[dependabot]

Bumps github.com/open-policy-agent/opa from 1.22.0 to 1.22.2.

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.22.2

This is a bugfix release for a type checker regression in v1.21.0.

Iterating an empty collection is rejected by the type checker

Policies that iterate a collection known to be empty, such as some x in [] or m[_] where m := {}, were rejected with rego_type_error: undefined ref. Iteration with a non-constant key is valid again, and simply yields nothing. Comparing or unifying the elements of such a collection with a value is accepted as well. Constant keys, like [][0], are still reported as undefined.

Reported by @​kholia.

v1.22.1

This is a bugfix release for a rule indexer regression in v1.21.0.

x in {"a", input.y} never matches for a ref x

allow if {
	input.x in {"a", input.y}
}

For an input of {"x": "b", "y": "b"}, this should evaluate to true. Due to a bug in the rule indexer, the rule body hadn't been returned, and allow thus evaluated to undefined.

Reported by @​kholia.

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.22.2

This is a bugfix release for a type checker regression in v1.21.0.

Iterating an empty collection is rejected by the type checker

Policies that iterate a collection known to be empty, such as some x in [] or m[_] where m := {}, were rejected with rego_type_error: undefined ref. Iteration with a non-constant key is valid again, and simply yields nothing. Comparing or unifying the elements of such a collection with a value is accepted as well. Constant keys, like [][0], are still reported as undefined.

Reported by @​kholia.

1.22.1

This is a bugfix release for a rule indexer regression in v1.21.0.

x in {"a", input.y} never matches for a ref x

allow if {
	input.x in {"a", input.y}
}

For an input of {"x": "b", "y": "b"}, this should evaluate to true. Due to a bug in the rule indexer, the rule body hadn't been returned, and allow thus evaluated to undefined.

Reported by @​kholia.

Commits

• 482d9e3 Release 1.22.2 prep (#9521)
• 7fb317c Release 1.22.1
• c918277 ast: keep a rule indexed as "anything" for in with a var member
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)