Skip to content

Update openpolicyagent/opa Docker tag to v1.22.4 - #35

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/openpolicyagent-opa-1.x
Open

Update openpolicyagent/opa Docker tag to v1.22.4#35
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/openpolicyagent-opa-1.x

Conversation

@renovate

@renovate renovate Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
openpolicyagent/opa (source) minor 1.21.4-static-debug → 1.22.4-static-debug

Release Notes

open-policy-agent/opa (openpolicyagent/opa)

v1.22.4

Compare Source

This is a fix release for a vulnerability (CVE-2026-97054) in Go's HTTP/1 server:

https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM

net/http: HTTP/1 server crash due to MaxBytesReader header race

For HTTP/1 servers, when MaxBytesReader's limit is exceeded,
"Connection: close" header is automatically set without synchronization,
which might race with another header being set explicitly in the server
handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or
MaxBytesHandler can crash due to runtime panic if its handler reads the
request body concurrently with writing the response header.

Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.

This is CVE-2026-97054 and Go issue https://go.dev/issue/82563.

Note that our security guidance includes not running OPA with its interfaces exposed to adversarial actors, like the public internet. This is fixed regardless, if only to avoid too many spurious vulnerability checker reports.

Also note that if you build your OPA binaries yourself, this patch release does not apply to you, as you control the version of Go that's used. This patch release affects the published binaries and docker images of OPA.

v1.22.3

Compare Source

This is a bugfix release for a type checker regression in v1.22.0.

It also includes a dependency bump for github.com/klauspost/compress.

[!NOTE]
The security advisory in question is GHSA-fpmh-frq8-7rj8.
Note that OPA does not support zstd compression in its handlers, but
automated vulnerability checkers still flag this as an issue, which is
why we bump this version in a patch release.

Allow keys of empty collections in rules replaced by with

A rule like default x := {} is typed as an empty collection, so any
constant key on it is rejected, even though tests replace it using with.
Empty collections in the types of rules that a with modifier targets are
now typed as any.

Dependency Updates
  • build(deps): Bump github.com/agnivade/levenshtein from 1.2.1 to 1.2.2
  • build(deps): Bump github.com/foxcpp/go-mockdns from 1.2.0 to 1.3.0
  • build(deps): Bump github.com/gobwas/glob from 1.0.0 to 1.1.0
  • build(deps): Bump github.com/huandu/go-sqlbuilder from 1.43.0 to 1.44.1
  • build(deps): Bump github.com/klauspost/compress from 1.20.0 to 1.20.3
  • build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.3.0 to 3.4.0
  • build(deps): Bump github.com/prometheus/client_golang from 1.24.1 to 1.25.0
  • build(deps): Bump github.com/spf13/pflag from 1.0.10 to 1.1.0
  • build(deps): Bump github.com/vektah/gqlparser/v2 from 2.5.58 to 2.5.64
  • build(deps): Bump go.opentelemetry.io/contrib/bridges/prometheus from 0.71.0 to 0.72.0
  • build(deps): Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.71.0 to 0.72.0
  • build(deps): Bump go.opentelemetry.io/otel from 1.46.0 to 1.47.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.46.0 to 1.47.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.46.0 to 1.47.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.46.0 to 1.47.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.46.0 to 1.47.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.46.0 to 1.47.0
  • build(deps): Bump go.opentelemetry.io/otel/sdk from 1.46.0 to 1.47.0
  • build(deps): Bump go.opentelemetry.io/otel/sdk/metric from 1.46.0 to 1.47.0
  • build(deps): Bump go.opentelemetry.io/otel/trace from 1.46.0 to 1.47.0
  • build(deps): Bump go.opentelemetry.io/proto/otlp from 1.11.0 to 1.11.1
  • build(deps): Bump go.yaml.in/yaml/v3 from 3.0.5 to 3.0.6
  • build(deps): Bump golang.org/x/sync from 0.23.0 to 0.24.0
  • build(deps): Bump golang.org/x/term from 0.46.0 to 0.47.0
  • build(deps): Bump golang.org/x/text from 0.42.0 to 0.43.0
  • build(deps): Bump google.golang.org/grpc from 1.84.0 to 1.85.0
  • build(deps): Bump oras.land/oras-go/v2 from 2.6.2 to 2.7.0

v1.22.2

Compare Source

This is a bugfix release for a type checker regression in v1.21.0.

Iterating an empty collection is rejected by the type checker

Policies that iterate a collection known to be empty, such as some x in [] or m[_] where m := {},
were rejected with rego_type_error: undefined ref. Iteration with a non-constant key is valid again, and simply
yields nothing. Comparing or unifying the elements of such a collection with a value is accepted as well.
Constant keys, like [][0], are still reported as undefined.

Reported by @​kholia.

v1.22.1

Compare Source

This is a bugfix release for a rule indexer regression in v1.21.0.

x in {"a", input.y} never matches for a ref x
allow if {
	input.x in {"a", input.y}
}

For an input of {"x": "b", "y": "b"}, this should evaluate to true. Due to a bug in the
rule indexer, the rule body hadn't been returned, and allow thus evaluated to undefined.

