mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-13 03:42:35 -06:00
02ea7b7dc2a63ea3033cf69ff9a1660efdb48171
6615 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Sebastian Spaink
|
02ea7b7dc2 |
repl: Enable bracketed paste to fix pasted tabs (#8882)
Fixes: #962 Pasting a snippet containing a tab into the REPL triggered tab-completion on the pasted tab, corrupting the input (e.g. injecting a completion candidate mid-line and producing a spurious parse error). Spaces were unaffected, so the bug only surfaced with tab-indented pastes. The fix is bracketed paste: with it enabled, a terminal wraps pasted text in paste markers and the line-reader inserts it literally instead of treating an embedded tab as a completion request. The previous reader, peterh/liner, has no bracketed-paste support and is unmaintained (last release 2021; the same fix was proposed upstream in peterh/liner#114 in 2019 with no traction), so this replaces it with reeflective/readline, which supports bracketed paste, completion, and history. OPA's existing multi-line buffering (the r.buffer parse-retry mechanism) is kept as-is; readline's native multi-line editing is left disabled to avoid changing REPL behavior. --------- Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
Sebastian Spaink
|
5f986bcfda |
ast: fix aliased comment buffer in annotation parser (#8925)
Fixes: #8757 The pooled metadataParser reuses its comment slice across METADATA blocks, and Parse stored it on the Annotations without copying. A later block's parse then overwrote an earlier annotation's comments, corrupting its EndLoc. opa build --optimize=1 prunes comments by each annotation's row range, so a corrupted EndLoc dropped a METADATA block's body while keeping the bare "# METADATA" marker, yielding bundles that fail to parse on load. Clone the slice so each Annotations owns its comments. --------- Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
dependabot[bot]
|
89a1e7bdfb |
build(deps): bump the dependencies group across 1 directory with 4 updates
Bumps the dependencies group with 4 updates in the / directory: [github.com/dgraph-io/badger/v4](https://github.com/dgraph-io/badger), [github.com/vektah/gqlparser/v2](https://github.com/vektah/gqlparser), [golang.org/x/text](https://github.com/golang/text) and [google.golang.org/grpc](https://github.com/grpc/grpc-go). Updates `github.com/dgraph-io/badger/v4` from 4.9.2 to 4.9.4 - [Release notes](https://github.com/dgraph-io/badger/releases) - [Changelog](https://github.com/dgraph-io/badger/blob/main/CHANGELOG.md) - [Commits](https://github.com/dgraph-io/badger/compare/v4.9.2...v4.9.4) Updates `github.com/vektah/gqlparser/v2` from 2.5.35 to 2.5.36 - [Release notes](https://github.com/vektah/gqlparser/releases) - [Commits](https://github.com/vektah/gqlparser/compare/v2.5.35...v2.5.36) Updates `golang.org/x/text` from 0.38.0 to 0.40.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](https://github.com/golang/text/compare/v0.38.0...v0.40.0) Updates `google.golang.org/grpc` from 1.81.1 to 1.82.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.0) --- updated-dependencies: - dependency-name: github.com/dgraph-io/badger/v4 dependency-version: 4.9.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: github.com/vektah/gqlparser/v2 dependency-version: 2.5.36 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: golang.org/x/text dependency-version: 0.40.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: google.golang.org/grpc dependency-version: 1.82.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]
|
b011c0dca4 |
build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 in /e2e
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]
|
6c51a0bf3a |
build(deps): bump @hono/node-server and prisma in /e2e/api/compile/prisma (#8931)
Removes [@hono/node-server](https://github.com/honojs/node-server). It's no longer used after updating ancestor dependency [prisma](https://github.com/prisma/prisma/tree/HEAD/packages/cli). These dependencies need to be updated together. Removes `@hono/node-server` Updates `prisma` from 7.8.0 to 7.9.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prisma/prisma/releases">prisma's releases</a>.</em></p> <blockquote> <h2>7.9.0</h2> <p>Today, we are excited to share the <code>7.9.0</code> stable release 🎉</p> <p><strong>🌟 Star this repo for notifications about new releases, bug fixes & features — or <a href="https://pris.ly/x">follow us on X</a>!</strong></p> <h1>Highlights</h1> <h2>ORM</h2> <h3>Tab completions for the Prisma CLI</h3> <p>Typing out CLI commands from memory is now optional. Prisma ships <strong>shell tab completions</strong> for <code>bash</code>, <code>zsh</code>, <code>fish</code>, and PowerShell, covering commands, subcommands, options, flags, and even option values.</p> <p><strong>Setting it up.</strong> Most projects run Prisma through a package manager, so completions are enabled through <code>@bomb.sh/tab</code>'s package-manager integration — install it once, then source the completion for your package manager and shell:</p> <pre lang="bash"><code># 1. Install @bomb.sh/tab globally npm install -g @bomb.sh/tab <h1>2. Wire up your package manager + shell (pnpm shown; swap in npm / yarn / bun):</h1> <p>echo 'source <(tab pnpm zsh)' >> ~/.zshrc # zsh<br /> echo 'source <(tab pnpm bash)' >> ~/.bashrc # bash<br /> tab pnpm fish > ~/.config/fish/completions/pnpm.fish # fish<br /> tab pnpm powershell > ~/.tab-pnpm.ps1 # PowerShell (then dot-source it from $PROFILE)<br /> </code></pre></p> <p><code>@bomb.sh/tab</code> delegates to any locally-installed CLI that ships completions, so <code>pnpm prisma <TAB></code>, <code>pnpm exec prisma <TAB></code>, <code>yarn prisma <TAB></code>, and <code>bun x prisma <TAB></code> all complete Prisma's commands, options, and values — no per-project setup. (<code>npx</code> and <code>bunx</code> don't support completion themselves; use <code>npm exec</code> and <code>bun x</code>.)</p> <p>If instead you have Prisma installed globally on your <code>PATH</code>, source its own completion directly: <code>source <(prisma complete zsh)</code> (or the <code>bash</code> / <code>fish</code> / <code>powershell</code> variant).</p> <p>This is built on <a href="https://github.com/bombshell-dev/tab/"><code>@bomb.sh/tab</code></a>, the same completion library that powers other CLIs in the ecosystem — including Cloudflare, Nuxt, and Vitest — so the package-manager completions you enable for Prisma work for those tools too. A wonderful community contribution from <a href="https://github.com/AmirSa12"><code>@AmirSa12</code></a> (<a href="https://redirect.github.com/prisma/prisma/pull/28351">#28351</a>) — thank you!</p> <p><a href="https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83">https://github.com/user-attachments/assets/1f916a60-ee4d-40be-bb7d-74035d48ca83</a></p> <h3>Prisma ORM, ready for AI agents</h3> <p>Coding agents are now a first-class audience for Prisma, and 7.9.0 brings the first wave of work to make Prisma projects safe and productive for them to work in.</p> <p><strong>Agent skills installed with <code>prisma init</code></strong> (<a href="https://redirect.github.com/prisma/prisma/pull/29689">#29689</a>)</p> <p><code>prisma init</code> now installs the <a href="https://github.com/prisma/skills">prisma/skills</a> catalog into freshly scaffolded projects. Agents such as Claude Code, Cursor, Codex, and Windsurf start out with current, version-relevant Prisma knowledge instead of relying on whatever happened to be in their training data. The install is best-effort and never blocks scaffolding; opt out at any time with <code>--no-skills</code>.</p> <pre lang="terminal"><code>npx prisma@latest init </code></pre> <p><img src="https://github.com/user-attachments/assets/8244a6dc-cdad-4028-a652-bb5ac6e4b271" alt="prisma init scaffolds a project and installs the Prisma agent skills catalog" /></p> <p><strong>A safer default around destructive commands</strong> (<a href="https://redirect.github.com/prisma/prisma/pull/29684">#29684</a>, <a href="https://redirect.github.com/prisma/prisma/pull/29691">#29691</a>, <a href="https://redirect.github.com/prisma/prisma/pull/29713">#29713</a>)</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prisma/prisma/commit/537583cedbab5a51a9c39405d8e7e18bd9a44c97"><code>537583c</code></a> feat(cli): add <code>@bomb.sh/tab</code> completions (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/cli/issues/28351">#28351</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/bf7c40f9b1828a0187363096c3d9f83b1b3c8a25"><code>bf7c40f</code></a> fix(cli): update Studio to 0.33.0 and suppress aborted response errors (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/cli/issues/29720">#29720</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/9acd8dcdc9395df8f8c4de241b8cfbfd2da227e9"><code>9acd8dc</code></a> feat(cli): install Prisma agent skills during prisma init (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/cli/issues/29689">#29689</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/aef8cb57f395f1d3499d8c472f44306a63cd4aa7"><code>aef8cb5</code></a> fix(cli): remove the migrate-reset tool from the MCP server (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/cli/issues/29691">#29691</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/cdca3335b392483aeb4ee5483cda436e4aaffb1a"><code>cdca333</code></a> chore(deps): update <code>@prisma/dev</code> to 0.24.14 (<a href="https://github.com/prisma/prisma/tree/HEAD/packages/cli/issues/29686">#29686</a>)</li> <li><a href="https://github.com/prisma/prisma/commit/fda8fbce23b3af6b1651bd539da09e62c863ed6e"><code>fda8fbc</code></a> chore(deps): bump <code>@prisma/dev</code> to 0.24.9 (resolves hono GHSA-92pp-h63x-v22m) (...</li> <li>See full diff in <a href="https://github.com/prisma/prisma/commits/7.9.0/packages/cli">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
564a187c1f |
build(deps): bump fast-uri from 3.1.2 to 3.1.4 in /docs (#8930)
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fastify/fast-uri/releases">fast-uri's releases</a>.</em></p> <blockquote> <h2>v3.1.4</h2> <h2>⚠️ Security Release</h2> <p>Fix for <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx">https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx</a></p> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.4">https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.4</a></p> <h2>v3.1.3</h2> <h2>⚠️ Security Release</h2> <ul> <li>Fixes: <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6">https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.3">https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.3</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fastify/fast-uri/commit/6aeece669e4166b2446a89f17c07a3b15dfb7ed4"><code>6aeece6</code></a> Bumped v3.1.4</li> <li><a href="https://github.com/fastify/fast-uri/commit/2d50fbabc80e4d0884fe0f6a98fe118ce6faa353"><code>2d50fba</code></a> fix: reject literal backslash in URI authority</li> <li><a href="https://github.com/fastify/fast-uri/commit/0549fe35b0d482233f3be2816439f3ec803603fa"><code>0549fe3</code></a> Bumped v3.1.3</li> <li><a href="https://github.com/fastify/fast-uri/commit/2a6d357a18a68e6d812824379fd3388a1ae50d05"><code>2a6d357</code></a> Merge commit from fork</li> <li>See full diff in <a href="https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
