Update a number of links to their new location (#8100)

* Update a number of links to their new location https://github.com/open-policy-agent/opa/issues/8091 highlighted a number of 'broken' links that are just redirects. I have updated many of these in this PR. Hopefully next time, the broken link report will be easier to parse. Signed-off-by: Charlie Egan <charlie_egan@apple.com> * Update docs/docs/policy-performance.md Co-authored-by: Stephan Renatus <s_renatus@apple.com> Signed-off-by: Charlie Egan <git@charlieegan3.com> --------- Signed-off-by: Charlie Egan <charlie_egan@apple.com> Signed-off-by: Charlie Egan <git@charlieegan3.com> Co-authored-by: Stephan Renatus <s_renatus@apple.com>
2026-08-12 19:32:48 -06:00 · 2025-12-02 11:06:38 +00:00
parent c246f71a61
commit efae5d1b58
88 changed files with 179 additions and 179 deletions
@@ -44,7 +44,7 @@ production users that have added themselves (in alphabetical order):
  information stored on namespaces. OPA is deployed on multiple
  clusters with ~100 nodes and ~300 namespaces total.

-* [BNY Mellon](https://www.bnymellon.com/) uses OPA as a sidecar to enforce access
+* [BNY Mellon](https://www.bny.com/corporate/global/en.html) uses OPA as a sidecar to enforce access
  control over applications based on external context coming from AD and other
  internal services. For more information see this talk from [QCon 2019](https://www.infoq.com/presentations/opa-spring-boot-hocon/).

@@ -112,7 +112,7 @@ production users that have added themselves (in alphabetical order):
  [Config Controller](https://cloud.google.com/kubernetes-engine/enterprise/policy-controller),
  [GKE Policy Automation](https://github.com/google/gke-policy-automation) or
  [Config Validator](https://github.com/GoogleCloudPlatform/policy-library). See
-  [Creating policy-compliant Google Cloud resources article](https://cloud.google.com/kubernetes-engine/enterprise/policy-controller/docs/how-to/creating-policy-controller-constraints)
+  [Creating policy-compliant Google Cloud resources article](https://docs.cloud.google.com/kubernetes-engine/policy-controller/docs/how-to/creating-policy-controller-constraints)
  for example use cases.

 * [Infracost](https://www.infracost.io/) shows cloud cost estimates for Terraform.
@@ -176,7 +176,7 @@ production users that have added themselves (in alphabetical order):

 * [Plex Systems](https://www.plex.com) uses OPA to enforce policy throughout
  their entire release process; from local development to continuous production
-  audits. The CI/CD pipelines at Plex leverage [conftest](https://github.com/instrumenta/conftest),
+  audits. The CI/CD pipelines at Plex leverage [conftest](https://github.com/open-policy-agent/conftest),
  a policy enforcement tool that relies on OPA, to automatically reject changes that do not adhere
  to defined policies. Plex also uses
  [Gatekeeper](https://github.com/open-policy-agent/gatekeeper), a Kubernetes policy controller, as
@@ -196,25 +196,25 @@ production users that have added themselves (in alphabetical order):
  etc. SAP/Infrabox is used in production within SAP and has several
  external users.

-* [Terminus Software](https://terminus.com/) uses OPA for microservice authorization.
+* [Terminus Software](https://demandscience.com/?utm_campaign=terminus-redirect) uses OPA for microservice authorization.

 * [T-Mobile](https://www.t-mobile.com) uses OPA as a core component for their
  [MagTape](https://github.com/tmobile/magtape/) project that enforces best
  practices and secure configurations across their fleet of Kubernetes
-  clusters (more info in [this blog post](https://opensource.t-mobile.com/blog/posts/rolling-out-the-magenta-tape/)).
+  clusters (more info in [this blog post](https://www.t-mobile.com/)).
  T-Mobile also leverages OPA to enforce authorization workflows within their
  Corporate Delivery Platform (CI/CD).

-* [Tremolo Security](https://www.tremolosecurity.com/) uses OPA at a
+* [Tremolo Security](https://www.tremolo.io/) uses OPA at a
  London-based financial services company to inject annotations and
  volume mount parameters into Kubernetes Pods so that workloads can
  connect to off-cluster CIFS drives and SQL Server
  instances. Policies are based on external context sourced from
  OpenUnison. Ability to validate policies offline is a huge win
  because the clusters are air-gapped. For more information on how
-  Tremolo Security uses OPA see [this blog post](https://www.tremolosecurity.com/beyond-rbac-in-openshift-open-policy-agent/).
+  Tremolo Security uses OPA see [this blog post](https://www.tremolo.io/beyond-rbac-in-openshift-open-policy-agent/).

-* [Tripadvisor](http://tripadvisor.com/) uses OPA to enforce
+* [Tripadvisor](https://tripadvisor.com/) uses OPA to enforce
  admission control policies in Kubernetes. In the process of rolling out OPA,
  they created an integration testing framework that verifies clusters are accepting
  and rejecting the right objects when OPA is deployed. For more information see
@@ -230,7 +230,7 @@ production users that have added themselves (in alphabetical order):
  have propagated. For more details on the VGS use case see this
  [blog post](https://www.verygoodsecurity.com/blog/posts/building-a-fine-grained-permission-system-in-a-distributed-environment).

-* [VNG Cloud](https://www.vngcloud.vn/en/home) [Identity and Access Management (IAM)](https://iam.vngcloud.vn/)
+* [VNG Cloud](https://www.vngcloud.vn/en/home) [Identity and Access Management (IAM)](https://iam.console.vngcloud.vn/)
  use OPA as a policy-based decision engine for authorization. IAM provides administrators with fine-grained 
  access control to VNG Cloud resources and help centralize and manage permissions to access resources. 
  Specifically, OPA is integrated to evaluate policies to make the decision about denying or allowing incoming requests.
@@ -240,9 +240,9 @@ production users that have added themselves (in alphabetical order):
  automatically correlates the entire security stack to uncover the most pressing issues.
  Wiz policies leverage Open Policy Agent (OPA) for a unified framework across the
  cloud-native stack. Whether for configurations, compliance, IaC, and more, OPA enables
-  teams to move faster in the cloud. For more information on how Wiz uses OPA, [contact Wiz](https://www.wiz.io/contact/).
+  teams to move faster in the cloud. For more information on how Wiz uses OPA, [contact Wiz](https://www.wiz.io/contact).

-* [Xenit AB](https://www.xenit.se/) uses OPA to implement fine-grained control
+* [Xenit AB](https://xenit.se/) uses OPA to implement fine-grained control
  over resource formulation in its managed Kubernetes service as well as several
  customer-specific implementations. For more information, see the Kubernetes Terraform library
  [OPA Gatekeeper module](https://github.com/XenitAB/terraform-modules/tree/main/modules/kubernetes/gatekeeper) and
@@ -270,7 +270,7 @@ pre-production (in alphabetical order):
  [OPA Runtime](https://github.com/aserto-dev/runtime) that make it easier for
  developers to incorporate OPA policies and the OPA engine into their applications.

-* [Cyral](https://www.cyral.com/) is a venture-funded data security
+* [Cyral](https://www.varonis.com/platform/database-activity-monitoring) is a venture-funded data security
  company. Still in stealth mode but using OPA to manage and enforce
  fine-grained authorization policies.

@@ -284,7 +284,7 @@ pre-production (in alphabetical order):

 * [Scalr](https://scalr.com/) is a remote operations backend for Terraform
  that helps users scale their Terraform usage through automation and collaboration.
-  [Scalr uses OPA](https://docs.scalr.com/en/latest/opa.html) to validate Terraform
+  [Scalr uses OPA](https://docs.scalr.io/docs/introduction) to validate Terraform
  code against organization standards and allows for approvals prior to a Terraform apply.

 * [Spacelift](https://spacelift.io) is a specialized CI/CD platform
@@ -303,9 +303,9 @@ testing include:
 * [Cisco](https://www.cisco.com/)
 * [Nefeli Networks](https://nefeli.io)
 * [SolarWinds](https://www.solarwinds.com/) via [Lee Calcote](https://github.com/leecalcote)
-* [State Street Corporation](http://www.statestreet.com/)
-* [PITS Global Data Recovery Services](https://www.pitsdatarecovery.net/)
+* [State Street Corporation](https://www.statestreet.com/us/en)
+* [PITS Global Data Recovery Services](https://www.pitsdatarecovery.com/)

 If you have adopted OPA and would like to be included in this list,
 feel free to submit a PR updating this file or
-[open an issue](https://github.com/open-policy-agent/opa/issues/new?assignees=&labels=adopt-opa&template=adopt-opa.yaml&title=organization_name+has+adopted+OPA).
+[open an issue](https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fopen-policy-agent%2Fopa%2Fissues%2Fnew%3Fassignees%3D%26labels%3Dadopt-opa%26template%3Dadopt-opa.yaml%26title%3Dorganization_name%2Bhas%2Badopted%2BOPA).
@@ -1,6 +1,6 @@
 # OPA Community Guidelines v2.0

-The [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md) is enforced in all areas of the OPA community, plus the following.
+The [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md) is enforced in all areas of the OPA community, plus the following.

 ## Relevancy

@@ -2,5 +2,5 @@

 Thanks for your interest in contributing to the Open Policy Agent (OPA) project!

