57742e84a9
build(deps): bump webpack-dev-server from 5.2.4 to 5.2.5 in /docs ( #8807 )
...
Bumps
[webpack-dev-server](https://github.com/webpack/webpack-dev-server ) from
5.2.4 to 5.2.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/webpack/webpack-dev-server/releases ">webpack-dev-server's
releases</a>.</em></p>
<blockquote>
<h2>v5.2.5</h2>
<h3>Patch Changes</h3>
<ul>
<li>Skip the HMR WebSocket path when forwarding upgrade requests to
user-defined proxies, so custom proxy WebSocket upgrades are no longer
intercepted by the dev server. (by <a
href="https://github.com/bjohansebas "><code>@bjohansebas</code></a> in
<a
href="https://redirect.github.com/webpack/webpack-dev-server/pull/5680 ">#5680</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md ">webpack-dev-server's
changelog</a>.</em></p>
<blockquote>
<h2>5.2.5</h2>
<h3>Patch Changes</h3>
<ul>
<li>Skip the HMR WebSocket path when forwarding upgrade requests to
user-defined proxies, so custom proxy WebSocket upgrades are no longer
intercepted by the dev server. (by <a
href="https://github.com/bjohansebas "><code>@bjohansebas</code></a> in
<a
href="https://redirect.github.com/webpack/webpack-dev-server/pull/5680 ">#5680</a>)</li>
</ul>
<p>All notable changes to this project will be documented in this file.
See <a
href="https://github.com/conventional-changelog/standard-version ">standard-version</a>
for commit guidelines.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/webpack/webpack-dev-server/commit/c3ee325819f64ceb77f85dcf727b6b5ede85cbc4 "><code>c3ee325</code></a>
chore(release): new release (<a
href="https://redirect.github.com/webpack/webpack-dev-server/issues/5682 ">#5682</a>)</li>
<li><a
href="https://github.com/webpack/webpack-dev-server/commit/60173be90873b187b41fc2009a4de253732988a1 "><code>60173be</code></a>
feat: add changeset validation and release workflow (<a
href="https://redirect.github.com/webpack/webpack-dev-server/issues/5680 ">#5680</a>)</li>
<li><a
href="https://github.com/webpack/webpack-dev-server/commit/948d5e6089bebcd801dac2cbe3ed4f80b64f117a "><code>948d5e6</code></a>
fix(proxy): match the HMR upgrade path exactly like the ws server (<a
href="https://redirect.github.com/webpack/webpack-dev-server/issues/5678 ">#5678</a>)</li>
<li><a
href="https://github.com/webpack/webpack-dev-server/commit/93e8996124332a6c94c4d3e0f8e5f2cf95321c67 "><code>93e8996</code></a>
fix: skip HMR websocket path when forwarding upgrades to user-defined
proxies...</li>
<li>See full diff in <a
href="https://github.com/webpack/webpack-dev-server/compare/v5.2.4...v5.2.5 ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions ">GitHub Actions</a>, a new
releaser for webpack-dev-server since your current version.</p>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/open-policy-agent/opa/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 10:08:13 -05:00
0e6fe9caa2
Add proto schemas for the IR plan and bundle manifest ( #8775 )
...
This adds two new proto schemas:
* v1/bundle/manifest.proto
* v1/ir/plan.proto
---------
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-06-22 10:02:15 -05:00
1a68282b0c
build(deps): bump dompurify from 3.4.10 to 3.4.11 in /docs ( #8803 )
...
Bumps [dompurify](https://github.com/cure53/DOMPurify ) from 3.4.10 to
3.4.11.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/cure53/DOMPurify/releases ">dompurify's
releases</a>.</em></p>
<blockquote>
<h2>DOMPurify 3.4.11</h2>
<ul>
<li>Fixed an issue with a leaky config for hooks via
<code>setConfig</code>, thanks <a
href="https://github.com/trace37labs "><code>@trace37labs</code></a></li>
<li>Bumped vulnerable development dependencies to arrive at plain 0 with
<code>npm audit</code></li>
<li>Updated the <code>osv-scanner</code> suppression list as no
vulnerable dependencies are left for now</li>
<li>Updated up the linting tool-chain and removed now-redundant lint
directives</li>
<li>Updated the documentation is several spots, README, wiki, etc.</li>
<li>Bumped several dependencies where possible</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/cure53/DOMPurify/commit/0cae5187403132f96a6d357649e4b15633fc210a "><code>0cae518</code></a>
release: 3.4.11 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1494 ">#1494</a>)</li>
<li>See full diff in <a
href="https://github.com/cure53/DOMPurify/compare/3.4.10...3.4.11 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/open-policy-agent/opa/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 09:55:25 -05:00
f4121fb38f
docs: remove duplicated word in Rego style guide ( #8800 )
...
The Rego style guide reads "will fail both in the the undefined case" —
removed the duplicated "the".
Signed-off-by: s3onghyun <s3onghyun.hong@gmail.com >
2026-06-18 11:41:01 -05:00
369db1718b
build(deps): bump dompurify from 3.4.0 to 3.4.10 in /docs ( #8789 )
...