16b238da79 |
build(deps): bump dompurify from 3.4.11 to 3.4.12 in /docs (#8929)
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.11 to 3.4.12. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cure53/DOMPurify/releases">dompurify's releases</a>.</em></p> <blockquote> <h2>DOMPurify 3.4.12</h2> <ul> <li>Fixed an issue where a hook would not get called for custom elements, thanks <a href="https://github.com/Rikuxx0"><code>@Rikuxx0</code></a></li> <li>Hardened the handling of hooks removing elements, <a href="https://github.com/mkrause-bee360"><code>@mkrause-bee360</code></a></li> <li>Added support for a few new SVG attributes, thanks <a href="https://github.com/cbn-falias"><code>@cbn-falias</code></a> & <a href="https://github.com/Develop-KIM"><code>@Develop-KIM</code></a></li> <li>Hardened the handling of declarative partial updates</li> <li>Updated the documentation is several spots, README, wiki, etc.</li> <li>Bumped several dependencies where possible</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cure53/DOMPurify/commit/a9ca1e537422319a557a9a2aa61f003b23b4a197"><code>a9ca1e5</code></a> release: 3.4.12 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1537">#1537</a>)</li> <li>See full diff in <a href="https://github.com/cure53/DOMPurify/compare/3.4.11...3.4.12">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
522a91ed63 |
build(deps): bump svgo from 3.3.3 to 3.3.4 in /docs (#8928)
Bumps [svgo](https://github.com/svg/svgo) from 3.3.3 to 3.3.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/svg/svgo/releases">svgo's releases</a>.</em></p> <blockquote> <h2>v3.3.4</h2> <h2>What's Changed</h2> <h3>Security</h3> <ul> <li><a href="https://svgo.dev/docs/plugins/removeScripts/">removeScriptElement</a>, remove JavaScript URIs case-insensitively and make <code><script></code> handling namespace aware. By <a href="https://github.com/SethFalco"><code>@SethFalco</code></a></li> </ul> <h2>Support</h2> <p>SVGO v3 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.</p> <p>Consider reading our <a href="https://svgo.dev/docs/migrations/migration-from-v3-to-v4/">Migration Guide from v3 to v4</a> which should ease the process.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/svg/svgo/commit/72a23886b4698b27624b936f3a15a80afd36d75f"><code>72a2388</code></a> Merge commit from fork</li> <li>See full diff in <a href="https://github.com/svg/svgo/compare/v3.3.3...v3.3.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
ea379447ad |
build(deps): bump hono from 4.12.25 to 4.12.31 in /e2e/api/compile/prisma (#8926)
Bumps [hono](https://github.com/honojs/hono) from 4.12.25 to 4.12.31. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/hono/releases">hono's releases</a>.</em></p> <blockquote> <h2>v4.12.31</h2> <h2>What's Changed</h2> <ul> <li>test(context): assert case-insensitive header names in response helpers by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5116">honojs/hono#5116</a></li> <li>chore(benchmark): add app.fetch() overhead benchmark by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5117">honojs/hono#5117</a></li> <li>refactor(aws-lambada): remove FIXME in <code>@ts-expect-error</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5130">honojs/hono#5130</a></li> <li>fix(utils/body): reuse cached formData in <code>parseBody()</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5131">honojs/hono#5131</a></li> <li>fix(request): fix multipart boundary mismatch in <code>cloneRawRequest</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5133">honojs/hono#5133</a></li> <li>fix(sse): emit retry feild when retry is <code>0</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5135">honojs/hono#5135</a></li> <li>test(validator): fix misspelled identifier in transform type test by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5136">honojs/hono#5136</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.30...v4.12.31">https://github.com/honojs/hono/compare/v4.12.30...v4.12.31</a></p> <h2>v4.12.30</h2> <h2>What's Changed</h2> <ul> <li>chore(benchmark/routers): bump deps in <a href="https://redirect.github.com/honojs/hono/pull/5107">honojs/hono#5107</a></li> <li>chore(benchmark): remove not used benchmarks in <a href="https://redirect.github.com/honojs/hono/pull/5108">honojs/hono#5108</a></li> <li>chore: update to ts6 in prep for ts7 in <a href="https://redirect.github.com/honojs/hono/pull/5104">honojs/hono#5104</a></li> <li>fix(cache): deduplicate Cache-Control directives case-insensitively in <a href="https://redirect.github.com/honojs/hono/pull/5025">honojs/hono#5025</a></li> <li>fix(compress): do not compress 206 Partial Content responses in <a href="https://redirect.github.com/honojs/hono/pull/5020">honojs/hono#5020</a></li> <li>fix(client): replaceUrlParam should not match a param that prefixes another in <a href="https://redirect.github.com/honojs/hono/pull/5096">honojs/hono#5096</a></li> <li>fix(method-override): set duplex when forwarding a stream body in query mode in <a href="https://redirect.github.com/honojs/hono/pull/5110">honojs/hono#5110</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.29...v4.12.30">https://github.com/honojs/hono/compare/v4.12.29...v4.12.30</a></p> <h2>v4.12.29</h2> <h2>What's Changed</h2> <ul> <li>fix(client): merge function headers with per-request headers by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5092">honojs/hono#5092</a></li> <li>chore: fix no-op tsc in test script by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5093">honojs/hono#5093</a></li> <li>fix(lambda-edge): resolve the handler with the value passed to the callback by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5094">honojs/hono#5094</a></li> <li>docs(language): add JSDoc <a href="https://github.com/example"><code>@example</code></a> to languageDetector by <a href="https://github.com/codebybilal18"><code>@codebybilal18</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5081">honojs/hono#5081</a></li> <li>test(workerd): add <code>compatibilityDate</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5100">honojs/hono#5100</a></li> <li>fix(lambda-edge): base64 encode content-encoded response bodies by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5099">honojs/hono#5099</a></li> <li>fix(aws-lambda): treat any non-identity content-encoding as binary by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5101">honojs/hono#5101</a></li> <li>fix(types): strip extra properties from array types in JSONParsed by <a href="https://github.com/Arman-Luthra"><code>@Arman-Luthra</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5103">honojs/hono#5103</a></li> <li>fix(trie-router): match empty wildcard remainder after regexp param by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5102">honojs/hono#5102</a></li> <li>fix(etag): treat If-None-Match: <code>*</code> as a match by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5084">honojs/hono#5084</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/codebybilal18"><code>@codebybilal18</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/hono/pull/5081">honojs/hono#5081</a></li> <li><a href="https://github.com/Arman-Luthra"><code>@Arman-Luthra</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/hono/pull/5103">honojs/hono#5103</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.28...v4.12.29">https://github.com/honojs/hono/compare/v4.12.28...v4.12.29</a></p> <h2>v4.12.28</h2> <h2>What's Changed</h2> <ul> <li>fix(serve-static): treat empty string content as found by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5062">honojs/hono#5062</a></li> <li>docs(MIGRATION): fix req.raw.headers reference (property, not method) by <a href="https://github.com/EduardF1"><code>@EduardF1</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5047">honojs/hono#5047</a></li> <li>chore: don't publish <code>*.tsbuildinfo</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5066">honojs/hono#5066</a></li> <li>fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5067">honojs/hono#5067</a></li> <li>fix: avoid circular dependency between body.ts and request.ts by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/hono/pull/5071">honojs/hono#5071</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/hono/commit/cadff88bba34153646c9b35f24d7cc0cb61be913"><code>cadff88</code></a> 4.12.31</li> <li><a href="https://github.com/honojs/hono/commit/64c613ab0f15526b0c0edb25ad0c2989eace2ea1"><code>64c613a</code></a> test(validator): fix misspelled identifier in transform type test (<a href="https://redirect.github.com/honojs/hono/issues/5136">#5136</a>)</li> <li><a href="https://github.com/honojs/hono/commit/aeba9ece778fb24953816fd3517858ff80de958f"><code>aeba9ec</code></a> fix(sse): emit retry feild when retry is <code>0</code> (<a href="https://redirect.github.com/honojs/hono/issues/5135">#5135</a>)</li> <li><a href="https://github.com/honojs/hono/commit/d7964503c956ae4af78597b7b11a05f9e5e73d2d"><code>d796450</code></a> fix(request): fix multipart boundary mismatch in <code>cloneRawRequest</code> (<a href="https://redirect.github.com/honojs/hono/issues/5133">#5133</a>)</li> <li><a href="https://github.com/honojs/hono/commit/80959d47d56ac18c2985336ad311917dc56497c5"><code>80959d4</code></a> fix(utils/body): reuse cached formData in <code>parseBody()</code> (<a href="https://redirect.github.com/honojs/hono/issues/5131">#5131</a>)</li> <li><a href="https://github.com/honojs/hono/commit/21b44b6db6118fc77fabb49832fc4cadd0ef8ec8"><code>21b44b6</code></a> refactor(aws-lambada): remove FIXME in <code>@ts-expect-error</code> (<a href="https://redirect.github.com/honojs/hono/issues/5130">#5130</a>)</li> <li><a href="https://github.com/honojs/hono/commit/5f738971b57b54077b9932fb7b916cf8517534a7"><code>5f73897</code></a> docs(combine): close quote in combine JSDoc example (<a href="https://redirect.github.com/honojs/hono/issues/5126">#5126</a>)</li> <li><a href="https://github.com/honojs/hono/commit/c285f9a498623fe0d2992b31c77b3738c0c0a54d"><code>c285f9a</code></a> chore(benchmark): add app.fetch() overhead benchmark (<a href="https://redirect.github.com/honojs/hono/issues/5117">#5117</a>)</li> <li><a href="https://github.com/honojs/hono/commit/fb9d7bf8fb0dd7b3c92a0c289d5dc685edf5f3a3"><code>fb9d7bf</code></a> test(context): assert case-insensitive header names in response helpers (<a href="https://redirect.github.com/honojs/hono/issues/5116">#5116</a>)</li> <li><a href="https://github.com/honojs/hono/commit/b2ae3a2204a48ce15a26448fd746d39745eb1837"><code>b2ae3a2</code></a> 4.12.30</li> <li>Additional commits viewable in <a href="https://github.com/honojs/hono/compare/v4.12.25...v4.12.31">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for hono since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
