[dependabot]

Bumps github.com/open-policy-agent/opa from 1.3.0 to 1.22.0.

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.22.0

This release contains a mix of new features, performance improvements and bug fixes. Notably:

• New rego.v2 import
• Configurable log level for HTTP access logs
• Stricter handling of bundle signature filenames (breaking change)
• Partial evaluation unrolls every over a known domain

Configurable log level for HTTP access logs

Added --log-level-request (default info) to control the level at which the HTTP server's "Received request."/"Sent response." access log lines are emitted, independent of the general --log-level. Set it to debug to keep those lines out of logs unless --log-level is also turned up.

Authored by @​srenatus

New rego.v2 import (#9224, #9269)

import rego.v2 enables the and and or keywords and the improved not semantics in one import, in place of future.keywords.and, future.keywords.or, and future.keywords.not. In a v0 module it also implies rego.v1. It is gated by the new rego_v2_import capability feature.

package example
import rego.v2
allow if input.user.admin or not (input.user.suspended or input.user.locked)

See Importing rego.v2.

Additionally: bundles can be declared as Rego v2 by setting the rego_version manifest attribute to 2 (individua bundle modules by setting file_rego_versions); and the Go API accepts the new ast.RegoV2 rego-version when parsing, compiling, and formatting Rego modules. The rego.v2 import is a redundant no-op for modules loaded these ways.

See bundle file format.

Authored by @​johanfylling

Stricter handling of bundle signature filenames (#9300)

Breaking change: We have corrected a long-standing bug in bundle signing and verification, which will cause bundles containing files matching the suffix pattern *signatures.json to no longer pass verification in newer versions of OPA. These bundles will need to be re-signed by this or newer versions of OPA to have a correct .signatures.json file. Bundles that do not contain filenames with the *signatures.json pattern are unaffected, and will continue to verify correctly across OPA versions.

OPA has historically been very lax in deciding where to source bundle signature data from during bundle verification, and would attempt to load bundle signatures data from any file in the bundle that had the filename suffix pattern *signatures.json.

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.22.0

This release contains a mix of new features, performance improvements and bug fixes. Notably:

• New rego.v2 import
• Configurable log level for HTTP access logs
• Stricter handling of bundle signature filenames (breaking change)
• Partial evaluation unrolls every over a known domain

Configurable log level for HTTP access logs

Added --log-level-request (default info) to control the level at which the HTTP server's "Received request."/"Sent response." access log lines are emitted, independent of the general --log-level. Set it to debug to keep those lines out of logs unless --log-level is also turned up.

Authored by @​srenatus

New rego.v2 import (#9224, #9269)

import rego.v2 enables the and and or keywords and the improved not semantics in one import, in place of future.keywords.and, future.keywords.or, and future.keywords.not. In a v0 module it also implies rego.v1. It is gated by the new rego_v2_import capability feature.

package example
import rego.v2
allow if input.user.admin or not (input.user.suspended or input.user.locked)

See Importing rego.v2.

Additionally: bundles can be declared as Rego v2 by setting the rego_version manifest attribute to 2 (individua bundle modules by setting file_rego_versions); and the Go API accepts the new ast.RegoV2 rego-version when parsing, compiling, and formatting Rego modules. The rego.v2 import is a redundant no-op for modules loaded these ways.

See bundle file format.

Authored by @​johanfylling

Stricter handling of bundle signature filenames (#9300)

Breaking change: We have corrected a long-standing bug in bundle signing and verification, which will cause bundles containing files matching the suffix pattern *signatures.json to no longer pass verification in newer versions of OPA. These bundles will need to be re-signed by this or newer versions of OPA to have a correct .signatures.json file. Bundles that do not contain filenames with the *signatures.json pattern are unaffected, and will continue to verify correctly across OPA versions.

... (truncated)

Commits

• d4c8d0c Prepare v1.22.0 release (#9456)
• fe8cf50 ast: report reserved names used as import aliases (#9452)
• 66d072a cmd/version: note that the _static binaries are deprecated
• d6b52e2 wasm: mark eq and assign as wasm-enabled
• 5faa7e8 topdown: allocate base cache children on first insert
• 044290b ast: index references holding a local bound to a scalar
• 359db76 website: Add links to survey and kubecon (#9448)
• ca66066 ast: add regression test for rule conflict reporting (#9443)
• d212a84 bundle: resolve wasm manifest paths against the base dir (#9444)
• 6d3fadd topdown: unroll every over a known domain
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)