-Please refer to [OPA's contribution guidelines](https://www.openpolicyagent.org/docs/latest/contributing/)
+Please refer to [OPA's contribution guidelines](https://www.openpolicyagent.org/docs/contributing)
 to find out how you can help.
@@ -1,6 +1,6 @@
 # Documentation and Website Development

 Please see the
-[contributing documentation](http://openpolicyagent.org/docs/contrib-docs)
+[contributing documentation](https://www.openpolicyagent.org/docs/contrib-docs)
 for information about how to get started contributing to the OPA documentation
 and website.
@@ -1,4 +1,4 @@
 ## Development

 The development guide has become part of the Contributing documentation
-and can be found [here](https://www.openpolicyagent.org/docs/contrib-development/).
+and can be found [here](https://www.openpolicyagent.org/docs/contrib-development).
@@ -57,7 +57,7 @@ standard GitHub fork workflow. See [OPA Dev Instructions](DEVELOPMENT.md)
 	git checkout -b release-v<version> origin/main
 	```

-1. Create a [personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)
+1. Create a [personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens)
   for GitHub with the 'read:org' scope. Export it to the `GITHUB_TOKEN` environment variable.

 1. Execute the release-patch target to generate boilerplate patch. Give the semantic version of the release:
@@ -2,7 +2,7 @@
 title: AWS CloudFormation Hooks
 ---

-[AWS CloudFormation Hooks](https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/hooks.html) allows users to
+[AWS CloudFormation Hooks](https://docs.aws.amazon.com/cloudformation-cli/latest/hooks-userguide/what-is-cloudformation-hooks.html) allows users to
 verify AWS infrastructure components defined in AWS CloudFormation
 [templates](https://aws.amazon.com/cloudformation/resources/templates/), like S3 Buckets or EC2 instances, prior to
 deployment. This is done via **hooks**. Hooks are composed of custom code running in an AWS Lambda function, which is
@@ -12,8 +12,8 @@ AWS currently supports hooks written in either Java or Python, and provides a
 [sample repository](https://github.com/aws-cloudformation/aws-cloudformation-samples), which includes example hooks
 written in both languages. Since we'd rather use OPA for this purpose, we'd need some code to process the requests
 handled by the hook and send them forward to OPA for policy decisions via its
-[REST API](https://www.openpolicyagent.org/docs/latest/rest-api/) using
-the [OPA AWS CloudFormation Hook](https://github.com/StyraInc/opa-aws-cloudformation-hook).
+[REST API](https://www.openpolicyagent.org/docs/rest-api) using
+the [OPA AWS CloudFormation Hook](https://github.com/StyraOSS/opa-aws-cloudformation-hook).

 ## Goals

@@ -35,7 +35,7 @@ In order to complete this tutorial, the following prerequisites needs to be met:
 - Docker
 - OPA server running at an endpoint reachable by the AWS Lambda function, either within the same AWS environment, or
  elsewhere. While developing your CloudFormation policies, a good option is to run OPA locally, but exposed to the
-  public via a service like [tunnelmole](https://tunnelmole.com/docs), an open source tunneling tool or [ngrok](https://ngrok.com/),
+  public via a service like [tunnelmole](https://tunnelmole.com/docs/), an open source tunneling tool or [ngrok](https://ngrok.com/),
  a popular closed source tunneling tool.

 ## Steps
@@ -45,7 +45,7 @@ In order to complete this tutorial, the following prerequisites needs to be met:
 To start out, clone the OPA AWS CloudFormation Hook repository:

 ```shell
-git clone https://github.com/StyraInc/opa-aws-cloudformation-hook.git
+git clone https://github.com/StyraOSS/opa-aws-cloudformation-hook.git
 cd opa-aws-cloudformation-hook
 ```

@@ -447,7 +447,7 @@ bucket_is_private if {
 Note how we no longer need the `bucket_create_or_update` rule, as that is already asserted by the main policy.
 Quite an improvement in terms of readability, and a good foundation for further policy authoring. If you'd like to see
 more examples of policy utilizing this pattern, check out the
-[policy directory](https://github.com/StyraInc/opa-aws-cloudformation-hook/tree/main/examples/policy) in the OPA AWS
+[policy directory](https://github.com/StyraOSS/opa-aws-cloudformation-hook/tree/main/examples/policy) in the OPA AWS
 CloudFormation Hook repo.

 ### OPA Authentication via AWS Secrets
@@ -361,7 +361,7 @@ Following successful authentication at the token endpoint the returned token wil

 Two claims will always be included in the issued JWT: `iat` and `exp`. Any other claims will be populated from the `additional_claims` map.

-The following is an example of using a [Google Cloud Storage](https://cloud.google.com/storage/) bucket as a bundle service backend
+The following is an example of using a [Google Cloud Storage](https://cloud.google.com/storage) bucket as a bundle service backend
 from outside the cloud account (for access from inside the account, see the [GCP Metadata Token](#gcp-metadata-token) section).

 ```yaml
@@ -399,7 +399,7 @@ Consider requiring authentication in order to prevent unauthorized read access t

 ### AWS Signature

-OPA will authenticate with an [AWS Version 4](https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html) or version 4A signature. While version 4 is the default, version 4A must be used when making requests that might be handled by more than one region, such as an [S3 Multi-Region Access Point](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPoints.html). You must use version 4A for this or requests will fail when routed to a different region than the one indicated in a version 4 signature. Furthermore, using version 4a also requires that temporary credentials are retrieved from a [regional AWS STS endpoint](https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html), rather than the global STS endpoint.
+OPA will authenticate with an [AWS Version 4](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html) or version 4A signature. While version 4 is the default, version 4A must be used when making requests that might be handled by more than one region, such as an [S3 Multi-Region Access Point](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPoints.html). You must use version 4A for this or requests will fail when routed to a different region than the one indicated in a version 4 signature. Furthermore, using version 4a also requires that temporary credentials are retrieved from a [regional AWS STS endpoint](https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html), rather than the global STS endpoint.

 Several methods of obtaining the necessary credentials are available; exactly one must be specified to use the AWS signature authentication method.

@@ -427,7 +427,7 @@ Please note that if you are using temporary IAM credentials (e.g. assumed IAM ro
 #### Using Named Profile Credentials

 If specifying `profile_credentials`, OPA will expect to find the `access key id`, `secret access key` and
-`session token` from the [named profiles](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html)
+`session token` from the [named profiles](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html)
 stored in the [credentials](https://docs.aws.amazon.com/sdkref/latest/guide/file-format.html) file on disk. On each
 request OPA will re-read the credentials from the file and use them for authentication.

@@ -452,7 +452,7 @@ On each request, Opa will try to use cached token acquired credentials using the
 #### Using EC2 Metadata Credentials

 If specifying `metadata_credentials`, OPA will use the AWS metadata services for [EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html)
-or [ECS](https://docs.aws.amazon.com/AmazonECS/latest/userguide/task-iam-roles.html)
+or [ECS](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html)
 to obtain the necessary credentials when running within a supported virtual machine/container.

 To use the EC2 metadata service, the IAM role to use and the AWS region for the resource must both
@@ -527,7 +527,7 @@ If specifying `web_identity_credentials`, OPA will expect to find environment va

 ### GCP Metadata Token

-OPA will authenticate with a GCP [access token](https://cloud.google.com/run/docs/securing/service-identity#access_tokens) or [identity token](https://cloud.google.com/run/docs/securing/service-identity) fetched from the [Compute Metadata Server](https://cloud.google.com/compute/docs/storing-retrieving-metadata). When one or more `scopes` is provided an access token is fetched. When a non-empty `audience` is provided an identity token is fetched. An audience or `scopes` array is required.
+OPA will authenticate with a GCP [access token](https://cloud.google.com/run/docs/securing/service-identity#access_tokens) or [identity token](https://cloud.google.com/run/docs/securing/service-identity) fetched from the [Compute Metadata Server](https://docs.cloud.google.com/compute/docs/metadata/overview). When one or more `scopes` is provided an access token is fetched. When a non-empty `audience` is provided an identity token is fetched. An audience or `scopes` array is required.

 When authenticating to native GCP services such as [Google Cloud Storage](https://cloud.google.com/storage) an access token should be used with the appropriate set of scopes required by the target resource. When authenticating to a third party application such as an application hosted on Google Cloud Run an identity token should be used.

@@ -586,7 +586,7 @@ When the given resource (the object in the GCS bucket) contains slashes (/) or o

 ### Azure Managed Identities Token

-OPA will authenticate with an [Azure managed identities](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview) token.
+OPA will authenticate with an [Azure managed identities](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview) token.
 The [token request](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http)
 can be configured via the plugin to customize the base URL, API version, and resource. Specific managed identity IDs can be optionally provided as well.
 (The token request for [Azure App Service](https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity?tabs=portal%2Chttp#connect-to-azure-services-in-app-code) or
@@ -602,7 +602,7 @@ but the endpoint and the header are different. Please see the individual documen
 | `services[_].credentials.azure_managed_identity.client_id`   | `string` | No       | Optional client ID of the managed identity you would like the token for. Required, if your VM has multiple user-assigned managed identities.                                                                                                                                                     |
 | `services[_].credentials.azure_managed_identity.mi_res_id`   | `string` | No       | Optional Azure Resource ID of the managed identity you would like the token for. Required, if your VM has multiple user-assigned managed identities.                                                                                                                                             |

-The following is an example of how to use an [Azure storage account](https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview)
+The following is an example of how to use an [Azure storage account](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview)
 as a bundle service backend.

 > Note that the `x-ms-version` header must be specified for the storage account
@@ -833,7 +833,7 @@ included in the actual bundle gzipped tarball.
 | `decision_logs.service`                            | `string`  | No                                | Name of the service to use to contact remote server. If no `plugin` is specified, and `console` logging is disabled, this will default to the first `service` name defined in the Services configuration.                                                |
 | `decision_logs.partition_name`                     | `string`  | No                                | Deprecated: Use `resource` instead. Path segment to include in status updates.                                                                                                                                                                           |
 | `decision_logs.resource`                           | `string`  | No (default: `/logs`)             | Full path to use for sending decision logs to a remote server.                                                                                                                                                                                           |
-| `decision_logs.reporting.buffer_type`              | `string`  | No (default: `size`)              | Toggles the type of buffer to use. The two available options are "size" or "event". Refer to the [Decision Log Plugin README](https://github.com/open-policy-agent/opa/tree/main/v1/plugins/logs/README.md) for for a detailed comparison.               |
+| `decision_logs.reporting.buffer_type`              | `string`  | No (default: `size`)              | Toggles the type of buffer to use. The two available options are "size" or "event". Refer to the [Decision Log Plugin README](https://github.com/open-policy-agent/opa/blob/main/v1/plugins/logs/README.md) for for a detailed comparison.               |
 | `decision_logs.reporting.buffer_size_limit_events` | `int64`   | No (default: `10000`)             | Decision log buffer size limit by events. OPA will drop old events from the log if this limit is exceeded. By default, 100 events are held. This number has to be greater than zero. Only works with "event" buffer type.                                |
 | `decision_logs.reporting.buffer_size_limit_bytes`  | `int64`   | No (default: `unlimited`)         | Decision log buffer size limit in bytes. OPA will drop old events from the log if this limit is exceeded. By default, no limit is set. Only one of `buffer_size_limit_bytes`, `max_decisions_per_second` may be set. Only works with "size" buffer type. |
 | `decision_logs.reporting.max_decisions_per_second` | `float64` | No                                | Maximum number of decision log events to buffer per second. OPA will drop events if the rate limit is exceeded. Only one of `buffer_size_limit_bytes`, `max_decisions_per_second` may be set.                                                            |
@@ -160,8 +160,8 @@ On each Pull Request, a series of tests will be run to ensure that the code
 is up to standard. Part of this process is also to run vulnerability scanning
 on the code and on the generated container image.

-[Trivy](https://aquasecurity.github.io/trivy/) is used to run the aforementioned
-vulnerability scanning. To install, follow the [installation instructions](https://aquasecurity.github.io/trivy/v0.29.2/getting-started/installation/).
+[Trivy](http://trivy.dev/) is used to run the aforementioned
+vulnerability scanning. To install, follow the [installation instructions](http://trivy.dev/v0.29.2/getting-started/installation/).

 To run the vulnerability scanning, on the code-base, run the following command:

@@ -8,7 +8,7 @@ the [Contributing to OPA](./contrib-code) page first.

 OPA is written in the [Go](https://golang.org) programming language.
 If you are new to Go, consider reading
-[Effective Go](https://golang.org/doc/effective_go.html),
+[Effective Go](https://go.dev/doc/effective_go.html),
 [Go Code Review Comments](https://go.dev/wiki/CodeReviewComments) or
 [How to Write Go Code](https://go.dev/doc/code)
 for guidance on writing idiomatic Go code.
@@ -23,7 +23,7 @@ Requirements:

 ## Getting Started

-After forking the repository and creating a [clone from your fork](https://docs.github.com/en/get-started/quickstart/contributing-to-projects),
+After forking the repository and creating a [clone from your fork](https://docs.github.com/en/get-started/exploring-projects-on-github/contributing-to-a-project),
 just run `make`. This will:

 - Build the OPA binary.
@@ -98,7 +98,7 @@ git push origin somefeature
 > Make sure to use a [good commit message](./contrib-code/#commit-messages).

 Now, submit a Pull Request from your fork.
-See the official [GitHub Documentation](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/creating-a-pull-request-from-a-fork)
+See the official [GitHub Documentation](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request-from-a-fork)
 for instructions to create the request.

 > Hint: You should be prompted to with a "Compare and Pull Request" button
@@ -108,7 +108,7 @@ Once your Pull Request has been reviewed and signed off please squash your
 commits. If you have a specific reason to leave multiple commits in the
 Pull Request, please mention it in the discussion.

-> If you are not familiar with squashing commits, see [the following blog post for a good overview](http://gitready.com/advanced/2009/02/10/squashing-commits-with-rebase.html).
+> If you are not familiar with squashing commits, see [the following blog post for a good overview](https://gitready.com/advanced/2009/02/10/squashing-commits-with-rebase.html).

 ## Benchmarks

@@ -88,7 +88,7 @@ if you need some help setting this up.
 ## Updating Existing Documentation

 Navigate to the
-[docs](https://github.com/open-policy-agent/opa/blob/main/docs/docs)
+[docs](https://github.com/open-policy-agent/opa/tree/main/docs/docs)
 folder in your local environment. Each top level item in the documentation nav
 will have an associated markdown file in the documentation folder. Locate the
 file you wish to update and confirm the title in the YAML frontmatter matches. Once
@@ -138,8 +138,8 @@ The [OPA Ecosystem](/ecosystem/) is a showcase of projects that are built with
 or integrated with OPA. If you have a project that you would like to showcase,
 please open a PR with two files:

- A markdown file in [docs/src/data/ecosystem/entries](https://github.com/open-policy-agent/opa/blob/main/docs/src/data/ecosystem/entries)
- An icon file in [docs/static/img/ecosystem-entry-logos](https://github.com/open-policy-agent/opa/blob/main/docs/static/img/ecosystem-entry-logos)
+- A markdown file in [docs/src/data/ecosystem/entries](https://github.com/open-policy-agent/opa/tree/main/docs/src/data/ecosystem/entries)
+- An icon file in [docs/static/img/ecosystem-entry-logos](https://github.com/open-policy-agent/opa/tree/main/docs/static/img/ecosystem-entry-logos)

 Both files should have the same 'id', e.g. if your project is called `foobar`,
 then the markdown file should be named `foobar.md` and the icon file
@@ -267,7 +267,7 @@ OPA will respond with the greeting from the policy (the pod hostname will differ
 ### Readiness and Liveness Probes

 OPA exposes a `/health` API endpoint that you can configure Kubernetes
-[Readiness and Liveness Probes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/)
+[Readiness and Liveness Probes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/)
 to call. For example:

 <EvergreenCodeBlock>
@@ -38,7 +38,7 @@ This tutorial requires:
 - Docker Engine 18.06.0-ce or newer
 - Docker API version 1.38 or newer
 - `root` or `sudo` access
- Nginx, or any capable [bundle](https://www.openpolicyagent.org/docs/latest/management-bundles/) server
+- Nginx, or any capable [bundle](https://www.openpolicyagent.org/docs/management-bundles) server

 The tutorial has been tested on the following platforms:

@@ -69,7 +69,7 @@ the policy.

 ### 2. Create policy bundle and OPA configuration.

-For the purpose of this example, we are going to use [Nginx](https://www.openpolicyagent.org/docs/latest/management-bundles/#nginx)
+For the purpose of this example, we are going to use [Nginx](https://www.openpolicyagent.org/docs/management-bundles#nginx)
 to serve bundles from the same machine Docker is running on.

 With nginx running, simply build the policy bundle placed into the nginx web root directory.
@@ -12,7 +12,7 @@ OPA-Envoy plugin. If none of these tips work, feel free to join
 ### Benchmarking Queries

 The `opa bench` command evaluates a Rego query multiple times and reports metrics. You can also profile your polices using
-`opa eval` to understand expression evaluation time. More information on improving policy performance can be found [here](https://www.openpolicyagent.org/docs/latest/policy-performance/).
+`opa eval` to understand expression evaluation time. More information on improving policy performance can be found [here](https://www.openpolicyagent.org/docs/policy-performance).

 ### Analyzing Decision Logs

@@ -145,7 +145,7 @@ containers:

 > 💡 Consider specifying CPU and memory resource requests and limits for the OPA and other containers to prevent
 > deployments from resource starvation.
-> You can also start OPA with the [`GOMAXPROCS`](https://golang.org/pkg/runtime)environment variable to limit the number of
+> You can also start OPA with the [`GOMAXPROCS`](https://pkg.go.dev/runtime)environment variable to limit the number of
 > cores that OPA can consume.
 >
 > 💡 The OPA-Envoy plugin can be configured to listen on a UNIX Domain Socket. A complete example of such a setup
@@ -254,7 +254,7 @@ CPU and memory consumed as well as latency added.

 ### Features

-The sample OPA-Envoy deployment described [previously](#opa-envoy-plugin), does not utilize OPA's [decision logs](https://www.openpolicyagent.org/docs/latest/management-decision-logs/)
+The sample OPA-Envoy deployment described [previously](#opa-envoy-plugin), does not utilize OPA's [decision logs](https://www.openpolicyagent.org/docs/management-decision-logs)
 management API that enables periodic reporting of decision logs to remote HTTP servers or local console. Decision logging
 can be enabled by updating the OPA-Envoy configuration, and the guidance provided on this page can be used to
 gather benchmark results.
@@ -12,7 +12,7 @@ This tutorial shows how Istio's AuthorizationPolicy can be configured to delegat
 ## Prerequisites

 This tutorial requires Kubernetes 1.20 or later. To run the tutorial locally ensure you start a cluster with Kubernetes
-version 1.20+, we recommend using [minikube](https://kubernetes.io/docs/getting-started-guides/minikube) or
+version 1.20+, we recommend using [minikube](https://kubernetes.io/docs/setup/) or
 [KIND](https://kind.sigs.k8s.io/).

 The tutorial also requires Istio v1.19.0 or later. It assumes you have Istio deployed on top of Kubernetes.
@@ -9,7 +9,7 @@ This document describes options for replicating data into OPA. The content of th

 ## Option 1: JWT Tokens

-[JSON Web Tokens (JWTs)](https://tools.ietf.org/html/rfc7519) allow you to securely transmit JSON data between software systems and are usually produced during the authentication process. You can set up authentication so that when the user logs in you create a JWT with that user's attributes (or any other data as far as OPA is concerned). Then you hand that JWT to OPA and use OPA's specialized support for JWTs to extract the information you need to make a policy decision.
+[JSON Web Tokens (JWTs)](https://datatracker.ietf.org/doc/html/rfc7519) allow you to securely transmit JSON data between software systems and are usually produced during the authentication process. You can set up authentication so that when the user logs in you create a JWT with that user's attributes (or any other data as far as OPA is concerned). Then you hand that JWT to OPA and use OPA's specialized support for JWTs to extract the information you need to make a policy decision.

 ### Flow

@@ -213,7 +213,7 @@ docker-compose -f docker-compose.yaml up
 Every time the demo GraphQL server receives an HTTP request, it asks OPA to decide whether an GraphQL query is authorized or not using a single RESTful API call.
 An example codebase is [here][graphql-example-repo], but the crux of the (JavaScript, Apollo framework) code is shown below.

-[graphql-example-repo]: https://github.com/StyraInc/graphql-apollo-example
+[graphql-example-repo]: https://github.com/StyraOSS/graphql-apollo-example

 ```javascript
 // we assume user is passed in as part of the request context.
@@ -57,8 +57,8 @@ opa build --bundle policies/ --output bundles/bundle.tar.gz

 #### Kafka Authorizer JAR File

-Next, download the latest version of the [Open Policy Agent plugin for Kafka authorization](https://github.com/StyraInc/opa-kafka-plugin)
-plugin from the projects [release pages](https://github.com/StyraInc/opa-kafka-plugin/releases).
+Next, download the latest version of the [Open Policy Agent plugin for Kafka authorization](https://github.com/StyraOSS/opa-kafka-plugin)
+plugin from the projects [release pages](https://github.com/StyraOSS/opa-kafka-plugin/releases).

 Store the plugin in the `plugin` directory (replace `${version}` with the version number of the plugin just downloaded):

@@ -66,7 +66,7 @@ Store the plugin in the `plugin` directory (replace `${version}` with the versio
 mv opa-authorizer-${version}-all.jar plugin/
 ```

-For more information on how to configure the OPA plugin for Kafka, see the plugin [repository](https://github.com/StyraInc/opa-kafka-plugin).
+For more information on how to configure the OPA plugin for Kafka, see the plugin [repository](https://github.com/StyraOSS/opa-kafka-plugin).

 Next, create a `docker-compose.yaml` file that runs OPA, Nginx, ZooKeeper, and Kafka.

@@ -189,7 +189,7 @@ This field can be used inside the policy.

 A detailed rundown of generating SSL certificates and JKS files required
 for SSL client authentication is outside the scope of this tutorial, but the plugin
-repository provides an [example script](https://github.com/StyraInc/opa-kafka-plugin/tree/main/example/opa_tutorial/create_cert.sh)
+repository provides an [example script](https://github.com/StyraOSS/opa-kafka-plugin/tree/main/example/opa_tutorial/create_cert.sh)
 that demonstrates the creation of client certificates for the four different
 users used in this tutorial:

@@ -522,5 +522,5 @@ policy.

 If you want to use the Kafka Authorizer plugin that integrates Kafka with
 OPA, see the build and install instructions in the
-[opa-kafka-plugin](https://github.com/StyraInc/opa-kafka-plugin)
+[opa-kafka-plugin](https://github.com/StyraOSS/opa-kafka-plugin)
 repository.
@@ -31,7 +31,7 @@ Kubernetes clusters for security, cost, and availability reasons.

 [OPA Gatekeeper](https://open-policy-agent.github.io/gatekeeper) is a specialized
 project providing first-class integration between OPA and Kubernetes. For
-background information see this [blog post](https://kubernetes.io/blog/2019/08/06/opa-gatekeeper-policy-and-governance-for-kubernetes)
+background information see this [blog post](https://kubernetes.io/blog/2019/08/06/opa-gatekeeper-policy-and-governance-for-kubernetes/)
 on kubernetes.io.

 OPA Gatekeeper adds the following on top of plain OPA:
@@ -4,7 +4,7 @@ title: Policy Primer via Examples

 Read this page if you are new to Kubernetes admission control with OPA and want
 to learn how to write policies for Kubernetes. It covers the version
-that uses kube-mgmt. The [OPA Gatekeeper version](https://open-policy-agent.github.io/gatekeeper)
+that uses kube-mgmt. The [OPA Gatekeeper version](https://open-policy-agent.github.io/gatekeeper/)
 has its own docs.

 ## Writing Policies
@@ -645,7 +645,7 @@ An empty list of operations in a _delta_ bundle `patch.json` will remove all the
 }
 ```

-If there are no operations to apply to the data, the bundle server should return the same [`Etag`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag) value as the last update. OPA will send the last `Etag` value in the [`If-None-Match`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-None-Match) Header.
+If there are no operations to apply to the data, the bundle server should return the same [`Etag`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/ETag) value as the last update. OPA will send the last `Etag` value in the [`If-None-Match`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/If-None-Match) Header.
 :::

 #### Delta Bundle Patch Operations
@@ -705,7 +705,7 @@ bundle would erase and overwrite policy and data under the manifest `roots`.

 The Bundle API is simple. Most HTTP servers capable of serving static files will do. While not strictly required in all deployments, it is also good if the implementation supports:

- HTTP caching using the [ETag header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag). This keeps OPA from having to download a bundle unless the bundle's content have changes.
+- HTTP caching using the [ETag header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/ETag). This keeps OPA from having to download a bundle unless the bundle's content have changes.
 - Authentication. When exposing a bundle at a remote endpoint, it is often desirable to protect the data by requiring all requests to the endpoint to be authenticated.

 This document lists some of the more common HTTP servers suitable as bundle servers, along with instructions for how to set them up as such.
@@ -1022,7 +1022,7 @@ The easiest way of testing GCP metadata token or JWT bearer grant type authentic

 #### Upload Bundle

-Uploading a bundle is trivial with the `gsutil` command included with the [Google Cloud SDK](https://cloud.google.com/sdk/docs/quickstart).
+Uploading a bundle is trivial with the `gsutil` command included with the [Google Cloud SDK](https://docs.cloud.google.com/sdk/docs/install-sdk).

 ```shell
 gsutil cp bundle.tar.gz gs://<bucket-name>/
@@ -1089,7 +1089,7 @@ keys:
 | Caching headers        | Yes                                                                                                                                                                                                                                                                              |
 | Authentication methods | [OAuth2 Client Credentials](https://www.openpolicyagent.org/docs/latest/configuration/#oauth2-client-credentials), <br/> [OAuth2 Client Credentials JWT authentication](https://www.openpolicyagent.org/docs/latest/configuration/#oauth2-client-credentials-jwt-authentication) |

-Note that for the time being, the [Shared Key or Shared Access Signature (SAS)](https://docs.microsoft.com/en-us/rest/api/storageservices/authorize-requests-to-azure-storage) options are [not supported](https://github.com/open-policy-agent/opa/issues/2964).
+Note that for the time being, the [Shared Key or Shared Access Signature (SAS)](https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-requests-to-azure-storage) options are [not supported](https://github.com/open-policy-agent/opa/issues/2964).

 #### Setup Instructions

@@ -1124,9 +1124,9 @@ curl --silent \

 #### Upload Bundle

-Uploading bundles to Azure Blob storage is easily done using the [azcopy](https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10) tool. Make sure to first properly [authorize](https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-authorize-azure-active-directory) the user to be able to upload to Blob storage.
+Uploading bundles to Azure Blob storage is easily done using the [azcopy](https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10) tool. Make sure to first properly [authorize](https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-authorize-user-identity) the user to be able to upload to Blob storage.

-By now you should be able to login interactively using `azcopy login --tenant-id <Active Directory tenant ID>`. Since you'll most likely will want to log in from scripts (to upload bundles programmatically), you should however create an Azure AD application, and a [service principal](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal) to do so. Good news! If you've followed the Authentication steps above, you already have one.
+By now you should be able to login interactively using `azcopy login --tenant-id <Active Directory tenant ID>`. Since you'll most likely will want to log in from scripts (to upload bundles programmatically), you should however create an Azure AD application, and a [service principal](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal) to do so. Good news! If you've followed the Authentication steps above, you already have one.

 **Uploading bundle using client secret authentication**

@@ -1242,7 +1242,7 @@ Nginx offers a simple but competent bundle server for those who prefer to host t

 #### Upload Bundle

-Either use the [nginx-upload-module](https://www.nginx.com/resources/wiki/modules/upload/) or upload bundles out-of-band with SSH or similar.
+Either use the [nginx-upload-module](https://docs.nginx.com/) or upload bundles out-of-band with SSH or similar.

 #### Example OPA Configuration

@@ -7,7 +7,7 @@ title: Concepts

 Bundles are the primary packaging and distribution unit in OCP. Each bundle contains Rego policies, data files, and is intended to be consumed by any number of OPA instances. The OCP configuration for the bundle specifies a set of **requirements** that list the sources (Rego, data, etc.) to include in the bundle.

-OCP builds [OPA Bundles](https://openpolicyagent.org/docs/management-bundles) and pushes them to external object storage systems (e.g., S3, GCS, Azure Cloud Storage, File System). OPA instances are configured to download bundles directly from these storage systems. See the [OPA Configuration](https://www.openpolicyagent.org/docs/latest/configuration/) documentation for more information how to configure authentication and bundle downloads for different cloud providers
+OCP builds [OPA Bundles](https://www.openpolicyagent.org/docs/management-bundles) and pushes them to external object storage systems (e.g., S3, GCS, Azure Cloud Storage, File System). OPA instances are configured to download bundles directly from these storage systems. See the [OPA Configuration](https://www.openpolicyagent.org/docs/configuration) documentation for more information how to configure authentication and bundle downloads for different cloud providers

 ### Namespacing

@@ -28,7 +28,7 @@ receive the policies and data they need to make decisions. OCP provides:
 - [Configuration](./configuration.md) - Learn how to configure the server
 - [API Reference](./api-reference.md) - Learn about the OCP REST API
 - [Authentication](./authentication.md) - Learn how to secure the server API
- [OCP on GitHub](http://github.com/open-policy-agent/opa-control-plane) -
+- [OCP on GitHub](https://github.com/open-policy-agent/opa-control-plane) -
  explore OCP the code, contribute and file issues.

 ## Kick the tires
@@ -9,7 +9,7 @@ general notes about operating OPA in such cases.

 ## HTTP Proxies

-OPA uses the standard Go [net/http](https://golang.org/pkg/net/http/) package
+OPA uses the standard Go [net/http](https://pkg.go.dev/net/http) package
 for outbound HTTP requests that download bundles, upload decision logs, etc. In
 environments where an HTTP proxy is required, you can configure OPA using the
 pseudo-standard `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment
@@ -146,7 +146,7 @@ When passing a capabilities definition file via `--capabilities`, one can restri

 Not providing a capabilities file, or providing a file without an `allow_net` key, will permit fetching remote schemas from any host.

-Note that the metaschemas [http://json-schema.org/draft-04/schema](http://json-schema.org/draft-04/schema), [http://json-schema.org/draft-06/schema](http://json-schema.org/draft-06/schema), and [http://json-schema.org/draft-07/schema](http://json-schema.org/draft-07/schema), are always available, even without network access.
+Note that the metaschemas [https://json-schema.org/draft-04/schema](https://json-schema.org/draft-04/schema), [https://json-schema.org/draft-06/schema](https://json-schema.org/draft-06/schema), and [https://json-schema.org/draft-07/schema](https://json-schema.org/draft-07/schema), are always available, even without network access.

