Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package opa for openSUSE:Factory checked in at 2026-08-29 17:43:06 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/opa (Old) and /work/SRC/openSUSE:Factory/.opa.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "opa" Sat Aug 29 17:43:06 2026 rev:27 rq:1374549 version:1.20.1 Changes: -------- --- /work/SRC/openSUSE:Factory/opa/opa.changes 2026-08-01 18:35:55.369447730 +0200 +++ /work/SRC/openSUSE:Factory/.opa.new.1265/opa.changes 2026-08-29 17:44:12.943979332 +0200 @@ -1,0 +2,262 @@ +Fri Aug 28 17:06:59 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 1.20.1: + * This release includes a bug fix for a regression introduced in + v1.20.0 in comparing a number to some float values. + https://github.com/open-policy-agent/opa/issues/9098 +- Update to version 1.20.0: + * This release contains a mix of new features and bug fixes. + Notably: + - New Rego keywords: and and or, for combining conditions + inside a single rule body + - allow_net now restricts remote JSON Schema $ref fetching from + json.match_schema and json.verify_schema + - Coverage reports can now explain why a range is not covered + - Much faster partial evaluation for dynamically composed + policies + * New Rego keywords: and and or (#7602) + Rego gains two keywords for combining conditions inside a + single rule body — a long-standing request, and one of the + larger additions to the language in some time. and and or let + control flow that previously had to be split across helper + rules stay where it is read. + Before, a rule body that needed to succeed on one of several + conditions meant extracting a rule: + + package example + + allow if { + input.method == "GET" + admin_or_public_owner + } + + admin_or_public_owner if input.user.admin + + admin_or_public_owner if { + input.user.owner + input.resource.public + } + + Now: + + package example + + import future.keywords.and + import future.keywords.or + + # the and groups first, so this reads as: + # an admin, or an owner of a public resource + allow if { + input.method == "GET" + input.user.admin or input.user.owner and input.resource.public + } + + Both keywords are opt-in future keywords: + https://www.openpolicyagent.org/docs/policy-reference/keywords/import#importing-future-keywords + + import future.keywords.and, import future.keywords.or, or import future.keywords for both. + + An and/or expression either succeeds or fails; it never + produces a value. So you can't assign one to a variable, pass + one to a function, or use one as the head of a comprehension. + Operands can read variables from the rule body around them, but + can't create new ones for the rest of the rule to use — wrap an + operand in braces to give it a body of its own, and any + variables it creates stay inside those braces. Only as much is + evaluated as needed: if the left side settles the outcome, the + right side is skipped. And when both sides of an or succeed, + you still get a single result; evaluation doesn't split in two. + Further reading: + - Rego Keywords: and, or — the full reference + - Precedence and grouping — how the operators group, and where + parentheses are needed + - Combining with not + - Incremental rules — the idiom when the alternatives must + produce a value + * Behavior change: allow_net applies to remote JSON Schema $refs + (#8979) + The allow_net capability restricts which hosts remote JSON + Schema $refs may be fetched from, but it was only wired up on + the compile-time type-checking path. Policies using neither -s + schemas nor + # METADATA schemas: + annotations never reached it, and an unset allowlist permitted + every host — so json.match_schema and json.verify_schema, + which compile schemas at evaluation time, fetched $refs from + anywhere. Their schema argument can come from input, so the + host was not necessarily under the policy author's control. + The allowlist now travels with the schema loader and is checked + per caller at any nesting depth. + Every redirect hop is checked too, matching http.send, and the + inter-query cache key includes the allowlist so a permissive + caller cannot populate the cache for a restrictive one. + * Coverage reports explain why a range is not covered (#8937) + Coverage reports showed that a range was uncovered, but not + why: ranges skipped by rule indexing or early exit looked + identical to dead code. + Not-covered ranges are now tagged with a Kind — index_excluded + or early_exit — determined by re-evaluating with each + optimization disabled and diffing the extra coverage data. Both + supplementary passes run by default when --coverage is set; the + new --coverage-runs flag on opa eval and opa test selects which + of them to run, and an empty list disables them. + * Runtime, SDK, Tooling + - bundle: Fix roots containing percent-encoded characters + (#6704) + - compile: Validate plan-addons exist (#9092) + - config: Migrate server.encoding and server.decoding + validation to Rego (#8903) + - debug: Allow configuring variable value length limit (#8907) + - format: Add support for formatting and/or logical expressions + (#8683) reported and + - format: Converge object comprehension layout (#9075) reported + and + - format: Don't group rules that aren't written on one line + (#8981) + - format: Don't unwrap one-line rule body braces from a single + set term (#8972) + - format: Honor line breaks before explicit and/or operand + bodies (#9053) + - format: Keep parens around a nested not operand (#9079) + - format: Wrap set union | infix in parens when output would be + re-interpreted as comprehension (#8977) + - format: Write added imports before rules (#9083) + - loader: Fix loading absolute paths on Windows (#4521) + - oracle: Support and/or logical keywords (#8819) reported and + - plugins: Avoid predictable OCI temp store (#8853) + - plugins: Fix overly verbose return of errors (#9090) + - rego: Pass capabilities to the parser in + (*Rego).compileModules (#9059) + - repl: Add support for and/or imports (#9066) reported and + - repl: Allow interactive ref head rule definitions (#5498) + - runtime: Allow registering hooks, and pass them to discovery + (#9064) + - server: Decouple decision logging from request context + cancellation (#9023) + - wasm: Address regression causing memory corruption (#8995) + * Compiler, Topdown and Rego + - ast: Allow non-infix and()/or() set built-in calls (#9012) + - ast: Correct regression in Ruleset Add (#9027) + - ast: Don't index away rules with a nested print call (#9038) + - ast: Don't leak generated locals for calls in ref type errors + (#4577) + - ast: Don't leak generated locals in ref type errors (#8897) + - ast: Don't report type errors for documents replaced by with + (#2903) + - ast: Fix future.keywords wildcard import not including the + not keyword (#9093) + - ast: Fix panic for shadowed root document calls in Rego v0 + (#9067) reported and + - ast: Index rules with and/or expressions (#8997) + - ast: Name the enclosing rule in unsafe var errors on shared + lines (#4967) + - ast: Only re-parse brace-led set terms as rule bodies (#8974) + - ast: Print undeclared var names (#5624) + - ast: Reject print calls as and/or operands (#9047) + - ast: Reject assignments in implicit not, and and or bodies + (#9069) + - ast: Reject bare ambiguous { ... | ... } not operands (#8978) + - ir: Add end locations in plan statements (#9007) + - ir: Add list of unplanned rules to plan data (#9031) + - topdown,tester: Don't put shared interned refs into mutable + ASTs (#9048) + - topdown: A few tracing/profiling improvements (#9010) + - topdown: Clean up http.send implementation (#8975) + - topdown: Don't yield a key in both base and virtual docs + twice (#4787) + - topdown: Error on built-in calls with unevaluated operands + (#3680) + - topdown: Fix false modulo by zero for multiples of 2^64 + (#8989) + - topdown: Fix negation inlining limit overflowing (#9036) + - topdown: Fix sum overflow when integer elements fit int64 but + the sum does not (#6281) + - topdown: Save enumerated refs over unknown data (#5471) + - topdown: Speed up partial evaluation of dynamically composed + policies (#5216) + - topdown: Treat an empty JSON Schema enum as unsatisfiable + (#8910) + - ast: Add Equal implementation for *object (#9025) + - ast: Add sync pool for strings.Reader (#9016) + - ast: Avoid excessive save/restore calls in parser (#9018) + - ast: Bucket built-in name lookup by ref shape (#9034) + - ast: Fix performance regression in InterfaceToValue (#9021) + - ast: Remove a few unnecessary allocations (#9009) + - ast: Use pointer comparison in Equal methods (#9020) + - eval: Catch booleans trying to escape to the heap (#8968) + - perf: Allocate less in ast.NewObject (#9035) + - perf: Heap allocation hunting (#9082) + - perf: Improved UUID implementation (#9039) + - topdown: Various io.Writer improvements (#9017) + * Docs, Website, Ecosystem + - docs/ecosystem: Add Scanara to the ecosystem page (#9094) + - docs/ecosystem: Describe what GOPAL actually covers (#9080) + - docs/policy-reference: Add examples for common built-ins + (#8913) + - docs/website: Refresh Apache APISIX ecosystem resources + (#8957) + - docs: Add endswith and replace built-in examples (#8991) + - docs: Add split and lower built-in examples (#8992) + - docs: Clarify glob.match indexing requirements (#8209) + - docs: Document and/or keywords (#8682) reported and + - docs: Highlight and/or keywords in Rego syntax (#9002) + - docs: Improve to_number built-in description (#8984) + - docs: Keep snippets