RATATOSKRATATOSK
Sign in

Open Policy Agent (OPA)

v1.20.0Security
Aug 27, 2026

ACTION 1OTHER 50

This release adds opt-in Rego language capabilities and coverage tooling while tightening remote schema fetching. It also includes correctness and performance improvements without broad mandatory migration work.

Action needed (1)

  • breakingallow_net restriction on remote JSON Schema $ref fetching

    In OPA v1.20.0, allow_net restricts remote JSON Schema $ref fetching from json.match_schema and json.verify_schema.

All 50 other recorded changesvalue changes 24 · fixes 18 · additions 8

value changes (24)

  • Converge object comprehension layout
  • Don't group rules that aren't written on one line
  • Don't unwrap one-line rule body braces from a single set term
  • Honor line breaks before explicit and/or operand bodies
  • Keep parens around a nested not operand
  • Wrap set union | infix in parens when output would be re-interpreted as comprehension
  • Write added imports before rules
  • Avoid predictable OCI temp store
  • Decouple decision logging from request context cancellation
  • Name the enclosing rule in unsafe var errors on shared lines
  • Print undeclared var names
  • A few tracing/profiling improvements
  • Bump the build toolchain to Go 1.27, and the go.mod language version to 1.26
  • Bump github.com/dgraph-io/badger/v4 from 4.9.4 to 4.9.5
  • Bump github.com/prometheus/client_golang from 1.24.0 to 1.24.1
  • Bump go.opentelemetry.io/proto/otlp from 1.10.0 to 1.11.0
  • Not-covered ranges are now tagged with a Kind — index_excluded or early_exit
  • Add list of unplanned rules to plan data
  • Save enumerated refs over unknown data
  • Speed up partial evaluation of dynamically composed policies
  • Treat an empty JSON Schema enum as unsatisfiable
  • Allocate less in ast.NewObject
  • Heap allocation hunting
  • Improved UUID implementation

fixes (18)

  • Fix roots containing percent-encoded characters
  • Validate plan-addons exist
  • Fix loading absolute paths on Windows
  • Fix overly verbose return of errors
  • Address regression causing memory corruption
  • Correct regression in Ruleset Add
  • Don't index away rules with a nested print call
  • Don't leak generated locals for calls in ref type errors
  • Don't leak generated locals in ref type errors
  • Don't report type errors for documents replaced by with
  • Don't yield a key in both base and virtual docs twice
  • Error on built-in calls with unevaluated operands
  • Fix false modulo by zero for multiples of 2^64
  • Fix negation inlining limit overflowing
  • Fix sum overflow when integer elements fit int64 but the sum does not
  • Fix performance regression in InterfaceToValue
  • Fix future.keywords wildcard import not including the not keyword
  • Fix panic for shadowed root document calls in Rego v0

additions (8)

  • Rego gains two keywords for combining conditions inside a single rule body
  • the new --coverage-runs flag on opa eval and opa test selects which of them to run
  • Add support for formatting and/or logical expressions
  • Support and/or logical keywords
  • Add support for and/or imports
  • Allow interactive ref head rule definitions
  • Allow configuring variable value length limit
  • Allow registering hooks, and pass them to discovery
Add Open Policy Agent (OPA) to your stack

A weekly email arrives when a release needs action. Like the breaking changes in this release.

Add to stack →
Official release note ↗All Open Policy Agent (OPA) releases →