RATATOSKRATATOSK
Sign in

Open Policy Agent (OPA)

v1.13.0Security
Jan 29, 2026

OTHER 37

OPA v1.13.0 adds a Decision Logger upload mode and a Rego built-in while broadening built-in input support. It also includes runtime and compiler fixes, performance work, and dependency updates; no security advisories or vulnerabilities are disclosed.

All 37 other recorded changesvalue changes 26 · fixes 5 · additions 3 · constraints 2 · removals 1

value changes (26)

  • - cmd/fmt: Do not overwrite file on fmt without changes ([#8222](https://github.com/open-policy-agent/opa/issues/8222)) authored by @Loic-R
  • - ast: Improve type error message when referencing functions ([#6840](https://github.com/open-policy-agent/opa/issues/6840)) authored by @sspaink
  • - ast: Improved annotations parsing ([#8210](https://github.com/open-policy-agent/opa/pull/8210)) authored by @anderseknert
  • - ast: Reinstate zero-alloc paths in Ref.String() ([#8202](https://github.com/open-policy-agent/opa/pull/8202)) authored by @anderseknert
  • - ast: Replace regex implementation in IsVarCompatibleString ([#8164](https://github.com/open-policy-agent/opa/pull/8164)) authored by @anderseknert
  • - ast: Optimize Set.Intersect and Set.Diff ([#8167](https://github.com/open-policy-agent/opa/pull/8167)) authored by @thevilledev
  • - ast: Optimize Set.Union ([#8172](https://github.com/open-policy-agent/opa/pull/8172)) authored by @thevilledev
  • - ast: Reduce allocations in Expr.MarshalJSON ([#8204](https://github.com/open-policy-agent/opa/pull/8204)) authored by @thevilledev
  • - ast: Reduce allocations in Rule.MarshalJSON ([#8205](https://github.com/open-policy-agent/opa/pull/8205)) authored by @thevilledev
  • - ast: Reduce allocations in Term.MarshalJSON ([#8200](https://github.com/open-policy-agent/opa/pull/8200)) authored by @thevilledev
  • - ast: Reduce allocations in With.MarshalJSON ([#8206](https://github.com/open-policy-agent/opa/pull/8206)) authored by @thevilledev
  • - perf: String() implementations using appenders ([#8192](https://github.com/open-policy-agent/opa/pull/8192)) authored by @anderseknert
  • - topdown: Avoid redundancy in builtinTrim ([#8237](https://github.com/open-policy-agent/opa/pull/8237)) authored by @thevilledev
  • - topdown: Eliminate closure allocations in Set and virtual doc enumeration ([#8242](https://github.com/open-policy-agent/opa/pull/8242)) authored by @alex60217101990
  • - topdown: Fast paths for array.reverse ([#8177](https://github.com/open-policy-agent/opa/pull/8177)) authored by @thevilledev
  • - topdown: Optimize json.remove and json.filter ([#8193](https://github.com/open-policy-agent/opa/pull/8193)) authored by @thevilledev
  • - topdown: Optimize object built-ins ([#8175](https://github.com/open-policy-agent/opa/pull/8175)) authored by @thevilledev
  • - topdown: Optimize union built-in ([#8173](https://github.com/open-policy-agent/opa/pull/8173)) authored by @thevilledev
  • - topdown: Pre-alloc in various built-ins ([#8198](https://github.com/open-policy-agent/opa/pull/8198)) authored by @thevilledev
  • - topdown: Reduce allocs in float sum/product ([#8235](https://github.com/open-policy-agent/opa/pull/8235)) authored by @thevilledev
  • - topdown: Skip set copy in getObjectKeysParam ([#8176](https://github.com/open-policy-agent/opa/pull/8176)) authored by @thevilledev
  • - deps: Switch to maintained go.yaml.in/yaml/v3 yaml library ([#8182](https://github.com/open-policy-agent/opa/pull/8182)) authored by @mrueg
  • - build: bump golang from 1.25.5 to 1.25.6 ([#8224](https://github.com/open-policy-agent/opa/pull/8224)) authored by @srenatus
  • - build(deps): bump go.opentelemetry.io deps from 1.38.0/0.63.0 to 1.39.0/0.64.0
  • - build(deps): bump klauspost/compress from v1.18.1 to v1.18.2 ([#8184](https://github.com/open-policy-agent/opa/pull/8184)) authored by @srenatus because of redaction warning
  • - build(deps): bump github.com/go-ini/ini from v1.67.0 to gopkg.in/ini.v1 v1.67.1 ([#8208](https://github.com/open-policy-agent/opa/issues/8208)) authored by @gabrpt

fixes (5)

  • - profiler: nil *Profiler should not report Enabled() ([#8256](https://github.com/open-policy-agent/opa/pull/8256)) authored by @anderseknert
  • - ast: Body.String() doesn't panic on empty body ([#8244](https://github.com/open-policy-agent/opa/pull/8244)) authored by @srenatus
  • - ast: Type Checker recognizes when a variable has multiple assignments but is an undefined function ([#7463](https://github.com/open-policy-agent/opa/issues/7463)) authored by @sspaink reported by @anderseknert
  • - topdown: Fix issue where numbers.range_step built-in could erroneously return undefined value ([#8194](https://github.com/open-policy-agent/opa/pull/8194)) authored by @thevilledev
  • - topdown: Re-introduce cancellation-awareness for regex.replace built-in ([#8179](https://github.com/open-policy-agent/opa/pull/8179)) authored by @srenatus from having been reverted in v1.12.1

additions (3)

  • - cmd/test: Enable sorting JSON test results by duration ([#7444](https://github.com/open-policy-agent/opa/issues/7444)) authored by @sspaink
  • - rego: Add Data function to simplify adding data from map ([#5961](https://github.com/open-policy-agent/opa/issues/5961)) authored by @majiayu000 reported by @anderseknert
  • - topdown: Add array.flatten built-in function ([#8226](https://github.com/open-policy-agent/opa/issues/8226)) authored by @anderseknert

constraints (2)

  • An immediate trigger mode has been added to the Decision Logger; enabled by setting the decision_logs.reporting.trigger [configuration option](https://www.openpolicyagent.org/docs/configuration#decision-logs) to immediate.
  • - topdown: Support arrays as input for json.match_schema ([#6615](https://github.com/open-policy-agent/opa/issues/6615)) authored by @sspaink reported by @mscudlik

removals (1)

  • - topdown: Remove hard-coded missing key error in strings.render_template built-in ([#7931](https://github.com/open-policy-agent/opa/issues/7931)) authored by @colinjlacy reported by @anderseknert
Add Open Policy Agent (OPA) to your stack

A weekly email arrives when a release needs action. Weeks with nothing to act on, like this one, send no email.

Add to stack →
Official release note ↗All Open Policy Agent (OPA) releases →