v1.13.1

v1.13.1

This bug fix release addresses an issue found in the new array.flatten built-in function

• Fix issue in array.flatten handling of single item arrays (#8273) (#8272) authored by @anderseknert

v1.13.0

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

• A new immediate upload trigger mode in the Decision Logger
• A new array.flatten built-in function
• Numerous performance improvements

Immediate Upload Trigger Mode in Decision Logger (#8110)

An immediate trigger mode has been added to the Decision Logger; enabled by setting the decision_logs.reporting.trigger configuration option to immediate.
When enabled, log events are pushed to the log service as soon as the configured upload chunk size criteria is met; or, at latest, when the configured upload delay is reached.

Authored by @sspaink

Runtime, SDK, Tooling

• cmd/fmt: Do not overwrite file on fmt without changes (#8222) authored by @Loic-R
• cmd/test: Enable sorting JSON test results by duration (#7444) authored by @sspaink
• profiler: nil *Profiler should not report Enabled() (#8256) authored by @anderseknert
• rego: Add Data function to simplify adding data from map (#5961) authored by @majiayu000 reported by @anderseknert
• runtime: Correct naming & docs for version checking (#8191) authored by @charlieegan3

Compiler, Topdown and Rego

• ast: Body.String() doesn't panic on empty body (#8244) authored by @srenatus
• ast: Improve type error message when referencing functions (#6840) authored by @sspaink
• ast: Type Checker recognizes when a variable has multiple assignments but is an undefined function (#7463) authored by @sspaink reported by @anderseknert
• ast/parser: Avoid duplicate loc copies (#8142) authored by @srenatus
• topdown: Add array.flatten built-in function (#8226) authored by @anderseknert
• topdown: Fix issue where numbers.range_step built-in could erroneously return undefined value (#8194) authored by @thevilledev
• topdown: Remove hard-coded missing key error in strings.render_template built-in (#7931) authored by @colinjlacy reported by @anderseknert
• topdown: Re-introduce cancellation-awareness for regex.replace built-in (#8179) authored by @srenatus
  from having been reverted in v1.12.1
• topdown: Support arrays as input for json.match_schema (#6615) authored by @sspaink reported by @mscudlik

Performance

• ast: Improved annotations parsing (#8210) authored by @anderseknert
• ast: Reinstate zero-alloc paths in Ref.String() (#8202) authored by @anderseknert
• ast: Replace regex implementation in IsVarCompatibleString (#8164) authored by @anderseknert
• ast: Optimize Set.Intersect and Set.Diff (#8167) authored by @thevilledev
• ast: Optimize Set.Union (#8172) authored by @thevilledev
• ast: Reduce allocations in Expr.MarshalJSON (#8204) authored by @thevilledev
• ast: Reduce allocations in Rule.MarshalJSON (#8205) authored by @thevilledev
• ast: Reduce allocations in Term.MarshalJSON (#8200) authored by @thevilledev
• ast: Reduce allocations in With.MarshalJSON (#8206) authored by @thevilledev
• perf: String() implementations using appenders (#8192) authored by @anderseknert
• topdown: Avoid redundancy in builtinTrim (#8237) authored by @thevilledev
• topdown: Eliminate closure allocations in Set and virtual doc enumeration (#8242) authored by @alex60217101990
• topdown: Fast paths for array.reverse (#8177) authored by @thevilledev
• topdown: Optimize json.remove and json.filter (#8193) authored by @thevilledev
• topdown: Optimize object built-ins (#8175) authored by @thevilledev
• topdown: Optimize union built-in (#8173) authored by @thevilledev
• topdown: Pre-alloc in various built-ins (#8198) authored by @thevilledev
• topdown: Reduce allocs in float sum/product (#8235) authored by @thevilledev
• topdown: Skip set copy in getObjectKeysParam (#8176) authored by @thevilledev

Docs, Website, Ecosystem

• docs: Add authz-spring-boot-starter to Spring Security API ecosystem entry (#8234) authored by @francois-eckert
• docs: Add header for crypto example to make (#8259) authored by @charlieegan3
• docs: Add notes for automated agents (#8147, #8203) authored by @charlieegan3
• docs: Add opa-wasm-zig to the ecosystem (#8163) authored by @burdzwastaken
• docs: Add scripts to import docs from source (#8148) authored by @charlieegan3
• docs: Explain how to use the SDK without a initialising a server (#8248) authored by @andrewcameronsims
• docs: Fix a number of redirecting links (#8165 authored by @charlieegan3
• docs: Fix template-expression examples (#8199) authored by @johanfylling
• docs/ocp: Mention source prefix/path options (#8238) authored by @srenatus
• website: Add redirect section for immutable referrers (#8262) authored by @charlieegan3 reported by @KraLeoD
• website: Display 2025 survey results on the website (#8258) authored by @charlieegan3
• website: Show breadcrumbs in search results (#8207) authored by @charlieegan3

Miscellaneous

• Decoupled the Rego job check from the Go job checks in the Github PR workflow (#8203) authored by @SeanLedford
• build: Format pr_check.rego with opa fmt (#8201) authored by @thevilledev
• build: Migrate PR check to OPA policy (#8183) authored by @SeanLedford
• build: Run go get against main to spot redacted (#8146) authored by @charlieegan3
• deps: Switch to maintained go.yaml.in/yaml/v3 yaml library (#8182) authored by @mrueg
• test/cases: Increase yaml test coverage for some regex and string builtins (#8152) authored by @srenatus
• Dependency updates; notably:
  • build: bump golang from 1.25.5 to 1.25.6 (#8224) authored by @srenatus
  • build(deps): bump go.opentelemetry.io deps from 1.38.0/0.63.0 to 1.39.0/0.64.0
  • build(deps): bump klauspost/compress from v1.18.1 to v1.18.2 (#8184) authored by @srenatus
    because of redaction warning
  • build(deps): bump github.com/go-ini/ini from v1.67.0 to gopkg.in/ini.v1 v1.67.1 (#8208) authored by @gabrpt

v1.12.3

v1.12.3

This is a bug fix release addressing two issues:

Bundle polling is being misconfigured when discovery bundle is updated (#8215)

This is an issue where the polling interval for discovery (discovery.polling.min_delay_seconds and discovery.polling.max_delay_seconds) were misinterpreted on reconfiguration, causing extremely long update intervals.

Reported by @loganmiller-chime, authored by @sspaink

Decision log size buffer buffer_size_limit_bytes misconfigured during reconfiguration (#8213)

This is a regression in the decision log, where the decision_logs.reporting.buffer_size_limit_bytes was mistakenly assigned the value of decision_logs.reporting.upload_size_limit_bytes during reconfiguration.
This issue is only present when decision_logs.reporting.buffer_type is set to size, which is the default value.

Authored by @sspaink

v1.12.2

This bug fix release address issues found in the new string interpolation feature

• Add (*TemplateString).Copy() method (#8159) authored by @anderseknert
• Fix template string not serialized with escaped { (#8161)
  authored by @anderseknert
• fix(ast): skip template string vars in ref safety (#8174)
  authored by @thevilledev
• fix(ast): use original var names in template error (#8180)
  authored by @thevilledev

v1.12.1

This bug fix release reverts a change to regex.replace that unintentionally changed its behaviour for anchored regular expressions.

• Revert "topdown: make regex.replace respect cancellation" (authored by @srenatus)

v1.12.0

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

• Support for String Interpolation in the Rego language
• Faster compilation and runtime
• Fixes published in the v1.11.1 release

String Interpolation (#4733)

The Rego language has been extended to support String Interpolation,
which provides a readable means to compose strings containing dynamic values determined at evaluation time.

An interpolated string is composed of a template-string containing zero or more template-expressions that evaluates to a value at evaluation time.
The $ character prefix identifies a template-string, and template-expressions are declared by being enclosed in curly-braces ({, }).

Additionally, undefined template-expression values don't halt evaluation; instead, <undefined> will be injected into the generated string.

package interpolation

allowed_roles := ["admin", "employee"]

default role := "guest"
role := input.role

deny contains $"User {input.username}'s role was '{role}', but must be one of {allowed_roles}" if {
  not role in allowed_roles
}

{
  "deny": [
    "User <undefined>'s role was 'guest', but must be one of [\"admin\", \"employee\"]"
  ],
}

String interpolation is a more readable and less error-prone substitute for the sprintf built-in function.

Authored by @johanfylling reported by @anderseknert

Tip

Help us out!

New Rego language features are exciting, and we want to maximize their usefulness. If you come across tools and integrations in the community where string interpolation isn't properly handled, such as syntax highlighting, please reach out and let us know.

Runtime, SDK, Tooling

• oracle: Refactor Oracle better support some and every (#8105, #8131, #8138) authored by @charlieegan3
• plugins/bundle: Prevent ns-level polling by validating intervals (#8082) authored by @jjhwan-h
• plugins/discovery: Initialize plugins before downloading (#8071) authored by @jt28828
• topdown: Introduce sink for context cancellation
  • topdown: Make regex.replace respect cancellation (#8089) authored by @srenatus
  • topdown: Make replace and strings.replace_n respect cancellation (#8089) authored by @srenatus
  • topdown: Use sink for concat (#8090) authored by @srenatus
  • perf: Avoid extra allocation in sink if no cancel (#8104) authored by @anderseknert

Compiler, Topdown and Rego

• ast/compile: Deal with error limit without panic/defer (#8087) authored by @srenatus
• ast/parser: Check if we need to unescape at all (#8135) authored by @srenatus
• perf: Improved visitor implementation (10% faster compilation) (#8078) authored by @anderseknert
• perf: Reduce allocations handling terms (#8116) authored by @anderseknert
• perf: Type-checker performance improvements (#8143) authored by @anderseknert

Docs, Website, Ecosystem

• website: Add support for rego string interpolation syntax highlighting (#8092) authored by @charlieegan3
• docs/ocp: Update "concepts" for v0.3.0 (#8117) authored by @srenatus
• website: Show playground errors (#8141) authored by @charlieegan3
• website: Update a number of links to their new location (#8100) authored by @charlieegan3
• docs: Remove link to feedback form (#8101) authored by @charlieegan3
• website: Remove survey bar (#8136) authored by @charlieegan3
• docs: Update community contacts (#8108) authored by @charlieegan3

Miscellaneous

• ast/checks_test: Fix flaky tests (#8111) authored by @srenatus
• benchmarks: Install node v24 (#8122) authored by @srenatus
• download: Fix when compiling with tag opa_no_oci (#8070) authored by @srenatus reported by @mg0083
• tests: Race in TestStatusUpdateBuffer (#8133) authored by @thevilledev
• workflow: Integrate benchmarks notebook (#8121) authored by @srenatus
• workflows: Skip all tests in benchmarks run (#8086) authored by @srenatus
• Dependency updates; notably:
  • build: Bump golang from 1.25.4 to 1.25.5 (#8107) authored by @srenatus
  • build(deps): Bump google.golang.org/grpc from 1.76.0 to 1.77.0

v1.11.1

This is a bugfix release:

Memory exhaustion via forged gzip header

A crafted HTTP request any of OPA's HTTP endpoints would lead OPA to use a large amount of memory, triggering
an out-of-memory process exit.

This weakness in OPA's HTTP API gzip handling is as old as the gzip handling itself. A configurable limit was introduced in v0.67.0, but it has been shown that this security measure wasn't sufficient to avoid running out of memory in memory-constrained setups.

Thanks to @thevilledev for reporting and fixing this issue.

It only applies to OPA running as server (as a binary or in a container, as "sidecar"). To trigger an OOM process exit using this weakness, an adversary must be able to send an HTTP request directly to OPA. This would be the case if they are in the same network, there is no proxy in front of OPA, or if OPA was exposed to the internet, which is advised against.

By the nature of HTTP encodings, this would be effective before token-based authentication and authorization policies, so these measures do not protect against the attack vector.

If all OPA endpoints are using TLS-based authentication (mutual TLS, "mTLS"), then an adversary cannot do harm with this method.

Please note that while we're taking all of these issues seriously, OPA isn't designed for adversary environments. It's strongly advised not to expose any of its endpoints to the public internet. Furthermore, available security measures should be applied regardless, for a defense in depth approach. See the documentation for the available means of authentication and authorization in OPA.

Please also check out our Security Policy for reporting critical issues and bugs.

Decision Logs dropped (introduced in OPA v1.9.0)

When the decision logs buffer was uploaded, the buffer limit inadvertently got reset to the default upload limit (32kb).
This causes logs to be dropped that shouldn't have been dropped.

This default is overridden by the configuration value decision_logs.reporting.upload_size_limit_bytes, see the docs on decision logs.

There's a Prometheus metric for dropped events, counter_decision_logs_dropped_buffer_size_limit_bytes_exceeded,
and you can check that for unexpectedly high counts.

Reported by @johanneslarsson #8123, fixed by @sspaink.

The release is otherwise identical to v1.11.0.

v1.11.0

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

• More efficient connection management in the http.send built-in function
• More performant loading of large bundles containing multiple Rego files

Immutable Releases

Starting with this release, OPA releases are immutable for increased security.

Runtime, SDK, Tooling

• v1/ast: Fix Call parsing Text attribute including an extra character (#7989) authored by @schmitd
• ast: Export built-in deprecated field (#7912) authored by @colinjlacy
• ast: Intern common var values + some parser improvements (#8028) authored by @anderseknert
• ast: Support custom builtins in CompileModulesWithOpt (#8061) authored by @sspaink
• bundle: Concurrent Rego parsing in bundle loader (#8067) authored by @anderseknert
• cmd: Support --ignore in eval cmd when using bundle flag (--bundle) (#8062) authored by @sspaink
• storage/inmem: Allow passing triggers (AST) data without conversion (#7958) authored by @anderseknert

Compiler, Topdown and Rego

• topdown: Avoid unnecessary use of custom http.Transport in http.send built-in (#7927) authored by @sykesm
• topdown: New custom SemVer implementation (#8010) authored by @anderseknert
• topdown: Use sync.Pool for eval func objects (#8054) authored by @anderseknert

Docs, Website, Ecosystem

• docs: Add example for Compile API's table mapping (#8017) authored by @srenatus
• docs: Address pages with similar titles (#8046) authored by @charlieegan3
• docs: Address some broken links (#8022) authored by @charlieegan3
• docs: Bump glob dep (CVE-2025-64756) (#8056) authored by @srenatus
• docs: Improve ground value and assignment docs (#8047) authored by @charlieegan3
• docs: Make iteration content flow better (#8064) authored by @charlieegan3
• docs: Note package repos are community maintained (#8053) authored by @charlieegan3
• docs: Update terraform guide with notes about plan (#8043) authored by @charlieegan3
• docs: Update the archive to have an edge link (#8011) authored by @charlieegan3
• docs: Update the policy language intro (#8050) authored by @charlieegan3
• docs/ocp: Datasource example uses wrong AWS S3 URL (#8039) authored by @SuchSkill
• docs/regal: Replicate sidebar fixes (#8036) authored by @charlieegan3
• website: Various fixes and improvements by @charlieegan3

Miscellaneous

• Bump golangci-lint, more gocritic linters (#8052) authored by @anderseknert
• Tidy up and unify sync pool handling (#8068) authored by @anderseknert
• builtins: Add StringOperandByteSlice helper (#8048) authored by @anderseknert
• test: Add test cases for consistent cache behavior (#8015) authored by @DFrenkel
• util/performance: Remove math.Log10, remove unused KeysCount (#8041) authored by @srenatus
• workflow: Add Benchmarks workflow (#8072) authored by @srenatus
• workflows/pull-request: Update macos versions (#8030) authored by @srenatus
• Dependency updates; notably:
  • build: golang 1.25.3 -> 1.25.4 (#8051) authored by @srenatus
  • build(deps): Bump github.com/bytecodealliance/wasmtime-go from v37.0.0 to v39.0.1 (#8075) authored by @srenatus
  • build(deps): Bump github.com/containerd/containerd/v2 from 2.1.4 to 2.2.0
  • build(deps): Bump github.com/huandu/go-sqlbuilder from 1.37.0 to 1.38.1
  • build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.0.11 to 3.0.12
  • build(deps): Bump github.com/vektah/gqlparser/v2 from 2.5.30 to 2.5.31 (#8027) authored by @johanfylling
  • build(deps): Bump golang.org/x/crypto from 0.43.0 to 0.45.0
  • build(deps): Bump golang.org/x/net from 0.44.0 to 0.45.0
  • build(deps): Bump golang.org/x/time from 0.13.0 to 0.14.0
  • build(deps): Bump google.golang.org/grpc from 1.75.1 to 1.76.0
  • build(deps): Bump google.golang.org/protobuf from 1.36.9 to 1.36.10

v1.10.1

This is a bugfix release for the split builtin: In v1.10.0, it was looping infinitely when used with an empty-string delimiter.

Reported by @SignalRichard, authored by @srenatus

The release is otherwise identical to v1.10.0.

v1.10.0

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

• Non-static arm64 executables for linux and darwin, supporting Wasm evaluation
• Performance improvements to the formatter, compiler, and runtime
• A new --fail-on-empty flag for opa test
• Support for IS NOT NULL query statements in the Compile API

Non-static OPA binaries for linux/arm64 and darwin/arm64

Starting with this release, OPA will ship non-static arm64 executables for linux and darwin.
These binaries have support for Wasm evaluation.
Furthermore, the openpolicyagent/opa:latest docker image is a multi-platform image with arm64 support.

Runtime, Tooling

• cmd: Add opa test --fail-on-empty to allow making bad -r or empty folders fail (#7943) reported and authored by @grosser
• format: Performance improvements in formatter (#7967) authored by @anderseknert
• repl: Check usage of with keyword (#7942) authored by @sspaink
• server/failtracer: don't assume only being fed two-elem calls (#7995) authored by @srenatus
• storage: Improve performance of storage operations (#7957) authored by @anderseknert
• storage: Some small improvements to inmem storage (#7944) authored by @anderseknert
• util: Fix race condition in ReadMaybeCompressedBody (#7966) authored by @anderseknert

Compiler, Topdown and Rego

• ast: Fix undeclared error when printing nested comprehension (#7647) authored by @schmitd reported by @charlesdaniels
• ast: Raise parse error on infix operator in rule name (#7433) authored by @mmzzuu
• ast: Refactor hash key equality function (#7969) authored by @anderseknert
• ast,topdown: Ref String() and greatly improved builtin lookup cost (#7961) authored by @anderseknert
• compile: Add support for "any value at all", as IS NOT NULL (#7998) authored by @srenatus
• eval: Lazy init of eval.Time term (#7968) authored by @anderseknert
• perf: Zero alloc AST store lookups of interned path terms (#7979) authored by @anderseknert
• perf: Cheaper split built-in calls (#7962) authored by @anderseknert

Docs, Website, Ecosystem

• docs: Add Compile API data filtering docs (#7939) authored by @srenatus
• docs: Add ecosystem project Moat (#7963) authored by @jcoenraadts
• docs: Address broken anchors (#8000) authored by @charlieegan3
• docs: Correction in OCP docs information regarding supported datasources (#7964) authored by @irodzik
• docs: Moving CLI Reference to Operations in TOC (#8001) authored by @johanfylling
• docs: OCP HTTP API updates (#7951) authored by @srenatus
• docs: Remove k8s primer line numbers comments (#7946) authored by @charlieegan3
• docs: Update based on Slack feedback (#7990) authored by @charlieegan3
• docs: Update link checker config (#7949) authored by @charlieegan3
• docs: Updated AI guidelines (#7945) authored by @charlieegan3
• docs/ocp/deployment: Add segment on database migrations (#7952) authored by @srenatus
• website: Fix build issues (#7999) authored by @charlieegan3
• website: FOUC squashing on the homepage (#7948) authored by @charlieegan3
• website: Show latest release rather than edge (#7988) authored by @charlieegan3
• website: Update docusaurus (#7947) authored by @charlieegan3

Miscellaneous

• ast/capabilities: Remove stale comment (#7994) authored by @srenatus
• build: Non-static images for linux/arm64 (#7977) authored by @srenatus
• ci: Add zig to post-merge github action (#7983) authored by @sspaink
• e2e/authz,topdown: Fix benchmarks (#7980) authored by @srenatus
• runtime: Fixing tests by closing watcher & set default GracefulShutdownPeriod (#7991) authored by @rMaxiQp
• test/e2e: move http.DefaultTransport fix to init() (#7955) authored by @srenatus
• Remove vendor/ (#7975) authored by @srenatus
• Modernize analyzer fixes (#7965) authored by @anderseknert
• Dependency updates; notably:
  • build: bump golang 1.25.1 -> 1.25.3 authored by @srenatus
  • build(deps): Bump github.com/olekukonko/tablewriter from 0.0.5 to 1.1.0 (#7937) authored by @jh125486
    This is a major version update containing breaking API changes. If you're affected by this, please consult the tablewriter migration guide.
  • deps(build): Bump github.com/bytecodealliance/wasmtime-go from v3.0.2 to v37.0.0 authored by @srenatus