Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: Open Policy Agent (OPA)Clear ×

Open Policy Agent (OPA)v1.19.1SecurityAug 17, 2026

ACTION 1View full analysis

A security-focused maintenance release updates the Go build dependency to 1.26.6 and addresses standard-library vulnerabilities used by OPA's HTTP handler and crypto builtins. Operators building their own binaries or images control the Go version used in those builds.

Action needed (1)

securitycriticalGo 1.26.6 build dependency
OPA is built with Go 1.26.6, fixing standard-library vulnerabilities in code used by its HTTP handler and crypto builtins. The fixes address GO-2026-5026, GO-2026-5972, GO-2026-6088, GO-2026-6089, GO-2026-6090, GO-2026-6091, and GO-2026-6218.

Source ↗

Open Policy Agent (OPA)v1.19.0SecurityJul 30, 2026

ACTION 3CHECK 2OTHER 36View full analysis

A release with a SQL injection fix and a GHSA-linked dependency update, alongside a breaking Rego safety-checking change. It also changes runtime and CLI behavior, adds capabilities, and fixes correctness and performance issues.

Action needed (3)

securityhighoras.land/oras-go/v2 update for GHSA-fxhp-mv3v-67qp
oras.land/oras-go/v2 is updated from 2.6.1 to 2.6.2 to address GHSA-fxhp-mv3v-67qp.
breakingReadHeaderTimeout default
All HTTP servers now set ReadHeaderTimeout to 32s.
breakingPartial set and -object rule name conflicts
The AST rejects partial set and -object rules that share a name.

Check if affected (2)

securityCompile API SQL identifier handling
Applies if you use the Compile API and use a dynamic key.
The Compile API no longer places caller-controlled text from a dynamically selected key in SQL identifier positions.
breakingStricter := safety checking
Applicability is not stated in the release notes.
Affected policies that previously compiled now fail with a rego_unsafe_var_error, reflecting stricter Rego safety checking.

Source ↗

Open Policy Agent (OPA)v1.17.1SecurityJun 8, 2026

ACTION 1View full analysis

A security-focused maintenance release updates the Go toolchain used to build official OPA binaries to address two disclosed standard-library vulnerabilities affecting OPA's HTTP handler and crypto builtins. Users who build their own binaries or images manage the Go version themselves.

Action needed (1)

securitymediumThe Go 1.26.4 build toolchain update
OPA is built with Go 1.26.4 in this release. The update fixes standard-library vulnerabilities used by OPA's HTTP handler and crypto builtins, identified as GO-2026-5037 and GO-2026-5039.

Source ↗

Open Policy Agent (OPA)v1.16.2SecurityMay 12, 2026

ACTION 1View full analysis

OPA v1.16.2 is a security-focused maintenance release. It updates the Go version used to build OPA binaries and images to 1.26.3 to address vulnerabilities.

Action needed (1)

securityThe Go build version, updated to 1.26.3
The version of Go used to build OPA binaries and images is updated to 1.26.3 to address vulnerabilities.

Source ↗

Open Policy Agent (OPA)v1.15.2SecurityApr 8, 2026

ACTION 1View full analysis

This release updates the Go toolchain used to build OPA binaries and images. It also includes multiple security fixes in that Go version.

Action needed (1)

securityThe Go toolchain, updated to 1.26.2
The Go version used to build OPA binaries and images is updated to 1.26.2. This Go version contains multiple security fixes.

Source ↗

Open Policy Agent (OPA)v1.14.1SecurityMar 9, 2026

ACTION 1OTHER 3View full analysis

OPA v1.14.1 is a patch release focused on bug fixes and dependency updates. It includes dependency work related to the Go standard library and common package vulnerabilities.

Action needed (1)

securityGolang standard library dependency updates
This patch release collects two bug fixes and dependency updates for the Golang standard library and common package vulnerabilities. The change ships in OPA v1.14.1.

Source ↗

Open Policy Agent (OPA)v1.14.0SecurityFeb 26, 2026

ACTION 1CHECK 1OTHER 21View full analysis

This release adds runtime and API capabilities, changes supported behavior and output, and corrects several defects. It also updates dependencies, including a fix for GHSA-9h8m-3fm2-qjrq.

Action needed (1)

securityhighThe go.opentelemetry.io dependencies, updated for GHSA-9h8m-3fm2-qjrq
The go.opentelemetry.io dependencies include the fix for GHSA-9h8m-3fm2-qjrq.

Check if affected (1)

breakingThe --h2c flag with Unix domain socket support
Applies if you use --h2c with unix domain socket (UDS).
OPA adds --h2c support for Unix domain sockets (UDS).

Source ↗

Open Policy Agent (OPA)v1.13.2SecurityFeb 18, 2026

ACTION 1View full analysis

OPA v1.13.2 updates the Go version used to build its binaries and images. The release includes the Go standard library fix for GO-2026-4337.

Action needed (1)

securitycriticalGo 1.25.7 build dependency
OPA binaries and images are now built with Go 1.25.7. The Go standard library in that version contains a fix for GO-2026-4337.

Source ↗

Browse by month