Open Policy Agent (OPA)

v1.22.0Security

2026년 10월 29일

Rego v2 지원, 관측성 개선, 의존성 및 도구 체인 업데이트, 정확성 수정이 함께 포함된 릴리스입니다. 번들 서명 검증이 강화되었으며, 업그레이드 전 호환성이 바뀌는 부분을 검토해야 합니다.

영향 확인 (1)

breaking번들 서명 및 검증 동작 수정
번들에 *signatures.json 접미사 패턴과 일치하는 파일이 포함된 경우 적용됩니다.
번들 서명과 검증에 있던 오래된 오류를 수정했습니다. 이제 새 OPA 버전에서는 *signatures.json 접미사 패턴과 일치하는 파일이 포함된 번들이 검증을 통과하지 못합니다.

deprecated정적 바이너리 사용 중단 예고
정적 바이너리를 사용하는 경우 적용됩니다.
static binaries가 deprecated로 지정되었습니다.

그 외 기록된 변경 38건 전체fixes 13 · value changes 12 · additions 10 · constraints 3

Resolve wasm manifest paths against the base dir
Restart the serve routine to apply config file changes
Name not activated bundles in /health?bundles error
Resolve encoded request paths consistently in authorizer and handlers
Report non-breaking spaces as illegal characters
Reject trailing minus in package declaration
Report reserved names used as import aliases
reject numbers with an out-of-range exponent
Reject some-in bindings that also appear in the domain
Preserve eval options when preparing with partial eval
Fix net.cidr_contains false negatives on IPv6 subnets ending at ::ffff:ffff:ffff
Fix partial eval panic on negated every
Fix substring overflow with huge length

Partial evaluation now evaluates an every over a known collection of at most 32 elements (counting nested everys together) once per element, instead of keeping it in the result when its body has unknowns.
Include metrics and error in mask and drop policy input
Report size and limit when request body is too large
Add location to import aliases
Compare numbers of up to 15 digits as exact decimals
rego_v2 capability implies template_strings and keywords_in_refs
List all conflicting rules in eval_conflict_error
- build(deps): Bump github.com/vektah/gqlparser/v2 from 2.5.37 to 2.5.58
- build(deps): Bump google.golang.org/grpc from 1.83.2 to 1.84.0
- build: Bump go (1.27.1 -> 1.27.3) ([#9340](https://github.com/open-policy-agent/opa/pull/9340), [#9421](https://github.com/open-policy-agent/opa/pull/9421)) authored by @srenatus, @johanfylling
- capabilities: Integrate patch release v1.21.1 ([#9291](https://github.com/open-policy-agent/opa/pull/9291)) authored by @srenatus
- capabilities: Integrate patch release v1.21.3 ([#9406](https://github.com/open-policy-agent/opa/pull/9406)) authored by @sspaink

Added --log-level-request (default info) to control the level at which the HTTP server's "Received request."/"Sent response." access log lines are emitted, independent of the general --log-level.
import rego.v2 enables the and and or keywords and the improved not semantics in one import
It is gated by the new rego_v2_import capability feature.
bundles can be declared as Rego v2 by setting the rego_version manifest attribute to 2
individua bundle modules by setting file_rego_versions
the Go API accepts the new ast.RegoV2 rego-version when parsing, compiling, and formatting Rego modules.
Export decision log buffer size and upload counters to Prometheus
Export decision log status and drop counters to Prometheus
Expose compile request body to the authorizer
Expose query API request body to the authorizer

Open Policy Agent (OPA) 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 브레이킹 체인지 같은 것들입니다.