open-policy-agent/opa v1.12.0

on GitHub

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

• Support for String Interpolation in the Rego language
• Faster compilation and runtime
• Fixes published in the v1.11.1 release

String Interpolation (#4733)

The Rego language has been extended to support String Interpolation,
which provides a readable means to compose strings containing dynamic values determined at evaluation time.

An interpolated string is composed of a template-string containing zero or more template-expressions that evaluates to a value at evaluation time.
The $ character prefix identifies a template-string, and template-expressions are declared by being enclosed in curly-braces ({, }).

Additionally, undefined template-expression values don't halt evaluation; instead, <undefined> will be injected into the generated string.

package interpolation

allowed_roles := ["admin", "employee"]

default role := "guest"
role := input.role

deny contains $"User {input.username}'s role was '{role}', but must be one of {allowed_roles}" if {
  not role in allowed_roles
}

{
  "deny": [
    "User <undefined>'s role was 'guest', but must be one of [\"admin\", \"employee\"]"
  ],
}

String interpolation is a more readable and less error-prone substitute for the sprintf built-in function.

Authored by @johanfylling reported by @anderseknert

Runtime, SDK, Tooling

• oracle: Refactor Oracle better support some and every (#8105, #8131, #8138) authored by @charlieegan3
• plugins/bundle: Prevent ns-level polling by validating intervals (#8082) authored by @jjhwan-h
• plugins/discovery: Initialize plugins before downloading (#8071) authored by @jt28828
• topdown: Introduce sink for context cancellation
  • topdown: Make regex.replace respect cancellation (#8089) authored by @srenatus
  • topdown: Make replace and strings.replace_n respect cancellation (#8089) authored by @srenatus
  • topdown: Use sink for concat (#8090) authored by @srenatus
  • perf: Avoid extra allocation in sink if no cancel (#8104) authored by @anderseknert

Compiler, Topdown and Rego

• ast/compile: Deal with error limit without panic/defer (#8087) authored by @srenatus
• ast/parser: Check if we need to unescape at all (#8135) authored by @srenatus
• perf: Improved visitor implementation (10% faster compilation) (#8078) authored by @anderseknert
• perf: Reduce allocations handling terms (#8116) authored by @anderseknert
• perf: Type-checker performance improvements (#8143) authored by @anderseknert

Docs, Website, Ecosystem

• website: Add support for rego string interpolation syntax highlighting (#8092) authored by @charlieegan3
• docs/ocp: Update "concepts" for v0.3.0 (#8117) authored by @srenatus
• website: Show playground errors (#8141) authored by @charlieegan3
• website: Update a number of links to their new location (#8100) authored by @charlieegan3
• docs: Remove link to feedback form (#8101) authored by @charlieegan3
• website: Remove survey bar (#8136) authored by @charlieegan3
• docs: Update community contacts (#8108) authored by @charlieegan3

Miscellaneous

• ast/checks_test: Fix flaky tests (#8111) authored by @srenatus
• benchmarks: Install node v24 (#8122) authored by @srenatus
• download: Fix when compiling with tag opa_no_oci (#8070) authored by @srenatus reported by @mg0083
• tests: Race in TestStatusUpdateBuffer (#8133) authored by @thevilledev
• workflow: Integrate benchmarks notebook (#8121) authored by @srenatus
• workflows: Skip all tests in benchmarks run (#8086) authored by @srenatus
• Dependency updates; notably:
  • build: Bump golang from 1.25.4 to 1.25.5 (#8107) authored by @srenatus
  • build(deps): Bump google.golang.org/grpc from 1.76.0 to 1.77.0