[dependabot]

Bumps github.com/open-policy-agent/opa from 1.21.3 to 1.22.0.

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.22.0

This release contains a mix of new features, performance improvements and bug fixes. Notably:

• New rego.v2 import
• Configurable log level for HTTP access logs
• Stricter handling of bundle signature filenames (breaking change)
• Partial evaluation unrolls every over a known domain

Configurable log level for HTTP access logs

Added --log-level-request (default info) to control the level at which the HTTP server's "Received request."/"Sent response." access log lines are emitted, independent of the general --log-level. Set it to debug to keep those lines out of logs unless --log-level is also turned up.

Authored by @​srenatus

New rego.v2 import (#9224, #9269)

import rego.v2 enables the and and or keywords and the improved not semantics in one import, in place of future.keywords.and, future.keywords.or, and future.keywords.not. In a v0 module it also implies rego.v1. It is gated by the new rego_v2_import capability feature.

package example
import rego.v2
allow if input.user.admin or not (input.user.suspended or input.user.locked)

See Importing rego.v2.

Additionally: bundles can be declared as Rego v2 by setting the rego_version manifest attribute to 2 (individua bundle modules by setting file_rego_versions); and the Go API accepts the new ast.RegoV2 rego-version when parsing, compiling, and formatting Rego modules. The rego.v2 import is a redundant no-op for modules loaded these ways.

See bundle file format.

Authored by @​johanfylling

Stricter handling of bundle signature filenames (#9300)

Breaking change: We have corrected a long-standing bug in bundle signing and verification, which will cause bundles containing files matching the suffix pattern *signatures.json to no longer pass verification in newer versions of OPA. These bundles will need to be re-signed by this or newer versions of OPA to have a correct .signatures.json file. Bundles that do not contain filenames with the *signatures.json pattern are unaffected, and will continue to verify correctly across OPA versions.

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.22.0

This release contains a mix of new features, performance improvements and bug fixes. Notably:

• New rego.v2 import
• Configurable log level for HTTP access logs
• Stricter handling of bundle signature filenames (breaking change)
• Partial evaluation unrolls every over a known domain

Configurable log level for HTTP access logs

Added --log-level-request (default info) to control the level at which the HTTP server's "Received request."/"Sent response." access log lines are emitted, independent of the general --log-level. Set it to debug to keep those lines out of logs unless --log-level is also turned up.

Authored by @​srenatus

New rego.v2 import (#9224, #9269)

import rego.v2 enables the and and or keywords and the improved not semantics in one import, in place of future.keywords.and, future.keywords.or, and future.keywords.not. In a v0 module it also implies rego.v1. It is gated by the new rego_v2_import capability feature.

package example
import rego.v2
allow if input.user.admin or not (input.user.suspended or input.user.locked)

See Importing rego.v2.

Additionally: bundles can be declared as Rego v2 by setting the rego_version manifest attribute to 2 (individua bundle modules by setting file_rego_versions); and the Go API accepts the new ast.RegoV2 rego-version when parsing, compiling, and formatting Rego modules. The rego.v2 import is a redundant no-op for modules loaded these ways.

See bundle file format.

Authored by @​johanfylling

Stricter handling of bundle signature filenames (#9300)

Breaking change: We have corrected a long-standing bug in bundle signing and verification, which will cause bundles containing files matching the suffix pattern *signatures.json to no longer pass verification in newer versions of OPA. These bundles will need to be re-signed by this or newer versions of OPA to have a correct .signatures.json file. Bundles that do not contain filenames with the *signatures.json pattern are unaffected, and will continue to verify correctly across OPA versions.

... (truncated)

Commits

• d4c8d0c Prepare v1.22.0 release (#9456)
• fe8cf50 ast: report reserved names used as import aliases (#9452)
• 66d072a cmd/version: note that the _static binaries are deprecated
• d6b52e2 wasm: mark eq and assign as wasm-enabled
• 5faa7e8 topdown: allocate base cache children on first insert
• 044290b ast: index references holding a local bound to a scalar
• 359db76 website: Add links to survey and kubecon (#9448)
• ca66066 ast: add regression test for rule conflict reporting (#9443)
• d212a84 bundle: resolve wasm manifest paths against the base dir (#9444)
• 6d3fadd topdown: unroll every over a known domain
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)