Bumps [dompurify](https://github.com/cure53/DOMPurify ) from 3.4.0 to
3.4.10.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/cure53/DOMPurify/releases ">dompurify's
releases</a>.</em></p>
<blockquote>
<h2>DOMPurify 3.4.10</h2>
<ul>
<li>Refactored codebase for clarity: extracted the public type
declarations into <code>types.ts</code></li>
<li>Decomposed the three largest sanitizer functions into focused
helpers</li>
<li>Removed duplicated defaults and dead branches, consolidated
<code>SAFE_FOR_TEMPLATES</code> scrubbing into single shared path</li>
<li>Improved per-node performance by hoisting the mXSS probe regexes and
testing <code>textContent</code> before <code>innerHTML</code></li>
<li>Added a deterministic micro-benchmark harness (<code>npm run
bench</code>) with a <code>--compare</code> mode</li>
<li>Reduced CI cost by running the full three-engine browser suite once
per PR</li>
<li>Refreshed the <code>demos/</code> folder so every demo runs again,
and added a SVG-via-<code><img></code> demo</li>
<li>Documented the bench and <code>test:happydom</code> scripts in the
README</li>
<li>Completed the Attack Classes & Bypass History wiki page</li>
<li>Bumped several dependencies where possible</li>
</ul>
<h2>DOMPurify 3.4.9</h2>
<ul>
<li>Further improved the handling of Trusted Types config options,
thanks <a
href="https://github.com/offset "><code>@offset</code></a></li>
<li>Further improved the handling of <code>IN_PLACE</code> sanitization,
thanks <a
href="https://github.com/mozfreddyb "><code>@mozfreddyb</code></a></li>
<li>Added more test coverage for <code>IN_PLACE</code> and Trusted Types
related usage</li>
<li>Bumped several dependencies where possible</li>
<li>Updated README and wiki with more accurate documentation &
attack samples</li>
</ul>
<h2>DOMPurify 3.4.8</h2>
<ul>
<li>Cleaned up the repository root, renamed some and removed unneeded
files</li>
<li>Fixed an issue with handling of Trusted Types policies, thanks <a
href="https://github.com/fulstadev "><code>@fulstadev</code></a></li>
<li>Fixed the node iterator for better template scrubbing, thanks <a
href="https://github.com/IamLeandrooooo "><code>@IamLeandrooooo</code></a></li>
<li>Included formerly missing LICENSE-MPL in published npm package,
thanks <a
href="https://github.com/asamuzaK "><code>@asamuzaK</code></a></li>
<li>Bumped several dependencies where possible</li>
</ul>
<h2>DOMPurify 3.4.7</h2>
<ul>
<li>Hardened the handling of Shadow Roots when using
<code>IN_PLACE</code>, thanks <a
href="https://github.com/GameZoneHacker "><code>@GameZoneHacker</code></a></li>
<li>Removed a problem leading to permanent hook pollution, thanks <a
href="https://github.com/offset "><code>@offset</code></a></li>
<li>Refactored the test suite and expanded test coverage
significantly</li>
</ul>
<h2>DOMPurify 3.4.6</h2>
<ul>
<li>Fixed several issues with DOM Clobbering in <code>IN_PLACE</code>
mode, thanks <a
href="https://github.com/offset "><code>@offset</code></a> & <a
href="https://github.com/Bankde "><code>@Bankde</code></a></li>
<li>Hardened the checks for cross-realm <code>IN_PLACE</code> and Shadow
DOM sanitization, thanks <a
href="https://github.com/offset "><code>@offset</code></a> & <a
href="https://github.com/Bankde "><code>@Bankde</code></a></li>
<li>Added more test coverage for <code>IN_PLACE</code> and general DOM
Clobbering attacks</li>
<li>Bumped several dependencies where possible</li>
</ul>
<h2>DOMPurify 3.4.5</h2>
<ul>
<li>Fixed a bypass caused by the new HTML element
<code>selectedcontent</code> added in 3.4.4, thanks <a
href="https://github.com/KabirAcharya "><code>@KabirAcharya</code></a></li>
</ul>
<p><strong>Note that this is a security release for an issue introduced
in 3.4.4 and should be upgraded to immediately.</strong></p>
<h2>DOMPurify 3.4.4</h2>
<ul>
<li>Added the <code>selectedcontent</code> element to default
allow-list, thanks <a
href="https://github.com/lukewarlow "><code>@lukewarlow</code></a></li>
<li>Added the <code>command</code> and <code>commandfor</code>
attributes to default allowed-list, thanks <a
href="https://github.com/lukewarlow "><code>@lukewarlow</code></a></li>
<li>Added better template scrubbing for <code>IN_PLACE</code>
operations, thanks <a
href="https://github.com/DEMON1A "><code>@DEMON1A</code></a></li>
<li>Added stronger checks for cross-realm windows, thanks <a
href="https://github.com/DEMON1A "><code>@DEMON1A</code></a> & <a
href="https://github.com/fg0x0 "><code>@fg0x0</code></a></li>
<li>Updated demo website and made sure it uses the latest from main</li>
<li>Updated existing workflows, fuzzer, dependabot, etc., added more
tests</li>
<li>Bumped several dependencies where possible</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/cure53/DOMPurify/commit/6ee5716f8336989753611beeca364957c0eb0c3e "><code>6ee5716</code></a>
release: 3.4.10 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1478 ">#1478</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/52102472d46035857c52df19e44285f8a1e102fc "><code>5210247</code></a>
release: 3.4.9 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1459 ">#1459</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/bcdd8285412dc9c4c149652aed2d712e790d6ccf "><code>bcdd828</code></a>
release: 3.4.8 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1439 ">#1439</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff "><code>ca30f07</code></a>
release: 3.4.7 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1414 ">#1414</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/bb7739e5bccec7e1ab3dae3f3e42d02db3acaaae "><code>bb7739e</code></a>
release: 3.4.6 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1394 ">#1394</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/011b0c78f2a0f57ee54f5fcccb697a46ca6e63ea "><code>011b0c7</code></a>
release: 3.4.5 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1382 ">#1382</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/5817ad969c15e67dfcd6cb37248d6e9c1553e7c3 "><code>5817ad9</code></a>
release: 3.4.4 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1374 ">#1374</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/520edb0371a9638f9b51f1798051299a250c686b "><code>520edb0</code></a>
release: 3.4.3 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1352 ">#1352</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/6f67fd396a7b8c64294343999fe607ca1f5299c0 "><code>6f67fd3</code></a>
Sync/3.4.2 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1322 ">#1322</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/5b0cdbbf52331e854c0a2de875b1a3790ecec2b8 "><code>5b0cdbb</code></a>
chore: merge main into 3.x for 3.4.1 release (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1301 ">#1301</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/cure53/DOMPurify/compare/3.4.0...3.4.10 ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Install script changes</summary>
<p>This version adds <code>prepare</code> script that runs during
installation. Review the package contents before updating.</p>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/open-policy-agent/opa/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-16 16:33:31 -05:00
ed23e2b0b2
build(deps): bump ws in /docs ( #8788 )
...
Bumps and [ws](https://github.com/websockets/ws ). These dependencies
needed to be updated together.
Updates `ws` from 7.5.10 to 7.5.11
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/websockets/ws/releases ">ws's
releases</a>.</em></p>
<blockquote>
<h2>7.5.11</h2>
<h1>Bug fixes</h1>
<ul>
<li>Backported 2b2abd45 to the 7.x release line (e14c4586).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8 "><code>fd36cd8</code></a>
[dist] 7.5.11</li>
<li><a
href="https://github.com/websockets/ws/commit/e14c45861deca0cef60dec0f9109b694abebdf52 "><code>e14c458</code></a>
[security] Limit retained message parts</li>
<li>See full diff in <a
href="https://github.com/websockets/ws/compare/7.5.10...7.5.11 ">compare
view</a></li>
</ul>
</details>
<br />
Updates `ws` from 8.18.3 to 8.21.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/websockets/ws/releases ">ws's
releases</a>.</em></p>
<blockquote>
<h2>7.5.11</h2>
<h1>Bug fixes</h1>
<ul>
<li>Backported 2b2abd45 to the 7.x release line (e14c4586).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8 "><code>fd36cd8</code></a>
[dist] 7.5.11</li>
<li><a
href="https://github.com/websockets/ws/commit/e14c45861deca0cef60dec0f9109b694abebdf52 "><code>e14c458</code></a>
[security] Limit retained message parts</li>
<li>See full diff in <a
href="https://github.com/websockets/ws/compare/7.5.10...7.5.11 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/open-policy-agent/opa/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-16 16:13:21 -05:00
186d4868cf
build(deps): bump launch-editor from 2.11.1 to 2.14.1 in /docs ( #8790 )
...
Bumps [launch-editor](https://github.com/vitejs/launch-editor ) from
2.11.1 to 2.14.1.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/launch-editor/commit/3f97c648307a70e7c930ba63f040e6ba8e72bc16 "><code>3f97c64</code></a>
v2.14.1</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/0cc9550e05c35224a1f61914b9731723f78c06a7 "><code>0cc9550</code></a>
fix: reject UNC paths (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/138 ">#138</a>)</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/afd1ab907769adbb0fb76b564551f3cd24822ea6 "><code>afd1ab9</code></a>
ci: run tests on mac and windows (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/136 ">#136</a>)</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/0bfa328e4d2a70d3accd86645efde43a5a8fd931 "><code>0bfa328</code></a>
test: add some tests for launch-editor package (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/135 ">#135</a>)</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/1b006ae00061e83628c884770df4869bac481ed3 "><code>1b006ae</code></a>
chore: add README (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/134 ">#134</a>)</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/383ef26fceaaab75e4f122bf833a8d457e187272 "><code>383ef26</code></a>
v2.14.0</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/6277209316b28bd76b057a97fcdfa42da5adc181 "><code>6277209</code></a>
ci: harden publish settings</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/520b2f787af1bbe3d2333d952547fc90f2c01bb3 "><code>520b2f7</code></a>
fix(deps): update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/129 ">#129</a>)</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/475ac662aeaa40eebe319f76acf7bd7ff2aba5d5 "><code>475ac66</code></a>
chore(deps): update dependency lint-staged to v17 (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/130 ">#130</a>)</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/247bf1dfe2c75efb50f507d33c2c5a3cbf4e20d0 "><code>247bf1d</code></a>
chore(deps): update dependency yorkie to v2 (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/131 ">#131</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/launch-editor/compare/v2.11.1...v2.14.1 ">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions ">GitHub Actions</a>, a new
releaser for launch-editor since your current version.</p>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/open-policy-agent/opa/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-16 15:51:53 -05:00
e7d0c0e3d1
docs: Add we/our/us check to spell check ( #8787 )
...
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-06-16 10:32:55 +00:00
7b004efe4a
docs: Update documentation to be more consistent and sound more like reference docs ( #8786 )
...
There are a lot of edits here. I am trying to make the docs more
consistent between pages and sections, each commit is one category of
change so it might be easier to go through commit by commit to see all
similar changes in the same place.
The main goal was to make the language sound more like reference docs
than product marketing, i.e. a little more formal with fewer filler
words in places. Rephrase to avoid informal 'we/our' guidance,
formatting updates for things like admonitions.
---------
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-06-16 09:44:47 +00:00
88c01e659c
runtime: Restore goautomaxprocs, add automemlimit ( #8784 )
...
This PR reverts the change in #8696 where automaxprocs was removed. This
meant the go language default of 2 procs vs 1 was used. In some memory
constrained deployments of OPA, this caused OOM issues where the server
used more memory than before with 2 processes running. This PR restores
the automaxprocs dependency and this behaviour.
This PR also follows other data-heavy CNCF projects in pairing this with
automemlimit to automate the setting of GOMEMLIMIT based on the cgroup
data too.
This makes no change for users manually setting these, but hopefully
will provide some sensible defaults that work well for most cases, and
better than the Go defaults in low resource deployments.
<details>
<summary>Other projects</summary>
*
https://github.com/prometheus/prometheus/blob/2ad3a871701531d1485f678acb7523cd0aa31789/go.mod#L11
*
https://github.com/istio/istio/blob/4985ae369245dcc91bc107a0c47ea41ded0c1a12/go.mod#L8
*
https://github.com/grafana/alloy/blob/e11d0f03e2b2e727161fb2169cade54698e17bd8/go.mod#L19
* https://github.com/thanos-io/thanos/blob/main/go.mod#L9
* https://github.com/kubernetes/kube-state-metrics/blob/main/go.mod#L6
* https://github.com/authzed/spicedb/blob/main/go.mod#L22
</details>
---------
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-06-15 13:54:43 +00:00
c07265b1cd
website: add ossrisk to ecosystem ( #8780 )
...
## What
Adds [ossrisk](https://github.com/depkeep/ossrisk ) to the OPA ecosystem
page.
ossrisk is a CLI and GitHub Action that scans npm and PyPI dependency
trees for supply-chain and long-term viability risk: known CVEs (via
OSV.dev), end-of-life versions, abandonment signals, typosquatting,
license compliance, and maintainer-takeover patterns.
