v1.21.1

This release fixes a compiler regression introduced in OPA v1.21.0.

Fix some … in/every in comprehensions nested in object and set literals (#9280)

A comprehension using some … in or every in its body, nested inside an object or set literal, was wrongly treated as ground, so the compiler skipped rewriting it. some … in then failed with rego_unsafe_var_error; every caused a compiler panic:

package example

p := {"k": [r.a | some r in input.xs]}           # rego_unsafe_var_error: var r is unsafe

q := {[1 | every x in input.xs { x > 0 }]}       # panic

Array literals weren't affected, and neither were literals that contain some other non-ground term.

authored by @srenatus, reported by @tun0

v1.21.0

This release contains a mix of new features and bug fixes. Notably:

• Improved rule indexing
• Improved rule recursion check
• YAML is parsed against the 1.2 core schema (breaking change)

Rules with general refs no longer collide in the recursion check (#6813)

Before, this was a recursion error:

package play

p[x].foo.bar if {
	x := "a"
	not p[x].foo.baz
}

p[x].foo.baz if {
	x := "a"
	false
}

Rules with a variable in their head are all stored at the ground prefix of their ref, so
p[x].foo.bar and p[x].foo.baz looked like dependencies of each other. The compiler is
now less conservative and compares the ref parts past the prefix. Genuine cycles are still
reported.

The IR and Wasm targets however still return an error: they plan one function per ground
path prefix, and cannot evaluate part of a function that is still being planned.

Authored by @sspaink, reported by @tsandall

Data and Query APIs can return rule labels in the response (#9211)

# METADATA labels for evaluated rules were only available in decision log
events. The Data API (GET/POST /v1/data) and Query API (GET/POST /v1/query) now accept a rule_labels query parameter to include the same
merged labels in the response payload, under a rule_labels key.

Authored by @srenatus

Behavior change: response gzip compression now bounds its buffer to min_length (#9205)

The server's gzip response compression (server.encoding.gzip) buffered an entire
incoming Write call before deciding whether to compress, so a single large write could
grow the buffer well past min_length before that decision was made. The handler is now
built on klauspost/compress/gzhttp
instead of a hand-rolled buffer and gzip.Writer pool, which caps what it buffers to
min_length (floored at 512 bytes) before streaming the remainder through the chosen
path. min_length and compression_level behave the same as before; only gzip is
negotiated, not zstd.

Authored by @srenatus

YAML is now parsed against the 1.2 core schema (#5754, #6598)

OPA parsed YAML with a library pinned to go-yaml v2, which implements YAML 1.1. Under
1.1, the bare words y, n, yes, no, on and off resolve to booleans, so a
GitHub Actions workflow loaded with --data came back with true where it should have
had on:

on: push

{ "true": "push" }

These words are now plain strings, as the YAML 1.2 core schema specifies. true and
false are unaffected. This applies everywhere OPA reads YAML: --data, bundles,
config files, and the yaml.unmarshal builtin.

If you were relying on yes/no/on/off being read as booleans, quote the value and
use true/false instead.

Authored by @sspaink, reported by @scnewma and @johnc-c

Empty composite literals are now typed as empty (#7275)

The type checker used to give the empty object literal {} the type
object[any: any], the empty array literal [] the type array[any], and the
empty set literal set() the type set[any], i.e. the types of a collection
that may hold anything. Every other literal is typed by its contents, so
referencing a key that isn't there is caught at compile time — but only for
non-empty literals:

obj := {"foo": "bar"}
obj.bar # rego_type_error: undefined ref: obj.bar

obj := {}
obj.bar # compiles

Empty literals are now typed as what they are: an object with no properties, an
array with no items, and a set with no members. Both examples above now fail to
compile, and so does every other way of selecting from an empty literal,
including iterating one (some x in []).

Comparing an empty object or array literal against a value whose type says it
can't be empty ({"foo": "bar"} == {}) is now a match error too, the same way
{"foo": "bar"} == {"bar": "foo"} already was. Use count(x) == 0 to test a
collection for emptiness without asserting its type. Sets are unaffected here:
set[string] describes any set of strings, the empty one included, so
{"foo"} == set() still compiles.

