Release v0.62.1 (#6618)

Signed-off-by: Stephan Renatus <stephan@styra.com>

CHANGELOG.md

@@ -3,7 +3,31 @@
 All notable changes to this project will be documented in this file. This
 project adheres to [Semantic Versioning](http://semver.org/).
 
-## Unreleased
+## 0.62.1
+
+This is a security fix release for the fixes published in [Golang 1.22.1](https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg).
+
+OPA servers using `--authentication=tls` would be affected: crafted malicious client
+certificates could cause a panic in the server.
+
+Also, crafted server certificates could panic OPA's HTTP clients, in bundle plugin,
+status and decision logs; and `http.send` calls that verify TLS.
+
+This affects all crypto/tls clients, and servers that set Config.ClientAuth to
+VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is
+for TLS servers to not verify client certificates.
+
+This is CVE-2024-24783 (https://pkg.go.dev/vuln/GO-2024-2598).
+
+Note that there are other security fixes in this Golang release, but whether or not
+OPA is affected is harder to tell. An update is advised.
+
+
+### Miscellaneous
+
+- Add Trino to OPA ecosystem (authored by @mosabua)
+- update: ADOPTERS.md (#6608) (authored by @fredmaggiowski)
+
 
 ## 0.62.0
 

version/version.go

@@ -11,7 +11,7 @@ import (
 )
 
 // Version is the canonical version of OPA.
-var Version = "0.63.0-dev"
+var Version = "0.62.1"
 
 // GoVersion is the version of Go this was built with
 var GoVersion = runtime.Version()

version/version_go1.18.go

@@ -1,8 +0,0 @@
-// Copyright 2022 The OPA Authors.  All rights reserved.
-// Use of this source code is governed by an Apache2
-// license that can be found in the LICENSE file.
-
-//go:build go1.18
-// +build go1.18
-
-package version