Updates the OPA MCP ecosystem entry with additional links and an updated
tool count.
## Changes
- Added `videos`: YouTube demo (author, lint, and test a Rego policy end
to end from Claude Desktop)
- Added `blogs`: LinkedIn Pulse article explaining the motivation behind
OPA MCP
- Added npm and Docker Hub to `code` (precedent: `opa-typescript` and
`opa-wasm-js` entries both include npmjs.com links)
- Added Smithery to `code` (primary MCP-ecosystem install path alongside
npm)
- Updated tool count from 32 to 50+ (current release is 52 tools across
7 categories)
- Added Conftest to the CLI list in the description body
Signed-off-by: Daniel Okwor <daniel@orygn.tech>
Co-authored-by: Daniel Okwor <daniel@orygn.tech>
Both are currently pinned (indirectly) to versions with published advisories:
- golang.org/x/crypto v0.51.0 → v0.52.0 (fixes GO-2026-5005/5006/5017/5019/
5020/5021/5023 and related — several rated critical).
- golang.org/x/net v0.53.0 → v0.55.0 (fixes GO-2026-5026 and related).
These ship compiled into the released OPA binaries (e.g. the v1.17.0
`-static` image), so container scanners (Grype/Trivy) flag OPA images for
them. `main`'s `.go-version` is already 1.26.4, which covers the Go-stdlib
advisories; this only bumps the two module deps. Produced with
`go get golang.org/x/crypto@latest golang.org/x/net@latest && go mod tidy`.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Bennett <35474536+BGebken@users.noreply.github.com>
### Why the changes in this PR are needed?
The PR pipeline checks if the formatting of docs changes is correct and
instructs developers to fix any discovered formatting issues using the
command `dprint fmt`. Contributors might not be aware of this before
creating the PR, or forget it, resulting in a failing pipeline (for
example
[here](https://github.com/open-policy-agent/opa/actions/runs/27003824827/job/79690783007))
and one more roundtrip, which could be avoided.
### What are the changes in this PR?
This PR adds an instruction to the contribution guideline to run the
`dprint fmt` command to ensure correct formatting.
### Further comments:
There is no issue for that as far as I know. I thought this would be
helpful (also I forgot this already twice 😅 ).
Signed-off-by: Manuela Züger <manuela.zueger@ipt.ch>
This commit fixes an issue where `plan` and `wasm` bundle build
targets could produce different output bytes across separate
invocations of `opa build` for the same inputs.
There were two underlying causes, both from Golang random map
iteration order leaking through to the order-sensitive planner.
Causes:
- `compilePlan` (`v1/compile`) and `planQuery` (`v1/rego`) iterated over the
compiler's module map without sorting keys first. This caused the
planner to have iteration-dependent variations in output. This was
fixed by sorting the module names before use.
- `planRules` (`internal/planner`) sorted rules by length of the rule
name ref, which is not a unique value. Because the sorting of the
rules was using an unstable sorting algorithm, and the rule names
were coming from iterating over a `map` type in the rule trie, this
had edge cases where non-deterministic output ordering could creep
in. This was fixed by adding a ref `Compare` call as a tie-breaker
to get a stable sorting order, regardless of iteration order in the
rule trie.
This commit also adds regression tests that assert plan output is
independent of module and rule ordering. The two fixes are needed
together because both sets of issues hit the planner from different
angles, and are mostly independent of each other.
Signed-off-by: Philip Conrad <philip_conrad@apple.com>
`dst.Compare(src)` calls `sortedKeys()` on both objects, and
`sortedKeys()` re-sorts `dst`'s keys on every call because each
preceding `dst.Insert(...)` resets `sortGuard` (the `sync.Once` that
gates the sort).
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This commit makes the behavior of pattern selection for
determining `file_rego_versions` from a bundle manifest more
deterministic when the pattern have overlap.
The docs note that when overlapping patterns occur, the result
is undefined. In practice, this meant that the map of patterns
was iterated over in randomized order.
