Sourced from github.com/open-policy-agent/opa's releases.

v1.18.2

This release includes a bug fix for a opa fmt regression introduced in v1.18.0.

The original fix for #8557 had the formatter enforce newlines in single-item collections (arrays, objects, sets) rather than merely honoring existing ones. As a result, running opa fmt on already-formatted policies could introduce a large number of unwanted changes. This patch release restores the intended behavior: only newlines already present in the source determine whether a single-item collection is formatted on one line or across multiple lines.

Fixes

• Fix regression in fix of #8557 (#8845) (authored by @​anderseknert)

v1.18.1

This release fixes a memory leak introduced in OPA v1.17.0. It is advised to update if you notice excess memory usage when running OPA server.

Fixes

• ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle (#8817) authored by @​srenatus reported by @​keydon and @​gorsr01

v1.18.0

This release contains a mix of bugfixes and small features. Notably:

• A breaking fix to the outbound User-Agent header so it conforms to RFC 9110 (see below)
• Container-aware resource limits: automatic GOMAXPROCS is restored and automatic GOMEMLIMIT is now supported
• Several opa fmt correctness fixes
• Improvements to opa test --coverage (ranges in report, inline rule head tracking, conjunction-expression coverage)

Breaking: Fix User-Agent according to RFC9110 (#8792)

OPA's outbound HTTP requests (bundle, discovery, decision log, status, http.send, AWS KMS/ECR) previously sent User-Agent: Open Policy Agent/<version> (<os>, <arch>), which is not a valid RFC 9110 User-Agent value because the product token cannot contain spaces. The header is now Open-Policy-Agent/<version> (<os>, <arch>). Server-side log filters or WAF rules that exact-match the old string will need to be updated.

Authored by @​sspaink, reported by @​SpecLad

Runtime, SDK, Tooling

• bundle: fix per-module rego version lookup (#8797) authored by @​sspaink, reported by @​xubinzheng
• bundle: improve determinism of file_rego_versions patterns with overlap (#8733) authored by @​philipaconrad
• cover: Track inline rule head in post trace walk (#6531) authored by @​charlieegan3, reported by @​anderseknert
• cover: Update report to include ranges (#8748) reported and authored by @​charlieegan3
• cover: Add support for coverage of conjunction exprs (#8809) authored by @​charlieegan3
• download/oci: Set Accept headers (#8720) authored by @​charlieegan3
• fmt: preserve the multiline but single entry iterables (#8557) authored by @​unichronic, reported by @​anderseknert
• format: Fix dropped with-clause after comment in object value (#8765) authored by @​sspaink, reported by @​srabraham
• format: keep lone with on the closing-bracket line of multi-line expressions (#8804) authored by @​anneheartrecord, reported by @​burnster
• oracle: Fix find-definition on expressions inside ast.Not nodes (#8731) authored by @​johanfylling
• runtime: Restore goautomaxprocs, add automemlimit (#8784) authored by @​charlieegan3

... (truncated)

Sourced from github.com/open-policy-agent/opa's changelog.

1.18.2

This release includes a bug fix for a opa fmt regression introduced in v1.18.0.

The original fix for #8557 had the formatter enforce newlines in single-item collections (arrays, objects, sets) rather than merely honoring existing ones. As a result, running opa fmt on already-formatted policies could introduce a large number of unwanted changes. This patch release restores the intended behavior: only newlines already present in the source determine whether a single-item collection is formatted on one line or across multiple lines.

Fixes

• Fix regression in fix of #8557 (#8845) (authored by @​anderseknert)

1.18.1

This release fixes a memory leak introduced in OPA v1.17.0. It is advised to update if you notice excess memory usage when running OPA server.

Fixes

• ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle (#8817) authored by @​srenatus reported by @​keydon and @​gorsr01

1.18.0

This release contains a mix of bugfixes and small features. Notably:

• A breaking fix to the outbound User-Agent header so it conforms to RFC 9110 (see below)
• Container-aware resource limits: automatic GOMAXPROCS is restored and automatic GOMEMLIMIT is now supported
• Several opa fmt correctness fixes
• Improvements to opa test --coverage (ranges in report, inline rule head tracking, conjunction-expression coverage)

Breaking: Fix User-Agent according to RFC9110 (#8792)

OPA's outbound HTTP requests (bundle, discovery, decision log, status, http.send, AWS KMS/ECR) previously sent User-Agent: Open Policy Agent/<version> (<os>, <arch>), which is not a valid RFC 9110 User-Agent value because the product token cannot contain spaces. The header is now Open-Policy-Agent/<version> (<os>, <arch>). Server-side log filters or WAF rules that exact-match the old string will need to be updated.

Authored by @​sspaink, reported by @​SpecLad

Runtime, SDK, Tooling

• bundle: fix per-module rego version lookup (#8797) authored by @​sspaink, reported by @​xubinzheng
• bundle: improve determinism of file_rego_versions patterns with overlap (#8733) authored by @​philipaconrad
• cover: Track inline rule head in post trace walk (#6531) authored by @​charlieegan3, reported by @​anderseknert
• cover: Update report to include ranges (#8748) reported and authored by @​charlieegan3
• cover: Add support for coverage of conjunction exprs (#8809) authored by @​charlieegan3

... (truncated)

• e695c9e Patch release v1.18.2
• d473969 Fix regression in fix of #8557 (#8845)
• acc8bf9 Release v1.18.1
• 713dc6a ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle
• cc2c5c6 Prepare v1.18 release (#8820)
• e72a98f format: keep lone with on the closing-bracket line of multi-line expression...
• 03646dd topdown: Fix PE not namespacing vars in comprehensions nested inside every ...
• bf2bb52 benchmarks: split off script, emit markdown table
• 02ce276 version: fix ill-formed User-Agent header (#8796)
• 1fdbb77 build(deps): bump the dependencies group across 2 directories with 6 updates
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)