Update go modules (main) (minor) - #1632
Conversation
6530ff8 to
6421e02
Compare
ℹ️ Artifact update noticeFile name: acceptance/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
File name: docs/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
File name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
Codecov Report✅ All modified and coverable lines are covered by tests. 🚀 New features to boost your workflow:
|
7f6a07a to
4f6e0d5
Compare
4f6e0d5 to
cf70ec7
Compare
903a958 to
915f933
Compare
8051b1b to
b414ed3
Compare
5c9e490 to
6625ab3
Compare
e54a0a3 to
830dcc8
Compare
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
the
ready-for-merge
4ce3d86 to
874cf4d
Compare
|
🤖 Finished Review · ✅ Success · Started 5:14 PM UTC · Completed 5:21 PM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 7:16 PM UTC · Completed 7:21 PM UTC |
|
🤖 Finished Review · ✅ Success · Started 12:55 PM UTC · Completed 1:02 PM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 4:56 AM UTC · Completed 5:04 AM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 2:18 PM UTC · Completed 2:26 PM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 5:50 AM UTC · Completed 5:56 AM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 9:46 PM UTC · Completed 9:58 PM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 1:23 AM UTC · Completed 1:30 AM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 12:49 PM UTC · Completed 12:56 PM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 5:47 AM UTC · Completed 5:54 AM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 4:55 PM UTC · Completed 5:04 PM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 7:51 PM UTC · Completed 8:04 PM UTC Commit: |
|
🤖 Finished Review · ✅ Success · Started 7:38 PM UTC · Completed 7:48 PM UTC Commit: |
|
🤖 Finished Review · ✅ Success · Started 8:35 AM UTC · Completed 8:47 AM UTC Commit: |
| github.com/tektoncd/triggers v0.33.0 // indirect | ||
| github.com/tektoncd/pipeline v1.14.1 // indirect | ||
| github.com/tektoncd/triggers v0.36.0 // indirect | ||
| github.com/tetratelabs/wazero v1.12.0 // indirect |
There was a problem hiding this comment.
[high] breaking behavioral change
OPA is being upgraded from v1.12.1 to v1.19.0, which includes a breaking behavioral change: stricter safety checking for the := operator. The RHS of := can no longer be made safe by the LHS. This repository contains 4311 uses of := across 156 Rego policy files. The make ci target runs opa check --strict which would surface any rego_unsafe_var_error at build time. If CI passes, no policies are affected.
Suggested fix: Before merging, confirm that CI (make ci) passes successfully with the updated OPA version. If CI fails with rego_unsafe_var_error, the affected policies must be refactored to make RHS variables safe independently of the LHS.
| module github.com/conforma/policy | ||
|
|
||
| go 1.25.5 | ||
| go 1.26.5 |
There was a problem hiding this comment.
[low] Go version compatibility
The root go.mod is being updated from go 1.25.5 to go 1.26.5. The CI workflow uses go-version-file: go.mod, so GitHub Actions will automatically install Go 1.26.5. This is a routine minor version bump handled by the existing CI infrastructure.
| go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/prometheus v0.65.0 // indirect |
There was a problem hiding this comment.
[low] transitive dependency churn
Several transitive dependencies are being removed or replaced as conftest and tektoncd/cli bump major versions. These include cosign/v2, go-witness, vault/api, grafeas, and various Azure/Kafka/MongoDB packages. The make ci target will catch any breakage from these removals.
This PR contains the following updates:
v0.20.7-0.20251103083939-3459088e4bae→v0.21.7v0.15.1→v0.16.0v0.66.0→v0.69.0v1.12.3→v1.19.1v0.37.0→v0.42.0v0.42.1→v0.46.0Release Notes
conforma/go-containerregistry (github.com/conforma/go-containerregistry)
v0.21.7Compare Source
cucumber/godog (github.com/cucumber/godog)
v0.16.0Compare Source
Changed
cucumber/messagesto v34 andcucumber/gherkinto v42 - (764 - vearutop)Fixed
open-policy-agent/conftest (github.com/open-policy-agent/conftest)
v0.69.0Compare Source
Changelog
New Features
55d9a7b: feat(verify): Add --var-values flag (#1288) (@jalseth)81f1ce4: feat: support glob wildcards in --namespace (#1343) (@arpitjain099)Bug Fixes
cd348b8: fix(ci): update setup-regal action to open-policy-agent org (#1368) (@boranx)0e38a95: fix(verify): default--show-builtin-errorsto false (#1325) (@dgeorgievski)OPA Changes
c0aceef: build(deps): bump github.com/open-policy-agent/opa from 1.15.2 to 1.17.1 (#1346) (@dependabot[bot])a41c3a9: build(deps): bump github.com/open-policy-agent/opa from 1.17.1 to 1.18.2 (#1363) (@dependabot[bot])4130398: build(deps): bump github.com/open-policy-agent/opa to v1.19.0 (#1385) (@johanfylling)Other Changes
6b381ad: Pre commit conftest docs integration (#1263) (@jrottenberg)107ec8e: build(deps): bump actions/checkout from 6.0.1 to 6.0.3 (#1352) (@dependabot[bot])0b9a9be: build(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#1358) (@dependabot[bot])a2ddb01: build(deps): bump alpine from 3.23.3 to 3.23.4 (#1316) (@dependabot[bot])cbe17f2: build(deps): bump alpine from 3.23.4 to 3.24.0 (#1351) (@dependabot[bot])15ddb9d: build(deps): bump alpine from 3.24.0 to 3.24.1 (#1357) (@dependabot[bot])313bf0a: build(deps): bump cachix/install-nix-action from 31.10.1 to 31.10.6 (#1329) (@dependabot[bot])cab3aa1: build(deps): bump cuelang.org/go from 0.16.0 to 0.16.1 (#1310) (@dependabot[bot])bee01de: build(deps): bump cuelang.org/go from 0.16.1 to 0.17.0 (#1362) (@dependabot[bot])7797f79: build(deps): bump cuelang.org/go from 0.17.0 to 0.17.1 (#1373) (@dependabot[bot])8cd5347: build(deps): bump docker/build-push-action from 7.0.0 to 7.1.0 (#1314) (@dependabot[bot])92db984: build(deps): bump docker/build-push-action from 7.1.0 to 7.2.0 (#1337) (@dependabot[bot])55eeab0: build(deps): bump docker/login-action from 4.0.0 to 4.1.0 (#1309) (@dependabot[bot])8d864f0: build(deps): bump docker/login-action from 4.1.0 to 4.2.0 (#1339) (@dependabot[bot])9f57449: build(deps): bump docker/login-action from 4.2.0 to 4.4.0 (#1370) (@dependabot[bot])026dc0d: build(deps): bump github.com/CycloneDX/cyclonedx-go (#1333) (@dependabot[bot])8293d77: build(deps): bump github.com/moby/buildkit from 0.29.0 to 0.30.0 (#1331) (@dependabot[bot])2f126ef: build(deps): bump golang from 1.26.1-alpine to 1.26.2-alpine (#1312) (@dependabot[bot])1f45387: build(deps): bump golang from 1.26.2-alpine to 1.26.4-alpine (#1344) (@dependabot[bot])fb6fbdd: build(deps): bump golang from 1.26.4-alpine to 1.26.5-alpine (#1371) (@dependabot[bot])30ed475: build(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 (#1364) (@dependabot[bot])d099ca1: build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.2 (#1334) (@dependabot[bot])eb7ca3e: build(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 (#1366) (@dependabot[bot])d07ab51: build(deps): bump js-yaml from 3.13.1 to 4.2.0 in /examples/ts (#1353) (@dependabot[bot])8314227: build(deps): bump sethvargo/ratchet from 0.11.4 to 0.12.0 (#1374) (@dependabot[bot])9abd9c4: ci: Use only-new-issues to prevent existing lint violations from blocking CI (#1340) (@boranx)169a2e4: perf(engine): Move Input AST conversion to occur before rule loop (#1348) (@brittandeyoung)v0.68.2Compare Source
Changelog
OPA Changes
36f23bf: build(deps): bump github.com/open-policy-agent/opa from 1.15.1 to 1.15.2 (#1311) (@dependabot[bot])Other Changes
479de13: build(deps): bump github.com/hashicorp/go-getter from 1.8.5 to 1.8.6 (#1307) (@dependabot[bot])v0.68.1Compare Source
Changelog
Bug Fixes
2631477: fix(push): Use Rego v1 by default (#1290) (@jalseth)v0.68.0Compare Source
Changelog
New Features
a604f55: feat(parser): Add nginx parser (#1289) (@jalseth)Bug Fixes
487a2e1: fix: Skip extensionless files that are not recognized types (#1302) (@ricardbejarano)OPA Changes
472e4e3: build(deps): bump github.com/open-policy-agent/opa from 1.14.1 to 1.15.1 (#1303) (@dependabot[bot])Other Changes
6d521ef: build(deps): bump github.com/google/go-jsonnet from 0.21.0 to 0.22.0 (#1299) (@dependabot[bot])2d5f1c2: build(deps): bump github.com/moby/buildkit from 0.28.0 to 0.29.0 (#1306) (@dependabot[bot])v0.67.1Compare Source
Changelog
Bug Fixes
9cef5a2: fix(releasing): Ensure GoReleaser creates a tar for linux_amd64 (#1294) (@jalseth)Other Changes
8bc9477: build(deps): bump actions/setup-go from 6.0.0 to 6.3.0 (#1278) (@dependabot[bot])7655171: build(deps): bump docker/build-push-action from 6.19.2 to 7.0.0 (#1284) (@dependabot[bot])35ab0ca: build(deps): bump docker/login-action from 3.6.0 to 4.0.0 (#1283) (@dependabot[bot])94e5286: build(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 (#1275) (@dependabot[bot])45a3835: ci: Update Nix devshell to use go-overlay (#1287) (@jalseth)v0.67.0Compare Source
Changelog
Bug Fixes
69f41ed: fix(plugin): Handle spaces in the plugin command path (#1242) (@jalseth)OPA Changes
59cb419: build(deps): bump github.com/open-policy-agent/opa from 1.12.1 to 1.13.1 (#1262) (@dependabot[bot])507345f: build(deps): bump github.com/open-policy-agent/opa from 1.13.1 to 1.13.2 (#1274) (@dependabot[bot])69b7329: build(deps): bump github.com/open-policy-agent/opa from 1.13.2 to 1.14.1 (#1282) (@dependabot[bot])Other Changes
8ec8ba0: build(deps): bump actions/checkout from 5.0.0 to 6.0.1 (#1230) (@dependabot[bot])fb1d20e: build(deps): bump alpine from 3.23.2 to 3.23.3 (#1264) (@dependabot[bot])84ee4f1: build(deps): bump bats-core/bats-action from 3.0.1 to 4.0.0 (#1270) (@dependabot[bot])06f26a6: build(deps): bump cuelang.org/go from 0.15.1 to 0.15.3 (#1244) (@dependabot[bot])d01f783: build(deps): bump cuelang.org/go from 0.15.3 to 0.15.4 (#1259) (@dependabot[bot])b7f9627: build(deps): bump cuelang.org/go from 0.15.4 to 0.16.0 (#1279) (@dependabot[bot])3e4cf98: build(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#1273) (@dependabot[bot])b7060d3: build(deps): bump github.com/CycloneDX/cyclonedx-go from 0.9.3 to 0.10.0 (#1265) (@dependabot[bot])e130513: build(deps): bump github.com/hashicorp/go-getter from 1.8.3 to 1.8.4 (#1245) (@dependabot[bot])e5afd3f: build(deps): bump github.com/hashicorp/go-getter from 1.8.4 to 1.8.5 (#1285) (@dependabot[bot])d6f5fb2: build(deps): bump github.com/moby/buildkit from 0.26.3 to 0.27.1 (#1260) (@dependabot[bot])c1ba806: build(deps): bump github.com/moby/buildkit from 0.27.1 to 0.28.0 (#1280) (@dependabot[bot])fc57996: build(deps): bump github.com/spdx/tools-golang from 0.5.5 to 0.5.6 (#1243) (@dependabot[bot])95d756f: build(deps): bump github.com/spdx/tools-golang from 0.5.6 to 0.5.7 (#1251) (@dependabot[bot])a59b8bd: build(deps): bump golang from 1.25.5-alpine to 1.25.6-alpine (#1256) (@dependabot[bot])bde1457: build(deps): bump golang from 1.25.6-alpine to 1.26.1-alpine (#1281) (@dependabot[bot])b2e58f0: build(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.2.0 (#1231) (@dependabot[bot])b1e9f30: ci: Update Dependabot config (#1267) (@jalseth)bf63002: ci: Update setup-go to use Go version from go.mod (#1268) (@jalseth)open-policy-agent/opa (github.com/open-policy-agent/opa)
v1.19.1Compare Source
v1.19.0Compare Source
This release contains a mix of new features and bug fixes. Notably:
:=)strings.split_nbuilt-in functionFix SQL injection vector in Compile API: Quote SQL filter field identifiers (#8945)
The field names in the SQL emitted by the Compile API come from partially evaluated refs, so a
policy that selects a dynamic key — such as
input.fruits[input.column]— puts caller-controlledtext in an identifier position. That text was emitted verbatim, which turns
into
and an application appending the filter to its query returns rows the policy denies.
Field segments that are not bare identifiers are now quoted at the UCAST-to-SQL boundary, with any
embedded quote character escaped. Ordinary column names stay unquoted, so existing filters keep
their current shape and remain case-insensitive on Postgres.
Authored by @thevilledev
Behavior change: stricter safety for assignment (
:=) (#3546)The assignment operator (
:=) is documented as "syntactic sugar for=, local variable creation,and additional compiler checks," and the safety checker reflects that: after
rewriting,
:=is treated identically to=(unification), so an assignment'sright-hand side can be made safe by unifying "backwards" through the left-hand
side. This means policies like
x := y; x = 7compile (bindingyto7)even though
yis never assigned, andx := y; obj[x]can silently degrade anexpected constant-time lookup into full iteration.
This change makes the right-hand-side of
:=be treated as a read thatmust be made safe by other expressions, and can no longer be satisfied through
the left-hand-side. Affected policies that previously compiled now fail with a
rego_unsafe_var_error. Reference iteration on the right-hand-side (e.g.some k; v := obj[k]) is unaffected.Note: this is a deliberate semantic change, not a fix to match documented
behavior — the intended semantics of
:=in this case were never specified.Authored by @sspaink, reported by @tsandall
WebAssembly runtime: wasmtime-go replaced with wazero (#7557)
OPA's WebAssembly runtime — used by the
wasmevaluation target and the WASM SDK — now runs onthe pure-Go wazero runtime instead of
bytecodealliance/wasmtime-go. Thisremoves the cgo dependency from this path, so
wasm-enabled builds no longer need a C toolchain.Compiled policy modules are now cached process-wide, so repeated VM creation for the same policy
skips recompilation. On an Apple M4 Max this makes wasm cold start (compile + instantiate + first
eval) about 73% faster, and warm evaluation about 29% faster with ~28% fewer allocations.
Authored by @srenatus, reported by @sspaink
Configuration validation moved to Rego, with warnings on unknown options (#8891)
Top-level configuration validation and default injection (
default_decision,default_authorization_decision,labels) is now expressed as an embedded Rego policy rather thanhand-written Go, as is the validation of
server.metricsandmetrics_export.The user-visible effect is that unrecognized configuration options are reported instead of being
silently ignored. A typo such as
decision_loginstead ofdecision_logsnow logs a warning atstartup:
{"level":"warning","msg":"unknown configuration option \"decision_log\" encountered"}These are warnings, not errors: OPA starts as before, and sections that are intentionally
user-extensible are left alone, so extra keys there do not warn. Embedders reading configuration
through
config.ParseConfigcan find the same messages onConfig.Warnings.Authored by @sspaink
Add
strings.split_nbuilt-in function (#8344)Policies often need only the first or last few parts of a split string, but the existing
splitbuilt-in always returns every part, so the count has to be worked around with wildcards or a slice.
strings.split_ntakes the firstnsplit parts from the front or the back of the string,depending on whether
nis positive or negative:If
abs(n)is larger than the number of parts, all parts are returned. Annof0returns anempty array.
Authored by @wonju-dev, reported by @anderseknert
Improved REPL line editing, with history file migration (#962)
Pasting a tab-indented snippet into the REPL triggered tab-completion on the pasted tab, corrupting
the input (e.g. injecting a completion candidate mid-line and producing a spurious parse error).
Fixing that requires bracketed paste, where the terminal wraps pasted text in markers so the line
reader inserts it literally instead of treating an embedded tab as a completion request. The
previous reader,
peterh/liner, has no bracketed-paste support and is unmaintained (last release2021), so it has been replaced with
reeflective/readline.The new reader persists history as JSON lines instead of one command per line. Existing history
files (
~/.opa_historyby default, or the path given to--history) are detected and migrated inplace the first time the REPL loads them, so history written by earlier versions of OPA is kept.
OPA's own multi-line buffering is unchanged, and
readline's native multi-line editing is leftdisabled to avoid changing REPL behavior.
Authored by @sspaink, reported by @aeneasr
Runtime, SDK, Tooling
--formatflag for proto/JSON plan bundles toopa build(#8825) authored by @sspainkReadHeaderTimeoutto32son all HTTP servers (#8877) authored by @RinZ27RoundTripperperDecision(#8884) authored by @paulo-raca--var-valuescmd output (#7830) authored by @sspaink, reported by @charlieegan3Compiler, Topdown and Rego
future.keywords.notimport in Rego v0 (#8953) authored by @johanfyllingx in [...](#8918) reported and authored by @srenatusTermValueEqualperformance regression (#8863) authored by @mchittenCogeneratedExprsreturn deterministic order (#8895) authored by @sspainkobject.*builtins (#8692) reported and authored by @anderseknert"a", "a" in {"a"}not returningtrue(#8747) authored by @anderseknertformat_intprecision loss for integers larger than 64 bits (#8857) authored by @SynvoyaSliceStack/GroupStack, unify refStack/functionMocksStack/saveStack (#8886) authored by @srenatusruletrie.Children()call inDepth()(#8886) authored by @srenatusfunctionMocksStackon genericGroupStack[T](#8886) authored by @srenatusDocs, Website, Ecosystem
in, bare refs; modernize rego (#8822) authored by @srenatus, reported by @tsandallMiscellaneous
test.WithTempFS(#8908) authored by @anderseknertAddressing GHSA-fxhp-mv3v-67qp
v1.18.2Compare Source
This release includes a bug fix for a
opa fmtregression introduced in v1.18.0.The original fix for #8557 had the formatter enforce newlines in single-item collections (arrays, objects, sets) rather than merely honoring existing ones. As a result, running
opa fmton already-formatted policies could introduce a large number of unwanted changes. This patch release restores the intended behavior: only newlines already present in the source determine whether a single-item collection is formatted on one line or across multiple lines.Fixes
v1.18.1Compare Source
This release fixes a memory leak introduced in OPA v1.17.0. It is advised to update if you notice excess memory usage when running OPA server.
Fixes
v1.18.0Compare Source
This release contains a mix of bugfixes and small features. Notably:
User-Agentheader so it conforms to RFC 9110 (see below)GOMAXPROCSis restored and automaticGOMEMLIMITis now supportedopa fmtcorrectness fixesopa test --coverage(ranges in report, inline rule head tracking, conjunction-expression coverage)Breaking: Fix User-Agent according to RFC9110 (#8792)
OPA's outbound HTTP requests (bundle, di
Configuration
📅 Schedule: (UTC)
* 0-3 * * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.