Open Policy Agent (OPA)
v1.16.0Securityv1.16.0 brings new URI builtins, Data API metadata support, OTLP metrics export, and critical fixes for log dropping and log buffer eviction bugs introduced in v1.15.x.
breakingUpgrade from v1.15.x immediately — logs are silently dropped
A BufferedLogger bug in v1.15.x caused bundle download logs, print() debug output, and plugin logs to be dropped after the first flush. This is silent data loss in your observability stack. If you're running v1.15.x in any environment where decision logs or debug output matter, upgrade to v1.16.0 now. Check your log pipeline for gaps if you've been running v1.15.x in production.
securityunits.parse_bytes exponent cap prevents timeout bypass
Extremely large exponent values in units.parse_bytes could be used to cause evaluation timeouts, potentially bypassing policy enforcement. This is fixed in v1.16.0 by capping the exponent size. If your policies accept user-controlled input that gets passed to units.parse_bytes, this fix is directly relevant — upgrade and review any policies that parse byte strings from untrusted sources.
enhancementUse new uri.parse / uri.is_valid builtins to replace fragile regex-based URL validation
Many OPA policies today use regex or string manipulation to validate or decompose URLs — a brittle approach. The new uri.parse builtin returns structured RFC 3986 components (scheme, host, path, query, etc.), and uri.is_valid does a clean true/false structural check. If you have policies handling redirect URIs, webhook URLs, or any URL-bearing input, replace your custom parsing logic with these builtins. The structured output makes it easier to write precise, readable rules.
主な変更 (5)
- New uri.parse and uri.is_valid builtins for RFC 3986-compliant URI handling in policy
- Data API now supports request/response metadata for wrapping projects — custom fields logged under decision log Custom['request_metadata']
- Prometheus metrics can now be exported via OTLP, unifying observability pipelines
- Critical fix: v1.15.x dropped logs for bundle downloads, print() calls, and plugin-originated logs — upgrade immediately if on v1.15.x
- units.parse_bytes exponent size now capped to prevent potential timeout bypass (security hardening)