mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-12 19:32:48 -06:00
5e04b0f93b3967872fdb425b4808ddbcbf1d4e79
6433 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Sebastian Spaink
|
5e04b0f93b |
Enable pattern validation in json.verify_schema and json.match_schema (#8686)
resolve: https://github.com/open-policy-agent/opa/issues/6089 As a side effect of #4429 `json.match_schema` and `json.verify_schema` have been silently ignoring the "pattern" keyword. Updated the internal/gojsonschema project to have pattern validation be optional to keep it disabled for type checking but enabled for the builtins. Patterns that RE2 can't compile will fail. Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
Sebastian Spaink
|
9d2c957c8b |
Generate a JSON Schema for the bundle manifest (#8684)
resolve: https://github.com/open-policy-agent/opa/issues/8661 Similar to the [plan.schema.json ](https://github.com/open-policy-agent/opa/pull/8676)this manifest will be published on the website under https://openpolicyagent.org/schemas/bundle/v1/manifest.schema.json --------- Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> Co-authored-by: Stephan Renatus <s_renatus@apple.com> |
||
|
Stephan Renatus
|
53d981c70f |
server/types: generalize request/response metadata
This is less brittle, and less duplication, than before. We're reading out the known fields from struct tags ONCE on init() for each of the types we want to use like this. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Stephan Renatus
|
840c2b91af |
server: wire in response/request metadata for compile handler
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
ORYGN
|
eca948b161 |
docs(ecosystem): add OPA MCP (#8618)
Adds **OPA MCP** to the ecosystem listing. - **Repo:** https://github.com/OrygnsCode/opa-mcp-server - **npm:** https://www.npmjs.com/package/@orygn/opa-mcp - **Docker Hub:** https://hub.docker.com/r/orygn/opa-mcp OPA MCP is a Model Context Protocol server that gives MCP-compatible clients (Claude Desktop, Cursor, VS Code, Zed, Windsurf, etc.) a structured interface to Rego. It wraps the OPA CLI, the OPA REST API, and the Regal linter behind 32 schema-validated tools, plus higher-level helpers (`rego_explain_decision`, `rego_describe_policy`, `rego_generate_test_skeleton`, `rego_suggest_fix`) that compose the primitives into agent-friendly workflows. ## Files - `docs/src/data/ecosystem/entries/opa-mcp.md` — entry following the format of `vscode-opa.md` and `regal.md`. - `docs/static/img/ecosystem-entry-logos/opa-mcp.png` — 256×256 logo, ~55 KB. ## Labels - `category: tooling` - `layer: editor` ## docs_features `learning-rego`, `policy-testing`, `debugging-rego`, `editors` — all chosen from the existing taxonomy used by other entries. Signed-off-by: OrygnsCode <38231263+OrygnsCode@users.noreply.github.com> |
||
|
Sebastian Spaink
|
796db6b8d2 |
Generate a JSON Schema for the IR plan (#8676)
resolve: https://github.com/open-policy-agent/opa/issues/8662 Generate a schema for the IR plan and publish it to the website at schemas/ir/v1/plan.schema.json resolve: https://github.com/open-policy-agent/opa/issues/6266 Fix the upper case Index in MakeNumberRefStmt by supporting both, lower and upper case. --------- Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
Toby Aurelius
|
f55bfe882d |
docs: correct ocp ssh key docs
Update description of OCP `ssh_key` config item to clarify it is the key contents, not a path. Signed-off-by: Toby Aurelius <22025115+taurelius@users.noreply.github.com> |
||
|
dependabot[bot]
|
0911080ea6 |
build(deps): bump the dependencies group across 2 directories with 12 updates (#8674)
Bumps the dependencies group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/fsnotify/fsnotify](https://github.com/fsnotify/fsnotify) | `1.9.0` | `1.10.1` | | [github.com/huandu/go-sqlbuilder](https://github.com/huandu/go-sqlbuilder) | `1.40.2` | `1.41.0` | | [github.com/lestrrat-go/jwx/v3](https://github.com/lestrrat-go/jwx) | `3.1.0` | `3.1.1` | | [github.com/olekukonko/tablewriter](https://github.com/olekukonko/tablewriter) | `1.1.0` | `1.1.4` | | [github.com/vektah/gqlparser/v2](https://github.com/vektah/gqlparser) | `2.5.32` | `2.5.33` | | [golang.org/x/net](https://github.com/golang/net) | `0.53.0` | `0.54.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.80.0` | `1.81.0` | | gopkg.in/ini.v1 | `1.67.1` | `1.67.2` | Bumps the dependencies group with 11 updates in the /e2e directory: | Package | From | To | | --- | --- | --- | | [github.com/fsnotify/fsnotify](https://github.com/fsnotify/fsnotify) | `1.9.0` | `1.10.1` | | [github.com/huandu/go-sqlbuilder](https://github.com/huandu/go-sqlbuilder) | `1.40.2` | `1.41.0` | | [github.com/lestrrat-go/jwx/v3](https://github.com/lestrrat-go/jwx) | `3.1.0` | `3.1.1` | | [github.com/olekukonko/tablewriter](https://github.com/olekukonko/tablewriter) | `1.1.0` | `1.1.4` | | [github.com/vektah/gqlparser/v2](https://github.com/vektah/gqlparser) | `2.5.32` | `2.5.33` | | [golang.org/x/net](https://github.com/golang/net) | `0.53.0` | `0.54.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.80.0` | `1.81.0` | | gopkg.in/ini.v1 | `1.67.1` | `1.67.2` | | [github.com/go-sql-driver/mysql](https://github.com/go-sql-driver/mysql) | `1.9.3` | `1.10.0` | | [github.com/microsoft/go-mssqldb](https://github.com/microsoft/go-mssqldb) | `1.9.8` | `1.10.0` | | [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.49.1` | `1.50.1` | Updates `github.com/fsnotify/fsnotify` from 1.9.0 to 1.10.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fsnotify/fsnotify/releases">github.com/fsnotify/fsnotify's releases</a>.</em></p> <blockquote> <h2>v1.10.1</h2> <h3>Changes and fixes</h3> <ul> <li> <p>inotify: don't remove sibling watches sharing a path prefix (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/754">#754</a>)</p> </li> <li> <p>inotify, windows: don't rename sibling watches sharing a path prefix (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/755">#755</a>)</p> </li> </ul> <p><a href="https://redirect.github.com/fsnotify/fsnotify/issues/754">#754</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/754">fsnotify/fsnotify#754</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/755">#755</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/755">fsnotify/fsnotify#755</a></p> <h2>v1.10.0</h2> <p>This version of fsnotify needs Go 1.23.</p> <h3>Changes and fixes</h3> <ul> <li> <p>inotify: improve initialization error message (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/731">#731</a>)</p> </li> <li> <p>inotify: send Rename event if recursive watch is renamed (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/696">#696</a>)</p> </li> <li> <p>inotify: avoid copying event buffers when reading names (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/741">#741</a>)</p> </li> <li> <p>kqueue: skip dangling symlinks (ENOENT) in watchDirectoryFiles, so a bad entry no longer aborts Watcher.Add for the whole directory (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/748">#748</a>)</p> </li> <li> <p>kqueue: drop watches directly in Close() to fix a file descriptor leak when recycling watchers (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/740">#740</a>)</p> </li> <li> <p>windows: fix nil pointer dereference in remWatch (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/736">#736</a>)</p> </li> <li> <p>windows: lock watch field updates against concurrent WatchList to fix a race introduced in v1.9.0 (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/709">#709</a>, <a href="https://redirect.github.com/fsnotify/fsnotify/issues/749">#749</a>)</p> </li> </ul> <p><a href="https://redirect.github.com/fsnotify/fsnotify/issues/696">#696</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/696">fsnotify/fsnotify#696</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/709">#709</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/709">fsnotify/fsnotify#709</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/731">#731</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/731">fsnotify/fsnotify#731</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/736">#736</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/736">fsnotify/fsnotify#736</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/740">#740</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/740">fsnotify/fsnotify#740</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/741">#741</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/741">fsnotify/fsnotify#741</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/748">#748</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/748">fsnotify/fsnotify#748</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/749">#749</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/749">fsnotify/fsnotify#749</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/fsnotify/fsnotify/blob/main/CHANGELOG.md">github.com/fsnotify/fsnotify's changelog</a>.</em></p> <blockquote> <h2>1.10.1 2026-05-04</h2> <h3>Changes and fixes</h3> <ul> <li> <p>inotify: don't remove sibling watches sharing a path prefix (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/754">#754</a>)</p> </li> <li> <p>inotify, windows: don't rename sibling watches sharing a path prefix (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/755">#755</a>)</p> </li> </ul> <p><a href="https://redirect.github.com/fsnotify/fsnotify/issues/754">#754</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/754">fsnotify/fsnotify#754</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/755">#755</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/755">fsnotify/fsnotify#755</a></p> <h2>1.10.0 2026-04-30</h2> <p>This version of fsnotify needs Go 1.23.