Open Policy Agent (OPA)

v1.20.0Security

2026年8月27日

オプトインで利用するRego機能やカバレッジ関連のツール改善に加え、リモートスキーマ取得の制限と正確性・性能の改善を含むリリースです。広範な必須移行を伴う内容ではなく、既存環境への一律の対応は必要ありません。

要対応 (1)

breakingリモート JSON Schema の $ref 取得制限
allow_net が、json.match_schema と json.verify_schema によるリモート JSON Schema の $ref 取得を制限します。

その他の記録済み変更 50 件すべてvalue changes 24 · fixes 18 · additions 8

Converge object comprehension layout
Don't group rules that aren't written on one line
Don't unwrap one-line rule body braces from a single set term
Honor line breaks before explicit and/or operand bodies
Keep parens around a nested not operand
Wrap set union | infix in parens when output would be re-interpreted as comprehension
Write added imports before rules
Avoid predictable OCI temp store
Decouple decision logging from request context cancellation
Name the enclosing rule in unsafe var errors on shared lines
Print undeclared var names
A few tracing/profiling improvements
Bump the build toolchain to Go 1.27, and the go.mod language version to 1.26
Bump github.com/dgraph-io/badger/v4 from 4.9.4 to 4.9.5
Bump github.com/prometheus/client_golang from 1.24.0 to 1.24.1
Bump go.opentelemetry.io/proto/otlp from 1.10.0 to 1.11.0
Not-covered ranges are now tagged with a Kind — index_excluded or early_exit
Add list of unplanned rules to plan data
Save enumerated refs over unknown data
Speed up partial evaluation of dynamically composed policies
Treat an empty JSON Schema enum as unsatisfiable
Allocate less in ast.NewObject
Heap allocation hunting
Improved UUID implementation

Rego gains two keywords for combining conditions inside a single rule body
the new --coverage-runs flag on opa eval and opa test selects which of them to run
Add support for formatting and/or logical expressions
Support and/or logical keywords
Add support for and/or imports
Allow interactive ref head rule definitions
Allow configuring variable value length limit
Allow registering hooks, and pass them to discovery

Open Policy Agent (OPA)をスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。今回の破壊的変更も、その一例です。