Authored by @sspaink, reported by @disaverio

Rule indexing improvements

The rule indexer now excludes rules from more kinds of expression, and builds a smaller
trie to do it with. See Use indexed statements
for what is indexed.

• startswith, endswith, strings.any_prefix_match and strings.any_suffix_match
  are indexed when the base strings are known at compile time.
• A reference that reads a key out of the object at its ground prefix in base data
  (data.groups.admins.members[input.subject]) is indexed by asking that object for the
  key, where such a ruleset used to leave every rule a candidate.
• References rooted at a local variable (x := input; x.foo == "a") are indexed the
  same as input.foo == "a", and a chain of assignments no longer drops the constraint
  at the end of it.
• A rule's path through the trie stops at the last level it constrains, and a reference
  reached by several values no longer leaves the rest of the rule unindexed.
• Candidates come back in declaration order, which the indexer documented but did not
  do. A complete rules must not produce multiple outputs error now points at the first
  of the conflicting definitions rather than the second, and partial evaluation names
  and orders the generated locals of its support rules differently. What a policy
  evaluates to is unaffected.

Changes

• ast: Count a ref once when an index entry replaces its var entry (#9257) authored by @srenatus, reported by @vlsi
• ast: Index a lookup into a collection in base data (#9235) authored by @srenatus
• ast: Index refs rooted at a local variable (#9081) authored by @srenatus
• ast: Let concrete index values supersede leftover "any" entries (#9081) authored by @srenatus
• ast: Number the references an index is built on (#9190) authored by @srenatus
• ast: Number the refs a rule requires (#9244) authored by @srenatus
• ast: Number the rules an index holds (#9190) authored by @srenatus
• ast: Keep refs no rule constrains to a value out of the trie (#9190) authored by @srenatus
• ast: Stop a rule index path at its last constrained level (#9108) authored by @srenatus
• ast: Walk a rule tree's children in a stable order (#9190) authored by @srenatus
• docs: Document indexing of refs rooted at a local variable (#9081) authored by @srenatus
• index: Also index suffix matching (endswith, strings.any_suffix_match) + some tweaks (#9164) authored by @srenatus
• perf: Add startswith and strings.any_prefix_match indexing (#9161) authored by @tsandall
• rego: Benchmark index lookups at every match position (#9190) authored by @srenatus

Runtime, SDK, Tooling

• compile: don't panic on non-string table/column mappings (#9241) authored by @sspaink
• debug: Adding query stack-trace framing mode (#9128) authored by @johanfylling
• dependencies: Include else bodies and unused ref bindings (#4814) authored by @sspaink, reported by @anderseknert
• download: Fix Trigger() racing a cancelled context into a false success (#9233) authored by @srenatus
• download: Fix ignored OCI downloader settings (#9113) authored by @sspaink
• download: Note that ociTarget.Exists is dead code (#9233) authored by @srenatus
• download: Resolve OCI bundles behind an image index (#7461) authored by @sspaink, reported by @zscott
• download: Stop BundleRequest timer on OCI early returns (#9233) authored by @srenatus
• fix: runner.CapturePrintOutput setting never read (#9104) authored by @anderseknert
• format: don't drop comments after an inline if body (#9109) authored by @sspaink, reported by @anderseknert
• metricsexport: Support custom headers on the OTLP exporter (#9234) authored by @srenatus
• plugins/logs: Add trace_id, span_id and request_context to the event AST (#9193) authored by @sspaink
• plugins/logs: Fix data race on the cached mask and drop queries (#9189) ...

v1.20.2

This release includes a bug fix for a parser regression introduced in v1.20.0, and dependency updates.

