RATATOSKRATATOSK
Sign in

Open Policy Agent (OPA)

v1.21.0Security
Sep 24, 2026

ACTION 4CHECK 1OTHER 72

A feature and maintenance release with YAML and Rego compatibility updates, expanded APIs and runtime capabilities, and indexing and performance improvements. It also includes broad correctness and dependency maintenance, with no stated operator setup or behavior changes.

Action needed (4)

  • breakingYAML 1.2 core-schema string typing

    YAML words are now treated as plain strings, as specified by the YAML 1.2 core schema.

  • breakingEmpty literal type inference

    Empty literals are now typed according to their contents: empty objects have no properties, empty arrays have no items, and empty sets have no members.

  • breakingUnreachable document content rejection

    Documents with unreachable content are now rejected.

  • breakingType checking for the in operator

    The in operator is now type-checked against the types of its collection.

Check if affected (1)

  • breakingsemver input validation

    Applies if you use semver.

    The semver built-ins now reject leading zeroes and empty pre-release or build components.

All 72 other recorded changesvalue changes 48 · fixes 17 · additions 5 · constraints 1 · removals 1

value changes (48)

  • response gzip compression now bounds its buffer to min_length
  • The rule indexer now excludes rules from more kinds of expression, and builds a smaller trie to do it with.
  • startswith, endswith, strings.any_prefix_match and strings.any_suffix_match are indexed when the base strings are known at compile time.
  • A reference that reads a key out of the object at its ground prefix in base data (data.groups.admins.members[input.subject]) is indexed by asking that object for the key
  • References rooted at a local variable (x := input; x.foo == "a") are indexed the same as input.foo == "a"
  • A rule's path through the trie stops at the last level it constrains
  • Add trace_id, span_id and request_context to the event AST
  • Recall multi-line statements as one history entry
  • Only log diagnostic API access at DEBUG
  • Split large bundle writes across transactions
  • Emphasize top-most differing types in type errors
  • Hint at missing future keyword imports
  • Mark JSON schema builtins nondeterministic
  • Point object parse errors at the offending token
  • Report keywords used as rule names
  • Report violations from multiple compiler stages
  • Pass Time and Seed through Partial() like Eval() does
  • Iterate known keys and save unknown ones during PE
  • Record evaluated rules during partial evaluation
  • Cheaper custom function calls
  • General performance improvements in compiler
  • Bump to 1.27.1
  • Bump github.com/dgraph-io/badger/v4 from 4.9.5 to 4.9.6
  • Bump github.com/gobwas/glob to v1.0.0
  • - build(deps): Bump github.com/huandu/go-sqlbuilder from 1.42.1 to 1.43.0
  • - build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.1 to 3.3.0
  • - build(deps): Bump github.com/olekukonko/tablewriter from 1.1.4 to 1.1.5
  • - build(deps): Bump github.com/prometheus/client_model from 0.6.2 to 0.6.3
  • - build(deps): Bump github.com/santhosh-tekuri/jsonschema/v6 from 6.0.2 to 6.0.3
  • - build(deps): Bump github.com/sirupsen/logrus from 1.9.4 to 1.10.2
  • - build(deps): Bump github.com/vektah/gqlparser/v2 from 2.5.36 to 2.5.37
  • - build(deps): Bump go.opentelemetry.io/contrib/bridges/prometheus from 0.69.0 to 0.71.0
  • - build(deps): Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.71.0
  • - build(deps): Bump go.opentelemetry.io/otel from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/sdk/metric from 1.44.0 to 1.46.0
  • - build(deps): Bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5
  • - build(deps): Bump golang.org/x/sync from 0.22.0 to 0.23.0
  • - build(deps): Bump golang.org/x/term from 0.45.0 to 0.46.0
  • - build(deps): Bump golang.org/x/text from 0.40.0 to 0.42.0
  • - build(deps): Bump golang.org/x/time from 0.15.0 to 0.16.0
  • - build(deps): Bump google.golang.org/grpc from 1.82.1 to 1.83.2
  • - build(deps): Bump google.golang.org/protobuf from 1.36.11 to 1.36.12

fixes (17)

  • Rules with general refs no longer collide in the recursion check
  • Candidates come back in declaration order, which the indexer documented but did not do.
  • don't panic on non-string table/column mappings
  • Fix Trigger() racing a cancelled context into a false success
  • Fix ignored OCI downloader settings
  • runner.CapturePrintOutput setting never read
  • don't drop comments after an inline if body
  • Report upload failures when retrying requeued chunks
  • Honor DisableUndefinedOutput setting
  • Return the listener error instead of exiting the process
  • Fix panic comparing a decimal zero with a non-integral number
  • Fix type errors from allowed undefined function calls
  • Fix EvalDisableInlining always being overridden
  • Fix regex cache leak
  • Fix sprintf formatting of floats with zero fraction
  • Match topdown semantics in strings.replace_n
  • Fix linear runtime for Array.set due to rehashing

additions (5)

  • now accept a rule_labels query parameter to include the same merged labels in the response payload
  • Adding query stack-trace framing mode
  • Support custom headers on the OTLP exporter
  • Add distributed_tracing.exclude_paths
  • Add stack traces to evaluation errors

constraints (1)

  • Resolve OCI bundles behind an image index

removals (1)

  • - build(deps): Drop sigs.k8s.io/yaml (was 1.6.0)
Add Open Policy Agent (OPA) to your stack

A weekly email arrives when a release needs action. Like the breaking changes in this release.

Add to stack →
Official release note ↗All Open Policy Agent (OPA) releases →