v0.63.0

Compare Source

v0.63.0

This release contains a mix of features, performance improvements, and bugfixes.

Runtime, Tooling, SDK

• cmd/exec: Add --timeout flag to opa exec to prevent infinite hangs. (#​6613) authored by @​philipaconrad
• download: Surface bundle download errors via debug logging (#​6609) authored by @​ashutosh-narkar reported by @​nevumx
• topdown: Fixing overactive Early Exit suppression (#​6566) authored by @​johanfylling reported by @​ashwinhb
• plugins/rest: Add support to get temp creds via AssumeRole (#​6634) authored by @​ashutosh-narkar

Topdown and Rego

• topdown: Adding a new crypto.x509.parse_and_verify_certificates_with_options built-in function. (#​5882) authored by @​yogisinha reported by @​IxDay
• format: Preserve brackets around set union operation (#​6588) authored by @​ashutosh-narkar reported by @​HarshPathakhp
• aws: Support for Unsigned Payload or provided content sha256 in AWS signing (#​6581) authored by @​prasanthj

Docs + Website + Ecosystem

• ADOPTERS.md: Add Facets.cloud to the list (#​6640) authored by @​ashutosh-narkar reported by @​samarthya-gupta1
• docs: Mention homebrew install option (#​6622) authored by @​anderseknert
• docs: Add Rego v1 keywords to list of reserved names (#​6649) authored by @​anderseknert
• docs: Add Tunnelmole as an open source tunneling option in the Cloudformation hooks documentation (#​6626) authored by @​robbie-cahill
• docs: Add docs on using env vars in place of CLI flags (#​6631) authored by @​anderseknert
• docs: Adding integration for Backstage (#​6629) authored by @​Parsifal-M
• docs: Clear up some uses of future keywords (#​6653) authored by @​charlieegan3
• docs: Update delta bundle patch doc for remove op (#​6645) authored by @​0marq
• docs: Fix typo in Debugging OPA (#​6637) authored by @​setchy

Miscellaneous

• chore: Remove repetitive words (#​6644) authored by @​occupyhabit
• Dependency updates; notably:
  • build(deps): bump github.com/containerd/containerd from 1.7.13 to 1.7.14
  • build(deps): bump github.com/golang/protobuf from 1.5.3 to 1.5.4
  • build(deps): bump google.golang.org/grpc from 1.62.0 to 1.62.1

v0.62.1

Compare Source

This is a security fix release for the fixes published in Go 1.22.1.

OPA servers using --authentication=tls would be affected: crafted malicious client certificates could cause a panic in the server.

Also, crafted server certificates could panic OPA's HTTP clients, in bundle plugin, status and decision logs; and http.send calls that verify TLS.

This is CVE-2024-24783 (https://pkg.go.dev/vuln/GO-2024-2598).

Note that there are other security fixes in this Golang release, but whether or not OPA is affected is harder to assess. An update is advised.

Miscellaneous

• Add Trino to OPA ecosystem (authored by @​mosabua)
• update: ADOPTERS.md (#​6608) (authored by @​fredmaggiowski)

v0.62.0

Compare Source

NOTES:

• The minimum version of Go required to build the OPA module is 1.20

This release contains a mix of improvements and bugfixes.

Runtime, Tooling, SDK

• cmd: Add environment variable backups for command-line flags (#​6508) authored by @​colinjlacy
• download/oci: Add missing WithBundleParserOpts method to OCI downloader (#​6571) authored by @​slonka
• logging: avoid %!F(MISSING) in logs by skipping calls to the {Debug,Info,Warn,Error}f functions when there are no arguments (#​6555) authored by @​srenatus

Topdown and Rego

• ast+cmd: Allow bundle to contain calls to unknown Rego functions when inspected (#​6591) authored by @​johanfylling
• topdown/http: Respect raise_error flag during input validation (#​6553) authored by @​ashutosh-narkar

Docs + Website + Ecosystem

• Add OpaDotNet to ecosystem projects (#​6554) authored by @​me-viper
• Add updated logos for Permit.io and OPAL (#​6562) authored by @​danielbass37
• docs: Update description of the url path usage when accessing values inside object and array documents for v1/data GET and POST (#​6567) authored by @​ashutosh-narkar
• docs: Use application/yaml instead of application/x-yaml as the former is now a recognized content type (#​6565) authored by @​anderseknert

Miscellaneous

• Add Elastic to ADOPTERS.md (#​6568) authored by @​orouz
• Dependency updates; notably:
  • bump golang 1.21.5 -> 1.22 (#​6595) authored by @​srenatus
  • bump google.golang.org/grpc from 1.61.0 to 1.62.0
  • bump golang.org/x/net from 0.19.0 to 0.21.0
  • bump github.com/containerd/containerd from 1.7.12 to 1.7.13
  • bump aquasecurity/trivy-action from 0.16.1 to 0.17.0
  • bump github.com/prometheus/client_golang from 1.18.0 to 1.19.0
  • bump github.com/opencontainers/image-spec from 1.1.0-rc5 to 1.1.0-rc6