NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
Go modules · #278 by repository stars
Last release today
16 Sep 2026
Ships on a steady schedule
a new release about every 8 days
Nearly every release is documented
notes for 59 of the last 60 stable releases
85 versions withdrawn
withdrawn after publishing
10 years old
4294 releases · first in 2016
Nothing published for this version
Nothing published for this version
Nothing published for this version
One column per quarter.
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
This release contains a mix of new features, performance improvements, and bugfixes. Notably:
This release contains a mix of new features, performance improvements, and bugfixes. Notably:
The Rego language has been extended to support String Interpolation, which provides a readable means to compose strings containing dynamic values determined at evaluation time.
An interpolated string is composed of a template-string containing zero or more template-expressions that evaluates to a value at evaluation time.
The $ character prefix identifies a template-string, and template-expressions are declared by being enclosed in curly-braces ({, }).
Additionally, undefined template-expression values don't halt evaluation; instead, <undefined> will be injected into the generated string.
package interpolation
allowed_roles := ["admin", "employee"]
default role := "guest"
role := input.role
deny contains $"User {input.username}'s role was '{role}', but must be one of {allowed_roles}" if {
not role in allowed_roles
}
{
"deny": [
"User <undefined>'s role was 'guest', but must be one of [\"admin\", \"employee\"]"
],
}
String interpolation is a more readable and less error-prone substitute for the sprintf built-in function.
Authored by @johanfylling reported by @anderseknert
Help us out!
New Rego language features are exciting, and we want to maximize their usefulness. If you come across tools and integrations in the community where string interpolation isn't properly handled, such as syntax highlighting, please reach out and let us know.
some and every (#8105, #8131, #8138) authored by @charlieegan3regex.replace respect cancellation (#8089) authored by @srenatusreplace and strings.replace_n respect cancellation (#8089) authored by @srenatusconcat (#8090) authored by @srenatusA crafted HTTP request any of OPA's HTTP endpoints would lead OPA to use a large amount of memory, triggering an out-of-memory process exit.
This is a bugfix release:
A crafted HTTP request any of OPA's HTTP endpoints would lead OPA to use a large amount of memory, triggering an out-of-memory process exit.
This weakness in OPA's HTTP API gzip handling is as old as the gzip handling itself. A configurable limit was introduced in v0.67.0, but it has been shown that this security measure wasn't sufficient to avoid running out of memory in memory-constrained setups. Thanks to @thevilledev for reporting and fixing this issue.
It only applies to OPA running as server (as a binary or in a container, as "sidecar"). To trigger an OOM process exit using this weakness, an adversary must be able to send an HTTP request directly to OPA. This would be the case if they are in the same network, there is no proxy in front of OPA, or if OPA was exposed to the internet, which is advised against.
By the nature of HTTP encodings, this would be effective before token-based authentication and authorization policies, so these measures do not protect against the attack vector. If all OPA endpoints are using TLS-based authentication (mutual TLS, "mTLS"), then an adversary cannot do harm with this method.
Please note that while we're taking all of these issues seriously, OPA isn't designed for adversary environments. It's strongly advised not to expose any of its endpoints to the public internet. Furthermore, available security measures should be applied regardless, for a defense in depth approach. See the documentation for the available means of authentication and authorization in OPA.
Please also check out our Security Policy for reporting critical issues and bugs.
When the decision logs buffer was uploaded, the buffer limit inadvertently got reset to the default upload limit (32kb). This causes logs to be dropped that shouldn't have been dropped.
This default is overridden by the configuration value decision_logs.reporting.upload_size_limit_bytes, see the docs on decision logs.
There's a Prometheus metric for dropped events, counter_decision_logs_dropped_buffer_size_limit_bytes_exceeded,
and you can check that for unexpectedly high counts.
Reported by @johanneslarsson #8123, fixed by @sspaink.
The release is otherwise identical to v1.11.0.
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Your coding agent can read these notes before it upgrades. Set up the MCP server →