[renovate]

This PR contains the following updates:

Package	Type	Update	Change
regorus	dependencies	minor	0.10.0 → 0.15.0

---

Release Notes

microsoft/regorus (regorus)

v0.15.0

Compare Source

Added

• (sprintf) support full %q format specifications (#​810)
• (azure_policy) parse alias paths with a quote-aware bracket grammar (#​894)
• (explain) make explanation attribution contracts explicit (#​896)
• (azure_policy) resolve dynamic tag field paths like literal tag fields (#​889)

Fixed

• prevent builtin and alias parsing panics (#​921)
• (sprintf) check memory before BigInt decimal conversion (#​907)
• (rvm) reject malformed compiled program blobs (#​847)
• (builtins) align strings.count with OPA match semantics (#​796)
• (builtins) harden numbers.range_step validation and allocation (#​801)
• (rvm) bind every key and value for the whole quantifier body (#​895)
• (rvm) correct source spans for multi-module programs, some-in patterns and object literals (#​892)
• (azure_policy) bind count bracket-suffix paths to the current element (#​890)

Other

• Harden core boundaries and avoid repeated comprehension parsing (#​924)
• Restore value equality shortcuts and preserve fallible serialization errors (#​927)
• Bound parser recursion across nested terms and every bodies (#​922)
• Harden timed value traversal and serialization resource errors (#​920)
• Remove external-body from float comparison (#​901)
• (deps) bump the rust-dependencies group across 2 directories with 3 updates (#​910)
• (readme) highlight RVM performance on Cedar benchmarks (#​918)
• Check RVM execution deadlines inside comparisons (#​917)
• Serialize host-await FFI arguments as compact JSON (#​884)
• Bound RVM native rule-call depth with per-VM configuration (#​913)
• (deps) bump the github-actions group with 2 updates (#​911)
• Document URL query escaping differences from OPA (#​903)
• Fix boolean sprintf output (#​902)
• Fix RVM missing-field rule and comprehension yields (#​887)
• Fix RVM keyed membership to check the requested pair (#​905)
• Fix scalar URL query decoding (#​904)
• (azure_policy) pin numeric subscripts on objects as missing fields (#​899)
• isolate shared-state FFI tests and stabilize rand.intn assertions (#​786)
• (azure_policy) enable quoted-wildcard-key count prefix cases (#​893)

v0.14.1

Compare Source

Added

• (explain) add explanation report types and settings (#​876)
• add default-off explanations cargo feature (#​873)

Fixed

• (number) make equality and ordering exact (#​846)
• (azure_policy) quote-aware [*] detection in field paths (#​875)
• (azure_policy) trim whitespace around bracket tag names (#​877)
• (azure_policy) keep value-count names out of field() resolution (#​874)
• (azure_policy) support double-quoted tag keys and reject empty tag names (#​872)
• (azure_policy) scope count field bindings to their resource (#​870)
• (azure_policy) collect nested wildcards below a count-bound prefix (#​871)
• (azure_policy) index only all-digit subscripts and saturate overflow (#​869)

Security

• Updated the build-tool-only zip dependency from 9.0.4 to 9.1.3 to address CVE-2026-115905 / GHSA-m665-v7pm-7grj (#​881). Regorus's policy evaluation runtime is unaffected; its build tooling does not use the affected streaming-extraction workflow.

Other

• add shared explanation corpus (#​885)
• (deps) bump the github-actions group across 1 directory with 9 updates (#​880)
• (deps) bump the rust-dependencies group across 6 directories with 12 updates (#​881)

v0.14.0

Compare Source

Added

• (compiler) [breaking] support fixed-arity host-await builtins (#​857)
• (bindings) expose compiled program builtin names (#​853)

Fixed

• (number) reject non-finite arithmetic results (#​845)
• (engine) keep query loop hoisting out of the shared compiled policy (#​849)
• (rvm) stop after compiling the final hoisted output loop (#​850)
• (number) reject non-finite values at supported ingress boundaries (#​840)
• (rvm) omit undefined values from set accumulation (#​841)

Other

• Fix ARM function naming in arity errors and enhance compile-error tests (#​867)
• Fix handling of quoted digit path segments in Azure Policy (#​866)
• Enhance Azure Policy tests for evaluation errors and short circuits (#​865)
• Preserve memory budgets across suspendable execution (#​830)
• fix dependency audits and vulnerable zip dependency (#​844)
• (deps) bump the github-actions group with 7 updates (#​839)

Added

• Expose compiled RVM builtin names through the C FFI and Program.GetBuiltinNames() in C#.

Changed

• [breaking] Registered RVM HostAwait builtins now require a declared input arity and pass new calls to host handlers as ordered arrays; host responses remain unwrapped. The C# HostAwaitBuiltin(string) constructor was removed, a source and CLR binary break, and public Rust Compiler::alloc_register now returns Result<Register, SpannedCompilerError>; the registered-builtin API signature is unchanged. Explicit __builtin_host_await calls and previously compiled programs keep their raw payloads, which may themselves be arrays and cannot be identified by shape. Deploy a matching program/handler/native/managed bundle or provide application-owned legacy routing; no runtime handshake or universal compatibility handler is provided. New managed code with an older size-aware native library may have its count ignored and is unsupported. Roll back the matching prior package/handler/program bundle together.
• [breaking] Float-promoting arithmetic now raises numeric overflow in <operation> instead of producing NaN or infinity, regardless of strict-builtin-error mode. Unlike OPA's wide-exponent arithmetic, finite results outside the binary64 range are rejected.

v0.13.0

Compare Source

Changed

• Package and import paths are now limited to 32 components. Previously accepted longer paths are rejected, making this a breaking release for the 0.12.x compatibility line.
• Rule lookups and compilation entrypoints use canonical paths that preserve literal namespace components. For package graph["1.0.0"], use data.graph["1.0.0"].deny, not the flattened package-metadata string data.graph.1.0.0.deny.