</p> <h3>Changes and fixes</h3> <ul> <li> <p>inotify: improve initialization error message (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/731">#731</a>)</p> </li> <li> <p>inotify: send Rename event if recursive watch is renamed (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/696">#696</a>)</p> </li> <li> <p>inotify: avoid copying event buffers when reading names (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/741">#741</a>)</p> </li> <li> <p>kqueue: skip dangling symlinks (ENOENT) in watchDirectoryFiles, so a bad entry no longer aborts Watcher.Add for the whole directory (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/748">#748</a>)</p> </li> <li> <p>kqueue: drop watches directly in Close() to fix a file descriptor leak when recycling watchers (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/740">#740</a>)</p> </li> <li> <p>windows: fix nil pointer dereference in remWatch (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/736">#736</a>)</p> </li> <li> <p>windows: lock watch field updates against concurrent WatchList to fix a race introduced in v1.9.0 (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/709">#709</a>, <a href="https://redirect.github.com/fsnotify/fsnotify/issues/749">#749</a>)</p> </li> </ul> <p><a href="https://redirect.github.com/fsnotify/fsnotify/issues/696">#696</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/696">fsnotify/fsnotify#696</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/709">#709</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/709">fsnotify/fsnotify#709</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/731">#731</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/731">fsnotify/fsnotify#731</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/736">#736</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/736">fsnotify/fsnotify#736</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/740">#740</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/740">fsnotify/fsnotify#740</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/741">#741</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/741">fsnotify/fsnotify#741</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/748">#748</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/748">fsnotify/fsnotify#748</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/749">#749</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/749">fsnotify/fsnotify#749</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fsnotify/fsnotify/commit/76b01a6e8f502187fecedea8b025e79e5a86085c"><code>76b01a6</code></a> Release 1.10.1</li> <li><a href="https://github.com/fsnotify/fsnotify/commit/fec150b807510e54e5b25def4b6e5fb001b4898c"><code>fec150b</code></a> Update changelog</li> <li><a href="https://github.com/fsnotify/fsnotify/commit/162b4216ab8f92ecd26425530bee198972c9b3cb"><code>162b421</code></a> inotify, windows: don't rename sibling watches sharing a path prefix (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/755">#755</a>)</li> <li><a href="https://github.com/fsnotify/fsnotify/commit/224257f23b2f3a96509b316c5cead71dd4a9099a"><code>224257f</code></a> inotify: don't remove sibling watches sharing a path prefix (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/754">#754</a>)</li> <li><a href="https://github.com/fsnotify/fsnotify/commit/e0c956c0ccaf51562fee30ef5c055c74e6ae2104"><code>e0c956c</code></a> windows: document directory Write events and stabilize tests (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/745">#745</a>)</li> <li><a href="https://github.com/fsnotify/fsnotify/commit/8d01d7b9cbe0199e4a1e60fbd965fb05dbb42123"><code>8d01d7b</code></a> Release 1.10.0</li> <li><a href="https://github.com/fsnotify/fsnotify/commit/602284e4a8cadd488d7a5fa07c48462dfac25108"><code>602284e</code></a> Update changelog</li> <li><a href="https://github.com/fsnotify/fsnotify/commit/7f03e59f9659552d8a084e03024cb9b983748ed7"><code>7f03e59</code></a> kqueue: skip ENOENT entries in watchDirectoryFiles (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/748">#748</a>)</li> <li><a href="https://github.com/fsnotify/fsnotify/commit/dab9dde2fc9ba4d0c1076318f81cabcc8fdb2ec9"><code>dab9dde</code></a> windows: lock watch field updates against concurrent WatchList (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/709">#709</a>) (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/749">#749</a>)</li> <li><a href="https://github.com/fsnotify/fsnotify/commit/eadf267ce152b5e62d48cc2c13bb08bd4062b6c7"><code>eadf267</code></a> kqueue: drop watches directly in Close() instead of going through remove() (#...</li> <li>Additional commits viewable in <a href="https://github.com/fsnotify/fsnotify/compare/v1.9.0...v1.10.1">compare view</a></li> </ul> </details> <br /> Updates `github.com/huandu/go-sqlbuilder` from 1.40.2 to 1.41.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/huandu/go-sqlbuilder/releases">github.com/huandu/go-sqlbuilder's releases</a>.</em></p> <blockquote> <h2>v1.41.0</h2> <ul> <li><code>[NEW]</code> Add an option <code>NoExpand</code> to change default field "expand" behavior for backward compatibility. See <a href="https://redirect.github.com/huandu/go-sqlbuilder/issues/237">#237</a> for details.</li> </ul> <p>NOTE: Starting from v1.40.0, the <code>Struct</code> utility type defaults to expanding non-primitive struct fields. This change caused unexpected behavior for some users. To address this without reverting the features introduced in v1.40.0, we have introduced a <code>NoExpand </code>configuration. When set to true, all fields will default to no expansion (preserving legacy behavior). You can still opt-in to expansion for specific fields by using the <code>fieldopt:"expand"</code> tag.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/huandu/go-sqlbuilder/compare/v1.40.0...v1.41.0">https://github.com/huandu/go-sqlbuilder/compare/v1.40.0...v1.41.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/huandu/go-sqlbuilder/commit/44837218602c8f96eac9f27411d5b93a20dc979d"><code>4483721</code></a> fix <a href="https://redirect.github.com/huandu/go-sqlbuilder/issues/237">#237</a>: add option <code>NoExpand</code> to control default field "expand" behavior</li> <li>See full diff in <a href="https://github.com/huandu/go-sqlbuilder/compare/v1.40.2...v1.41.0">compare view</a></li> </ul> </details> <br /> Updates `github.com/lestrrat-go/jwx/v3` from 3.1.0 to 3.1.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lestrrat-go/jwx/releases">github.com/lestrrat-go/jwx/v3's releases</a>.</em></p> <blockquote> <h2>v3.1.1</h2> <p>For more detailed release notes, see <a href="https://github.com/lestrrat-go/jwx/blob/v3.1.1/Changes">Changes</a>.</p> <h2>What's Changed</h2> <ul> <li>build(deps): bump pozil/auto-assign-issue from 2.2.0 to 2.2.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2045">lestrrat-go/jwx#2045</a></li> <li>guard ecdsa coordinates against oversized big.Int by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2050">lestrrat-go/jwx#2050</a></li> <li>reject jwe with conflicting alg in protected vs per-recipient by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2052">lestrrat-go/jwx#2052</a></li> <li>fix AddressClaim.MarshalJSON for non-printable bytes by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2056">lestrrat-go/jwx#2056</a></li> <li>jwt: only call ParseForm when WithFormKey is supplied by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2058">lestrrat-go/jwx#2058</a></li> <li>jws: jkuProvider rejects fetched keys marked use=enc by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2060">lestrrat-go/jwx#2060</a></li> <li>jwa: unify SignatureAlgorithm/KeyEncryption/ContentEncryption into one registry by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2066">lestrrat-go/jwx#2066</a></li> <li>build(deps): bump pozil/auto-assign-issue from f245a9119ba5cc2fed4aa7b8268d576d40acddf0 to 7bf9d82c77d45976224660b873fc83e60576c5aa by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2065">lestrrat-go/jwx#2065</a></li> <li>cmd/jwx: warn on private-key-to-tty + reject keysize<=0 for oct by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2071">lestrrat-go/jwx#2071</a></li> <li>jws: refuse "b64" header in VerifyCompactFast by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2081">lestrrat-go/jwx#2081</a></li> <li>jws: VerifyCompactFast refusals match jws.VerifyError() class by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2083">lestrrat-go/jwx#2083</a></li> <li>jws: name loose keySet options in fan-out verify error by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2085">lestrrat-go/jwx#2085</a></li> <li>jws: honor RFC 7797 b64=false in Message.MarshalJSON by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2087">lestrrat-go/jwx#2087</a></li> <li>jws: reject literal-JSON "protected" in general-form JWS by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2089">lestrrat-go/jwx#2089</a></li> <li>jwt: ParseRequest: don't skip form body on chunked transfer by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2091">lestrrat-go/jwx#2091</a></li> <li>jwt: pedantic mode enforces cty=JWT nested-envelope shape by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2094">lestrrat-go/jwx#2094</a></li> <li>jwt: defensively reject missing claims in MaxDeltaIs / MinDeltaIs by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2099">lestrrat-go/jwx#2099</a></li> <li>jwt: ParseInsecure: parse loop-local payload, not original input by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2097">lestrrat-go/jwx#2097</a></li> <li>jws: Verify rejects b64=false without "b64" listed in "crit" by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2102">lestrrat-go/jwx#2102</a></li> <li>jws: Sign auto-declares "b64" in "crit" when emitting b64=false by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2104">lestrrat-go/jwx#2104</a></li> <li>jws: declare "b64" as typed bool header field by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2106">lestrrat-go/jwx#2106</a></li> <li>jws: reject general-form JWS with top-level "header" sibling of "signatures" by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2108">lestrrat-go/jwx#2108</a></li> <li>jws: typed sentinel for AlgorithmsForKey unclassifiable-key failures by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2110">lestrrat-go/jwx#2110</a></li> <li>jws: VerifyMessage observes ctx cancellation between loop iterations by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2112">lestrrat-go/jwx#2112</a></li> <li>jws: cleanup follow-ups from recent review (low-severity batch) by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2114">lestrrat-go/jwx#2114</a></li> <li>jwe: DecryptMessage observes ctx cancellation between loop iterations by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2117">lestrrat-go/jwx#2117</a></li> <li>jwe: parse and bound-check PBES2 p2c in int64 space; name the violated bound by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2119">lestrrat-go/jwx#2119</a></li> <li>jwe: WithKey validates alg-vs-key shape at option-time by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2121">lestrrat-go/jwx#2121</a></li> <li>jwe: compression cap error names "decompressed" payload, the option, and the size by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2123">lestrrat-go/jwx#2123</a></li> <li>jwe: bound joined-error count and drop redundant outer Decrypt prefix by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2125">lestrrat-go/jwx#2125</a></li> <li>jwe: keySetProvider surfaces per-key errors via errors.Join by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2127">lestrrat-go/jwx#2127</a></li> <li>jwe: add WithDisabledKeyAlgorithms global policy hook by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2129">lestrrat-go/jwx#2129</a></li> <li>jwe: document WithMaxDecompressBufferSize behavior at non-positive values by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2131">lestrrat-go/jwx#2131</a></li> <li>jwk: stop duplicating JWK fields at JWKS top level on parse by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2133">lestrrat-go/jwx#2133</a></li> <li>jwk: wrap ParseKey errors with ParseError sentinel by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2135">lestrrat-go/jwx#2135</a></li> <li>jwk: stream the keys array with cap-before-allocate by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2137">lestrrat-go/jwx#2137</a></li> <li>jwk: treat nil key from custom KeyParser as continue, not success by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2140">lestrrat-go/jwx#2140</a></li> <li>jwk: fix phantom ContinueParseError refs and unmarshaler typo in docs by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2142">lestrrat-go/jwx#2142</a></li> <li>Changes: draft v3.1.1 release notes by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2155">lestrrat-go/jwx#2155</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/lestrrat-go/jwx/compare/v3.1.0...v3.1.1">https://github.com/lestrrat-go/jwx/compare/v3.1.0...v3.1.