Open Policy Agent (OPA)

v1.22.0Security

Oct 29, 2026

A feature-rich release adds Rego v2 and observability improvements alongside dependency, toolchain, and correctness updates. Bundle-signature validation is stricter because bundles with `*signatures.json` files may no longer verify, and static binaries are deprecated.

Check if affected (1)

breakingBundle signing and verification correction
Applies if your bundles contain files matching the suffix pattern *signatures.json.
Bundle signing and verification now rejects bundles containing files matching the suffix pattern *signatures.json in newer OPA versions. This corrects a long-standing signing and verification bug.

Plan ahead (1)

deprecatedStatic binaries deprecation
Applies if you use the static binaries.
The static binaries are deprecated in this release.

All 38 other recorded changesfixes 13 · value changes 12 · additions 10 · constraints 3

fixes (13)

Resolve wasm manifest paths against the base dir
Restart the serve routine to apply config file changes
Name not activated bundles in /health?bundles error
Resolve encoded request paths consistently in authorizer and handlers
Report non-breaking spaces as illegal characters
Reject trailing minus in package declaration
Report reserved names used as import aliases
reject numbers with an out-of-range exponent
Reject some-in bindings that also appear in the domain
Preserve eval options when preparing with partial eval
Fix net.cidr_contains false negatives on IPv6 subnets ending at ::ffff:ffff:ffff
Fix partial eval panic on negated every
Fix substring overflow with huge length

value changes (12)

Partial evaluation now evaluates an every over a known collection of at most 32 elements (counting nested everys together) once per element, instead of keeping it in the result when its body has unknowns.
Include metrics and error in mask and drop policy input
Report size and limit when request body is too large
Add location to import aliases
Compare numbers of up to 15 digits as exact decimals
rego_v2 capability implies template_strings and keywords_in_refs
List all conflicting rules in eval_conflict_error
- build(deps): Bump github.com/vektah/gqlparser/v2 from 2.5.37 to 2.5.58
- build(deps): Bump google.golang.org/grpc from 1.83.2 to 1.84.0
- build: Bump go (1.27.1 -> 1.27.3) ([#9340](https://github.com/open-policy-agent/opa/pull/9340), [#9421](https://github.com/open-policy-agent/opa/pull/9421)) authored by @srenatus, @johanfylling
- capabilities: Integrate patch release v1.21.1 ([#9291](https://github.com/open-policy-agent/opa/pull/9291)) authored by @srenatus
- capabilities: Integrate patch release v1.21.3 ([#9406](https://github.com/open-policy-agent/opa/pull/9406)) authored by @sspaink

additions (10)

Added --log-level-request (default info) to control the level at which the HTTP server's "Received request."/"Sent response." access log lines are emitted, independent of the general --log-level.
import rego.v2 enables the and and or keywords and the improved not semantics in one import
It is gated by the new rego_v2_import capability feature.
bundles can be declared as Rego v2 by setting the rego_version manifest attribute to 2
individua bundle modules by setting file_rego_versions
the Go API accepts the new ast.RegoV2 rego-version when parsing, compiling, and formatting Rego modules.
Export decision log buffer size and upload counters to Prometheus
Export decision log status and drop counters to Prometheus
Expose compile request body to the authorizer
Expose query API request body to the authorizer

constraints (3)

Support resource attributes on exported metrics
Support masking array-rooted input and result
Mark eq and assign as wasm-enabled

Add Open Policy Agent (OPA) to your stack

A weekly email arrives when a release needs action. Like the breaking changes in this release.

Add to stack →

Official release note ↗All Open Policy Agent (OPA) releases →