Open Policy Agent (OPA)
v1.19.0SecurityOPA v1.19.0 fixes a SQL injection vulnerability in the Compile API and tightens := safety checking (breaking change). The release replaces the WASM runtime with pure-Go wazero for faster startup and lower overhead, adds new string functions, and improves the REPL.
securitySQL injection in Compile API via unquoted identifiers fixed
Field segments that are not bare identifiers in Compile API filters are now quoted and escaped at the UCAST-to-SQL boundary. Applies to policies that select a dynamic key, such as input.fruits[input.column]. The fix ships in v1.19.0.
breaking:= safety checking made stricter
The := operator now enforces stricter variable safety checking. Policies that previously compiled because the right-hand side became safe only through unification with the left-hand side now fail with rego_unsafe_var_error. Policies relying on this implicit safety must be refactored before upgrading to v1.19.0.
breakingUnrecognized configuration options now reported
Unrecognized top-level configuration options are now reported as errors instead of being silently ignored. Configurations with unknown fields will fail to parse in v1.19.0.
Key changes (7)
- SQL injection in Compile API (dynamic key filters) fixed: field segments now quoted and escaped
- Breaking: := operator safety checking tightened; policies relying on implicit left-hand-side unification for safety now fail
- Breaking: unrecognized config options now reported instead of silently ignored
- WASM runtime replaced with pure-Go wazero; no C toolchain required, cold start ~73% faster, warm evaluation ~29% faster with ~28% fewer allocations
- New strings.split_n built-in for extracting first/last n parts of split strings
- REPL line reader replaced (peterh/liner → reeflective/readline) with bracketed paste support; history auto-migrated to JSON-lines format
- Go dependency updated to 1.26.5
A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.