RATATOSKRATATOSK
로그인

Open Policy Agent (OPA)

v1.21.0Security
2026년 9월 24일

ACTION 4CHECK 1OTHER 72

YAML과 Rego 호환성, API와 런타임 기능, 인덱싱 및 성능, 정확성과 의존성 유지보수를 다루는 기능·유지보수 릴리스입니다. 운영자 설정이나 동작 변경은 명시되지 않았습니다.

조치 필요 (4)

  • breakingYAML 단어의 문자열 처리

    YAML 1.2 핵심 스키마에서 지정한 단어를 일반 문자열로 처리합니다.

  • breaking빈 리터럴 형식 지정

    빈 리터럴의 형식을 실제 내용에 맞게 지정합니다. 속성이 없는 object, 항목이 없는 array, 멤버가 없는 set으로 각각 처리됩니다.

  • breaking도달할 수 없는 내용이 있는 문서 거부

    도달할 수 없는 내용이 포함된 문서를 거부합니다.

  • breaking컬렉션 형식에 따른 in 연산자 검사

    컬렉션의 형식에 맞춰 in 연산자의 사용을 검사합니다.

영향 확인 (1)

  • breakingsemver 값 검증 강화

    semver를 사용하는 경우에 적용됩니다.

    semver 내장 함수에서 앞자리 0과 빈 사전 출시 및 빌드 값을 거부합니다.

그 외 기록된 변경 72건 전체value changes 48 · fixes 17 · additions 5 · constraints 1 · removals 1

value changes (48)

  • response gzip compression now bounds its buffer to min_length
  • The rule indexer now excludes rules from more kinds of expression, and builds a smaller trie to do it with.
  • startswith, endswith, strings.any_prefix_match and strings.any_suffix_match are indexed when the base strings are known at compile time.
  • A reference that reads a key out of the object at its ground prefix in base data (data.groups.admins.members[input.subject]) is indexed by asking that object for the key
  • References rooted at a local variable (x := input; x.foo == "a") are indexed the same as input.foo == "a"
  • A rule's path through the trie stops at the last level it constrains
  • Add trace_id, span_id and request_context to the event AST
  • Recall multi-line statements as one history entry
  • Only log diagnostic API access at DEBUG
  • Split large bundle writes across transactions
  • Emphasize top-most differing types in type errors
  • Hint at missing future keyword imports
  • Mark JSON schema builtins nondeterministic
  • Point object parse errors at the offending token
  • Report keywords used as rule names
  • Report violations from multiple compiler stages
  • Pass Time and Seed through Partial() like Eval() does
  • Iterate known keys and save unknown ones during PE
  • Record evaluated rules during partial evaluation
  • Cheaper custom function calls
  • General performance improvements in compiler
  • Bump to 1.27.1
  • Bump github.com/dgraph-io/badger/v4 from 4.9.5 to 4.9.6
  • Bump github.com/gobwas/glob to v1.0.0
  • - build(deps): Bump github.com/huandu/go-sqlbuilder from 1.42.1 to 1.43.0
  • - build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.1 to 3.3.0
  • - build(deps): Bump github.com/olekukonko/tablewriter from 1.1.4 to 1.1.5
  • - build(deps): Bump github.com/prometheus/client_model from 0.6.2 to 0.6.3
  • - build(deps): Bump github.com/santhosh-tekuri/jsonschema/v6 from 6.0.2 to 6.0.3
  • - build(deps): Bump github.com/sirupsen/logrus from 1.9.4 to 1.10.2
  • - build(deps): Bump github.com/vektah/gqlparser/v2 from 2.5.36 to 2.5.37
  • - build(deps): Bump go.opentelemetry.io/contrib/bridges/prometheus from 0.69.0 to 0.71.0
  • - build(deps): Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.71.0
  • - build(deps): Bump go.opentelemetry.io/otel from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.46.0
  • - build(deps): Bump go.opentelemetry.io/otel/sdk/metric from 1.44.0 to 1.46.0
  • - build(deps): Bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5
  • - build(deps): Bump golang.org/x/sync from 0.22.0 to 0.23.0
  • - build(deps): Bump golang.org/x/term from 0.45.0 to 0.46.0
  • - build(deps): Bump golang.org/x/text from 0.40.0 to 0.42.0
  • - build(deps): Bump golang.org/x/time from 0.15.0 to 0.16.0
  • - build(deps): Bump google.golang.org/grpc from 1.82.1 to 1.83.2
  • - build(deps): Bump google.golang.org/protobuf from 1.36.11 to 1.36.12

fixes (17)

  • Rules with general refs no longer collide in the recursion check
  • Candidates come back in declaration order, which the indexer documented but did not do.
  • don't panic on non-string table/column mappings
  • Fix Trigger() racing a cancelled context into a false success
  • Fix ignored OCI downloader settings
  • runner.CapturePrintOutput setting never read
  • don't drop comments after an inline if body
  • Report upload failures when retrying requeued chunks
  • Honor DisableUndefinedOutput setting
  • Return the listener error instead of exiting the process
  • Fix panic comparing a decimal zero with a non-integral number
  • Fix type errors from allowed undefined function calls
  • Fix EvalDisableInlining always being overridden
  • Fix regex cache leak
  • Fix sprintf formatting of floats with zero fraction
  • Match topdown semantics in strings.replace_n
  • Fix linear runtime for Array.set due to rehashing

additions (5)

  • now accept a rule_labels query parameter to include the same merged labels in the response payload
  • Adding query stack-trace framing mode
  • Support custom headers on the OTLP exporter
  • Add distributed_tracing.exclude_paths
  • Add stack traces to evaluation errors

constraints (1)

  • Resolve OCI bundles behind an image index

removals (1)

  • - build(deps): Drop sigs.k8s.io/yaml (was 1.6.0)
Open Policy Agent (OPA) 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 브레이킹 체인지 같은 것들입니다.

스택에 추가 →
공식 릴리스 노트 ↗Open Policy Agent (OPA) 릴리스 전체 →