Fix stale parse errors on statements starting with { (#9140)

When the and/or keywords added in v1.20.0 are imported, a statement that starts with { is
first read as an explicit operand body, and re-read as a term (a comprehension, for example) if no
and or or follows. Errors recorded during the abandoned first attempt stayed in the parser's
term cache and were reported against the successful re-read, rejecting policies that parse fine:

package example

import future.keywords

xs := [1, 2, 3]

allow if {
	{
	y |
		some y in xs # rego_parse_error: unexpected some keyword
	} == {1, 2, 3}
}

The term cache is now restored along with the rest of the parser state when the operand-body guess
is abandoned. Only policies importing and or or — directly or via import future.keywords —
were affected; policies that don't import them parse unchanged.

Authored by @sspaink

Miscellaneous

• build(go): Bump to 1.27.1 (3652eeb) authored by @srenatus
• Dependency updates; notably:
  • build(deps): Bump github.com/dgraph-io/badger/v4 from 4.9.5 to 4.9.6
  • build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.1 to 3.2.0
  • build(deps): Bump github.com/santhosh-tekuri/jsonschema/v6 from 6.0.2 to 6.0.3
  • build(deps): Bump github.com/sirupsen/logrus from 1.9.4 to 1.10.2
  • build(deps): Bump go.opentelemetry.io/contrib/bridges/prometheus from 0.69.0 to 0.71.0
  • build(deps): Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.71.0
  • build(deps): Bump go.opentelemetry.io/otel from 1.44.0 to 1.46.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.44.0 to 1.46.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.44.0 to 1.46.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.44.0 to 1.46.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.46.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.46.0
  • build(deps): Bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.46.0
  • build(deps): Bump go.opentelemetry.io/otel/sdk/metric from 1.44.0 to 1.46.0
  • build(deps): Bump go.opentelemetry.io/otel/trace from 1.44.0 to 1.46.0
  • build(deps): Bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5
  • build(deps): Bump golang.org/x/text from 0.40.0 to 0.41.0
  • build(deps): Bump google.golang.org/grpc from 1.82.1 to 1.83.2
  • build(deps): Bump google.golang.org/protobuf from 1.36.11 to 1.36.12

v1.20.1

This release includes a bug fix for a regression introduced in v1.20.0 in
comparing a number to some float values.
Thanks @kmadan for reporting the issue and submitting a fix!

v1.20.0

This release contains a mix of new features and bug fixes. Notably:

• New Rego keywords: and and or, for combining conditions inside a single rule body
• allow_net now restricts remote JSON Schema $ref fetching from json.match_schema and json.verify_schema
• Coverage reports can now explain why a range is not covered
• Much faster partial evaluation for dynamically composed policies

New Rego keywords: and and or (#7602)

Rego gains two keywords for combining conditions inside a single rule body — a long-standing
request, and one of the larger additions to the language in some time. and and or let control
flow that previously had to be split across helper rules stay where it is read.

Before, a rule body that needed to succeed on one of several conditions meant extracting a rule:

package example

allow if {
	input.method == "GET"
	admin_or_public_owner
}

admin_or_public_owner if input.user.admin

admin_or_public_owner if {
	input.user.owner
	input.resource.public
}

Now:

package example

import future.keywords.and
import future.keywords.or

# the and groups first, so this reads as:
# an admin, or an owner of a public resource
allow if {
	input.method == "GET"
	input.user.admin or input.user.owner and input.resource.public
}

Both keywords are opt-in future keywords:
import future.keywords.and, import future.keywords.or, or import future.keywords for both.

An and/or expression either succeeds or fails; it never produces a value. So you can't assign
one to a variable, pass one to a function, or use one as the head of a comprehension.

Operands can read variables from the rule body around them, but can't create new ones for the rest
of the rule to use — wrap an operand in braces to give it a body of its own, and any variables it
creates stay inside those braces. Only as much is evaluated as needed: if the left side settles the
outcome, the right side is skipped. And when both sides of an or succeed, you still get a single
result; evaluation doesn't split in two.