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/lestrrat-go/jwx/blob/v3.1.1/Changes">github.com/lestrrat-go/jwx/v3's changelog</a>.</em></p> <blockquote> <p>v3.1.1 7 May 2026</p> <ul> <li> <p>[jws] Coordinated RFC 7797 <code>b64=false</code> handling pass: <code>jws.Verify</code> rejects payloads with <code>b64=false</code> unless <code>b64</code> is also listed in <code>crit</code>; <code>jws.Sign</code> auto-declares <code>b64</code> in <code>crit</code> when emitting <code>b64=false</code>; <code>Message.MarshalJSON</code> honors <code>b64=false</code> instead of silently re-encoding; <code>jws.VerifyCompactFast</code> refuses any compact JWS carrying <code>b64</code> (the fast path doesn't process extension headers); and <code>b64</code> is now declared as a typed boolean header field rather than handled ad-hoc. (<a href="https://redirect.github.com/lestrrat-go/jwx/issues/2081">#2081</a>, <a href="https://redirect.github.com/lestrrat-go/jwx/issues/2087">#2087</a>, <a href="https://redirect.github.com/lestrrat-go/jwx/issues/2102">#2102</a>, <a href="https://redirect.github.com/lestrrat-go/jwx/issues/2104">#2104</a>, <a href="https://redirect.github.com/lestrrat-go/jwx/issues/2106">#2106</a>)</p> </li> <li> <p>[jws] Reject malformed general-form JSON-serialized JWS: inputs with a top-level <code>header</code> member as a sibling of <code>signatures</code> are rejected (the spec only permits <code>header</code> inside per-signature objects), as are inputs whose <code>protected</code> member is a literal JSON object instead of a base64url-encoded string. (<a href="https://redirect.github.com/lestrrat-go/jwx/issues/2089">#2089</a>, <a href="https://redirect.github.com/lestrrat-go/jwx/issues/2108">#2108</a>)</p> </li> <li> <p>[jws] <code>jws.AlgorithmsForKey</code> failures from unclassifiable keys are now wrapped in a typed sentinel so callers can branch on "couldn't categorize this key" without string matching the error message. (<a href="https://redirect.github.com/lestrrat-go/jwx/issues/2110">#2110</a>)</p> </li> <li> <p>[jws] Verify error-shape consistency: <code>VerifyCompactFast</code> refusals now match the <code>jws.VerifyError()</code> taxonomy used by the slow path, fan-out verify errors name the loose <code>WithKeySet</code> options that were tried, multi-signature <code>b64</code> mismatches name the offending signature index and conflicting value, and the compact <code>b64=false</code>+payload-contains-<code>.</code> error references RFC 7797 §5.2 and points at <code>WithDetachedPayload</code>. (<a href="https://redirect.github.com/lestrrat-go/jwx/issues/2083">#2083</a>, <a href="https://redirect.github.com/lestrrat-go/jwx/issues/2085">#2085</a>, <a href="https://redirect.github.com/lestrrat-go/jwx/issues/2114">#2114</a>)</p> </li> <li> <p>[jws] Keys fetched via the <code>jku</code> header are no longer accepted for signature verification when the JWK declares <code>use=enc</code>. (<a href="https://redirect.github.com/lestrrat-go/jwx/issues/2060">#2060</a>)</p> </li> <li> <p>[jws][jwe] <code>jws.VerifyMessage</code> and <code>jwe.DecryptMessage</code> observe context cancellation between loop iterations rather than only at boundaries. Long fan-out verify/decrypt loops now respond to a cancelled context promptly. (<a href="https://redirect.github.com/lestrrat-go/jwx/issues/2112">#2112</a>, <a href="https://redirect.github.com/lestrrat-go/jwx/issues/2117">#2117</a>)</p> </li> <li> <p>[jwe] Reject PBES2 messages whose <code>p2c</code> (iteration count) does not parse cleanly into int64 or violates the configured bound. The error now names the violated bound (min vs max) instead of the generic "out of range". (<a href="https://redirect.github.com/lestrrat-go/jwx/issues/2119">#2119</a>)</p> </li> <li> <p>[jwe] <code>jwe.WithKey()</code> validates the alg-vs-key shape at option construction time rather than during encryption, so misuse surfaces at the call site instead of inside the encrypt loop. (<a href="https://redirect.github.com/lestrrat-go/jwx/issues/2121">#2121</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lestrrat-go/jwx/commit/59b8b1b4239be0b470e5d939f16759793bc4a203"><code>59b8b1b</code></a> release v3.1.1</li> <li><a href="https://github.com/lestrrat-go/jwx/commit/4d4ab015bec294bcee30d83506def12906e9da2c"><code>4d4ab01</code></a> Changes: draft v3.1.1 release notes (<a href="https://redirect.github.com/lestrrat-go/jwx/issues/2155">#2155</a>)</li> <li><a href="https://github.com/lestrrat-go/jwx/commit/ad739f565db19d9d8fe805eb5db0b05d5441f971"><code>ad739f5</code></a> jwk: fix phantom ContinueParseError refs and unmarshaler typo in docs (<a href="https://redirect.github.com/lestrrat-go/jwx/issues/2142">#2142</a>)</li> <li><a href="https://github.com/lestrrat-go/jwx/commit/3227cf9c3d8ddc2d9728d58db03f905b61972f69"><code>3227cf9</code></a> jwk: treat nil key from custom KeyParser as continue, not success (<a href="https://redirect.github.com/lestrrat-go/jwx/issues/2140">#2140</a>)</li> <li><a href="https://github.com/lestrrat-go/jwx/commit/82c067ed57cbcbf0aba072518ed928c96306e951"><code>82c067e</code></a> jwk: stream the keys array with cap-before-allocate (<a href="https://redirect.github.com/lestrrat-go/jwx/issues/2137">#2137</a>)</li> <li><a href="https://github.com/lestrrat-go/jwx/commit/931a815632dab9bb0e49c81aa701dbf9e9a77f04"><code>931a815</code></a> jwk: wrap ParseKey errors with ParseError sentinel (<a href="https://redirect.github.com/lestrrat-go/jwx/issues/2135">#2135</a>)</li> <li><a href="https://github.com/lestrrat-go/jwx/commit/53f62259012b1d934a1dc8c07ebbd8f516f7b919"><code>53f6225</code></a> jwk: stop duplicating JWK fields at JWKS top level on parse (<a href="https://redirect.github.com/lestrrat-go/jwx/issues/2133">#2133</a>)</li> <li><a href="https://github.com/lestrrat-go/jwx/commit/8943519997fa2fe4e7e0423baf9cd8e9bb45ddd9"><code>8943519</code></a> jwe: document WithMaxDecompressBufferSize behavior at non-positive values (<a href="https://redirect.github.com/lestrrat-go/jwx/issues/2">#2</a>...</li> <li><a href="https://github.com/lestrrat-go/jwx/commit/4797307a63aa0dd6847ee64cbdacbb878226b4f8"><code>4797307</code></a> jwe: add WithDisabledKeyAlgorithms global policy hook (<a href="https://redirect.github.com/lestrrat-go/jwx/issues/2129">#2129</a>)</li> <li><a href="https://github.com/lestrrat-go/jwx/commit/de41d0ef9e0b8f6a9f844f5313abbc510dda78fb"><code>de41d0e</code></a> jwe: keySetProvider surfaces per-key errors via errors.Join (<a href="https://redirect.github.com/lestrrat-go/jwx/issues/2127">#2127</a>)</li> <li>Additional commits viewable in <a href="https://github.com/lestrrat-go/jwx/compare/v3.1.0...v3.1.1">compare view</a></li> </ul> </details> <br /> Updates `github.com/olekukonko/tablewriter` from 1.1.0 to 1.1.4 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/olekukonko/tablewriter/commit/a0dea8a90a8a0c7610afb5588d2f15a57f4aa9a2"><code>a0dea8a</code></a> no need to disable twice</li> <li><a href="https://github.com/olekukonko/tablewriter/commit/a4fb40afbe367fd0733ce7b45223034febf7b0b4"><code>a4fb40a</code></a> Merge pull request <a href="https://redirect.github.com/olekukonko/tablewriter/issues/314">#314</a> from sducamp/fix/rendition-debug-leak</li> <li><a href="https://github.com/olekukonko/tablewriter/commit/6bc4cb4866ab2a10340bf0d11c41e676b546e253"><code>6bc4cb4</code></a> fix: prevent debug output leak from renderer during Options() reconfiguration</li> <li><a href="https://github.com/olekukonko/tablewriter/commit/54408fee90b7a66a94d9d71f789d42e03f45109b"><code>54408fe</code></a> update ll to v0.1.6</li> <li><a href="https://github.com/olekukonko/tablewriter/commit/5ea5f3c761e556def568d7e07df774c55ae66071"><code>5ea5f3c</code></a> add mote tab test ans update go mod</li> <li><a href="https://github.com/olekukonko/tablewriter/commit/1455dd8dd79719f142013f59e300fcdf0144f3fd"><code>1455dd8</code></a> Merge pull request <a href="https://redirect.github.com/olekukonko/tablewriter/issues/311">#311</a> from olekukonko/tabber</li> <li><a href="https://github.com/olekukonko/tablewriter/commit/d7b0a55c1f9c6bd55eceaa22dfb0123bac23f281"><code>d7b0a55</code></a> improve tab and make test more predictable</li> <li><a href="https://github.com/olekukonko/tablewriter/commit/62117a2ca655057ba2e61f2d18896f619fc48230"><code>62117a2</code></a> add space default <a href="https://redirect.github.com/olekukonko/tablewriter/issues/312">#312</a> for colorized renderer</li> <li><a href="https://github.com/olekukonko/tablewriter/commit/4958831ad1de62ec94567bf5d42a8a9b2c50e74d"><code>4958831</code></a> ll v0.1.5 update enables logging by default hence disable</li> <li><a href="https://github.com/olekukonko/tablewriter/commit/1c68e06c65b87d5416aada2737b6683fadd1b25b"><code>1c68e06</code></a> use space for padding as default <a href="https://redirect.github.com/olekukonko/tablewriter/issues/312">#312</a></li> <li>Additional commits viewable in <a href="https://github.com/olekukonko/tablewriter/compare/v1.1.0...v1.1.4">compare view</a></li> </ul> </details> <br /> Updates `github.com/vektah/gqlparser/v2` from 2.5.32 to 2.5.33 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vektah/gqlparser/releases">github.com/vektah/gqlparser/v2's releases</a>.