 Similarly, the `allow_net` capability restricts what hosts the `http.send` built-in function may send requests to, and what hosts the `net.lookup_ip_addr` built-in function may resolve IP addresses for.

@@ -806,7 +806,7 @@ PASS: 2/2

 The benchmark output formats default to `pretty`, but support a `gobench` format which complies with the
 [Golang Benchmark Data Format](https://go.googlesource.com/proposal/+/master/design/14313-benchmark-format.md).
-This allows for usage of tools like [benchstat](https://godoc.org/golang.org/x/perf/cmd/benchstat) to gain additional
+This allows for usage of tools like [benchstat](https://pkg.go.dev/golang.org/x/perf/cmd/benchstat?utm_source=godoc) to gain additional
 insight into the benchmark results and to diff between benchmark results.

 Example:
@@ -893,7 +893,7 @@ DataRbacTestUserHasRoleNegative                         235 ± 0%

 This gives clear feedback that the evaluations have slowed down considerably by looking at the `delta`

-> Note that for [benchstat](https://godoc.org/golang.org/x/perf/cmd/benchstat) you will want to run with `--count` to
+> Note that for [benchstat](https://pkg.go.dev/golang.org/x/perf/cmd/benchstat) you will want to run with `--count` to
 > repeat the benchmarks a number of times (5-10 is usually enough). The tool requires several data points else the `p`
 > value will not show meaningful changes and the `delta` will be `~`.

@@ -2,7 +2,7 @@
 title: Token Signing
 ---
 <BuiltinTable category={"tokensign"}/>
-OPA provides two builtins that implement JSON Web Signature [RFC7515](https://tools.ietf.org/html/rfc7515) functionality.
+OPA provides two builtins that implement JSON Web Signature [RFC7515](https://datatracker.ietf.org/doc/html/rfc7515) functionality.

 `io.jwt.encode_sign_raw()` takes three JSON Objects (strings) as parameters and returns their JWS Compact Serialization.
 This builtin should be used by those that want maximum control over the signing and serialization procedure. It is
@@ -35,7 +35,7 @@ The following algorithms are supported:
 - `RS512`: RSASSA-PKCS-v1.5 using SHA-512

 :::info
-Note that the key's provided should be base64 URL encoded (without padding) as per the specification ([RFC7517](https://tools.ietf.org/html/rfc7517)).
+Note that the key's provided should be base64 URL encoded (without padding) as per the specification ([RFC7517](https://datatracker.ietf.org/doc/html/rfc7517)).
 This differs from the plain text secrets provided with the algorithm specific verify built-ins described below.
 :::

@@ -1115,7 +1115,7 @@ Content-Type: application/json-patch+json

 Update a document.

-The server accepts updates encoded as JSON Patch operations. The message body of the request should contain a JSON encoded array containing one or more JSON Patch operations. Each operation specifies the operation type, path, and an optional value. For more information on JSON Patch, see [RFC 6902](https://tools.ietf.org/html/rfc6902).
+The server accepts updates encoded as JSON Patch operations. The message body of the request should contain a JSON encoded array containing one or more JSON Patch operations. Each operation specifies the operation type, path, and an optional value. For more information on JSON Patch, see [RFC 6902](https://datatracker.ietf.org/doc/html/rfc6902).

 The effective path of the JSON Patch operation is obtained by joining the path portion of the URL with the path value from the operation(s) contained in the message body. In all cases, the parent of the effective path MUST refer to an existing document, otherwise the server returns 404. In the case of **remove** and **replace** operations, the effective path MUST refer to an existing document, otherwise the server returns 404.

@@ -3,7 +3,7 @@ title: SSH and sudo
 ---

 Host-level access controls are an important part of every organization's
-security strategy. Using [Linux-PAM](http://tldp.org/HOWTO/User-Authentication-HOWTO/x115.html) and OPA
+security strategy. Using [Linux-PAM](https://tldp.org/HOWTO/User-Authentication-HOWTO/x115.html) and OPA
 we can extend policy-based access control to SSH and sudo.

 ## Goals
@@ -42,7 +42,7 @@ This tutorial requires
 - [OPA](https://github.com/open-policy-agent/opa/releases)

 (This tutorial _should_ also work with the
-[latest version of Terraform](https://www.terraform.io/downloads.html), but
+[latest version of Terraform](https://developer.hashicorp.com/terraform), but
 it is untested. Contributions welcome!)

 # Getting Started
@@ -51,7 +51,7 @@ it is untested. Contributions welcome!)

 ### 1. Create and save a Terraform plan

-Create a [Terraform](https://www.terraform.io/docs/index.html) file that includes an
+Create a [Terraform](https://developer.hashicorp.com/terraform/docs) file that includes an
 auto-scaling group and a server on AWS.
 (You will need to modify the `shared_credentials_file` to point to your AWS credentials.)