1a5a35eb13 |
build(deps): bump markdown-it and markdownlint-cli2 in /docs (#8923)
Bumps [markdown-it](https://github.com/markdown-it/markdown-it) to 14.3.0 and updates ancestor dependency [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2). These dependencies need to be updated together. Updates `markdown-it` from 14.1.1 to 14.3.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md">markdown-it's changelog</a>.</em></p> <blockquote> <h2>[14.3.0] - 2026-07-02</h2> <h3>Changed</h3> <ul> <li>Reworked build pipeline & tools.</li> <li>Added source maps.</li> <li>Bumped <code>linkify-it</code> to 5.0.2.</li> </ul> <h3>Fixed</h3> <ul> <li>Preserve backslash-space hard line breaks, matching CommonMark 6.7, <a href="https://redirect.github.com/markdown-it/markdown-it/issues/1185">#1185</a>.</li> </ul> <h2>[14.2.0] - 2026-05-24</h2> <h3>Added</h3> <ul> <li><code>isPunctCharCode</code> to utilities.</li> </ul> <h3>Fixed</h3> <ul> <li>Don't end HTML comment blocks on a blank line, <a href="https://redirect.github.com/markdown-it/markdown-it/issues/1155">#1155</a>.</li> <li>Properly recognize astral chars (surrogates) in delimiter scans for emphasis-like markers, <a href="https://redirect.github.com/markdown-it/markdown-it/issues/1072">#1072</a>. Big thanks to <a href="https://github.com/tats-u"><code>@tats-u</code></a> for his global efforts with improving CJK support.</li> <li>Preserve unicode whitespaces when trimm headings/paragraphs, <a href="https://redirect.github.com/markdown-it/markdown-it/issues/1074">#1074</a>.</li> <li>More strict entities decode to avoid false positives <code>;</code>, <a href="https://redirect.github.com/markdown-it/markdown-it/issues/1096">#1096</a>.</li> <li>Restore block parser state on fail in <code>lheading</code> rule, <a href="https://redirect.github.com/markdown-it/markdown-it/issues/1131">#1131</a>.</li> </ul> <h3>Security</h3> <ul> <li>Fixed poor smartquotes perfomance on > 70k quotes in single block</li> <li>Bumped linkify-it to 5.0.1 with fixed potential perfomance issues.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/markdown-it/markdown-it/commit/ff0ee084fc6b0d10fac049fa562bc2925b5cc723"><code>ff0ee08</code></a> 14.3.0 released</li> <li><a href="https://github.com/markdown-it/markdown-it/commit/52e2749ab25aaf841bf74b50560929aa93b8e14d"><code>52e2749</code></a> Bump linkify-it / vite deps</li> <li><a href="https://github.com/markdown-it/markdown-it/commit/56c2404e6d3e78632ce7b37a95f289fc04330c76"><code>56c2404</code></a> fix: keep backslash-space hard line break (CommonMark 6.7) (<a href="https://redirect.github.com/markdown-it/markdown-it/issues/1185">#1185</a>)</li> <li><a href="https://github.com/markdown-it/markdown-it/commit/0fbb18b23145158a39255f7476c781dbce320a16"><code>0fbb18b</code></a> Bump vite from 8.0.14 to 8.0.16 (<a href="https://redirect.github.com/markdown-it/markdown-it/issues/1181">#1181</a>)</li> <li><a href="https://github.com/markdown-it/markdown-it/commit/83450e2bc3836ad9f68f652e5685031e9dce4897"><code>83450e2</code></a> Rework benchmark deps and bump versions</li> <li><a href="https://github.com/markdown-it/markdown-it/commit/57a68632ce317593fe316b7131105b131691b90b"><code>57a6863</code></a> benchmark => tinybench</li> <li><a href="https://github.com/markdown-it/markdown-it/commit/7608db19a5b14f84b47b34cced43c574b1abfd0c"><code>7608db1</code></a> Update CI config</li> <li><a href="https://github.com/markdown-it/markdown-it/commit/9d8eb42a72e0e576125733acc7ae6154e8f6cb5a"><code>9d8eb42</code></a> Added package-lock and updated versions to latest possible</li> <li><a href="https://github.com/markdown-it/markdown-it/commit/0aee70db5e8284c84201d39d64c2b14228fd280a"><code>0aee70d</code></a> lint: enable <code>@stylistic/no-multi-spaces</code> rule</li> <li><a href="https://github.com/markdown-it/markdown-it/commit/88789854dc44db99b7736fd4349487dfda0d4067"><code>8878985</code></a> lint => neostandard</li> <li>Additional commits viewable in <a href="https://github.com/markdown-it/markdown-it/compare/14.1.1...14.3.0">compare view</a></li> </ul> </details> <br /> Updates `markdownlint-cli2` from 0.22.1 to 0.23.1 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/DavidAnson/markdownlint-cli2/blob/main/CHANGELOG.md">markdownlint-cli2's changelog</a>.</em></p> <blockquote> <h2>0.23.1</h2> <ul> <li>Show attempted fix counts after fixing</li> <li>Update dependencies (including <code>markdownlint</code>)</li> </ul> <h2>0.23.0</h2> <ul> <li>Add <code>overrides</code> configuration option</li> <li>Improve options/configuration file handling</li> <li>Update dependencies (including <code>markdownlint</code>)</li> <li>Remove support for end-of-life Node 20</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/06f92c99e930c11230426b5edd775021d25e08a8"><code>06f92c9</code></a> Update to version 0.23.1.</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/a77352640f8667a658349c68d14db1368c6b22ba"><code>a773526</code></a> Freshen list of external custom rules included with the markdownlint-cli2-rul...</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/437b0caae2b2f39d061309567f99f9c23eb1f1e5"><code>437b0ca</code></a> Bump eslint-plugin-jsdoc from 63.0.11 to 63.0.12</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/5463e0fa275b9105ed02dbae9ea6848d062d1c1e"><code>5463e0f</code></a> Bump eslint-plugin-unicorn from 70.0.0 to 71.0.0</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/b04ac138a26acc3f65a5e5482825cc938885b7b9"><code>b04ac13</code></a> Bump globby from 16.2.0 to 16.2.1</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/1e63f97b080fc2aac9a426379e96e82542cf78a8"><code>1e63f97</code></a> Revert commit afb7d9898724f0d96279116bbb6f0d1026fff8df "Pin CI workflow's pnp...</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/040594ba722e8d319c2e172bf9771d1ba8474d51"><code>040594b</code></a> Update dependency: markdownlint to 0.41.1.</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/4d97fa85a1eff2af23011c7f4838738332847f64"><code>4d97fa8</code></a> Address new ESLint warnings from previous commit.</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/50cb033a960853cde873c8895849cae94e9f0db7"><code>50cb033</code></a> Bump eslint-node-test from 0.1.0 to 0.2.0</li> <li><a href="https://github.com/DavidAnson/markdownlint-cli2/commit/a53bf04386f8980a027bbb2ed198a5361dbe2b55"><code>a53bf04</code></a> Bump eslint-plugin-jsdoc from 63.0.10 to 63.0.11</li> <li>Additional commits viewable in <a href="https://github.com/DavidAnson/markdownlint-cli2/compare/v0.22.1...v0.23.1">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
5266415db0 |
build(deps): bump webpack-dev-server from 5.2.5 to 5.2.6 in /docs (#8922)
Bumps [webpack-dev-server](https://github.com/webpack/webpack-dev-server) from 5.2.5 to 5.2.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/webpack/webpack-dev-server/releases">webpack-dev-server's releases</a>.</em></p> <blockquote> <h2>v5.2.6</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: allow <code>undefined</code> as the <code>Server</code> constructor <code>options</code> argument again (by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack-dev-server/pull/5695">#5695</a>)</p> <p>Restores accepting <code>undefined</code> (defaulting it to <code>{}</code>) for the <code>options</code> argument, so passing a webpack config's optional <code>devServer</code> field type-checks and works as before.</p> </li> <li> <p>Protect the built-in state-changing routes (<code>/webpack-dev-server/invalidate</code> and <code>/webpack-dev-server/open-editor</code>) against cross-site request forgery. Requests are now checked with <code>Sec-Fetch-Site</code> (falling back to an <code>Origin</code>/<code>Host</code> comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack-dev-server/pull/5698">#5698</a>)</p> </li> <li> <p>Handle malformed <code>Host</code> and <code>Origin</code> header values gracefully when validating requests. (by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack-dev-server/pull/5699">#5699</a>)</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md">webpack-dev-server's changelog</a>.</em></p> <blockquote> <h2>5.2.6</h2> <h3>Patch Changes</h3> <ul> <li> <p>fix: allow <code>undefined</code> as the <code>Server</code> constructor <code>options</code> argument again (by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack-dev-server/pull/5695">#5695</a>)</p> <p>Restores accepting <code>undefined</code> (defaulting it to <code>{}</code>) for the <code>options</code> argument, so passing a webpack config's optional <code>devServer</code> field type-checks and works as before.</p> </li> <li> <p>Protect the built-in state-changing routes (<code>/webpack-dev-server/invalidate</code> and <code>/webpack-dev-server/open-editor</code>) against cross-site request forgery. Requests are now checked with <code>Sec-Fetch-Site</code> (falling back to an <code>Origin</code>/<code>Host</code> comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack-dev-server/pull/5698">#5698</a>)</p> </li> <li> <p>Handle malformed <code>Host</code> and <code>Origin</code> header values gracefully when validating requests. (by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack-dev-server/pull/5699">#5699</a>)</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/webpack/webpack-dev-server/commit/8a37b0ed89d07ca81532188fe19f080a2ee51475"><code>8a37b0e</code></a> chore(release): new release (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5697">#5697</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/f21ed0f44aceb6132abb591ee8b60d770b6e489f"><code>f21ed0f</code></a> fix: handle malformed Host and Origin headers (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5699">#5699</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/80cd9eea54975fe632a518d8bd902a260f374e7c"><code>80cd9ee</code></a> fix: reject cross-site requests to open-editor and invalidate endpoints (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5698">#5698</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/308e853808fc8f5d0722276e1a87aa73c91859a5"><code>308e853</code></a> fix: handle undefined options in Server constructor (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5695">#5695</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/8b2b9151f41e0d6157c8bd051cf5f16bce5dba17"><code>8b2b915</code></a> chore: update branch references from v4 to v5 in workflow configuration</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/870ed2258dda612c8feeaf8d971afd08233696ad"><code>870ed22</code></a> chore: add v5 branch to release workflow triggers</li> <li>See full diff in <a href="https://github.com/webpack/webpack-dev-server/compare/v5.2.5...v5.2.6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Stephan Renatus
|
0def2cd01e |
ast: fix panic when indexing composite literal values in x in [...]
