OPA v1.18.1 corrects a memory leak introduced in OPA v1.17.0. No individual change entries are included here.
Source ↗Releases
AI-analyzed release notes for CNCF graduated and incubating projects.
A release with a breaking change to the outbound User-Agent value, along with restored automatic GOMAXPROCS handling and new automatic GOMEMLIMIT support. It also improves formatting and coverage behavior, corrects compiler and runtime defects, and updates dependencies.
Check if affected (1)
breakingThe
User-Agentheader formatApplies if you configure server-side log filters or WAF rules that exact-match the old string.
The
User-Agentheader now usesOpen-Policy-Agent/<version> (<os>, <arch>)in OPA v1.18.0. Server-side log filters or WAF rules that exact-match the old string need to be updated.
A security-focused maintenance release updates the Go toolchain used to build official OPA binaries to address two disclosed standard-library vulnerabilities affecting OPA's HTTP handler and crypto builtins. Users who build their own binaries or images manage the Go version themselves.
Action needed (1)
securitymediumThe
Go 1.build toolchain update26. 4 OPA is built with
Go 1.in this release. The update fixes standard-library vulnerabilities used by OPA's HTTP handler and crypto builtins, identified as26. 4 GO-2026-5037andGO-2026-5039.