</em></p> <blockquote> <h2>v2.5.33</h2> <h2>What's Changed</h2> <ul> <li>fix: allow repeatable directives on GraphQL document by <a href="https://github.com/fredzqm"><code>@fredzqm</code></a> in <a href="https://redirect.github.com/vektah/gqlparser/pull/418">vektah/gqlparser#418</a></li> <li>feat: create a new ScalarLeafsRuleWithoutSuggestions validator rule by <a href="https://github.com/XuankangLin"><code>@XuankangLin</code></a> in <a href="https://redirect.github.com/vektah/gqlparser/pull/413">vektah/gqlparser#413</a></li> <li>refactor: format lines in scalar_leafs.go by <a href="https://github.com/XuankangLin"><code>@XuankangLin</code></a> in <a href="https://redirect.github.com/vektah/gqlparser/pull/423">vektah/gqlparser#423</a></li> <li>Fix negative Position.Column for definitions with block string descriptions (<a href="https://redirect.github.com/vektah/gqlparser/issues/254">#254</a>) by <a href="https://github.com/riwal42c"><code>@riwal42c</code></a> in <a href="https://redirect.github.com/vektah/gqlparser/pull/422">vektah/gqlparser#422</a></li> <li>Update spec to 2023 version by <a href="https://github.com/StevenACoffman"><code>@StevenACoffman</code></a> in <a href="https://redirect.github.com/vektah/gqlparser/pull/401">vektah/gqlparser#401</a></li> <li>Bump picomatch from 2.3.1 to 2.3.2 in /validator/imported by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/vektah/gqlparser/pull/420">vektah/gqlparser#420</a></li> <li>Bump <code>@babel/preset-env</code> from 7.29.0 to 7.29.2 in /validator/imported in the actions-deps group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/vektah/gqlparser/pull/419">vektah/gqlparser#419</a></li> <li>Bump brace-expansion from 1.1.12 to 1.1.13 in /validator/imported by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/vektah/gqlparser/pull/421">vektah/gqlparser#421</a></li> <li>Bump prettier from 3.8.1 to 3.8.2 in /validator/imported in the actions-deps group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/vektah/gqlparser/pull/424">vektah/gqlparser#424</a></li> <li>Bump prettier from 3.8.2 to 3.8.3 in /validator/imported in the actions-deps group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/vektah/gqlparser/pull/425">vektah/gqlparser#425</a></li> <li>Bump minimatch from 3.0.4 to 3.1.5 in /validator/imported by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/vektah/gqlparser/pull/417">vektah/gqlparser#417</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/XuankangLin"><code>@XuankangLin</code></a> made their first contribution in <a href="https://redirect.github.com/vektah/gqlparser/pull/413">vektah/gqlparser#413</a></li> <li><a href="https://github.com/riwal42c"><code>@riwal42c</code></a> made their first contribution in <a href="https://redirect.github.com/vektah/gqlparser/pull/422">vektah/gqlparser#422</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/vektah/gqlparser/compare/v2.5.32...v2.5.33">https://github.com/vektah/gqlparser/compare/v2.5.32...v2.5.33</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vektah/gqlparser/commit/41b7913b390ac4278ca7fc766afd586c1e6df819"><code>41b7913</code></a> Bump minimatch from 3.0.4 to 3.1.5 in /validator/imported (<a href="https://redirect.github.com/vektah/gqlparser/issues/417">#417</a>)</li> <li><a href="https://github.com/vektah/gqlparser/commit/3c33bbeb81dd06c1dc5d5e56c97c2ac74e3a5e71"><code>3c33bbe</code></a> Bump prettier in /validator/imported in the actions-deps group (<a href="https://redirect.github.com/vektah/gqlparser/issues/425">#425</a>)</li> <li><a href="https://github.com/vektah/gqlparser/commit/f63b51fcf337b673ac06b593262f7ed72d11de24"><code>f63b51f</code></a> Update spec to 2023 version (<a href="https://redirect.github.com/vektah/gqlparser/issues/401">#401</a>)</li> <li><a href="https://github.com/vektah/gqlparser/commit/1f1383cb52d49c63919a791309a2c80e16a83c6f"><code>1f1383c</code></a> Bump prettier in /validator/imported in the actions-deps group (<a href="https://redirect.github.com/vektah/gqlparser/issues/424">#424</a>)</li> <li><a href="https://github.com/vektah/gqlparser/commit/021901042dbe56648020832ee88973acd389ea64"><code>0219010</code></a> Fix negative Position.Column for definitions with block string descriptions (...</li> <li><a href="https://github.com/vektah/gqlparser/commit/16bf3c4da15f2de0a8648e66f956ef9da2129d8e"><code>16bf3c4</code></a> refactor: format lines in scalar_leafs.go (<a href="https://redirect.github.com/vektah/gqlparser/issues/423">#423</a>)</li> <li><a href="https://github.com/vektah/gqlparser/commit/be677085400ffa5fd6e0ac86d98d1cf94db05efe"><code>be67708</code></a> Bump brace-expansion from 1.1.12 to 1.1.13 in /validator/imported (<a href="https://redirect.github.com/vektah/gqlparser/issues/421">#421</a>)</li> <li><a href="https://github.com/vektah/gqlparser/commit/61efb18da16d7f45f8050ecb576d27b85e6861da"><code>61efb18</code></a> feat: create a new ScalarLeafsRuleWithoutSuggestions validator rule (<a href="https://redirect.github.com/vektah/gqlparser/issues/413">#413</a>)</li> <li><a href="https://github.com/vektah/gqlparser/commit/a9bb4644d5911effae909bab06029df7f11c402c"><code>a9bb464</code></a> feat(validator): handle repeatable directives correctly (<a href="https://redirect.github.com/vektah/gqlparser/issues/418">#418</a>)</li> <li><a href="https://github.com/vektah/gqlparser/commit/b239ec3bfe15a44330f9752bd7fb56cc41cf1c2b"><code>b239ec3</code></a> Bump <code>@babel/preset-env</code> in /validator/imported in the actions-deps group (<a href="https://redirect.github.com/vektah/gqlparser/issues/419">#419</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vektah/gqlparser/compare/v2.5.32...v2.5.33">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/net` from 0.53.0 to 0.54.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/b138e06246cb323f2f380c2b7f7dd91f581dd56b"><code>b138e06</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/net/commit/689f70a42abd350f3a1aaa70b0d13eb9543d927a"><code>689f70a</code></a> quic: fix wrong final size being used for RESET_STREAM frame</li> <li><a href="https://github.com/golang/net/commit/208f306b2f0fd008b388bee2c2644be279778e94"><code>208f306</code></a> http3: increase handshake timeout</li> <li><a href="https://github.com/golang/net/commit/49810da71b9026da9e0d028a6ad8c7730c52d9c4"><code>49810da</code></a> http2: enable net/http wrapping when go >= 1.27</li> <li><a href="https://github.com/golang/net/commit/5e11a5ab891c117eda83b4304d60dd13286c1c76"><code>5e11a5a</code></a> quic: fix data race in streamForFrame</li> <li><a href="https://github.com/golang/net/commit/8c63081cd380ea768db5651941614b73472160ff"><code>8c63081</code></a> http2: use empty Transport rather than DefaultTransport in http2wrap</li> <li><a href="https://github.com/golang/net/commit/fc7b466ca49cb204039630533ece4fc557eb35cd"><code>fc7b466</code></a> http2: add http2wrap test</li> <li><a href="https://github.com/golang/net/commit/15c2cb1875fd727313dc4de909b3ee149422fbe2"><code>15c2cb1</code></a> http2: avoid overflowing 32-bit int when http2wrap enabled</li> <li><a href="https://github.com/golang/net/commit/64651885c2f2d745d77af2d7af2edbf568c179af"><code>6465188</code></a> http2: add wrapped Server</li> <li><a href="https://github.com/golang/net/commit/72f419a894cb0597dd5b6bcf119086bf2af41231"><code>72f419a</code></a> http2: add wrapped ClientConn</li> <li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.53.0...v0.54.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/text` from 0.36.0 to 0.37.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/text/commit/3ef517e623a4bfc08d6457f87d73afda7af7d8e1"><code>3ef517e</code></a> go.mod: update golang.org/x dependencies</li> <li>See full diff in <a href="https://github.com/golang/text/compare/v0.36.0...v0.37.0">compare view</a></li> </ul> </details> <br /> Updates `google.golang.org/grpc` from 1.80.0 to 1.81.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.81.0</h2> <h1>Behavior Changes</h1> <ul> <li>balancer/rls: Switch gauge metrics to asynchronous emission (once per collection cycle) to reduce telemetry noise and align with other gRPC language implementations. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8808">#8808</a>)</li> </ul> <h1>Dependencies</h1> <ul> <li>Minimum supported Go version is now 1.25. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8969">#8969</a>)</li> </ul> <h1>Bug Fixes</h1> <ul> <li>xds: Use the leaf cluster's security config for the TLS handshake instead of the aggregate cluster's config. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8956">#8956</a>)</li> <li>transport: Send a <code>RST_STREAM</code> when receiving an <code>END_STREAM</code> when the stream is not already half-closed. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8832">#8832</a>)</li> <li>xds: Fix ADS resource name validation to prevent a panic. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8970">#8970</a>)</li> </ul> <h1>New Features</h1> <ul> <li>grpc/stats: Add support for custom labels in per-call metrics (<a href="https://github.com/grpc/proposal/blob/master/A108-otel-custom-per-call-label.md">gRFC A108</a>). (<a href="https://redirect.github.com/grpc/grpc-go/issues/9008">#9008</a>)</li> <li>xds: Add support for Server Name Indication (SNI) and SAN validation (<a href="https://github.com/grpc/proposal/blob/master/A101-SNI-setting-and-SNI-SAN-validation.md">gRFC A101</a>). Disabled by default. To enable, set <code>GRPC_EXPERIMENTAL_XDS_SNI=true</code> environment variable. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9016">#9016</a>)</li> <li>xds: Add support to control which fields get propagated from ORCA backend metric reports to LRS load reports (<a href="https://github.com/grpc/proposal/blob/master/A85-lrs-custom-metrics-changes.md">gRFC A85</a>). Disabled by default. To enable, set <code>GRPC_EXPERIMENTAL_XDS_ORCA_LRS_PROPAGATION=true</code>. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9005">#9005</a>)</li> <li>xds: Add metrics to track xDS client connectivity and cached resource state (<a href="https://github.com/grpc/proposal/blob/master/A78-grpc-metrics-wrr-pf-xds.md">gRFC A78</a>). (<a href="https://redirect.github.com/grpc/grpc-go/issues/8807">#8807</a>)</li> <li>stats/otel: Enhance <code>grpc.subchannel.disconnections</code> metric by adding disconnection reason to the <code>grpc.disconnect_error</code> label (<a href="https://github.com/grpc/proposal/blob/master/A94-subchannel-otel-metrics.md">gRFC A94</a>). This provides granular insights into why subchannels are closing. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8973">#8973</a>)</li> <li>mem: Add <code>mem.Buffer.Slice()</code> API to slice the buffer like a slice. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8977">#8977</a>) <ul> <li>Special Thanks: <a href="https://github.com/ash2k"><code>@ash2k</code></a></li> </ul> </li> </ul> <h1>Performance Improvements</h1> <ul> <li>alts: Pool read buffers to lower memory utilization when sockets are unreadable. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8964">#8964</a>)</li> <li>transport: Pool HTTP/2 framer read buffers to reduce idle memory consumption. Currently limited to Linux for ALTS and non-encrypted transports (TCP, Unix). To disable, set <code>GRPC_GO_EXPERIMENTAL_HTTP_FRAMER_READ_BUFFER_POOLING=false</code> and report any issues. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9032">#9032</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/cb18228317ff523e63d931b4058b0329585b7dcd"><code>cb18228</code></a> Change version to 1.81.0 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9062">#9062</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/96748f973e20bbfcafa19a8bdffc85ad5da138d1"><code>96748f9</code></a> Cherry-pick <a href="https://redirect.github.com/grpc/grpc-go/issues/9105">#9105</a> to 1.81.x (<a href="https://redirect.github.com/grpc/grpc-go/issues/9106">#9106</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/91832222f0144f76527b630ca55cfea6e1aa015a"><code>9183222</code></a> Cherry pick <a href="https://redirect.github.com/grpc/grpc-go/issues/9055">#9055</a>, <a href="https://redirect.github.com/grpc/grpc-go/issues/9032">#9032</a> to v1.81.x (<a href="https://redirect.github.com/grpc/grpc-go/issues/9095">#9095</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/5cba6da4211f3b130238c792937f5921741b616a"><code>5cba6da</code></a> Revert "deps: update dependencies for all modules (<a href="https://redirect.github.com/grpc/grpc-go/issues/9065">#9065</a>)" (<a href="https://redirect.github.com/grpc/grpc-go/issues/9067">#9067</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/af8a9364aa7523ab24d214e9ef13e6ad64d5c5f9"><code>af8a936</code></a> deps: update dependencies for all modules (<a href="https://redirect.github.com/grpc/grpc-go/issues/9065">#9065</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/cdc60dfaaadde45e16aa3c28237c0e655a722c1a"><code>cdc60df</code></a> transport: optimize heap allocations in ready reader and update syscall conne...</li> <li><a href="https://github.com/grpc/grpc-go/commit/208d053e3204c806ba9e6205c26aa064c8b42852"><code>208d053</code></a> xds/resolver: pass complete XDSConfig in RPC context for HTTP filters (gRFC A...</li> <li><a href="https://github.com/grpc/grpc-go/commit/50fe1cc7fd78b78ae638ed90ea78514c934167ac"><code>50fe1cc</code></a> test: Fix flaky test <code>TestServerStreaming_ClientCallRecvMsgTwice</code> in `end2end...</li> <li><a href="https://github.com/grpc/grpc-go/commit/d574bad188f25ba03d41a506e6f2ef93837ad10b"><code>d574bad</code></a> build(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9050">#9050</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/b8bf4d0488a351c563d63797ffba321585d6bb24"><code>b8bf4d0</code></a> build(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 in /inte...</li> <li>Additional commits viewable in <a href="https://github.com/grpc/grpc-go/compare/v1.80.0...v1.81.0">compare view</a></li> </ul> </details> <br /> Updates `gopkg.in/ini.v1` from 1.67.1 to 1.67.2 Updates `github.com/fsnotify/fsnotify` from 1.9.0 to 1.10.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fsnotify/fsnotify/releases">github.com/fsnotify/fsnotify's releases</a>.</em></p> <blockquote> <h2>v1.10.1</h2> <h3>Changes and fixes</h3> <ul> <li> <p>inotify: don't remove sibling watches sharing a path prefix (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/754">#754</a>)</p> </li> <li> <p>inotify, windows: don't rename sibling watches sharing a path prefix (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/755">#755</a>)</p> </li> </ul> <p><a href="https://redirect.github.com/fsnotify/fsnotify/issues/754">#754</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/754">fsnotify/fsnotify#754</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/755">#755</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/755">fsnotify/fsnotify#755</a></p> <h2>v1.10.0</h2> <p>This version of fsnotify needs Go 1.23.</p> <h3>Changes and fixes</h3> <ul> <li> <p>inotify: improve initialization error message (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/731">#731</a>)</p> </li> <li> <p>inotify: send Rename event if recursive watch is renamed (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/696">#696</a>)</p> </li> <li> <p>inotify: avoid copying event buffers when reading names (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/741">#741</a>)</p> </li> <li> <p>kqueue: skip dangling symlinks (ENOENT) in watchDirectoryFiles, so a bad entry no longer aborts Watcher.Add for the whole directory (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/748">#748</a>)</p> </li> <li> <p>kqueue: drop watches directly in Close() to fix a file descriptor leak when recycling watchers (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/740">#740</a>)</p> </li> <li> <p>windows: fix nil pointer dereference in remWatch (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/736">#736</a>)</p> </li> <li> <p>windows: lock watch field updates against concurrent WatchList to fix a race introduced in v1.9.0 (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/709">#709</a>, <a href="https://redirect.github.com/fsnotify/fsnotify/issues/749">#749</a>)</p> </li> </ul> <p><a href="https://redirect.github.com/fsnotify/fsnotify/issues/696">#696</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/696">fsnotify/fsnotify#696</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/709">#709</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/709">fsnotify/fsnotify#709</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/731">#731</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/731">fsnotify/fsnotify#731</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/736">#736</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/736">fsnotify/fsnotify#736</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/740">#740</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/740">fsnotify/fsnotify#740</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/741">#741</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/741">fsnotify/fsnotify#741</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/748">#748</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/748">fsnotify/fsnotify#748</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/749">#749</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/749">fsnotify/fsnotify#749</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/fsnotify/fsnotify/blob/main/CHANGELOG.md">github.com/fsnotify/fsnotify's changelog</a>.</em></p> <blockquote> <h2>1.10.1 2026-05-04</h2> <h3>Changes and fixes</h3> <ul> <li> <p>inotify: don't remove sibling watches sharing a path prefix (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/754">#754</a>)</p> </li> <li> <p>inotify, windows: don't rename sibling watches sharing a path prefix (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/755">#755</a>)</p> </li> </ul> <p><a href="https://redirect.github.com/fsnotify/fsnotify/issues/754">#754</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/754">fsnotify/fsnotify#754</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/755">#755</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/755">fsnotify/fsnotify#755</a></p> <h2>1.10.0 2026-04-30</h2> <p>This version of fsnotify needs Go 1.23.</p> <h3>Changes and fixes</h3> <ul> <li> <p>inotify: improve initialization error message (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/731">#731</a>)</p> </li> <li> <p>inotify: send Rename event if recursive watch is renamed (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/696">#696</a>)</p> </li> <li> <p>inotify: avoid copying event buffers when reading names (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/741">#741</a>)</p> </li> <li> <p>kqueue: skip dangling symlinks (ENOENT) in watchDirectoryFiles, so a bad entry no longer aborts Watcher.Add for the whole directory (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/748">#748</a>)</p> </li> <li> <p>kqueue: drop watches directly in Close() to fix a file descriptor leak when recycling watchers (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/740">#740</a>)</p> </li> <li> <p>windows: fix nil pointer dereference in remWatch (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/736">#736</a>)</p> </li> <li> <p>windows: lock watch field updates against concurrent WatchList to fix a race introduced in v1.9.0 (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/709">#709</a>, <a href="https://redirect.github.com/fsnotify/fsnotify/issues/749">#749</a>)</p> </li> </ul> <p><a href="https://redirect.github.com/fsnotify/fsnotify/issues/696">#696</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/696">fsnotify/fsnotify#696</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/709">#709</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/709">fsnotify/fsnotify#709</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/731">#731</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/731">fsnotify/fsnotify#731</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/736">#736</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/736">fsnotify/fsnotify#736</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/740">#740</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/740">fsnotify/fsnotify#740</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/741">#741</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/741">fsnotify/fsnotify#741</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/748">#748</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/748">fsnotify/fsnotify#748</a> <a href="https://redirect.github.com/fsnotify/fsnotify/issues/749">#749</a>: <a href="https://redirect.github.com/fsnotify/fsnotify/pull/749">fsnotify/fsnotify#749</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fsnotify/fsnotify/commit/76b01a6e8f502187fecedea8b025e79e5a86085c"><code>76b01a6</code></a> Release 1.10.1</li> <li><a href="https://github.com/fsnotify/fsnotify/commit/fec150b807510e54e5b25def4b6e5fb001b4898c"><code>fec150b</code></a> Update changelog</li> <li><a href="https://github.com/fsnotify/fsnotify/commit/162b4216ab8f92ecd26425530bee198972c9b3cb"><code>162b421</code></a> inotify, windows: don't rename sibling watches sharing a path prefix (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/755">#755</a>)</li> <li><a href="https://github.com/fsnotify/fsnotify/commit/224257f23b2f3a96509b316c5cead71dd4a9099a"><code>224257f</code></a> inotify: don't remove sibling watches sharing a path prefix (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/754">#754</a>)</li> <li><a href="https://github.com/fsnotify/fsnotify/commit/e0c956c0ccaf51562fee30ef5c055c74e6ae2104"><code>e0c956c</code></a> windows: document directory Write events and stabilize tests (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/745">#745</a>)</li> <li><a href="https://github.com/fsnotify/fsnotify/commit/8d01d7b9cbe0199e4a1e60fbd965fb05dbb42123"><code>8d01d7b</code></a> Release 1.10.0</li> <li><a href="https://github.com/fsnotify/fsnotify/commit/602284e4a8cadd488d7a5fa07c48462dfac25108"><code>602284e</code></a> Update changelog</li> <li><a href="https://github.com/fsnotify/fsnotify/commit/7f03e59f9659552d8a084e03024cb9b983748ed7"><code>7f03e59</code></a> kqueue: skip ENOENT entries in watchDirectoryFiles (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/748">#748</a>)</li> <li><a href="https://github.com/fsnotify/fsnotify/commit/dab9dde2fc9ba4d0c1076318f81cabcc8fdb2ec9"><code>dab9dde</code></a> windows: lock watch field updates against concurrent WatchList (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/709">#709</a>) (<a href="https://redirect.github.com/fsnotify/fsnotify/issues/749">#749</a>)</li> <li><a href="https://github.com/fsnotify/fsnotify/commit/eadf267ce152b5e62d48cc2c13bb08bd4062b6c7"><code>eadf267</code></a> kqueue: drop watches directly in Close() instead of going through remove() (#...</li> <li>Additional commits viewable in <a href="https://github.com/fsnotify/fsnotify/compare/v1.9.0...v1.10.1">compare view</a></li> </ul> </details> <br /> Updates `github.com/huandu/go-sqlbuilder` from 1.40.2 to 1.41.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/huandu/go-sqlbuilder/releases">github.com/huandu/go-sqlbuilder's releases</a>.</em></p> <blockquote> <h2>v1.41.0</h2> <ul> <li><code>[NEW]</code> Add an option <code>NoExpand</code> to change default field "expand" behavior for backward compatibility. See <a href="https://redirect.github.com/huandu/go-sqlbuilder/issues/237">#237</a> for details.</li> </ul> <p>NOTE: Starting from v1.40.0, the <code>Struct</code> utility type defaults to expanding non-primitive struct fields. This change caused unexpected behavior for some users. To address this without reverting the features introduced in v1.40.0, we have introduced a <code>NoExpand </code>configuration. When set to true, all fields will default to no expansion (preserving legacy behavior). You can still opt-in to expansion for specific fields by using the <code>fieldopt:"expand"</code> tag.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/huandu/go-sqlbuilder/compare/v1.40.0...v1.41.0">https://github.com/huandu/go-sqlbuilder/compare/v1.40.0...v1.41.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/huandu/go-sqlbuilder/commit/44837218602c8f96eac9f27411d5b93a20dc979d"><code>4483721</code></a> fix <a href="https://redirect.github.com/huandu/go-sqlbuilder/issues/237">#237</a>: add option <code>NoExpand</code> to control default field "expand" behavior</li> <li>See full diff in <a href="https://github.com/huandu/go-sqlbuilder/compare/v1.40.2...v1.41.0">compare view</a></li> </ul> </details> <br /> Updates `github.com/lestrrat-go/jwx/v3` from 3.1.0 to 3.1.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lestrrat-go/jwx/releases">github.com/lestrrat-go/jwx/v3's releases</a>.</em></p> <blockquote> <h2>v3.1.1</h2> <p>For more detailed release notes, see <a href="https://github.com/lestrrat-go/jwx/blob/v3.1.1/Changes">Changes</a>.</p> <h2>What's Changed</h2> <ul> <li>build(deps): bump pozil/auto-assign-issue from 2.2.0 to 2.2.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2045">lestrrat-go/jwx#2045</a></li> <li>guard ecdsa coordinates against oversized big.Int by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2050">lestrrat-go/jwx#2050</a></li> <li>reject jwe with conflicting alg in protected vs per-recipient by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2052">lestrrat-go/jwx#2052</a></li> <li>fix AddressClaim.MarshalJSON for non-printable bytes by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2056">lestrrat-go/jwx#2056</a></li> <li>jwt: only call ParseForm when WithFormKey is supplied by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2058">lestrrat-go/jwx#2058</a></li> <li>jws: jkuProvider rejects fetched keys marked use=enc by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2060">lestrrat-go/jwx#2060</a></li> <li>jwa: unify SignatureAlgorithm/KeyEncryption/ContentEncryption into one registry by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2066">lestrrat-go/jwx#2066</a></li> <li>build(deps): bump pozil/auto-assign-issue from f245a9119ba5cc2fed4aa7b8268d576d40acddf0 to 7bf9d82c77d45976224660b873fc83e60576c5aa by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2065">lestrrat-go/jwx#2065</a></li> <li>cmd/jwx: warn on private-key-to-tty + reject keysize<=0 for oct by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2071">lestrrat-go/jwx#2071</a></li> <li>jws: refuse "b64" header in VerifyCompactFast by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2081">lestrrat-go/jwx#2081</a></li> <li>jws: VerifyCompactFast refusals match jws.VerifyError() class by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2083">lestrrat-go/jwx#2083</a></li> <li>jws: name loose keySet options in fan-out verify error by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2085">lestrrat-go/jwx#2085</a></li> <li>jws: honor RFC 7797 b64=false in Message.MarshalJSON by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2087">lestrrat-go/jwx#2087</a></li> <li>jws: reject literal-JSON "protected" in general-form JWS by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2089">lestrrat-go/jwx#2089</a></li> <li>jwt: ParseRequest: don't skip form body on chunked transfer by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2091">lestrrat-go/jwx#2091</a></li> <li>jwt: pedantic mode enforces cty=JWT nested-envelope shape by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2094">lestrrat-go/jwx#2094</a></li> <li>jwt: defensively reject missing claims in MaxDeltaIs / MinDeltaIs by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2099">lestrrat-go/jwx#2099</a></li> <li>jwt: ParseInsecure: parse loop-local payload, not original input by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2097">lestrrat-go/jwx#2097</a></li> <li>jws: Verify rejects b64=false without "b64" listed in "crit" by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2102">lestrrat-go/jwx#2102</a></li> <li>jws: Sign auto-declares "b64" in "crit" when emitting b64=false by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2104">lestrrat-go/jwx#2104</a></li> <li>jws: declare "b64" as typed bool header field by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2106">lestrrat-go/jwx#2106</a></li> <li>jws: reject general-form JWS with top-level "header" sibling of "signatures" by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2108">lestrrat-go/jwx#2108</a></li> <li>jws: typed sentinel for AlgorithmsForKey unclassifiable-key failures by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> in <a href="https://redirect.github.com/lestrrat-go/jwx/pull/2110">lestrrat-go/jwx#2110</a></li> <li>jws: VerifyMessage observes ctx cancellation between loop iterations by <a href="https://github.com/lestrrat"><code>@lestrrat</code></a> i... _Description has been truncated_ --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Johan Fylling <johan.dev@fylling.se> Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Johan Fylling <johan.dev@fylling.se> Co-authored-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Stephan Renatus
|
a444d1e660 |
workflows: note improvements in benchmark comments
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Johan Fylling
|
cae44b00b4 |
docs: Move future.keyword.not import details out of general policy-lang docs (#8658)
This is a follow up from [this](https://github.com/open-policy-agent/opa/pull/8641#discussion_r3224067825) discussion. This moves the `future.keywords.not` discussion out of the general policy-language documentation and into the keyword page. The issue here, though, is that this lives insides the `Keyword Examples` section of the `Policy Reference` docs. Is there some other place we can move this to; or should we simply rename `Keywords Examples` -> `Keywords` (though then people might expect more details on the other keywords). 🤷 --------- Signed-off-by: Johan Fylling <johan.dev@fylling.se> |
||
|
Philip Conrad
|
3250b653ac |
bundle: Update bundle roots conflict detection algorithm. (#8664)
This commit is a change of algorithm for how we detect conflicts between the roots of multiple bundles. The old algorithm was an O(N^2) all-to-all root paths comparison. The new algorithm changes this to a string sorting and scanning process, which results in O(N log N) comparisons, and fewer string split operations. The benchmarks included with this commit indicate a meaningful improvement across nearly all cases tested, with even the pathological cases showing substantial improvement in runtime and memory usage/allocs. |
||
|
dependabot[bot]
|
37de95f5fc |
build(deps): bump webpack-dev-server from 5.2.2 to 5.2.4 in /docs (#8670)
Bumps [webpack-dev-server](https://github.com/webpack/webpack-dev-server) from 5.2.2 to 5.2.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/webpack/webpack-dev-server/releases">webpack-dev-server's releases</a>.</em></p> <blockquote> <h2>v5.2.4</h2> <h3><a href="https://github.com/webpack/webpack-dev-server/compare/v5.2.3...v5.2.4">5.2.4</a> (2026-05-11)</h3> <h3>Bug Fixes</h3> <ul> <li>set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP</li> </ul> <h2>v5.2.3</h2> <h3><a href="https://github.com/webpack/webpack-dev-server/compare/v5.2.2...v5.2.3">5.2.3</a> (2026-01-12)</h3> <h3>Bug Fixes</h3> <ul> <li>add <code>cause</code> for <code>errorObject</code> (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5518">#5518</a>) (<a href="https://github.com/webpack/webpack-dev-server/commit/37b033da2c48335178495a1987c469a26ef3de60">37b033d</a>)</li> <li>compatibility with event target and universal target and lazy compilation (<a href="https://github.com/webpack/webpack-dev-server/commit/574026c44b9c51f0bbd2f5a2836c54607289a071">574026c</a>)</li> <li><strong>overlay:</strong> add ESC key to dismiss overlay (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5598">#5598</a>) (<a href="https://github.com/webpack/webpack-dev-server/commit/f91baa8831e061e2998849966b8002b40b83fb07">f91baa8</a>)</li> <li>progress indicator styles (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5557">#5557</a>) (<a href="https://github.com/webpack/webpack-dev-server/commit/41a53a1accdb0a90785d82cbe8a079794eeed3c8">41a53a1</a>)</li> <li>upgrade selfsigned to v5</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md">webpack-dev-server's changelog</a>.</em></p> <blockquote> <h3><a href="https://github.com/webpack/webpack-dev-server/compare/v5.2.3...v5.2.4">5.2.4</a> (2026-05-11)</h3> <h3>Bug Fixes</h3> <ul> <li>set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP</li> </ul> <h3><a href="https://github.com/webpack/webpack-dev-server/compare/v5.2.2...v5.2.3">5.2.3</a> (2026-01-12)</h3> <h3>Bug Fixes</h3> <ul> <li>add <code>cause</code> for <code>errorObject</code> (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5518">#5518</a>) (<a href="https://github.com/webpack/webpack-dev-server/commit/37b033da2c48335178495a1987c469a26ef3de60">37b033d</a>)</li> <li>compatibility with event target and universal target and lazy compilation (<a href="https://github.com/webpack/webpack-dev-server/commit/574026c44b9c51f0bbd2f5a2836c54607289a071">574026c</a>)</li> <li><strong>overlay:</strong> add ESC key to dismiss overlay (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5598">#5598</a>) (<a href="https://github.com/webpack/webpack-dev-server/commit/f91baa8831e061e2998849966b8002b40b83fb07">f91baa8</a>)</li> <li>progress indicator styles (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5557">#5557</a>) (<a href="https://github.com/webpack/webpack-dev-server/commit/41a53a1accdb0a90785d82cbe8a079794eeed3c8">41a53a1</a>)</li> <li>upgrade selfsigned to v5</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/webpack/webpack-dev-server/commit/fd401308f1cc026262880e2dab810004d6444282"><code>fd40130</code></a> chore(release): 5.2.4</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/ece4f3617bea31fb6d3833f69a32b6c289959a49"><code>ece4f36</code></a> chore: update deps (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5661">#5661</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/a2161442a314a06a97e25d1404d08410cb4e9c51"><code>a216144</code></a> ci: fix test (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5658">#5658</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/df073c53a8cefb54210b43813fa6ee60364a554e"><code>df073c5</code></a> Merge commit from fork</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/b550a702bd4246d1724513b70de0bfbe6604672f"><code>b550a70</code></a> chore(release): 5.2.3</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/9704dc52e3f696ae1446428c25882745e9b65cbb"><code>9704dc5</code></a> chore: upgrade selfsigned to v5 and remove node-forge dependency (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5618">#5618</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/92bf644784741e8ea5adaa4a1dc26f4d462f223d"><code>92bf644</code></a> chore: bump express to update qs (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5621">#5621</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/792b2f0bd13a3b93abf701fe3a5cf41ee16722f4"><code>792b2f0</code></a> chore(deps-dev): bump the dependencies group with 4 updates (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5606">#5606</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/6d587cab3e023675de2feedf81bcdfcec7d5b774"><code>6d587ca</code></a> chore(deps): bump the dependencies group across 1 directory with 27 updates (...</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/f91baa8831e061e2998849966b8002b40b83fb07"><code>f91baa8</code></a> fix(overlay): add ESC key to dismiss overlay (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5598">#5598</a>)</li> <li>Additional commits viewable in <a href="https://github.com/webpack/webpack-dev-server/compare/v5.2.2...v5.2.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Sebastian Spaink
