ewilliams28/releases
1
0
Fork 0
mirror of https://github.com/open-policy-agent/opa.git synced 2026-08-12 19:32:48 -06:00
Code Issues Packages Projects Releases Wiki Activity
6,553 Commits 45 Branches 221 Tags
f6092b9ce472a443eeaf78eabb2a28bd6d85ceba
Commit Graph

6553 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Sebastian Spaink f6092b9ce4 add --format flag for proto/JSON plan bundles (#8825) 
This change adds a new flag for emitting plan bundles in the new protobuf wire format. `opa build --format=json|proto`. With `--format=proto`, the bundle contains `/plan.pb` and `/.manifest.pb` in place of `/plan.json`and `/.manifest`. Bundle Reader auto-detects both forms; mixed-format bundles are rejected at read, merge, and write time.

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
 2026-07-06 12:50:33 -05:00
Stephan Renatus d7a9d913f8 compile: preserve package annotations in wasm bundle builds (#8855) 
pruneBundleEntrypoints was removing the METADATA block from modules
whose package path matched the entrypoint. The original code explicitly
guarded against this—packages are always retained in the bundle so their
annotations should be too—but the guard was lost during a refactor in
39a4c0ef43.

Fixes #8854

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-07-03 14:56:49 +02:00
Anders Eknert 193172daf1 Use more precise return types for object.* builtins 
A bit surprising how not a single test seems to fail from this change 😅
I've added one to at least verify that the type checker does a little
better now than before. External tools like Regal can do even better :)

Fixes #8692

Signed-off-by: Anders Eknert <anders.eknert@apple.com>
 2026-07-03 14:02:17 +02:00
Stephan Renatus defec76824 Integrate Patch v1.18.2 (#8852) 
Signed-off-by: Anders Eknert <anders.eknert@apple.com>
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Co-authored-by: Anders Eknert <anders.eknert@apple.com>
 2026-07-03 09:20:49 +02:00
Anders Eknert b4a7a19882 perf: avoid allocations with custom Atoi and Atoi64 helpers (#8758) 
strconv.Atoi was called frequently in OPA, and its failure case is
expensive. This custom implementation is slightly faster for the
successful case, but more importantly much more efficient in the failure
case, allocating nothing for any given input string.

Signed-off-by: Anders Eknert <anders.eknert@apple.com>
 2026-07-02 10:14:17 +00:00
Anders Eknert e5679d92ce Fix regression in fix of #8557 (#8845) 
The fix that shipped in v1.18.0 had the formatter not just honor
newlines when formatting single-item collections, but had them enforced.
This is quite a disruptive change leading to previously formatted files
to have potentially hundreds of changes upon reformat. This fix ensures
that only existing newlines in the source determine whether a
single-item collection should be formatted across a single or multiple
lines.

Signed-off-by: Anders Eknert <anders.eknert@apple.com>
 2026-07-02 09:06:47 +00:00
dependabot[bot] b3ecf132c6 build(deps): bump pg in /e2e/api/compile/prisma in the e2e-prisma group 
Bumps the e2e-prisma group in /e2e/api/compile/prisma with 1 update: [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg).


Updates `pg` from 8.21.0 to 8.22.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.22.0/packages/pg)

---
updated-dependencies:
- dependency-name: pg
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: e2e-prisma
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-02 10:07:29 +02:00
dependabot[bot] 8aa2b36fa9 build(deps): bump the dependencies group across 2 directories with 4 updates (#8836) 
Bumps the dependencies group with 2 updates in the / directory:
[github.com/huandu/go-sqlbuilder](https://github.com/huandu/go-sqlbuilder)
and
[github.com/vektah/gqlparser/v2](https://github.com/vektah/gqlparser).
Bumps the dependencies group with 2 updates in the /e2e directory:
[github.com/testcontainers/testcontainers-go](https://github.com/testcontainers/testcontainers-go)
and [modernc.org/sqlite](https://gitlab.com/cznic/sqlite).

Updates `github.com/huandu/go-sqlbuilder` from 1.41.0 to 1.42.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/huandu/go-sqlbuilder/releases">github.com/huandu/go-sqlbuilder's
releases</a>.</em></p>
<blockquote>
<h2>v1.42.0</h2>
<h2>What's Changed</h2>
<ul>
<li><code>[NEW]</code>: Add<code>USING</code> to<code>DELETE</code> and
<code>SKIP LOCKED</code>/<code>NOWAIT</code> to<code>SELECT</code> by <a
href="https://github.com/webdaad"><code>@​webdaad</code></a> in <a
href="https://redirect.github.com/huandu/go-sqlbuilder/issues/239">#239</a></li>
<li><code>[FIX]</code>: <code>ILIKE</code> operator is supported by
ClickHouse but not Sqlite. Issue was raised by <a
href="https://github.com/NAlexandrov"><code>@​NAlexandrov</code></a> in
<a
href="https://redirect.github.com/huandu/go-sqlbuilder/issues/240">#240</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/webdaad"><code>@​webdaad</code></a> made
their first contribution in <a
href="https://redirect.github.com/huandu/go-sqlbuilder/pull/239">huandu/go-sqlbuilder#239</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/huandu/go-sqlbuilder/compare/v1.41.0...v1.42.0">https://github.com/huandu/go-sqlbuilder/compare/v1.41.0...v1.42.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/huandu/go-sqlbuilder/commit/345b646003cea85d5e86a54bd78d25c54f82f0e7"><code>345b646</code></a>
fix: restore module path and retract v1.42.0</li>
<li><a
href="https://github.com/huandu/go-sqlbuilder/commit/289c7205eed2fa8a6a5954595db4dc66ae835dc8"><code>289c720</code></a>
fix <a
href="https://redirect.github.com/huandu/go-sqlbuilder/issues/240">#240</a>:
ILIKE is supported by ClickHouse but not Sqlite</li>
<li><a
href="https://github.com/huandu/go-sqlbuilder/commit/eb02267b1c23923ee0e3a49b71418d0aa8966cd3"><code>eb02267</code></a>
Merge pull request <a
href="https://redirect.github.com/huandu/go-sqlbuilder/issues/239">#239</a>
from webdaad/master</li>
<li><a
href="https://github.com/huandu/go-sqlbuilder/commit/d5110f9dd25e549ddab05150e5c542f4a06318b2"><code>d5110f9</code></a>
feat(select): add SKIP LOCKED</li>
<li><a
href="https://github.com/huandu/go-sqlbuilder/commit/0c2aa0fb5257b5808681bf3ff10e89d22252a62d"><code>0c2aa0f</code></a>
feat(delete): add using for postgres database</li>
<li>See full diff in <a
href="https://github.com/huandu/go-sqlbuilder/compare/v1.41.0...v1.42.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/vektah/gqlparser/v2` from 2.5.34 to 2.5.35
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vektah/gqlparser/releases">github.com/vektah/gqlparser/v2's
releases</a>.</em></p>
<blockquote>
<h2>v2.5.35</h2>
<h2>What's Changed</h2>
<ul>
<li>Migrate yaml dependency to go.yaml.in/yaml/v3 by <a
href="https://github.com/atzedus"><code>@​atzedus</code></a> in <a
href="https://redirect.github.com/vektah/gqlparser/pull/437">vektah/gqlparser#437</a></li>
<li>fix nullable nested list variable coercion by <a
href="https://github.com/jbellenger"><code>@​jbellenger</code></a> in <a
href="https://redirect.github.com/vektah/gqlparser/pull/439">vektah/gqlparser#439</a></li>
<li>build(deps-dev): bump prettier from 3.8.3 to 3.8.4 in
/validator/imported in the actions-deps group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/vektah/gqlparser/pull/438">vektah/gqlparser#438</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/vektah/gqlparser/compare/v2.5.34...v2.5.35">https://github.com/vektah/gqlparser/compare/v2.5.34...v2.5.35</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vektah/gqlparser/commit/e3a8d380b01be8704b7e43762413c396b77ec4f3"><code>e3a8d38</code></a>
Fix nullable nested list variable coercion (<a
href="https://redirect.github.com/vektah/gqlparser/issues/439">#439</a>)</li>
<li><a
href="https://github.com/vektah/gqlparser/commit/7edd6f710b8df76f817b2aa08f64d1bf72f71691"><code>7edd6f7</code></a>
build(deps-dev): bump prettier (<a
href="https://redirect.github.com/vektah/gqlparser/issues/438">#438</a>)</li>
<li><a
href="https://github.com/vektah/gqlparser/commit/5112c6b64846a7aa294ebff6776026c19b587e13"><code>5112c6b</code></a>
build(deps): migrate yaml import to go.yaml.in/yaml/v3 (<a
href="https://redirect.github.com/vektah/gqlparser/issues/437">#437</a>)</li>
<li>See full diff in <a
href="https://github.com/vektah/gqlparser/compare/v2.5.34...v2.5.35">compare
view</a></li>
</ul>
</details>
<br />

Updates `github.com/testcontainers/testcontainers-go` from 0.42.0 to
0.43.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/testcontainers/testcontainers-go/releases">github.com/testcontainers/testcontainers-go's
releases</a>.</em></p>
<blockquote>
<h2>v0.43.0</h2>
<h1>What's Changed</h1>
<h2>⚠️ Breaking Changes</h2>
<ul>
<li>chore(wait)!: change url callback in wait.ForSQL to accept
network.Port (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3650">#3650</a>)
<a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a></li>
</ul>
<blockquote>
<p>Users of <code>wait.ForSQL</code> need to follow the new API
contract, using Moby's <code>network.Port</code> instead of
<code>string</code> when building the callback function to check the
URL. Please see <a
href="https://golang.testcontainers.org/features/wait/sql/">https://golang.testcontainers.org/features/wait/sql/</a></p>
</blockquote>
<ul>
<li>feat!: add PullImageWithPlatform to DockerProvider (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3710">#3710</a>)
<a
href="https://github.com/blueprismo"><code>@​blueprismo</code></a></li>
</ul>
<blockquote>
<p>Users implementing their own
<code>testcontainers.ImageProvider</code> need to implement the new
<code>PullImageWithPlatform</code> method introduced by this PR.</p>
</blockquote>
<h2>🚀 Features</h2>
<ul>
<li>feat(k3s): pull image opts (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3716">#3716</a>)
<a
href="https://github.com/blueprismo"><code>@​blueprismo</code></a></li>
<li>feat(wait): implement AnyMultiStrategy: ForAny equivalent to ForAll.
(<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3719">#3719</a>)
<a href="https://github.com/jeanbza"><code>@​jeanbza</code></a></li>
<li>feat(eventhubs): add WithAzuriteContainer and functional-options
config builder (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3722">#3722</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>feat!: add PullImageWithPlatform to DockerProvider (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3710">#3710</a>)
<a
href="https://github.com/blueprismo"><code>@​blueprismo</code></a></li>
<li>feat(modules/dex): add Dex OIDC provider module (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3659">#3659</a>)
<a href="https://github.com/guilycst"><code>@​guilycst</code></a></li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li>fix(security): remove debug code that leaks Docker credentials (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3721">#3721</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>fix(ollama): align local exec test with Ollama 0.30.6 log format (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3715">#3715</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>fix: close temp file handle before removal (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3672">#3672</a>)
<a href="https://github.com/acouvreur"><code>@​acouvreur</code></a></li>
<li>fix(compose): close docker clients to prevent goroutine leaks (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3661">#3661</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>fix: wait for log production goroutine to drain on stop (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3660">#3660</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
</ul>
<h2>📖 Documentation</h2>
<ul>
<li>chore: update usage metrics (2026-06) (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3714">#3714</a>)
@<a
href="https://github.com/apps/github-actions">github-actions[bot]</a></li>
</ul>
<h2>🧹 Housekeeping</h2>
<ul>
<li>chore(wait)!: change url callback in wait.ForSQL to accept
network.Port (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3650">#3650</a>)
<a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a></li>
<li>chore: update usage metrics (2026-05) (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3670">#3670</a>)
@<a
href="https://github.com/apps/github-actions">github-actions[bot]</a></li>
<li>chore: remove cgroupnsMode setting from K3s container configuration
(<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3653">#3653</a>)
<a href="https://github.com/lixin9311"><code>@​lixin9311</code></a></li>
</ul>
<h2>📦 Dependency updates</h2>
<ul>
<li>chore(deps): update dependencies to latest versions in go.mod and
go.sum (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3729">#3729</a>)
<a
href="https://github.com/Steven-Harris"><code>@​Steven-Harris</code></a></li>
<li>chore: bump sshd-docker image to 1.4.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3727">#3727</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>chore(deps): bump Ryuk to v0.14.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3313">#3313</a>)
<a
href="https://github.com/mdelapenya"><code>@​mdelapenya</code></a></li>
<li>chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.4 to
4.26.5 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3713">#3713</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3712">#3712</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump mkdocs-include-markdown-plugin from 7.2.2 to 7.3.0
(<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3711">#3711</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump slackapi/slack-github-action from 2.1.1 to 3.0.3
(<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3677">#3677</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump idna from 3.11 to 3.15 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3708">#3708</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump github.com/containerd/containerd/v2 from 2.2.2 to
2.2.4 in /modules/compose (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3709">#3709</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
<li>chore(deps): bump urllib3 from 2.6.3 to 2.7.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3704">#3704</a>)
@<a href="https://github.com/apps/dependabot">dependabot[bot]</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/0835739aaf45d6cb7eb295f0c820e6f9e92102df"><code>0835739</code></a>
chore: use new version (v0.43.0) in modules and examples</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/85b6d7075d69260feb15b9d3b5bdab14d4698546"><code>85b6d70</code></a>
chore(deps): update dependencies to latest versions in go.mod and go.sum
(<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3729">#3729</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/8360f719408c23a4f3b731be25a94b267b624a28"><code>8360f71</code></a>
feat(k3s): pull image opts (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3716">#3716</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/b5e70223aa57f409f7721a89d66abf5b2a453468"><code>b5e7022</code></a>
chore: bump sshd-docker image to 1.4.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3727">#3727</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/1c05dd58a894fd52b48ab272ef6cb6aceaa57dd2"><code>1c05dd5</code></a>
chore(deps): bump Ryuk to v0.14.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3313">#3313</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/96ab0957556c744987ad7e97f59c78c469604e10"><code>96ab095</code></a>
feat(wait): implement AnyMultiStrategy: ForAny equivalent to ForAll. (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3719">#3719</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/42ac7d2e9a30de22f91da9e45d6084628ae2acb2"><code>42ac7d2</code></a>
chore(wait)!: change url callback in wait.ForSQL to accept network.Port
(<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3650">#3650</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/ab312e0088c3d615d64a4c6159805b9ab6db356d"><code>ab312e0</code></a>
chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.4 to 4.26.5
(<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3713">#3713</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/c5c95e5f9bbc01ef374cb76f8c63c09d9add93e4"><code>c5c95e5</code></a>
chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3712">#3712</a>)</li>
<li><a
href="https://github.com/testcontainers/testcontainers-go/commit/465d00250e529349f6975e88eb30d9338c6ae991"><code>465d002</code></a>
chore(deps): bump mkdocs-include-markdown-plugin from 7.2.2 to 7.3.0 (<a
href="https://redirect.github.com/testcontainers/testcontainers-go/issues/3711">#3711</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/testcontainers/testcontainers-go/compare/v0.42.0...v0.43.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `modernc.org/sqlite` from 1.52.0 to 1.53.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md">modernc.org/sqlite's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<ul>
<li>
<p>2026-06-25 v1.54.0:</p>
<ul>
<li>Under the opt-in <code>_texttotime</code> DSN parameter, best-effort
parse date-shaped TEXT values from columns SQLite reports with an empty
declared type — aggregates and expressions over a date column
(<code>MAX(d)</code>, <code>COALESCE(d, ...)</code>,
<code>upper(d)</code>, <code>d || ''</code>), subqueries, and typeless
real columns (<code>CREATE TABLE t(x)</code>) — into
<code>time.Time</code>, instead of delivering them as a raw string that
<code>Scan</code> cannot store into a <code>*time.Time</code>. The
existing declared
<code>DATE</code>/<code>DATETIME</code>/<code>TIME</code>/<code>TIMESTAMP</code>
path is unchanged; this only adds the empty-decltype case. The
conversion is strictly best-effort: a value that does not parse as a
time falls through to the original string, so no <code>Scan</code> that
worked before can newly fail. <code>ColumnTypeScanType</code> continues
to report <code>string</code> for empty-decltype columns, since the
declared type cannot prove the column is temporal. Without
<code>_texttotime</code> the behavior is byte-for-byte unchanged.
Resolves [GitLab issue <a
href="https://gitlab.com/cznic/sqlite/issues/248">#248</a>](<a
href="https://gitlab.com/cznic/sqlite/-/issues/248">https://gitlab.com/cznic/sqlite/-/issues/248</a>).</li>
<li>See [GitLab merge request <a
href="https://gitlab.com/cznic/sqlite/issues/133">#133</a>](<a
href="https://gitlab.com/cznic/sqlite/-/merge_requests/133">https://gitlab.com/cznic/sqlite/-/merge_requests/133</a>),
thanks Ian Chechin!</li>
</ul>
</li>
<li>
<p>2026-06-21 v1.53.0:</p>
<ul>
<li>Add <strong>experimental</strong> <code>netbsd/amd64</code> support,
resolving the long-standing build break in [GitLab issue <a
href="https://gitlab.com/cznic/sqlite/issues/246">#246</a>](<a
href="https://gitlab.com/cznic/sqlite/-/issues/246">https://gitlab.com/cznic/sqlite/-/issues/246</a>).
This target is intentionally <strong>not yet listed among the supported
platforms</strong> in the package documentation: the port had been
broken for years and is only now revived, and there is as yet no
real-world experience running it under production workloads. Green CI is
not the same as battle-tested — so while the full test suite (including
the <code>pcache</code> and <code>vec</code> packages and the
<code>-race</code> concurrency test) passes on NetBSD 10.1 / Go 1.26.3,
and the entire upstream toolchain (<code>libc</code>, <code>cc</code>,
<code>ccgo</code>, <code>libz</code>, <code>libtcl8.6</code>,
<code>libsqlite3</code>, <code>libsqlite_vec</code>) is green on the
NetBSD CI builder, the target is offered for evaluation only. If you run
NetBSD, please exercise it with your own workloads and report back via
<a href="https://gitlab.com/cznic/sqlite/issues/246">#246</a>; the
intent is to promote it to a fully supported platform after a period of
broader real-world testing (on the order of a month) elapses without
surprises.</li>
<li>Implementation notes: the previously shipped
<code>lib/sqlite_netbsd_amd64.go</code> was a stale old-generator
transpile that no longer compiled (the
<code>mu.enter</code>/<code>mu.leave</code> break in <a
href="https://gitlab.com/cznic/sqlite/issues/246">#246</a>); it is
replaced by a fresh new-generator transpile consistent with every other
platform, and <code>modernc.org/sqlite/vec</code> (sqlite-vec) is
vendored and auto-registers on netbsd. Correct operation requires the
matching pinned <code>modernc.org/libc</code>, which carries two
NetBSD-specific fixes found during this work: the <code>mmap(2)</code>
<code>PAD</code>-argument ABI (without it, concurrent WAL access faults
with SIGBUS in the WAL-index shared memory) and a working
<code>abort(3)</code> (the prior stub left SQLite's crash-recovery
<code>writecrash</code> test unable to terminate by signal). As usual,
downstream modules must pin the exact <code>modernc.org/libc</code>
version this module's <code>go.mod</code> pins.</li>
<li>See [GitLab merge request <a
href="https://gitlab.com/cznic/sqlite/issues/82">#82</a>](<a
href="https://gitlab.com/cznic/sqlite/-/merge_requests/82">https://gitlab.com/cznic/sqlite/-/merge_requests/82</a>),
thanks Leonardo Taccari (<a
href="https://github.com/iamleot"><code>@​iamleot</code></a>) and Thomas
Klausner (@<em>wiz</em>)!</li>
<li>Add <strong>experimental</strong> <code>freebsd/386</code> and
<code>freebsd/arm</code> support. As with the <code>netbsd/amd64</code>
target above, these two 32-bit FreeBSD ports are intentionally
<strong>not yet listed among the supported platforms</strong> in the
package documentation: <code>freebsd/386</code> previously shipped a
stale, effectively untested SQLite 3.41 transpile, and
<code>freebsd/arm</code> is entirely new, so neither has real-world
production mileage yet. Both are now freshly transpiled at SQLite 3.53.2
consistent with every other platform, build cleanly, and pass the full
test suite (core, WAL/concurrency, and the <code>vec</code> package) on
the FreeBSD CI builders; they are offered for evaluation only. If you
run 32-bit FreeBSD, please exercise these targets with your own
workloads and report back — the intent is to promote
<code>freebsd/386</code>, <code>freebsd/arm</code>, and
<code>netbsd/amd64</code> to fully supported platforms in a future
release cycle, once a period of broader real-world testing elapses
without surprises.</li>
<li>Implementation notes: correct operation on <code>freebsd/arm</code>
requires the matching pinned <code>modernc.org/libc</code> (v1.73.4),
which fixes the per-arch <code>mmap(2)</code> <code>off_t</code>
encoding for 32-bit FreeBSD; without it the WAL shared-memory mapping
faults with SIGBUS under concurrent access, the same class of bug found
on the netbsd port. As usual, downstream modules must pin the exact
<code>modernc.org/libc</code> version this module's <code>go.mod</code>
pins.</li>
<li>See [GitLab merge request <a
href="https://gitlab.com/cznic/sqlite/issues/119">#119</a>](<a
href="https://gitlab.com/cznic/sqlite/-/merge_requests/119">https://gitlab.com/cznic/sqlite/-/merge_requests/119</a>),
thanks Olivier Cochard-Labbé (<a
href="https://github.com/ocochard"><code>@​ocochard</code></a>)!</li>
<li>Add a Go-facing wrapper for <code>SQLITE_CONFIG_PCACHE2</code>.
<code>PageCache</code> is the factory and <code>Cache</code> the
per-database instance, both idiomatic Go interfaces; <code>Page</code>
exposes the raw <code>Buf</code> and <code>Extra</code> pointers that
SQLite reads through the C pcache contract.
<code>RegisterPageCache</code> and <code>MustRegisterPageCache</code>
install the module process-globally before the first
<code>sql.Open</code>; subsequent Open calls are gated through a
one-shot <code>Xsqlite3_config(SQLITE_CONFIG_PCACHE2)</code> so a
too-late Register returns <code>ErrPageCacheTooLate</code> rather than
silently falling through to the built-in pcache1. The binding owns the
<code>sqlite3_pcache_page</code> stub and re-consults the implementation
on every Fetch, reusing the stub only when the returned
<code>Page</code> value is unchanged, which keeps a bounded/evicting
purgeable cache safe by construction.</li>
<li>See [GitLab merge request <a
href="https://gitlab.com/cznic/sqlite/issues/126">#126</a>](<a
href="https://gitlab.com/cznic/sqlite/-/merge_requests/126">https://gitlab.com/cznic/sqlite/-/merge_requests/126</a>),
thanks Ian Chechin!</li>
<li>Add <code>modernc.org/sqlite/pcache</code>, the reference page-cache
implementation that accompanies the <a
href="https://gitlab.com/cznic/sqlite/issues/126">#126</a>
<code>SQLITE_CONFIG_PCACHE2</code> wrapper. <code>pcache.New</code>
returns a <code>*Pool</code> satisfying the <code>PageCache</code>
interface; register it once with
<code>sqlite.MustRegisterPageCache(pcache.New())</code> and every
connection opened afterwards draws its pages from it. Each
<code>Pool.Create</code> mints a fresh per-database <code>Cache</code>:
a bounded, LRU-evicting page store that honours the <code>PRAGMA
cache_size</code> soft cap and releases the least-recently-unpinned page
when it must make room. Page memory — the <code>Buf</code> and
<code>Extra</code> buffers SQLite reads through — is allocated with
<code>libc.Xmalloc</code>/<code>libc.Xcalloc</code> and therefore lives
off the Go heap, which keeps SQLite's interior pointer arithmetic on the
page extras from tripping the race detector's checkptr enforcement.
<code>Pool.Stats</code> reports aggregate lifetime counters (hits,
misses, allocs, evictions, rekeys, truncates, caches) across every cache
a Pool has created, so hit/miss/eviction behaviour is observable without
instrumenting individual caches. Cross-connection page sharing is out of
scope for now; each <code>Create</code> returns an independent
per-database cache.</li>
<li>Validated end-to-end against the <a
href="https://gitlab.com/cznic/sqlite/issues/126">#126</a> stress
workload (<code>cache_size=16</code>, 4000 BLOB rows with DELETE and
<code>incremental_vacuum</code>, <code>integrity_check</code> clean
under <code>-race</code>) and benchmarked for the memory-utilization
goal tracked in [GitLab issue <a
href="https://gitlab.com/cznic/sqlite/issues/204">#204</a>](<a
href="https://gitlab.com/cznic/sqlite/-/issues/204">https://gitlab.com/cznic/sqlite/-/issues/204</a>).</li>
<li>See [GitLab merge request <a
href="https://gitlab.com/cznic/sqlite/issues/127">#127</a>](<a
href="https://gitlab.com/cznic/sqlite/-/merge_requests/127">https://gitlab.com/cznic/sqlite/-/merge_requests/127</a>),
thanks Ian Chechin!</li>
