Open Policy Agent (OPA)
v1.17.0SecurityOPA v1.17.0 fixes a semantic bug in negation handling and improves decision log label reporting. Most changes are enhancements; one dependency removal requires manual GOMAXPROCS configuration in some environments.
enhancementImport future.keywords.not to fix negation semantics in composite expressions
OPA v1.17.0 introduces a new `future.keywords.not` import that fixes a long-standing semantic bug where negation of composite expressions (`not f(g(input.x))`) would fail silently if any intermediate value was undefined, instead of correctly succeeding. With the import enabled, undefined intermediates no longer cause rule failure. If your policies rely on negation of complex expressions where inputs or function results might be undefined, import `future.keywords.not` to fix unintuitive failures. This is a behavioral change that may affect policy evaluation, but in the direction of correctness.
enhancementUpdate decision log parsing for new rule_labels array format
Decision logs now include a new top-level `rule_labels` array that collects labels from all successfully evaluated rules in a single entry, with inner-scope-wins precedence (rule > document > package > subpackages). This replaces the previous behavior of one log entry per label-contributing scope. If you parse or query decision logs by rule labels, update your log parsing logic to read from `rule_labels` as an array of merged label maps rather than individual scope-level entries. This change simplifies label aggregation and is now processed by default in both runtime and Go SDK.
breakingRemoved automaxprocs and x/net dependencies; configure GOMAXPROCS manually if needed
OPA v1.17.0 removes the automaxprocs and x/net dependencies, reducing the runtime footprint and eliminating potential conflicts with applications that also manage those libraries. No action is required unless your deployment explicitly depends on automaxprocs behavior (automatic CPU detection and GOMAXPROCS tuning). If you rely on that behavior, you may need to configure GOMAXPROCS explicitly in your environment or deployment. Most users will see no impact.
Key changes (5)
- New `future.keywords.not` import fixes unintuitive failures when negating composite expressions with undefined intermediates.
- Decision logs now include `rule_labels` array with merged labels from all successfully evaluated rules.
- Bundle manifest and IR plan JSON schemas are now published for validation and tooling integration.
- Removed automaxprocs and x/net dependencies to reduce runtime footprint.
- Pattern validation enabled in `json.verify_schema` and `json.match_schema` builtin functions.