Beyond a `--fail-on <severity>` threshold, ossrisk integrates with OPA
via the `opa` CLI: the scan result JSON is passed as `input` to `opa
eval`, and policies in `package ossrisk` add messages to a `deny` set to
gate the build. This enables cross-signal rules a threshold alone cannot
express — for example blocking packages with install scripts published
by a brand-new maintainer (the event-stream takeover pattern). The JSON
output also pipes cleanly into conftest.
## Changes
- `docs/src/data/ecosystem/entries/ossrisk.md` — entry with `category:
security`, `layer: cicd`, `type: poweredbyopa`
- `docs/static/img/ecosystem-entry-logos/ossrisk.svg` — logo
---------
Signed-off-by: glimm-no <admin@glimm.no >
Signed-off-by: pkuzco <b.naamneh@gmail.com >
Co-authored-by: glimm-no <admin@glimm.no >
Co-authored-by: Charlie Egan <git@charlieegan3.com >
2026-06-15 14:00:35 +01:00
c2864a1af3
Add SDK references for evaluating IR plans
...
Moved Intermediate Representation section earlier in the integration
guide and documented Swift-OPA and java-opa-sdk for direct IR plan
evaluation in applications. Added cross-links between integration.md
and ir.md documentation.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-06-15 13:27:04 +02:00
34167e2d86
docs: Add notes about use of GOMEMLIMIT ( #8771 )
...
Documents issue in memory constrained environments following the change
in typical heap size following the change from 1 to 2 max procs in
https://github.com/open-policy-agent/opa/pull/8696
---------
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-06-11 14:31:12 +00:00
ffd7d46ee4
website: Various updates to node and website deps ( #8768 )
...
Replaces https://github.com/open-policy-agent/opa/pull/8762
Original dependabot updates:
Bumps the website group in /docs with 9 updates:
| Package | From | To |
| --- | --- | --- |
|
[@floating-ui/react](https://github.com/floating-ui/floating-ui/tree/HEAD/packages/react )
| `0.27.18` | `0.27.19` |
|
[@iconify/react](https://github.com/iconify/iconify/tree/HEAD/components/react )
| `6.0.0` | `6.0.2` |
| [@mermaid-js/layout-elk](https://github.com/mermaid-js/mermaid ) |
`0.1.9` | `0.2.1` |
| [eslint](https://github.com/eslint/eslint ) | `9.39.2` | `10.4.1` |
| [glob](https://github.com/isaacs/node-glob ) | `11.1.0` | `13.0.6` |
| [js-yaml](https://github.com/nodeca/js-yaml ) | `4.1.1` | `4.2.0` |
| [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2 ) |
`0.21.0` | `0.22.1` |
| [recharts](https://github.com/recharts/recharts ) | `3.7.0` | `3.8.1` |
|
[baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping )
| `2.10.20` | `2.10.33` |
I have also made some updates to use node 24.
---------
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-11 13:23:17 +00:00
532cf8c880
website: Fix build from missing dateAdded ( #8764 )
...
https://github.com/open-policy-agent/opa/pull/8685 had not been rebased
and so this only failed when on main.
I have also updated a regal link to use an abs url to silence a warning.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-06-10 14:39:35 +01:00
85de0c3046
website: Update homepage AI example to tool calls ( #8755 )
...
This feels more relevant and interesting as an example now. We have RBAC
use cases elsewhere.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-06-10 14:06:49 +01:00
85e2477c85
website: Update docusaurus ( #8756 )
...
Also add dependabot for website deps.
---------
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-06-10 10:13:01 +01:00
e161170dd9
Add depkeep to enterprise support ( #8685 )
...
Signed-off-by: glimm-no <admin@glimm.no >
Co-authored-by: glimm-no <admin@glimm.no >
2026-06-10 10:08:05 +01:00
a8f8cea073
build(deps): bump shell-quote from 1.8.3 to 1.8.4 in /docs ( #8753 )
...
Bumps [shell-quote](https://github.com/ljharb/shell-quote ) from 1.8.3 to
1.8.4.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md ">shell-quote's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/ljharb/shell-quote/compare/v1.8.3...v1.8.4 ">v1.8.4</a>
- 2026-05-22</h2>
<h3>Commits</h3>
<ul>
<li>[Fix] <code>quote</code>: validate object-token shapes <a
href="https://github.com/ljharb/shell-quote/commit/4378a6e613db5948168684864e49b42b83134d2d "><code>4378a6e</code></a></li>
<li>[Dev Deps] update <code>@ljharb/eslint-config</code>,
<code>auto-changelog</code>, <code>eslint</code>, <code>npmignore</code>
<a
href="https://github.com/ljharb/shell-quote/commit/22ebec04349065a45ad8afc8cc8d53c4624634a6 "><code>22ebec0</code></a></li>
<li>[Tests] increase coverage <a
href="https://github.com/ljharb/shell-quote/commit/9f3caa31900cc6ee64858b31134144c648ce206d "><code>9f3caa3</code></a></li>
<li>[readme] replace runkit CI badge with shields.io check-runs badge <a
href="https://github.com/ljharb/shell-quote/commit/3344a047dd1e95f71c4ca27522cbfd05c56277e0 "><code>3344a04</code></a></li>
<li>[Dev Deps] update <code>@ljharb/eslint-config</code> <a
href="https://github.com/ljharb/shell-quote/commit/699c5113d135f4d4591574bebf173334ffa453d4 "><code>699c511</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ljharb/shell-quote/commit/ff166e2b63eb5f932bd131a8886a99e9afdf45ae "><code>ff166e2</code></a>
v1.8.4</li>
<li><a
href="https://github.com/ljharb/shell-quote/commit/4378a6e613db5948168684864e49b42b83134d2d "><code>4378a6e</code></a>
[Fix] <code>quote</code>: validate object-token shapes</li>
<li><a
href="https://github.com/ljharb/shell-quote/commit/22ebec04349065a45ad8afc8cc8d53c4624634a6 "><code>22ebec0</code></a>
[Dev Deps] update <code>@ljharb/eslint-config</code>,
<code>auto-changelog</code>, <code>eslint</code>, `npmig...</li>
<li><a
href="https://github.com/ljharb/shell-quote/commit/9f3caa31900cc6ee64858b31134144c648ce206d "><code>9f3caa3</code></a>
[Tests] increase coverage</li>
<li><a
href="https://github.com/ljharb/shell-quote/commit/3344a047dd1e95f71c4ca27522cbfd05c56277e0 "><code>3344a04</code></a>
[readme] replace runkit CI badge with shields.io check-runs badge</li>
<li><a
href="https://github.com/ljharb/shell-quote/commit/699c5113d135f4d4591574bebf173334ffa453d4 "><code>699c511</code></a>
[Dev Deps] update <code>@ljharb/eslint-config</code></li>
<li>See full diff in <a
href="https://github.com/ljharb/shell-quote/compare/v1.8.3...v1.8.4 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/open-policy-agent/opa/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-09 10:03:56 -05:00
daf5d97991
docs(ecosystem): update OPA MCP entry with video, blog, and distribution links ( #8712 )
...
Updates the OPA MCP ecosystem entry with additional links and an updated
tool count.
## Changes
- Added `videos`: YouTube demo (author, lint, and test a Rego policy end
to end from Claude Desktop)
- Added `blogs`: LinkedIn Pulse article explaining the motivation behind
OPA MCP
- Added npm and Docker Hub to `code` (precedent: `opa-typescript` and
`opa-wasm-js` entries both include npmjs.com links)
- Added Smithery to `code` (primary MCP-ecosystem install path alongside
npm)
- Updated tool count from 32 to 50+ (current release is 52 tools across
7 categories)
- Added Conftest to the CLI list in the description body
Signed-off-by: Daniel Okwor <daniel@orygn.tech >
Co-authored-by: Daniel Okwor <daniel@orygn.tech >
2026-06-08 13:36:43 +01:00
75202c334c
docs: PoC for kapa.ai ( #8699 )
...
https://contribute.cncf.io/blog/2026/04/09/reducing-support-tax-cncf-kapa-ai/
Changes to follow shortly, PR open for domain allow listing.
Fixes https://github.com/open-policy-agent/opa/issues/8125
---------
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-06-08 12:06:56 +02:00
947f2f6a7c
docs/contributing: add formatting ( #8740 )
...
### Why the changes in this PR are needed?
The PR pipeline checks if the formatting of docs changes is correct and
instructs developers to fix any discovered formatting issues using the
command `dprint fmt`. Contributors might not be aware of this before
creating the PR, or forget it, resulting in a failing pipeline (for
example
[here](https://github.com/open-policy-agent/opa/actions/runs/27003824827/job/79690783007 ))
and one more roundtrip, which could be avoided.
### What are the changes in this PR?
This PR adds an instruction to the contribution guideline to run the
`dprint fmt` command to ensure correct formatting.
### Further comments:
There is no issue for that as far as I know. I thought this would be
helpful (also I forgot this already twice 😅 ).
Signed-off-by: Manuela Züger <manuela.zueger@ipt.ch >
2026-06-06 08:47:16 +02:00
c3a407c5d2
website: Add support page disclaimer and sort by date added ( #8736 )
...
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-06-04 10:00:16 +00:00
9e103847d0
docs: Update regal docs for 0.41.1 release ( #8730 )
...
https://github.com/open-policy-agent/regal/releases/tag/v0.41.1
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-06-03 12:38:12 +00:00
27619ae0dc
docs: Update built-in index page titles ( #8728 )
...
This is for search engine result headings and on-site search titles.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-06-03 13:28:34 +01:00
bcc13280a4
website: Add .md alternate content types for llms ( #8725 )
...
This makes the site's content easier to consume from chatbots and coding
harnesses.
This reuses the logic from the copy page content button implemented
previously.
E.g.
https://deploy-preview-8725--openpolicyagent.netlify.app/docs/policy-reference/keywords/contains.md
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-06-02 16:03:07 +01:00
98944a4f44
docs/chore: Remove broken links ( #8716 )
...
Fixes https://github.com/open-policy-agent/opa/issues/8714
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-06-01 12:36:58 +00:00
f1612417a6
docs: clarify environment variable substitution behaviour ( #8713 )
...
Updates documentation to clarify behaviour of unset environment variables
following #7831 and #7786 .
Signed-off-by: Toby Aurelius <22025115+taurelius@users.noreply.github.com >
2026-05-29 19:57:44 +02:00
763aaaab5f
build(deps): bump qs from 6.14.1 to 6.14.2 in /docs ( #8694 )
...
Bumps [qs](https://github.com/ljharb/qs ) from 6.14.1 to 6.14.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ljharb/qs/blob/main/CHANGELOG.md ">qs's
changelog</a>.</em></p>
<blockquote>
<h2><strong>6.14.2</strong></h2>
<ul>
<li>[Fix] <code>parse</code>: mark overflow objects for indexed notation
exceeding <code>arrayLimit</code> (<a
href="https://redirect.github.com/ljharb/qs/issues/546 ">#546</a>)</li>
<li>[Fix] <code>arrayLimit</code> means max count, not max index, in
<code>combine</code>/<code>merge</code>/<code>parseArrayValue</code></li>
<li>[Fix] <code>parse</code>: throw on <code>arrayLimit</code> exceeded
with indexed notation when <code>throwOnLimitExceeded</code> is true (<a
href="https://redirect.github.com/ljharb/qs/issues/529 ">#529</a>)</li>
<li>[Fix] <code>parse</code>: enforce <code>arrayLimit</code> on
<code>comma</code>-parsed values</li>
<li>[Fix] <code>parse</code>: fix error message to reflect arrayLimit as
max index; remove extraneous comments (<a
href="https://redirect.github.com/ljharb/qs/issues/545 ">#545</a>)</li>
<li>[Robustness] avoid <code>.push</code>, use <code>void</code></li>
<li>[readme] document that <code>addQueryPrefix</code> does not add
<code>?</code> to empty output (<a
href="https://redirect.github.com/ljharb/qs/issues/418 ">#418</a>)</li>
<li>[readme] clarify <code>parseArrays</code> and
<code>arrayLimit</code> documentation (<a
href="https://redirect.github.com/ljharb/qs/issues/543 ">#543</a>)</li>
<li>[readme] replace runkit CI badge with shields.io check-runs
badge</li>
<li>[meta] fix changelog typo (<code>arrayLength</code> →
<code>arrayLimit</code>)</li>
<li>[actions] fix rebase workflow permissions</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ljharb/qs/commit/bdcf0c7f82387c18ac8fabfccd2f440645cef47b "><code>bdcf0c7</code></a>
v6.14.2</li>
<li><a
href="https://github.com/ljharb/qs/commit/294db90c812ddbe7d7a35d5687c505fd21a2d6a2 "><code>294db90</code></a>
[readme] document that <code>addQueryPrefix</code> does not add
<code>?</code> to empty output</li>
<li><a
href="https://github.com/ljharb/qs/commit/5c308e5516c270a78caa6f278465914090f91ec6 "><code>5c308e5</code></a>
[readme] clarify <code>parseArrays</code> and <code>arrayLimit</code>
documentation</li>
<li><a
href="https://github.com/ljharb/qs/commit/6addf8cf738d529c54d91f6f3ffb6c1be91bbfdc "><code>6addf8c</code></a>
[Fix] <code>parse</code>: mark overflow objects for indexed notation
exceeding <code>arrayLimit</code></li>
<li><a
href="https://github.com/ljharb/qs/commit/cfc108f662326d6ab540f3545ef0b832baf83cdf "><code>cfc108f</code></a>
[Fix] <code>arrayLimit</code> means max count, not max index, in
<code>combine</code>/<code>merge</code>/`pars...</li>
<li><a
href="https://github.com/ljharb/qs/commit/febb64442a80e49200211fa38d3c96b58024ac77 "><code>febb644</code></a>
[Fix] <code>parse</code>: throw on <code>arrayLimit</code> exceeded with
indexed notation when `thr...</li>
<li><a
href="https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482 "><code>f6a7abf</code></a>
[Fix] <code>parse</code>: enforce <code>arrayLimit</code> on
<code>comma</code>-parsed values</li>
<li><a
href="https://github.com/ljharb/qs/commit/fbc5206c25b4d1851cea683f02c10756c521d15a "><code>fbc5206</code></a>
[Fix] <code>parse</code>: fix error message to reflect arrayLimit as max
index; remove e...</li>
<li><a
href="https://github.com/ljharb/qs/commit/1b9a8b4e78c6aff4c22fa559107227f02fd0216a "><code>1b9a8b4</code></a>
[actions] fix rebase workflow permissions</li>
<li><a
href="https://github.com/ljharb/qs/commit/2a35775614e0fb46ac8a3060201a32a7c23a7fda "><code>2a35775</code></a>
[meta] fix changelog typo (<code>arrayLength</code> →
<code>arrayLimit</code>)</li>
<li>Additional commits viewable in <a
href="https://github.com/ljharb/qs/compare/v6.14.1...v6.14.2 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/open-policy-agent/opa/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-25 13:58:44 +02:00
f9155842bc
docs: Add explicit address binding to examples ( #8688 )
...
Add --addr=0.0.0.0:8181 flag to OPA server commands in Docker Compose
examples. This is needed for OPA >1.0.
Addresses Feedback:
<img width="1358" height="616" alt="Screenshot"
src="https://github.com/user-attachments/assets/8b116c1f-b362-427c-8eff-7888dbbe5c14 "
/>
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-05-21 18:33:42 +01:00
9d2c957c8b
Generate a JSON Schema for the bundle manifest ( #8684 )
...
resolve: https://github.com/open-policy-agent/opa/issues/8661
Similar to the [plan.schema.json
](https://github.com/open-policy-agent/opa/pull/8676 )this manifest will
be published on the website under
https://openpolicyagent.org/schemas/bundle/v1/manifest.schema.json
---------
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
Co-authored-by: Stephan Renatus <s_renatus@apple.com >
2026-05-21 10:39:17 -05:00
eca948b161
docs(ecosystem): add OPA MCP ( #8618 )
...
Adds **OPA MCP** to the ecosystem listing.
- **Repo:** https://github.com/OrygnsCode/opa-mcp-server
- **npm:** https://www.npmjs.com/package/@orygn/opa-mcp
- **Docker Hub:** https://hub.docker.com/r/orygn/opa-mcp
OPA MCP is a Model Context Protocol server that gives MCP-compatible
clients (Claude Desktop, Cursor, VS Code, Zed, Windsurf, etc.) a
structured interface to Rego. It wraps the OPA CLI, the OPA REST API,
and the Regal linter behind 32 schema-validated tools, plus higher-level
helpers (`rego_explain_decision`, `rego_describe_policy`,
`rego_generate_test_skeleton`, `rego_suggest_fix`) that compose the
primitives into agent-friendly workflows.
## Files
- `docs/src/data/ecosystem/entries/opa-mcp.md` — entry following the
format of `vscode-opa.md` and `regal.md`.
- `docs/static/img/ecosystem-entry-logos/opa-mcp.png` — 256×256 logo,
~55 KB.
## Labels
- `category: tooling`
- `layer: editor`
## docs_features
`learning-rego`, `policy-testing`, `debugging-rego`, `editors` — all
chosen from the existing taxonomy used by other entries.
Signed-off-by: OrygnsCode <38231263+OrygnsCode@users.noreply.github.com >
2026-05-20 08:54:01 -05:00
796db6b8d2
Generate a JSON Schema for the IR plan ( #8676 )
...
resolve: https://github.com/open-policy-agent/opa/issues/8662
Generate a schema for the IR plan and publish it to the website at schemas/ir/v1/plan.schema.json
resolve: https://github.com/open-policy-agent/opa/issues/6266
Fix the upper case Index in MakeNumberRefStmt by supporting both, lower and upper case.
---------
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-05-19 15:16:25 -05:00
f55bfe882d
docs: correct ocp ssh key docs
...
Update description of OCP `ssh_key` config item to clarify it is the key contents, not a path.
Signed-off-by: Toby Aurelius <22025115+taurelius@users.noreply.github.com >
2026-05-19 13:45:31 +02:00
cae44b00b4
docs: Move future.keyword.not import details out of general policy-lang docs ( #8658 )
...
This is a follow up from
[this](https://github.com/open-policy-agent/opa/pull/8641#discussion_r3224067825 )
discussion.
This moves the `future.keywords.not` discussion out of the general
policy-language documentation and into the keyword page. The issue here,
though, is that this lives insides the `Keyword Examples` section of the
`Policy Reference` docs. Is there some other place we can move this to;
or should we simply rename `Keywords Examples` -> `Keywords` (though
then people might expect more details on the other keywords). 🤷
---------
Signed-off-by: Johan Fylling <johan.dev@fylling.se >
2026-05-19 08:30:18 +02:00
37de95f5fc
build(deps): bump webpack-dev-server from 5.2.2 to 5.2.4 in /docs ( #8670 )
...
Bumps
[webpack-dev-server](https://github.com/webpack/webpack-dev-server ) from
5.2.2 to 5.2.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/webpack/webpack-dev-server/releases ">webpack-dev-server's
releases</a>.</em></p>
<blockquote>
<h2>v5.2.4</h2>
<h3><a
href="https://github.com/webpack/webpack-dev-server/compare/v5.2.3...v5.2.4 ">5.2.4</a>
(2026-05-11)</h3>
<h3>Bug Fixes</h3>
<ul>
<li>set Cross-Origin-Resource-Policy header to prevent source code theft
over HTTP</li>
</ul>
<h2>v5.2.3</h2>
<h3><a
href="https://github.com/webpack/webpack-dev-server/compare/v5.2.2...v5.2.3 ">5.2.3</a>
(2026-01-12)</h3>
<h3>Bug Fixes</h3>
<ul>
<li>add <code>cause</code> for <code>errorObject</code> (<a
href="https://redirect.github.com/webpack/webpack-dev-server/issues/5518 ">#5518</a>)
(<a
href="https://github.com/webpack/webpack-dev-server/commit/37b033da2c48335178495a1987c469a26ef3de60 ">37b033d</a>)</li>
<li>compatibility with event target and universal target and lazy
compilation (<a
href="https://github.com/webpack/webpack-dev-server/commit/574026c44b9c51f0bbd2f5a2836c54607289a071 ">574026c</a>)</li>
<li><strong>overlay:</strong> add ESC key to dismiss overlay (<a
href="https://redirect.github.com/webpack/webpack-dev-server/issues/5598 ">#5598</a>)
(<a
href="https://github.com/webpack/webpack-dev-server/commit/f91baa8831e061e2998849966b8002b40b83fb07 ">f91baa8</a>)</li>
<li>progress indicator styles (<a
href="https://redirect.github.com/webpack/webpack-dev-server/issues/5557 ">#5557</a>)
(<a
href="https://github.com/webpack/webpack-dev-server/commit/41a53a1accdb0a90785d82cbe8a079794eeed3c8 ">41a53a1</a>)</li>
<li>upgrade selfsigned to v5</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md ">webpack-dev-server's
changelog</a>.</em></p>
<blockquote>
<h3><a
href="https://github.com/webpack/webpack-dev-server/compare/v5.2.3...v5.2.4 ">5.2.4</a>
(2026-05-11)</h3>
<h3>Bug Fixes</h3>
<ul>
<li>set Cross-Origin-Resource-Policy header to prevent source code theft
over HTTP</li>
</ul>
<h3><a
href="https://github.com/webpack/webpack-dev-server/compare/v5.2.2...v5.2.3 ">5.2.3</a>
(2026-01-12)</h3>
<h3>Bug Fixes</h3>
<ul>
<li>add <code>cause</code> for <code>errorObject</code> (<a
href="https://redirect.github.com/webpack/webpack-dev-server/issues/5518 ">#5518</a>)
(<a
href="https://github.com/webpack/webpack-dev-server/commit/37b033da2c48335178495a1987c469a26ef3de60 ">37b033d</a>)</li>
<li>compatibility with event target and universal target and lazy
compilation (<a
href="https://github.com/webpack/webpack-dev-server/commit/574026c44b9c51f0bbd2f5a2836c54607289a071 ">574026c</a>)</li>
<li><strong>overlay:</strong> add ESC key to dismiss overlay (<a
href="https://redirect.github.com/webpack/webpack-dev-server/issues/5598 ">#5598</a>)
(<a
href="https://github.com/webpack/webpack-dev-server/commit/f91baa8831e061e2998849966b8002b40b83fb07 ">f91baa8</a>)</li>
<li>progress indicator styles (<a
href="https://redirect.github.com/webpack/webpack-dev-server/issues/5557 ">#5557</a>)
(<a
href="https://github.com/webpack/webpack-dev-server/commit/41a53a1accdb0a90785d82cbe8a079794eeed3c8 ">41a53a1</a>)</li>
<li>upgrade selfsigned to v5</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/webpack/webpack-dev-server/commit/fd401308f1cc026262880e2dab810004d6444282 "><code>fd40130</code></a>
chore(release): 5.2.4</li>
<li><a
href="https://github.com/webpack/webpack-dev-server/commit/ece4f3617bea31fb6d3833f69a32b6c289959a49 "><code>ece4f36</code></a>
chore: update deps (<a
href="https://redirect.github.com/webpack/webpack-dev-server/issues/5661 ">#5661</a>)</li>
<li><a
href="https://github.com/webpack/webpack-dev-server/commit/a2161442a314a06a97e25d1404d08410cb4e9c51 "><code>a216144</code></a>
ci: fix test (<a
href="https://redirect.github.com/webpack/webpack-dev-server/issues/5658 ">#5658</a>)</li>
<li><a
href="https://github.com/webpack/webpack-dev-server/commit/df073c53a8cefb54210b43813fa6ee60364a554e "><code>df073c5</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/webpack/webpack-dev-server/commit/b550a702bd4246d1724513b70de0bfbe6604672f "><code>b550a70</code></a>
chore(release): 5.2.3</li>
<li><a
href="https://github.com/webpack/webpack-dev-server/commit/9704dc52e3f696ae1446428c25882745e9b65cbb "><code>9704dc5</code></a>
chore: upgrade selfsigned to v5 and remove node-forge dependency (<a
href="https://redirect.github.com/webpack/webpack-dev-server/issues/5618 ">#5618</a>)</li>
<li><a
href="https://github.com/webpack/webpack-dev-server/commit/92bf644784741e8ea5adaa4a1dc26f4d462f223d "><code>92bf644</code></a>
chore: bump express to update qs (<a
href="https://redirect.github.com/webpack/webpack-dev-server/issues/5621 ">#5621</a>)</li>
<li><a
href="https://github.com/webpack/webpack-dev-server/commit/792b2f0bd13a3b93abf701fe3a5cf41ee16722f4 "><code>792b2f0</code></a>
chore(deps-dev): bump the dependencies group with 4 updates (<a
href="https://redirect.github.com/webpack/webpack-dev-server/issues/5606 ">#5606</a>)</li>
<li><a
href="https://github.com/webpack/webpack-dev-server/commit/6d587cab3e023675de2feedf81bcdfcec7d5b774 "><code>6d587ca</code></a>
chore(deps): bump the dependencies group across 1 directory with 27
updates (...</li>
<li><a
href="https://github.com/webpack/webpack-dev-server/commit/f91baa8831e061e2998849966b8002b40b83fb07 "><code>f91baa8</code></a>
fix(overlay): add ESC key to dismiss overlay (<a
href="https://redirect.github.com/webpack/webpack-dev-server/issues/5598 ">#5598</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/webpack/webpack-dev-server/compare/v5.2.2...v5.2.4 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/open-policy-agent/opa/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-18 13:45:31 -05:00
ae16d425ab
website: Bring back edge release redirect ( #8671 )
...
test with:
https://deploy-preview-8671--openpolicyagent.netlify.app/downloads/edge/opa_darwin_amd64
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-05-18 17:13:31 +01:00
1545390088
docs: Update diagram to match index examples ( #8667 )
...
Follows comment from feedback form about this inconsistency.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-05-18 14:38:33 +01:00
6398df6069
topdown: change labels aggregation and merge logic ( #8656 )
...
Thought about it some more, and I think this is how it is less
surprising:
```rego
# METADATA
# labels:
# app: foo
package foo
# METADATA
# labels:
# id: allow-01
allow if { ... }
```
Evaluating `data.foo.allow` successfully will yield a single entry in
`rule_labels`:
```json
{
"app": "foo",
"id": "allow-01"
}
```
Labels are merged along their annotations chain.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-05-18 09:33:39 +00:00
acf9aaea4b
docs: Add documentation for the future.keywords.not import ( #8641 )
...
Fixes : #8556
Signed-off-by: Johan Fylling <johan.dev@fylling.se >
2026-05-13 13:49:38 +02:00
cf2b3757f1
Add titles to code blocks in policy-testing
...
Moves file names from bold text to code fence title attributes to
be consistent with other blocks on page and site.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-05-13 08:15:08 +02:00
6932abaae6
build(deps): bump mermaid from 11.14.0 to 11.15.0 in /docs
...
Bumps [mermaid](https://github.com/mermaid-js/mermaid ) from 11.14.0 to 11.15.0.
- [Release notes](https://github.com/mermaid-js/mermaid/releases )
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.14.0...mermaid@11.15.0 )
---
updated-dependencies:
- dependency-name: mermaid
dependency-version: 11.15.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-12 08:01:59 +02:00
913739161b
labels: aggregate from package/subpackage/document scope, update CHANGELOG
...
Small follow-up to #8613 . I think carrying the labels from upper scopes
along makes this more powerful.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-05-11 14:10:26 +02:00
84cbb8e668
redirects: "edge" -> "latest"
...
Temporary measure until we've sorted out edge release storage.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-05-11 09:46:47 +02:00
ce03cd8d23
build(deps): bump @babel/plugin-transform-modules-systemjs in /docs
...
Bumps [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs ) from 7.25.9 to 7.29.4.
- [Release notes](https://github.com/babel/babel/releases )
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md )
- [Commits](https://github.com/babel/babel/commits/v7.29.4/packages/babel-plugin-transform-modules-systemjs )
---
updated-dependencies:
- dependency-name: "@babel/plugin-transform-modules-systemjs"
dependency-version: 7.29.4
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-11 08:59:03 +02:00
875060316b
build(deps): bump fast-uri from 3.0.6 to 3.1.2 in /docs
...
Bumps [fast-uri](https://github.com/fastify/fast-uri ) from 3.0.6 to 3.1.2.
- [Release notes](https://github.com/fastify/fast-uri/releases )
- [Commits](https://github.com/fastify/fast-uri/compare/v3.0.6...v3.1.2 )
---
updated-dependencies:
- dependency-name: fast-uri
dependency-version: 3.1.2
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-09 08:31:25 +02:00
cb54e9c14f
runtime: rule labels metadata processing follow-ups ( #8613 )
...
❗ We now parse rego metadata annotations by default.
Rule annotations now support a `labels` field. During policy eval,
labels from all successfully evaluated rules are collected and included
in each decision log entry as a top-level `rule_labels` array. Each
element preserves the label map from one evaluated rule. Exact
duplicates are omitted.
```rego
# METADATA
# labels:
# severity: low
# team: platform
allow if input.role == "admin"
```
The resulting decision log entry will contain:
```json
{"rule_labels": [{"severity": "low", "team": "platform"}]}
```
---------
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-05-08 15:00:26 +00:00
deee848e52
Revert website redirects ( #8617 )
...
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-05-07 10:51:39 -05:00
f645d91097
Remove edge releases ( #8615 )
...
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-05-07 08:47:15 -05:00
1a4a713006
Add a page explaining the Rego based PR check ( #8611 )
...
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-05-06 15:40:08 -05:00
dependabot[bot]