@@ -92,7 +92,7 @@ terraform plan --out tfplan.binary

 ### 2. Convert the Terraform plan into JSON

-Use the command [terraform show](https://www.terraform.io/docs/commands/show.html) to convert the Terraform plan into
+Use the command [terraform show](https://developer.hashicorp.com/terraform/cli/commands/show) to convert the Terraform plan into
 JSON so that OPA can read the plan.

 ```shell
@@ -82,7 +82,7 @@ evaluating compiled policies. If you want to evaluate Rego policies inside
 JavaScript we recommend you use the
 [Javascript SDK](https://github.com/open-policy-agent/npm-opa-wasm).
 There is also an
-[example NodeJS application](https://github.com/open-policy-agent/npm-opa-wasm/tree/master/examples/nodejs-app)
+[example NodeJS application](https://github.com/open-policy-agent/npm-opa-wasm/tree/main/examples/nodejs-app)
 provided for reference.

 ### Other Languages
@@ -21,13 +21,13 @@ Public open source projects integrating Regal for linting in their CI/CD pipelin
 - [Brainiac](https://github.com/carbonetes/brainiac)
 - [Cloudbeat](https://github.com/elastic/cloudbeat)
 - [Conftest](https://github.com/open-policy-agent/conftest)
- [CVAT](https://github.com/opencv/cvat)
+- [CVAT](https://github.com/cvat-ai/cvat)
 - [GKE Policy Automation](https://github.com/google/gke-policy-automation)
 - [Konstraint](https://github.com/plexsystems/konstraint)
 - [Kubescape](https://github.com/kubescape/regolibrary)
 - [Legitify](https://github.com/Legit-Labs/legitify)
 - [Matrix Authentication Service](https://github.com/element-hq/matrix-authentication-service/)
- [Minder](https://github.com/stacklok/minder)
+- [Minder](https://github.com/mindersec/minder)
 - [Modernisation Platform](https://github.com/ministryofjustice/modernisation-platform)
 - [OPA Library](https://github.com/open-policy-agent/library)
 - [Red Hat COP](https://github.com/redhat-cop/rego-policies)
@@ -47,7 +47,7 @@ Projects and products that integrate Regal into their offerings.
 - [Dependency Management Data](https://gitlab.com/tanna.dev/dependency-management-data)
 - [Enterprise OPA](https://github.com/styrainc/enterprise-opa)
 - [The Rego Playground](https://play.openpolicyagent.org)
- [Trunk Check](https://trunk.io/check)
+- [Trunk Check](https://trunk.io/)
 - [reviewdog/action-regal](https://github.com/reviewdog/action-regal)
 <!-- cspell:enable-->

@@ -21,9 +21,9 @@ are:
 - `pretty` (default) - Human-readable table-like output where each violation is printed with a detailed explanation
 - `compact` - Human-readable output where each violation is printed on a single line
 - `json` - JSON output, suitable for programmatic consumption
- `github` - GitHub [workflow command](https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions)
+- `github` - GitHub [workflow command](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-commands)
  output, ideal for use in GitHub Actions. Annotates PRs and creates a
-  [job summary](https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#adding-a-job-summary)
+  [job summary](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-commands#adding-a-job-summary)
  from the linter report
 - `sarif` - [SARIF](https://sarifweb.azurewebsites.net/) JSON output, for consumption by tools processing code analysis
  reports
@@ -11,7 +11,7 @@ sidebar_label: Project Roots

 While many projects consider the project's root directory (in editors often referred to as **workspace**) their
 "main" directory for policies, some projects may contain code from other languages, policy "subprojects", or multiple
-[bundles](https://www.openpolicyagent.org/docs/management-bundles/). While most of Regal's features work
+[bundles](https://www.openpolicyagent.org/docs/management-bundles). While most of Regal's features work
 independently of this — linting, for example, doesn't consider where in a workspace policies are located as long as
 those locations aren't [ignored](./ignore-rules) — some features, like automatically
 [fixing](https://www.openpolicyagent.org/projects/regal/fixing) violations, benefit from knowing when a project contains multiple roots.
@@ -9,7 +9,7 @@ sidebar_label: Roast

 # Roast (Regal's Optimized AST)

-Roast is an optimized JSON format for [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/) ASTs, as well
+Roast is an optimized JSON format for [Rego](https://www.openpolicyagent.org/docs/policy-language) ASTs, as well
 as common utilities for working with both the Roast format and OPA's AST APIs.

 Roast is used by [Regal](https://www.openpolicyagent.org/projects/regal), where the JSON representation of Rego's AST is used input for
@@ -49,7 +49,7 @@ by Regal.
 [Neovim](https://neovim.io/) supports both the Language Server Protocol and the Debug Adapter Protocol.

 Generally, the Regal binary should be [installed](https://www.openpolicyagent.org/projects/regal#getting-started)
-first. [`mason.vim`](https://github.com/williamboman/mason.nvim) users can install the
+first. [`mason.vim`](https://github.com/mason-org/mason.nvim) users can install the
 Regal binary with `:MasonInstall regal`
 ([package definition](https://github.com/mason-org/mason-registry/blob/2024-07-23-asian-hate/packages/regal/package.yaml)).

@@ -19,7 +19,7 @@ import Intro from '@site/src/components/projects/regal/Intro';
 # Regal

 Regal is a linter and language server for
-[Rego](https://www.openpolicyagent.org/docs/policy-language/), making
+[Rego](https://www.openpolicyagent.org/docs/policy-language), making
 your Rego magnificent, and you the ruler of rules!

 With its extensive set of linter rules, documentation and editor integrations,
@@ -73,8 +73,8 @@ effort.

 ## Related Resources

- OPA Docs: [Upgrading to v1.0](https://www.openpolicyagent.org/docs/v0-upgrade/)
- OPA Docs: [v0 Backwards Compatibility](https://www.openpolicyagent.org/docs/v0-compatibility/)
+- OPA Docs: [Upgrading to v1.0](https://www.openpolicyagent.org/docs/v0-upgrade)
+- OPA Docs: [v0 Backwards Compatibility](https://www.openpolicyagent.org/docs/v0-compatibility)
 - Styra Blog: [Renovating Rego](https://www.styra.com/blog/renovating-rego/)
 - OPA Blog: [OPA 1.0 Is Coming, Here's What You Need to Know](https://blog.openpolicyagent.org/opa-1-0-is-coming-heres-what-you-need-to-know-c8fb0d258368)
 - OPA Blog: [Announcing OPA 1.0: A New Standard for Policy as Code](https://blog.openpolicyagent.org/announcing-opa-1-0-a-new-standard-for-policy-as-code-a6d8427ee828)
@@ -43,7 +43,7 @@ same way they'd normally do it using a traditional programming language (that is
 work, OPA provides several tools to help measure performance, and learning how to use them well is the best way to
 understand the performance characteristics of policy evaluation.

-See the [performance](https://www.openpolicyagent.org/docs/policy-performance/) section of the OPA docs for an
+See the [performance](https://www.openpolicyagent.org/docs/policy-performance) section of the OPA docs for an
 introduction to these tools, as well as advice on how to write performant policies.

 ## Configuration Options
@@ -61,4 +61,4 @@ rules:
 ## Related Resources

 - OPA Docs: [time.now_ns](https://www.openpolicyagent.org/docs/policy-reference/#builtin-time-timenow_ns)
- OPA Docs: [Policy Performance](https://www.openpolicyagent.org/docs/policy-performance/)
+- OPA Docs: [Policy Performance](https://www.openpolicyagent.org/docs/policy-performance)
@@ -56,5 +56,5 @@ rules:
 ## Related Resources

 - Regal Docs: [Call to `print` or `trace` function](https://www.openpolicyagent.org/projects/regal/rules/testing/print-or-trace-call)
- OPA Docs: [Policy Testing](https://www.openpolicyagent.org/docs/policy-testing/)
+- OPA Docs: [Policy Testing](https://www.openpolicyagent.org/docs/policy-testing)
 - GitHub: [Source Code](https://github.com/open-policy-agent/regal/blob/main/bundle/regal/rules/testing/dubious-print-sprintf/dubious_print_sprintf.rego)
@@ -41,5 +41,5 @@ rules:

 - OPA Blog: [Introducing the OPA print function](https://blog.openpolicyagent.org/introducing-the-opa-print-function-809da6a13aee)
 - OPA Docs: [Policy Reference: Debugging](https://www.openpolicyagent.org/docs/policy-reference/#debugging)
- OPA Docs: [Decision Logs](https://www.openpolicyagent.org/docs/management-decision-logs/)
+- OPA Docs: [Decision Logs](https://www.openpolicyagent.org/docs/management-decision-logs)
 - GitHub: [Source Code](https://github.com/open-policy-agent/regal/blob/main/bundle/regal/rules/testing/print-or-trace-call/print_or_trace_call.rego)
@@ -8,14 +8,14 @@ labels:
 code:
 - https://github.com/apache/apisix
 blogs:
- https://apisix.apache.org/blog/2021/12/24/open-policy-agent
+- https://apisix.apache.org/blog/2021/12/24/open-policy-agent/
 - https://medium.com/@ApacheAPISIX/apache-apisix-integrates-with-open-policy-agent-to-enrich-its-ecosystem-15569fe3ab9c
 docs_features:
  rest-api-integration:
    note: |
      Apache APISIX routes can be configured to call an OPA instance over
      the REST API.
-      [This blog post](https://apisix.apache.org/blog/2021/12/24/open-policy-agent/)
+      [This blog post](https://apisix.apache.org/blog/2021/12/24/open-policy-agent//)
      explains how such a configuration can be achieved.
 ---
 Apache APISIX provides a plugin for delegating fine-grained authorization decisions to OPA.
@@ -19,7 +19,7 @@ docs_features:
    note: |
      Atmos can validate Terraform stack before applying them. This is done
      using the `validate component` command
-      [documented here](https://atmos.tools/cli/commands/validate/component).
+      [documented here](https://atmos.tools/cli/commands/validate/component/).
 ---

 Workflow automation tool for DevOps. Keep configuration DRY with hierarchical imports of configurations, inheritance, and WAY more.
@@ -10,7 +10,7 @@ tutorials:
 code:
 - https://github.com/StyraInc/opa-aws-cloudformation-hook
 blogs:
- https://www.styra.com/blog/the-opa-aws-cloudformation-hook
+- https://www.styra.com/blog/the-opa-aws-cloudformation-hook/
 inventors:
 - styra
 docs_features:
@@ -6,7 +6,7 @@ labels:
  category: object
  layer: data
 tutorials:
- https://docs.ceph.com/docs/master/radosgw/opa/
+- https://docs.ceph.com/en/latest/radosgw/opa/
 inventors:
 - styra
 - redhat
@@ -5,7 +5,7 @@ labels:
  layer: cicd
  type: poweredbyopa
 tutorials:
- https://circleci.com/docs/config-policy-management-overview/
+- https://circleci.com/docs/guides/config-policies/config-policy-management-overview/
 inventors:
 - circleci
 ---
@@ -8,9 +8,9 @@ labels:
  category: containers
  datasource: clair
 code:
- https://github.com/open-policy-agent/contrib/tree/master/image_enforcer
+- https://github.com/open-policy-agent/contrib/tree/main/image_enforcer
 tutorials:
- https://github.com/open-policy-agent/contrib/blob/master/image_enforcer/README.md
+- https://github.com/open-policy-agent/contrib/blob/main/image_enforcer/README.md
 docs_features:
  rest-api-integration:
    note: |
@@ -6,9 +6,9 @@ labels:
  layer: application
  category: serverless
 code:
- https://github.com/open-policy-agent/contrib/tree/master/wasm/cloudflare-worker
