RATATOSKRATATOSK
로그인

Open Policy Agent (OPA)

v1.20.0Security
2026년 8월 27일

ACTION 1OTHER 50

선택적으로 활성화하는 Rego 기능과 커버리지 도구가 추가되고 원격 스키마 조회 제한이 강화되었습니다. 정확성과 성능 개선도 포함되며, 광범위한 필수 마이그레이션은 없습니다.

조치 필요 (1)

  • breakingallow_net의 원격 JSON Schema $ref 조회 제한

    allow_net이 json.match_schema와 json.verify_schema에서 원격 JSON Schema의 $ref 조회를 제한합니다.

그 외 기록된 변경 50건 전체value changes 24 · fixes 18 · additions 8

value changes (24)

  • Converge object comprehension layout
  • Don't group rules that aren't written on one line
  • Don't unwrap one-line rule body braces from a single set term
  • Honor line breaks before explicit and/or operand bodies
  • Keep parens around a nested not operand
  • Wrap set union | infix in parens when output would be re-interpreted as comprehension
  • Write added imports before rules
  • Avoid predictable OCI temp store
  • Decouple decision logging from request context cancellation
  • Name the enclosing rule in unsafe var errors on shared lines
  • Print undeclared var names
  • A few tracing/profiling improvements
  • Bump the build toolchain to Go 1.27, and the go.mod language version to 1.26
  • Bump github.com/dgraph-io/badger/v4 from 4.9.4 to 4.9.5
  • Bump github.com/prometheus/client_golang from 1.24.0 to 1.24.1
  • Bump go.opentelemetry.io/proto/otlp from 1.10.0 to 1.11.0
  • Not-covered ranges are now tagged with a Kind — index_excluded or early_exit
  • Add list of unplanned rules to plan data
  • Save enumerated refs over unknown data
  • Speed up partial evaluation of dynamically composed policies
  • Treat an empty JSON Schema enum as unsatisfiable
  • Allocate less in ast.NewObject
  • Heap allocation hunting
  • Improved UUID implementation

fixes (18)

  • Fix roots containing percent-encoded characters
  • Validate plan-addons exist
  • Fix loading absolute paths on Windows
  • Fix overly verbose return of errors
  • Address regression causing memory corruption
  • Correct regression in Ruleset Add
  • Don't index away rules with a nested print call
  • Don't leak generated locals for calls in ref type errors
  • Don't leak generated locals in ref type errors
  • Don't report type errors for documents replaced by with
  • Don't yield a key in both base and virtual docs twice
  • Error on built-in calls with unevaluated operands
  • Fix false modulo by zero for multiples of 2^64
  • Fix negation inlining limit overflowing
  • Fix sum overflow when integer elements fit int64 but the sum does not
  • Fix performance regression in InterfaceToValue
  • Fix future.keywords wildcard import not including the not keyword
  • Fix panic for shadowed root document calls in Rego v0

additions (8)

  • Rego gains two keywords for combining conditions inside a single rule body
  • the new --coverage-runs flag on opa eval and opa test selects which of them to run
  • Add support for formatting and/or logical expressions
  • Support and/or logical keywords
  • Add support for and/or imports
  • Allow interactive ref head rule definitions
  • Allow configuring variable value length limit
  • Allow registering hooks, and pass them to discovery
Open Policy Agent (OPA) 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 브레이킹 체인지 같은 것들입니다.

스택에 추가 →
공식 릴리스 노트 ↗Open Policy Agent (OPA) 릴리스 전체 →