Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update dependency open-policy-agent/opa to v0.65.0 (dockerfile) (main) #126

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update dependency open-policy-agent/opa to v0.65.0 (dockerfile) (main) #126

wants to merge 1 commit into from

Conversation

ivankatliarchuk
Copy link
Member

@ivankatliarchuk ivankatliarchuk commented Mar 25, 2024 •
edited
Loading

This PR contains the following updates:

Package Update Change
open-policy-agent/opa minor 0.60.0 -> 0.65.0

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

open-policy-agent/opa (open-policy-agent/opa)

v0.65.0

Compare Source

This release contains a mix of features and bugfixes.

Runtime, Tooling, SDK
Topdown and Rego
Miscellaneous
  • docs: Add arrays to composite values section (#​6727) authored by @​anderseknert reported by @​SpecLad
  • docs: Add remainder operator to grammar (#​6767) authored by @​anderseknert
  • docs: Fix dynamic metadata object in docs (#​6709) authored by @​antonioberben
  • docs: Use best practice package name in test examples (#​6731) authored by @​asleire
  • docs: Update query API doc with details about overriding the def decision path (#​6745) authored by @​ashutosh-narkar
  • ci: pin GitHub Actions macos runner version and build for darwin/amd64 (#​6720) reported and authored by @​suzuki-shunsuke
  • Dependency updates; notably:
    • build(go): bump golang from 1.22.2 to 1.22.3
    • build(deps): bump github.com/containerd/containerd from 1.7.15 to 1.7.17
    • build(deps): bump github.com/prometheus/client_golang
    • build(deps): bump golang.org/x/net from 0.24.0 to 0.25.0
    • build(deps): bump google.golang.org/grpc from 1.63.2 to 1.64.0
Breaking changes

A new IsSetStmt statement has been added to the intermediate representation (IR).
This is a breaking change for custom IR evaluators, which must interpret this statement in IR plans generated by this OPA version and later.
No actions are required for Wasm users, as long as Wasm modules are built by this OPA version or later.

v0.64.1

Compare Source

This is a bug fix release addressing the following issues:

  • ci: Pin GitHub Actions macos runner version. The architecture of the GitHub Actions Runner macos-latest was changed from amd64 to arm64 and as a result darwin/amd64 binary wasn't released (#​6720) authored by @​suzuki-shunsuke
  • plugins/discovery: Update comparison logic used in the discovery plugin for handling overrides. This fixes a panic that resulted from the comparison of uncomparable types (#​6723) authored by @​ashutosh-narkar

v0.64.0

Compare Source

NOTES:

  • The minimum version of Go required to build the OPA module is 1.21

This release contains a mix of features, a new builtin function (json.marshal_with_options()), performance improvements, and bugfixes.

Breaking Change
Bootstrap configuration overrides Discovered configuration

Previously if Discovery was enabled, other features like bundle downloading and status reporting could not be configured manually.
The reason for this was to prevent OPAs being deployed that could not be controlled through discovery. It's possible that
the system serving the discovered config is unaware of all options locally available in OPA. Hence, we relax the configuration
check when discovery is enabled so that the bootstrap configuration can contain plugin configurations. In case of conflicts,
the bootstrap configuration for plugins wins. These local configuration overrides from the bootstrap configuration are included
in the Status API messages so that management systems can get visibility into the local overrides.

In general, the bootstrap configuration overrides the discovered configuration. Previously this was not the case for all
configuration fields. For example, if the discovered configuration changes the labels section, only labels that are
additional compared to the bootstrap configuration are used, all other changes are ignored. This implies labels in the
bootstrap configuration override those in the discovered configuration. But for fields such as default_decision, default_authorization_decision,
nd_builtin_cache, the discovered configuration would override the bootstrap configuration. Now the behavior is more consistent
for the entire configuration and helps to avoid accidental configuration errors. (#​5722) authored by @​ashutosh-narkar

Add rego_version attribute to the bundle manifest

A new global rego_version attribute is added to the bundle manifest, to inform the OPA runtime about what Rego version (v0/v1) to
use while parsing/compiling contained Rego files. There is also a new file_rego_versions attribute which allows individual
files to override the global Rego version specified by rego_version.

When the version of the contained Rego is advertised by the bundle through this attribute, it is not required to run OPA with the
--v1-compatible (or future --v0-compatible) flag in order to correctly parse, compile and evaluate the bundle's modules.

A bundle's rego_version attribute takes precedence over any applied --v1-compatible/--v0-compatible flag. (#​6578) authored by @​johanfylling

Runtime, Tooling, SDK
  • compile: Fix panic from CLI + metadata entrypoint overlaps. The panic occurs when opa build was provided an entrypoint from both a CLI flag, and via entrypoint metadata annotation. (#​6661) authored by @​philipaconrad
  • cmd/deps: Improve memory footprint and execution time of deps command for policies with high dependency connectivity (#​6685) authored by @​johanfylling
  • server: Keep default decision path in-sync with manager's config (#​6697) authored by @​ashutosh-narkar
  • server: Remove unnecessary AST-to-JSON conversions (#​6665) and (#​6669) authored by @​koponen-styra
  • sdk: Allow customizations of the plugin manager via SDK (#​6662) authored by @​xico42
  • sdk: Fix issue where active parser options aren't propagated to module reload during bundle activation resulting in errors while activating bundles with v1 syntax (#​6689) authored by @​xico42
  • plugins/rest: Close response body in OAuth2 client credentials flow (#​6708) authored by @​johanneslarsson
Topdown and Rego
Docs, Website, Ecosystem
Miscellaneous
  • go.{mod,sum}: Update the go stanza of OPA's go.mod to go 1.21. OPA, used as Go dependency, requires at least go 1.21, and thus works with all officially supported Go versions (1.21.x and 1.22.x) (#​6678) authored by @​srenatus
  • ci: Update Github Actions for Node 20. This change updates the upload-artifact and download-artifact Github actions to the latest version (v4) (#​6670) authored by @​philipaconrad
  • build: Update WASM Rego test generation docker command to address CVE-2022-24765 in Git (#​6703) authored by @​ashutosh-narkar
  • Dependency updates; notably:
    • build(go): bump 1.22.1 -> 1.22.2 (#​6672) authored by @​srenatus
    • build(deps): bump aquasecurity/trivy-action from 0.18.0 to 0.19.0
    • build(deps): bump github.com/containerd/containerd from 1.7.14 to 1.7.15
    • build(deps): bump github.com/prometheus/client_model from 0.5.0 to 0.6.1
    • build(deps): bump golang.org/x/net from 0.22.0 to 0.24.0
    • build(deps): bump google.golang.org/grpc from 1.62.1 to 1.63.2

v0.63.0

Compare Source

This release contains a mix of features, performance improvements, and bugfixes.

Runtime, Tooling, SDK
Topdown and Rego
Docs + Website + Ecosystem
Miscellaneous
  • chore: Remove repetitive words (#​6644) authored by @​occupyhabit
  • Dependency updates; notably:
    • build(deps): bump github.com/containerd/containerd from 1.7.13 to 1.7.14
    • build(deps): bump github.com/golang/protobuf from 1.5.3 to 1.5.4
    • build(deps): bump google.golang.org/grpc from 1.62.0 to 1.62.1

v0.62.1

Compare Source

This is a security fix release for the fixes published in Go 1.22.1.

OPA servers using --authentication=tls would be affected: crafted malicious client certificates could cause a panic in the server.

Also, crafted server certificates could panic OPA's HTTP clients, in bundle plugin, status and decision logs; and http.send calls that verify TLS.

This is CVE-2024-24783 (https://pkg.go.dev/vuln/GO-2024-2598).

Note that there are other security fixes in this Golang release, but whether or not OPA is affected is harder to assess. An update is advised.

Miscellaneous

v0.62.0

Compare Source

NOTES:

  • The minimum version of Go required to build the OPA module is 1.20

This release contains a mix of improvements and bugfixes.

Runtime, Tooling, SDK
  • cmd: Add environment variable backups for command-line flags (#​6508) authored by @​colinjlacy
  • download/oci: Add missing WithBundleParserOpts method to OCI downloader (#​6571) authored by @​slonka
  • logging: avoid %!F(MISSING) in logs by skipping calls to the {Debug,Info,Warn,Error}f functions when there are no arguments (#​6555) authored by @​srenatus
Topdown and Rego
Docs + Website + Ecosystem
Miscellaneous
  • Add Elastic to ADOPTERS.md (#​6568) authored by @​orouz
  • Dependency updates; notably:
    • bump golang 1.21.5 -> 1.22 (#​6595) authored by @​srenatus
    • bump google.golang.org/grpc from 1.61.0 to 1.62.0
    • bump golang.org/x/net from 0.19.0 to 0.21.0
    • bump github.com/containerd/containerd from 1.7.12 to 1.7.13
    • bump aquasecurity/trivy-action from 0.16.1 to 0.17.0
    • bump github.com/prometheus/client_golang from 1.18.0 to 1.19.0
    • bump github.com/opencontainers/image-spec from 1.1.0-rc5 to 1.1.0-rc6

v0.61.0

Compare Source

This release contains a mix of new features and bugfixes.

Runtime, SDK
Topdown
Docs
Miscellaneous
  • linters+testdata: Reformat all yaml testcases for linting. (#​6511) authored by @​philipaconrad
  • Dependency updates, notably:
    • bump github.com/containerd/containerd from 1.7.11 to 1.7.12
    • bump github.com/go-logr/logr from 1.3.0 to 1.4.1
    • bump github.com/google/uuid from 1.5.0 to 1.6.0
    • bump github.com/prometheus/client_golang from v1.16.0 to v1.18.0
    • bump google.golang.org/grpc from 1.60.1 to 1.61.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@ivankatliarchuk ivankatliarchuk self-assigned this Mar 25, 2024
@github-actions GitHub Actions
Copy link

@ivankatliarchuk: There are no 'kind' label on this PR. You need a 'kind' label.
Label can be added by writing in a comment ⬇️

  • /kind feature
  • /kind fix
  • /kind chore
  • /kind docs
  • /kind refactor
  • /kind github
  • /kind security
  • /kind question
Details

I am a bot created to help the cloudkats developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the DeFiCh/oss-governance-bot repository.

@ivankatliarchuk ivankatliarchuk force-pushed the renovate/main-open-policy-agent-opa-0.x branch 2 times, most recently from fc07140 to 25c0296 Compare March 31, 2024 20:52
@ivankatliarchuk ivankatliarchuk changed the title chore(deps): update dependency open-policy-agent/opa to v0.62.1 (dockerfile) (main) chore(deps): update dependency open-policy-agent/opa to v0.63.0 (dockerfile) (main) Mar 31, 2024
@ivankatliarchuk ivankatliarchuk force-pushed the renovate/main-open-policy-agent-opa-0.x branch from 25c0296 to 0a2ad10 Compare April 29, 2024 04:33
@ivankatliarchuk ivankatliarchuk changed the title chore(deps): update dependency open-policy-agent/opa to v0.63.0 (dockerfile) (main) chore(deps): update dependency open-policy-agent/opa to v0.64.0 (dockerfile) (main) Apr 29, 2024
@ivankatliarchuk ivankatliarchuk force-pushed the renovate/main-open-policy-agent-opa-0.x branch from 0a2ad10 to 0b2fce0 Compare April 30, 2024 04:28
@ivankatliarchuk ivankatliarchuk changed the title chore(deps): update dependency open-policy-agent/opa to v0.64.0 (dockerfile) (main) chore(deps): update dependency open-policy-agent/opa to v0.64.1 (dockerfile) (main) Apr 30, 2024
@ivankatliarchuk ivankatliarchuk force-pushed the renovate/main-open-policy-agent-opa-0.x branch from 0b2fce0 to bc2c86d Compare June 3, 2024 04:23
@ivankatliarchuk ivankatliarchuk changed the title chore(deps): update dependency open-policy-agent/opa to v0.64.1 (dockerfile) (main) chore(deps): update dependency open-policy-agent/opa to v0.65.0 (dockerfile) (main) Jun 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@ivankatliarchuk ivankatliarchuk

Labels
datasource::github-releases deps manager:regex needs/kind renovate Universal dependency update tool rule::1 type::minor
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@ivankatliarchuk