unichronic, reported by @anderseknert
• format: Fix dropped with-clause after comment in object value (#8765) authored by @sspaink, reported by @srabraham
• format: keep lone with on the closing-bracket line of multi-line expressions (#8804) authored by @anneheartrecord, reported by @burnster
• oracle: Fix find-definition on expressions inside ast.Not nodes (#8731) authored by @johanfylling
• runtime: Restore goautomaxprocs, add automemlimit (#8784) authored by @charlieegan3

Compiler, Topdown and Rego

• ast: Apply location to inner ast.Not expressions (#8717) authored by @johanfylling, reported by @anderseknert
• ast: Clean up code for value comparisons (#8737) authored by @anderseknert
• ast: Fix PE regression for future.keywords.not negation inside every (#8781) authored by @johanfylling
• internal/edittree: Add recursive tree node recycling (#8693) authored by @philipaconrad
• internal: compile,planner: improve determinism of plan/wasm bundle builds (#8732) authored by @philipaconrad
• perf: avoid allocations in object.get (#8729) authored by @anderseknert
• topdown: Fix PE not namespacing vars in comprehensions nested inside every (#8816) authored by @johanfylling
• topdown: remove dst.Compare(src) shortcut (#8739) authored by @srenatus
• topdown: skip strconv.ParseInt in format_int base-10 fast path (#8801) authored by @srenatus

Docs, Website, Ecosystem

• docs/chore: Remove broken links (#8714) authored by @charlieegan3, reported by @github-actions
• docs: PoC for kapa.ai (#8125) reported and authored by @charlieegan3
• docs(ecosystem): update OPA MCP entry with video, blog, and distribution links (#8712) authored by @OrygnsCode
• docs/contributing: add formatting (#8740) authored by @mmzzuu
• docs: Add SDK references for evaluating IR plans (#8783) authored by @charlieegan3
• docs: Add depkeep to enterprise support (#8685) authored by @pkuzco
• docs: Add notes about use of GOMEMLIMIT (#8771) authored by @charlieegan3
• docs: Add we/our/us check to spell check (#8787) authored by @charlieegan3
• docs: Update built-in index page titles (#8728) authored by @charlieegan3
• docs: Update documentation to be more consistent and sound more like reference docs (#8786) authored by @charlieegan3
• docs: Update regal docs for 0.41.1 release (#8730) authored by @charlieegan3
• docs: Update to agents.md regarding security dependences 'fixes' (#8754) authored by @charlieegan3
• docs: clarify environment variable substitution behaviour (#8713) authored by @taurelius
• docs: remove duplicated word in Rego style guide (#8800) authored by @s3onghyun
• website: Add .md alternate content types for llms (#8725) authored by @charlieegan3
• website: Add support page disclaimer and sort by date added (#8736) authored by @charlieegan3
• website: Fix build from missing dateAdded (#8764) authored by @charlieegan3
• website: Update docusaurus (#8756) authored by @charlieegan3
• website: Update homepage AI example to tool calls (#8755) authored by @charlieegan3
• website: Various updates to node and website deps (#8768) authored by @charlieegan3
• website: add ossrisk to ecosystem (#8780) authored by @pkuzco

Miscellaneous

• benchmarks: smaller tweaks (#8759) authored by @srenatus
• benchmarks: split off script, emit markdown table (#8812) authored by @srenatus
• benchmarks: use details+summary comments for benchlab results (#8811) authored by @srenatus
• capabilities: Integrate 1.17.1 patch release (#8798) authored by @sspaink
• chore: tidy go.mod to remove untagged versions (#8791) authored by @thaJeztah
• e2e: Add proto schemas for the IR plan and bundle manifest (#8766) reported and authored by @sspaink
• gha: deduplicate change-detection output in pr CI checks (#8808) authored by @sspaink
• nightly: use regal@main (#8735) authored by @srenatus
• workflow: remove tests from docker (edge) image build (#8721) authored by @srenatus
• workflows: bring back docker edge tags for post-merge (#8718) authored by @srenatus
• workflows: use go-version-file with actions/setup-go (#8751) authored by @srenatus
• Dependency updates; notably:
  • build(deps): Add github.com/KimMachineGun/automemlimit v0.7.5
  • build(deps): Add go.uber.org/automaxprocs v1.6.0
  • build(deps): Bump github.com/dgraph-io/badger/v4 from v4.9.1 to v4.9.2
  • build(deps): Bump github.com/vektah/gqlparser/v2 from v2.5.33 to v2.5.34
  • build(deps): Bump go.opentelemetry.io/contrib/bridges/prometheus from v0.68.0 to v0.69.0
  • build(deps): Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from v0.68.0 to v0.69.0
  • build(deps): Bump go.opentelemetry.io/otel from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/sdk from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/sdk/metric from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/trace from v1.43.0 to v1.44.0
  • build(deps): Bump golang.org/x/sync from v0.20.0 to v0.21.0
  • build(deps): Bump golang.org/x/text from v0.37.0 to v0.38.0
  • build(deps): Bump google.golang.org/grpc from v1.81.0 to v1.81.1
  • build(deps): Bump gopkg.in/ini.v1 from v1.67.2 to v1.67.3
  • build(deps): Bump oras.land/oras-go/v2 from v2.6.0 to v2.6.1
  • build(deps): bump golang.org/x/crypto to v0.52.0 and golang.org/x/net to v0.55.0 (#8745) authored by @BGebken
  • build: bump go 1.26.3 -> 1.26.4 (#8726) authored by @srenatus

v1.18.0

Compare

Choose a tag to compare

This release uses the latest version of Go (1.26.4) to build OPA, fixing stdlib vulnerabilities in code that OPA's HTTP handler and crypto builtins use:

• https://pkg.go.dev/vuln/GO-2026-5039
• https://pkg.go.dev/vuln/GO-2026-5037

It is otherwise the same code as v1.17.0.

Note that users building their own OPA binaries and images already control the Golang version, so this is not relevant for them.

Miscellaneous

• build: bump go 1.26.3 -> 1.26.4 (authored by @srenatus)

This release uses the latest version of Go (1.26.4) to build OPA, fixing stdlib vulnerabilities in code that OPA's HTTP handler and crypto builtins use:

• https://pkg.go.dev/vuln/GO-2026-5039
• https://pkg.go.dev/vuln/GO-2026-5037

It is otherwise the same code as v1.17.0.

Note that users building their own OPA binaries and images already control the Golang version, so this is not relevant for them.

Miscellaneous

• build: bump go 1.26.3 -> 1.26.4 (authored by @srenatus)

v1.17.1

Compare

Choose a tag to compare

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

• A new future.keywords.not import that adds improved semantics to the not keyword.
• Rule Labels in Decision Logs
• Published json schema for IR and bundle manifest
• Dropped automaxprocs and x/net dependencies

Improved Negation Semantics (#8387)

This OPA release introduces a new future.keywords.not import
that fixes a long-standing semantic issue with negation in Rego.

Without the import, the compiler expands a negated composite expression like
not f(g(input.x)) into a series of sub-expressions evaluated before the
not:

__local0__ = input.x
g(__local0__, __local1__)
not f(__local1__)

If any sub-expression fails — for example, input.x is undefined or g
produces an undefined result — the entire rule fails rather than the not succeeding.
This is unintuitive: the user's intent is "the condition does not hold," but
an undefined intermediate value causes a silent failure instead of the expected
not result.

With import future.keywords.not, composite-expression negation wraps the full compiler
expansion in an implicit body:

not { __local0__ = input.x; g(__local0__, __local1__); f(__local1__) }

Now, if any sub-expression is undefined or fails, the body is unsatisfiable
and the not expression succeeds; matching the intuition that "the condition does not hold."

NOTE:

Users are recommended to import future.keywords.not whenever the not keyword is used in a policy.

Authored by @johanfylling

Rule Labels in Decision Logs (#2089)

Rule annotations now support a labels field. Labels from all successfully evaluated
rules are collected and included in each decision log entry as a top-level rule_labels
array. Each element is the merged label map for one successfully evaluated rule, with
inner-scope-wins precedence across the rule's annotation chain
(subpackages < package < document < rule). Merged maps are deduplicated
across rules so that identical label sets collapse to a single entry.

# METADATA
# scope: package
# labels:
#   service: authz
#   severity: info
package myapp

# METADATA
# labels:
#   severity: low
#   team: platform
allow if input.role == "admin"

The resulting decision log entry will contain:

{"rule_labels": [{"service": "authz", "severity": "low", "team": "platform"}]}

Note how severity: info from the package scope is overridden by severity: low from
the rule scope. Queries against rule_labels can now rely on each entry carrying the
full label context for a single rule, rather than one entry per contributing scope.

Both the runtime and the Go SDK now process metadata annotations by default.

Authored by @srenatus, reported by @tsandall

Runtime, SDK, Tooling

• ast: Allow $ref in allOf in JSON schemas (#6523) authored by @deeglaze reported by @mosiac1
• bundle: Update bundle roots conflict detection algorithm. (#8664) authored by @philipaconrad
• download: Use oras, not containerd (#8639) authored by @srenatus
• server: Remove dead code (s.partials) (#8708) authored by @srenatus
• server: Wire in response/request metadata for compile handler (#8650) authored by @srenatus
• server/types: generalize request/response metadata (#8650) authored by @srenatus

Compiler, Topdown and Rego

• builtins: Enable pattern validation in json.verify_schema and json.match_schema built-in functions (#6089) authored by @sspaink reported by @ewout8
• ir: Don't capitalize index field in MakeNumberRefStmt IR statement (#6266) authored by @sspaink reported by @johanfylling
• perf: Avoid allocating in binary and/or operators when possible (#8689) authored by @anderseknert
• rego: Allow per-eval GenerateJSON function (#8690) authored by @anderseknert

Docs, Website, Ecosystem

• ecosystem: add OPA MCP (#8618) authored by @OrygnsCode
• docs: Add explicit address binding to examples (#8688) authored by @charlieegan3
• docs: Add titles to code blocks in policy-testing (#8649) authored by @charlieegan3
• docs: Correct OCP SSH key docs (#8675) authored by @taurelius
• docs: Update diagram to match index examples (#8667) authored by @charlieegan3

Miscellaneous

• ast,storage/inmem: Add inmem.NewFromASTObject and add missing string case to ast.InternedValue (#8707) authored by @anderseknert
• build: go install -> go install tool to control checksums (#8646) authored by @srenatus
• build: Push edge binaries to bucket (#8668) authored by @charlieegan3
• workflows: Fix benchmarks workflow (replace action, avoid stackoverflow) (#8655) authored by @srenatus
• workflows: Note improvements in benchmark comments (#8673) authored by @srenatus
• Generate a JSON Schema for the IR plan (#8662) authored by @sspaink reported by @kroekle
• Generate a JSON Schema for the bundle manifest (#8661) authored by @sspaink reported by @kroekle
• Dependency updates; notably:
  • build(deps): Remove automaxprocs dependency (#8696) authored by @anderseknert
  • build(deps): Remove direct x/net dependency (#8697) authored by @anderseknert
  • build(deps): Bump github.com/bytecodealliance/wasmtime-go from 43.0.2 to 44.0.0 (8652) authored by @srenatus
  • build(deps): Bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1
  • build(deps): Bump github.com/huandu/go-sqlbuilder from 1.40.2 to 1.41.0
  • build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.0 to 3.1.1
  • build(deps): Bump github.com/vektah/gqlparser/v2 from 2.5.32 to 2.5.33
  • build(deps): Bump google.golang.org/grpc from 1.80.0 to 1.81.0
  • build(deps): Bump gopkg.in/ini.v1 from 1.67.1 to 1.67.2

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

• A new future.keywords.not import that adds improved semantics to the not keyword.
• Rule Labels in Decision Logs
• Published json schema for IR and bundle manifest
• Dropped automaxprocs and x/net dependencies

Improved Negation Semantics (#8387)

This OPA release introduces a new future.keywords.not import that fixes a long-standing semantic issue with negation in Rego.

Without the import, the compiler expands a negated composite expression like not f(g(input.x)) into a series of sub-expressions evaluated before the not:

__local0__ = input.x
g(__local0__, __local1__)
not f(__local1__)

If any sub-expression fails — for example, input.x is undefined or g produces an undefined result — the entire rule fails rather than the not succeeding. This is unintuitive: the user's intent is "the condition does not hold," but an undefined intermediate value causes a silent failure instead of the expected not result.

With import future.keywords.not, composite-expression negation wraps the full compiler expansion in an implicit body:

not { __local0__ = input.x; g(__local0__, __local1__); f(__local1__) }

Now, if any sub-expression is undefined or fails, the body is unsatisfiable and the not expression succeeds; matching the intuition that "the condition does not hold."

NOTE:

Users are recommended to import future.keywords.not whenever the not keyword is used in a policy.

