8000 chore(deps): update dependency open-policy-agent/opa to v1.5.1 (opa/dockerfile) (master) by ivankatliarchuk · Pull Request #1063 · cloudkats/docker-tools · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

chore(deps): update dependency open-policy-agent/opa to v1.5.1 (opa/dockerfile) (master) #1063

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

chore(deps): update dependency open-policy-agent/opa to v1.5.1 (opa/dockerfile) (master) #1063

wants to merge 1 commit into from

Conversation

ivankatliarchuk
Copy link
Member
@ivankatliarchuk ivankatliarchuk commented May 5, 2025 •
edited
Loading

This PR contains the following updates:

Package Update Change
open-policy-agent/opa minor 1.3.0 -> 1.5.1

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

open-policy-agent/opa (open-policy-agent/opa)

v1.5.1

Compare Source

This is a bug fix release addressing a regression to the walk built-in function, introduced in v1.5.0. See #​7656 (authored by @​anderseknert reported by @​robmyersrobmyers)

v1.5.0

Compare Source

This release contains a mix of new features, performance improvements, and bugfixes. Among others:

  • Support for AWS SSO credentials provider
  • Support for signing client assertions with Azure Keyvault
  • Faster object.get, walk and builtin-function evaluation
  • Improved guardrails in the parser
  • Improvements to decision logging
Modernized OPA Website (#​7037)

The OPA website has been modernized with a new design and improved user experience.

The new site is based on Docusaurus and React which makes it easier to build live functionality and add non-documentation resources. This lays the groundwork for even more improvements in the future!

Documentation for older OPA versions are still available in the version archive.

Authored by @​charlieegan3

Runtime, Tooling, SDK
Planner, Topdown and Rego
Docs, Website, Ecosystem
Miscellaneous
  • github_actions: Adding monthly check for broken hyperlinks (#​7537) authored by @​sspaink
  • perf: Extended interning (#​7636) authored by @​anderseknert
  • perf: Ref.String() shortcut on single var term ref (#​7595) authored by @​anderseknert
  • refactor: Don't return error from opaTest (#​7560) authored by @​sspaink
  • refactor: Remove internal/gqlparser and use upstream dependency instead. (#​7520) authored by @​robmyersrobmyers
  • test: Fix flaky TestContextErrorHandling (#​7587) authored by @​sspaink
  • Apply modernize linter fixes (#​7599) authored by @​anderseknert
  • Use any in place of interface{} (#​7566) authored by @​anderseknert
  • Dependency updates; notably:
    • build: bump go from 1.24.0 to 1.24.3
    • build(deps): bump containerd to v2.1.1 (#​7627) authored by @​johanfylling reported by @​robmyersrobmyers
    • build(deps): bump github.com/fsnotify/fsnotify from 1.8.0 to 1.9.0
    • build(deps): bump github.com/prometheus/client_golang from 1.21.1 to 1.22.0
    • build(deps): bump github.com/prometheus/client_model from 0.6.1 to 0.6.2
    • build(deps): bump golang.org/x/net from 0.38.0 to 0.39.0
    • build(deps): bump google.golang.org/grpc from 1.71.1 to 1.72.0

v1.4.2

Compare Source

This is a bug fix release addressing the missing capabilities/v1.4.1.json in the v1.4.1 release.

v1.4.1

Compare Source

⚠️ Please skip this release and go straight to v1.4.2 ⚠️
This release is broken due to a mistake during the release process and the artifacts are missing a crucial capabilities file.
Sorry for any inconvenience.

This is a security fix release for the fixes published in Go 1.24.1 and 1.24.2

  • build: bump go to 1.24.2 (#​7544) (authored by @​sspaink)
    Addressing CVE-2025-22870 and CVE-2025-22871 vulnerabilities in the Go runtime.

v1.4.0

Compare Source

This release contains a security fix addressing CVE-2025-46569.
It also includes a mix of new features, bugfixes, and dependency updates.

Security Fix: CVE-2025-46569 - OPA server Data API HTTP path injection of Rego (GHSA-6m8w-jc87-6cr7)

A vulnerability in the OPA server's Data API allows an attacker to craft the HTTP path in a way that injects Rego code into the query that is evaluated.
The evaluation result cannot be made to return any other data than what is generated by the requested path, but this path can be misdirected, and the injected Rego code can be crafted to make the query succeed or fail; opening up for oracle attacks or, given the right circumstances, erroneous policy decision results.
Furthermore, the injected code can be crafted to be computationally expensive, resulting in a Denial Of Service (DoS) attack.

Users are only impacted if all of the following apply:

  • OPA is deployed as a standalone server (rather than being used as a Go library)
  • The OPA server is exposed outside of the local host in an untrusted environment.
  • The configured authorization policy does not do exact matching of the input.path attribute when deciding if the request should be allowed.

or, if all of the following apply:

  • OPA is deployed as a standalone server.
  • The service connecting to OPA allows 3rd parties to insert unsanitised text into the path of the HTTP request to OPA’s Data API.

Note: With no Authorization Policy configured for restricting API access (the default configuration), the RESTful Data API provides access for managing Rego policies; and the RESTful Query API facilitates advanced queries.
Full access to these APIs provides both simpler, and broader access than what the security issue describes here can facilitate.
As such, OPA servers exposed to a network are not considered affected by the attack described here if they are knowingly not restricting access through an Authorization Policy.

This issue affects all versions of OPA prior to 1.4.0.

See the Security Advisory for more details.

Reported by @​GamrayW, @​HyouKash, @​AdrienIT, authored by @​johanfylling

Runtime, Tooling, SDK
Topdown and Rego
Docs, Website, Ecosystem
Miscellaneous
  • Dependency updates; notably:
    • build(deps): bump github.com/hypermodeinc/badger from v4.6.0 to v4.7.0
    • build(deps): bump github.com/spf13/viper from 1.18.2 to 1.20.1
    • build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
    • build(deps): bump google.golang.org/grpc from 1.71.0 to 1.71.1
    • build(deps): bump oras.land/oras-go/v2 from 2.3.1 to 2.5.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@ivankatliarchuk ivankatliarchuk self-assigned this May 5, 2025
@ivankatliarchuk ivankatliarchuk force-pushed the renovate/master-opa-open-policy-agent-opa-1.x branch from 7617b68 to 07fe1bf Compare May 5, 2025 18:27
@ivankatliarchuk ivankatliarchuk changed the title chore(deps): update dependency open-policy-agent/opa to v1.4.0 (opa/dockerfile) (master) chore(deps): update dependency open-policy-agent/opa to v1.4.2 (opa/dockerfile) (master) May 5, 2025
@ivankatliarchuk ivankatliarchuk force-pushed the renovate/master-opa-open-policy-agent-opa-1.x branch 2 times, most recently from ce451ca to e84f457 Compare May 6, 2025 04:19
@ivankatliarchuk ivankatliarchuk force-pushed the renovate/master-opa-open-policy-agent-opa-1.x branch from e84f457 to 6b2b046 Compare June 2, 2025 04:26
@ivankatliarchuk ivankatliarchuk changed the title chore(deps): update dependency open-policy-agent/opa to v1.4.2 (opa/dockerfile) (master) chore(deps): update dependency open-policy-agent/opa to v1.5.0 (opa/dockerfile) (master) Jun 2, 2025
@ivankatliarchuk ivankatliarchuk force-pushed the renovate/master-opa-open-policy-agent-opa-1.x branch 5 times, most recently from b9fee03 to 6441c89 Compare June 8, 2025 04:27
@ivankatliarchuk ivankatliarchuk changed the title chore(deps): update dependency open-policy-agent/opa to v1.5.0 (opa/dockerfile) (master) chore(deps): update dependency open-policy-agent/opa to v1.5.1 (opa/dockerfile) (master) Jun 8, 2025
@ivankatliarchuk ivankatliarchuk force-pushed the renovate/master-opa-open-policy-agent-opa-1.x branch 2 times, most recently from 4ebc916 to e927c47 Compare June 10, 2025 04:24
< 789E div data-view-component="true" class="TimelineItem-badge">
@ivankatliarchuk ivankatliarchuk force-pushed the renovate/master-opa-open-policy-agent-opa-1.x branch from e927c47 to 77e81e3 Compare June 11, 2025 04:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@ivankatliarchuk ivankatliarchuk

Labels
datasource::github-releases deps manager:regex renovate rule::1 type::minor
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@ivankatliarchuk
0