Skip to content

fix(deps): update module github.com/open-policy-agent/opa to v1.15.2 (main)#5335

Merged
elastic-renovate-prod[bot] merged 1 commit intomainfrom
renovate/main-github.com-open-policy-agent-opa-1.x
Apr 24, 2026
Merged

fix(deps): update module github.com/open-policy-agent/opa to v1.15.2 (main)#5335
elastic-renovate-prod[bot] merged 1 commit intomainfrom
renovate/main-github.com-open-policy-agent-opa-1.x

Conversation

@elastic-renovate-prod
Copy link
Copy Markdown
Contributor

@elastic-renovate-prod elastic-renovate-prod Bot commented Apr 24, 2026

This PR contains the following updates:

Package Type Update Change
github.com/open-policy-agent/opa require minor v1.8.0 -> v1.15.2

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

open-policy-agent/opa (github.com/open-policy-agent/opa)

v1.15.2

Compare Source

This release updates the version of Go used to build the OPA binaries and images to 1.26.2.
This version of Go contains multiple security fixes.

v1.15.1

Compare Source

This patch release fixes a backwards-incompatible change in the v1/logging.Logger interface that inadvertently made it into Release v1.15.0.
When using OPA as Go module, and when providing custom Logger implementations, this change would break your build.

[!TIP]
Users of the binaries or Docker images can ignore this, the code is otherwise the same as v1.15.0.

Miscellaneous
  • logging: make WithContext() optional (authored by @​srenatus)

v1.15.0

Compare Source

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • Add logger plugin interface and file logger implementation with log rotation
  • Custom HTTPAuthPlugin behavior change, all per-request authentication logic must be moved from NewClient() to
    Prepare()
  • AWS signing supports for web identity for assume role credentials
Logger Plugin Support (#​8434) (authored by @​srenatus)

OPA now supports pluggable logging implementations via the logger plugin interface, which is based on Go's standard log/slog.Handler interface. This allows any slog.Handler implementation to be used as a logger plugin. Loggers can be configured via the server.logger_plugin configuration option and used for both runtime logging and decision logs. OPA includes a built-in file logger plugin (file_logger) that writes structured JSON logs with rotation support using lumberjack. Users can also implement and register custom logger plugins when building OPA.

Example configuration for server logging:

server:
  logger_plugin: file_logger

plugins:
  file_logger:
    path: /var/log/opa/server.log
    max_size_mb: 100
    max_age_days: 28
    max_backups: 3
    compress: true
    level: info

Example configuration for decision logs using the same plugin:

server:
  logger_plugin: file_logger

decision_logs:
  plugin: file_logger

plugins:
  file_logger:
    path: /var/log/opa/server.log
    max_size_mb: 100
    max_age_days: 28
    max_backups: 3
    compress: true
    level: info
Custom HTTPAuthPlugin behavior change (#​8376) (authored by @​srenatus)

The HTTPAuthPlugin.NewClient() method is now called once per Client instance and cached rather than being called for
every request. Custom plugins that performed per-request operations in NewClient() (such as request counters,
per-request transport wrapping, or logging/metrics side effects) will now only execute those operations once. All
per-request authentication logic must be moved from NewClient() to Prepare(). All plugins included in OPA have been
updated and are unaffected by this change.

Runtime, SDK, Tooling
  • plugins/logger: Add logger plugin interface and file logger implementation with log rotation (#​8434) (authored by
    @​srenatus)
  • plugins/logs: Decision logs can now use logger plugins for output (#​8434) (authored by @​srenatus)
  • logging: Add BufferedLogger to capture early startup logs before plugins are initialized (#​8434) (authored by
    @​srenatus)
  • plugins/rest: Configurable re-read interval for TLS client certificates via cert_reread_interval_seconds field.
    Defaults to re-reading on every request for backwards compatibility.
    The implementation also uses content hashing to detect changes and avoid re-parsing unchanged TLS certificates and
    keys. (#​8376) (authored by @​srenatus)
  • plugins/rest: All TLS configurations now inherit the minimum version and TLS ciphersuites as configured for the
    server. (#​8376) (authored by @​srenatus)
  • internal/providers/aws: Refactor deprecated crypto/elliptic APIs to crypto/ecdh (#​8395) (authored by @​kanywst)
  • plugins/rest: AWS Signing - Allow Service Account (Web Identity) credentials for Assume Role Credentials (#​8386) (
    authored by @​tiagogviegas)
Compiler, Topdown and Rego
  • ast: fix overlapping array and scalar pattern in rule index (authored by @​srenatus)
Bundles
Docs, Website, Ecosystem
Miscellaneous

v1.14.1

Compare Source

This is a patch release collecting two bug fixes and various dependency updates for Golang standard library and common package vulnerabilities.

These bug fixes include a revert of the rule indexer tweaks shipped in 1.14.0, which had caused unexpected lookup failures for some users. (We expect to properly fix the issue in 1.15.0, but for now, a revert is the quicker choice.)

Changes
  • Fix intermittent plugins manager deadlock on opa.configure (#​8407)
  • Revert "ast: make rule index track var assignments and x in {...} (#​8341)" (#​8410)
  • build: bump deps (go.mod from main)
  • build: bump go 1.26.1 (#​8409)

v1.14.0

Compare Source

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • Improved rule indexing of variable assignments and x in {...} expressions
  • Support for --h2c with unix domain socket for opa run
  • A new glossary tooltip for technical terms in the docs
  • Fixes published in the v1.13.1 and v1.13.2 releases
Improved rule indexing of variable assignments and x in {...} expressions (#​1841)

With this change, the rule indexer will index expressions like:

allow if input.role in {"admin", "user"}

On lookup, the rule body will only be returned if input.role is either one of "admin" or "user".

The reverse case is also indexed:

allow if "admin" in input.roles

in which the searched collection is unknown.

Authored by @​srenatus reported by @​nischalsheth

Runtime, SDK, Tooling
Compiler, Topdown and Rego
Docs, Website, Ecosystem
Miscellaneous

v1.13.2

Compare Source

This release updates the version of Go used to build the OPA binaries and images to 1.25.7.
That version of the Go standard library contains a fix for GO-2026-4337.

Full Changelog: open-policy-agent/opa@v1.13.1...v1.13.2

v1.13.1

Compare Source

v1.13.1

This bug fix release addresses an issue found in the new array.flatten built-in function

v1.13.0

Compare Source

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • A new immediate upload trigger mode in the Decision Logger
  • A new array.flatten built-in function
  • Numerous performance improvements
Immediate Upload Trigger Mode in Decision Logger (#​8110)

An immediate trigger mode has been added to the Decision Logger; enabled by setting the decision_logs.reporting.trigger configuration option to immediate.
When enabled, log events are pushed to the log service as soon as the configured upload chunk size criteria is met; or, at latest, when the configured upload delay is reached.

Authored by @​sspaink

Runtime, SDK, Tooling
Compiler, Topdown and Rego
Performance
Docs, Website, Ecosystem
Miscellaneous
  • Decoupled the Rego job check from the Go job checks in the Github PR workflow (#​8203) authored by @​SeanLedford
  • build: Format pr_check.rego with opa fmt (#​8201) authored by @​thevilledev
  • build: Migrate PR check to OPA policy (#​8183) authored by @​SeanLedford
  • build: Run go get against main to spot redacted (#​8146) authored by @​charlieegan3
  • deps: Switch to maintained go.yaml.in/yaml/v3 yaml library (#​8182) authored by @​mrueg
  • test/cases: Increase yaml test coverage for some regex and string builtins (#​8152) authored by @​srenatus
  • Dependency updates; notably:
    • build: bump golang from 1.25.5 to 1.25.6 (#​8224) authored by @​srenatus
    • build(deps): bump go.opentelemetry.io deps from 1.38.0/0.63.0 to 1.39.0/0.64.0
    • build(deps): bump klauspost/compress from v1.18.1 to v1.18.2 (#​8184) authored by @​srenatus
      because of redaction warning
    • build(deps): bump github.com/go-ini/ini from v1.67.0 to gopkg.in/ini.v1 v1.67.1 (#​8208) authored by @​gabrpt

v1.12.3

Compare Source

v1.12.3

This is a bug fix release addressing two issues:

Bundle polling is being misconfigured when discovery bundle is updated (#​8215)

This is an issue where the polling interval for discovery (discovery.polling.min_delay_seconds and discovery.polling.max_delay_seconds) were misinterpreted on reconfiguration, causing extremely long update intervals.

Reported by @​loganmiller-chime, authored by @​sspaink

Decision log size buffer buffer_size_limit_bytes misconfigured during reconfiguration (#​8213)

This is a regression in the decision log, where the decision_logs.reporting.buffer_size_limit_bytes was mistakenly assigned the value of decision_logs.reporting.upload_size_limit_bytes during reconfiguration.
This issue is only present when decision_logs.reporting.buffer_type is set to size, which is the default value.

Authored by @​sspaink

v1.12.2

Compare Source

This bug fix release address issues found in the new string interpolation feature

v1.12.1

Compare Source

This bug fix release reverts a change to regex.replace that unintentionally changed its behaviour for anchored regular expressions.

  • Revert "topdown: make regex.replace respect cancellation" (authored by @​srenatus)

v1.12.0

Compare Source

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • Support for String Interpolation in the Rego language
  • Faster compilation and runtime
  • Fixes published in the v1.11.1 release
String Interpolation (#​4733)

The Rego language has been extended to support String Interpolation,
which provides a readable means to compose strings containing dynamic values determined at evaluation time.

An interpolated string is composed of a template-string containing zero or more template-expressions that evaluates to a value at evaluation time.
The $ character prefix identifies a template-string, and template-expressions are declared by being enclosed in curly-braces ({, }).

Additionally, undefined template-expression values don't halt evaluation; instead, <undefined> will be injected into the generated string.

package interpolation

allowed_roles := ["admin", "employee"]

default role := "guest"
role := input.role

deny contains $"User {input.username}'s role was '{role}', but must be one of {allowed_roles}" if {
  not role in allowed_roles
}
{
  "deny": [
    "User <undefined>'s role was 'guest', but must be one of [\"admin\", \"employee\"]"
  ],
}

String interpolation is a more readable and less error-prone substitute for the sprintf built-in function.

Authored by @​johanfylling reported by @​anderseknert

[!TIP]
Help us out!

New Rego language features are exciting, and we want to maximize their usefulness. If you come across tools and integrations in the community where string interpolation isn't properly handled, such as syntax highlighting, please reach out and let us know.

Runtime, SDK, Tooling
Compiler, Topdown and Rego
Docs, Website, Ecosystem
Miscellaneous

v1.11.1

Compare Source

This is a bugfix release:

Memory exhaustion via forged gzip header

A crafted HTTP request any of OPA's HTTP endpoints would lead OPA to use a large amount of memory, triggering
an out-of-memory process exit.

This weakness in OPA's HTTP API gzip handling is as old as the gzip handling itself. A configurable limit was introduced in v0.67.0, but it has been shown that this security measure wasn't sufficient to avoid running out of memory in memory-constrained setups.

Thanks to @​thevilledev for reporting and fixing this issue.

It only applies to OPA running as server (as a binary or in a container, as "sidecar"). To trigger an OOM process exit using this weakness, an adversary must be able to send an HTTP request directly to OPA. This would be the case if they are in the same network, there is no proxy in front of OPA, or if OPA was exposed to the internet, which is advised against.

By the nature of HTTP encodings, this would be effective before token-based authentication and authorization policies, so these measures do not protect against the attack vector.

If all OPA endpoints are using TLS-based authentication (mutual TLS, "mTLS"), then an adversary cannot do harm with this method.

Please note that while we're taking all of these issues seriously, OPA isn't designed for adversary environments. It's strongly advised not to expose any of its endpoints to the public internet. Furthermore, available security measures should be applied regardless, for a defense in depth approach. See the documentation for the available means of authentication and authorization in OPA.

Please also check out our Security Policy for reporting critical issues and bugs.

Decision Logs dropped (introduced in OPA v1.9.0)

When the decision logs buffer was uploaded, the buffer limit inadvertently got reset to the default upload limit (32kb).
This causes logs to be dropped that shouldn't have been dropped.

This default is overridden by the configuration value decision_logs.reporting.upload_size_limit_bytes, see the docs on decision logs.

There's a Prometheus metric for dropped events, counter_decision_logs_dropped_buffer_size_limit_bytes_exceeded,
and you can check that for unexpectedly high counts.

Reported by @​johanneslarsson #​8123, fixed by @​sspaink.

The release is otherwise identical to v1.11.0.

v1.11.0

Compare Source

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • More efficient connection management in the http.send built-in function
  • More performant loading of large bundles containing multiple Rego files
Immutable Releases

Starting with this release, OPA releases are immutable for increased security.

Runtime, SDK, Tooling
Compiler, Topdown and Rego
Docs, Website, Ecosystem

Configuration

📅 Schedule: Branch creation - "* 1 * * 1-5" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@elastic-renovate-prod elastic-renovate-prod Bot added backport-skip dependencies Pull requests that update a dependency file renovate renovate-auto-approve Team:Security-Cloud Services Security Data Experience - Cloud Services team. labels Apr 24, 2026
@elastic-renovate-prod elastic-renovate-prod Bot requested a review from a team as a code owner April 24, 2026 01:07
@elastic-renovate-prod elastic-renovate-prod Bot added the Team:Security-Cloud Services Security Data Experience - Cloud Services team. label Apr 24, 2026
@elastic-renovate-prod elastic-renovate-prod Bot added this pull request to the merge queue Apr 24, 2026
@mergify mergify Bot added the queued label Apr 24, 2026
@mergify
Copy link
Copy Markdown
Contributor

mergify Bot commented Apr 24, 2026 •
edited
Loading

Merge Queue Status

  • ✅ Entered queue — 2026-04-24 01:27 UTC · Rule: default
  • 🚫 Left the queue — 2026-04-24 04:02 UTC · at 6d5207986cd0c5ce3b091bdc788bc9c180c12f5d

This pull request spent 2 hours 35 minutes 12 seconds in the queue, with no time running CI.

Reason

The pull request conflicts with pull requests ahead in queue: #5327, #5330, #5331, #5334

Hint

There is nothing you can do for now. If the pull request ahead in the queue is merged, this pull request will become conflicting and you'll have to update it.
If the pull request ahead is not merged, you can requeue this pull request with a @mergifyio queue comment.

@mergify mergify Bot added dequeued and removed queued labels Apr 24, 2026
@github-merge-queue github-merge-queue Bot removed this pull request from the merge queue due to a conflict with the base branch Apr 24, 2026
@mergify
Copy link
Copy Markdown
Contributor

mergify Bot commented Apr 24, 2026

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/main-github.com-open-policy-agent-opa-1.x upstream/renovate/main-github.com-open-policy-agent-opa-1.x
git merge upstream/main
git push upstream renovate/main-github.com-open-policy-agent-opa-1.x

@elastic-renovate-prod elastic-renovate-prod Bot force-pushed the renovate/main-github.com-open-policy-agent-opa-1.x branch from 6d52079 to 8f7cf48 Compare April 24, 2026 04:24
@mergify mergify Bot removed the dequeued label Apr 24, 2026
@elastic-renovate-prod elastic-renovate-prod Bot force-pushed the renovate/main-github.com-open-policy-agent-opa-1.x branch from 8f7cf48 to c5e5029 Compare April 24, 2026 04:38
@elastic-renovate-prod elastic-renovate-prod Bot added this pull request to the merge queue Apr 24, 2026
@mergify mergify Bot added the queued label Apr 24, 2026
@mergify
Copy link
Copy Markdown
Contributor

mergify Bot commented Apr 24, 2026 •
edited
Loading

Merge Queue Status

This pull request spent 20 minutes 30 seconds in the queue, with no time running CI.

Waiting for:
  • check-success=Lint
  • check-success=Package Cloudbeat (docker)
  • check-success=Package Cloudbeat (tar.gz)
  • check-success=Test Rego Policies
  • check-success=Unit Test
  • any of:
    • check-neutral = Package Cloudbeat (docker)
    • check-skipped = Package Cloudbeat (docker)
    • check-success = Package Cloudbeat (docker)
  • any of:
    • check-neutral = Package Cloudbeat (tar.gz)
    • check-skipped = Package Cloudbeat (tar.gz)
    • check-success = Package Cloudbeat (tar.gz)
  • any of:
    • check-neutral = Test Rego Policies
    • check-skipped = Test Rego Policies
    • check-success = Test Rego Policies
  • any of:
    • check-neutral = Lint
    • check-skipped = Lint
    • check-success = Lint
  • any of:
    • check-neutral = Unit Test
    • check-skipped = Unit Test
    • check-success = Unit Test
All conditions

Reason

Pull request #5335 has been merged manually at 4deca0f

Hint

You were too fast!

mergify Bot added a commit that referenced this pull request Apr 24, 2026
@mergify
Merge of #5335
6b68b0c
@mergify mergify Bot mentioned this pull request Apr 24, 2026
Closed
74 tasks
mergify Bot added a commit that referenced this pull request Apr 24, 2026
@mergify
Merge of #5335
40d8498
mergify Bot added a commit that referenced this pull request Apr 24, 2026
@mergify
Merge of #5335
7f653eb
@mergify mergify Bot mentioned this pull request Apr 24, 2026
Closed
74 tasks
mergify Bot added a commit that referenced this pull request Apr 24, 2026
@mergify
Merge of #5335
573f983
Merged via the queue into main with commit 4deca0f Apr 24, 2026
14 of 16 checks passed
@elastic-renovate-prod elastic-renovate-prod Bot deleted the renovate/main-github.com-open-policy-agent-opa-1.x branch April 24, 2026 05:15
This was referenced Apr 24, 2026
Merged
Closed
@mergify mergify Bot added dequeued and removed queued labels Apr 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

No one assigned

Labels

backport-skip dependencies Pull requests that update a dependency file dequeued renovate renovate-auto-approve Team:Security-Cloud Services Security Data Experience - Cloud Services team.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants