Sourced from github.com/open-policy-agent/opa's releases.

v0.67.0

This release contains a mix of features, a new builtin function (strings.count), performance improvements, and bugfixes.

Breaking Change

Request Body Size Limits

OPA now automatically rejects very large requests (#6868) authored by @​philipaconrad. Requests with a Content-Length larger than 128 MB uncompressed, and gzipped requests with payloads that decompress to larger than 256 MB will be rejected, as part of hardening OPA against denial-of-service attacks. Previously, a large enough request could cause an OPA instance to run out of memory in low-memory sidecar deployment scenarios, just from attempting to read the request body into memory.

These changes allow improvements in memory usage for the OPA HTTP server, and help OPA deployments avoid some accidental out-of-memory situations.

For most users, no changes will be needed to continue using OPA. However, to control this behavior, two new configuration keys are available: server.decoding.max_length and server.decoding.gzip.max_length. These control the max size in bytes to allow for an incoming request payload, and the maximum size in bytes to allow for a decompressed gzip request payload, respectively.

Here's an example OPA configuration using the new keys:

# Set max request size to 64 MB and max gzip size (decompressed) to be 128 MB.
server:
  decoding:
    max_length: 67108864
    gzip:
      max_length: 134217728

Topdown and Rego

• topdown: New strings.count builtin which returns the number of non-overlapping instances of a substring in a string (#6827) authored by @​Manish-Giri
• format: Produce error when --rego-v1 formatted module has rule name conflicting with keyword (#6833) authored by @​johanfylling
• topdown: Add cap to caches for regex and glob built-in functions (#6828) authored by @​johanfylling. This fixes possible memory leaks where caches grow uncontrollably when large amounts of regexes or globs are generated or originate from the input document.

Runtime, Tooling, SDK

• repl: Add support for correctly loading bundle modules (#6872) authored by @​ashutosh-narkar
• plugins/discovery: Allow un-registration of discovery listener (#6851) authored by @​mjungsbluth. The discovery plugin allows OPA to register a bundle download status listener but previously did not offer a method to unregister that listener
• plugins/logs: Reduce amount of work performed inside global lock in decision log plugin (#6859) authored by @​johanfylling
• plugins/rest: Add a new client credential attribute to support Azure Workload Identity. This would allow workloads deployed on an Azure Kubernetes Services (AKS) cluster to authenticate and access Azure cloud resources (#6802) authored by @​ledbutter
• cmd/inspect: Add ability for opa inspect to inspect a single file outside of any bundle (#6873) authored by @​tjons
• cmd+bundle: Add --follow-symlinks flag to the opa build command to allow users to build directories with symlinked files, and have the contents of those symlinked files included in the built bundle (#6800) authored by @​tjons
• server: Add missing handling in the server for the explain=fails query value (#6886) authored by @​acamatcisco

Docs, Website, Ecosystem

• docs: Update bundle section with an example of a manifest with rego_version and file_rego_versions attributes (#6885) authored by @​ashutosh-narkar
• docs: Better link language SDKs to make them more discoverable (#6866) authored by @​charlieegan3

Miscellaneous

... (truncated)

Sourced from github.com/open-policy-agent/opa's changelog.

0.67.0

This release contains a mix of features, a new builtin function (strings.count), performance improvements, and bugfixes.

Breaking Change

Request Body Size Limits

OPA now automatically rejects very large requests (#6868) authored by @​philipaconrad. Requests with a Content-Length larger than 128 MB uncompressed, and gzipped requests with payloads that decompress to larger than 256 MB will be rejected, as part of hardening OPA against denial-of-service attacks. Previously, a large enough request could cause an OPA instance to run out of memory in low-memory sidecar deployment scenarios, just from attempting to read the request body into memory.

These changes allow improvements in memory usage for the OPA HTTP server, and help OPA deployments avoid some accidental out-of-memory situations.

For most users, no changes will be needed to continue using OPA. However, to control this behavior, two new configuration keys are available: server.decoding.max_length and server.decoding.gzip.max_length. These control the max size in bytes to allow for an incoming request payload, and the maximum size in bytes to allow for a decompressed gzip request payload, respectively.

Here's an example OPA configuration using the new keys:

# Set max request size to 64 MB and max gzip size (decompressed) to be 128 MB.
server:
  decoding:
    max_length: 67108864
    gzip:
      max_length: 134217728

Topdown and Rego

• topdown: New strings.count builtin which returns the number of non-overlapping instances of a substring in a string (#6827) authored by @​Manish-Giri
• format: Produce error when --rego-v1 formatted module has rule name conflicting with keyword (#6833) authored by @​johanfylling
• topdown: Add cap to caches for regex and glob built-in functions (#6828) authored by @​johanfylling. This fixes possible memory leaks where caches grow uncontrollably when large amounts of regexes or globs are generated or originate from the input document.

Runtime, Tooling, SDK

• repl: Add support for correctly loading bundle modules (#6872) authored by @​ashutosh-narkar
• plugins/discovery: Allow un-registration of discovery listener (#6851) authored by @​mjungsbluth. The discovery plugin allows OPA to register a bundle download status listener but previously did not offer a method to unregister that listener
• plugins/logs: Reduce amount of work performed inside global lock in decision log plugin (#6859) authored by @​johanfylling
• plugins/rest: Add a new client credential attribute to support Azure Workload Identity. This would allow workloads deployed on an Azure Kubernetes Services (AKS) cluster to authenticate and access Azure cloud resources (#6802) authored by @​ledbutter
• cmd/inspect: Add ability for opa inspect to inspect a single file outside of any bundle (#6873) authored by @​tjons
• cmd+bundle: Add --follow-symlinks flag to the opa build command to allow users to build directories with symlinked files, and have the contents of those symlinked files included in the built bundle (#6800) authored by @​tjons
• server: Add missing handling in the server for the explain=fails query value (#6886) authored by @​acamatcisco

Docs, Website, Ecosystem

• docs: Update bundle section with an example of a manifest with rego_version and file_rego_versions attributes (#6885) authored by @​ashutosh-narkar
• docs: Better link language SDKs to make them more discoverable (#6866) authored by @​charlieegan3

... (truncated)

• b62ae6b Prepare v0.67.0 release
• bec8e1a build(deps): bump github/codeql-action from 3.25.13 to 3.25.14 (#6888)
• d48fdd9 server: Add missing handling for explain=fails to the REST API.
• 959f9e5 docs: Add an example of a manifest with attribute
• a793f27 repl: Add support for correctly loading bundle modules
• c5706ee server+util: Limit max request sizes, prealloc request buffers (#6868)
• 0ca35e2 build(deps): bump docker/setup-buildx-action from 3.4.0 to 3.5.0 (#6880)
• f9ccb66 build(deps): bump github/codeql-action from 3.25.12 to 3.25.13 (#6881)
• 0db1f8f build(deps): bump docker/setup-qemu-action from 3.1.0 to 3.2.0 (#6882)
• ac3ddf9 docs: Update generated CLI docs
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)