Open Policy Agent (OPA)

v1.22.0Security

2026年10月29日

Rego v2、可観測性、依存関係とツールチェーン、正確性に関する更新を含むリリースです。バンドル署名の検証も強化されているため、アップグレード前に互換性への影響を確認してください。

影響確認 (1)

breakingバンドル署名と検証の動作変更
バンドルに *signatures.json で終わるファイルが含まれる場合に適用されます。
バンドル署名と検証の長年の不具合を修正しました。新しいバージョンの OPA では、*signatures.json で終わるファイルを含むバンドルが検証を通らなくなります。

deprecatedstatic binaries の非推奨化
static binaries を使用している場合に適用されます。
static binaries は非推奨になりました。

その他の記録済み変更 38 件すべてfixes 13 · value changes 12 · additions 10 · constraints 3

Resolve wasm manifest paths against the base dir
Restart the serve routine to apply config file changes
Name not activated bundles in /health?bundles error
Resolve encoded request paths consistently in authorizer and handlers
Report non-breaking spaces as illegal characters
Reject trailing minus in package declaration
Report reserved names used as import aliases
reject numbers with an out-of-range exponent
Reject some-in bindings that also appear in the domain
Preserve eval options when preparing with partial eval
Fix net.cidr_contains false negatives on IPv6 subnets ending at ::ffff:ffff:ffff
Fix partial eval panic on negated every
Fix substring overflow with huge length

Partial evaluation now evaluates an every over a known collection of at most 32 elements (counting nested everys together) once per element, instead of keeping it in the result when its body has unknowns.
Include metrics and error in mask and drop policy input
Report size and limit when request body is too large
Add location to import aliases
Compare numbers of up to 15 digits as exact decimals
rego_v2 capability implies template_strings and keywords_in_refs
List all conflicting rules in eval_conflict_error
- build(deps): Bump github.com/vektah/gqlparser/v2 from 2.5.37 to 2.5.58
- build(deps): Bump google.golang.org/grpc from 1.83.2 to 1.84.0
- build: Bump go (1.27.1 -> 1.27.3) ([#9340](https://github.com/open-policy-agent/opa/pull/9340), [#9421](https://github.com/open-policy-agent/opa/pull/9421)) authored by @srenatus, @johanfylling
- capabilities: Integrate patch release v1.21.1 ([#9291](https://github.com/open-policy-agent/opa/pull/9291)) authored by @srenatus
- capabilities: Integrate patch release v1.21.3 ([#9406](https://github.com/open-policy-agent/opa/pull/9406)) authored by @sspaink

Added --log-level-request (default info) to control the level at which the HTTP server's "Received request."/"Sent response." access log lines are emitted, independent of the general --log-level.
import rego.v2 enables the and and or keywords and the improved not semantics in one import
It is gated by the new rego_v2_import capability feature.
bundles can be declared as Rego v2 by setting the rego_version manifest attribute to 2
individua bundle modules by setting file_rego_versions
the Go API accepts the new ast.RegoV2 rego-version when parsing, compiling, and formatting Rego modules.
Export decision log buffer size and upload counters to Prometheus
Export decision log status and drop counters to Prometheus
Expose compile request body to the authorizer
Expose query API request body to the authorizer

Open Policy Agent (OPA)をスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。今回の破壊的変更も、その一例です。