Building the rule index for `<ref> in <collection>` panicked with "illegal value" whenever the collection contained an object or set element (or an array nesting one), since updateMemberRefInValue inserts each collection element into the trie as-is, without restricting it to scalars/arrays like the equality-based indexing does. Such elements now fall back to the trie's "any" node, like an unbound Var: the rule stays a candidate for every input, and body evaluation determines the actual result. Other Value types considered (Ref, comprehensions, Call) can't actually reach the trie from compiled Rego, since the compiler rewrites them into separate statements before the index is built; verified this individually against `opa eval`, so the panic remains for them as a genuine invariant check. Fixes #8918. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
dependabot[bot]
|
33fc04b53a |
build(deps): bump body-parser from 1.20.4 to 1.20.6 in /docs (#8920)
Bumps [body-parser](https://github.com/expressjs/body-parser) from 1.20.4 to 1.20.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/expressjs/body-parser/releases">body-parser's releases</a>.</em></p> <blockquote> <h2>1.20.6</h2> <h2>Important: Security</h2> <ul> <li>Security fix for <a href="https://www.cve.org/CVERecord?id=CVE-2025-13466">CVE-2026-12590</a> (<a href="https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6">GHSA-v422-hmwv-36x6</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>fix: improve limit option validation by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/741">expressjs/body-parser#741</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/expressjs/body-parser/compare/1.20.5...1.20.6">https://github.com/expressjs/body-parser/compare/1.20.5...1.20.6</a></p> <h2>v1.20.5</h2> <h2>What's Changed</h2> <p>The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (<a href="https://redirect.github.com/expressjs/body-parser/pull/716">expressjs/body-parser#716</a>)</p> <ul> <li>refactor(json): simplify strict mode error string construction by <a href="https://github.com/jonchurch"><code>@jonchurch</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/692">expressjs/body-parser#692</a></li> <li>fix: correct off-by-one error in parameterCount by <a href="https://github.com/abhu85"><code>@abhu85</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/716">expressjs/body-parser#716</a></li> <li>deps(qs): bump qs to 6.15.1 by <a href="https://github.com/jonchurch"><code>@jonchurch</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/722">expressjs/body-parser#722</a></li> <li>Release: 1.20.5 by <a href="https://github.com/jonchurch"><code>@jonchurch</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/721">expressjs/body-parser#721</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/abhu85"><code>@abhu85</code></a> made their first contribution in <a href="https://redirect.github.com/expressjs/body-parser/pull/716">expressjs/body-parser#716</a></li> </ul> <p>Special thanks to triager <a href="https://github.com/krzysdz"><code>@krzysdz</code></a> for keeping this on our radar and effectively triaging the specific issue!</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/expressjs/body-parser/compare/1.20.4...1.20.5">https://github.com/expressjs/body-parser/compare/1.20.4...1.20.5</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/expressjs/body-parser/blob/master/HISTORY.md">body-parser's changelog</a>.</em></p> <blockquote> <h1>1.20.6 / 2026-07-09</h1> <ul> <li>Security fix for <a href="https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6">GHSA-v422-hmwv-36x6</a></li> <li>fix: improve <code>limit</code> option validation (<a href="https://redirect.github.com/expressjs/body-parser/issues/698">#698</a>) <ul> <li>Invalid <code>limit</code> values (e.g. unparseable strings or <code>NaN</code>) now throw instead of being silently ignored, which previously disabled size limit enforcement</li> <li><code>null</code> and <code>undefined</code> fall back to the default 100kb limit</li> </ul> </li> </ul> <h1>1.20.5 / 2026-04-24</h1> <ul> <li>refactor(json): simplify strict mode error string construction</li> <li>fix: extended urlencoded parsing of arrays with >100 elements (<a href="https://redirect.github.com/expressjs/body-parser/issues/716">#716</a>)</li> <li>deps: qs@~6.15.1</li> <li></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/expressjs/body-parser/commit/5cc4fb8867c93a3aa4455927e38858c9ab89ff43"><code>5cc4fb8</code></a> 1.20.6 (<a href="https://redirect.github.com/expressjs/body-parser/issues/746">#746</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/3492672eee593d5c158f239b6e9115498a5dbeac"><code>3492672</code></a> fix: improve limit option validation (<a href="https://redirect.github.com/expressjs/body-parser/issues/741">#741</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/0defdbe7f95ad0d3bc007d3a7c59c8c0ab9e6575"><code>0defdbe</code></a> release(patch): 1.20.5</li> <li><a href="https://github.com/expressjs/body-parser/commit/cd0e7a000c53e7be7262d303e57a352b6a00db7f"><code>cd0e7a0</code></a> deps(qs): bump qs to 6.15.1</li> <li><a href="https://github.com/expressjs/body-parser/commit/6f24d7e8bcd9860b136920926ce86da1a7dd1d51"><code>6f24d7e</code></a> fix: correct off-by-one error in parameterCount (<a href="https://redirect.github.com/expressjs/body-parser/issues/716">#716</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/b849bd533d8b4abf5576a3e301f28d9befa05ddd"><code>b849bd5</code></a> deps: qs@~6.14.1 (<a href="https://redirect.github.com/expressjs/body-parser/issues/690">#690</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/2c55e2f712f320a8e8d0f9fcb1d06526d0e401c9"><code>2c55e2f</code></a> refactor(json): simplify strict mode error string construction (<a href="https://redirect.github.com/expressjs/body-parser/issues/692">#692</a>)</li> <li>See full diff in <a href="https://github.com/expressjs/body-parser/compare/1.20.4...1.20.6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
bf3769c64f |
build(deps): bump shell-quote from 1.8.4 to 1.10.0 in /docs (#8921)
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.4 to 1.10.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md">shell-quote's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/ljharb/shell-quote/compare/v1.9.0...v1.10.0">v1.10.0</a> - 2026-07-10</h2> <h3>Merged</h3> <ul> <li>[New] <code>parse</code>: add opt-in <code>splitUnquoted</code> option for shell field-splitting of unquoted expansions <a href="https://redirect.github.com/ljharb/shell-quote/pull/1"><code>[#1](https://github.com/ljharb/shell-quote/issues/1)</code></a></li> </ul> <h3>Commits</h3> <ul> <li>[Fix] <code>parse</code>: match nested <code>${...}</code> braces so nested parameter expansion is consumed as one substitution <a href="https://github.com/ljharb/shell-quote/commit/c0842c8a7a034066da2496a75e91cbe500ff736c"><code>c0842c8</code></a></li> <li>[Tests] <code>parse</code>: pin single-quote literalness and unmatched-quote handling <a href="https://github.com/ljharb/shell-quote/commit/a0d03e35c8ede24016502c4433b8f5d6b3100a62"><code>a0d03e3</code></a></li> <li>[readme] remove the space in js code fences so evalmd evaluates them <a href="https://github.com/ljharb/shell-quote/commit/2116fa36aeea77fe8d561b0db46b1f9b26b8cf1b"><code>2116fa3</code></a></li> <li>[Tests] <code>quote</code>: pin conservative escaping of <code>=</code>, <code>@</code>, <code>^</code>, <code>,</code>, <code>:</code>, <code>!</code> (<a href="https://redirect.github.com/ljharb/shell-quote/issues/11">#11</a>) <a href="https://github.com/ljharb/shell-quote/commit/1c36f3ff77d26d200620c1027e5c271050120b8e"><code>1c36f3f</code></a></li> <li>[readme] document that <code>quote</code> outputs POSIX quoting, not <code>cmd.exe</code>/PowerShell <a href="https://github.com/ljharb/shell-quote/commit/100e96e0ffadcca97d63dda15651c70b9f83507c"><code>100e96e</code></a></li> <li>[readme] document <code>parse</code>'s supported parameter-expansion subset <a href="https://github.com/ljharb/shell-quote/commit/e1c75cd6e4a3c60003792c7f2802587d328622cb"><code>e1c75cd</code></a></li> <li>[Fix] <code>parse</code>: a backslash inside single quotes must not escape the closing quote <a href="https://github.com/ljharb/shell-quote/commit/5d460a332b54b83153297fe7d1964330b28fa491"><code>5d460a3</code></a></li> <li>[readme] fix stale example outputs <a href="https://github.com/ljharb/shell-quote/commit/2de86f5d44f44d3ac9df36413d8a05f3534cdec6"><code>2de86f5</code></a></li> <li>[Tests] <code>quote</code>: pin that a backslash with whitespace is not doubled in single quotes (<a href="https://redirect.github.com/ljharb/shell-quote/issues/14">#14</a>) <a href="https://github.com/ljharb/shell-quote/commit/190e236bcf1d81caa8e40e8ea3bb11998575be71"><code>190e236</code></a></li> <li>[readme] <code>quote</code>: use output verbatim; do not re-quote it (<a href="https://redirect.github.com/ljharb/shell-quote/issues/11">#11</a>) <a href="https://github.com/ljharb/shell-quote/commit/1b364683b1e9e8d078fd3017cde82cf10c9c04a5"><code>1b36468</code></a></li> <li>[Refactor] <code>parse</code>: fix swapped <code>SINGLE_QUOTE</code>/<code>DOUBLE_QUOTE</code> variable names <a href="https://github.com/ljharb/shell-quote/commit/801af5c935b27d6dcda63b3975d5e92a7b6f887f"><code>801af5c</code></a></li> <li>[types] fix an error TS v6 ignores but v7 fails on <a href="https://github.com/ljharb/shell-quote/commit/59bbf8b81bf3236842deb72805744d489f650eba"><code>59bbf8b</code></a></li> <li>[Dev Deps] update <code>@arethetypeswrong/cli</code>, <code>evalmd</code> <a href="https://github.com/ljharb/shell-quote/commit/a04d47516e1cd5b1b4d3f720ddf97561ed0082fc"><code>a04d475</code></a></li> <li>[Dev Deps] update <code>@arethetypeswrong/ci</code>, <code>eslint</code> <a href="https://github.com/ljharb/shell-quote/commit/d390f9a92b97a04b1f799298634e90dc581021e6"><code>d390f9a</code></a></li> <li>[Tests] <code>quote</code>: the tilde test escapes every <code>~</code>, not just a leading one (<a href="https://redirect.github.com/ljharb/shell-quote/issues/9">#9</a>) <a href="https://github.com/ljharb/shell-quote/commit/617d119795c7b44d6e49a4d41f80195c4aa5735c"><code>617d119</code></a></li> </ul> <h2><a href="https://github.com/ljharb/shell-quote/compare/v1.8.4...v1.9.0">v1.9.0</a> - 2026-06-24</h2> <h3>Commits</h3> <ul> <li>[New] add types <a href="https://github.com/ljharb/shell-quote/commit/dca6e21a02df4cc1a83ed1b5baa4d82df134170a"><code>dca6e21</code></a></li> <li>[Dev Deps] update <code>eslint</code> <a href="https://github.com/ljharb/shell-quote/commit/9aa9e8f60991f8c4053a29e476795d891ff851ad"><code>9aa9e8f</code></a></li> <li>[Fix] <code>parse</code>: finalize tokens in linear time (GHSA-395f-4hp3-45gv) <a href="https://github.com/ljharb/shell-quote/commit/7ff5488599d01c323514f02f5efb74088dd134ec"><code>7ff5488</code></a></li> <li>[actions] update workflows <a href="https://github.com/ljharb/shell-quote/commit/75e849741ffaf2d3aa53ae0e18ef6bf9929ef478"><code>75e8497</code></a></li> <li>[actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10<code>@types/esrecurse</code> <a href="https://github.com/ljharb/shell-quote/commit/3fb739de44b81c69431947d54fbfc18998dd6d72"><code>3fb739d</code></a></li> <li>[actions] retry <code>npm install</code> on Windows to survive npm 2/3 staging-rename flake <a href="https://github.com/ljharb/shell-quote/commit/abe0163293c82963fa8a16cfaa87181846d5aced"><code>abe0163</code></a></li> <li>[actions] Windows + node 5/7: install deps with a modern node <a href="https://github.com/ljharb/shell-quote/commit/b4bafa2e7e58d53d9839b1c24976f61e54b43326"><code>b4bafa2</code></a></li> <li>[Fix] <code>quote</code>: escape leading <code>~</code> to prevent shell tilde-expansion <a href="https://github.com/ljharb/shell-quote/commit/7a76c1a12d8461c2234a1c655b943cee84cbff91"><code>7a76c1a</code></a></li> <li>[Dev Deps] update <code>auto-changelog</code>, <code>tape</code> <a href="https://github.com/ljharb/shell-quote/commit/7184b4458b65c17b931e126d8cb5f586c6717dc8"><code>7184b44</code></a></li> <li>[Dev Deps] apparently <code>jackspeak</code> is no longer in the graph <a href="https://github.com/ljharb/shell-quote/commit/9ba368a4057b9f498b0fef23b5b15543ef81b98c"><code>9ba368a</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ljharb/shell-quote/commit/64988d9a0e73a2ae710488952e3614958ef289d4"><code>64988d9</code></a> v1.10.0</li> <li><a href="https://github.com/ljharb/shell-quote/commit/617d119795c7b44d6e49a4d41f80195c4aa5735c"><code>617d119</code></a> [Tests] <code>quote</code>: the tilde test escapes every <code>~</code>, not just a leading one (<a href="https://redirect.github.com/ljharb/shell-quote/issues/9">#9</a>)</li> <li><a href="https://github.com/ljharb/shell-quote/commit/59bbf8b81bf3236842deb72805744d489f650eba"><code>59bbf8b</code></a> [types] fix an error TS v6 ignores but v7 fails on</li> <li><a href="https://github.com/ljharb/shell-quote/commit/190e236bcf1d81caa8e40e8ea3bb11998575be71"><code>190e236</code></a> [Tests] <code>quote</code>: pin that a backslash with whitespace is not doubled in singl...</li> <li><a href="https://github.com/ljharb/shell-quote/commit/a04d47516e1cd5b1b4d3f720ddf97561ed0082fc"><code>a04d475</code></a> [Dev Deps] update <code>@arethetypeswrong/cli</code>, <code>evalmd</code></li> <li><a href="https://github.com/ljharb/shell-quote/commit/b9545b39f4de17aa169410823c98acf58387e474"><code>b9545b3</code></a> [New] <code>parse</code>: add opt-in <code>splitUnquoted</code> option for shell field-splitting of...</li> <li><a href="https://github.com/ljharb/shell-quote/commit/1b364683b1e9e8d078fd3017cde82cf10c9c04a5"><code>1b36468</code></a> [readme] <code>quote</code>: use output verbatim; do not re-quote it (<a href="https://redirect.github.com/ljharb/shell-quote/issues/11">#11</a>)</li> <li><a href="https://github.com/ljharb/shell-quote/commit/1c36f3ff77d26d200620c1027e5c271050120b8e"><code>1c36f3f</code></a> [Tests] <code>quote</code>: pin conservative escaping of <code>=</code>, <code>@</code>, <code>^</code>, <code>,</code>, <code>:</code>, <code>!</code> (<a href="https://redirect.github.com/ljharb/shell-quote/issues/11">#11</a>)</li> <li><a href="https://github.com/ljharb/shell-quote/commit/e1c75cd6e4a3c60003792c7f2802587d328622cb"><code>e1c75cd</code></a> [readme] document <code>parse</code>'s supported parameter-expansion subset</li> <li><a href="https://github.com/ljharb/shell-quote/commit/c0842c8a7a034066da2496a75e91cbe500ff736c"><code>c0842c8</code></a> [Fix] <code>parse</code>: match nested <code>${...}</code> braces so nested parameter expansion is ...</li> <li>Additional commits viewable in <a href="https://github.com/ljharb/shell-quote/compare/v1.8.4...v1.10.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
8c750eb490 |
build(deps): bump js-yaml from 5.1.0 to 5.2.1 in /docs (#8914)
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 5.1.0 to 5.2.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md">js-yaml's changelog</a>.</em></p> <blockquote> <h2>[5.2.1] - 2026-07-02</h2> <h3>Fixed</h3> <ul> <li>Add <code>Map</code> support to !!omap (should work when <code>realMapTag</code> used)</li> </ul> <h3>Security</h3> <ul> <li>Remove quadratic complexity from !!omap <code>addItem</code>. Regression from v5 (usually not critical, because YAML11_SCHEMA is not default anymore).</li> </ul> <h2>4.3.0, 3.15.0 - 2026-06-27</h2> <h3>Security</h3> <ul> <li>Backported <code>maxTotalMergeKeys</code> option.</li> </ul> <h2>[5.2.0] - 2026-06-26</h2> <h3>Added</h3> <ul> <li>Added <code>maxTotalMergeKeys</code> (10000) loader option to limit the total number of keys processed by YAML merge (<code><<</code>) across one <code>load()</code> / <code>loadAll()</code> call.</li> <li>Added <code>maxAliases</code> (-1) loader option to limit the number of YAML aliases per document.</li> </ul> <h3>Removed</h3> <ul> <li><code>maxMergeSeqLength</code> replaced with <code>maxTotalMergeKeys</code> for limiting YAML merge processing.</li> </ul> <h3>Fixed</h3> <ul> <li>Round-trip of integers with exponential form (>= <code>1e21</code>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodeca/js-yaml/commit/ac16b42c46c11c5c7f66062bfc78b168b5f07ecd"><code>ac16b42</code></a> 5.2.1 released</li> <li><a href="https://github.com/nodeca/js-yaml/commit/4a864e55eec5044da67ca95a13f48c73e9ae8c0d"><code>4a864e5</code></a> Deps bump</li> <li><a href="https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe"><code>39f3211</code></a> !!omap: add <code>Map</code> support and remove quadratic complexity</li> <li><a href="https://github.com/nodeca/js-yaml/commit/ff17f1e5bbd1d0dcfb9567ff4526f7206a666f7b"><code>ff17f1e</code></a> Changelog update</li> <li><a href="https://github.com/nodeca/js-yaml/commit/8ed15f1cf6a0f1818ea4c0cd5d3973e87af2158f"><code>8ed15f1</code></a> deps bump</li> <li><a href="https://github.com/nodeca/js-yaml/commit/1a562dc14cac81354643e45936cde968b6da324c"><code>1a562dc</code></a> Fix changelog link</li> <li><a href="https://github.com/nodeca/js-yaml/commit/c28ed5ec1aa66a37b8202e17d0caa122922a1b00"><code>c28ed5e</code></a> 5.2.0 released</li> <li><a href="https://github.com/nodeca/js-yaml/commit/125cd5ab9f1355d4edaf6d95bf3a7099dc333d35"><code>125cd5a</code></a> Add <code>maxAliases</code> option</li> <li><a href="https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1"><code>3105455</code></a> Replace <code>maxMergeSeqLength</code>option with <code>maxTotalMergeKeys</code> (more robust)</li> <li><a href="https://github.com/nodeca/js-yaml/commit/39d00d65eb6b88362a5c806cea57541e687aaccb"><code>39d00d6</code></a> numbers: Drop boxed numbers support, simplify .identify() checks, clarify rou...</li> <li>Additional commits viewable in <a href="https://github.com/nodeca/js-yaml/compare/5.1.0...5.2.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Charlie Egan
|
efebe8044d |
docs: Some minor bug fixes to improve reporting (#8917)
Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Stephan Renatus
|
bdf1d301e0 |
server/failtracer: skip self-referential undefined-ref hints
The compile-time fail hints used a fuzzy match against the ref's top-level segment to suggest typo fixes (e.g. input.frut -> input.fruit). levenshtein.ClosestStrings returns the exact match itself when the top-level segment already matches a declared unknown, so any failure caused by a missing/undefined sub-field (rather than a misspelled top-level name) produced a hint suggesting the exact same ref back, e.g. "input.resource.heading undefined, did you mean input.resource.heading?". Skip the hint entirely in that case, since the fuzzy matcher has no visibility into sub-fields and suggesting the ref unchanged is a no-op. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Sebastian Spaink
|
31065f123e |
cmd/check: report wrapped structured errors individually (#8912)
Fixes #3663 In JSON mode, `opa check -b` collapsed all compilation errors into one opaque string, unlike non-bundle mode which lists each with its code and location. The bundle loader wraps errors as `fmt.Errorf("bundle %s: %w", ...)`, and NewOutputErrors default case stringified the wrapper instead of the structured ast.Errors inside it. The default case now unwraps and recurses, keeping the wrapper's message only when unwrapping reveals nothing structured. Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
Anders Eknert
|
3368497a96 |
test: Start decomissioning test.WithTempFS (#8908)
The `test.WithTempFS` helper is used _extensively_ throughout our tests. Since `t.TempDir()` became a thing (Go 1.16), it probably shouldn't be, as that function does all the same things but in a more idiomatic manner. Main issues with `test.WithTempFS`: - It doesn't take a `*testing.T`, making failures reported without correct/helpful location. - It creates a new scope for no particular reason, where it could just have returned the root directory instead. An additional scope == an additionl level of indentation. This change adds the new `test.TempDir` and `test.TempDirOf` functions, which tries to address these issues. There are way too many places where `test.WithTempFS` is used for me to fix in a single PR, so more will have to come later. Most of the changes here don't even use the new functions, but replace the use of `test.WithTempFS` with `t.TempDir()` directly, as no files were passed to the function there. Also: - Replace a number of `reflect.DeepEqual` calls with better alternatives (not using reflection) Recommended reviewing with whitespace diffs hidden! Signed-off-by: Anders Eknert <anders.eknert@apple.com> |
||
|
Anders Eknert
|
5a33432bd4 |
cmd: Avoid intermediate buffer when writing bundle (#8909)
While likely not important for small bundles, using `opa build` to build large bundles would previously allocate much more memory than was needed, as the bundle would first be written to an intermediate in-memory buffer before getting written to disk. This fixes that by deferring the creation of the output file to the first write, then writing to that directly. Signed-off-by: Anders Eknert <anders.eknert@apple.com> |
||
|
Oluwajuwon Omotayo
|
4cefcaff21 |
ecosystem: add agt-policies-africa — African data protection OPA policy pack (#8850)
### Why the changes in this PR are needed? The OPA Ecosystem page has no coverage of African data protection regulations or AI agent compliance in the African context. Nine African data protection laws are now in force (Nigeria NDPA 2023, Kenya DPA 2019, Ghana Act 843, Rwanda Law 058/2021, Egypt PDPL 151/2020, Mauritius DPA 2017, South Africa POPIA, Tanzania PDPA 2022, Uganda DPPA 2019), and developers building AI agents for African markets have no discoverable OPA policy reference for these jurisdictions. This entry surfaces an existing open-source resource to that audience directly on openpolicyagent.org/ecosystem. ### What are the changes in this PR? Adds a single ecosystem entry file: - `docs/src/data/ecosystem/entries/agt-policies-africa.md` The entry covers: - 9 African jurisdictions, each with a Rego policy and a full `opa test` suite (140+ tests) - Decision semantics: `deny / escalate / audit / allow` — structured for AI agent runtimes - Highlights two OPA docs features: `policy-testing` and `learning-rego` - Uses `allow_missing_image: true` (no logo file included — same pattern as `awesome-opa.md`) ### Notes to assist PR review: - No docs page, sidebar, or Go code changes — ecosystem entry only - Ecosystem entries are auto-discovered; no `sidebars.js` update required - The project is already listed in `awesome-opa` (PR #82, merged June 2026), so the URL is established ### Further comments: The project's primary audience is developers building AI agents for Nigerian and broader African fintech/financial markets, where data residency, transaction-limit enforcement, and PII protection (BVN/NIN/national IDs) are regulatory requirements. OPA is used as the policy decision engine via the REST API and Go SDK. The ecosystem entry brings this niche but growing use case into the discoverability of the OPA ecosystem page alongside other security and compliance tools. I have read the project's [AI tool use guidelines](https://www.openpolicyagent.org/docs/contrib-code#ai-guidelines). Claude Code was used to assist with formatting; all content reflects my own work and understanding of the referenced regulations. --------- Signed-off-by: oluwajuwon omotayo <ginuxtechacademy@gmail.com> Signed-off-by: Charlie Egan <charlie_egan@apple.com> Co-authored-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Paulo Costa
|
e8c8c72217 |
sdk: allow customizing HTTP RoundTripper per Decision (#8884)
### Why the changes in this PR are needed? The OPA SDK (`v1/sdk`) doesn't currently expose the rego-layer `EvalHTTPRoundTripper` primitive added in #7180. Go library embedders that call `opa.Decision(...)` therefore have no way to observe or shape `http.send` round-trips from their policies. Concrete use cases: - **Observability**: attach an outbound HTTP round-trip decorator so each policy-triggered `http.send` shows up in the embedder's request-scoped telemetry (spans, structured logs, per-plugin round-trip capture, etc.). - **Credential injection**: mint or refresh a caller-supplied bearer / mTLS certificate for the exact scope of one decision — a variation on the Minder pattern that motivated #7180 at the rego layer. - **Middleware**: transparently thread retry, backoff, or rate-limit policies in front of `http.send` without policy authors having to do anything. Today, doing any of the above requires either forking the SDK, calling into `rego`/`topdown` directly (losing the SDK's plugin/bundle wiring), or globally registering an `HTTPTracingService` via `pkg/tracing.RegisterHTTPTracing` (which is global, per-process, and coarse-grained). ### What are the changes in this PR? Adds `DecisionOptions.HTTPRoundTripper` (type `topdown.CustomizeRoundTripper`) and threads it through `evalArgs` into the `pq.Eval(...)` call via the existing `rego.EvalHTTPRoundTripper`. - **Backward-compatible.** New nil-defaulted field; existing callers see identical behavior. Covered by a nil-passthrough subtest. - **Per-request scope.** Threading happens on `pq.Eval` opts, not `rego.New` opts, so the prepared-query cache remains shared across decisions and each `Decision` can supply its own transform. - **API consistency.** Uses the same `topdown.CustomizeRoundTripper` type introduced in #7180 for the rego layer — no new naming to litigate, and the SDK field name (`HTTPRoundTripper`) matches `rego.EvalHTTPRoundTripper`. - **Doc-commented gotcha.** The doc comment calls out that the received `*http.Transport` may be `nil` for plain-HTTP requests (post-#7927), matching the pattern exercised by `topdown/http_test.go:TestHTTPWithCustomTransport`'s `secretTransport.Transform`. ### Notes to assist PR review: - Zero changes to public types beyond one new nil-defaulted field on `sdk.DecisionOptions` (which is re-exported to `sdk` as a type alias — no shim edits needed). - No changes to `PartialOptions` — `http.send` is non-deterministic and deferred during partial evaluation, so plumbing it there would have no runtime effect. Happy to add for symmetry if reviewers prefer. - New test `TestDecisionWithHTTPRoundTripper` covers (a) nil field is a no-op (regression guard) and (b) a caller-supplied `CustomizeRoundTripper` is invoked exactly once per `Decision` and its wrapped transport receives the request. ### Further comments: Related prior work: - #7180 — rego-layer `EvalHTTPRoundTripper`; this PR is the SDK-layer follow-up. - #5967 — `plugins.WithDistributedTracingOpts` (per-instance HTTP wrapping for bundle fetches / decision-log pushes; addresses a different traffic class — background rather than per-Decision — and is intentionally out of scope here). - #7927 — nuance about `*http.Transport` sometimes being nil, referenced in the new doc comment. Signed-off-by: Paulo Costa <eu@paulo.costa.nom.br> |
||
|
Charlie Egan
|
c7231bdd0b |
docs: Update regal and blog links (#8901)
Updates to latest regal release and makes some changes to blog.openpolicyagent.org links too. --------- Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Atishay Jain
|
2a1bd4f14e |
topdown: fix precision loss for integers larger than 64 bits in arithmetic and aggregates (#8887)
## Description Fixes #6281. `plus`, `minus`, `multiply`, `sum` and `product` corrupt integers that need more than 64 bits of precision. They route the operands through `builtins.NumberToFloat` (a `big.Float` carrying the default mantissa), so the value is rounded before the operation is applied: ```rego 18446744073709551617 + 1 # 18446744073709551616 (should be ...618) 18446744073709551617 * 2 # 36893488147419103230 (should be ...234) sum([18446744073709551617, 1]) # 18446744073709551616 (should be ...618) product([18446744073709551617, 2]) # 36893488147419103230 (should be ...234) ``` This is the same defect class that #8857 fixed for `format_int`. There is a root cause underneath it that is worth calling out separately, because it is the reason this fails silently rather than erroring: ```go func NumberToInt(n ast.Number) (*big.Int, error) { f := NumberToFloat(n) // rounds here r, accuracy := f.Int(nil) if accuracy != big.Exact { // cannot fire: the rounded float IS an exact integer return nil, errors.New("illegal value") } return r, nil } ``` The accuracy check exists to catch inexact conversions, but the rounding has already happened inside `NumberToFloat`, and the rounded value is itself an integer, so the check passes. `NumberToInt` returns the wrong `big.Int` and reports no error: ``` NumberToInt(18446744073709551617) = 18446744073709551616 NumberToInt(123456789012345678901234567890) = 123456789012345678899921813504 ``` `NumberToInt` also backs `BigIntOperand`, so the corruption is reachable from the `bits.*` builtins as well. ## Fix - `NumberToInt` parses integer literals exactly with `big.Int`, and falls back to `big.Rat` for fractional and exponent forms, so `1e30` stays exact and a genuinely fractional value is rejected rather than silently truncated. - `plus`/`minus`/`multiply` apply the operation on exact `big.Int`s when both operands are integers, mirroring how `format_int` was fixed. - `sum`/`product` accumulate on `big.Int` when every element is an integer, and fall back to the existing float accumulator otherwise (which also preserves the existing operand-type errors). Float, mixed int/float, and small-int behaviour is unchanged, including the existing interned-small-int fast paths. `0.1 + 0.2` still yields `0.3`. Division and modulo are untouched. The thread raises open questions about their expected semantics for big integers, so they felt out of scope here. ## Test Two golden cases: `arithmetic/bignum exact` and `aggregates/bignum exact`, covering >2^64 values through each operation, a 30-digit value, negatives, and the small-int / float / mixed cases that must not change. Results are rendered with `sprintf` in the golden cases because the case loader parses expected numbers as `float64`, which cannot represent these values. Asserting on the numbers directly fails on the loader rather than on the builtin. `format_int`'s golden case sidesteps the same problem by returning strings. Both cases fail on `main` and pass with this change. `go test ./v1/topdown/` passes with no regressions; the failing tests I do see on Windows (`TestCertSelectionLogic`, and several in `v1/rego`) fail identically on a clean checkout of `main`, so they are pre-existing and unrelated. Added WASM exceptions for both cases, as #8857 did, since WASM cannot represent integers larger than 64 bits (#3711). --------- Signed-off-by: Atishyy27 <atishayjain2704@gmail.com> Co-authored-by: Atishyy27 <atishayjain2704@gmail.com> |
||
|
Sebastian Spaink
|
3bf93d9796 |
config: migrate server.metrics and metrics_export validation to Rego (#8900)
Following #8891, which moved top-level config validation to an embedded Rego policy, this migrates the `server/metrics` and `metrics_export` configs onto Rego as well. Plugins register their recognized options via `config.RegisterConfigSpec` (derived from their struct fields) so unknown-option warnings live with each struct that brings the config. The goal is migrate more `validateAndInjectDefaults` in follow up PRs, this setups the foundation for other migrations to follow. --------- Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
Charlie Egan
|
d9ba5b4891 |
website: Import blog from medium (#8898)
This PR imports the blogs from https://medium.com/open-policy-agent into the docusaurus site. This is being done as the blog has stopped working due to the custom domain hosting feature being removed from our tier. The pages have been imported from manually downloaded webarchive files from each post to ensure we captured the assets and rendered code example too. --------- Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
dependabot[bot]
|
cf938e0ba8 |
build(deps): bump websocket-driver from 0.7.4 to 0.7.5 in /docs (#8899)
Bumps [websocket-driver](https://github.com/faye/websocket-driver-node) from 0.7.4 to 0.7.5. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md">websocket-driver's changelog</a>.</em></p> <blockquote> <h3>0.7.5 / 2026-06-04</h3> <ul> <li>Close a draft-75/76 connection if a length header grows to exceed the configured max length</li> <li>Fail the connection if a message is larger than the configured max length after extension processing</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/faye/websocket-driver-node/commit/5d6a9aaf5f019007d917bd9ddc7eeb775c86cc1f"><code>5d6a9aa</code></a> Bump version to 0.7.5</li> <li><a href="https://github.com/faye/websocket-driver-node/commit/c55679a5b18251dd0a55d18a0cc6a4fd8822b92f"><code>c55679a</code></a> Fail the connection if a message is larger than the configured max length aft...</li> <li><a href="https://github.com/faye/websocket-driver-node/commit/5b197ca874dab58e96cacad8a3c256797d804680"><code>5b197ca</code></a> Close a draft-75/76 connection if a length header grows to exceed the configu...</li> <li><a href="https://github.com/faye/websocket-driver-node/commit/fc93a48f879d0fd4a77c687a4a19c4328613df65"><code>fc93a48</code></a> Test on Node v22, v24, and v26</li> <li><a href="https://github.com/faye/websocket-driver-node/commit/2e82d3464d294bdd11202657208636e667212335"><code>2e82d34</code></a> Test on recent versions of Node</li> <li><a href="https://github.com/faye/websocket-driver-node/commit/e4962db9940ad1a8cf6fe8328d3b81c3f8c37479"><code>e4962db</code></a> Switch from Travis CI to GitHub Actions</li> <li><a href="https://github.com/faye/websocket-driver-node/commit/3f2f9b70a8ae999b4657d26316a5d45b7caea679"><code>3f2f9b7</code></a> Travis update: cache npm modules, remove sudo, run on Node 15</li> <li>See full diff in <a href="https://github.com/faye/websocket-driver-node/compare/0.7.4...0.7.5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Sebastian Spaink
|
8e2f1807ac |
config: validate configuration with Rego and warn on unknown options (#8891)
Part of #2745 Like most of his ideas, @anderseknert's suggestion to use Rego to replace the `validateAndInjectDefaults` functions throughout the codebase is another winner. This PR starts the migration by replacing the top-level `validateAndInjectDefaults` in `v1/config/config.go` with an embedded policy, `validate.rego`. The policy injects the top-level defaults (`default_decision`, `default_authorization_decision`, `labels`) and reports unrecognized configuration options, so a typo such as `decision_log` instead of `decision_logs` is logged as a warning at startup rather than silently ignored. It's evaluated in `ParseConfig` using the low-level `ast`/`topdown` packages rather than the top-level `rego` package. This keeps `config` off the heavy `rego → bundle → …` dependency web (which would otherwise create import cycles as more packages' tests reach `config`), and we don't need any of the `rego` package's conveniences here — it's one module compiled once and a single query. The Rego unit tests run in CI via `build/run-rego-tests.sh` (and locally with `make rego-test`). This sets the foundation for the other plugin `validateAndInjectDefaults` functions to migrate to Rego as well; where the logic isn't too complicated it should be a fairly easy replacement. At the moment all known keys live in `validate.rego` under `_specs` to support the "warn on unrecognized options" check, but the plugin-specific entries can move closer to each plugin as it migrates. It would also be nice for `_specs` to be auto-generated somehow in the future. Supporting extension of config validation with custom policies is something I'd like to follow up with, so keeping #2745 open for now. I also think these policies could be reusable with [java-opa-sdk](https://github.com/open-policy-agent/java-opa-sdk) 👀 Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
Sebastian Spaink
|
9e7dc5c430 |
ast: make CogeneratedExprs return deterministic order
CogeneratedExprs built its result slice by iterating the 'visited' map, so the order of the returned expressions was randomized by Go's map iteration. PrettyEvent walks these co-generated expressions in order to populate the --var-values output; when a base variable is reachable from refs in more than one co-generated expression (e.g. 'tc' in 'tc.data == tc.expected.data'), the walk order decides which column that variable is reported at. The randomized order made the pretty output flip between runs, causing TestFailVarValues to fail intermittently. Append to the result slice during visitation instead, using the map only for dedup, so the returned order follows the deterministic generates/generatedFrom structure. Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
Sebastian Spaink
|
55e859d73f |
ast: make := RHS directional in safety checks (#8874)
Fixes: #3546 `:=` is currently sugar for `=`, so the safety checker can satisfy an assignment's RHS by unifying backwards through the LHS. As a result `x := y; x = 7` compiles (binding `y` to `7`) even though `y` is never assigned, and `x := y; obj[x]` can silently turn a constant-time lookup into full iteration. Mark equality expressions rewritten from `:=` and exclude the LHS from the safe basis when computing their output variables, so a value cannot flow LHS->RHS. RHS reference iteration (e.g. `some k; v := obj[k]`) is unaffected. This is a deliberate semantic change, and is backwards-incompatible: affected policies now fail with a rego_unsafe_var_error. --------- Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
Sebastian Spaink
|
632d60e11e |
topdown: resolve ground refs in --var-values output (#8888)
Fixes #7830 When a failing test expression selected a value out of a local variable via a ground ref (e.g. tc.data), the pretty --var-values output only showed the base variable's full value rather than the selected value being compared. Resolution previously only worked for refs the compiler rewrites into locals (calls, arithmetic, variable-keyed refs); plain ground object selections stay inline and were never resolved. Handle ast.Ref terms in PrettyEvent's var walker: resolve a ground ref whose base is a bound local against the local bindings and report the selected value at the ref's location, while still descending to report the base variable too. Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
Stephan Renatus
|
eaf6a345fc |
planner: avoid redundant ruletrie.Children() call in Depth()
Children() rebuilds and sorts a slice from the children map on every call; Depth() was calling it twice (once for the length check, once for the cap hint) for no benefit since only the count is used. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Stephan Renatus
|
54b584c89a |
planner: unify functionMocksStack on generic GroupStack[T]
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Stephan Renatus
|
d0970c5ed3 |
topdown+util: add generic SliceStack/GroupStack, unify refStack/functionMocksStack/saveStack
SliceStack is a plain generic LIFO stack. GroupStack builds on it for the two-level 'stack of slices' pattern shared by functionMocksStack and saveStack: whole groups are pushed/popped, while elements are pushed/popped onto the top group only. Both stacks zero vacated slots on pop, at both levels, so popped values (ast terms, bindings) aren't kept alive by the backing arrays. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Stephan Renatus
|
af21718f79 |
topdown+util: replace hand-rolled evalFunc/evalBuiltin pools with generic ResettablePool
eval.go had two nearly-identical sync.Pool wrappers (evfp, evbp) whose only job was to zero out evalFunc/evalBuiltin fields before returning them to the pool, so pooled values don't keep terms/bindings from a prior call alive. Add util.ResettablePool[T, PT], a generic pool for types whose pointer implements Reset(). The reset method is resolved via a compile-time pointer constraint (PT resettable[T]) rather than a runtime interface assertion, so there's no extra dispatch cost on the Put hot path compared to the hand-written version. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
adrian2monk
|
3f0256edb2 |
Bump oras-go@v2.6.2 to address GHSA-fxhp-mv3v-67qp found it in deps
Signed-off-by: adrian2monk <adrian2monk@gmail.com> |
||
|
Stephan Renatus
|
a7265038f2 |
ast+topdown: parametrized (prefix) external rule sources (#8881)
Let a single registered external source serve an unbounded family of sub-references by adding an optional ParametrizedExternalRuleIndex interface whose ParamArity(tail Ref) int the evaluator queries at lookup time. Fixed arity is the degenerate implementation (return N); the exact-ref path is unchanged (a source that doesn't implement the interface has arity 0, with no forced no-op method — same optional- interface idiom as ExternalRuleIndexCloser). - A single registered prefix can now back an uneven-depth tree — e.g. data.reg.user[k] consuming one key while data.reg.pair[a][b] consumes two — by keying off a leading discriminator segment. - Caching is preserved. The contract constrains the count to depend on the tail's *shape*, not on parameter *values*, so it's known before Lookup and the cache key (prefix + ground params) is still computable up front — no need to call Lookup before knowing the boundary. For example, registering prefix data.foo with ParamArity(data.foo) 1 makes data.foo[<key>].<rule> resolve <key> as a parameter, handed to Lookup via LookupOptions.Params. One source can then serve a distinct set of rules per key without registering each key concretely, so references whose key only comes into existence at runtime resolve without a recompile. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Sebastian Spaink
|
b4d15e0c25 |
ast: Fix non-deterministic type errors when shadowing a built-in (#8880)
Fixes: #3729 A variable that shadows a built-in name (e.g. `count`) via `=` unification was left un-rewritten, so later stages could mistake it for the built-in and raise spurious type errors -- non-deterministically, due to map iteration order in Graph.Sort. Rewrite such body-bound variables to fresh locals, and make Graph.Sort deterministic by ordering nodes before the topological sort. --------- Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
Atishay Jain
|
4f4608576d |
ast: restore location on unsafe var errors for rewritten head vars (#8885)
`opa check` reports `rego_unsafe_var_error` with no file/line when the unsafe variable in a rule head was rewritten, so you get: ``` 1 error occurred: rego_unsafe_var_error: var x is unsafe ``` instead of `p.rego:3: rego_unsafe_var_error: var x is unsafe`. As noted in the issue, this is a regression against v1.13. Note: #8776 proposed the same one-line change before being closed in a stale-PR sweep; I've added the regression test here so it can't silently come back. Fixes #8719. Signed-off-by: Atishyy27 <atishayjain2704@gmail.com> Co-authored-by: Atishyy27 <atishayjain2704@gmail.com> |
||
|
Nikhil Jathar
|
8b147a63bb |
The Zed Rego extension link points at github.com/StyraInc/zed-rego (404). The repo now lives at github.com/StyraOSS/zed-rego.
Signed-off-by: Nikhil Jathar <22786232+mailnike@users.noreply.github.com> |
||
|
Stephan Renatus
|
d517d1b914 |
ast+topdown: let external sources distinguish absent from unknown
External rule sources received a resolver (via ExternalIndex.Tree) that reported both an input reference absent from a concrete input and one that is symbolic under partial evaluation as the same UnknownValueErr. A source therefore could not tell 'concretely missing' apart from 'deliberately unknown' on a per-reference basis (e.g. input.foo unknown while input.bar is known), which matters when a source translates input into an external lookup during partial evaluation. Pass the save-set-aware evaluator to ExternalIndex.Tree instead of the raw input document, mirroring the resolver the built-in rule indexer already uses. Sources opt into the new behavior via ExternalSourceOptions.DistinguishAbsentFromUnknown: when set, an unknown reference returns UnknownValueErr while an absent one resolves to (nil, nil). The default is unchanged, preserving the previous collapse for existing sources. The ExternalRuleSource/ExternalRuleIndex interfaces are unchanged. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Sebastian Spaink
|
78f31260f6 |
sdk: fix deadlock between OPA.Plugin and manager onCommit (#8879)
Fixes: #8873 An intermittent deadlock could occur between sdk.OPA.mtx and plugins.Manager.mtx when they were acquired in opposite orders by two concurrent goroutines: - OPA.Plugin held opa.mtx and then called into the manager, which acquires manager.mtx. - Manager.onCommit held manager.mtx and then invoked the registered compiler trigger, which acquires opa.mtx. Break the cycle from both sides. OPA.Plugin now snapshots the manager under opa.mtx and releases the lock before calling into it, matching the pattern already used by Stop and executeTransaction. Manager.onCommit now snapshots the registered triggers under manager.mtx and invokes them after releasing the lock, so no registered callback runs while the manager lock is held. Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
Sebastian Spaink
|
afb57c7e13 |
topdown: don't leak internal vars in partial eval results (#8872)
Fixes: #6378 Calling a function with an unknown argument the function ignores produced a partial-eval result referencing an internal variable, e.g. __localcp0__ = input.project instead of the equivalent bare ref input.project To record that input.project must be defined, copy propagation keeps the ref but binds it to a generated variable that's used nowhere else — cluttering the result for no benefit. Track these generated variables as placeholders and emit the bare ref instead of the equality. --------- Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
RinZ27
|
d051c7e41a |
server: set ReadHeaderTimeout to 32s on all HTTP servers
Signed-off-by: RinZ27 <222222878+RinZ27@users.noreply.github.com> |
||
|
Charlie Egan
|
e8c3e104fa |
docs: Add kubecon NA page (#8876)
This page will be linked to from the kiosk at KubeCon. https://deploy-preview-8876--openpolicyagent.netlify.app/events/2026-kubecon-na Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Stephan Renatus
|
19855342fe |
build(go): bump to 1.26.5
https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc govulncheck flagged us for: * crypto/tls: Encrypted Client Hello privacy leak The Encrypted Client Hello implementation would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used. Thanks to Coia Prant (github.com/rbqvq) for reporting this issue. This is CVE-2026-42505 and Go issue https://go.dev/issue/79282. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Synvoya
|
65c39790fc |
topdown: fix format_int precision loss for integers larger than 64 bits (#8857)
## Description
`format_int(x, base)` corrupts integers that need more than 64 bits of
precision, in every base. It routes the value through
`builtins.NumberToFloat` (a `big.Float` with a 64-bit mantissa) then
`f.Int()`, so any integer above ~2^64 is rounded before formatting:
```rego
format_int(18446744073709551617, 16) # "10000000000000000" (should be "10000000000000001")
format_int(18446744073709551617, 10) # "18446744073709551616" (should be "...617")
```
`sprintf("%x", [18446744073709551617])` returns the correct
`10000000000000001`, so two builtins disagree on the same exact-integer
value.
## Fix
Format integer inputs through an exact `big.Int` (mirroring
`builtinSprintf`). Fractional/exponent inputs still fall through to the
existing float-truncation path, so `format_int(15.9, 16) == "f"` and
`format_int(-15.9, 16) == "-f"` are unchanged.
## Test
Added a golden case covering a >2^64 integer in bases 2/8/10/16,
negatives, and the fractional-truncation cases. Full `go test
./v1/topdown/` passes (900+ existing string golden cases, no
regressions).
---------
Signed-off-by: Synvoya <16019863+Synvoya@users.noreply.github.com>
Co-authored-by: Synvoya <16019863+Synvoya@users.noreply.github.com>
|
||
|
Charlie Egan
|
39fcb030e5 |
docs: Add Ghostunnel and NATS Plugin to Ecosystem (#8871)
Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
SEONGHYUN HONG
|
deb30b103d |
docs: fix decision_logs buffer_size_limit_events default in prose (#8866)
The `decision_logs.reporting.buffer_size_limit_events` row documents its default as `10000`, but the prose in the same cell says "By default, 100 events are held". The real default is `10000` (`defaultBufferSizeLimitEvents = int64(10000)` in `v1/plugins/logs/plugin.go`), so the row was internally contradictory. This corrects the prose to match both the code and the row's own default column. Docs only. Signed-off-by: s3onghyun <s3onghyun@users.noreply.github.com> |
||
|
Charlie Egan
|
7bdfe03927 |
runtime: Remove goautomaxprocs and automemlimit (#8869)
The memory pressure in low resource containers this PR aimed to fix was
actually caused by #8817, which was fixed in #8829. The
automaxprocs/automemlimit dependencies are no longer needed as was
intended in #8696.
This reverts commit
|