github.com/open-policy-agent/opa

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

• A new immediate upload trigger mode
• A new array.flatten built-in function
• Numerous performance improvements

Immediate Upload Trigger Mode in Decision Logger (#8110)

An immediate trigger mode has been added to the Decision Logger; enabled by setting the decision_logs.reporting.trigger configuration option to immediate. When enabled, log events are pushed to the log service as soon as the configured upload chunk size criteria is met; or, at latest, when the configured upload delay is reached.

Authored by @sspaink

Runtime, SDK, Tooling

• cmd/fmt: Do not overwrite file on fmt without changes (#8222) authored by @Loic-R
• cmd/test: Enable sorting JSON test results by duration (#7444) authored by @sspaink
• profiler: nil *Profiler should not report Enabled() (#8256) authored by @anderseknert
• rego: Add Data function to simplify adding data from map (#5961) authored by @majiayu000 reported by @anderseknert
• runtime: Correct naming & docs for version checking (#8191) authored by @charlieegan3

Compiler, Topdown and Rego

• ast: Body.String() doesn't panic on empty body (#8244) authored by @srenatus
• ast: Improve type error message when referencing functions (#6840) authored by @sspaink
• ast: Type Checker recognizes when a variable has multiple assignments but is an undefined function (#7463) authored by @sspaink reported by @anderseknert
• ast/parser: Avoid duplicate loc copies (#8142) authored by @srenatus
• topdown: Add array.flatten built-in function (#8226) authored by @anderseknert
• topdown: Fix issue where numbers.range_step built-in could erroneously return undefined value (#8194) authored by @thevilledev
• topdown: Remove hard-coded missing key error in strings.render_template built-in (#7931) authored by @colinjlacy reported by @anderseknert
• topdown: Re-introduce cancellation-awareness for regex.replace built-in (#8179) authored by @srenatus
  from having been reverted in v1.12.1
• topdown: Support arrays as input for json.match_schema (#6615) authored by @sspaink reported by @mscudlik

Performance

• ast: Improved annotations parsing (#8210) authored by @anderseknert
• ast: Reinstate zero-alloc paths in Ref.String() (#8202) authored by @anderseknert
• ast: Replace regex implementation in IsVarCompatibleString (#8164) authored by @anderseknert
• ast: Optimize Set.Intersect and Set.Diff (#8167) authored by @thevilledev
• ast: Optimize Set.Union (#8172) authored by @thevilledev
• ast: Reduce allocations in Expr.MarshalJSON (#8204) authored by @thevilledev
• ast: Reduce allocations in Rule.MarshalJSON (#8205) authored by @thevilledev
• ast: Reduce allocations in Term.MarshalJSON (#8200) authored by @thevilledev
• ast: Reduce allocations in With.MarshalJSON (#8206) authored by @thevilledev
• perf: String() implementations using appenders (#8192) authored by @anderseknert
• topdown: Avoid redundancy in builtinTrim (#8237) authored by @thevilledev
• topdown: Eliminate closure allocations in Set and virtual doc enumeration (#8242) authored by @alex60217101990
• topdown: Fast paths for array.reverse (#8177) authored by @thevilledev
• topdown: Optimize json.remove and json.filter (#8193) authored by @thevilledev
• topdown: Optimize object built-ins (#8175) authored by @thevilledev
• topdown: Optimize union built-in (#8173) authored by @thevilledev
• topdown: Pre-alloc in various built-ins (#8198) authored by @thevilledev
• topdown: Reduce allocs in float sum/product (#8235) authored by @thevilledev
• topdown: Skip set copy in getObjectKeysParam (#8176) authored by @thevilledev

Docs, Website, Ecosystem

• docs: Add authz-spring-boot-starter to Spring Security API ecosystem entry (#8234) authored by @francois-eckert
• docs: Add header for crypto example to make (#8259) authored by @charlieegan3
• docs: Add notes for automated agents (#8147, #8203) authored by @charlieegan3
• docs: Add opa-wasm-zig to the ecosystem (#8163) authored by @burdzwastaken
• docs: Add scripts to import docs from source (#8148) authored by @charlieegan3
• docs: Explain how to use the SDK without a initialising a server (#8248) authored by @andrewcameronsims
• docs: Fix a number of redirecting links (#8165 authored by @charlieegan3
• docs: Fix template-expression examples (#8199) authored by @johanfylling
• docs/ocp: Mention source prefix/path options (#8238) authored by @srenatus
• website: Add redirect section for immutable referrers (#8262) authored by @charlieegan3 reported by @KraLeoD
• website: Display 2025 survey results on the website (#8258) authored by @charlieegan3
• website: Show breadcrumbs in search results (#8207) authored by @charlieegan3

Miscellaneous

• Decoupled the Rego job check from the Go job checks in the Github PR workflow (#8203) authored by @SeanLedford
• build: Format pr_check.rego with opa fmt (#8201) authored by @thevilledev
• build: Migrate PR check to OPA policy (#8183) authored by @SeanLedford
• build: Run go get against main to spot redacted (#8146) authored by @charlieegan3
• deps: Switch to maintained go.yaml.in/yaml/v3 yaml library (#8182) authored by @mrueg
• test/cases: Increase yaml test coverage for some regex and string builtins (#8152) authored by @srenatus
• Dependency updates; notably:
  • build: bump golang from 1.25.5 to 1.25.6 (#8224) authored by @srenatus
  • build(deps): bump go.opentelemetry.io deps from 1.38.0/0.63.0 to 1.39.0/0.64.0
  • build(deps): bump klauspost/compress from v1.18.1 to v1.18.2 (#8184) authored by @srenatus
    because of redaction warning
  • build(deps): bump github.com/go-ini/ini from v1.67.0 to gopkg.in/ini.v1 v1.67.1 (#8208) authored by @gabrpt

This is a bug fix release addressing two issues:

Bundle polling is being misconfigured when discovery bundle is updated (#8215)

This is an issue where the polling interval for discovery (discovery.polling.min_delay_seconds and discovery.polling.max_delay_seconds) were misinterpreted on reconfiguration, causing extremely long update intervals.

Reported by @loganmiller-chime, authored by @sspaink

Decision log size buffer

buffer_size_limit_bytes misconfigured during reconfiguration (#8213)

This is a regression in the decision log, where the decision_logs.reporting.buffer_size_limit_bytes was mistakenly assigned the value of decision_logs.reporting.upload_size_limit_bytes during reconfiguration. This issue is only present when decision_logs.reporting.buffer_type is set to size, which is the default value.

Authored by @sspaink

This bug fix release address issues found in the new string interpolation feature

• Add (*TemplateString).Copy() method (#8159) authored by @anderseknert
• Fix template string not serialized with escaped { (#8161) authored by @anderseknert
• fix(ast): skip template string vars in ref safety (#8174) authored by @thevilledev
• fix(ast): use original var names in template error (#8180) authored by @thevilledev

This bug fix release reverts a change to regex.replace that unintentionally changed its behaviour for anchored regular expressions.

• Revert "topdown: make regex.replace respect cancellation" (authored by @srenatus)