permitio/opal 0.10.0-rc.5

on GitHub

Release candidate. Docker :latest and a plain pip install stay on 0.9.9 until 0.10.0 ships, so nothing moves unless you opt in. 0.10.0-rc.5 is 0.10.0-rc.4 plus the two changes below. See the 0.10.0-rc.4 notes for the scopes repoint and opt-in clone settings, the 0.10.0-rc.3 notes for the scope-clone repack, the 0.10.0-rc.2 notes for the security fixes and the 0.10.0-rc.1 notes for the move to pydantic v2 and Starlette 1.x.

No new settings. Both changes are in the images.

SSH fetches from GitHub work after GitHub drops ssh-rsa (#996)

This affects images built with TRUST_POLICY_REPO_HOST_SSH_FINGERPRINT=true, the default, and policy repositories reached over SSH.

• The server images used to write only the policy repo host's RSA key into ~/.ssh/known_hosts. libgit2 1.7, which the server uses for git, offers only the host-key methods for the key types it finds in that file, and maps an RSA entry to the ssh-rsa (SHA-1) signature type alone.
• GitHub is retiring the ssh-rsa signature type (GitHub changelog: brownouts on 2026-11-04 and 2026-12-09, removal on 2027-01-13). Without it, the server and GitHub share no host-key method, and SSH fetches and clones fail with failed to start SSH session: Unable to exchange encryption keys.
• The images now scan the host's ed25519, ecdsa and rsa keys, in both the Debian and Alpine server images.
• If you build your own image or mount your own known_hosts, include an ed25519 or ecdsa line for github.com, or the same failure applies.

Images on Python 3.12, and a dnspython floor (#993)

• The Docker images move from Python 3.10 to 3.12 (3.12.16 at build time). Python 3.10 reached end of life on 2026-10-01. The packages themselves still support 3.10; only the images change. If you build FROM permitio/opal-* and pip install your own packages, they now install for Python 3.12.
• dnspython is floored at 2.9.0 on Python 3.11 and later (it comes in through pydantic[email]), for CVE-2026-114605 (GHSA-45c3-73f7-pv4m).

How to opt in

Docker: every image is published under the 0.10.0-rc.5 tag, plus -alpine:

permitio/opal-server:0.10.0-rc.5
permitio/opal-client:0.10.0-rc.5
permitio/opal-client-standalone:0.10.0-rc.5
permitio/opal-client-cedar:0.10.0-rc.5
permitio/opal-client-eopa:0.10.0-rc.5

pip: pre-releases are skipped unless you ask for them:

pip install --pre opal-client        # or: opal-client==0.10.0rc5
pip install --pre opal-server