RATATOSKRATATOSK
ログイン

Open Policy Agent (OPA)

v1.21.0Security
2026年9月24日

ACTION 4CHECK 1OTHER 72

YAMLとRegoの互換性更新に加え、APIと実行時機能、インデックス作成、性能、正確性、依存関係の保守が進められた機能・保守リリースです。オペレーターの設定や動作を変更する内容はありません。

要対応 (4)

  • breakingYAMLの単語をプレーン文字列として扱う変更

    YAML 1.2コアスキーマの仕様に従い、対象の単語をプレーン文字列として扱います。

  • breaking空のリテラルの型付けを明確化

    空のリテラルを、それぞれ実際の型に合わせて扱います。プロパティのないオブジェクト、要素のない配列、メンバーのないセットとして型付けされます。

  • breaking到達不能な内容を含むドキュメントの拒否

    到達不能な内容を含むドキュメントを拒否します。

  • breakingin 演算子とコレクション型の検査

    コレクションの型に対して in 演算子を型検査します。

影響確認 (1)

  • breakingsemver の値に対する形式検証

    semverを使用している場合に適用されます。

    semver の組み込み関数で、先頭のゼロと空のプレリリースまたはビルド情報を拒否します。

その他の記録済み変更 72 件すべてvalue changes 48 · fixes 17 · additions 5 · constraints 1 · removals 1

value changes (48)

  • response gzip compression now bounds its buffer to min_length
  • The rule indexer now excludes rules from more kinds of expression, and builds a smaller trie to do it with.
  • startswith, endswith, strings.any_prefix_match and strings.any_suffix_match are indexed when the base strings are known at compile time.
  • A reference that reads a key out of the object at its ground prefix in base data (data.groups.admins.members[input.subject]) is indexed by asking that object for the key
  • References rooted at a local variable (x := input; x.foo == "a") are indexed the same as input.foo == "a"
  • A rule's path through the trie stops at the last level it constrains
  • Add trace_id, span_id and request_context to the event AST
  • Recall multi-line statements as one history entry
  • Only log diagnostic API access at DEBUG
  • Split large bundle writes across transactions
  • Emphasize top-most differing types in type errors
  • Hint at missing future keyword imports
  • Mark JSON schema builtins nondeterministic
  • Point object parse errors at the offending token
  • Report keywords used as rule names
  • Report violations from multiple compiler stages
  • Pass Time and Seed through Partial() like Eval() does
  • Iterate known keys and save unknown ones during PE
  • Record evaluated rules during partial evaluation
  • Cheaper custom function calls
  • General performance improvements in compiler
  • Bump to 1.27.1
  • Bump github.com/dgraph-io/badger/v4 from 4.9.5 to 4.9.6
  • Bump github.com/gobwas/glob to v1.0.0
  • - build(deps): Bump github.com/huandu/go-sqlbuilder from 1.42.1 to 1.43.0
  • - build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.1 to 3.3.0
  • - build(deps): Bump github.com/olekukonko/tablewriter from 1.1.4 to 1.1.5
  • - build(deps): Bump github.com/prometheus/client_model from 0.6.2 to 0.6.3
  • - build(deps): Bump github.com/santhosh-tekuri/jsonschema/v6 from 6.0.2 to 6.0.3
  • - build(deps): Bump github.com/sirupsen/logrus from 1.9.4 to 1.10.2
  • - build(deps): Bump github.com/vektah/gqlparser/v2 from 2.5.36 to 2.5.37
  • - build(deps): Bump go.opentelemetry.io/contrib/bridges/prometheus from 0.69.0 to 0.71.0
  • - build(deps): Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.71.0
  • - build(deps): Bump go.opentelemetry.io/otel from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/sdk/metric from 1.44.0 to 1.46.0
  • - build(deps): Bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5
  • - build(deps): Bump golang.org/x/sync from 0.22.0 to 0.23.0
  • - build(deps): Bump golang.org/x/term from 0.45.0 to 0.46.0
  • - build(deps): Bump golang.org/x/text from 0.40.0 to 0.42.0
  • - build(deps): Bump golang.org/x/time from 0.15.0 to 0.16.0
  • - build(deps): Bump google.golang.org/grpc from 1.82.1 to 1.83.2
  • - build(deps): Bump google.golang.org/protobuf from 1.36.11 to 1.36.12

fixes (17)

  • Rules with general refs no longer collide in the recursion check
  • Candidates come back in declaration order, which the indexer documented but did not do.
  • don't panic on non-string table/column mappings
  • Fix Trigger() racing a cancelled context into a false success
  • Fix ignored OCI downloader settings
  • runner.CapturePrintOutput setting never read
  • don't drop comments after an inline if body
  • Report upload failures when retrying requeued chunks
  • Honor DisableUndefinedOutput setting
  • Return the listener error instead of exiting the process
  • Fix panic comparing a decimal zero with a non-integral number
  • Fix type errors from allowed undefined function calls
  • Fix EvalDisableInlining always being overridden
  • Fix regex cache leak
  • Fix sprintf formatting of floats with zero fraction
  • Match topdown semantics in strings.replace_n
  • Fix linear runtime for Array.set due to rehashing

additions (5)

  • now accept a rule_labels query parameter to include the same merged labels in the response payload
  • Adding query stack-trace framing mode
  • Support custom headers on the OTLP exporter
  • Add distributed_tracing.exclude_paths
  • Add stack traces to evaluation errors

constraints (1)

  • Resolve OCI bundles behind an image index

removals (1)

  • - build(deps): Drop sigs.k8s.io/yaml (was 1.6.0)
Open Policy Agent (OPA)をスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。 今回の破壊的変更も、その一例です。

スタックに追加 →
公式リリースノート ↗Open Policy Agent (OPA)のリリース一覧 →