Skip to content

Bump github.com/open-policy-agent/opa from 1.13.2 to 1.14.1#3

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/github.com/open-policy-agent/opa-1.14.1
Open

Bump github.com/open-policy-agent/opa from 1.13.2 to 1.14.1#3
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/github.com/open-policy-agent/opa-1.14.1

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Mar 14, 2026

Bumps github.com/open-policy-agent/opa from 1.13.2 to 1.14.1.

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.14.1

This is a patch release collecting two bug fixes and various dependency updates for Golang standard library and common package vulnerabilities.

These bug fixes include a revert of the rule indexer tweaks shipped in 1.14.0, which had caused unexpected lookup failures for some users. (We expect to properly fix the issue in 1.15.0, but for now, a revert is the quicker choice.)

Changes

  • Fix intermittent plugins manager deadlock on opa.configure (#8407)
  • Revert "ast: make rule index track var assignments and x in {...} (#8341)" (#8410)
  • build: bump deps (go.mod from main)
  • build: bump go 1.26.1 (#8409)

v1.14.0

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • Improved rule indexing of variable assignments and x in {...} expressions
  • Support for --h2c with unix domain socket for opa run
  • A new glossary tooltip for technical terms in the docs
  • Fixes published in the v1.13.1 and v1.13.2 releases

Improved rule indexing of variable assignments and x in {...} expressions (#1841)

With this change, the rule indexer will index expressions like:

allow if input.role in {"admin", "user"}

On lookup, the rule body will only be returned if input.role is either one of "admin" or "user".

The reverse case is also indexed:

allow if "admin" in input.roles

in which the searched collection is unknown.

Authored by @​srenatus reported by @​nischalsheth

Runtime, SDK, Tooling

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.14.1

This is a patch release collecting two bug fixes and various dependency updates for Golang standard library and common package vulnerabilities.

These bug fixes include a revert of the rule indexer tweaks shipped in 1.14.0, which had caused unexpected lookup failures for some users. (We expect to properly fix the issue in 1.15.0, but for now, a revert is the quicker choice.)

Changes

  • Fix intermittent plugins manager deadlock on opa.configure (#8407)
  • Revert "ast: make rule index track var assignments and x in {...} (#8341)" (#8410)
  • build: bump deps (go.mod from main)
  • build: bump go 1.26.1 (#8409)

1.14.0

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • Improved rule indexing of variable assignments and x in {...} expressions
  • Support for --h2c with unix domain socket for opa run
  • A new glossary tooltip for technical terms in the docs
  • Fixes published in the v1.13.1 and v1.13.2 releases

Improved rule indexing of variable assignments and x in {...} expressions (#1841)

With this change, the rule indexer will index expressions like:

allow if input.role in {"admin", "user"}

On lookup, the rule body will only be returned if input.role is either one of "admin" or "user".

The reverse case is also indexed:

allow if "admin" in input.roles

in which the searched collection is unknown.

Authored by @​srenatus reported by @​nischalsheth

Runtime, SDK, Tooling

... (truncated)

Commits
  • 3d1bac4 Patch release v1.14.1
  • 13ef6b8 build: bump deps (go.mod from main)
  • 8836a79 Fix intermittent plugins manager deadlock on opa.configure (#8407)
  • c416fd9 Revert "ast: make rule index track var assignments and x in {...} (#8341)" ...
  • 3d57b2e build: bump go 1.26.1 (#8409)
  • acf81e8 Release v1.14.0 (#8379)
  • b4b04a6 ci: Fix check-changes job skipping over YAML changes. (#8377)
  • 3c5b7c6 docs: Document metrics for http.send, regex, and glob builtins (#8103)
  • 29918f9 rego: disable rule indexing for benchmark
  • 9d124cb ast: Ensure term values implement string lengther (#8374)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 1.13.2 to 1.14.1.
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](open-policy-agent/opa@v1.13.2...v1.14.1)

---
updated-dependencies:
- dependency-name: github.com/open-policy-agent/opa
  dependency-version: 1.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Mar 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants