permitio/opal 0.10.0-rc.2

on GitHub

Release candidate. Docker :latest and a plain pip install stay on 0.9.9 until 0.10.0 ships, so nothing moves unless you opt in. 0.10.0-rc.2 is 0.10.0-rc.1 plus the security and hardening fixes below. The 0.10 move to pydantic v2 and Starlette 1.x is unchanged, so see the 0.10.0-rc.1 notes for that.

Security fixes since rc.1

• Distrust the compromised eMudhra CAs (CVE-2026-111943, #974). certifi>=2026.10.19 and upgraded ca-certificates in all images. A build-time check fails the image if any trust store still trusts them.
• PyJWT and GitPython floors past their published advisories (#976): pyjwt[crypto]>=2.15.1 and gitpython>=3.2.1. PyJWT 2.15.1 also restores accepting =-padded signatures, which 2.14.0 and 2.15.0 (shipped in rc.1) rejected.
• ddtrace 4 allowed (#983): ddtrace>=4.8.2,<5, so installs get the fix for CVE-2026-50271. The images keep ddtrace 3.x's default of not tracing every websocket message (DD_TRACE_WEBSOCKET_MESSAGES_ENABLED=false); set it to true to opt in.
• Auth values redacted in logs, callback reports and responses (#968).
• Bundled OPA 1.9.0 → 1.21.4 in opal-client (#906). It is built with Go 1.27.3, clearing the Go standard-library advisories that the old binary carried, and includes OPA's own 1.21.3 bundle-signing fix (GHSA-g2pf-6v5v-qcc8). The OPA image is now pinned by digest. EOPA moves to v1.45.1, its last upstream release; upstream EOPA is archived, so prefer opal-client.
• Image base layers (#987): setuptools 84.x (with its vendored jaraco.context and wheel), Debian and Alpine security updates (openssl, zlib), and urllib3>=2.8.0.

⚠️ Check your policies before upgrading opal-client

OPA 1.19 to 1.21 tightened policy compilation, so a policy that loaded on OPA 1.9 can be rejected by the new client image. YAML is also now parsed as YAML 1.2, so unquoted yes/no/on/off become strings, and that change is silent. Run opa check (with --v0-compatible if you use v0 compatibility) against your policy repository with OPA 1.21.4, and read OPA bundled in the client image for what opa check can't catch.

Also: setuptools 82 and later no longer ship pkg_resources. OPAL doesn't use it, but an image built FROM permitio/opal-client that installs a plugin relying on it must install setuptools<82 itself.

Build and release hardening

• Test certificate fixtures are kept out of the images (#979).
• E2E image builds no longer print the GitHub event payload (#977).
• Release images now carry the release version (#984, #986). Before this, pip show opal-common inside a published image reported 0.0.0. The release workflow now checks each pushed image's version.

How to opt in

Docker: every image is published under the 0.10.0-rc.2 tag, plus -alpine:

permitio/opal-server:0.10.0-rc.2
permitio/opal-client:0.10.0-rc.2
permitio/opal-client-standalone:0.10.0-rc.2
permitio/opal-client-cedar:0.10.0-rc.2
permitio/opal-client-eopa:0.10.0-rc.2

pip: pre-releases are skipped unless you ask for them:

pip install --pre opal-client        # or: opal-client==0.10.0rc2
pip install --pre opal-server