|
593559b768 |
Cleanup post-merge from previous edge release attempt (#8672)
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
Charlie Egan
|
ae16d425ab |
website: Bring back edge release redirect (#8671)
test with: https://deploy-preview-8671--openpolicyagent.netlify.app/downloads/edge/opa_darwin_amd64 Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Charlie Egan
|
019eec1f03 |
chore: Push edge binaries to bucket (#8668)
This will allow us to have a redirect URL for edge binaries from the website as we had before. The new secret has been created but will need to merge to get access to it and test. Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Stephan Renatus
|
c67800411c |
ast: support rule annotations from external sources, tweak performance (#8666)
```
goos: darwin
goarch: arm64
pkg: github.com/open-policy-agent/opa/v1/rego
cpu: Apple M4 Max
│ ../scratch/main.bench │ ../scratch/pr.bench │
│ sec/op │ sec/op vs base │
AggregatedLabels/off-16 4.343µ ± 1% 4.292µ ± 1% -1.19% (p=0.001 n=10)
AggregatedLabels/on-16 6.931µ ± 1% 4.585µ ± 5% -33.85% (p=0.001 n=10)
geomean 5.486µ 4.436µ -19.15%
│ ../scratch/main.bench │ ../scratch/pr.bench │
│ B/op │ B/op vs base │
AggregatedLabels/off-16 5.604Ki ± 0% 5.605Ki ± 0% +0.02% (p=0.004 n=10)
AggregatedLabels/on-16 8.493Ki ± 0% 5.960Ki ± 0% -29.83% (p=0.000 n=10)
geomean 6.899Ki 5.780Ki -16.22%
│ ../scratch/main.bench │ ../scratch/pr.bench │
│ allocs/op │ allocs/op vs base │
AggregatedLabels/off-16 100.0 ± 0% 100.0 ± 0% ~ (p=1.000 n=10) ¹
AggregatedLabels/on-16 163.0 ± 0% 106.0 ± 0% -34.97% (p=0.000 n=10)
geomean 127.7 103.0 -19.36%
¹ all samples are equal
```
---------
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
|
||
|
Charlie Egan
|
1545390088 |
docs: Update diagram to match index examples (#8667)
Follows comment from feedback form about this inconsistency. Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Stephan Renatus
|
6398df6069 |
topdown: change labels aggregation and merge logic (#8656)
Thought about it some more, and I think this is how it is less
surprising:
```rego
# METADATA
# labels:
# app: foo
package foo
# METADATA
# labels:
# id: allow-01
allow if { ... }
```
Evaluating `data.foo.allow` successfully will yield a single entry in
`rule_labels`:
```json
{
"app": "foo",
"id": "allow-01"
}
```
Labels are merged along their annotations chain.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
|
||
|
Stephan Renatus
|
8ee49143a0 |
rego: add benchmark with and without rule labels (#8665)
Follow-up to #8613. ``` goos: darwin goarch: arm64 pkg: github.com/open-policy-agent/opa/v1/rego cpu: Apple M4 Max BenchmarkAggregatedLabels/off-16 306432 4136 ns/op 5740 B/op 100 allocs/op BenchmarkAggregatedLabels/on-16 259644 4533 ns/op 6085 B/op 106 allocs/op PASS ok github.com/open-policy-agent/opa/v1/rego 2.821s ``` Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Stephan Renatus
|
1da23e49c5 |
workflows: fix benchmarks workflow (replace action, avoid stackoverflow)
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Johan Fylling
|
acf9aaea4b |
docs: Add documentation for the future.keywords.not import (#8641)
Fixes: #8556 Signed-off-by: Johan Fylling <johan.dev@fylling.se> |
||
|
Stephan Renatus
|
40344ea417 |
deps: bump wasmtime-go (v43 -> v44)
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Stephan Renatus
|
8e67555219 |
types: fix benchmark
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Stephan Renatus
|
9445535681 |
release-vuln-check: fix tools install
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Johan Fylling
|
e80a469ecd |
Integrate 1.16.2 patch release
Signed-off-by: Johan Fylling <johan.dev@fylling.se> |
||
|
Charlie Egan
|
cf2b3757f1 |
Add titles to code blocks in policy-testing
Moves file names from bold text to code fence title attributes to be consistent with other blocks on page and site. Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
dependabot[bot]
|
2770e3a093 |
build(deps): bump the gha-dependencies group with 2 updates (#8648)
Bumps the gha-dependencies group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action). Updates `github/codeql-action` from 4.35.2 to 4.35.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v4.35.3</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li> <li>Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. <a href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li> <li>Best-effort connection tests for private registries now use <code>GET</code> requests instead of <code>HEAD</code> for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. <a href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li> <li>Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. <a href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.35.4 - 07 May 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li> </ul> <h2>4.35.3 - 01 May 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li> <li>Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. <a href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li> <li>Best-effort connection tests for private registries now use <code>GET</code> requests instead of <code>HEAD</code> for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. <a href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li> <li>Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. <a href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li> </ul> <h2>4.35.2 - 15 Apr 2026</h2> <ul> <li>The undocumented TRAP cache cleanup feature that could be enabled using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the <code>trap-caching: false</code> input to the <code>init</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li> <li>The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. <a href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li> <li>Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. <a href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li> <li>Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li> </ul> <h2>4.35.1 - 27 Mar 2026</h2> <ul> <li>Fix incorrect minimum required Git version for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li> </ul> <h2>4.35.0 - 27 Mar 2026</h2> <ul> <li>Reduced the minimum Git version required for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> from 2.38.0 to 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3767">#3767</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1">2.25.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3773">#3773</a></li> </ul> <h2>4.34.1 - 20 Mar 2026</h2> <ul> <li>Downgrade default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3">2.24.3</a> due to issues with a small percentage of Actions and JavaScript analyses. <a href="https://redirect.github.com/github/codeql-action/pull/3762">#3762</a></li> </ul> <h2>4.34.0 - 20 Mar 2026</h2> <ul> <li>Added an experimental change which disables TRAP caching when <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. <a href="https://redirect.github.com/github/codeql-action/pull/3569">#3569</a></li> <li>We are rolling out improved incremental analysis to C/C++ analyses that use build mode <code>none</code>. We expect this rollout to be complete by the end of April 2026. <a href="https://redirect.github.com/github/codeql-action/pull/3584">#3584</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0">2.25.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3585">#3585</a></li> </ul> <h2>4.33.0 - 16 Mar 2026</h2> <ul> <li>Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. <a href="https://redirect.github.com/github/codeql-action/pull/3562">#3562</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/e46ed2cbd01164d986452f91f178727624ae40d7"><code>e46ed2c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3867">#3867</a> from github/update-v4.35.3-8c6e48dbe</li> <li><a href="https://github.com/github/codeql-action/commit/b73d1d163446ca5e62b96698027210ab41df6a4a"><code>b73d1d1</code></a> Add changelog entry for <a href="https://redirect.github.com/github/codeql-action/issues/3853">#3853</a></li> <li><a href="https://github.com/github/codeql-action/commit/24e0bb00a931e2a5edb703ce3b22a70f3a3e800b"><code>24e0bb0</code></a> Reorder changelog entries</li> <li><a href="https://github.com/github/codeql-action/commit/ec298daba71cf7592feacbd1c0887cddc0659f62"><code>ec298da</code></a> Update changelog for v4.35.3</li> <li><a href="https://github.com/github/codeql-action/commit/8c6e48dbe051ceb3015c19554831af1b43275f46"><code>8c6e48d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3865">#3865</a> from github/update-bundle/codeql-bundle-v2.25.3</li> <li><a href="https://github.com/github/codeql-action/commit/719098349ea5beae8aa364bf9b71ff1c8d937df2"><code>7190983</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/2bb209555a024d051f6271c8a846b402497f9445"><code>2bb2095</code></a> Update default bundle to codeql-bundle-v2.25.3</li> <li><a href="https://github.com/github/codeql-action/commit/7851e55dc3be31ec4bcc3ef98453de2cb306e698"><code>7851e55</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3850">#3850</a> from github/mbg/private-registry/cloudsmith-gcp</li> <li><a href="https://github.com/github/codeql-action/commit/262a15f6cf4c7a43d6a38ad76392e5e2d4977751"><code>262a15f</code></a> Add generic non-printable chars test for OIDC configs</li> <li><a href="https://github.com/github/codeql-action/commit/a6109b1c07173a53ece3d179a925ff9644d1fabd"><code>a6109b1</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3853">#3853</a> from github/mbg/start-proxy/improved-checks</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...e46ed2cbd01164d986452f91f178727624ae40d7">compare view</a></li> </ul> </details> <br /> Updates `slackapi/slack-github-action` from 3.0.2 to 3.0.