We now iterate over the `file_rego_version` patterns in
lexically-sorted order, which ensures a deterministic result,
even when user-authored glob patterns overlap with each other.
Signed-off-by: Philip Conrad <philip_conrad@apple.com>
The `ast.Compare(any, any)` function is a beast better avoided, and the
`any` args type mean some AST values (like strings) escape to the heap
when boxed.
Previous work already ensured it wasn't called too often — this just
moves it further along by having all `ast.Value`s do their own
comparisons with the help of a new function to easily compare 2
different value types.
Also:
- topdown: slightly cheaper object.union_n implementation
- eval: remove unused expr field on evalNot
- eval: rename fmtVarTerm -> fmtVar
- term: remove unused termSlice type
- builtins: cheaper Builtin.Ref()
Signed-off-by: Anders Eknert <anders.eknert@apple.com>
This change removes the 1-2 heap allocations previously made per call to
the `object.get` built-in function.
Also:
- Slightly tweak `builtins.<Type>Operand` functions to have them pass
the inlining threshold score of 80 — they would previously all score at
81!
Signed-off-by: Anders Eknert <anders.eknert@apple.com>
The ociTarget.Resolve and ociTarget.Fetch methods introduced in the
containerd migration were not setting Accept headers on manifest
requests. Several registries, including ghcr.io, require a manifest
media type in the Accept header and return 404 Not Found without it.
The previous containerd-based implementation set this header
automatically via the docker resolver. The new oras-based custom target
did not replicate that behaviour.
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
This commit greatly extends the sync.Pool usage within the
EditTree data structure, and adds Dispose calls to the
appropriate call sites within the JSON Patch builtins.
This has a higher cost than the original "just unlink the
nodes" approach, but reduces GC and allocation pressure
when there's lots of churn and deletion operations.
Benchmarks indicate a 5-15% CPU time cost increase, in
exchange for a 15-18%+ reduction in memory usage and allocs.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net>
- Add `inmem.NewFromASTObject` to simplify creating store from AST value
- Add missing string case to `ast.InternedValue`, and some internal
improvements
Signed-off-by: Anders Eknert <anders.eknert@apple.com>
Resolve any RefSchema within an AllOf before attempting to merge
schemas. Disregards empty anyOfs as top type.
Fixes#6523.
Signed-off-by: Dionna Glaze <d_glaze@apple.com>
The Rego API's `GenerateJSON` function allows clients to provide custom
logic for transforming an original AST result into whatever format they
may need. Previously this could only be set on the Rego object directly,
meaning that a single prepared query would have to use the same function
for all evaluations. This change adds the option to additionally set an
`EvalGenerateJSON function scoped to individual evaluations, making it
easier to reuse a single prepared query even when the shape of the
result is determined dynamically, by input data, in-policy routing, etc.
Signed-off-by: Anders Eknert <anders.eknert@apple.com>
This is handled natively by Go since 1.25, so this dependency should no
longer be needed. See references below for more information. Only
notable difference seems to be that Go sets a minimum value of 2 while
the automaxprocs lib has a minimum value of 1. Go seems to account for
much more though, so I don't think that difference alone warrants the
inclusion of this dependency. Users who really want GOMAXPROCS=1 can
always set that themselves.
References:
- https://github.com/golang/go/issues/73193
- https://github.com/uber-go/automaxprocs/issues/98
Signed-off-by: Anders Eknert <anders.eknert@apple.com>
We don't need that for h2c anymore, and it was only used in a e2e test.
Still an indirect dependency, but oh well.
Signed-off-by: Anders Eknert <anders.eknert@apple.com>
resolve: https://github.com/open-policy-agent/opa/issues/6089
As a side effect of #4429 `json.match_schema` and `json.verify_schema`
have been silently ignoring the "pattern" keyword.
Updated the internal/gojsonschema project to have pattern validation be
optional to keep it disabled for type checking but enabled for the
builtins. Patterns that RE2 can't compile will fail.
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
Stephan Renatus