+- https://github.com/open-policy-agent/contrib/tree/main/wasm/cloudflare-worker
 tutorials:
- https://github.com/open-policy-agent/contrib/blob/master/wasm/cloudflare-worker/README.md
+- https://github.com/open-policy-agent/contrib/blob/main/wasm/cloudflare-worker/README.md
 docs_features:
  wasm-integration:
    note: |
@@ -1,20 +1,20 @@
 ---
-title: Enterprise Contract
+title: Conforma
 software:
- enterprise-contract
+- conforma
 inventors:
- enterprise-contract
+- conforma
 labels:
  category: security
  layer: application
 code:
- https://github.com/enterprise-contract/ec-cli
+- https://github.com/conforma/cli
 blogs:
- https://enterprisecontract.dev/posts/
+- https://conforma.dev/posts/
 docs_features:
  go-integration:
    note: |
-      The [Enterprise Contract](https://enterprisecontract.dev/) uses the OPA go
+      [Conforma](https://conforma.dev/) uses the OPA go
      library to process rego policies when validating the signatures and
      attestations of container images and other software artifacts.
 ---
@@ -9,7 +9,7 @@ tutorials:
 - https://docs.dapr.io/reference/components-reference/supported-middleware/middleware-opa/
 code:
 - https://github.com/dapr/dapr
- https://github.com/dapr/components-contrib/blob/master/middleware/http/opa/middleware.go
+- https://github.com/dapr/components-contrib/blob/main/middleware/http/opa/middleware.go
 docs_features:
  go-integration:
    note: |
@@ -4,7 +4,7 @@ labels:
  category: gateway
  layer: network
 code:
- https://github.com/megaease/easegress
+- https://github.com/easegress-io/easegress
 inventors:
 - megaease
 ---
@@ -6,9 +6,9 @@ labels:
 software:
 - elasticsearch
 code:
- https://github.com/open-policy-agent/contrib/tree/master/data_filter_elasticsearch
+- https://github.com/open-policy-agent/contrib/tree/main/data_filter_elasticsearch
 tutorials:
- https://github.com/open-policy-agent/contrib/blob/master/data_filter_elasticsearch/README.md
+- https://github.com/open-policy-agent/contrib/blob/main/data_filter_elasticsearch/README.md
 inventors:
 - styra
 ---
@@ -15,8 +15,8 @@ software:
 inventors:
 - env0
 tutorials:
- https://docs.env0.com/docs/opa-plugin
- https://docs.env0.com/docs/policies
+- https://docs.envzero.com/guides/integrations/plugins/opa-plugin
+- https://docs.envzero.com/guides/policies-governance/policies
 code:
 - https://github.com/env0/approval-policies
 blogs:
@@ -34,7 +34,7 @@ docs_features:
    note: |
      env0 is a Terraform automation platform that allows you to manage your
      infrastructure as code (IaC) at scale. It has a built-in integration with
-      OPA. See docs [here](https://docs.env0.com/docs/opa-plugin).
+      OPA. See docs [here](https://docs.envzero.com/guides/integrations/plugins/opa-plugin).
 ---

 env0 is the best way to deploy and manage IaC - Terraform, OpenTofu, CloudFormation, Pulumi, Kubernetes, and more. Our platform integrates with OPA to allow its users to streamline cloud governance, automate policy enforcement, and maintain control over cloud deployments while enabling managed self-service.
@@ -8,7 +8,7 @@ software:
 - envoy
 tutorials:
 - https://github.com/tsandall/minimal-opa-envoy-example/blob/master/README.md
- https://www.openpolicyagent.org/docs/latest/envoy-introduction/
+- https://www.openpolicyagent.org/docs/envoy
 code:
 - https://github.com/open-policy-agent/opa-envoy-plugin
 - https://github.com/tsandall/minimal-opa-envoy-example
@@ -53,6 +53,6 @@ docs_features:
      project uses the REST API to allow and deny requests routed via an Envoy proxy.

      Read about this integration in the
-      [OPA Docs](https://www.openpolicyagent.org/docs/latest/envoy-introduction/).
+      [OPA Docs](https://www.openpolicyagent.org/docs/envoy).
 ---
 Envoy is a networking abstraction for cloud-native applications. OPA hooks into Envoy’s external authorization filter to provide fine-grained, context-aware authorization for network or HTTP requests.
@@ -7,13 +7,13 @@ labels:
 inventors:
 - styra
 blogs:
- http://styra.com/blog/how-to-express-or-in-rego
+- https://www.styra.com/blog/how-to-express-or-in-rego/
 docs_features:
  learning-rego:
    note: |
-      This [learning material](http://styra.com/blog/how-to-express-or-in-rego)
+      This [learning material](https://www.styra.com/blog/how-to-express-or-in-rego/)
      is a great way to learn how to migrate logic from other languages to Rego.
 ---

-This [learning material](http://styra.com/blog/how-to-express-or-in-rego)
+This [learning material](https://www.styra.com/blog/how-to-express-or-in-rego/)
 is a great way to learn how to migrate logic from other languages to Rego.
@@ -11,7 +11,7 @@ software:
 - helm
 tutorials:
 - https://insights.docs.fairwinds.com/features/admission-controller/
- https://insights.docs.fairwinds.com/features/insights-cli
+- https://insights.docs.fairwinds.com/features/insights-cli/
 blogs:
 - https://www.fairwinds.com/blog/managing-opa-policies-with-fairwinds-insights
 - https://www.fairwinds.com/blog/manage-open-policy-agent-opa-consistently
@@ -14,14 +14,14 @@ blogs:
 code:
 - https://github.com/flipt-io/flipt
 tutorials:
- https://docs.flipt.io/authorization/overview
- https://docs.flipt.io/guides/operation/authorization/rbac-with-keycloak
- https://docs.flipt.io/configuration/authorization
+- https://docs.flipt.io/v1/authorization/overview
+- https://docs.flipt.io/v1/guides/operation/authorization/rbac-with-keycloak
+- https://docs.flipt.io/v1/configuration/authorization
 docs_features:
  go-integration:
    note: |
      Flipt's authorization feature uses the Go API to embed Open Policy Agent and evaluate authorization policies.
-      [These docs](https://docs.flipt.io/authorization/overview)
+      [These docs](https://docs.flipt.io/v1/authorization/overview)
      explain how it works.
 ---
 Flipt is an open-source, Enterprise-ready, GitOps enabled, CloudNative feature management solution.
@@ -9,7 +9,7 @@ code:
 software:
 - kubernetes
 tutorials:
- https://open-policy-agent.github.io/gatekeeper/website/docs/howto
+- https://open-policy-agent.github.io/gatekeeper/website/docs/howto/
 videos:
 - https://youtu.be/RMiovzGGCfI?t=1049
 - https://youtu.be/6RNp3m_THw4?t=864
@@ -18,4 +18,4 @@ docs_features:

 [GitHub Action for OPA Rego Policy Tests](docs/website/content/integrations/rego-test-assertions.md) by [Masterpoint](https://masterpoint.io/) is used to automate testing for your OPA (Open Policy Agent) Rego policies, generates a report with coverage information, and posts the test results as a comment on your pull requests, making it easy for your team to review and approve policies.

-Use this to test your OPA Rego files for [Spacelift policies](https://docs.spacelift.io/concepts/policy), [Kubernetes Admission Controller policies](https://www.openpolicyagent.org/docs/latest/kubernetes-introduction/), [Docker authorization policies](https://www.openpolicyagent.org/docs/latest/docker-authorization/), or any other use case that uses [Open Policy Agent's policy language Rego](https://www.openpolicyagent.org/docs/latest/). This Action also updates PR comments with the test results in place to prevent duplication.
+Use this to test your OPA Rego files for [Spacelift policies](https://docs.spacelift.io/concepts/policy), [Kubernetes Admission Controller policies](https://www.openpolicyagent.org/docs/kubernetes), [Docker authorization policies](https://www.openpolicyagent.org/docs/docker-authorization), or any other use case that uses [Open Policy Agent's policy language Rego](https://www.openpolicyagent.org/docs/latest/). This Action also updates PR comments with the test results in place to prevent duplication.
@@ -10,6 +10,6 @@ inventors:
 code:
 - https://github.com/anderseknert/opa-google-calendar
 blogs:
- https://www.styra.com/blog/the-power-of-data-calendar-based-policy-enforcement
+- https://www.styra.com/blog/the-power-of-data-calendar-based-policy-enforcement/
 ---
 Using the Google Calendar API with OPA for calendar powered policy decisions
@@ -8,7 +8,7 @@ software:
 code:
 - https://github.com/StyraInc/graphql-apollo-example
 tutorials:
- https://www.openpolicyagent.org/docs/graphql-api-authorization/
+- https://www.openpolicyagent.org/docs/graphql-api-authorization
 ---
 GraphQL is a query language for APIs and a runtime for fulfilling those queries with your existing data.

@@ -6,9 +6,9 @@ labels:
 software:
 - linux
 tutorials:
- https://github.com/open-policy-agent/contrib/blob/master/opa-iptables/docs/tutorial.md
+- https://github.com/open-policy-agent/contrib/blob/main/opa-iptables/docs/tutorial.md
 code:
- https://github.com/open-policy-agent/contrib/tree/master/opa-iptables
+- https://github.com/open-policy-agent/contrib/tree/main/opa-iptables
 inventors:
 - gsoc
 - cisco
@@ -7,9 +7,9 @@ labels:
  category: streaming
  layer: data
 blogs:
- https://opencredo.com/blogs/controlling-kafka-data-flows-using-open-policy-agent/
+- https://www.opencredo.com/blogs/controlling-kafka-data-flows-using-open-policy-agent
 tutorials:
- https://www.openpolicyagent.org/docs/latest/kafka-authorization/
+- https://www.openpolicyagent.org/docs/kafka-authorization
 code:
 - https://github.com/StyraInc/opa-kafka-plugin
 - https://github.com/llofberg/kafka-authorizer-opa
@@ -6,7 +6,7 @@ labels:
 software:
 - kong
 code:
- https://github.com/open-policy-agent/contrib/tree/master/kong_api_authz
+- https://github.com/open-policy-agent/contrib/tree/main/kong_api_authz
 inventors:
 - wada-ama
 ---
@@ -3,7 +3,7 @@ title: Kubernetes Authorization
 code:
 - https://github.com/open-policy-agent/contrib/tree/main/k8s_authorization
 blogs:
- https://www.styra.com/blog/kubernetes-authorization-webhook
+- https://www.styra.com/blog/kubernetes-authorization-webhook/
 - https://itnext.io/kubernetes-authorization-via-open-policy-agent-a9455d9d5ceb
 - https://itnext.io/optimizing-open-policy-agent-based-kubernetes-authorization-via-go-execution-tracer-7b439bb5dc5b
 inventors:
@@ -81,7 +81,7 @@ blogs:
 - https://blog.openpolicyagent.org/securing-the-kubernetes-api-with-open-policy-agent-ce93af0552c3
 - https://itnext.io/kubernetes-authorization-via-open-policy-agent-a9455d9d5ceb
 - https://medium.com/capital-one-tech/policy-enabled-kubernetes-with-open-policy-agent-3b612b3f0203
- https://blog.openshift.com/fine-grained-policy-enforcement-in-openshift-with-open-policy-agent/
+- https://www.redhat.com/en/blog/fine-grained-policy-enforcement-in-openshift-with-open-policy-agent
 docs_features:
  rest-api-integration:
    note: |
@@ -12,7 +12,7 @@ code:
 inventors:
 - armo
 tutorials:
- https://hub.armosec.io/docs
+- https://hub.armosec.io/docs/armo-platform
 docs_features:
  go-integration:
    note: |
@@ -11,7 +11,7 @@ labels:
 code:
 - https://github.com/kubeshield/bpf-opa-demo
 blogs:
- https://blog.byte.builders/post/bpf-opa/
+- https://appscode.com/blog/post/bpf-opa/
 docs_features:
  kubernetes:
    note: |
@@ -7,7 +7,7 @@ labels:
 tutorials:
 - https://www.openpolicyagent.org/docs/ssh-and-sudo-authorization.html
 code:
- https://github.com/open-policy-agent/contrib/tree/master/pam_opa