Authored by @johanfylling

Rule Labels in Decision Logs (#2089)

Rule annotations now support a labels field. Labels from all successfully evaluated rules are collected and included in each decision log entry as a top-level rule_labels array. Each element is the merged label map for one successfully evaluated rule, with inner-scope-wins precedence across the rule's annotation chain (subpackages < package < document < rule). Merged maps are deduplicated across rules so that identical label sets collapse to a single entry.

# METADATA
# scope: package
# labels:
#   service: authz
#   severity: info
package myapp

# METADATA
# labels:
#   severity: low
#   team: platform
allow if input.role == "admin"

The resulting decision log entry will contain:

{"rule_labels": [{"service": "authz", "severity": "low", "team": "platform"}]}

Note how severity: info from the package scope is overridden by severity: low from the rule scope. Queries against rule_labels can now rely on each entry carrying the full label context for a single rule, rather than one entry per contributing scope.

Both the runtime and the Go SDK now process metadata annotations by default.

Authored by @srenatus, reported by @tsandall

Runtime, SDK, Tooling

• ast: Allow $ref in allOf in JSON schemas (#6523) authored by @deeglaze reported by @mosiac1
• bundle: Update bundle roots conflict detection algorithm. (#8664) authored by @philipaconrad
• download: Use oras, not containerd (#8639) authored by @srenatus
• server: Remove dead code (s.partials) (#8708) authored by @srenatus
• server: Wire in response/request metadata for compile handler (#8650) authored by @srenatus
• server/types: generalize request/response metadata (#8650) authored by @srenatus

Compiler, Topdown and Rego

• builtins: Enable pattern validation in json.verify_schema and json.match_schema built-in functions (#6089) authored by @sspaink reported by @ewout8
• ir: Don't capitalize index field in MakeNumberRefStmt IR statement (#6266) authored by @sspaink reported by @johanfylling
• perf: Avoid allocating in binary and/or operators when possible (#8689) authored by @anderseknert
• rego: Allow per-eval GenerateJSON function (#8690) authored by @anderseknert

Docs, Website, Ecosystem

• ecosystem: add OPA MCP (#8618) authored by @OrygnsCode
• docs: Add explicit address binding to examples (#8688) authored by @charlieegan3
• docs: Add titles to code blocks in policy-testing (#8649) authored by @charlieegan3
• docs: Correct OCP SSH key docs (#8675) authored by @taurelius
• docs: Update diagram to match index examples (#8667) authored by @charlieegan3

Miscellaneous

• ast,storage/inmem: Add inmem.NewFromASTObject and add missing string case to ast.InternedValue (#8707) authored by @anderseknert
• build: go install -> go install tool to control checksums (#8646) authored by @srenatus
• build: Push edge binaries to bucket (#8668) authored by @charlieegan3
• workflows: Fix benchmarks workflow (replace action, avoid stackoverflow) (#8655) authored by @srenatus
• workflows: Note improvements in benchmark comments (#8673) authored by @srenatus
• Generate a JSON Schema for the IR plan (#8662) authored by @sspaink reported by @kroekle
• Generate a JSON Schema for the bundle manifest (#8661) authored by @sspaink reported by @kroekle
• Dependency updates; notably:
  • build(deps): Remove automaxprocs dependency (#8696) authored by @anderseknert
  • build(deps): Remove direct x/net dependency (#8697) authored by @anderseknert
  • build(deps): Bump github.com/bytecodealliance/wasmtime-go from 43.0.2 to 44.0.0 (8652) authored by @srenatus
  • build(deps): Bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1
  • build(deps): Bump github.com/huandu/go-sqlbuilder from 1.40.2 to 1.41.0
  • build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.0 to 3.1.1
  • build(deps): Bump github.com/vektah/gqlparser/v2 from 2.5.32 to 2.5.33
  • build(deps): Bump google.golang.org/grpc from 1.80.0 to 1.81.0
  • build(deps): Bump gopkg.in/ini.v1 from 1.67.1 to 1.67.2

v1.17.0

Compare

Choose a tag to compare

This release updates the version of Go used to build the OPA binaries and images to 1.26.3;
addressing a number of vulnerabilities.

This release updates the version of Go used to build the OPA binaries and images to 1.26.3; addressing a number of vulnerabilities.

v1.16.2

Compare

Choose a tag to compare

This is a patch release addressing a regression in the plugin manager that may cause the service to hang on shutdown (#8590).

This is a patch release addressing a regression (#8590) in the plugin manager that may cause the service to hang on shutdown.

v1.16.1

Compare

Choose a tag to compare

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

• New uri.parse and uri.is_valid built-in functions
• Data API Request/Response Metadata
• Prometheus metrics exported via OTLP
• Formatter improvements

NOTE:

In v1.15.x, OPA was dropping logs for bundle downloads, print() calls and other plugin-originated logs. Users are advised to update, v1.16.0 fixes this bug in (#8544).

New uri.parse and uri.is_valid built-in functions (#8263)

Two new built-in functions have been added: uri.parse for parsing a given URI, and uri.is_valid for verifying the structure of a given URI.

uri.parse

Parses a URI and returns an object containing its components according to RFC 3986. Empty components are omitted.

package example

test_uri if {
	uri.parse("https://example.com:8080/api?q=1#top") == {
		"scheme": "https",
		"hostname": "example.com",
		"port": "8080",
		"path": "/api",
		"raw_path": "/api",
		"raw_query": "q=1",
		"fragment": "top",
	}
}

uri.is_valid

Returns true if the input can be parsed as a URI, false otherwise.

package example

deny contains "invalid URI" if {
    not uri.is_valid("http://[invalid")
}

Authored by @charlieegan3 reported by @anivar

Data API Request/Response Metadata (#8570)

Wrapping projects can now attach custom metadata to Data API requests and have evaluation produce response metadata.

Two distinct metadata paths are introduced:

• Request metadata: parsed from extra top-level keys in the request body, made available to builtins via BuiltinContext.RequestMetadata. Logged in the decision log under Custom["request_metadata"].

• Response metadata: a separate map (BuiltinContext.ResponseMetadata) that builtins can populate during evaluation. Only included in the API response and decision log if non-empty.

In vanilla OPA, no builtins write response metadata, so responses are unchanged. The request metadata map is only allocated when the request carries extra fields; the response map is one empty map per request.

To avoid conflicts with future OPA top-level keys, callers should use a namespaced key: {"input": {...}, "com.example.opa/md": {...}}.

Request with metadata:

curl -H 'Content-Type: application/json' \
  -d '{"input": {"user": "alice"}, "com.example.opa/metadata": {"corp-id": "acme-42"}}' \
  http://localhost:8181/v1/data/example/allow

Response (response metadata included if, for example, set by a custom builtin):

{
  "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135",
  "result": true,
  "com.example.opa/response": {
    "snapshot_version": "v3"
  }
}

Decision log entry:

{
  "custom": {
    "request_metadata": {
      "com.example.opa/metadata": {
        "corp-id": "acme-42"
      }
    },
    "response_metadata": {
      "com.example.opa/response": {
        "snapshot_version": "v3"
      }
    }
  },
  "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135",
  "input": { "user": "alice" },
  "msg": "Decision Log",
  "path": "example/allow",
  "result": true
}

Authored by @srenatus

Runtime, SDK, Tooling

• distributedtracing: Export Prometheus metrics via OTLP (#7591) reported and authored by @Munken
• cmd,tester: Update opa test to stream test case results (#3676) authored by @sspaink reported by @tsandall
• cmd,tester: Show full errors when test fails and using --coverage (#8438) authored by @grosser
• format: Add new line between METADATA blocks (#8483) authored by @sspaink
• format: Allow indenting all withs in expression (#8508) authored by @anderseknert
• format: Fix dropping comments after handling unexpectedCommentError (#8553) authored by @sspaink
• format: Preserve location of trailing comments inside every body (#8558) authored by @johanfylling
• format: Prevent opa fmt from formatting single attribute objects with comments (#7565) authored by @sspaink reported by @anderseknert
• logging: Keep forwarding from BufferedLogger after Flush() (#8544) authored by @srenatus reported by @annieyhuang
• plugins/logs: Fix logBuffer eviction loop only dropping one element (#8543) authored by @sspaink
• plugins/logs: Fix out-of-order plugin status notifications (#8009) authored by @sspaink reported by @Pushpalanka
• plugins/rest: Carry over all of *tls.Config (#8473) authored by @srenatus reported by @ashu2496
• server: Drop HTML index page query form (#8477) authored by @johanfylling reported by @srenatus and @r0binak
• server: Skip chmod for abstract Unix domain sockets (#8536) authored by @bakayolo
• storage/inmem: Avoid allocations from Read() in MakeDir() (#8561) authored by @srenatus
• tester: Add method to match tests by ref prefixes (#6696) authored by @anderseknert
  Note: Experimental.

Compiler, Topdown and Rego

• ast: Allow Back-to-back metadata blocks (#8482) authored by @sspaink reported by @johanfylling
• ast: Catch functions in dynamic extent of ref head rule (#8461) authored by @srenatus reported by @johanfylling
• ast: Fix parenthesis in String() of {obj,arr,set} comprehensions (#8511) authored by @srenatus
• ast: Fix parsing of unary - in front of a ref (#5014) authored by @mmzzuu reported by @philipaconrad
• ast: Fix type checker match error for objects with set keys (#6260) authored by @sspaink reported by @tsandall
• ast: Fix type checker to recognize numeric index in generated map (#6736) authored by @sspaink reported by @anderseknert
• ast: Handle underdetermined function args (#5234) authored by @sspaink reported by @obataku
• ast: Identify compatible type from reference in type checker (#7273) authored by @sspaink reported by @anderseknert
• ast: Support recursive JSON Schemas (#6099) authored by @sspaink reported by @anderseknert
• builtins: Add support for days, weeks and years in time.parse_duration_ns built-in function (#2719) authored by @sspaink reported by @freeseacher
• builtins: Fix graph.reachable_paths to return all reachable paths (#5871) authored by @davidmarne-wf reported by @ericjkao
• builtins: Limit exponent size in units.parse_bytes built-in function to prevent timeout bypass (#8326) authored by @isaiahvita reported by @anderseknert
• perf: Add CopyNonGround() methods for Array, Set, and Object (#8323) authored by @alex60217101990
• resolver/wasm: Add NewWithContext to allow passing context (#8499) authored by @dominikschulz

Docs, Website, Ecosystem

• docs: Add aggregates examples for count and sum built-in functions (#8566) authored by @alliasgher reported by @srenatus
• docs: Add generated output.jsons for docs examples (#8535) authored by @charlieegan3
• docs: Add spec for OCP bundle status tracking API (#8502) authored by @ashutosh-narkar
• docs: Add the latest videos to the README presentations section (#8523) authored by @sspaink
• docs: Add Windows development notes to dev reference guide (#8422) authored by @raajheshkannaa
• docs: Fix input value type in not undefined example (#8580) authored by @menma1234
• docs: Update Regal docs to v0.40.0 (#8538) authored by @charlieegan3
• docs: Updated roadmap link (#8501) authored by @johanfylling
• docs: Various typo fixes (#8529) authored by @sspaink
• ecosystem: Add vulnetix ecosystem entry (#8532) authored by @0x73746F66
• ecosystem: Add KubeStellar Console (#8560) authored by @clubanderson
• website: Add banner to show when event has passed (#8493) authored by @charlieegan3
• website: Add copy-as-markdown button to doc pages (#8540) authored by @charlieegan3
• website: Copy button improvements (#8577) authored by @charlieegan3
• website: Remove old redirects, add new management redirect (#8424) authored by @charlieegan3 reported by @narainar
• website: Update intro video on homepage (#8547) authored by @charlieegan3

Miscellaneous

• build: Exclude domains that cause false positives (#8533) (#8495) authored by @charlieegan3
• e2e/cli: Add test for debug print() logging (#8567) authored by @srenatus
• e2e/cli: Start CLI E2E tests (#8545) authored by @srenatus
• github: declare formatted rego as rego (#8564) authored by @srenatus
• Security policy update (#8479) authored by @anderseknert
• Dependency updates; notably:
  • build: bump go 1.26.2 (#8497) authored by @sspaink
  • build(deps): bump wasmtime-go from v39.0.1 to v43.0.2
  • build(deps): bump go.opentelemetry.io deps from 1.40.0/0.65.0 to 1.43.0/0.68.0
  • build(deps): bump github.com/containerd/containerd/v2 from 2.2.1 to 2.2.3
  • build(deps): bump ithub.com/huandu/go-sqlbuilder from 1.39.1 to 1.40.2
  • build(deps): bump golang.org/x/net from 0.51.0 to 0.53.0
  • build(deps): bump golang.org/x/text from 0.34.0 to 0.36.0

v1.16.0

Compare

Choose a tag to compare

This patch release fixes a backwards-incompatible change in the v1/logging.Logger interface that inadvertently made it into Release v1.15.0. When using OPA as Go module, and when providing custom Logger implementations, this change would break your build.

Users of the binaries or Docker images can ignore this, the code is otherwise the same as v1.15.0. Miscellaneous

logging: make WithContext() optional (authored by @srenatus)