github open-policy-agent/opa v1.6.0
on GitHub

latest releases: v1.8.0, v1.7.1, v1.7.0...
2 months ago

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • Improvements to the OPA website and documentation
  • Allowing keywords in Rego references
  • Parallel test execution
  • Faster built-in function execution

Modernized OPA Website (#7037)

We're continuing to modernize the OPA website with a new design and improved user experience.

Some highlights:

  • Builtins: You can now search them on the docs page!
  • Sidebar redesign: Making it easier to find what you're looking for in our docs
  • Feedback forms: Closing the feedback loop between docs authors and readers -- Please let us know if you dislike, or like, a docs page.
  • Downloads page: Find your OS' installation instructions on a less cluttered page!
  • And much more

Authored by @sky3n3t and @charlieegan3

Allowing keywords in Rego references (#7709)

Previously, Rego references could not contain terms that conflict with Rego keywords such as package, if, else, not, etc.
in certain constructs: 

package example

allow if {
    input.package.source         # not allowed (before v1.6.0)
    input["package"].destination # allowed
}

The constraints for valid Rego references have been relaxed to allow keywords.
The above example is now valid and will no longer cause a compilation error.

Authored by @johanfylling

Parallel Test Execution (#7442)

By default, OPA will now run tests in parallel (defaulting to one parallel execution thread per available CPU core), significantly speeding up test execution time for large test suites.
The performance boost is closely tied to the number of tests in your project and your selected parallelism level. For larger projects and default settings, 2-3x performance gains have been measured on a MacBook Pro.

Parallelism can be disabled to run tests sequentially by setting the --parallel flag to 1. E.g. opa test . --parallel=1.

Authored by @sspaink reported by @anderseknert

Faster Builtin Function Evaluation

The builtin context, an internal construct of OPA's evaluation engine, was previously provided to every builtin function.
As it turns out, only very few of them actually need it, for caching, cancellation, or lookups.
Those builtins are still provided with a builtin context, but for calls to all other builtins, we save the memory required by it.
The impact is tremendous: Even though the size of a single builtin context is only about 270 bytes, in an example application (Regal), this change brings about 360 MB of reduced memory usage!

Authored by @anderseknert

Runtime, Tooling, SDK

  • cmd/check: opa check --bundle report virtual/base doc conflicts (#7701) authored by @anderseknert
    When opa check is used with the --bundle flag, an error will be reported if the provided json/yaml data has a conflicting overlap with the virtual documents generated by Rego rules. Such conflicts are ambiguous and can lead to unexpected evaluation results, and should be resolved.
  • cmd/inspect: Fixing missing annotations location in opa inspect with JSON format (#7459) authored by @johanfylling reported by @mostealth
  • cmd/parse: Expose --v0-compatible flag (#7668) authored by @tsandall
  • cmd/refactor: Fix src:dst parsing to deal with colons (#7648) authored by @tsandall
  • metrics: Fix restartable timer bug. (#7669) authored by @philipaconrad
  • metrics: Prealloc maps + add benchmark (#7664) authored by @philipaconrad
  • oracle: Add support for some and every (#7716) authored by @charlieegan3
  • oracle: Support object refs in FindDefinition (#7711) authored by @charlieegan3
  • plugin/decision: Check if event is too large after compression (#7526) authored by @sspaink
  • runtime,server: Replace gorilla/mux dependency with http.ServeMux (#7676) authored by @anderseknert
    Note: This is a potentially breaking change for go API users directly interfacing with the OPA server's routing.
  • server: Fix deferred metrics timers. (#7671) authored by @philipaconrad
  • server: Fix query url when opa is served not from root path (#7644) authored by @olegKoshmeliuk
    Note: This is only applicable for the web UI hosted by OPA on its root path (/) and OPA is served at some other path than root.

Compiler, Topdown and Rego

  • ast: Ensure surplus leading zeros always error (#7726) authored by @charlieegan3
    Note: Primitive Rego number values with leading zeros (e.g. 0123) are now considered invalid at time of parsing and will generate an error. If you're impacted by this change, please update your policies to not have numbers with leading zeros. E.g. 0123 should be changed to 123.
  • ast: Fixing type-checker schema cache race condition for inlined schemas (#7679, 7571) authored by @johanfylling reported by @daniel-petrov-gig
  • perf: Improve performance when referencing "global" in loop (#7654) authored by @anderseknert
  • topdown: Fix issue where path in walk would get mutated (#7656) authored by @anderseknert reported by @robmyersrobmyers
  • topdown/http: Lenient application/json Content-Type header (#6684) authored by @sspaink reported by @mrvanes

Docs, Website, Ecosystem

Miscellaneous

  • build: Better detection of go changes (#7696) authored by @charlieegan3
  • build: Bump golang 1.24.3 -> 1.24.4 (#7672) authored by @srenatus
  • Adding Clarification to merge instructions when cutting a patch release (#7660) authored by @johanfylling
  • build: Make summary failure source clearer (#7697) authored by @charlieegan3
  • build: Skip jobs for non docs changes (#7688) authored by @charlieegan3
  • deps: Use google.golang.org/protobuf (#7655) authored by @sspaink
  • perf: Simplify interning (#7714) authored by @anderseknert
  • perf: Only pass built-in context to calls depending on it (#7728) authored by @anderseknert
  • perf: Improve built-in concat performance (#7702) authored by @anderseknert
  • perf: More efficient data/v1 POST handler (#7673) authored by @anderseknert
  • test: Fix flaky TestRaisingHTTPClientQueryError (#7698) authored by @sspaink
  • test: Fix flaky topdown query cache tests (#7590) authored by @sspaink
  • Dependency updates; notably:
    • build(deps): Bump gqlparser from v2.5.27 to v2.5.28 (#7699) authored by @robmyersrobmyers
    • build(deps): bump github.com/go-logr/logr from 1.4.2 to 1.4.3
    • build(deps): bump github.com/vektah/gqlparser/v2 from 2.5.26 to 2.5.27
    • build(deps): bump golang.org/x/net from 0.39.0 to 0.40.0
    • build(deps): bump google.golang.org/grpc from 1.72.0 to 1.72.2
    • build(deps): bump oras.land/oras-go/v2 from 2.5.0 to 2.6.0
    • build(deps): bump go.opentelemetry.io deps to 1.36.0/0.61.0
Check out latest releases or
releases around open-policy-agent/opa v1.6.0

Don't miss a new opa release

NewReleases is sending notifications on new releases.

Get notifications