+- https://github.com/open-policy-agent/contrib/tree/main/pam_opa
 inventors:
 - styra
 ---
@@ -5,8 +5,8 @@ software:
 labels:
  category: security
 tutorials:
- https://www.openpolicyagent.org/docs/latest/oauth-oidc/
+- https://www.openpolicyagent.org/docs/oauth-oidc
 blogs:
- https://www.styra.com/blog/integrating-identity-oauth2-and-openid-connect-in-open-policy-agent
+- https://www.styra.com/blog/integrating-identity-oauth2-and-openid-connect-in-open-policy-agent/
 ---
 Integrating OAuth2 with Open Policy Agent
@@ -9,7 +9,7 @@ inventors:
 code:
 - https://github.com/opcr-io/policy
 tutorials:
- https://openpolicycontainers.com/docs/tutorial
+- https://openpolicycontainers.com/docs/tutorial/
 docs_features:
  go-integration:
    note: |
@@ -20,18 +20,18 @@ docs_features:
    note: |
      OPCR policy images can be loaded in over the Bundle API. The feature
      it documented in the
-      [OPCR docs](https://openpolicycontainers.com/docs/opa).
+      [OPCR docs](https://openpolicycontainers.com/docs/opa/).
  opa-bundles-discovery:
    note: |
      OPCR images can be loaded in over the Bundle API and contain
      discovery bundles. The feature it documented in the
-      [OPCR docs](https://openpolicycontainers.com/docs/opa).
+      [OPCR docs](https://openpolicycontainers.com/docs/opa/).
  external-data:
    note: |
      OPCR policy images can contain data as well as policy. If you need to
      distribute data to OPA from an OCI registry, OPCR can build and push
      such images. See the docs for
-      [building images here](https://openpolicycontainers.com/docs/cli/build).
+      [building images here](https://openpolicycontainers.com/docs/cli/build/).
 ---

 The Open Policy Registry project provides a docker-style workflow for OPA
@@ -5,7 +5,7 @@ labels:
  category: application
  layer: network
 code:
- https://github.com/StyraInc/opa-aspnetcore
+- https://github.com/open-policy-agent/opa-aspnetcore
 - https://www.nuget.org/packages/Styra.Opa.AspNetCore
 tutorials:
 - https://open-policy-agent.github.io/opa-aspnetcore/
@@ -5,7 +5,7 @@ labels:
  category: application
  layer: network
 code:
- https://github.com/StyraInc/opa-csharp
+- https://github.com/open-policy-agent/opa-csharp
 - https://www.nuget.org/packages/Styra.Opa
 tutorials:
 - https://open-policy-agent.github.io/opa-csharp/
@@ -7,10 +7,10 @@ labels:
  category: wasm
  type: poweredbyopa
 code:
- https://github.com/StyraInc/opa-java-wasm
+- https://github.com/StyraOSS/opa-java-wasm
 - https://central.sonatype.com/artifact/com.styra.opa/opa-java-wasm
 tutorials:
- https://github.com/StyraInc/opa-java-wasm?tab=readme-ov-file#getting-started
+- https://github.com/StyraOSS/opa-java-wasm?tab=readme-ov-file#getting-started
 inventors:
 - andreatp
 ---
@@ -7,7 +7,7 @@ labels:
 software:
 - java
 code:
- https://github.com/StyraInc/opa-java
+- https://github.com/open-policy-agent/opa-java
 - https://central.sonatype.com/artifact/com.styra/opa
 tutorials:
 - https://open-policy-agent.github.io/opa-java/javadoc/
@@ -7,7 +7,7 @@ labels:
 software:
 - java
 code:
- "https://github.com/StyraInc/opa-springboot"
+- "https://github.com/open-policy-agent/opa-springboot"
 - "https://central.sonatype.com/artifact/com.styra.opa/springboot"
 inventors:
 - styra
@@ -19,17 +19,17 @@ docs_features:
    note: |
      OPAL uses the OPA REST API to update the policy and data pushed down
      from the OPAL server.
-      See [how this works](https://docs.opal.ac/overview/architecture).
+      See [how this works](https://docs.opal.ac/overview/architecture/).
  external-data:
    note: |
      The OPAL Client uses the OPA REST API to update the state pushed down
      from the OPAL server.
-      See [how this works](https://docs.opal.ac/overview/architecture).
+      See [how this works](https://docs.opal.ac/overview/architecture/).
  external-data-realtime-push:
    note: |
      OPAL is able to deliver real-time data updates to OPA instances.
      See
-      [how this works](https://docs.opal.ac/getting-started/quickstart/opal-playground/publishing-data-update)
+      [how this works](https://docs.opal.ac/getting-started/quickstart/opal-playground/publishing-data-update/)
      in the OPAL docs.
 ---
 OPAL is an administration layer for Open Policy Agent (OPA), detecting changes in realtime to both policy and policy data and pushing live updates to your agents.
@@ -8,7 +8,7 @@ inventors:
 code:
 - https://github.com/permitio/OPToggles
 tutorials:
- https://optoggles.opal.ac/tutorials/demo
+- https://optoggles.opal.ac/tutorials/demo/
 ---
 OPToggles uses OPA and OPAL to sync open-policy to your frontend with the help of feature flag solutions.
 OPToggles creates user-targeted feature flags based on the policy rules you defined in OPA and keeps the users updated in real-time with OPAL's real-time policy and policy-data change detection.
@@ -9,7 +9,7 @@ code:
 - https://github.com/principled-evolution/gopal
 - https://github.com/principled-evolution/aicertify
 blogs:
- https://principledevolution.ai/blog/governance-policy-as-code-opa-trust-ai
+- https://principledevolution.ai/blog/governance-policy-as-code-opa-trust-ai/
 # tutorials: # Optional: Add if specific tutorials exist
 ---

@@ -6,17 +6,17 @@ labels:
 code:
 - https://github.com/open-policy-agent/rego-cheat-sheet
 tutorials:
- https://openpolicyagent.org/docs/cheatsheet
+- https://www.openpolicyagent.org/docs/cheatsheet
 docs_features:
  learning-rego:
    note: |
-      The [Rego Cheat Sheet](https://openpolicyagent.org/docs/cheatsheet)
+      The [Rego Cheat Sheet](https://www.openpolicyagent.org/docs/cheatsheet)
      was designed as a language reference, featuring common contact points,
      with Rego learners in mind.
 ---

-The [Rego Cheat Sheet](https://openpolicyagent.org/docs/cheatsheet) has been
+The [Rego Cheat Sheet](https://www.openpolicyagent.org/docs/cheatsheet) has been
 designed to be a reference for Rego learners and users documenting the common
 contact points with the language. There is also a
-[PDF version](https://openpolicyagent.org/cheatsheet.pdf) for those looking for
+[PDF version](https://www.openpolicyagent.org/cheatsheet.pdf) for those looking for
 a printable reference.
@@ -21,7 +21,7 @@ inventors:
 blogs:
 - https://mia-platform.eu/blog/rond-open-source-api-enforcement/
 - https://mia-platform.eu/blog/role-based-access-control-rbac/
- https://resources.mia-platform.eu/en/white-paper-rbac-platform-engineering
+- https://mia-platform.eu/library/rbac-implementation-platform-engineering/
 docs_features:
  go-integration:
    note: |
@@ -13,7 +13,7 @@ code:
 inventors:
 - scalr
 blogs:
- https://www.scalr.com/blog/opa-is-to-policy-automation-as-terraform-is-to-iac/
+- https://scalr.com/blog/opa-is-to-policy-automation-as-terraform-is-to-iac
 docs_features:
  cli-integration:
    note: |
@@ -25,7 +25,7 @@ docs_features:
    note: |
      Spacelift supports Rego as a language to describe policies for IaC
      resources. View the docs on
-      [creating Rego policies](https://docs.spacelift.io/concepts/policy/).
+      [creating Rego policies](https://docs.spacelift.io/concepts/policy).
  terraform:
    note: |
      Spacelift supports Rego as a language to describe policies for Terraform
@@ -36,7 +36,7 @@ docs_features:
    note: |
      Spacelift supports Rego as a language to describe policies for various
      resource types, including Kubernetes. View the
-      [policy documentation](https://docs.spacelift.io/concepts/policy/) for
+      [policy documentation](https://docs.spacelift.io/concepts/policy) for
      more information.
 ---
 Spacelift is a sophisticated CI/CD platform for Infrastructure as Code including Terraform, Pulumi, CloudFormation, Kubernetes, and Ansible. Spacelift utilizes Open Policy Agent to support a variety of policy types within the platform and Policy as Code for secure and compliance Infrastructure as Code.
@@ -8,12 +8,12 @@ labels:
 software:
 - java
 code:
- https://github.com/open-policy-agent/contrib/tree/master/spring_authz
+- https://github.com/open-policy-agent/contrib/tree/main/spring_authz
 - https://github.com/Bisnode/opa-spring-security
 - https://github.com/massenz/jwt-opa
 - https://github.com/eugenp/tutorials/tree/master/spring-security-modules/spring-security-opa
 tutorials:
- https://github.com/open-policy-agent/contrib/blob/master/spring_authz/README.md
+- https://github.com/open-policy-agent/contrib/blob/main/spring_authz/README.md
 - https://github.com/massenz/jwt-opa#web-server-demo-app
 - https://www.baeldung.com/spring-security-authorization-opa
 inventors:
@@ -6,7 +6,7 @@ labels:
 software:
 - sqlite
 code:
- https://github.com/open-policy-agent/contrib/tree/master/data_filter_example
+- https://github.com/open-policy-agent/contrib/tree/main/data_filter_example
 blogs:
 - https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4
 inventors:
@@ -16,6 +16,6 @@ tutorials:
 ---

 Swift-OPA is a Swift package for evaluating
-[OPA IR Plans](https://www.openpolicyagent.org/docs/latest/ir/) compiled from
+[OPA IR Plans](https://www.openpolicyagent.org/docs/ir) compiled from
 [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/#what-is-rego)
 declarative policy.
@@ -11,17 +11,17 @@ labels:
  layer: orchestration
 tutorials:
 - https://www.openpolicyagent.org/docs/terraform.html
- https://github.com/instrumenta/conftest/blob/master/README.md
+- https://github.com/open-policy-agent/conftest/blob/master/README.md
 code:
 - https://github.com/instrumenta/conftest
 - https://github.com/fugue/regula
- https://github.com/accurics/terrascan
+- https://github.com/tenable/terrascan
 - https://github.com/Checkmarx/kics
 - https://github.com/open-policy-agent/library/tree/master/terraform
- https://github.com/accurics/terrascan/tree/master/pkg/policies/opa/rego
+- https://github.com/tenable/terrascan/tree/master/pkg/policies/opa/rego
 - https://github.com/Checkmarx/kics/tree/master/assets/queries/terraform
 blogs:
- https://www.styra.com/blog/policy-based-infrastructure-guardrails-with-terraform-and-opa
+- https://www.styra.com/blog/policy-based-infrastructure-guardrails-with-terraform-and-opa/
 inventors:
 - fugue
 - accurics
@@ -14,8 +14,8 @@ software:
 code:
 - https://github.com/walt-id/waltid-ssikit
 tutorials:
- https://docs.walt.id/v/ssikit/ssi-kit/open-policy-agent
- https://docs.walt.id/v/ssikit/concepts/verification-policies/dynamic-policies
+- https://docs-old.walt.id/ssikit/concepts/open-policy-agent
+- https://docs-old.walt.id/ssikit/concepts/verification-policies/dynamic-policies
 videos:
 - title: Verifying W3C Verifiable Credentials with the SSI Kit using OPA (Open Policy
    Agent)
@@ -28,7 +28,7 @@ docs_features:
    note: |
      SSI Kit's CLI exposes policy management commands which update a local
      OPA instance. The feature is
-      [documented in the walt.id docs](https://docs.walt.id/v/ssikit/concepts/open-policy-agent).
+      [documented in the walt.id docs](https://docs-old.walt.id/ssikit/concepts/open-policy-agent).
 ---
 Verifying W3C Verifiable Credentials for building SSI (Self-Sovereign Identity) use cases.