Added

• Add source-scoped, nonexecuting rule-declaration detection through HasDeclaredRuleRootedAt in Rust, FFI, and C#, including dotted-prefix matching and load-time parser context preservation (#​826)
• expose lossless package components (#​834)
• (sprintf) support Go-compatible %q for strings (#​809)
• (csharp) expose RVM instruction budget setter (#​811)
• (compiler) FFI and C# bindings for RVM, incl. host-await built-ins (#​672)

Fixed

• preserve literal namespace components across evaluation paths (#​827)
• (rego) schedule comprehensions in rule outputs (#​825)
• disambiguate prior rule file labels (#​824)
• keep prior rule locations in concise conflict diagnostics (#​820)
• Rule-conflict diagnostics now retain the current source envelope and identify the previous rule by file, line, and column without nesting a second diagnostic; literal percent, CR, and LF characters in the previous file label are percent-encoded. RVM conflict result semantics are unchanged.
• Suspendable RVM budgets remain immutable across host-await resumes, include native resume parsing and immediate result serialization, and leave malformed JSON syntax/EOF retryable; independent unbudgeted VM calls do not inherit a caller's account, and run-to-completion thread-baseline behavior remains unchanged.

Other

• (deps) bump the github-actions group across 1 directory with 5 updates (#​828)
• (deps) bump the rust-dependencies group across 6 directories with 13 updates (#​832)
• (deps) bump the github-actions group with 3 updates (#​822)
• (deps) bump the github-actions group with 5 updates (#​818)
• (deps) bump the rust-dependencies group across 5 directories with 5 updates (#​813)
• (deps) bump MarcoIeni/release-plz-action in the github-actions group (#​814)
• (deps) bump the github-actions group with 4 updates (#​807)
• (deps) bump the rust-dependencies group across 5 directories with 9 updates (#​808)

v0.12.0

Compare Source

Added

• (value) Frozen object storage (boxed-slice) for compact parsed objects (#​787)
• json.patch builtin with Rego set support + partial-rule multi-body fix (picks up #​442) (#​776)
• Support Verus verification (#​759)

Fixed

• Prevent panic by Number::modulo (#​773)
• Handle i64::MIN / -1 special case
• (interpreter,rvm) resolve function calls through import aliases (#​769)

Other

• Add per-execution memory budgets to RVM (#​792)
• Verify Number with Verus (#​774)
• (deps) bump the github-actions group with 3 updates (#​793)
• Fix potential underflow in bigint_to_scientific (#​791)
• (deps) migrate from serde_yaml to yaml_serde (#​790)
• (value) migrate Array storage abstraction (#​785)
• (deps) bump the github-actions group across 1 directory with 4 updates (#​783)
• Pin GitHub Actions to full-length commit SHAs (#​777)
• (value) migrate Value::Set to Set storage abstraction (#​778)
• (deps) bump the rust-dependencies group across 5 directories with 10 updates (#​784)
• (deps) bump the github-actions group with 4 updates (#​779)
• (deps) bump the github-actions group across 1 directory with 11 updates (#​763)
• (deps) bump the rust-dependencies group across 6 directories with 6 updates (#​768)
• Handle i32::MIN in Number::two_pow and Number::ten_pow (#​771)

Added

• (rvm) add opt-in per-execution memory budgets for run-to-completion evaluation, including typed Rust and binding errors (#​792)

v0.11.0

Compare Source

Added

• (compiler) support registered host-await builtins for natural function call syntax (#​667)
• (value) introduce Set storage abstraction (#​740)

Fixed

• (rvm) assert every-quantifier results so failing cases don't pass (#​765)
• Engine::add_data now deep-merges nested data documents instead of only merging top-level keys. Adding { "a": { "x": 1 } } followed by { "a": { "y": 2 } } now yields { "a": { "x": 1, "y": 2 } } (matching OPA's data-document merge). Nested sets under a shared key are unioned. Only genuine leaf conflicts (the same path holding two different values) are reported as errors. (#​760)
• A zero-arg function producing two different complete values (e.g. f() := { "a": 1 } and f() := { "b": 2 }) is now reported as a conflict, matching OPA's complete-rule semantics, instead of silently combining the outputs.

Security

• Engine::add_data now rejects data nested beyond 128 levels instead of risking a stack overflow on adversarially deep input.

Other

• (deps) bump the rust-dependencies group across 5 directories with 11 updates (#​764)
• Expand keyword-in-ref coverage for complex parser edge cases (interpreter + RVM) (#​744)
• (deps) bump the rust-dependencies group across 5 directories with 4 updates (#​754)
• (deps) bump the rust-dependencies group across 5 directories with 6 updates (#​750)
• (value) migrate Value::Object to Object storage abstraction (#​736)
• normalize path separators in folder filter on Windows (#​742)
• Introduce Object storage abstraction (#​735)
• (rvm) add debug-mode invariant assertions (#​737)
• (deps) bump the rust-dependencies group across 5 directories with 5 updates (#​734)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.