highlighted while they are edited (#8431) + * Miscellaneous + - ast: Annotations code cleanup (#9049) + - ast: Enable modernize linter for golangci-lint (#8996) + - ast: Enable static check of consistent receiver names (#9008) + - ast: Move global builtin.Ref() vars to a single location + (#9040) + - ast: Move interning experiment behind noisy tag (#9034) + - ast: Replace use of sort package with modern alternatives + (#9013) + - ast: Use slices.CompareFunc for imports and annotations + (#9019) + - build/release: Create new release tool (#8959) + - build(go): Modernize for the Go 1.26 standard library (#9056) + - bundle: Use util.WithPrefix (#9005) + - ci: Migrate proto-check to bufbuild/buf-action (#9030) + - ci: Serialize benchmarks workflow to avoid racing writes to + benchmarks branch (#9065) + - lint: Enable all usetesting options (#9072) + - lint: Remove intrange linter, as it's covered by modernize + (#9014) + - releng: Sample benchmarks from 15 processes, not 3 (#9034) + - releng: Update post-merge benchmark regression check (#9029) + - server_test: Adjust test to avoid flakey decision log test + outcome (#9026) + - test: Clean up irrelevant nolint directives (#9050) + - test: Restore print-based and/or short-circuit tests (#9057) + - topdown: Add uri built-in compliance cases for parser edge + cases (#8980) + - topdown: Cover uuid.parse input format leniency (#9003) + - topdown: Modernize fixes and some string building + improvements (#8993) + - util: Don't return a nil slice from StringToByteSlice("") + (#9091) + - Dependency updates; notably: + - build(go): Bump the build toolchain to Go 1.27, and the + go.mod language version to 1.26 (#9051) + - build(deps): Bump github.com/dgraph-io/badger/v4 from 4.9.4 + to 4.9.5 + - build(deps): Bump github.com/prometheus/client_golang from + 1.24.0 to 1.24.1 + - build(deps): Bump go.opentelemetry.io/proto/otlp from + 1.10.0 to 1.11.0 +- Update to version 1.19.1: + This release uses the latest version of Go (1.26.6) to build OPA, + fixing stdlib vulnerabilities in code that OPA's HTTP handler and + crypto builtins use: + - https://pkg.go.dev/vuln/GO-2026-6218 + - https://pkg.go.dev/vuln/GO-2026-6091 + - https://pkg.go.dev/vuln/GO-2026-6090 + - https://pkg.go.dev/vuln/GO-2026-6089 + - https://pkg.go.dev/vuln/GO-2026-6088 + - https://pkg.go.dev/vuln/GO-2026-5972 + - https://pkg.go.dev/vuln/GO-2026-5026 + It is otherwise the same code as v1.19.0. + * Miscellaneous + - build(go): bump to 1.26.6 + +------------------------------------------------------------------- Old: ---- opa-1.19.0.obscpio New: ---- opa-1.20.1.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ opa.spec ++++++ --- /var/tmp/diff_new_pack.TtnA3S/_old 2026-08-29 17:44:14.350029066 +0200 +++ /var/tmp/diff_new_pack.TtnA3S/_new 2026-08-29 17:44:14.352029137 +0200 @@ -17,7 +17,7 @@ Name: opa -Version: 1.19.0 +Version: 1.20.1 Release: 0 Summary: Open source, general-purpose policy engine License: Apache-2.0 @@ -26,7 +26,7 @@ Source1: vendor.tar.gz BuildRequires: bash-completion BuildRequires: fish -BuildRequires: go1.26 >= 1.26.5 +BuildRequires: go1.26 >= 1.26.6 BuildRequires: zsh %description ++++++ _service ++++++ --- /var/tmp/diff_new_pack.TtnA3S/_old 2026-08-29 17:44:14.398030764 +0200 +++ /var/tmp/diff_new_pack.TtnA3S/_new 2026-08-29 17:44:14.403030941 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/open-policy-agent/opa.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v1.19.0</param> + <param name="revision">refs/tags/v1.20.1</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.TtnA3S/_old 2026-08-29 17:44:14.426031754 +0200 +++ /var/tmp/diff_new_pack.TtnA3S/_new 2026-08-29 17:44:14.429031861 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/open-policy-agent/opa</param> <param name="changesrevision">cc2c5c60a4c486f15a5e8de457e96ed0fefaf5fe</param></service><service name="tar_scm"> <param name="url">https://github.com/open-policy-agent/opa.git</param> - <param name="changesrevision">1e32c796e8979b1bda2f768138500b1deb95ff24</param></service></servicedata> + <param name="changesrevision">72f30d678c4fc1ff1eef8b5f11b1220761d16d0b</param></service></servicedata> (No newline at EOF) ++++++ opa-1.19.0.obscpio -> opa-1.20.1.obscpio ++++++ ++++ 73138 lines of diff (skipped) ++++++ opa.obsinfo ++++++ --- /var/tmp/diff_new_pack.TtnA3S/_old 2026-08-29 17:44:18.293168542 +0200 +++ /var/tmp/diff_new_pack.TtnA3S/_new 2026-08-29 17:44:18.298168719 +0200 @@ -1,5 +1,5 @@ name: opa -version: 1.19.0 -mtime: 1785440334 -commit: 1e32c796e8979b1bda2f768138500b1deb95ff24 +version: 1.20.1 +mtime: 1787901934 +commit: 72f30d678c4fc1ff1eef8b5f11b1220761d16d0b ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/opa/vendor.tar.gz /work/SRC/openSUSE:Factory/.opa.new.1265/vendor.tar.gz differ: char 142, line 1