Reported by @​kholia.

v1.22.0

Compare Source

This release contains a mix of new features, performance improvements and bug fixes. Notably:

  • New rego.v2 import
  • Configurable log level for HTTP access logs
  • Stricter handling of bundle signature filenames (breaking change)
  • Partial evaluation unrolls every over a known domain
Configurable log level for HTTP access logs

Added --log-level-request (default info) to control the level at which the HTTP
server's "Received request."/"Sent response." access log lines are emitted, independent
of the general --log-level. Set it to debug to keep those lines out of logs unless
--log-level is also turned up.

Authored by @​srenatus

New rego.v2 import (#​9224, #​9269)

import rego.v2 enables the and and or keywords and the improved not semantics in one
import, in place of future.keywords.and, future.keywords.or, and future.keywords.not.
In a v0 module it also implies rego.v1. It is gated by the new rego_v2_import capability
feature.

package example

import rego.v2

allow if input.user.admin or not (input.user.suspended or input.user.locked)

See Importing rego.v2.

Additionally: bundles can be declared as Rego v2 by setting the rego_version manifest attribute to 2 (individua
bundle modules by setting file_rego_versions); and the Go API accepts the new ast.RegoV2 rego-version when parsing,
compiling, and formatting Rego modules.
The rego.v2 import is a redundant no-op for modules loaded these ways.

See bundle file format.

Authored by @​johanfylling

Stricter handling of bundle signature filenames (#​9300)

Breaking change: We have corrected a long-standing bug in bundle signing and verification, which will cause bundles containing files matching the suffix pattern *signatures.json to no longer pass verification in newer versions of OPA.
These bundles will need to be re-signed by this or newer versions of OPA to have a correct .signatures.json file.
Bundles that do not contain filenames with the *signatures.json pattern are unaffected, and will continue to verify correctly across OPA versions.

OPA has historically been very lax in deciding where to source bundle signature data from during bundle verification, and would attempt to load bundle signatures data from any file in the bundle that had the filename suffix pattern *signatures.json.

This could cause surprising behavior at bundle verification time, and resulted in all files with the *signatures.json pattern being ignored for signing, allowing filenames like foosignatures.json to be added to a bundle without being integrity-checked by the bundle signature.

OPA now identifies the bundle signatures file by its exact basename .signatures.json (the same way it locates the bundle manifest and data files), so it is found regardless of any directory prefix, and a bundle containing more than one signatures file is rejected.
Additionally, OPA will now correctly detect and sign all other files with the suffix pattern *signatures.json, which may cause bundles signed by this and future versions of OPA to have different signatures from the same content signed by older versions of OPA.

Authored by @​philipaconrad

Partial evaluation unrolls every over a known domain

Partial evaluation now evaluates an every over a known collection of at most 32 elements (counting nested everys together) once per element, instead of keeping it in the result when its body has unknowns. The result is the conjunction of the body for each element, which the data filtering targets of the Compile API can translate. See every.

Authored by @​srenatus

Runtime, SDK, Tooling
Compiler, Topdown and Rego
Docs, Website, Ecosystem
Miscellaneous

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@codecov

codecov Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.79%. Comparing base (2f8ead1) to head (51c8aa3).

Additional details and impacted files 
@@           Coverage Diff           @@
##             main      #35   +/-   ##
=======================================
  Coverage   95.79%   95.79%           
=======================================
  Files           5        5           
  Lines         857      857           
=======================================
  Hits          821      821           
  Misses         36       36

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@renovate
renovate Bot force-pushed the renovate/openpolicyagent-opa-1.x branch from a21a21b to 329c1bf Compare November 5, 2026 20:29
@renovate renovate Bot changed the title Update openpolicyagent/opa Docker tag to v1.22.0 Update openpolicyagent/opa Docker tag to v1.22.1 Nov 5, 2026
@renovate
renovate Bot force-pushed the renovate/openpolicyagent-opa-1.x branch from 329c1bf to 903d0b6 Compare November 6, 2026 05:31
@renovate renovate Bot changed the title Update openpolicyagent/opa Docker tag to v1.22.1 Update openpolicyagent/opa Docker tag to v1.22.2 Nov 6, 2026
@renovate
renovate Bot force-pushed the renovate/openpolicyagent-opa-1.x branch from 903d0b6 to 54bba72 Compare November 10, 2026 18:01
@renovate renovate Bot changed the title Update openpolicyagent/opa Docker tag to v1.22.2 Update openpolicyagent/opa Docker tag to v1.22.3 Nov 10, 2026
@renovate
renovate Bot force-pushed the renovate/openpolicyagent-opa-1.x branch from 54bba72 to 51c8aa3 Compare November 12, 2026 20:11
@renovate renovate Bot changed the title Update openpolicyagent/opa Docker tag to v1.22.3 Update openpolicyagent/opa Docker tag to v1.22.4 Nov 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants