mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-13 03:42:35 -06:00
efebe8044d46bef8cd8214d0193732ca30c74480
1921 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Charlie Egan
|
efebe8044d |
docs: Some minor bug fixes to improve reporting (#8917)
Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Oluwajuwon Omotayo
|
4cefcaff21 |
ecosystem: add agt-policies-africa — African data protection OPA policy pack (#8850)
### Why the changes in this PR are needed? The OPA Ecosystem page has no coverage of African data protection regulations or AI agent compliance in the African context. Nine African data protection laws are now in force (Nigeria NDPA 2023, Kenya DPA 2019, Ghana Act 843, Rwanda Law 058/2021, Egypt PDPL 151/2020, Mauritius DPA 2017, South Africa POPIA, Tanzania PDPA 2022, Uganda DPPA 2019), and developers building AI agents for African markets have no discoverable OPA policy reference for these jurisdictions. This entry surfaces an existing open-source resource to that audience directly on openpolicyagent.org/ecosystem. ### What are the changes in this PR? Adds a single ecosystem entry file: - `docs/src/data/ecosystem/entries/agt-policies-africa.md` The entry covers: - 9 African jurisdictions, each with a Rego policy and a full `opa test` suite (140+ tests) - Decision semantics: `deny / escalate / audit / allow` — structured for AI agent runtimes - Highlights two OPA docs features: `policy-testing` and `learning-rego` - Uses `allow_missing_image: true` (no logo file included — same pattern as `awesome-opa.md`) ### Notes to assist PR review: - No docs page, sidebar, or Go code changes — ecosystem entry only - Ecosystem entries are auto-discovered; no `sidebars.js` update required - The project is already listed in `awesome-opa` (PR #82, merged June 2026), so the URL is established ### Further comments: The project's primary audience is developers building AI agents for Nigerian and broader African fintech/financial markets, where data residency, transaction-limit enforcement, and PII protection (BVN/NIN/national IDs) are regulatory requirements. OPA is used as the policy decision engine via the REST API and Go SDK. The ecosystem entry brings this niche but growing use case into the discoverability of the OPA ecosystem page alongside other security and compliance tools. I have read the project's [AI tool use guidelines](https://www.openpolicyagent.org/docs/contrib-code#ai-guidelines). Claude Code was used to assist with formatting; all content reflects my own work and understanding of the referenced regulations. --------- Signed-off-by: oluwajuwon omotayo <ginuxtechacademy@gmail.com> Signed-off-by: Charlie Egan <charlie_egan@apple.com> Co-authored-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Charlie Egan
|
c7231bdd0b |
docs: Update regal and blog links (#8901)
Updates to latest regal release and makes some changes to blog.openpolicyagent.org links too. --------- Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Charlie Egan
|
d9ba5b4891 |
website: Import blog from medium (#8898)
This PR imports the blogs from https://medium.com/open-policy-agent into the docusaurus site. This is being done as the blog has stopped working due to the custom domain hosting feature being removed from our tier. The pages have been imported from manually downloaded webarchive files from each post to ensure we captured the assets and rendered code example too. --------- Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
dependabot[bot]
|
cf938e0ba8 |
build(deps): bump websocket-driver from 0.7.4 to 0.7.5 in /docs (#8899)
Bumps [websocket-driver](https://github.com/faye/websocket-driver-node) from 0.7.4 to 0.7.5. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md">websocket-driver's changelog</a>.</em></p> <blockquote> <h3>0.7.5 / 2026-06-04</h3> <ul> <li>Close a draft-75/76 connection if a length header grows to exceed the configured max length</li> <li>Fail the connection if a message is larger than the configured max length after extension processing</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/faye/websocket-driver-node/commit/5d6a9aaf5f019007d917bd9ddc7eeb775c86cc1f"><code>5d6a9aa</code></a> Bump version to 0.7.5</li> <li><a href="https://github.com/faye/websocket-driver-node/commit/c55679a5b18251dd0a55d18a0cc6a4fd8822b92f"><code>c55679a</code></a> Fail the connection if a message is larger than the configured max length aft...</li> <li><a href="https://github.com/faye/websocket-driver-node/commit/5b197ca874dab58e96cacad8a3c256797d804680"><code>5b197ca</code></a> Close a draft-75/76 connection if a length header grows to exceed the configu...</li> <li><a href="https://github.com/faye/websocket-driver-node/commit/fc93a48f879d0fd4a77c687a4a19c4328613df65"><code>fc93a48</code></a> Test on Node v22, v24, and v26</li> <li><a href="https://github.com/faye/websocket-driver-node/commit/2e82d3464d294bdd11202657208636e667212335"><code>2e82d34</code></a> Test on recent versions of Node</li> <li><a href="https://github.com/faye/websocket-driver-node/commit/e4962db9940ad1a8cf6fe8328d3b81c3f8c37479"><code>e4962db</code></a> Switch from Travis CI to GitHub Actions</li> <li><a href="https://github.com/faye/websocket-driver-node/commit/3f2f9b70a8ae999b4657d26316a5d45b7caea679"><code>3f2f9b7</code></a> Travis update: cache npm modules, remove sudo, run on Node 15</li> <li>See full diff in <a href="https://github.com/faye/websocket-driver-node/compare/0.7.4...0.7.5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Sebastian Spaink
|
8e2f1807ac |
config: validate configuration with Rego and warn on unknown options (#8891)
Part of #2745 Like most of his ideas, @anderseknert's suggestion to use Rego to replace the `validateAndInjectDefaults` functions throughout the codebase is another winner. This PR starts the migration by replacing the top-level `validateAndInjectDefaults` in `v1/config/config.go` with an embedded policy, `validate.rego`. The policy injects the top-level defaults (`default_decision`, `default_authorization_decision`, `labels`) and reports unrecognized configuration options, so a typo such as `decision_log` instead of `decision_logs` is logged as a warning at startup rather than silently ignored. It's evaluated in `ParseConfig` using the low-level `ast`/`topdown` packages rather than the top-level `rego` package. This keeps `config` off the heavy `rego → bundle → …` dependency web (which would otherwise create import cycles as more packages' tests reach `config`), and we don't need any of the `rego` package's conveniences here — it's one module compiled once and a single query. The Rego unit tests run in CI via `build/run-rego-tests.sh` (and locally with `make rego-test`). This sets the foundation for the other plugin `validateAndInjectDefaults` functions to migrate to Rego as well; where the logic isn't too complicated it should be a fairly easy replacement. At the moment all known keys live in `validate.rego` under `_specs` to support the "warn on unrecognized options" check, but the plugin-specific entries can move closer to each plugin as it migrates. It would also be nice for `_specs` to be auto-generated somehow in the future. Supporting extension of config validation with custom policies is something I'd like to follow up with, so keeping #2745 open for now. I also think these policies could be reusable with [java-opa-sdk](https://github.com/open-policy-agent/java-opa-sdk) 👀 Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
Sebastian Spaink
|
b4d15e0c25 |
ast: Fix non-deterministic type errors when shadowing a built-in (#8880)
Fixes: #3729 A variable that shadows a built-in name (e.g. `count`) via `=` unification was left un-rewritten, so later stages could mistake it for the built-in and raise spurious type errors -- non-deterministically, due to map iteration order in Graph.Sort. Rewrite such body-bound variables to fresh locals, and make Graph.Sort deterministic by ordering nodes before the topological sort. --------- Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
Nikhil Jathar
|
8b147a63bb |
The Zed Rego extension link points at github.com/StyraInc/zed-rego (404). The repo now lives at github.com/StyraOSS/zed-rego.
Signed-off-by: Nikhil Jathar <22786232+mailnike@users.noreply.github.com> |
||
|
Charlie Egan
|
e8c3e104fa |
docs: Add kubecon NA page (#8876)
This page will be linked to from the kiosk at KubeCon. https://deploy-preview-8876--openpolicyagent.netlify.app/events/2026-kubecon-na Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Charlie Egan
|
39fcb030e5 |
docs: Add Ghostunnel and NATS Plugin to Ecosystem (#8871)
Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
SEONGHYUN HONG
|
deb30b103d |
docs: fix decision_logs buffer_size_limit_events default in prose (#8866)
The `decision_logs.reporting.buffer_size_limit_events` row documents its default as `10000`, but the prose in the same cell says "By default, 100 events are held". The real default is `10000` (`defaultBufferSizeLimitEvents = int64(10000)` in `v1/plugins/logs/plugin.go`), so the row was internally contradictory. This corrects the prose to match both the code and the row's own default column. Docs only. Signed-off-by: s3onghyun <s3onghyun@users.noreply.github.com> |
||
|
Charlie Egan
|
7bdfe03927 |
runtime: Remove goautomaxprocs and automemlimit (#8869)
The memory pressure in low resource containers this PR aimed to fix was
actually caused by #8817, which was fixed in #8829. The
automaxprocs/automemlimit dependencies are no longer needed as was
intended in #8696.
This reverts commit
|
||
|
Charlie Egan
|
b0d896adec |
docs: Update cheatsheet files
follows https://github.com/open-policy-agent/rego-cheat-sheet/pull/13 Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Charlie Egan
|
618978384d |
docs: remove import rego.v1
This has not been needed in new releases for over a year. Leaving these in has a cost as it causes AI to generate rego with import rego.v1 when it's not needed. Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Manuela Züger
|
e761d1711e |
docs/website: Improve partial evaluation / data filtering documentation (#8625)
### Why the changes in this PR are needed? The issue #8316 outlines that the Partial Evaluation / Data Filtering documentation could benefit from clearer examples and explanations to better enable users to get started adopting the feature. ### What are the changes in this PR? * added a simple data filtering example to the filtering overview page to better showcase its purpose * explained the metadata annotation for unknowns and how it links to the database table and field names * added a tutorial page to provide a quick walkthrough --------- Signed-off-by: Manuela Züger <manuela.zueger@ipt.ch> Signed-off-by: Manuela Züger <79690363+mmzzuu@users.noreply.github.com> Co-authored-by: Charlie Egan <git@charlieegan3.com> |
||
|
dependabot[bot]
|
e72114bbbf |
build(deps): bump the website group in /docs with 4 updates (#8839)
Bumps the website group in /docs with 4 updates: [eslint](https://github.com/eslint/eslint), [js-yaml](https://github.com/nodeca/js-yaml), [recharts](https://github.com/recharts/recharts) and [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping). Updates `eslint` from 10.4.1 to 10.5.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/eslint/eslint/releases">eslint's releases</a>.</em></p> <blockquote> <h2>v10.5.0</h2> <h2>Features</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/5ca8c5278edea1fd84d3ba83d8ea3f52fb3831ad"><code>5ca8c52</code></a> feat: correct stack tracking in max-nested-callbacks (<a href="https://redirect.github.com/eslint/eslint/issues/20973">#20973</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/b5657837604fa5e8cf1278074782025cadd34b6c"><code>b565783</code></a> feat: report no-with violations at the with keyword (<a href="https://redirect.github.com/eslint/eslint/issues/20971">#20971</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/2ce032fbc72a1a80c024c084a4f382fb6dece684"><code>2ce032f</code></a> feat: report max-lines-per-function violations at function head (<a href="https://redirect.github.com/eslint/eslint/issues/20966">#20966</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/732cb3e09d5b8b809b5f461d118a5d9fdcd6427f"><code>732cb3e</code></a> feat: report max-nested-callbacks violations at function head (<a href="https://redirect.github.com/eslint/eslint/issues/20967">#20967</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/f9c138a0ba7d8e37aed39aef4a3ff1cae8c669f7"><code>f9c138a</code></a> feat: report max-depth violations on keywords (<a href="https://redirect.github.com/eslint/eslint/issues/20943">#20943</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/bdb496cc0d54b6d0a023aef9abd5f040ccff2101"><code>bdb496c</code></a> feat: correct max-depth handling for else-if chains (<a href="https://redirect.github.com/eslint/eslint/issues/20944">#20944</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/c29687354a7f96093f57f7d73eecb866ad5e2953"><code>c296873</code></a> feat: update error loc in <code>max-statements</code> to function header (<a href="https://redirect.github.com/eslint/eslint/issues/20907">#20907</a>) (Taejin Kim)</li> </ul> <h2>Documentation</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/8ae1b5b856dc031cd6c701d89a4df7da4772cd56"><code>8ae1b5b</code></a> docs: Update README (GitHub Actions Bot)</li> <li><a href="https://github.com/eslint/eslint/commit/ca7eb90127dcad917188bb1342623f02a272e781"><code>ca7eb90</code></a> docs: update Node.js prerequisites to include ICU support (<a href="https://redirect.github.com/eslint/eslint/issues/20962">#20962</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/f99b47a6799be25321552402a49303bb06a43fe4"><code>f99b47a</code></a> docs: Update README (GitHub Actions Bot)</li> <li><a href="https://github.com/eslint/eslint/commit/acf03d4eed31d259c7dc62af5b9640629784f7cc"><code>acf03d4</code></a> docs: clarify precedence of parserOptions over languageOptions (<a href="https://redirect.github.com/eslint/eslint/issues/20926">#20926</a>) (sethamus)</li> </ul> <h2>Chores</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/b18bf58c5ac748415ffffdff2d96980fbd6a57e8"><code>b18bf58</code></a> chore: update ecosystem plugins (<a href="https://redirect.github.com/eslint/eslint/issues/20959">#20959</a>) (ESLint Bot)</li> <li><a href="https://github.com/eslint/eslint/commit/c2d1444df77cb42e5a0b89ab70496879d180a54d"><code>c2d1444</code></a> refactor: replace areAllSegmentsUnreachable with !isAnySegmentReachable (<a href="https://redirect.github.com/eslint/eslint/issues/20951">#20951</a>) (Taejin Kim)</li> <li><a href="https://github.com/eslint/eslint/commit/243b8c56014bbbe63771185b0731d8dd4d1316e9"><code>243b8c5</code></a> chore: enhance config-rule to support oneOf, anyOf, and nested schemas (<a href="https://redirect.github.com/eslint/eslint/issues/20788">#20788</a>) (kuldeep kumar)</li> <li><a href="https://github.com/eslint/eslint/commit/217b2a91f46137c5ffd693965e71306c4c15ea6b"><code>217b2a9</code></a> test: add unit tests for ParserService (<a href="https://redirect.github.com/eslint/eslint/issues/20949">#20949</a>) (Taejin Kim)</li> <li><a href="https://github.com/eslint/eslint/commit/72003e781d76bd4ee0d98a6601730d0b829070f9"><code>72003e7</code></a> test: add location information to error messages in <code>max-statements</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20945">#20945</a>) (lumir)</li> <li><a href="https://github.com/eslint/eslint/commit/7797c266977b0bc4971aa79721813d480de72cd1"><code>7797c26</code></a> refactor: deduplicate isAnySegmentReachable across rules (<a href="https://redirect.github.com/eslint/eslint/issues/20890">#20890</a>) (Taejin Kim)</li> <li><a href="https://github.com/eslint/eslint/commit/67c46fa6e4f34e88cc6bc82f8a0dcc917c65d257"><code>67c46fa</code></a> chore: update ecosystem plugins (<a href="https://redirect.github.com/eslint/eslint/issues/20938">#20938</a>) (ESLint Bot)</li> <li><a href="https://github.com/eslint/eslint/commit/95d8c7a99f991abd8ab618d0ee2cbd4f58effc29"><code>95d8c7a</code></a> chore: update dependency <code>@eslint/json</code> to v2 (<a href="https://redirect.github.com/eslint/eslint/issues/20934">#20934</a>) (renovate[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/cf9e496205142cd4971b9f98aed85866d1010b9c"><code>cf9e496</code></a> chore: update <code>@arethetypeswrong/cli</code> to 0.18.3 (<a href="https://redirect.github.com/eslint/eslint/issues/20933">#20933</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/fb6d3960cacc51fc12383fa5ded2382adbf90c1c"><code>fb6d396</code></a> test: run type tests with TypeScript 7 (<a href="https://redirect.github.com/eslint/eslint/issues/20868">#20868</a>) (sethamus)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/eslint/eslint/commit/de3b672a267e32607db04176ce4775664acb3145"><code>de3b672</code></a> 10.5.0</li> <li><a href="https://github.com/eslint/eslint/commit/362a5185134290db696d39f97c9da609ded54040"><code>362a518</code></a> Build: changelog update for 10.5.0</li> <li><a href="https://github.com/eslint/eslint/commit/5ca8c5278edea1fd84d3ba83d8ea3f52fb3831ad"><code>5ca8c52</code></a> feat: correct stack tracking in max-nested-callbacks (<a href="https://redirect.github.com/eslint/eslint/issues/20973">#20973</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/b5657837604fa5e8cf1278074782025cadd34b6c"><code>b565783</code></a> feat: report no-with violations at the with keyword (<a href="https://redirect.github.com/eslint/eslint/issues/20971">#20971</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/2ce032fbc72a1a80c024c084a4f382fb6dece684"><code>2ce032f</code></a> feat: report max-lines-per-function violations at function head (<a href="https://redirect.github.com/eslint/eslint/issues/20966">#20966</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/732cb3e09d5b8b809b5f461d118a5d9fdcd6427f"><code>732cb3e</code></a> feat: report max-nested-callbacks violations at function head (<a href="https://redirect.github.com/eslint/eslint/issues/20967">#20967</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/f9c138a0ba7d8e37aed39aef4a3ff1cae8c669f7"><code>f9c138a</code></a> feat: report max-depth violations on keywords (<a href="https://redirect.github.com/eslint/eslint/issues/20943">#20943</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/8ae1b5b856dc031cd6c701d89a4df7da4772cd56"><code>8ae1b5b</code></a> docs: Update README</li> <li><a href="https://github.com/eslint/eslint/commit/ca7eb90127dcad917188bb1342623f02a272e781"><code>ca7eb90</code></a> docs: update Node.js prerequisites to include ICU support (<a href="https://redirect.github.com/eslint/eslint/issues/20962">#20962</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/b18bf58c5ac748415ffffdff2d96980fbd6a57e8"><code>b18bf58</code></a> chore: update ecosystem plugins (<a href="https://redirect.github.com/eslint/eslint/issues/20959">#20959</a>)</li> <li>Additional commits viewable in <a href="https://github.com/eslint/eslint/compare/v10.4.1...v10.5.0">compare view</a></li> </ul> </details> <br /> Updates `js-yaml` from 4.2.0 to 5.1.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md">js-yaml's changelog</a>.</em></p> <blockquote> <h2>[5.1.0] - 2026-06-23</h2> <h3>Added</h3> <ul> <li>Collection tags can finalize an incrementally populated carrier into a different result value.</li> </ul> <h3>Changed</h3> <ul> <li>[breaking] <code>quoteStyle</code> now selects the preferred quote style; use the restored <code>forceQuotes</code> option to force quoting non-key strings.</li> </ul> <h2>[5.0.0] - 2026-06-20</h2> <h3>Added</h3> <ul> <li>Added named exports for schemas, tags, parser events and AST utilities.</li> <li>Reworked <code>JSON_SCHEMA</code> and <code>CORE_SCHEMA</code> with spec-compliant scalar resolution rules, and added <code>YAML11_SCHEMA</code>.</li> <li>Added <code>realMapTag</code> for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.</li> <li>Added <code>dump()</code> <code>transform</code> option for changing the generated AST before rendering.</li> <li>Added <code>dump()</code> options <code>seqInlineFirst</code>, <code>flowBracketPadding</code>, <code>flowSkipCommaSpace</code>, <code>flowSkipColonSpace</code>, <code>quoteFlowKeys</code>, <code>quoteStyle</code> and <code>tagBeforeAnchor</code>.</li> <li>Added formal data layers (events and AST) for modular data pipelines. <ul> <li>Added low-level parser (to events), presenter and visitor APIs.</li> </ul> </li> <li>Added the <a href="https://github.com/yaml/yaml-test-suite">YAML Test Suite</a> to the test set.</li> </ul> <h3>Changed</h3> <ul> <li>See the <a href="https://github.com/nodeca/js-yaml/blob/master/docs/migrate_v4_to_v5.md">migration guide</a> for upgrade notes.</li> <li>Rewritten in TypeScript and reorganized the public API around flat named exports.</li> <li>Reduced the set of exported schemas: <ul> <li>YAML 1.2 schemas: <code>CORE_SCHEMA</code> (loader default), <code>JSON_SCHEMA</code>, <code>FAILSAFE_SCHEMA</code>.</li> <li><code>YAML11_SCHEMA</code>, a combination of all YAML 1.1 tags (YAML 1.1 does not specify a schema, only "types").</li> </ul> </li> <li><code>load</code>/<code>dump</code> default behaviour is now specified exactly via schemas: <ul> <li><code>load</code> uses <code>CORE_SCHEMA</code>, without <code>!!merge</code> by default.</li> <li><code>dump</code> uses <code>YAML11_SCHEMA</code> + <code>CORE_SCHEMA</code> for the quoting check, to guarantee backward compatibility by default.</li> </ul> </li> <li><code>!!set</code> is now loaded as a JavaScript <code>Set</code>.</li> <li>Replaced the <code>Type</code> API with a tags API. Similar, but more precise and simpler. See examples for details. Tags can be defined via <code>defineScalarTag()</code>, <code>defineSequenceTag()</code> and <code>defineMappingTag()</code>, or as a spread + override of an existing tag.</li> <li>Renamed <code>Schema.extend()</code> to <code>Schema.withTags()</code>.</li> <li>Expanded YAML 1.2 conformance and improved handling of directives, document markers, block keys, multiline scalars, tag syntax and other things.</li> <li><code>load()</code> now throws on empty input instead of returning <code>undefined</code>.</li> <li>Moved browser builds to the <code>js-yaml/browser</code> export.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodeca/js-yaml/commit/f1e45cd201de162cc388a5175717eddf0743d367"><code>f1e45cd</code></a> 5.1.0 released</li> <li><a href="https://github.com/nodeca/js-yaml/commit/53b22be4fe05ea668b2420b142b424d360f6e2cf"><code>53b22be</code></a> Fix constructor coverage</li> <li><a href="https://github.com/nodeca/js-yaml/commit/a1eaa2bce1ce5738d46a918b1f3a228b9fa0bdbd"><code>a1eaa2b</code></a> Fix quote style options and restore forceQuotes</li> <li><a href="https://github.com/nodeca/js-yaml/commit/0532e7d23fff763f07ce166bef0f3b0906f26597"><code>0532e7d</code></a> Add finalizers for immutable collection tags</li> <li><a href="https://github.com/nodeca/js-yaml/commit/9f00b91cdc293f3dfcd017d29dbc413ee98a5c70"><code>9f00b91</code></a> tests: drop the rest of issues tests, move a small fraction of useful checks ...</li> <li><a href="https://github.com/nodeca/js-yaml/commit/6be5d46c88f4caed3103e83075c2eb4aab8770fd"><code>6be5d46</code></a> tests: drop not actual or duplicating issue tests (covered in other places)</li> <li><a href="https://github.com/nodeca/js-yaml/commit/a7c9766f0d79e6506e119dbe91b43deb2d5f8879"><code>a7c9766</code></a> Fix !!pairs coverage</li> <li><a href="https://github.com/nodeca/js-yaml/commit/75148bc4f5eb69b3d338e1c355d8bb2dba5bdf34"><code>75148bc</code></a> 5.0.0 released</li> <li><a href="https://github.com/nodeca/js-yaml/commit/704b25d29229c52e66b824bfc1908d8f3ba3a45e"><code>704b25d</code></a> Quote document markers followed by whitespace</li> <li><a href="https://github.com/nodeca/js-yaml/commit/42dea284430b1077f95a326f14db422b19bedecc"><code>42dea28</code></a> Support complex !!pairs keys with realMapTag</li> <li>Additional commits viewable in <a href="https://github.com/nodeca/js-yaml/compare/4.2.0...5.1.0">compare view</a></li> </ul> </details> <br /> Updates `recharts` from 3.8.1 to 3.9.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/recharts/recharts/releases">recharts's releases</a>.</em></p> <blockquote> <h2>v3.9.0</h2> <h2>What's Changed</h2> <h3>Animations</h3> <p>3.9 comes with new animations! There are several bug fixes and what's best, all animations are now fully customizable.</p> <p>See the animations guide on <a href="https://recharts.github.io/en-US/guide/animations/">https://recharts.github.io/en-US/guide/animations/</a></p> <ul> <li>Animation guide by <a href="https://github.com/PavelVanecek"><code>@PavelVanecek</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7179">recharts/recharts#7179</a></li> <li>Animation tests by <a href="https://github.com/PavelVanecek"><code>@PavelVanecek</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7255">recharts/recharts#7255</a></li> <li>New animation props by <a href="https://github.com/PavelVanecek"><code>@PavelVanecek</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7215">recharts/recharts#7215</a></li> <li>test: cover legacy animation length changes by <a href="https://github.com/PavelVanecek"><code>@PavelVanecek</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7283">recharts/recharts#7283</a></li> <li>test: add sparse animation path tests for Line component by <a href="https://github.com/PavelVanecek"><code>@PavelVanecek</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7295">recharts/recharts#7295</a></li> <li>Export and document interpolate function by <a href="https://github.com/PavelVanecek"><code>@PavelVanecek</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7293">recharts/recharts#7293</a></li> <li>test: enhance line animation tests for ComposedChart and responsive by <a href="https://github.com/PavelVanecek"><code>@PavelVanecek</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7289">recharts/recharts#7289</a></li> <li>Manual animations on website by <a href="https://github.com/PavelVanecek"><code>@PavelVanecek</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7483">recharts/recharts#7483</a></li> <li>Add new example where chart animates by scroll by <a href="https://github.com/PavelVanecek"><code>@PavelVanecek</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7484">recharts/recharts#7484</a></li> <li>fix: preserve single-value line dash gaps during animation by <a href="https://github.com/puneetdixit200"><code>@puneetdixit200</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7405">recharts/recharts#7405</a></li> <li>Add animate-by-scroll example and update docs by <a href="https://github.com/PavelVanecek"><code>@PavelVanecek</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7487">recharts/recharts#7487</a></li> <li>Add custom fillOpacity on hover website example by <a href="https://github.com/PavelVanecek"><code>@PavelVanecek</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7489">recharts/recharts#7489</a></li> <li>honorable mention to <a href="https://github.com/robjampar"><code>@robjampar</code></a> for PR <a href="https://redirect.github.com/recharts/recharts/pull/6973">recharts/recharts#6973</a> which ended up declined but it introduced the starting idea for the new animation props</li> </ul> <h3>New features other than animations</h3> <ul> <li>Expose and document chart layout hooks and layout types in public API by <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7265">recharts/recharts#7265</a></li> <li>feat: allow HTML attributes passthrough on ResponsiveContainer by <a href="https://github.com/techcodie"><code>@techcodie</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7168">recharts/recharts#7168</a></li> <li>feat: add nodeInset and nodeGap properties to Treemap for better la… by <a href="https://github.com/MaximSrour"><code>@MaximSrour</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7044">recharts/recharts#7044</a></li> <li>feat(PieChart): add dataKey to Legend payload by <a href="https://github.com/Harikrushn9118"><code>@Harikrushn9118</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7137">recharts/recharts#7137</a></li> </ul> <h3>Bugfixes</h3> <ul> <li>fix: preserve valid falsy custom names (0, "") in tooltips by <a href="https://github.com/vamsi2246"><code>@vamsi2246</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7175">recharts/recharts#7175</a></li> <li>fix(ResponsiveContainer): Fix erroneous console warning on init by <a href="https://github.com/andypoorman"><code>@andypoorman</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7174">recharts/recharts#7174</a></li> <li>fix(DataUtils): improve isPercent validation to exclude invalid formats by <a href="https://github.com/vamsi2246"><code>@vamsi2246</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7178">recharts/recharts#7178</a></li> <li>fix(BarChart): render stacked bars when all values are 0 (<a href="https://redirect.github.com/recharts/recharts/issues/6235">#6235</a>) by <a href="https://github.com/andypoorman"><code>@andypoorman</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7199">recharts/recharts#7199</a></li> <li>fix(Sankey): prevent NaN node positions when link values sum to zero by <a href="https://github.com/Mridul012"><code>@Mridul012</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7185">recharts/recharts#7185</a></li> <li>fix(Funnel): prevent NaN coordinate layout crash when all values are zero by <a href="https://github.com/Mridul012"><code>@Mridul012</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7184">recharts/recharts#7184</a></li> <li>fixes an issue where XAxis and YAxis padding were ignored by the clipping mask when allowDataOverflow={true} was used alongside a restricted domain by <a href="https://github.com/emiedonmokumo"><code>@emiedonmokumo</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7232">recharts/recharts#7232</a></li> <li>fix: use originalDataIndex for tooltip dispatch in Bar by <a href="https://github.com/mayrang"><code>@mayrang</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7273">recharts/recharts#7273</a></li> <li>fix: resolve TypeScript 6 deprecation errors in tsconfig files by <a href="https://github.com/shreedharbhat98"><code>@shreedharbhat98</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7285">recharts/recharts#7285</a></li> <li>fix(bar): use Math.round instead of bitwise truncation for bar positioning by <a href="https://github.com/EduardF1"><code>@EduardF1</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7297">recharts/recharts#7297</a></li> <li>fix(types): propagate Tooltip types in chart helper contexts by <a href="https://github.com/mixelburg"><code>@mixelburg</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7125">recharts/recharts#7125</a></li> <li>fix(Legend): prevent overlap with chart on container resize by <a href="https://github.com/maroKanatani"><code>@maroKanatani</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7201">recharts/recharts#7201</a></li> <li>test(YAxis): failing repro for <a href="https://redirect.github.com/recharts/recharts/issues/7362">#7362</a> — function domain doesn't render ticks on empty/all-null data by <a href="https://github.com/nlenepveu"><code>@nlenepveu</code></a> in <a href="https://redirect.github.com/recharts/recharts/pull/7384">recharts/recharts#7384</a></li> </ul> <h3>Tree-shaking</h3> <p>We now have focused tree-shaking tests that allow us to observe exactly which components end up in the final bundle and why. I have also removed some unnecessary loops and you should see the final bundle size decrease somewhat as a result.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/recharts/recharts/commit/8c1cce725956a036949471eba392ac0cc20189a8"><code>8c1cce7</code></a> v3.9.0 (<a href="https://redirect.github.com/recharts/recharts/issues/7490">#7490</a>)</li> <li><a href="https://github.com/recharts/recharts/commit/e5fe9bb2fba18dc96c64b10fd4a7c4a4bdc86d1f"><code>e5fe9bb</code></a> Add custom fillOpacity on hover website example (<a href="https://redirect.github.com/recharts/recharts/issues/7489">#7489</a>)</li> <li><a href="https://github.com/recharts/recharts/commit/ad1590f256d6e7484890326282935576824cdce6"><code>ad1590f</code></a> Add test for Pie and Legend animation (<a href="https://redirect.github.com/recharts/recharts/issues/7488">#7488</a>)</li> <li><a href="https://github.com/recharts/recharts/commit/337edbd371ace0551068cbd9591b9ef18fee0ae3"><code>337edbd</code></a> Add animate-by-scroll example and update docs (<a href="https://redirect.github.com/recharts/recharts/issues/7487">#7487</a>)</li> <li><a href="https://github.com/recharts/recharts/commit/0063aa486281e28ebbceeeda0102ba9c1dc1b6ff"><code>0063aa4</code></a> fix: preserve single-value line dash gaps during animation (<a href="https://redirect.github.com/recharts/recharts/issues/7405">#7405</a>)</li> <li><a href="https://github.com/recharts/recharts/commit/6dbe130b8908cc09f6096d0b78d117b93b8335f4"><code>6dbe130</code></a> Add new example where chart animates by scroll (<a href="https://redirect.github.com/recharts/recharts/issues/7484">#7484</a>)</li> <li><a href="https://github.com/recharts/recharts/commit/a2c4171608f2608e9025204c6c3fdb3b459c5c87"><code>a2c4171</code></a> Manual animations on website (<a href="https://redirect.github.com/recharts/recharts/issues/7483">#7483</a>)</li> <li><a href="https://github.com/recharts/recharts/commit/c88f5f36f38be0c3d0cab6dad5e7f8f167b7f1bb"><code>c88f5f3</code></a> Simplify and export some of the new animation props (<a href="https://redirect.github.com/recharts/recharts/issues/7481">#7481</a>)</li> <li><a href="https://github.com/recharts/recharts/commit/410cf5cf063f521ad9b84ed21143c39cc113d8cb"><code>410cf5c</code></a> Renaming some of the animation props (<a href="https://redirect.github.com/recharts/recharts/issues/7477">#7477</a>)</li> <li><a href="https://github.com/recharts/recharts/commit/a1b89c6c798c3e6294a166f2a199baf3f991f128"><code>a1b89c6</code></a> chore(deps-dev): bump undici from 6.26.0 to 6.27.0 (<a href="https://redirect.github.com/recharts/recharts/issues/7475">#7475</a>)</li> <li>Additional commits viewable in <a href="https://github.com/recharts/recharts/compare/v3.8.1...v3.9.0">compare view</a></li> </ul> </details> <br /> Updates `baseline-browser-mapping` from 2.10.33 to 2.10.38 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/web-platform-dx/baseline-browser-mapping/releases">baseline-browser-mapping's releases</a>.</em></p> <blockquote> <h2>v2.9.3 - remove <code>process.loadEnvFile()</code></h2> <h2>What's Changed</h2> <ul> <li>Remove process.loadEnfFile() from main script by <a href="https://github.com/tonypconway"><code>@tonypconway</code></a> in <a href="https://redirect.github.com/web-platform-dx/baseline-browser-mapping/pull/112">web-platform-dx/baseline-browser-mapping#112</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/web-platform-dx/baseline-browser-mapping/compare/v2.9.2...v2.9.3">https://github.com/web-platform-dx/baseline-browser-mapping/compare/v2.9.2...v2.9.3</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/web-platform-dx/baseline-browser-mapping/commit/37f3dae1c0142f522858bc0f40084af1879fd46c"><code>37f3dae</code></a> Patch to 2.10.38 because browser or feature data changed</li> <li><a href="https://github.com/web-platform-dx/baseline-browser-mapping/commit/c5c28415598c49f679b1a77794a286ed9e00c315"><code>c5c2841</code></a> Browser or feature data changed</li> <li><a href="https://github.com/web-platform-dx/baseline-browser-mapping/commit/14903f7eeaacd05bd2353f411d55aa8a72370a62"><code>14903f7</code></a> Updating static site</li> <li><a href="https://github.com/web-platform-dx/baseline-browser-mapping/commit/2cfe7fc23acc6fe68d99f55d1dfa58370938ec0a"><code>2cfe7fc</code></a> Patch to 2.10.37 because browser or feature data changed</li> <li><a href="https://github.com/web-platform-dx/baseline-browser-mapping/commit/48e5a7c4a4013a11b08c73cac230c11b2b557130"><code>48e5a7c</code></a> Browser or feature data changed</li> <li><a href="https://github.com/web-platform-dx/baseline-browser-mapping/commit/ba5507374281bf5d9b3697b392b5a2173bcc5c8b"><code>ba55073</code></a> Updating static site</li> <li><a href="https://github.com/web-platform-dx/baseline-browser-mapping/commit/df118b243455c9c65b2a212eeb5efff1a9a5d18e"><code>df118b2</code></a> Patch to 2.10.36 because browser or feature data changed</li> <li><a href="https://github.com/web-platform-dx/baseline-browser-mapping/commit/c2663f17c73951bb3f586eb38f787018308ba446"><code>c2663f1</code></a> Browser or feature data changed</li> <li><a href="https://github.com/web-platform-dx/baseline-browser-mapping/commit/221a2665ab34e99061ebae5c8232016a49c34677"><code>221a266</code></a> Updating static site</li> <li><a href="https://github.com/web-platform-dx/baseline-browser-mapping/commit/d358b780b9446896a4bc0b2032cd35fbf73239c8"><code>d358b78</code></a> Patch to 2.10.35 because browser or feature data changed</li> <li>Additional commits viewable in <a href="https://github.com/web-platform-dx/baseline-browser-mapping/compare/v2.10.33...v2.10.38">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Nikhil J
|
81858aa542 |
docs: fix broken OAuth2/OIDC policy examples (#8840)
## What / Why
The examples on the OAuth2/OIDC guide (`docs/docs/oauth-oidc.md`) fail
to compile on current OPA (v1+):
1. `claims := jwt.decode(input.token)[1]` uses an undefined built-in.
The correct name is `io.jwt.decode`, which the same page already uses
correctly further down (`jwt_unverified := io.jwt.decode(input.token)`).
2. The `jwt_verified := jwt_unverified { ... }` and `token := t { ... }`
rules are missing the `if` keyword required before a rule body in Rego
v1, so they fail to parse (`'if' keyword is required before rule body`).
## Changes
- `jwt.decode` -> `io.jwt.decode`
- add `if` before the `jwt_verified` and `token` rule bodies
These are minimal, semantics-preserving fixes so the copy-pasteable
examples work on a current OPA release.
Signed-off-by: Nikhil Jathar <22786232+mailnike@users.noreply.github.com>
|
||
|
John Hooks
|
c498b548ca |
ecosystem: add Sencillo projects to ecosystem (#8818)
### What are the changes in this PR? Just adding a couple of my projects to the ecosystem page. Signed-off-by: John Hooks <hooksie11@gmail.com> |
||
|
dependabot[bot]
|
1783ac26de |
build(deps): bump linkify-it from 5.0.0 to 5.0.1 in /docs
Bumps [linkify-it](https://github.com/markdown-it/linkify-it) from 5.0.0 to 5.0.1. - [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md) - [Commits](https://github.com/markdown-it/linkify-it/compare/5.0.0...5.0.1) --- updated-dependencies: - dependency-name: linkify-it dependency-version: 5.0.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Stephan Renatus
|
9c83b9948a |
wasm: replace wasmtime-go with wazero (#8815)
The change replaces bytecodealliance/wasmtime-go/v44 (CGo) with
tetratelabs/wazero (pure Go)
- CGo eliminated — wazero is pure Go, so the whole internal/wasm/sdk
runtime no longer needs a C toolchain/cross-compilation story.
- The "env glue module" trick (glue.go) is the right solution to
wazero's constraint that a HostModuleBuilder can't export memory.
- Process-wide CompilationCache (sync.OnceValue): each unique policy is
compiled once per process, and discarded/re-instantiated VMs are cheap.
- Simplification in vm.go — dropping the ~25 closure fields (evalOneOff,
eval, heapPtrGet, …) in favor of mod.ExportedFunction(name) + a generic
call/callVoid/callOrCancel
- All tests pass (incl. internal/wasm/sdk/internal/wasm,
internal/wasm/sdk/opa). evalCompat for ABI 1.1 is retained.
----------
```
│
|
||
|
Stephan Renatus
|
65f485d651 |
docs: document rule indexer support for in, bare refs; modernize rego (#8823)
This had shipped in [v1.15.0](https://github.com/open-policy-agent/opa/releases/tag/v1.15.0) (and been attempted to ship in 1.14.0), but we've forgotten about the docs 😅 Fixes #8822 Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> |
||
|
Charlie Egan
|
8b59ff6e48 |
docs: Updates examples to use some...in, add link to debugger (#8806)
Based on input from user here in slack: https://openpolicyagent.slack.com/archives/C08V59T3NAF/p1781788845493869 This also makes some updates based on common topics in the new docs chat. Some/every appears to be particularly confusing and the installation instructions might be better if more prominent. --------- Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
dependabot[bot]
|
57742e84a9 |
build(deps): bump webpack-dev-server from 5.2.4 to 5.2.5 in /docs (#8807)
Bumps [webpack-dev-server](https://github.com/webpack/webpack-dev-server) from 5.2.4 to 5.2.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/webpack/webpack-dev-server/releases">webpack-dev-server's releases</a>.</em></p> <blockquote> <h2>v5.2.5</h2> <h3>Patch Changes</h3> <ul> <li>Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack-dev-server/pull/5680">#5680</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md">webpack-dev-server's changelog</a>.</em></p> <blockquote> <h2>5.2.5</h2> <h3>Patch Changes</h3> <ul> <li>Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack-dev-server/pull/5680">#5680</a>)</li> </ul> <p>All notable changes to this project will be documented in this file. See <a href="https://github.com/conventional-changelog/standard-version">standard-version</a> for commit guidelines.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/webpack/webpack-dev-server/commit/c3ee325819f64ceb77f85dcf727b6b5ede85cbc4"><code>c3ee325</code></a> chore(release): new release (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5682">#5682</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/60173be90873b187b41fc2009a4de253732988a1"><code>60173be</code></a> feat: add changeset validation and release workflow (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5680">#5680</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/948d5e6089bebcd801dac2cbe3ed4f80b64f117a"><code>948d5e6</code></a> fix(proxy): match the HMR upgrade path exactly like the ws server (<a href="https://redirect.github.com/webpack/webpack-dev-server/issues/5678">#5678</a>)</li> <li><a href="https://github.com/webpack/webpack-dev-server/commit/93e8996124332a6c94c4d3e0f8e5f2cf95321c67"><code>93e8996</code></a> fix: skip HMR websocket path when forwarding upgrades to user-defined proxies...</li> <li>See full diff in <a href="https://github.com/webpack/webpack-dev-server/compare/v5.2.4...v5.2.5">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for webpack-dev-server since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Sebastian Spaink
|
0e6fe9caa2 |
Add proto schemas for the IR plan and bundle manifest (#8775)
This adds two new proto schemas: * v1/bundle/manifest.proto * v1/ir/plan.proto --------- Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> |
||
|
dependabot[bot]
|
1a68282b0c |
build(deps): bump dompurify from 3.4.10 to 3.4.11 in /docs (#8803)
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.10 to 3.4.11. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cure53/DOMPurify/releases">dompurify's releases</a>.</em></p> <blockquote> <h2>DOMPurify 3.4.11</h2> <ul> <li>Fixed an issue with a leaky config for hooks via <code>setConfig</code>, thanks <a href="https://github.com/trace37labs"><code>@trace37labs</code></a></li> <li>Bumped vulnerable development dependencies to arrive at plain 0 with <code>npm audit</code></li> <li>Updated the <code>osv-scanner</code> suppression list as no vulnerable dependencies are left for now</li> <li>Updated up the linting tool-chain and removed now-redundant lint directives</li> <li>Updated the documentation is several spots, README, wiki, etc.</li> <li>Bumped several dependencies where possible</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cure53/DOMPurify/commit/0cae5187403132f96a6d357649e4b15633fc210a"><code>0cae518</code></a> release: 3.4.11 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1494">#1494</a>)</li> <li>See full diff in <a href="https://github.com/cure53/DOMPurify/compare/3.4.10...3.4.11">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
SEONGHYUN HONG
|
f4121fb38f |
docs: remove duplicated word in Rego style guide (#8800)
The Rego style guide reads "will fail both in the the undefined case" — removed the duplicated "the". Signed-off-by: s3onghyun <s3onghyun.hong@gmail.com> |
||
|
dependabot[bot]
|
369db1718b |
build(deps): bump dompurify from 3.4.0 to 3.4.10 in /docs (#8789)
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.0 to 3.4.10. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cure53/DOMPurify/releases">dompurify's releases</a>.</em></p> <blockquote> <h2>DOMPurify 3.4.10</h2> <ul> <li>Refactored codebase for clarity: extracted the public type declarations into <code>types.ts</code></li> <li>Decomposed the three largest sanitizer functions into focused helpers</li> <li>Removed duplicated defaults and dead branches, consolidated <code>SAFE_FOR_TEMPLATES</code> scrubbing into single shared path</li> <li>Improved per-node performance by hoisting the mXSS probe regexes and testing <code>textContent</code> before <code>innerHTML</code></li> <li>Added a deterministic micro-benchmark harness (<code>npm run bench</code>) with a <code>--compare</code> mode</li> <li>Reduced CI cost by running the full three-engine browser suite once per PR</li> <li>Refreshed the <code>demos/</code> folder so every demo runs again, and added a SVG-via-<code><img></code> demo</li> <li>Documented the bench and <code>test:happydom</code> scripts in the README</li> <li>Completed the Attack Classes & Bypass History wiki page</li> <li>Bumped several dependencies where possible</li> </ul> <h2>DOMPurify 3.4.9</h2> <ul> <li>Further improved the handling of Trusted Types config options, thanks <a href="https://github.com/offset"><code>@offset</code></a></li> <li>Further improved the handling of <code>IN_PLACE</code> sanitization, thanks <a href="https://github.com/mozfreddyb"><code>@mozfreddyb</code></a></li> <li>Added more test coverage for <code>IN_PLACE</code> and Trusted Types related usage</li> <li>Bumped several dependencies where possible</li> <li>Updated README and wiki with more accurate documentation & attack samples</li> </ul> <h2>DOMPurify 3.4.8</h2> <ul> <li>Cleaned up the repository root, renamed some and removed unneeded files</li> <li>Fixed an issue with handling of Trusted Types policies, thanks <a href="https://github.com/fulstadev"><code>@fulstadev</code></a></li> <li>Fixed the node iterator for better template scrubbing, thanks <a href="https://github.com/IamLeandrooooo"><code>@IamLeandrooooo</code></a></li> <li>Included formerly missing LICENSE-MPL in published npm package, thanks <a href="https://github.com/asamuzaK"><code>@asamuzaK</code></a></li> <li>Bumped several dependencies where possible</li> </ul> <h2>DOMPurify 3.4.7</h2> <ul> <li>Hardened the handling of Shadow Roots when using <code>IN_PLACE</code>, thanks <a href="https://github.com/GameZoneHacker"><code>@GameZoneHacker</code></a></li> <li>Removed a problem leading to permanent hook pollution, thanks <a href="https://github.com/offset"><code>@offset</code></a></li> <li>Refactored the test suite and expanded test coverage significantly</li> </ul> <h2>DOMPurify 3.4.6</h2> <ul> <li>Fixed several issues with DOM Clobbering in <code>IN_PLACE</code> mode, thanks <a href="https://github.com/offset"><code>@offset</code></a> & <a href="https://github.com/Bankde"><code>@Bankde</code></a></li> <li>Hardened the checks for cross-realm <code>IN_PLACE</code> and Shadow DOM sanitization, thanks <a href="https://github.com/offset"><code>@offset</code></a> & <a href="https://github.com/Bankde"><code>@Bankde</code></a></li> <li>Added more test coverage for <code>IN_PLACE</code> and general DOM Clobbering attacks</li> <li>Bumped several dependencies where possible</li> </ul> <h2>DOMPurify 3.4.5</h2> <ul> <li>Fixed a bypass caused by the new HTML element <code>selectedcontent</code> added in 3.4.4, thanks <a href="https://github.com/KabirAcharya"><code>@KabirAcharya</code></a></li> </ul> <p><strong>Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.</strong></p> <h2>DOMPurify 3.4.4</h2> <ul> <li>Added the <code>selectedcontent</code> element to default allow-list, thanks <a href="https://github.com/lukewarlow"><code>@lukewarlow</code></a></li> <li>Added the <code>command</code> and <code>commandfor</code> attributes to default allowed-list, thanks <a href="https://github.com/lukewarlow"><code>@lukewarlow</code></a></li> <li>Added better template scrubbing for <code>IN_PLACE</code> operations, thanks <a href="https://github.com/DEMON1A"><code>@DEMON1A</code></a></li> <li>Added stronger checks for cross-realm windows, thanks <a href="https://github.com/DEMON1A"><code>@DEMON1A</code></a> & <a href="https://github.com/fg0x0"><code>@fg0x0</code></a></li> <li>Updated demo website and made sure it uses the latest from main</li> <li>Updated existing workflows, fuzzer, dependabot, etc., added more tests</li> <li>Bumped several dependencies where possible</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cure53/DOMPurify/commit/6ee5716f8336989753611beeca364957c0eb0c3e"><code>6ee5716</code></a> release: 3.4.10 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1478">#1478</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/52102472d46035857c52df19e44285f8a1e102fc"><code>5210247</code></a> release: 3.4.9 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1459">#1459</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/bcdd8285412dc9c4c149652aed2d712e790d6ccf"><code>bcdd828</code></a> release: 3.4.8 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1439">#1439</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff"><code>ca30f07</code></a> release: 3.4.7 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1414">#1414</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/bb7739e5bccec7e1ab3dae3f3e42d02db3acaaae"><code>bb7739e</code></a> release: 3.4.6 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1394">#1394</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/011b0c78f2a0f57ee54f5fcccb697a46ca6e63ea"><code>011b0c7</code></a> release: 3.4.5 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1382">#1382</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/5817ad969c15e67dfcd6cb37248d6e9c1553e7c3"><code>5817ad9</code></a> release: 3.4.4 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1374">#1374</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/520edb0371a9638f9b51f1798051299a250c686b"><code>520edb0</code></a> release: 3.4.3 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1352">#1352</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/6f67fd396a7b8c64294343999fe607ca1f5299c0"><code>6f67fd3</code></a> Sync/3.4.2 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1322">#1322</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/5b0cdbbf52331e854c0a2de875b1a3790ecec2b8"><code>5b0cdbb</code></a> chore: merge main into 3.x for 3.4.1 release (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1301">#1301</a>)</li> <li>Additional commits viewable in <a href="https://github.com/cure53/DOMPurify/compare/3.4.0...3.4.10">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
ed23e2b0b2 |
build(deps): bump ws in /docs (#8788)
Bumps and [ws](https://github.com/websockets/ws). These dependencies needed to be updated together. Updates `ws` from 7.5.10 to 7.5.11 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>7.5.11</h2> <h1>Bug fixes</h1> <ul> <li>Backported 2b2abd45 to the 7.x release line (e14c4586).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8"><code>fd36cd8</code></a> [dist] 7.5.11</li> <li><a href="https://github.com/websockets/ws/commit/e14c45861deca0cef60dec0f9109b694abebdf52"><code>e14c458</code></a> [security] Limit retained message parts</li> <li>See full diff in <a href="https://github.com/websockets/ws/compare/7.5.10...7.5.11">compare view</a></li> </ul> </details> <br /> Updates `ws` from 8.18.3 to 8.21.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>7.5.11</h2> <h1>Bug fixes</h1> <ul> <li>Backported 2b2abd45 to the 7.x release line (e14c4586).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8"><code>fd36cd8</code></a> [dist] 7.5.11</li> <li><a href="https://github.com/websockets/ws/commit/e14c45861deca0cef60dec0f9109b694abebdf52"><code>e14c458</code></a> [security] Limit retained message parts</li> <li>See full diff in <a href="https://github.com/websockets/ws/compare/7.5.10...7.5.11">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
186d4868cf |
build(deps): bump launch-editor from 2.11.1 to 2.14.1 in /docs (#8790)
Bumps [launch-editor](https://github.com/vitejs/launch-editor) from 2.11.1 to 2.14.1. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/launch-editor/commit/3f97c648307a70e7c930ba63f040e6ba8e72bc16"><code>3f97c64</code></a> v2.14.1</li> <li><a href="https://github.com/vitejs/launch-editor/commit/0cc9550e05c35224a1f61914b9731723f78c06a7"><code>0cc9550</code></a> fix: reject UNC paths (<a href="https://redirect.github.com/vitejs/launch-editor/issues/138">#138</a>)</li> <li><a href="https://github.com/vitejs/launch-editor/commit/afd1ab907769adbb0fb76b564551f3cd24822ea6"><code>afd1ab9</code></a> ci: run tests on mac and windows (<a href="https://redirect.github.com/vitejs/launch-editor/issues/136">#136</a>)</li> <li><a href="https://github.com/vitejs/launch-editor/commit/0bfa328e4d2a70d3accd86645efde43a5a8fd931"><code>0bfa328</code></a> test: add some tests for launch-editor package (<a href="https://redirect.github.com/vitejs/launch-editor/issues/135">#135</a>)</li> <li><a href="https://github.com/vitejs/launch-editor/commit/1b006ae00061e83628c884770df4869bac481ed3"><code>1b006ae</code></a> chore: add README (<a href="https://redirect.github.com/vitejs/launch-editor/issues/134">#134</a>)</li> <li><a href="https://github.com/vitejs/launch-editor/commit/383ef26fceaaab75e4f122bf833a8d457e187272"><code>383ef26</code></a> v2.14.0</li> <li><a href="https://github.com/vitejs/launch-editor/commit/6277209316b28bd76b057a97fcdfa42da5adc181"><code>6277209</code></a> ci: harden publish settings</li> <li><a href="https://github.com/vitejs/launch-editor/commit/520b2f787af1bbe3d2333d952547fc90f2c01bb3"><code>520b2f7</code></a> fix(deps): update all non-major dependencies (<a href="https://redirect.github.com/vitejs/launch-editor/issues/129">#129</a>)</li> <li><a href="https://github.com/vitejs/launch-editor/commit/475ac662aeaa40eebe319f76acf7bd7ff2aba5d5"><code>475ac66</code></a> chore(deps): update dependency lint-staged to v17 (<a href="https://redirect.github.com/vitejs/launch-editor/issues/130">#130</a>)</li> <li><a href="https://github.com/vitejs/launch-editor/commit/247bf1dfe2c75efb50f507d33c2c5a3cbf4e20d0"><code>247bf1d</code></a> chore(deps): update dependency yorkie to v2 (<a href="https://redirect.github.com/vitejs/launch-editor/issues/131">#131</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/launch-editor/compare/v2.11.1...v2.14.1">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for launch-editor since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Charlie Egan
|
e7d0c0e3d1 |
docs: Add we/our/us check to spell check (#8787)
Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Charlie Egan
|
7b004efe4a |
docs: Update documentation to be more consistent and sound more like reference docs (#8786)
There are a lot of edits here. I am trying to make the docs more consistent between pages and sections, each commit is one category of change so it might be easier to go through commit by commit to see all similar changes in the same place. The main goal was to make the language sound more like reference docs than product marketing, i.e. a little more formal with fewer filler words in places. Rephrase to avoid informal 'we/our' guidance, formatting updates for things like admonitions. --------- Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Charlie Egan
|
88c01e659c |
runtime: Restore goautomaxprocs, add automemlimit (#8784)
This PR reverts the change in #8696 where automaxprocs was removed. This meant the go language default of 2 procs vs 1 was used. In some memory constrained deployments of OPA, this caused OOM issues where the server used more memory than before with 2 processes running. This PR restores the automaxprocs dependency and this behaviour. This PR also follows other data-heavy CNCF projects in pairing this with automemlimit to automate the setting of GOMEMLIMIT based on the cgroup data too. This makes no change for users manually setting these, but hopefully will provide some sensible defaults that work well for most cases, and better than the Go defaults in low resource deployments. <details> <summary>Other projects</summary> * https://github.com/prometheus/prometheus/blob/2ad3a871701531d1485f678acb7523cd0aa31789/go.mod#L11 * https://github.com/istio/istio/blob/4985ae369245dcc91bc107a0c47ea41ded0c1a12/go.mod#L8 * https://github.com/grafana/alloy/blob/e11d0f03e2b2e727161fb2169cade54698e17bd8/go.mod#L19 * https://github.com/thanos-io/thanos/blob/main/go.mod#L9 * https://github.com/kubernetes/kube-state-metrics/blob/main/go.mod#L6 * https://github.com/authzed/spicedb/blob/main/go.mod#L22 </details> --------- Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
pkuzco
|
c07265b1cd |
website: add ossrisk to ecosystem (#8780)
## What Adds [ossrisk](https://github.com/depkeep/ossrisk) to the OPA ecosystem page. ossrisk is a CLI and GitHub Action that scans npm and PyPI dependency trees for supply-chain and long-term viability risk: known CVEs (via OSV.dev), end-of-life versions, abandonment signals, typosquatting, license compliance, and maintainer-takeover patterns. Beyond a `--fail-on <severity>` threshold, ossrisk integrates with OPA via the `opa` CLI: the scan result JSON is passed as `input` to `opa eval`, and policies in `package ossrisk` add messages to a `deny` set to gate the build. This enables cross-signal rules a threshold alone cannot express — for example blocking packages with install scripts published by a brand-new maintainer (the event-stream takeover pattern). The JSON output also pipes cleanly into conftest. ## Changes - `docs/src/data/ecosystem/entries/ossrisk.md` — entry with `category: security`, `layer: cicd`, `type: poweredbyopa` - `docs/static/img/ecosystem-entry-logos/ossrisk.svg` — logo --------- Signed-off-by: glimm-no <admin@glimm.no> Signed-off-by: pkuzco <b.naamneh@gmail.com> Co-authored-by: glimm-no <admin@glimm.no> Co-authored-by: Charlie Egan <git@charlieegan3.com> |
||
|
Charlie Egan
|
c2864a1af3 |
Add SDK references for evaluating IR plans
Moved Intermediate Representation section earlier in the integration guide and documented Swift-OPA and java-opa-sdk for direct IR plan evaluation in applications. Added cross-links between integration.md and ir.md documentation. Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Charlie Egan
|
34167e2d86 |
docs: Add notes about use of GOMEMLIMIT (#8771)
Documents issue in memory constrained environments following the change in typical heap size following the change from 1 to 2 max procs in https://github.com/open-policy-agent/opa/pull/8696 --------- Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Charlie Egan
|
ffd7d46ee4 |
website: Various updates to node and website deps (#8768)
Replaces https://github.com/open-policy-agent/opa/pull/8762 Original dependabot updates: Bumps the website group in /docs with 9 updates: | Package | From | To | | --- | --- | --- | | [@floating-ui/react](https://github.com/floating-ui/floating-ui/tree/HEAD/packages/react) | `0.27.18` | `0.27.19` | | [@iconify/react](https://github.com/iconify/iconify/tree/HEAD/components/react) | `6.0.0` | `6.0.2` | | [@mermaid-js/layout-elk](https://github.com/mermaid-js/mermaid) | `0.1.9` | `0.2.1` | | [eslint](https://github.com/eslint/eslint) | `9.39.2` | `10.4.1` | | [glob](https://github.com/isaacs/node-glob) | `11.1.0` | `13.0.6` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.2.0` | | [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2) | `0.21.0` | `0.22.1` | | [recharts](https://github.com/recharts/recharts) | `3.7.0` | `3.8.1` | | [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.10.20` | `2.10.33` | I have also made some updates to use node 24. --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Charlie Egan <charlie_egan@apple.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Charlie Egan
|
532cf8c880 |
website: Fix build from missing dateAdded (#8764)
https://github.com/open-policy-agent/opa/pull/8685 had not been rebased and so this only failed when on main. I have also updated a regal link to use an abs url to silence a warning. Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Charlie Egan
|
85de0c3046 |
website: Update homepage AI example to tool calls (#8755)
This feels more relevant and interesting as an example now. We have RBAC use cases elsewhere. Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Charlie Egan
|
85e2477c85 |
website: Update docusaurus (#8756)
Also add dependabot for website deps. --------- Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
pkuzco
|
e161170dd9 |
Add depkeep to enterprise support (#8685)
Signed-off-by: glimm-no <admin@glimm.no> Co-authored-by: glimm-no <admin@glimm.no> |
||
|
dependabot[bot]
|
a8f8cea073 |
build(deps): bump shell-quote from 1.8.3 to 1.8.4 in /docs (#8753)
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.3 to 1.8.4. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md">shell-quote's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/ljharb/shell-quote/compare/v1.8.3...v1.8.4">v1.8.4</a> - 2026-05-22</h2> <h3>Commits</h3> <ul> <li>[Fix] <code>quote</code>: validate object-token shapes <a href="https://github.com/ljharb/shell-quote/commit/4378a6e613db5948168684864e49b42b83134d2d"><code>4378a6e</code></a></li> <li>[Dev Deps] update <code>@ljharb/eslint-config</code>, <code>auto-changelog</code>, <code>eslint</code>, <code>npmignore</code> <a href="https://github.com/ljharb/shell-quote/commit/22ebec04349065a45ad8afc8cc8d53c4624634a6"><code>22ebec0</code></a></li> <li>[Tests] increase coverage <a href="https://github.com/ljharb/shell-quote/commit/9f3caa31900cc6ee64858b31134144c648ce206d"><code>9f3caa3</code></a></li> <li>[readme] replace runkit CI badge with shields.io check-runs badge <a href="https://github.com/ljharb/shell-quote/commit/3344a047dd1e95f71c4ca27522cbfd05c56277e0"><code>3344a04</code></a></li> <li>[Dev Deps] update <code>@ljharb/eslint-config</code> <a href="https://github.com/ljharb/shell-quote/commit/699c5113d135f4d4591574bebf173334ffa453d4"><code>699c511</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ljharb/shell-quote/commit/ff166e2b63eb5f932bd131a8886a99e9afdf45ae"><code>ff166e2</code></a> v1.8.4</li> <li><a href="https://github.com/ljharb/shell-quote/commit/4378a6e613db5948168684864e49b42b83134d2d"><code>4378a6e</code></a> [Fix] <code>quote</code>: validate object-token shapes</li> <li><a href="https://github.com/ljharb/shell-quote/commit/22ebec04349065a45ad8afc8cc8d53c4624634a6"><code>22ebec0</code></a> [Dev Deps] update <code>@ljharb/eslint-config</code>, <code>auto-changelog</code>, <code>eslint</code>, `npmig...</li> <li><a href="https://github.com/ljharb/shell-quote/commit/9f3caa31900cc6ee64858b31134144c648ce206d"><code>9f3caa3</code></a> [Tests] increase coverage</li> <li><a href="https://github.com/ljharb/shell-quote/commit/3344a047dd1e95f71c4ca27522cbfd05c56277e0"><code>3344a04</code></a> [readme] replace runkit CI badge with shields.io check-runs badge</li> <li><a href="https://github.com/ljharb/shell-quote/commit/699c5113d135f4d4591574bebf173334ffa453d4"><code>699c511</code></a> [Dev Deps] update <code>@ljharb/eslint-config</code></li> <li>See full diff in <a href="https://github.com/ljharb/shell-quote/compare/v1.8.3...v1.8.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-policy-agent/opa/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
ORYGN
|
daf5d97991 |
docs(ecosystem): update OPA MCP entry with video, blog, and distribution links (#8712)
Updates the OPA MCP ecosystem entry with additional links and an updated tool count. ## Changes - Added `videos`: YouTube demo (author, lint, and test a Rego policy end to end from Claude Desktop) - Added `blogs`: LinkedIn Pulse article explaining the motivation behind OPA MCP - Added npm and Docker Hub to `code` (precedent: `opa-typescript` and `opa-wasm-js` entries both include npmjs.com links) - Added Smithery to `code` (primary MCP-ecosystem install path alongside npm) - Updated tool count from 32 to 50+ (current release is 52 tools across 7 categories) - Added Conftest to the CLI list in the description body Signed-off-by: Daniel Okwor <daniel@orygn.tech> Co-authored-by: Daniel Okwor <daniel@orygn.tech> |
||
|
Charlie Egan
|
75202c334c |
docs: PoC for kapa.ai (#8699)
https://contribute.cncf.io/blog/2026/04/09/reducing-support-tax-cncf-kapa-ai/ Changes to follow shortly, PR open for domain allow listing. Fixes https://github.com/open-policy-agent/opa/issues/8125 --------- Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Manuela Züger
|
947f2f6a7c |
docs/contributing: add formatting (#8740)
### Why the changes in this PR are needed? The PR pipeline checks if the formatting of docs changes is correct and instructs developers to fix any discovered formatting issues using the command `dprint fmt`. Contributors might not be aware of this before creating the PR, or forget it, resulting in a failing pipeline (for example [here](https://github.com/open-policy-agent/opa/actions/runs/27003824827/job/79690783007)) and one more roundtrip, which could be avoided. ### What are the changes in this PR? This PR adds an instruction to the contribution guideline to run the `dprint fmt` command to ensure correct formatting. ### Further comments: There is no issue for that as far as I know. I thought this would be helpful (also I forgot this already twice 😅 ). Signed-off-by: Manuela Züger <manuela.zueger@ipt.ch> |
||
|
Charlie Egan
|
c3a407c5d2 |
website: Add support page disclaimer and sort by date added (#8736)
Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Charlie Egan
|
9e103847d0 |
docs: Update regal docs for 0.41.1 release (#8730)
https://github.com/open-policy-agent/regal/releases/tag/v0.41.1 Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Charlie Egan
|
27619ae0dc |
docs: Update built-in index page titles (#8728)
This is for search engine result headings and on-site search titles. Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Charlie Egan
|
bcc13280a4 |
website: Add .md alternate content types for llms (#8725)
This makes the site's content easier to consume from chatbots and coding harnesses. This reuses the logic from the copy page content button implemented previously. E.g. https://deploy-preview-8725--openpolicyagent.netlify.app/docs/policy-reference/keywords/contains.md Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Charlie Egan
|
98944a4f44 |
docs/chore: Remove broken links (#8716)
Fixes https://github.com/open-policy-agent/opa/issues/8714 Signed-off-by: Charlie Egan <charlie_egan@apple.com> |
||
|
Toby Aurelius
|
f1612417a6 |
docs: clarify environment variable substitution behaviour (#8713)
Updates documentation to clarify behaviour of unset environment variables following #7831 and #7786. Signed-off-by: Toby Aurelius <22025115+taurelius@users.noreply.github.com> |