Further reading:

• Rego Keywords: and, or — the full reference
• Precedence and grouping — how the operators group, and where parentheses are needed
• Combining with not
• Incremental rules — the idiom when the alternatives must produce a value

Try the new keywords in the Rego Playground, or in your
editor with the VS Code extension
or the IntelliJ IDEA plugin — see
Editor and IDE Support for others.

Authored by @johanfylling

Behavior change: allow_net applies to remote JSON Schema $refs (#8979)

The allow_net
capability restricts which hosts remote JSON Schema $refs may be fetched from, but it was only
wired up on the compile-time type-checking path. Policies using neither -s schemas nor
# METADATA schemas:
annotations never reached it, and an unset allowlist permitted every host — so
json.match_schema
and json.verify_schema,
which compile schemas at evaluation time, fetched $refs from anywhere. Their schema argument can
come from input, so the host was not necessarily under the policy author's control.

The allowlist now travels with the schema loader and is checked per caller at any nesting depth.
Every redirect hop is checked too, matching http.send, and the inter-query cache key includes the
allowlist so a permissive caller cannot populate the cache for a restrictive one.

Authored by @sspaink, reported by @charlesdaniels

Coverage reports explain why a range is not covered (#8937)

Coverage reports showed that a
range was uncovered, but not why: ranges skipped by rule indexing
or early exit looked identical to dead code.

Not-covered ranges are now tagged with a Kind — index_excluded or early_exit — determined
by re-evaluating with each optimization disabled and diffing the extra coverage data. Both
supplementary passes run by default when --coverage is set; the new --coverage-runs flag on
opa eval and opa test selects which of them to run, and an empty list disables them.

Authored by @charlieegan3

Runtime, SDK, Tooling

• bundle: Fix roots containing percent-encoded characters (#6704) authored by @sspaink, reported by @sirpi
• compile: Validate plan-addons exist (#9092) authored by @charlieegan3
• config: Migrate server.encoding and server.decoding validation to Rego (#8903) authored by @sspaink
• debug: Allow configuring variable value length limit (#8907) authored by @oh-summy
• format: Add support for formatting and/or logical expressions (#8683) reported and authored by @johanfylling
• format: Converge object comprehension layout (#9075) reported and authored by @hamodywe
• format: Don't group rules that aren't written on one line (#8981) authored by @sspaink
• format: Don't unwrap one-line rule body braces from a single set term (#8972) authored by @johanfylling
• format: Honor line breaks before explicit and/or operand bodies (#9053) authored by @sspaink, reported by @anderseknert
• format: Keep parens around a nested not operand (#9079) authored by @sspaink
• format: Wrap set union | infix in parens when output would be re-interpreted as comprehension (#8977) authored by @johanfylling
• format: Write added imports before rules (#9083) authored by @sspaink
• loader: Fix loading absolute paths on Windows (#4521) authored by @sspaink, reported by @lcarva
• oracle: Support and/or logical keywords (#8819) reported and authored by @johanfylling
• plugins: Avoid predictable OCI temp store (#8853) authored by @br0x2
• plugins: Fix overly verbose return of errors (#9090) authored by @anderseknert
• rego: Pass capabilities to the parser in (*Rego).compileModules (#9059) authored by @anderseknert
• repl: Add support for and/or imports (#9066) reported and authored by @johanfylling
• repl: Allow interactive ref head rule definitions (#5498) authored by @sspaink, reported by @philipaconrad
• runtime: Allow registering hooks, and pass them to discovery (#9064) authored by @srenatus
• server: Decouple decision logging from request context cancellation (#9023) authored by @srenatus
• wasm: Address regression causing memory corruption (#8995) authored by @charlieegan3

Compiler, Topdown and Rego

• ast: Allow non-infix and()/or() set built-in calls (#9012) authored by @johanfylling
• ast: Correct regression in Ruleset Add (#9027) authored by @charlieegan3
• ast: Don't index away rules with a nested print call (#9038) authored by @sspaink
• ast: Don't leak generated locals for calls in ref type errors (#4577) authored by @sspaink, reported by @johanfylling
• ast: Don't leak generated locals in ref type errors (#8897) authored by @sspaink, reported by @anderseknert
• ast: Don't report type errors for documents replaced by with (#2903) authored by @sspaink, reported by @gshively11
• ast: Fix future.keywords wildcard import not including the not keyword (#9093) authored by @johanfylling
• ast: Fix panic for shadowed root document calls in Rego v0 ([#9...

v1.19.1

This release uses the latest version of Go (1.26.6) to build OPA, fixing stdlib vulnerabilities in code that OPA's HTTP handler and crypto builtins use:

• https://pkg.go.dev/vuln/GO-2026-6218
• https://pkg.go.dev/vuln/GO-2026-6091
• https://pkg.go.dev/vuln/GO-2026-6090
• https://pkg.go.dev/vuln/GO-2026-6089
• https://pkg.go.dev/vuln/GO-2026-6088
• https://pkg.go.dev/vuln/GO-2026-5972
• https://pkg.go.dev/vuln/GO-2026-5026

It is otherwise the same code as v1.19.0.

Note that users building their own OPA binaries and images already control the Golang version, so this is not relevant for them.

Miscellaneous

• build(go): bump to 1.26.6 (authored by @srenatus)

v1.19.0

This release contains a mix of new features and bug fixes. Notably:

• A fixed SQL injection vector in the Compile API
• Stricter safety checking for Rego assignments (:=)
• A cgo-free, faster WebAssembly runtime (wazero replaces wasmtime-go)
• Startup warnings for unknown configuration options
• A new strings.split_n built-in function
• A REPL line reader that handles pasted input correctly, migrating existing history files

Fix SQL injection vector in Compile API: Quote SQL filter field identifiers (#8945)

The field names in the SQL emitted by the Compile API come from partially evaluated refs, so a
policy that selects a dynamic key — such as input.fruits[input.column] — puts caller-controlled
text in an identifier position. That text was emitted verbatim, which turns

WHERE fruit.name = 'allowed'

into

WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed'

and an application appending the filter to its query returns rows the policy denies.

Field segments that are not bare identifiers are now quoted at the UCAST-to-SQL boundary, with any
embedded quote character escaped. Ordinary column names stay unquoted, so existing filters keep
their current shape and remain case-insensitive on Postgres.

Authored by @thevilledev

Behavior change: stricter safety for assignment (:=) (#3546)

The assignment operator (:=) is documented as "syntactic sugar for =, local variable creation,
and additional compiler checks," and the safety checker reflects that: after
rewriting, := is treated identically to = (unification), so an assignment's
right-hand side can be made safe by unifying "backwards" through the left-hand
side. This means policies like x := y; x = 7 compile (binding y to 7)
even though y is never assigned, and x := y; obj[x] can silently degrade an
expected constant-time lookup into full iteration.

This change makes the right-hand-side of := be treated as a read that
must be made safe by other expressions, and can no longer be satisfied through
the left-hand-side. Affected policies that previously compiled now fail with a
rego_unsafe_var_error. Reference iteration on the right-hand-side (e.g.
some k; v := obj[k]) is unaffected.

Note: this is a deliberate semantic change, not a fix to match documented
behavior — the intended semantics of := in this case were never specified.

Authored by @sspaink, reported by @tsandall

WebAssembly runtime: wasmtime-go replaced with wazero (#7557)

OPA's WebAssembly runtime — used by the wasm evaluation target and the WASM SDK — now runs on
the pure-Go wazero runtime instead of bytecodealliance/wasmtime-go. This
removes the cgo dependency from this path, so wasm-enabled builds no longer need a C toolchain.

Compiled policy modules are now cached process-wide, so repeated VM creation for the same policy
skips recompilation. On an Apple M4 Max this makes wasm cold start (compile + instantiate + first
eval) about 73% faster, and warm evaluation about 29% faster with ~28% fewer allocations.

Authored by @srenatus, reported by @sspaink

Configuration validation moved to Rego, with warnings on unknown options (#8891)

Top-level configuration validation and default injection (default_decision,
default_authorization_decision, labels) is now expressed as an embedded Rego policy rather than
hand-written Go, as is the validation of server.metrics and metrics_export.

The user-visible effect is that unrecognized configuration options are reported instead of being
silently ignored. A typo such as decision_log instead of decision_logs now logs a warning at
startup:

{"level":"warning","msg":"unknown configuration option \"decision_log\" encountered"}

These are warnings, not errors: OPA starts as before, and sections that are intentionally
user-extensible are left alone, so extra keys there do not warn. Embedders reading configuration
through config.ParseConfig can find the same messages on Config.Warnings.

Authored by @sspaink

Add strings.split_n built-in function (#8344)

Policies often need only the first or last few parts of a split string, but the existing split
built-in always returns every part, so the count has to be worked around with wildcards or a slice.

strings.split_n takes the first n split parts from the front or the back of the string,
depending on whether n is positive or negative:

result := strings.split_n("a.b.c.d", ".", 2)
# result == ["a", "b"]

result := strings.split_n("a.b.c.d", ".", -2)
# result == ["c", "d"]

If abs(n) is larger than the number of parts, all parts are returned. An n of 0 returns an
empty array.

Authored by @wonju-dev, reported by @anderseknert

Improved REPL line editing, with history file migration (#962)

Pasting a tab-indented snippet into the REPL triggered tab-completion on the pasted tab, corrupting
the input (e.g. injecting a completion candidate mid-line and producing a spurious parse error).
Fixing that requires bracketed paste, where the terminal wraps pasted text in markers so the line
reader inserts it literally instead of treating an embedded tab as a completion request. The
previous reader, peterh/liner, has no bracketed-paste support and is unmaintained (last release
2021), so it has been replaced with reeflective/readline.

The new reader persists history as JSON lines instead of one command per line. Existing history
files (~/.opa_history by default, or the path given to --history) are detected and migrated in
place the first time the REPL loads them, so history written by earlier versions of OPA is kept.
OPA's own multi-line buffering is unchanged, and readline's native multi-line editing is left
disabled to avoid changing REPL behavior.

Authored by @sspaink, reported by @aeneasr

Runtime, SDK, Tooling

• cmd: Avoid intermediate buffer when writing bundle (#8909) authored by @anderseknert
• cmd/build: Add --format flag for proto/JSON plan bundles to opa build (#8825) authored by @sspaink
• cmd/check: Report wrapped structured errors individually (#3663) authored by @sspaink, reported by @oren-zohar
• compile: Preserve package annotations in wasm bundle builds (#8854) authored by @srenatus, reported by @me-viper
• format: Keep rule body inline when the head spans multiple lines (#8894) authored by @Kunalbehbud, reported by @charlieegan3
• repl: Use a plain line reader for non-terminal input (#8941) authored by @sspaink
• server: Set ReadHeaderTimeout to 32s on all HTTP servers (#8877) authored by @RinZ27
• server/failtracer: Skip self-referential undefined-ref hints (#8916) authored by @srenatus
• sdk: Allow customizing HTTP RoundTripper per Decision (#8884) authored by @paulo-raca
• sdk: Fix deadlock between OPA.Plugin and manager onCommit (#8873) reported and authored by @sspaink
• tester: Make Result JSON round-trippable (#8014) authored by @vsolano9, reported by @anderseknert
• topdown: Resolve ground refs in --var-values cmd output (#7830) authored by @sspaink, reported by @charlieegan3

Compiler, Topdown and Rego

• ast: Add support for Go 1.27 & jsonv2 (#8947) authored by @anderseknert and @charlieegan3
• ast: Fix aliased comment buffer in annotation parser (#8757) authored by @sspaink, reported by @0hardik1
• ast: Fix non-deterministic type errors when shadowing a built-in (#3729) authored by @sspaink, reported by @srenatus
• ast: Fix leaky future.keywords.not import in Rego v0 (#8953) authored by @johanfylling
• ast: Fix panic when indexing composite literal values in x in [...] (#8918) reported and authored by @srenatus
• ast: Fix TermValueEqual performance regression (#8863) authored by @mchitten
• ast: Improve rule conflict error (#6391) authored by @unichronic, reported by @johanfylling
• ast: Make CogeneratedExprs return deterministic order (#8895) authored by @sspaink
• ast: Reject partial set and -object rules sharing a name (#8860) authored by @sspaink, reported by @shomron
• ast: Restore location on unsafe var errors for rewritten head vars (#8719) authored by @Atishyy27, reported by @anderseknert
• ast: Use more precise return types for object.* builtins (#8692) reported a...

v1.18.2

This release includes a bug fix for a opa fmt regression introduced in v1.18.0.

The original fix for #8557 had the formatter enforce newlines in single-item collections (arrays, objects, sets) rather than merely honoring existing ones. As a result, running opa fmt on already-formatted policies could introduce a large number of unwanted changes. This patch release restores the intended behavior: only newlines already present in the source determine whether a single-item collection is formatted on one line or across multiple lines.

Fixes

• Fix regression in fix of #8557 (#8845) (authored by @anderseknert)

v1.18.1

This release fixes a memory leak introduced in OPA v1.17.0. It is advised to update if you notice excess memory usage when running OPA server.

Fixes

• ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle (#8817) authored by @srenatus reported by @keydon and @gorsr01

v1.18.0

This release contains a mix of bugfixes and small features. Notably:

• A breaking fix to the outbound User-Agent header so it conforms to RFC 9110 (see below)
• Container-aware resource limits: automatic GOMAXPROCS is restored and automatic GOMEMLIMIT is now supported
• Several opa fmt correctness fixes
• Improvements to opa test --coverage (ranges in report, inline rule head tracking, conjunction-expression coverage)

Breaking: Fix User-Agent according to RFC9110 (#8792)

OPA's outbound HTTP requests (bundle, discovery, decision log, status, http.send, AWS KMS/ECR)
previously sent User-Agent: Open Policy Agent/<version> (<os>, <arch>), which is not a valid
RFC 9110 User-Agent value because the product token cannot contain spaces. The header is now
Open-Policy-Agent/<version> (<os>, <arch>). Server-side log filters or WAF rules that
exact-match the old string will need to be updated.

Authored by @sspaink, reported by @SpecLad

Runtime, SDK, Tooling

• bundle: fix per-module rego version lookup (#8797) authored by @sspaink, reported by @xubinzheng
• bundle: improve determinism of file_rego_versions patterns with overlap (#8733) authored by @philipaconrad
• cover: Track inline rule head in post trace walk (#6531) authored by @charlieegan3, reported by @anderseknert
• cover: Update report to include ranges (#8748) reported and authored by @charlieegan3
• cover: Add support for coverage of conjunction exprs (#8809) authored by @charlieegan3
• download/oci: Set Accept headers (#8720) authored by @charlieegan3
• fmt: preserve the multiline but single entry iterables (#8557) authored by @unichronic, reported by @anderseknert
• format: Fix dropped with-clause after comment in object value (#8765) authored by @sspaink, reported by @srabraham
• format: keep lone with on the closing-bracket line of multi-line expressions (#8804) authored by @anneheartrecord, reported by @burnster
• oracle: Fix find-definition on expressions inside ast.Not nodes (#8731) authored by @johanfylling
• runtime: Restore goautomaxprocs, add automemlimit (#8784) authored by @charlieegan3

Compiler, Topdown and Rego

• ast: Apply location to inner ast.Not expressions (#8717) authored by @johanfylling, reported by @anderseknert
• ast: Clean up code for value comparisons (#8737) authored by @anderseknert
• ast: Fix PE regression for future.keywords.not negation inside every (#8781) authored by @johanfylling
• internal/edittree: Add recursive tree node recycling (#8693) authored by @philipaconrad
• internal: compile,planner: improve determinism of plan/wasm bundle builds (#8732) authored by @philipaconrad
• perf: avoid allocations in object.get (#8729) authored by @anderseknert
• topdown: Fix PE not namespacing vars in comprehensions nested inside every (#8816) authored by @johanfylling
• topdown: remove dst.Compare(src) shortcut (#8739) authored by @srenatus
• topdown: skip strconv.ParseInt in format_int base-10 fast path (#8801) authored by @srenatus

Docs, Website, Ecosystem

• docs/chore: Remove broken links (#8714) authored by @charlieegan3, reported by @github-actions
• docs: PoC for kapa.ai (#8125) reported and authored by @charlieegan3
• docs(ecosystem): update OPA MCP entry with video, blog, and distribution links (#8712) authored by @OrygnsCode
• docs/contributing: add formatting (#8740) authored by @mmzzuu
• docs: Add SDK references for evaluating IR plans (#8783) authored by @charlieegan3
• docs: Add depkeep to enterprise support (#8685) authored by @pkuzco
• docs: Add notes about use of GOMEMLIMIT (#8771) authored by @charlieegan3
• docs: Add we/our/us check to spell check (#8787) authored by @charlieegan3
• docs: Update built-in index page titles (#8728) authored by @charlieegan3
• docs: Update documentation to be more consistent and sound more like reference docs (#8786) authored by @charlieegan3
• docs: Update regal docs for 0.41.1 release (#8730) authored by @charlieegan3
• docs: Update to agents.md regarding security dependences 'fixes' (#8754) authored by @charlieegan3
• docs: clarify environment variable substitution behaviour (#8713) authored by @taurelius
• docs: remove duplicated word in Rego style guide (#8800) authored by @s3onghyun
• website: Add .md alternate content types for llms (#8725) authored by @charlieegan3
• website: Add support page disclaimer and sort by date added (#8736) authored by @charlieegan3
• website: Fix build from missing dateAdded (#8764) authored by @charlieegan3
• website: Update docusaurus (#8756) authored by @charlieegan3
• website: Update homepage AI example to tool calls (#8755) authored by @charlieegan3
• website: Various updates to node and website deps (#8768) authored by @charlieegan3
• website: add ossrisk to ecosystem (#8780) authored by @pkuzco

Miscellaneous

• benchmarks: smaller tweaks (#8759) authored by @srenatus
• benchmarks: split off script, emit markdown table (#8812) authored by @srenatus
• benchmarks: use details+summary comments for benchlab results (#8811) authored by @srenatus
• capabilities: Integrate 1.17.1 patch release (#8798) authored by @sspaink
• chore: tidy go.mod to remove untagged versions (#8791) authored by @thaJeztah
• e2e: Add proto schemas for the IR plan and bundle manifest (#8766) reported and authored by @sspaink
• gha: deduplicate change-detection output in pr CI checks (#8808) authored by @sspaink
• nightly: use regal@main (#8735) authored by @srenatus
• workflow: remove tests from docker (edge) image build (#8721) authored by @srenatus
• workflows: bring back docker edge tags for post-merge (#8718) authored by @srenatus
• workflows: use go-version-file with actions/setup-go (#8751) authored by @srenatus
• Dependency updates; notably:
  • build(deps): Add github.com/KimMachineGun/automemlimit v0.7.5
  • build(deps): Add go.uber.org/automaxprocs v1.6.0
  • build(deps): Bump github.com/dgraph-io/badger/v4 from v4.9.1 to v4.9.2
  • build(deps): Bump github.com/vektah/gqlparser/v2 from v2.5.33 to v2.5.34
  • build(deps): Bump go.opentelemetry.io/contrib/bridges/prometheus from v0.68.0 to v0.69.0
  • build(deps): Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from v0.68.0 to v0.69.0
  • build(deps): Bump go.opentelemetry.io/otel from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/sdk from v1.43.0 to v1.44.0
  • build(deps): Bump go.opentelemetry.io/otel/sdk/metric from v1.43....