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/slackapi/slack-github-action/releases">slackapi/slack-github-action's releases</a>.</em></p> <blockquote> <h2>Slack GitHub Action v3.0.3</h2> <h3>Patch Changes</h3> <ul> <li>66834e4: feat: add instrumentation to address error rates</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/slackapi/slack-github-action/blob/main/CHANGELOG.md">slackapi/slack-github-action's changelog</a>.</em></p> <blockquote> <h1>slack-github-action</h1> <h2>3.0.3</h2> <h3>Patch Changes</h3> <ul> <li>66834e4: feat: add instrumentation to address error rates</li> </ul> <h2>3.0.2</h2> <h3>Patch Changes</h3> <ul> <li>79529d7: fix: resolve url.parse deprecation warning for webhook techniques</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/slackapi/slack-github-action/commit/45a88b9581bfab2566dc881e2cd66d334e621e2c"><code>45a88b9</code></a> chore: release</li> <li><a href="https://github.com/slackapi/slack-github-action/commit/1c0bcf08feaa559a9bcfcc249184e13b136ffa55"><code>1c0bcf0</code></a> chore: release (<a href="https://redirect.github.com/slackapi/slack-github-action/issues/606">#606</a>)</li> <li><a href="https://github.com/slackapi/slack-github-action/commit/66834e4b0cad4cbf09ca680587ad8af71d615d4b"><code>66834e4</code></a> feat: add instrumentation to address error rates (<a href="https://redirect.github.com/slackapi/slack-github-action/issues/600">#600</a>)</li> <li><a href="https://github.com/slackapi/slack-github-action/commit/0fe0f902b9f8da107ca0e1314a388c0f57e20d48"><code>0fe0f90</code></a> build(deps): bump <code>@actions/github</code> from 9.0.0 to 9.1.1 (<a href="https://redirect.github.com/slackapi/slack-github-action/issues/605">#605</a>)</li> <li><a href="https://github.com/slackapi/slack-github-action/commit/c5e70597945c255539c5218d4178ed3c7d8188be"><code>c5e7059</code></a> build(deps): bump <code>@slack/web-api</code> from 7.15.0 to 7.15.1 (<a href="https://redirect.github.com/slackapi/slack-github-action/issues/604">#604</a>)</li> <li><a href="https://github.com/slackapi/slack-github-action/commit/0325526875571a27abcfd2b302453a90871abbff"><code>0325526</code></a> build(deps-dev): bump <code>@biomejs/biome</code> from 2.4.10 to 2.4.13 (<a href="https://redirect.github.com/slackapi/slack-github-action/issues/601">#601</a>)</li> <li><a href="https://github.com/slackapi/slack-github-action/commit/900cd3e6fa9d6eacd8a5512ecff230d08e65aec7"><code>900cd3e</code></a> build(deps-dev): bump <code>@types/node</code> from 24.12.0 to 24.12.2 (<a href="https://redirect.github.com/slackapi/slack-github-action/issues/603">#603</a>)</li> <li><a href="https://github.com/slackapi/slack-github-action/commit/53fdcffeb6e4d34cbdf3276f7beadb0ecc7c9fcd"><code>53fdcff</code></a> build(deps): bump <code>@actions/core</code> from 3.0.0 to 3.0.1 (<a href="https://redirect.github.com/slackapi/slack-github-action/issues/602">#602</a>)</li> <li><a href="https://github.com/slackapi/slack-github-action/commit/26856cc7fb2c1c2951483645f5fdc3643dbe96eb"><code>26856cc</code></a> build(deps): bump slackapi/slack-github-action from 3.0.1 to 3.0.2 (<a href="https://redirect.github.com/slackapi/slack-github-action/issues/596">#596</a>)</li> <li><a href="https://github.com/slackapi/slack-github-action/commit/feba1e29702383a5a3cd5136af0559ba10859b04"><code>feba1e2</code></a> ci: skip publish step if no release is needed (<a href="https://redirect.github.com/slackapi/slack-github-action/issues/599">#599</a>)</li> <li>Additional commits viewable in <a href="https://github.com/slackapi/slack-github-action/compare/03ea5433c137af7c0495bc0cad1af10403fc800c...45a88b9581bfab2566dc881e2cd66d334e621e2c">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Stephan Renatus
|
cb94b005f5 |
build: go install -> go install tool to control checksums
This is slightly more control, avoiding a supply chain risk. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
dependabot[bot]
|
6932abaae6 |
build(deps): bump mermaid from 11.14.0 to 11.15.0 in /docs
Bumps [mermaid](https://github.com/mermaid-js/mermaid) from 11.14.0 to 11.15.0. - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.14.0...mermaid@11.15.0) --- updated-dependencies: - dependency-name: mermaid dependency-version: 11.15.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Stephan Renatus
|
4fbc0e8fee |
download: use oras, not containerd
This cuts out a bunch of heavyweight dependencies that are notorious for causing false postive vulnerability findings. Things we can't verify without running manual integration tests: Token exchange edge cases: The `registry.ParseReference` strictness: If users pass references that containerd accepted but ORAS's parser rejects (unusual characters, missing tag, etc.), it would fail at the ParseReference call. In practice, OCI references follow the same grammar everywhere, so this is unlikely. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Stephan Renatus
|
913739161b |
labels: aggregate from package/subpackage/document scope, update CHANGELOG
Small follow-up to #8613. I think carrying the labels from upper scopes along makes this more powerful. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Stephan Renatus
|
84cbb8e668 |
redirects: "edge" -> "latest"
Temporary measure until we've sorted out edge release storage. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Stephan Renatus
|
d46681187d |
benchmarks: improve post-merge comment, move cutoff for "failure" to 25%
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Stephan Renatus
|
881a07e8ce |
post-merge: use and override dev tag
This is exactly what wasmtime does, maybe it works with immutable github releases. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>dev |
||
|
dependabot[bot]
|
ce03cd8d23 |
build(deps): bump @babel/plugin-transform-modules-systemjs in /docs
Bumps [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) from 7.25.9 to 7.29.4. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.4/packages/babel-plugin-transform-modules-systemjs) --- updated-dependencies: - dependency-name: "@babel/plugin-transform-modules-systemjs" dependency-version: 7.29.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]
|
ec0ae56ada |
build(deps): bump fast-uri in /e2e/api/compile/prisma
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.0 to 3.1.2. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.2) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]
|
875060316b |
build(deps): bump fast-uri from 3.0.6 to 3.1.2 in /docs
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.0.6 to 3.1.2. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](https://github.com/fastify/fast-uri/compare/v3.0.6...v3.1.2) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Sebastian Spaink
|
e0e2af9057 |
Deploy edge prelease (#8626)
follow up to: https://github.com/open-policy-agent/opa/pull/8615 The S3 bucket containing the edge release binaries is no longer available. setup-opa relies on these binaries. This new `Deploy Edge Prelease` re-introduces edge release by publishing them as a Github pre-release instead. On every push to main, after the linux/windows/darwin release builds complete, a new deploy-edge job deletes any existing edge release and creates a fresh GitHub prerelease tagged edge with all OPA binaries attached. --------- Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
Stephan Renatus
|
cb54e9c14f |
runtime: rule labels metadata processing follow-ups (#8613)
❗ We now parse rego metadata annotations by default. Rule annotations now support a `labels` field. During policy eval, labels from all successfully evaluated rules are collected and included in each decision log entry as a top-level `rule_labels` array. Each element preserves the label map from one evaluated rule. Exact duplicates are omitted. ```rego # METADATA # labels: # severity: low # team: platform allow if input.role == "admin" ``` The resulting decision log entry will contain: ```json {"rule_labels": [{"severity": "low", "team": "platform"}]} ``` --------- Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Sebastian Spaink
|
81987eebe4 |
fix: populate modules from bundles for coverage reporting in bundle mode (#8496)
resolve: https://github.com/open-policy-agent/opa/issues/3324 When running `opa test -c -b`, the coverage reporter received nil modules because cmd/test.go only populated the modules variable in the file-loading branch. This caused cover.Report() to skip the NotCovered walk, resulting in 100% coverage regardless of actual test coverage. Extract modules from bundles via ParsedModules() when both bundle mode and coverage are enabled, so the coverage reporter can correctly identify uncovered lines. Tested the change locally as well with the steps in the issue. Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
Stephan Renatus
|
df98759c2f |
benchmarks: fix PR comment script
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Stephan Renatus
|
6f113ba009 |
ci: golangci-lint bump to v2.12.2 (#8623)
https://github.com/golangci/golangci-lint/releases/tag/v2.12.2 Mostly because I couldn't make sense of the failures in https://github.com/open-policy-agent/opa/pull/8622 --------- Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
dependabot[bot]
|
b7d5552493 |
build(deps): bump hono in /e2e/api/compile/prisma
Bumps [hono](https://github.com/honojs/hono) from 4.12.14 to 4.12.18. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](https://github.com/honojs/hono/compare/v4.12.14...v4.12.18) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Stephan Renatus
|
5c535f0019 |
benchmarks: fix reporting jq call
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Stephan Renatus
|
dc77f2e259 |
workflows: report benchmark regressions back to pull request
Let's see if this works, it's a bit experimental at this point. The twist comparred to how it's been done in EOPA (for example) is that we're running the benchmarks post-merge, and report back if at the end we find a failing check. This way, the PR goes green without having to wait for the benchmarks, but there's still a connection between PR and benchmark. Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Stephan Renatus
|
bd26ba618c |
build: bump go 1.26.2 -> 1.26.3
Lots of small things: https://groups.google.com/g/golang-announce/c/qcCIEXso47M Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Sebastian Spaink
|
deee848e52 |
Revert website redirects (#8617)
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
Sebastian Spaink
|
f645d91097 |
Remove edge releases (#8615)
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
Johan Fylling
|
40024cebd6 |
ast: not-body marshaling (#8614)
JSON- and pretty format marshaling of `ast.Not` Signed-off-by: Johan Fylling <johan.dev@fylling.se> |
||
|
Sebastian Spaink
|
1a4a713006 |
Add a page explaining the Rego based PR check (#8611)
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |