permitio/opal 0.9.10-rc.1

on GitHub

Release candidate for a 0.9.10 patch release on the 0.9 line (pydantic v1), built from release/0.9.x.

What's Changed

• fix: redact auth values in client logs, admit Python 3.13 by @zeevmoney in #969

Highlights:

• Auth values stay out of client logs and reports: errors are logged and stored as Type: message with credentials masked, instead of repr(), which includes the request headers. Log lines mask Authorization headers, Bearer/Basic values and sensitive query params. The report sent to callback URLs no longer carries each entry's fetcher config or inline data, and entry.url is redacted.
• Responses and config output: 401 bodies no longer echo the presented token. print-config, debug_repr() and --help show sensitive config entries as <redacted>. Invalid OPAL_* or CLI values raise errors that name the key but not the value.
• Python 3.13: opal-common and opal-client now install on Python 3.9–3.13. opal-server stays below 3.13.

Visible to consumers:

• the callback payload drops entry.config and entry.data, and entry.url is redacted;
• 401 bodies drop detail.token;
• logged error strings change from repr form to Type: message, including in the OPA health-check policy's error field;
• a bad config value raises ValueError instead of ValidationError.

The same changes are on master (0.10 line) in #968.

Full Changelog: 0.9.9...0.9.10-rc.1