Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: Open Policy Agent (OPA)Clear ×

Open Policy Agent (OPA)v1.19.0SecurityJul 30, 2026

ACTION 3CHECK 2OTHER 36View full analysis

A release with a SQL injection fix and a GHSA-linked dependency update, alongside a breaking Rego safety-checking change. It also changes runtime and CLI behavior, adds capabilities, and fixes correctness and performance issues.

Action needed (3)

securityhighoras.land/oras-go/v2 update for GHSA-fxhp-mv3v-67qp
oras.land/oras-go/v2 is updated from 2.6.1 to 2.6.2 to address GHSA-fxhp-mv3v-67qp.
breakingReadHeaderTimeout default
All HTTP servers now set ReadHeaderTimeout to 32s.
breakingPartial set and -object rule name conflicts
The AST rejects partial set and -object rules that share a name.

Check if affected (2)

securityCompile API SQL identifier handling
Applies if you use the Compile API and use a dynamic key.
The Compile API no longer places caller-controlled text from a dynamically selected key in SQL identifier positions.
breakingStricter := safety checking
Applicability is not stated in the release notes.
Affected policies that previously compiled now fail with a rego_unsafe_var_error, reflecting stricter Rego safety checking.

Source ↗

Open Policy Agent (OPA)v1.18.0SecurityJun 25, 2026

CHECK 1OTHER 22View full analysis

A release with a breaking change to the outbound User-Agent value, along with restored automatic GOMAXPROCS handling and new automatic GOMEMLIMIT support. It also improves formatting and coverage behavior, corrects compiler and runtime defects, and updates dependencies.

Check if affected (1)

breakingThe User-Agent header format
Applies if you configure server-side log filters or WAF rules that exact-match the old string.
The User-Agent header now uses Open-Policy-Agent/<version> (<os>, <arch>) in OPA v1.18.0. Server-side log filters or WAF rules that exact-match the old string need to be updated.

Source ↗

Open Policy Agent (OPA)v1.16.0SecurityApr 30, 2026

ACTION 1OTHER 38View full analysis

OPA v1.16.0 adds URI built-ins, Data API metadata support, testing and WASM capabilities, along with broader Rego and schema support. It also changes formatting, logging, server, TLS, socket, storage, and dependency behavior, but includes a shutdown regression, so users should skip v1.16.0 and upgrade directly to v1.16.1.

Action needed (1)

breakingHTML index page query form removed
OPA v1.16.0 drops the HTML index page query form.

Source ↗

Open Policy Agent (OPA)v1.15.0SecurityMar 26, 2026

CHECK 1OTHER 16View full analysis

OPA v1.15.0 adds pluggable logging and AWS web-identity signing support, changes the custom HTTPAuthPlugin lifecycle contract, and adds TLS certificate reread configuration. It also includes correctness fixes and dependency updates; no security advisories or vulnerability disclosures are stated.

Check if affected (1)

breakingCustom HTTPAuthPlugin lifecycle contract
Applies if you use custom HTTPAuthPlugin implementations.
In v1.15.0, all per-request authentication logic for custom HTTPAuthPlugin implementations must move from NewClient() to Prepare().

Source ↗

Open Policy Agent (OPA)v1.14.0SecurityFeb 26, 2026

ACTION 1CHECK 1OTHER 21View full analysis

This release adds runtime and API capabilities, changes supported behavior and output, and corrects several defects. It also updates dependencies, including a fix for GHSA-9h8m-3fm2-qjrq.

Action needed (1)

securityhighThe go.opentelemetry.io dependencies, updated for GHSA-9h8m-3fm2-qjrq
The go.opentelemetry.io dependencies include the fix for GHSA-9h8m-3fm2-qjrq.

Check if affected (1)

breakingThe --h2c flag with Unix domain socket support
Applies if you use --h2c with unix domain socket (UDS).
OPA adds --h2c support for Unix domain sockets (UDS).

Source ↗

Browse by month