A release with a SQL injection fix and a GHSA-linked dependency update, alongside a breaking Rego safety-checking change. It also changes runtime and CLI behavior, adds capabilities, and fixes correctness and performance issues.
Action needed (3)
securityhigh
oras.update for GHSA-fxhp-mv3v-67qpland/oras-go/v2 oras.is updated fromland/oras-go/v2 2.to6. 1 2.to address GHSA-fxhp-mv3v-67qp.6. 2 breaking
ReadHeaderTimeoutdefaultAll HTTP servers now set
ReadHeaderTimeoutto32s.breakingPartial set and
-objectrule name conflictsThe AST rejects partial set and
-objectrules that share a name.
Check if affected (2)
securityCompile API SQL identifier handling
Applies if you use the Compile API and use a dynamic key.
The Compile API no longer places caller-controlled text from a dynamically selected key in SQL identifier positions.
breakingStricter
:=safety checkingApplicability is not stated in the release notes.
Affected policies that previously compiled now fail with a
rego_unsafe_var_error, reflecting stricter Rego safety checking.