<li>Tighten the <code>modernc.org/sqlite/pcache</code> reference
implementation per cznic's !127 review follow-ups. Adds
<code>Stats.EasyRefusals</code>, a per-Pool counter for the cases where
<code>FetchCreateEasy</code> returns nil at cap; SQLite reacts to a
refusal by spilling dirty pages and retrying with
<code>FetchCreateForce</code>, so the new field is a direct proxy for
the I/O pressure the strict Easy contract imposes vs pcache1's
recycle-without-spill behavior. <code>BenchmarkPoolEvictionChurn</code>
was reworked to drive a rotating-residue DELETE (<code>k % 3 = i %
3</code>) and re-insert a matching batch each cycle so the spill
pressure recurs and <code>easy-refusals/op</code> scales with
<code>b.N</code> instead of capping at the seed's one-time first-cycle
cost; both existing benchmarks now report <code>easy-refusals/op</code>
alongside the page-allocs/evictions metrics.
<code>Stats.Evictions</code> documentation was tightened to match the
actual behavior (counts LRU eviction, <code>Unpin(discard=true)</code>,
<code>Shrink</code> releases, and <code>Unpin(discard=false)</code>
trimming back to target after a <code>FetchCreateForce</code>
overcommit; bulk frees from <code>Truncate</code>, <code>Rekey</code>
collisions, and <code>Destroy</code> are not counted). The
<code>TestPoolRoundTripIntegrity</code> comment claiming the workload
exercises <code>xRekey</code> ~15 times has been corrected; the SQL
surface does not reliably emit xRekey here, and that codepath is covered
by the unit tests instead.</li>
<li>See [GitLab merge request <a
href="https://gitlab.com/cznic/sqlite/issues/130">#130</a>](<a
href="https://gitlab.com/cznic/sqlite/-/merge_requests/130">https://gitlab.com/cznic/sqlite/-/merge_requests/130</a>),
thanks Ian Chechin!</li>
<li>Make <code>modernc.org/sqlite/pcache</code> <code>-race</code>-clean
under SQLite's <code>cache=shared</code> mode. The pool already runs
correctly under shared-cache because every callback into a given
<code>Cache</code> is serialised internally by SQLite's
<code>sqlite3BtreeEnter</code> on the <code>BtShared</code> mutex;
verified empirically with a lock-free in-flight probe (max-in-flight = 1
on the canonical two-connection workload, 4 on a positive control with
goroutines hitting the cache directly). However the Go race detector
does not recognise SQLite's libc mutex as a happens-before edge and
reports false-positive races on <code>Fetch</code> vs <code>Unpin</code>
reads/writes of the per-cache state, which surfaces as <code>DATA
RACE</code> failures for any user who registers the pool and runs their
suite under <code>-race</code>. A <code>sync.Mutex</code> on the
<code>cache</code> type is now taken on every public method
(<code>SetSize</code>, <code>PageCount</code>, <code>Fetch</code>,
<code>Unpin</code>, <code>Rekey</code>, <code>Truncate</code>,
<code>Destroy</code>, <code>Shrink</code>), always. On the common
non-shared-cache path the lock is uncontended (one atomic CAS per
Lock/Unlock pair, negligible next to the SQLite work it bookends); on
the shared-cache path it just rubber-stamps the order SQLite's
<code>BtShared</code> mutex already established. A new
<code>e2e_test.go</code> <code>TestSharedCacheTwoConns_Integrity</code>
drives two <code>sql.Conn</code> against the same
<code>cache=shared</code> URI with concurrent writers and asserts
<code>PRAGMA integrity_check = ok</code> under <code>-race</code>;
passes cleanly with the lock, would surface the false-positive without
it. Design notes live in <code>pcache/sharing.go</code>.</li>
<li>See [GitLab merge request <a
href="https://gitlab.com/cznic/sqlite/issues/131">#131</a>](<a
href="https://gitlab.com/cznic/sqlite/-/merge_requests/131">https://gitlab.com/cznic/sqlite/-/merge_requests/131</a>),
thanks Ian Chechin!</li>
<li>Add a Go wrapper for <code>sqlite3_db_status</code>, the
per-connection runtime counters (cache hit/miss/write/spill rates,
schema and prepared-statement memory, lookaside usage, deferred foreign
keys). <code>DBStatus</code> is an interface implemented by the driver
connection and reached through the <code>database/sql</code> escape
hatch <code>(*sql.Conn).Raw()</code>, mirroring the existing
<code>FileControl</code> surface; <code>DBStatusOp</code> is a distinct
typed enum of the <code>SQLITE_DBSTATUS_*</code> verbs so a counter from
a different op family will not compile in its place. <code>Status(op,
reset)</code> returns the <code>(current, high)</code> pair and
optionally resets the counter. This also lets
<code>modernc.org/sqlite/pcache</code> measure real I/O instead of the
<code>EasyRefusals</code> proxy: the new
<code>BenchmarkPoolSpillIO</code> reads the pager-level
<code>SQLITE_DBSTATUS_CACHE_SPILL</code>/<code>_CACHE_WRITE</code>
counters, which the pager maintains identically for pcache1 and the
pool, making the pcache1-vs-pool comparison cznic raised on the !127
review a genuine apples-to-apples measurement. On the rotating-residue
eviction-churn workload at <code>cache_size=16</code> the pool spills
~3.5x more than pcache1 (cache-spill/op 31.96 vs 8.96) for ~3% more page
writes (cache-write/op 450 vs 436) at identical hit/miss, quantifying
the I/O cost of the strict Easy contract that <code>EasyRefusals</code>
only proxied.</li>
<li>See [GitLab merge request <a
href="https://gitlab.com/cznic/sqlite/issues/132">#132</a>](<a
href="https://gitlab.com/cznic/sqlite/-/merge_requests/132">https://gitlab.com/cznic/sqlite/-/merge_requests/132</a>),
thanks Ian Chechin!</li>
<li>Add an opt-in <code>_dqs</code> DSN query parameter that disables
SQLite's double-quoted string literal compatibility quirk on a
per-connection basis. When <code>_dqs=0</code> (or any
<code>strconv.ParseBool</code> false value) is supplied, the driver
calls <code>sqlite3_db_config</code> with
<code>SQLITE_DBCONFIG_DQS_DDL</code> and
<code>SQLITE_DBCONFIG_DQS_DML</code> set to off before any statement is
prepared, so a double-quoted identifier that fails to resolve raises a
parse error instead of silently falling back to a string literal.
Absence of the parameter, or <code>_dqs=1</code>, leaves SQLite's
default behavior unchanged; existing DSNs continue to work
byte-for-byte. Resolves [GitLab issue <a
href="https://gitlab.com/cznic/sqlite/issues/61">#61</a>](<a
href="https://gitlab.com/cznic/sqlite/-/issues/61">https://gitlab.com/cznic/sqlite/-/issues/61</a>).</li>
<li>See [GitLab merge request <a
href="https://gitlab.com/cznic/sqlite/issues/128">#128</a>](<a
href="https://gitlab.com/cznic/sqlite/-/merge_requests/128">https://gitlab.com/cznic/sqlite/-/merge_requests/128</a>),
thanks Ian Chechin!</li>
<li>Add an opt-in <code>_error_rc</code> DSN query parameter for clearer
error reporting on open-time failures. When <code>_error_rc=1</code> (or
any <code>strconv.ParseBool</code> true value) is supplied, error
strings synthesised from a <code>(rc, db)</code> pair only append
<code>sqlite3_errmsg(db)</code> when
<code>sqlite3_extended_errcode(db)</code> is consistent with the
operation rc (full match first, primary code <code>&amp;0xff</code> as
fallback). On mismatch the canonical <code>sqlite3_errstr(rc)</code> is
used alone, so an open-time <code>SQLITE_CANTOPEN</code> no longer
carries the temporary handle's stale &quot;out of memory&quot; errmsg.
Absence of the parameter, or <code>_error_rc=0</code>, preserves the
legacy &quot;errstr: errmsg&quot; form byte-for-byte; existing callers
that parse error strings are unaffected. The driver's
<code>*Error.Code()</code> returns the same SQLite result code in both
modes. Parsed before <code>sqlite3_open_v2</code> so open-time errors
are covered. Resolves [GitLab issue <a
href="https://gitlab.com/cznic/sqlite/issues/230">#230</a>](<a
href="https://gitlab.com/cznic/sqlite/-/issues/230">https://gitlab.com/cznic/sqlite/-/issues/230</a>).</li>
<li>See [GitLab merge request <a
href="https://gitlab.com/cznic/sqlite/issues/129">#129</a>](<a
href="https://gitlab.com/cznic/sqlite/-/merge_requests/129">https://gitlab.com/cznic/sqlite/-/merge_requests/129</a>),
thanks Ian Chechin!</li>
</ul>
</li>
<li>
<p>2026-06-06 v1.52.0:</p>
<ul>
<li>Upgrade to <a
href="https://sqlite.org/releaselog/3_53_2.html">SQLite 3.53.2</a>.</li>
<li>Add <code>Backup.Remaining</code> and <code>Backup.PageCount</code>,
thin wrappers around the existing <code>sqlite3_backup_remaining</code>
and <code>sqlite3_backup_pagecount</code> C symbols. Together they
expose the per-<code>Step</code> progress counters that the underlying
backup object already maintains, enabling progress reporting during
online backups without dropping to <code>modernc.org/sqlite/lib</code>
directly.</li>
<li>See [GitLab merge request <a
href="https://gitlab.com/cznic/sqlite/issues/122">#122</a>](<a
href="https://gitlab.com/cznic/sqlite/-/merge_requests/122">https://gitlab.com/cznic/sqlite/-/merge_requests/122</a>),
thanks Ian Chechin!</li>
<li>Drop the redundant second copy in <code>(*conn).columnText</code>,
the path that backs every <code>Rows.Scan</code> into a Go
<code>string</code> for a TEXT column. The value's bytes are still
copied once out of SQLite-owned memory into a fresh Go buffer; that
buffer is then reinterpreted as the result string with
<code>unsafe.String</code> rather than copied a second time by the
implicit <code>string([]byte)</code> conversion. This removes one
allocation per TEXT value per row and roughly halves the bytes allocated
on that path; on the new <code>BenchmarkColumnTextScan</code> cases it
is ~13–20% faster for payloads of 256 B and larger, with no measurable
change for very short strings. Purely internal: no API or behavioral
change, and the returned string never aliases SQLite's buffer.</li>
<li>See [GitLab merge request <a
href="https://gitlab.com/cznic/sqlite/issues/123">#123</a>](<a
href="https://gitlab.com/cznic/sqlite/-/merge_requests/123">https://gitlab.com/cznic/sqlite/-/merge_requests/123</a>),
thanks Ian Chechin!</li>
<li>Cache each result column's declared type once per result set in
<code>newRows</code> instead of recomputing it on every row. The TEXT
branch of <code>Rows.Next</code> calls
<code>ColumnTypeDatabaseTypeName</code> for every TEXT column on every
row (independent of any DSN flag), which previously did a
<code>libc.GoString</code> + <code>strings.ToUpper</code> each time;
that lookup is now a single index into a cached, pre-uppercased
<code>[]string</code>, and <code>ColumnTypeScanType</code> reads the
same cache and drops its per-call <code>strings.ToLower</code>. The
declared type is fixed for the lifetime of a prepared statement, so the
C round-trip is paid once per column rather than once per column per
row, removing exactly 1 alloc + 8 B per TEXT column per row from the
<code>Next</code> hot path. The new <code>BenchmarkTextToTimeScan</code>
cases show ~7% faster on a 1000-row DATETIME SELECT under
<code>_texttotime=1</code>. Purely internal:
<code>ColumnTypeDatabaseTypeName</code> and
<code>ColumnTypeScanType</code> return identical values, no API or
behavioral change.</li>
<li>See [GitLab merge request <a
href="https://gitlab.com/cznic/sqlite/issues/124">#124</a>](<a
href="https://gitlab.com/cznic/sqlite/-/merge_requests/124">https://gitlab.com/cznic/sqlite/-/merge_requests/124</a>),
thanks Ian Chechin!</li>
<li>Cache, per result column, the <code>parseTimeFormats</code> index
that first parsed a TEXT-stored DATE/DATETIME/TIMESTAMP value, and try
that format first on later rows instead of re-walking the list from the
top. <code>(*conn).parseTime</code> previously ran
<code>time.Parse</code> down the format list on every such row; for the
canonical SQLite TEXT datetime format every row paid two failed
<code>time.Parse</code> attempts — each allocating a
<code>*time.ParseError</code> — before the match. On a 1000-row DATETIME
TEXT SELECT this cuts ~50% of allocs/op and ~57% of B/op and is ~37%
faster. The fall-through chain is preserved exactly: the seven formats
are mutually exclusive, so the cached hint can never select a different
match than the in-order scan, and the parsed <code>driver.Value</code>
is identical to before. Purely internal: no API or behavioral
change.</li>
<li>See [GitLab merge request <a
href="https://gitlab.com/cznic/sqlite/issues/125">#125</a>](<a
href="https://gitlab.com/cznic/sqlite/-/merge_requests/125">https://gitlab.com/cznic/sqlite/-/merge_requests/125</a>),
thanks Ian Chechin!</li>
</ul>
</li>
<li>
<p>2026-05-28 v1.51.0:</p>
<ul>
<li>Pool the <code>[]driver.Value</code> slice passed to
scalar/aggregate UDF callbacks and to vtab
<code>Filter</code>/<code>Insert</code>/<code>Update</code> callbacks,
eliminating the dominant per-row allocation on UDF-heavy queries.
Benchmarks on a 1000-row, 3-arg noop scalar UDF show ~40% fewer bytes/op
and ~15% fewer allocs/op.</li>
<li>Document the matching &quot;arguments are not valid past
return&quot; contract on <code>vtab.Cursor.Filter</code> and
<code>vtab.Updater.Insert</code>/<code>Update</code>, consistent with
the existing rule for <code>FunctionImpl.Scalar</code> /
<code>AggregateFunction.Step</code> / <code>WindowInverse</code>.</li>
<li>Resolves [GitLab issue <a
href="https://gitlab.com/cznic/sqlite/issues/226">#226</a>](<a
href="https://gitlab.com/cznic/sqlite/-/issues/226">https://gitlab.com/cznic/sqlite/-/issues/226</a>).
See [GitLab merge request <a
href="https://gitlab.com/cznic/sqlite/issues/114">#114</a>](<a
href="https://gitlab.com/cznic/sqlite/-/merge_requests/114">https://gitlab.com/cznic/sqlite/-/merge_requests/114</a>),
thanks Ian Chechin!</li>
<li>Add <code>FileControl.FileControlDataVersion</code>, a wrapper
around <code>SQLITE_FCNTL_DATA_VERSION</code> for observing pager-cache
data-version changes, including those made on the same connection.
Useful as a primitive for application-level cache invalidation.</li>
<li>Exposed via the idiomatic <code>database/sql</code> escape hatch
<code>(*sql.Conn).Raw()</code>, consistent with the existing
<code>FileControlPersistWAL</code>.</li>
<li>See [GitLab merge request <a
href="https://gitlab.com/cznic/sqlite/issues/115">#115</a>](<a
href="https://gitlab.com/cznic/sqlite/-/merge_requests/115">https://gitlab.com/cznic/sqlite/-/merge_requests/115</a>),
thanks Ian Chechin!</li>
<li>Fix a regression where in-memory connections (<code>:memory:</code>,
<code>file::memory:</code>, shared-cache memory URIs) were discarded by
<code>database/sql</code> after a context-cancelled query, taking the
entire in-memory store with them. The fix for <a
href="https://gitlab.com/cznic/sqlite/issues/198">#198</a> had added an
<code>sqlite3_is_interrupted</code> check to the connection validator
that mistakenly applied to in-memory connections too, re-introducing the
bug originally fixed by !74. File-backed connections keep the existing
behaviour and are still discarded after an interrupt.</li>
<li>Resolves [GitLab issue <a
href="https://gitlab.com/cznic/sqlite/issues/196">#196</a>](<a
href="https://gitlab.com/cznic/sqlite/-/issues/196">https://gitlab.com/cznic/sqlite/-/issues/196</a>).
See [GitLab merge request <a
href="https://gitlab.com/cznic/sqlite/issues/116">#116</a>](<a
href="https://gitlab.com/cznic/sqlite/-/merge_requests/116">https://gitlab.com/cznic/sqlite/-/merge_requests/116</a>),
thanks Ian Chechin!</li>
<li>Add an opt-in <code>FunctionImpl.VolatileArgs</code> flag that hands
TEXT and BLOB arguments to scalar and aggregate UDF callbacks as
zero-copy views (<code>unsafe.String</code>/<code>unsafe.Slice</code>)
over SQLite's own value buffers, eliminating the per-argument
<code>libc.GoString</code>/<code>make([]byte)</code> copy that the <a
href="https://gitlab.com/cznic/sqlite/issues/226">#226</a> slice-pooling
left as the remaining per-row allocation. On the same 1000-row, 3-arg
(INTEGER/TEXT/BLOB) noop scalar UDF this removes a further ~35% of
allocs/op and ~11% of bytes/op on top of <a
href="https://gitlab.com/cznic/sqlite/issues/226">#226</a>.</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://gitlab.com/cznic/sqlite/commit/6b32d1ee965dfe59bf2e50baeb6f451b67d6a71e"><code>6b32d1e</code></a>
CHANGELOG.md: document experimental freebsd/386 + freebsd/arm (<a
href="https://gitlab.com/cznic/sqlite/issues/119">#119</a>)</li>
<li><a
href="https://gitlab.com/cznic/sqlite/commit/697300ffaa56b03b79e490dc960f218794cb2a75"><code>697300f</code></a>
Merge branch 'dbstatus-binding' into 'master'</li>
<li><a
href="https://gitlab.com/cznic/sqlite/commit/759639fa15658feabd8218bc766768fc383b3c12"><code>759639f</code></a>
sqlite: review fixes for !132 — restore <a
href="https://gitlab.com/cznic/sqlite/issues/131">#131</a> CHANGELOG
link, correct DBStatus...</li>
<li><a
href="https://gitlab.com/cznic/sqlite/commit/40ff0274c43e4f7771456e5c2a06ed669605b797"><code>40ff027</code></a>
sqlite: add DBStatus wrapper for sqlite3_db_status + pcache spill-I/O
benchmark</li>
<li><a
href="https://gitlab.com/cznic/sqlite/commit/6a28fe7d28a1c7de553ae4d9dc797f59c45f3563"><code>6a28fe7</code></a>
HACKING.md: document CHANGELOG versioning + MR integration flow</li>
<li><a
href="https://gitlab.com/cznic/sqlite/commit/adff4b17551c6663f85f2b13400a44887c91a440"><code>adff4b1</code></a>
Merge branch 'pcache-shared-cache-draft' into 'master'</li>
<li><a
href="https://gitlab.com/cznic/sqlite/commit/14e5790eee01be325551a5ffa20d3c9788bc6135"><code>14e5790</code></a>
vendor: regenerate freebsd/arm vec at SQLite 3.53.2</li>
<li><a
href="https://gitlab.com/cznic/sqlite/commit/8725c22279f2bbcac7a9c661787bd3f69d66ea6d"><code>8725c22</code></a>
Add freebsd/386 + freebsd/arm targets</li>
<li><a
href="https://gitlab.com/cznic/sqlite/commit/73050dce0e8a597fea764c9b1d98689d3387f15a"><code>73050dc</code></a>
Merge branch 'pcache-pool-polish' into 'master'</li>
<li><a
href="https://gitlab.com/cznic/sqlite/commit/1897fdd636a034eeb5dde210365c0018ebfae09c"><code>1897fdd</code></a>
CHANGELOG.md: consolidate untagged v1.53.0/v1.54.0 into one v1.53.0
section</li>
<li>Additional commits viewable in <a
href="https://gitlab.com/cznic/sqlite/compare/v1.52.0...v1.53.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-01 22:50:05 +02:00
Nikhil J 81858aa542 docs: fix broken OAuth2/OIDC policy examples (#8840) 
## What / Why

The examples on the OAuth2/OIDC guide (`docs/docs/oauth-oidc.md`) fail
to compile on current OPA (v1+):

1. `claims := jwt.decode(input.token)[1]` uses an undefined built-in.
The correct name is `io.jwt.decode`, which the same page already uses
correctly further down (`jwt_unverified := io.jwt.decode(input.token)`).
2. The `jwt_verified := jwt_unverified { ... }` and `token := t { ... }`
rules are missing the `if` keyword required before a rule body in Rego
v1, so they fail to parse (`'if' keyword is required before rule body`).

## Changes
- `jwt.decode` -> `io.jwt.decode`
- add `if` before the `jwt_verified` and `token` rule bodies

These are minimal, semantics-preserving fixes so the copy-pasteable
examples work on a current OPA release.

Signed-off-by: Nikhil Jathar <22786232+mailnike@users.noreply.github.com>
 2026-07-01 22:03:55 +02:00
John Hooks c498b548ca ecosystem: add Sencillo projects to ecosystem (#8818) 
### What are the changes in this PR?

Just adding a couple of my projects to the ecosystem page.

Signed-off-by: John Hooks <hooksie11@gmail.com>
 2026-07-01 22:02:45 +02:00
Anders Eknert b7c9658c4e perf: reduce allocations in index lookup (#8835) 
While we previously cached and reused trie traveral result from indexing
lookups, simply `clear`ing the tr.unordered map meant we still had to
allocate every time we appended to its slice values. This change fixes
that, along with some general cleanups in index.go — including an
audacious attempt to sneak in `util.Or` from Regal!

The improvement should reflect nicely across many benchmarks in OPA, as
pretty much all evaluations do indexing lookups. The Regal benchmark is
quite convincing, with 800k allocations saved in linting the Regal
bundle:

```
449648097 ns/op    1234775834 B/op    34886194 allocs/op
449672806 ns/op    1226927914 B/op    34045124 allocs/op
```

Signed-off-by: Anders Eknert <anders.eknert@apple.com>
 2026-07-01 19:46:29 +00:00
Jasdeep Singh Bhalla 23a4e62676 Add Dockerfile.rego to validate image builds (#8744) 
OPA's Docker images are built with `docker buildx`, which supports
Rego-based build policies via `Dockerfile.rego`. Adding this file lets
OPA validate its own image builds using OPA — enforcing that base images
come only from the approved chainguard namespace.

Adds `Dockerfile.rego` with a single deny rule: base images must come
from `docker.io/chainguard/`. This covers all four variants built in the
Makefile (`glibc-dynamic`, `glibc-dynamic:latest-dev`, `static`,
`busybox`). Local build context access (used by `COPY`) is allowed
implicitly when no deny rule fires.

The policy follows the same `decision` shape used by buildx's own
`policy/default.rego`. No changes to other files are needed — buildx
automatically evaluates `Dockerfile.rego` when present.

Closes #8401.

Signed-off-by: jasdeepbhalla <jasdeepbhalla@gmail.com>
 2026-07-01 10:42:54 +02:00
Stephan Renatus 39811e50db workflows: prune benchmarks to last 250 runs 
To avoid this:

```
📷 Committing and pushing new benchmark data...
[benchmarks 745914423] add benchmark run for 21fe862a52
 1 file changed, 1 insertion(+)
exit status 1: Cloning into '.'...
Switched to a new branch 'benchmarks'
remote: warning: See https://gh.io/lfs for more information.
remote: warning: File benchmarks.json is 50.29 MB; this is larger than GitHub's recommended maximum file size of 50.00 MB
remote: warning: File 1dfc1e1acb is 50.14 MB; this is larger than GitHub's recommended maximum file size of 50.00 MB
remote: warning: GH001: Large files detected. You may want to try Git Large File Storage - https://git-lfs.github.com.
To https://github.com/open-policy-agent/opa.git
 ! [remote rejected]     benchmarks -> benchmarks (cannot lock ref 'refs/heads/benchmarks': is at 7a136a304d but expected 3fd93c504e)
error: failed to push some refs to 'https://github.com/open-policy-agent/opa.git'
```

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-07-01 10:12:12 +02:00
Johan Fylling 21fe862a52 planner: Support and/or logical operators (#8827) 
Fixes: #8681

---------

Signed-off-by: Johan Fylling <johan.dev@fylling.se>
 2026-07-01 08:30:40 +02:00
dependabot[bot] 1783ac26de build(deps): bump linkify-it from 5.0.0 to 5.0.1 in /docs 
Bumps [linkify-it](https://github.com/markdown-it/linkify-it) from 5.0.0 to 5.0.1.
- [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md)
- [Commits](https://github.com/markdown-it/linkify-it/compare/5.0.0...5.0.1)

---
updated-dependencies:
- dependency-name: linkify-it
  dependency-version: 5.0.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-01 08:30:03 +02:00
Stephan Renatus db8fbb7ea2 Merge pull request #8831 from srenatus/sr/tluunlqkxqmy 
Integrate Patch v1.18.1
 2026-07-01 08:29:02 +02:00
Stephan Renatus dd0f52f38b releng: integrate patch release v1.18.1 
This time via a merge commit. This is an experiment, I think golang
will play nicer with this, since v1.18.1 now is a precendant of main.

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-06-29 14:45:53 +02:00
Stephan Renatus acc8bf9f88 Release v1.18.1 
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
v1.18.1 		2026-06-29 14:43:28 +02:00
Stephan Renatus 713dc6a427 ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle 
AnnotationSet.MergedLabels was introduced in v1.17.0 to cache merged
label maps per rule. It used weak.Pointer[Rule] as the cache key and
registered a runtime.AddCleanup to evict the entry when the rule was
garbage-collected.

The cleanup closure captured `as` (the AnnotationSet pointer). The
AnnotationSet holds strong references to every module it was built
from (as.modules), and each module holds its rules. This meant that
once any rule had a cleanup registered:

  runtime cleanup queue → closure → AnnotationSet → modules → Rule

Rule was always reachable through that path, so the cleanup could
never fire. Nothing would ever delete the closure, so the
AnnotationSet and all of its rules were permanently retained.

In practice, OPA's dynamic bundle plugin recompiles policies on every
poll cycle. Each compilation creates a fresh AnnotationSet. With the
bug, old AnnotationSets accumulated in the heap indefinitely, causing
the OOM-kill pattern reported in #8817.

Fix: drop the cache entirely. MergedLabels now calls Chain and
mergeChainLabels on every invocation. Chain is a handful of map
lookups and MergedLabels is called at most once per evaluated rule per
request, so the recomputation cost is negligible. This removes the
mergedLabels sync.Map field, the ruleLabelsEntry type, and the
runtime/sync/weak imports.

A regression test uses weak.Pointer[AnnotationSet] to assert that an
AnnotationSet is collectable after it goes out of scope.

Fixes #8817
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-06-29 14:43:28 +02:00
Stephan Renatus bfd0d00073 ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle 
AnnotationSet.MergedLabels was introduced in v1.17.0 to cache merged
label maps per rule. It used weak.Pointer[Rule] as the cache key and
registered a runtime.AddCleanup to evict the entry when the rule was
garbage-collected.

The cleanup closure captured `as` (the AnnotationSet pointer). The
AnnotationSet holds strong references to every module it was built
from (as.modules), and each module holds its rules. This meant that
once any rule had a cleanup registered:

  runtime cleanup queue → closure → AnnotationSet → modules → Rule

Rule was always reachable through that path, so the cleanup could
never fire. Nothing would ever delete the closure, so the
AnnotationSet and all of its rules were permanently retained.

In practice, OPA's dynamic bundle plugin recompiles policies on every
poll cycle. Each compilation creates a fresh AnnotationSet. With the
bug, old AnnotationSets accumulated in the heap indefinitely, causing
the OOM-kill pattern reported in #8817.

Fix: drop the cache entirely. MergedLabels now calls Chain and
mergeChainLabels on every invocation. Chain is a handful of map
lookups and MergedLabels is called at most once per evaluated rule per
request, so the recomputation cost is negligible. This removes the
mergedLabels sync.Map field, the ruleLabelsEntry type, and the
runtime/sync/weak imports.

A regression test uses weak.Pointer[AnnotationSet] to assert that an
AnnotationSet is collectable after it goes out of scope.

Fixes #8817
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-06-29 12:42:21 +02:00
Stephan Renatus 9c83b9948a wasm: replace wasmtime-go with wazero (#8815) 
The change replaces bytecodealliance/wasmtime-go/v44 (CGo) with
tetratelabs/wazero (pure Go)

- CGo eliminated — wazero is pure Go, so the whole internal/wasm/sdk
runtime no longer needs a C toolchain/cross-compilation story.
- The "env glue module" trick (glue.go) is the right solution to
wazero's constraint that a HostModuleBuilder can't export memory.
- Process-wide CompilationCache (sync.OnceValue): each unique policy is
compiled once per process, and discarded/re-instantiated VMs are cheap.
- Simplification in vm.go — dropping the ~25 closure fields (evalOneOff,
eval, heapPtrGet, …) in favor of mod.ExportedFunction(name) + a generic
call/callVoid/callOrCancel
- All tests pass (incl. internal/wasm/sdk/internal/wasm,
internal/wasm/sdk/opa). evalCompat for ABI 1.1 is retained.


----------

```
                                │ bf2bb5261c  │             13d2710058             │
                                │    sec/op    │   sec/op     vs base                │
WASMColdStartTargets/topdown-16    112.8µ ± 1%   113.3µ ± 1%        ~ (p=0.512 n=15)
WASMColdStartTargets/wasm-16      10.850m ± 1%   2.906m ± 1%  -73.22% (p=0.000 n=15)
geomean                            1.107m        573.9µ       -48.14%

benchmark \ host                local:tags=opa_wasm
                                            vs base
WASMColdStartTargets/topdown                      ~
WASMColdStartTargets/wasm                   -73.22%

```
```

            │ bf2bb5261c │             13d2710058             │
            │   sec/op    │   sec/op     vs base                │
WasmRego-16   4.976µ ± 1%   3.546µ ± 3%  -28.74% (p=0.000 n=15)

            │ bf2bb5261c  │              13d2710058               │
            │     B/op     │     B/op       vs base                 │
WasmRego-16   2.276Ki ± 0%   13.260Ki ± 0%  +482.50% (p=0.000 n=15)

            │ bf2bb5261c │            13d2710058             │
            │  allocs/op  │ allocs/op   vs base                │
WasmRego-16    46.00 ± 0%   33.00 ± 0%  -28.26% (p=0.000 n=15)

benchmark \ host    local:tags=opa_wasm
                                vs base
WasmRego                        -28.74%
```

> [!NOTE]
> When running benchmarks here, be aware that the memory previously used
was invisible to the benchmark machinery -- it was on the other side of
the CGo divide 🙈

Fixes #7557.

---------

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-06-26 17:40:03 +02:00
Stephan Renatus 65f485d651 docs: document rule indexer support for in, bare refs; modernize rego (#8823) 
This had shipped in
[v1.15.0](https://github.com/open-policy-agent/opa/releases/tag/v1.15.0)
(and been attempted to ship in 1.14.0), but we've forgotten about the
docs 😅

Fixes #8822

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-06-26 15:13:09 +02:00
Johan Fylling 37b14851b8 topdown: and/or expression evaluation (#8793) 
Contains simplified PE: expressions are plugged and saved, but not
optimized. PE optimization to follow in #8680

Signed-off-by: Johan Fylling <johan.dev@fylling.se>
 2026-06-26 14:07:16 +02:00
wasm-updater 6543ddebf6 wasm: Update generated binaries 2026-06-26 08:06:36 +00:00
Anders Eknert 2b18f03b2b topdown: fix "a", "a" in {"a"} not returning true (#8747) 
It's mostly useless, but aren't we all.

Also added benchmarks to make sure I didn't mess anything up. And one or
two tiny but unrelated fixes.

---------

Signed-off-by: Anders Eknert <anders.eknert@apple.com>
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Co-authored-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-06-26 10:04:30 +02:00
Charlie Egan 8b59ff6e48 docs: Updates examples to use some...in, add link to debugger (#8806) 
Based on input from user here in slack:
https://openpolicyagent.slack.com/archives/C08V59T3NAF/p1781788845493869

This also makes some updates based on common topics in the new docs
chat. Some/every appears to be particularly confusing and the
installation instructions might be better if more prominent.

---------

Signed-off-by: Charlie Egan <charlie_egan@apple.com>
 2026-06-26 10:02:39 +02:00
Sebastian Spaink 141fc51bd6 Prepare v1.19.0 development (#8821) 
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
 2026-06-25 16:41:51 -05:00
Sebastian Spaink cc2c5c60a4 Prepare v1.18 release (#8820) 
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
v1.18.0 		2026-06-25 12:10:29 -05:00
安妮的心动录 e72a98fb10 format: keep lone with on the closing-bracket line of multi-line expressions (#8805) 
## What

`opa fmt` repositions a lone trailing `with` onto its own indented line
when the expression it modifies spans multiple lines (a wrapped function
call ending in `)`, or an `every`/block ending in `}`).

Given:
```rego
result_a if {
	foo(
		arg_a,
		bar(arg_b, arg_c),
		"some message",
	) with input.x as false
}
```
`opa fmt` (1.16+) ejects the `with`:
```rego
	)
		with input.x as false
```
This makes already-formatted files non-idempotent after the Regal 0.40 →
0.41 upgrade (which bundles OPA ≤1.15 → ≥1.16), even though no
`tools/opa` bump is involved.

## Why

#8508 added the rule that the first `with` stays inline only when
`withs[0].Location.Row == expr.Location.Row`. That compares against the
expression's **start** row. For a multi-line expression the lone `with`
sits on the **closing-bracket** row, so the equality fails and the
`with` is indented — pure churn, since with a single `with` there's no
alignment to gain.

## Fix

Compare against the row where the expression's terms end (the
closing-bracket row) instead of where they begin. The new helper
`exprTermsEndRow` derives it from the expression text up to the first
`with` (`expr.Location.Text` spans the `with` clauses, so they're
trimmed off via the first `with`'s offset). Single-line expressions are
unchanged, and a `with` the author deliberately placed on its own line
below the expression is still indented (the behaviour #8508 added). For
multiple `with`s, the first stays on the bracket line and the rest align
below it.

## Tests

Added multi-line cases (`)`-ending call and `}`-ending `every` block) to
the `v0`/`v1` `test_with` format fixtures.
`testfiles/v1/test_not_future_import.rego.formatted` is updated: its
source already had `} with input.y as 5 …` on the closing-brace line and
the fixture had baked in the buggy ejection — it now stays on the brace
line. All format fixtures round-trip (idempotent).

Fixes #8804

<!--
oss-radar:idempotency=auto-20260622-151524.w1.open-policy-agent_opa.8804
-->

Signed-off-by: Charles Cheng <charlescheng@rezona.ai>
 2026-06-24 09:00:40 -05:00
Johan Fylling 03646dde18 topdown: Fix PE not namespacing vars in comprehensions nested inside every (#8816) 
Partial-eval doesn't properly namespace in-scope vars inside
comprehensions when they're nested inside an `every` statement.

E.g. PE on `data.test.p = true` for the policy:

```rego
package test
p if {
	every x in input.x {
		{y | y := input.y; y < x}
	}
}
```

will emit:

```rego
every __local0__1, __local1__1 in input.x { 
	{__local2__ | __local2__ = input.y; lt(__local2__, __local1__)} 
}
```

Notice how the comprehension makes a reference to `__local1__`, which
has been namespaced to `__local1__1` in the outer scope, making the
result query invalid.

This fix checks for comprehension terms inside the `every`-body and
amends them. Which gives us the updated result query:

```rego
every __local0__1, __local1__1 in input.x {
 	{__local2__1 | __local2__1 = input.y; lt(__local2__1, __local1__1)}
 }
```

where vars inside the comprehension are now namespaced.

Note: this is a pretty narrow edge-case, so I wouldn't expect many real
cases in the wild.

---------

Signed-off-by: Johan Fylling <johan.dev@fylling.se>
 2026-06-24 13:22:47 +02:00
Stephan Renatus bf2bb5261c benchmarks: split off script, emit markdown table 
Follow-up to #8811.

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-06-23 16:03:42 +02:00
Sebastian Spaink 02ce276093 version: fix ill-formed User-Agent header (#8796) 
resolve: https://github.com/open-policy-agent/opa/issues/8792

I added a note in the Changelog that should hopefully be enough?

---------

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
 2026-06-23 14:18:19 +01:00
dependabot[bot] 1fdbb77dd6 build(deps): bump the dependencies group across 2 directories with 6 updates 
Bumps the dependencies group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/dgraph-io/badger/v4](https://github.com/dgraph-io/badger) | `4.9.1` | `4.9.2` |
| [github.com/vektah/gqlparser/v2](https://github.com/vektah/gqlparser) | `2.5.33` | `2.5.34` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.20.0` | `0.21.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.37.0` | `0.38.0` |
| gopkg.in/ini.v1 | `1.67.2` | `1.67.3` |

Bumps the dependencies group with 1 update in the /e2e directory: [modernc.org/sqlite](https://gitlab.com/cznic/sqlite).


Updates `github.com/dgraph-io/badger/v4` from 4.9.1 to 4.9.2
- [Release notes](https://github.com/dgraph-io/badger/releases)
- [Changelog](https://github.com/dgraph-io/badger/blob/main/CHANGELOG.md)
- [Commits](https://github.com/dgraph-io/badger/compare/v4.9.1...v4.9.2)

Updates `github.com/vektah/gqlparser/v2` from 2.5.33 to 2.5.34
- [Release notes](https://github.com/vektah/gqlparser/releases)
- [Commits](https://github.com/vektah/gqlparser/compare/v2.5.33...v2.5.34)

Updates `golang.org/x/sync` from 0.20.0 to 0.21.0
- [Commits](https://github.com/golang/sync/compare/v0.20.0...v0.21.0)

Updates `golang.org/x/text` from 0.37.0 to 0.38.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](https://github.com/golang/text/compare/v0.37.0...v0.38.0)

Updates `gopkg.in/ini.v1` from 1.67.2 to 1.67.3

Updates `modernc.org/sqlite` from 1.51.0 to 1.52.0
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.51.0...v1.52.0)

---
updated-dependencies:
- dependency-name: github.com/dgraph-io/badger/v4
  dependency-version: 4.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: github.com/vektah/gqlparser/v2
  dependency-version: 2.5.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: golang.org/x/sync
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: golang.org/x/text
  dependency-version: 0.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: gopkg.in/ini.v1
  dependency-version: 1.67.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: modernc.org/sqlite
  dependency-version: 1.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-23 14:55:09 +02:00
Charlie Egan 954196aaa4 cover: Add support for coverage of conjunction exprs (#8809) 
This changes how files like this are covered

```rego
package example

allow if {
  true; true; false; false
  ^^^^^^^^^^^^^^^^^^ -- covered
                     ^^^^^^ -- not covered, after this PR, previously no annotation. 
}
```

<img width="3456" height="1360" alt="Screenshot 8"
src="https://github.com/user-attachments/assets/0a6eaa9b-1d17-42f2-a670-f1fb7e739f87"
/>

I have also refactored some test cases in the cover package.

---------

Signed-off-by: Charlie Egan <charlie_egan@apple.com>
 2026-06-23 14:36:50 +02:00
Sebastian Spaink dec8333b32 deduplicate change-detection output in pr CI checks (#8808) 
follow up to this suggestion from @srenatus:
https://github.com/open-policy-agent/opa/pull/8775#discussion_r3440627903

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
 2026-06-23 14:35:20 +02:00
Stephan Renatus 09679abd11 benchmarks: use details+summary comments for benchlab results (#8811) 
This is how it looked previously:
https://github.com/open-policy-agent/opa/pull/8752#issuecomment-4662153981

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-06-23 09:59:33 +01:00
dependabot[bot] 57742e84a9 build(deps): bump webpack-dev-server from 5.2.4 to 5.2.5 in /docs (#8807) 
Bumps
[webpack-dev-server](https://github.com/webpack/webpack-dev-server) from
5.2.4 to 5.2.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/webpack/webpack-dev-server/releases">webpack-dev-server's
releases</a>.</em></p>
<blockquote>
<h2>v5.2.5</h2>
<h3>Patch Changes</h3>
<ul>
<li>Skip the HMR WebSocket path when forwarding upgrade requests to
user-defined proxies, so custom proxy WebSocket upgrades are no longer
intercepted by the dev server. (by <a
href="https://github.com/bjohansebas"><code>@​bjohansebas</code></a> in
<a
href="https://redirect.github.com/webpack/webpack-dev-server/pull/5680">#5680</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md">webpack-dev-server's
changelog</a>.</em></p>
<blockquote>
<h2>5.2.5</h2>
<h3>Patch Changes</h3>
<ul>
<li>Skip the HMR WebSocket path when forwarding upgrade requests to
user-defined proxies, so custom proxy WebSocket upgrades are no longer
intercepted by the dev server. (by <a
href="https://github.com/bjohansebas"><code>@​bjohansebas</code></a> in
<a
href="https://redirect.github.com/webpack/webpack-dev-server/pull/5680">#5680</a>)</li>
</ul>
<p>All notable changes to this project will be documented in this file.
See <a
href="https://github.com/conventional-changelog/standard-version">standard-version</a>
for commit guidelines.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/webpack/webpack-dev-server/commit/c3ee325819f64ceb77f85dcf727b6b5ede85cbc4"><code>c3ee325</code></a>
chore(release): new release (<a
href="https://redirect.github.com/webpack/webpack-dev-server/issues/5682">#5682</a>)</li>
<li><a
href="https://github.com/webpack/webpack-dev-server/commit/60173be90873b187b41fc2009a4de253732988a1"><code>60173be</code></a>
feat: add changeset validation and release workflow (<a
href="https://redirect.github.com/webpack/webpack-dev-server/issues/5680">#5680</a>)</li>
<li><a
href="https://github.com/webpack/webpack-dev-server/commit/948d5e6089bebcd801dac2cbe3ed4f80b64f117a"><code>948d5e6</code></a>
fix(proxy): match the HMR upgrade path exactly like the ws server (<a
href="https://redirect.github.com/webpack/webpack-dev-server/issues/5678">#5678</a>)</li>
<li><a
href="https://github.com/webpack/webpack-dev-server/commit/93e8996124332a6c94c4d3e0f8e5f2cf95321c67"><code>93e8996</code></a>
fix: skip HMR websocket path when forwarding upgrades to user-defined
proxies...</li>
<li>See full diff in <a
href="https://github.com/webpack/webpack-dev-server/compare/v5.2.4...v5.2.5">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for webpack-dev-server since your current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=webpack-dev-server&package-manager=npm_and_yarn&previous-version=5.2.4&new-version=5.2.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/open-policy-agent/opa/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-22 10:08:13 -05:00
Sebastian Spaink 0e6fe9caa2 Add proto schemas for the IR plan and bundle manifest (#8775) 
This adds two new proto schemas:

* v1/bundle/manifest.proto
* v1/ir/plan.proto

---------

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
 2026-06-22 10:02:15 -05:00
dependabot[bot] 1a68282b0c build(deps): bump dompurify from 3.4.10 to 3.4.11 in /docs (#8803) 
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.10 to
3.4.11.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/cure53/DOMPurify/releases">dompurify's
releases</a>.</em></p>
<blockquote>
<h2>DOMPurify 3.4.11</h2>
<ul>
<li>Fixed an issue with a leaky config for hooks via
<code>setConfig</code>, thanks <a
href="https://github.com/trace37labs"><code>@​trace37labs</code></a></li>
<li>Bumped vulnerable development dependencies to arrive at plain 0 with
<code>npm audit</code></li>
<li>Updated the <code>osv-scanner</code> suppression list as no
vulnerable dependencies are left for now</li>
<li>Updated up the linting tool-chain and removed now-redundant lint
directives</li>
<li>Updated the documentation is several spots, README, wiki, etc.</li>
<li>Bumped several dependencies where possible</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/cure53/DOMPurify/commit/0cae5187403132f96a6d357649e4b15633fc210a"><code>0cae518</code></a>
release: 3.4.11 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1494">#1494</a>)</li>
<li>See full diff in <a
href="https://github.com/cure53/DOMPurify/compare/3.4.10...3.4.11">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=dompurify&package-manager=npm_and_yarn&previous-version=3.4.10&new-version=3.4.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/open-policy-agent/opa/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-22 09:55:25 -05:00
Shuvam Pal 1dcdacbe32 fmt: preserve the multiline but single entry iterables (#8663) 
Fixes #8557.

`opa fmt` collapsed single-entry arrays/objects into one line even when
the original source spanned multiple rows, making deeply nested
structures hard to read. This maintains the structure.

Signed-off-by: unichronic <ishuvam.pal@gmail.com>
 2026-06-22 09:21:48 -05:00
Stephan Renatus f75131f0e5 topdown: skip strconv.ParseInt in format_int base-10 fast path (#8801) 
For number inputs whose decimal string is already interned (0–100),
builtinFormatInt was round-tripping through strconv.ParseInt to get an
int, only to convert it straight back to a string in
InternedIntegerString.

Add InternedStringTermFromNumber which looks up the interned string term
directly from the Number's underlying string, skipping the parse step.

```
goos: darwin
goarch: arm64
pkg: github.com/open-policy-agent/opa/v1/topdown
cpu: Apple M4 Max
             │ ../scratch/f10_main.bench │       ../scratch/f10_pr.bench       │
             │          sec/op           │   sec/op     vs base                │
FormatInt-16                 19.48n ± 3%   10.99n ± 1%  -43.56% (p=0.000 n=10)

             │ ../scratch/f10_main.bench │    ../scratch/f10_pr.bench     │
             │           B/op            │    B/op     vs base            │
FormatInt-16                  0.000 ± 0%   0.000 ± 0%  ~ (p=1.000 n=10) ¹
¹ all samples are equal

             │ ../scratch/f10_main.bench │    ../scratch/f10_pr.bench     │
             │         allocs/op         │ allocs/op   vs base            │
FormatInt-16                  0.000 ± 0%   0.000 ± 0%  ~ (p=1.000 n=10) ¹
¹ all samples are equal
```

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
 2026-06-18 19:13:23 +02:00
SEONGHYUN HONG f4121fb38f docs: remove duplicated word in Rego style guide (#8800) 
The Rego style guide reads "will fail both in the the undefined case" —
removed the duplicated "the".

Signed-off-by: s3onghyun <s3onghyun.hong@gmail.com>
 2026-06-18 11:41:01 -05:00
Sebastian Spaink b0c824b1a9 fix per-module rego version lookup (#8799) 
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
 2026-06-18 11:36:35 -05:00
Sebastian Spaink 93d6984466 Integrate 1.17.1 patch release (#8798) 
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
 2026-06-18 07:37:36 +02:00
dependabot[bot] bfda58ebaf build(deps): bump the gha-dependencies group with 2 updates (#8770) 
Bumps the gha-dependencies group with 2 updates:
[jdx/mise-action](https://github.com/jdx/mise-action) and
[github/codeql-action](https://github.com/github/codeql-action).

Updates `jdx/mise-action` from 4.0.1 to 4.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jdx/mise-action/releases">jdx/mise-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.0: automatic --locked installs</h2>
<p>This release adds automatic locked installs when a
<code>mise.lock</code> is present, and fixes a long-standing cache-key
collision that could poison tool installs when workflows migrate between
runner providers.</p>
<h2>Added</h2>
<h3>Automatic <code>--locked</code> install when <code>mise.lock</code>
exists (<a
href="https://redirect.github.com/jdx/mise-action/pull/495">#495</a>) by
<a
href="https://github.com/zeitlinger"><code>@​zeitlinger</code></a></h3>
<p>When a repo contains <code>mise.lock</code>, the action now
automatically passes <code>--locked</code> to <code>mise install</code>
(on mise versions that support it). This removes the need to manually
set <code>install_args: --locked</code> and prevents <code>mise
install</code> from silently mutating the lockfile in CI. Explicit
<code>install_args</code> and older mise versions are still
respected.</p>
<p>Note: workflows with a stale lockfile may now fail earlier and more
explicitly instead of silently updating <code>mise.lock</code> mid-run —
this surfaces lockfile drift rather than hiding it.</p>
<h2>Fixed</h2>
<ul>
<li><strong>Cache key collisions across runner providers</strong> (<a
href="https://redirect.github.com/jdx/mise-action/pull/456">#456</a>) —
the default cache key now includes the runner image (e.g.
<code>macos15</code>, <code>ubuntu24</code> for GitHub-hosted runners;
<code>self-hosted</code> otherwise). Previously, repos migrating between
providers like github-hosted, namespace.so, BuildJet, and self-hosted
runners with the same OS/arch could restore a peer provider's
<code>~/.local/share/mise/installs/*</code>, causing failures like
<code>does not have an executable named '…'</code> or SIGILL crashes
from binaries built against a different glibc/CPU featureset. Expect a
one-time cache miss after upgrading; thereafter the cache stays scoped
per image.</li>
<li><strong><code>mise-shim.exe</code> missing on Windows</strong> (<a
href="https://redirect.github.com/jdx/mise-action/pull/476">#476</a>) by
<a href="https://github.com/risu729"><code>@​risu729</code></a> — the
action now installs <code>mise-shim.exe</code> alongside
<code>mise.exe</code> and repairs restored caches that lack the shim.
Fixes <a
href="https://redirect.github.com/jdx/mise-action/issues/475">#475</a>.</li>
</ul>
<h2>Changed</h2>
<ul>
<li>Migrated the bundled action build from ncc (CommonJS) to Rollup
(ESM) (<a
href="https://redirect.github.com/jdx/mise-action/pull/436">#436</a>).
No user-facing behavior change.</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jdx/mise-action/compare/v4.0.1...v4.1.0">https://github.com/jdx/mise-action/compare/v4.0.1...v4.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jdx/mise-action/blob/main/CHANGELOG.md">jdx/mise-action's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<hr />
<h2><a
href="https://github.com/jdx/mise-action/compare/v4.0.1..v4.1.0">4.1.0</a>
- 2026-06-04</h2>
<h3>🚀 Features</h3>
<ul>
<li>add wings_enabled input (mise-wings cache integration) (<a
href="https://redirect.github.com/jdx/mise-action/issues/454">#454</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/454">#454</a></li>
<li>lock install when mise.lock is present (<a
href="https://redirect.github.com/jdx/mise-action/issues/495">#495</a>)
by <a href="https://github.com/zeitlinger"><code>@​zeitlinger</code></a>
in <a
href="https://redirect.github.com/jdx/mise-action/pull/495">#495</a></li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li><strong>(ci)</strong> add gh auth setup-git to release-plz.sh (<a
href="https://redirect.github.com/jdx/mise-action/issues/473">#473</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/473">#473</a></li>
<li><strong>(ci)</strong> pin codeql-action with exact version comment
(<a
href="https://redirect.github.com/jdx/mise-action/issues/481">#481</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/481">#481</a></li>
<li>include runner image in cache key to prevent cross-provider
collisions (<a
href="https://redirect.github.com/jdx/mise-action/issues/456">#456</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/456">#456</a></li>
<li>install mise-shim.exe on Windows (<a
href="https://redirect.github.com/jdx/mise-action/issues/476">#476</a>)
by <a href="https://github.com/risu729"><code>@​risu729</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/476">#476</a></li>
</ul>
<h3>⚙️ Miscellaneous Tasks</h3>
<ul>
<li><strong>(ci)</strong> use !cancelled() instead of always() for final
job (<a
href="https://redirect.github.com/jdx/mise-action/issues/460">#460</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/460">#460</a></li>
<li><strong>(ci)</strong> remove autofix.ci workflow (<a
href="https://redirect.github.com/jdx/mise-action/issues/470">#470</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/470">#470</a></li>
<li><strong>(ci)</strong> add zizmor workflow for github actions
security analysis (<a
href="https://redirect.github.com/jdx/mise-action/issues/471">#471</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/471">#471</a></li>
<li><strong>(ci)</strong> close failing or conflicted PRs sooner (<a
href="https://redirect.github.com/jdx/mise-action/issues/480">#480</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/480">#480</a></li>
<li>add communique to enhance release notes (<a
href="https://redirect.github.com/jdx/mise-action/issues/411">#411</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/411">#411</a></li>
<li>migrate from ncc (CJS) to rollup (ESM) (<a
href="https://redirect.github.com/jdx/mise-action/issues/436">#436</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/436">#436</a></li>
<li>add final job to aggregate build-test results (<a
href="https://redirect.github.com/jdx/mise-action/issues/438">#438</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/438">#438</a></li>
<li>migrate package manager from npm/pnpm/bun to aube (<a
href="https://redirect.github.com/jdx/mise-action/issues/455">#455</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/455">#455</a></li>
<li>remove pull_request_target workflow (<a
href="https://redirect.github.com/jdx/mise-action/issues/469">#469</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/469">#469</a></li>
<li>update aube tool version (<a
href="https://redirect.github.com/jdx/mise-action/issues/501">#501</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/501">#501</a></li>
</ul>
<hr />
<h2><a
href="https://github.com/jdx/mise-action/compare/v4.0.0..v4.0.1">4.0.1</a>
- 2026-03-22</h2>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>run npm install in pre-commit hook before build (<a
href="https://redirect.github.com/jdx/mise-action/issues/410">#410</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/410">#410</a></li>
</ul>
<h3>🚜 Refactor</h3>
<ul>
<li>extract getCwd() helper to deduplicate working directory resolution
(<a
href="https://redirect.github.com/jdx/mise-action/issues/403">#403</a>)
by <a href="https://github.com/altendky"><code>@​altendky</code></a> in
<a
href="https://redirect.github.com/jdx/mise-action/pull/403">#403</a></li>
</ul>
<h3>📚 Documentation</h3>
<ul>
<li>bump versions listed im README.md (<a
href="https://redirect.github.com/jdx/mise-action/issues/407">#407</a>)
by <a href="https://github.com/deining"><code>@​deining</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/407">#407</a></li>
<li>bump more versions listed in README.md (<a
href="https://redirect.github.com/jdx/mise-action/issues/408">#408</a>)
by <a href="https://github.com/deining"><code>@​deining</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/408">#408</a></li>
</ul>
<h3>⚙️ Miscellaneous Tasks</h3>
<ul>
<li>add workflow to auto-close stale PRs (<a
href="https://redirect.github.com/jdx/mise-action/issues/409">#409</a>)
by <a href="https://github.com/jdx"><code>@​jdx</code></a> in <a
href="https://redirect.github.com/jdx/mise-action/pull/409">#409</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jdx/mise-action/commit/dba19683ed58901619b14f395a24841710cb4925"><code>dba1968</code></a>
chore: release v4.1.0 (<a
href="https://redirect.github.com/jdx/mise-action/issues/490">#490</a>)</li>
<li><a
href="https://github.com/jdx/mise-action/commit/f91a09d9ef7e5b4ce6e5df3bd166d39901d95f80"><code>f91a09d</code></a>
fix(ci): resolve zizmor findings (<a
href="https://redirect.github.com/jdx/mise-action/issues/503">#503</a>)</li>
<li><a
href="https://github.com/jdx/mise-action/commit/a9d72a2ac56857d83f06a89da8b45386a519541e"><code>a9d72a2</code></a>
chore(deps): update github/codeql-action action to v4.36.0 (<a
href="https://redirect.github.com/jdx/mise-action/issues/500">#500</a>)</li>
<li><a
href="https://github.com/jdx/mise-action/commit/1f56d953238b8d47fa71c5f59d86a41a4f1f9b30"><code>1f56d95</code></a>
chore(deps): update dependency <code>@​actions/cache</code> to v6.0.1
(<a
href="https://redirect.github.com/jdx/mise-action/issues/497">#497</a>)</li>
<li><a
href="https://github.com/jdx/mise-action/commit/e47eed9a5f11d7b1c4e4a27e094fdee05dfb6db3"><code>e47eed9</code></a>
chore: update aube tool version (<a
href="https://redirect.github.com/jdx/mise-action/issues/501">#501</a>)</li>
<li><a
href="https://github.com/jdx/mise-action/commit/69c24ed9206bc145dcdd8fa072fc6031ceb14c8d"><code>69c24ed</code></a>
chore(deps): update dependency aube to v1.15.0 (<a
href="https://redirect.github.com/jdx/mise-action/issues/498">#498</a>)</li>
<li><a
href="https://github.com/jdx/mise-action/commit/76f84078a8bb3d593bdc3ba28edbfeea1882fcae"><code>76f8407</code></a>
chore(deps): update zizmorcore/zizmor-action action to v0.5.4 (<a
href="https://redirect.github.com/jdx/mise-action/issues/488">#488</a>)</li>
<li><a
href="https://github.com/jdx/mise-action/commit/4a84c91c82fa1e7d0a1ea17ff19af79ab26643a1"><code>4a84c91</code></a>
chore(deps): update dependency eslint to v10.4.0 (<a
href="https://redirect.github.com/jdx/mise-action/issues/492">#492</a>)</li>
<li><a
href="https://github.com/jdx/mise-action/commit/4d5418b7bac561ef4739f99987686d4b21475743"><code>4d5418b</code></a>
chore(deps): update dependency <code>@​types/node</code> to v24.12.4 (<a
href="https://redirect.github.com/jdx/mise-action/issues/485">#485</a>)</li>
<li><a
href="https://github.com/jdx/mise-action/commit/e6760994f7823b9dc6217632e727fb1ff323c0c0"><code>e676099</code></a>
chore(deps): update dependency typescript-eslint to v8.59.3 (<a
href="https://redirect.github.com/jdx/mise-action/issues/487">#487</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/jdx/mise-action/compare/1648a7812b9aeae629881980618f079932869151...dba19683ed58901619b14f395a24841710cb4925">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action` from 4.36.1 to 4.36.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.36.2</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.36.2 - 04 Jun 2026</h2>
<ul>
<li>Cache CodeQL CLI version information across Actions steps. <a
href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li>
<li>Reduce requests while waiting for analysis processing by using
exponential backoff when polling SARIF processing status. <a
href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li>
</ul>
<h2>4.36.1 - 02 Jun 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.0 - 22 May 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.19.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li>
<li>Add support for SHA-256 Git object IDs. <a
href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li>
</ul>
<h2>4.35.5 - 15 May 2026</h2>
<ul>
<li>We have improved how the JavaScript bundles for the CodeQL Action
are generated to avoid duplication across bundles and reduce the size of
the repository by around 70%. This should have no effect on the runtime
behaviour of the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li>
<li>For performance and accuracy reasons, <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> will now only be enabled on a pull request when
diff-informed analysis is also enabled for that run. If diff-informed
analysis is unavailable (for example, because the PR diff ranges could
not be computed), the action will fall back to a full analysis. <a
href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li>
<li>If multiple inputs are provided for the GitHub-internal
<code>analysis-kinds</code> input, only <code>code-scanning</code> will
be enabled. The <code>analysis-kinds</code> input is experimental, for
GitHub-internal use only, and may change without notice at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li>
<li>Added an experimental change which, when running a Code Scanning
analysis for a PR with <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> enabled, prefers CodeQL CLI versions that have
a cached overlay-base database for the configured languages. This speeds
up analysis for a repository when there is not yet a cached overlay-base
database for the latest CLI version. We expect to roll this change out
to everyone in May. <a
href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li>
</ul>
<h2>4.35.4 - 07 May 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li>
</ul>
<h2>4.35.3 - 01 May 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.19.3 and earlier. These versions of
CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise
Server 3.15, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li>
<li>Configurations for private registries that use Cloudsmith or GCP
OIDC are now accepted. <a
href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li>
<li>Best-effort connection tests for private registries now use
<code>GET</code> requests instead of <code>HEAD</code> for better
compatibility with various registry implementations. For NuGet feeds,
the test is now always performed against the service index. <a
href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li>
<li>Fixed a bug where two diagnostics produced within the same
millisecond could overwrite each other on disk, causing one of them to
be lost. <a
href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li>
</ul>
<h2>4.35.2 - 15 Apr 2026</h2>
<ul>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable is deprecated and will be removed in May 2026. If you are
affected by this, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li>
<li>The Git version 2.36.0 requirement for improved incremental analysis
now only applies to repositories that contain submodules. <a
href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li>
<li>Python analysis on GHES no longer extracts the standard library,
relying instead on models of the standard library. This should result in
significantly faster extraction and analysis times, while the effect on
alerts should be minimal. <a
href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li>
<li>Fixed a bug in the validation of OIDC configurations for private
registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/8aad20d150bbac5944a9f9d289da16a4b0d87c1e"><code>8aad20d</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3949">#3949</a>
from github/update-v4.36.2-dcb947ce1</li>
<li><a
href="https://github.com/github/codeql-action/commit/f521b08cd8f468ab193ea950a589cb2e9c869c6a"><code>f521b08</code></a>
Add additional changelog notes</li>
<li><a
href="https://github.com/github/codeql-action/commit/8aeff0ffb7b78582ee0d0e6eebb8140684400d08"><code>8aeff0f</code></a>
Update changelog for v4.36.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/dcb947ce15976d40ea82935510b2db4872ec124c"><code>dcb947c</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3948">#3948</a>
from github/update-bundle/codeql-bundle-v2.25.6</li>
<li><a
href="https://github.com/github/codeql-action/commit/c251bcefa178f7780f62f150002acffe3d07fde9"><code>c251bce</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/62953c18b35f59e28351d2f1e806925aef8b1e3c"><code>62953c1</code></a>
Update default bundle to codeql-bundle-v2.25.6</li>
<li><a
href="https://github.com/github/codeql-action/commit/423b570baf1976cd7a3daeba5d6e9f9b76432f37"><code>423b570</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3946">#3946</a>
from github/dependabot/npm_and_yarn/npm-minor-5d507a...</li>
<li><a
href="https://github.com/github/codeql-action/commit/c35d1b164463ee62a100735382aaaa525c5d3496"><code>c35d1b1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3947">#3947</a>
from github/dependabot/github_actions/dot-github/wor...</li>
<li><a
href="https://github.com/github/codeql-action/commit/cb1a588b02755b176e7b9d033ed4b69312f0e1bd"><code>cb1a588</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3937">#3937</a>
from github/robertbrignull/waitForProcessing_backoff</li>
<li><a
href="https://github.com/github/codeql-action/commit/ba47406412c54532b5b4fcfbaf877c9e2382b206"><code>ba47406</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3943">#3943</a>
from github/henrymercer/cache-cli-version-info</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/87557b9c84dde89fdd9b10e88954ac2f4248e463...8aad20d150bbac5944a9f9d289da16a4b0d87c1e">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Charlie Egan <charlie_egan@apple.com>
 2026-06-17 11:37:20 +01:00
dependabot[bot] 1f9005b77a build(deps): bump hono from 4.12.23 to 4.12.25 in /e2e/api/compile/prisma (#8794) 
Bumps [hono](https://github.com/honojs/hono) from 4.12.23 to 4.12.25.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.25</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>CORS Middleware reflects any Origin with credentials when
<code>origin</code> defaults to the wildcard</h3>
<p>Affects: <code>hono/cors</code>. Fixes the wildcard origin reflecting
the request <code>Origin</code> and sending
<code>Access-Control-Allow-Credentials: true</code> when
<code>credentials: true</code> is set without an explicit
<code>origin</code>, where any site a logged-in user visited could make
credentialed cross-origin requests and read responses from
cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc</p>
<h3>Body Limit Middleware can be bypassed on AWS Lambda by understating
<code>Content-Length</code></h3>
<p>Affects: <code>hono/body-limit</code> on AWS Lambda
(<code>hono/aws-lambda</code>, <code>hono/lambda-edge</code>). Fixes the
request being built with the client-declared <code>Content-Length</code>
while the body is delivered fully buffered, where a client could declare
a small <code>Content-Length</code> with a much larger body and slip
past the configured size limit. GHSA-rv63-4mwf-qqc2</p>
<h3>Path traversal in <code>serve-static</code> on Windows via encoded
backslash (<code>%5C</code>)</h3>
<p>Affects: <code>serveStatic</code> on Windows (Node, Bun, Deno
adapters). Fixes the path guard allowing a lone backslash, where an
encoded backslash (<code>%5C</code>) decoded to <code>\</code> was
treated as a separator by the Windows path resolver, letting a single
URL segment escape into a middleware-guarded subtree.
GHSA-wwfh-h76j-fc44</p>
<h3>AWS Lambda adapter merges multiple <code>Set-Cookie</code> headers
into one value, dropping cookies on ALB single-header and Lattice</h3>
<p>Affects: <code>hono/aws-lambda</code>. Fixes multiple
<code>Set-Cookie</code> response headers being joined into one
comma-separated value for ALB single-header responses and VPC Lattice
v2, where the value could not be split back into individual cookies and
clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf</p>
<h3>Lambda@Edge adapter keeps only the last value of a repeated request
header, dropping the rest</h3>
<p>Affects: <code>hono/lambda-edge</code>. Fixes repeated request
headers being written with overwrite instead of append, where only the
last value of a header such as <code>X-Forwarded-For</code> reached the
application and the remaining values were silently dropped.
GHSA-wgpf-jwqj-8h8p</p>
<h2>v4.12.24</h2>
<h2>What's Changed</h2>
<ul>
<li>docs(contribution): simplifyAI Usage Policy by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4972">honojs/hono#4972</a></li>
<li>chore: remove <code>@​types/glob</code> by <a
href="https://github.com/rtritto"><code>@​rtritto</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4978">honojs/hono#4978</a></li>
<li>fix(bearer-auth): mention verifyToken in missing-options error
message by <a
href="https://github.com/tan7vir"><code>@​tan7vir</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4987">honojs/hono#4987</a></li>
<li>refactor(language): Test/improve tests on languages middleware by <a
href="https://github.com/iNeoO"><code>@​iNeoO</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4980">honojs/hono#4980</a></li>
<li>fix(utils/ipaddr): expand &quot;::&quot; to eight zero groups by <a
href="https://github.com/youcefzemmar"><code>@​youcefzemmar</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4973">honojs/hono#4973</a></li>
<li>fix: clean up config files trailing comma, stale excludes,
typesVersions gaps, jsr paths by <a
href="https://github.com/Mohammad-Faiz-Cloud-Engineer"><code>@​Mohammad-Faiz-Cloud-Engineer</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4982">honojs/hono#4982</a></li>
<li>refactor(timing): Test/add test for middleware timing by <a
href="https://github.com/iNeoO"><code>@​iNeoO</code></a> in <a
href="https://redirect.github.com/honojs/hono/pull/4991">honojs/hono#4991</a></li>
<li>fix(utils/ipaddr): render the unspecified address binary as
&quot;::&quot; by <a
href="https://github.com/sarathfrancis90"><code>@​sarathfrancis90</code></a>
in <a
href="https://redirect.github.com/honojs/hono/pull/4998">honojs/hono#4998</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.23...v4.12.24">https://github.com/honojs/hono/compare/v4.12.23...v4.12.24</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/hono/commit/fce483e11466b72d27e61d44523c7e6edeb19e50"><code>fce483e</code></a>
4.12.25</li>
<li><a
href="https://github.com/honojs/hono/commit/751ba41ba26dff20351a13964c07627ddcf382b6"><code>751ba41</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/f0b094db8474696344d98e5665a4ac2a6d5f346e"><code>f0b094d</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/fa5f9bfcc25d65e08af85211cc2e5ecd0e0ea24b"><code>fa5f9bf</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/3892a6c2b54f974505de41013fcac88a71908e3d"><code>3892a6c</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/74c2cf8ef4f5cc29a876380df1ba230ff7128b3f"><code>74c2cf8</code></a>
test(aws-lambda): update integration tests (<a
href="https://redirect.github.com/honojs/hono/issues/5012">#5012</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/7ae7cbae5d0ed8a40e8b9cc353e13175b9d7e3e1"><code>7ae7cba</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/1b1384815485f9d6590c6966e23a06fd07166cb7"><code>1b13848</code></a>
chore(ci): bump codecov-action to v7.0.0 (<a
href="https://redirect.github.com/honojs/hono/issues/5011">#5011</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/5fdde5ab5a7d7c89eba4d1ceab76f4a7c011cd3b"><code>5fdde5a</code></a>
4.12.24</li>
<li><a
href="https://github.com/honojs/hono/commit/c78932d745cdf6284ae131a156479ac930da0262"><code>c78932d</code></a>
fix(utils/ipaddr): render the unspecified address binary as
&quot;::&quot; (<a
href="https://redirect.github.com/honojs/hono/issues/4998">#4998</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.12.23...v4.12.25">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.12.23&new-version=4.12.25)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/open-policy-agent/opa/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 16:33:51 -05:00
dependabot[bot] 369db1718b build(deps): bump dompurify from 3.4.0 to 3.4.10 in /docs (#8789) 
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.0 to
3.4.10.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/cure53/DOMPurify/releases">dompurify's
releases</a>.</em></p>
<blockquote>
<h2>DOMPurify 3.4.10</h2>
<ul>
<li>Refactored codebase for clarity: extracted the public type
declarations into <code>types.ts</code></li>
<li>Decomposed the three largest sanitizer functions into focused
helpers</li>
<li>Removed duplicated defaults and dead branches, consolidated
<code>SAFE_FOR_TEMPLATES</code> scrubbing into single shared path</li>
<li>Improved per-node performance by hoisting the mXSS probe regexes and
testing <code>textContent</code> before <code>innerHTML</code></li>
<li>Added a deterministic micro-benchmark harness (<code>npm run
bench</code>) with a <code>--compare</code> mode</li>
<li>Reduced CI cost by running the full three-engine browser suite once
per PR</li>
<li>Refreshed the <code>demos/</code> folder so every demo runs again,
and added a SVG-via-<code>&lt;img&gt;</code> demo</li>
<li>Documented the bench and <code>test:happydom</code> scripts in the
README</li>
<li>Completed the Attack Classes &amp; Bypass History wiki page</li>
<li>Bumped several dependencies where possible</li>
</ul>
<h2>DOMPurify 3.4.9</h2>
<ul>
<li>Further improved the handling of Trusted Types config options,
thanks <a
href="https://github.com/offset"><code>@​offset</code></a></li>
<li>Further improved the handling of <code>IN_PLACE</code> sanitization,
thanks <a
href="https://github.com/mozfreddyb"><code>@​mozfreddyb</code></a></li>
<li>Added more test coverage for <code>IN_PLACE</code> and Trusted Types
related usage</li>
<li>Bumped several dependencies where possible</li>
<li>Updated README and wiki with more accurate documentation &amp;
attack samples</li>
</ul>
<h2>DOMPurify 3.4.8</h2>
<ul>
<li>Cleaned up the repository root, renamed some and removed unneeded
files</li>
<li>Fixed an issue with handling of Trusted Types policies, thanks <a
href="https://github.com/fulstadev"><code>@​fulstadev</code></a></li>
<li>Fixed the node iterator for better template scrubbing, thanks <a
href="https://github.com/IamLeandrooooo"><code>@​IamLeandrooooo</code></a></li>
<li>Included formerly missing LICENSE-MPL in published npm package,
thanks <a
href="https://github.com/asamuzaK"><code>@​asamuzaK</code></a></li>
<li>Bumped several dependencies where possible</li>
</ul>
<h2>DOMPurify 3.4.7</h2>
<ul>
<li>Hardened the handling of Shadow Roots when using
<code>IN_PLACE</code>, thanks <a
href="https://github.com/GameZoneHacker"><code>@​GameZoneHacker</code></a></li>
<li>Removed a problem leading to permanent hook pollution, thanks <a
href="https://github.com/offset"><code>@​offset</code></a></li>
<li>Refactored the test suite and expanded test coverage
significantly</li>
</ul>
<h2>DOMPurify 3.4.6</h2>
<ul>
<li>Fixed several issues with DOM Clobbering in <code>IN_PLACE</code>
mode, thanks <a
href="https://github.com/offset"><code>@​offset</code></a> &amp; <a
href="https://github.com/Bankde"><code>@​Bankde</code></a></li>
<li>Hardened the checks for cross-realm <code>IN_PLACE</code> and Shadow
DOM sanitization, thanks <a
href="https://github.com/offset"><code>@​offset</code></a> &amp; <a
href="https://github.com/Bankde"><code>@​Bankde</code></a></li>
<li>Added more test coverage for <code>IN_PLACE</code> and general DOM
Clobbering attacks</li>
<li>Bumped several dependencies where possible</li>
</ul>
<h2>DOMPurify 3.4.5</h2>
<ul>
<li>Fixed a bypass caused by the new HTML element
<code>selectedcontent</code> added in 3.4.4, thanks <a
href="https://github.com/KabirAcharya"><code>@​KabirAcharya</code></a></li>
</ul>
<p><strong>Note that this is a security release for an issue introduced
in 3.4.4 and should be upgraded to immediately.</strong></p>
<h2>DOMPurify 3.4.4</h2>
<ul>
<li>Added the <code>selectedcontent</code> element to default
allow-list, thanks <a
href="https://github.com/lukewarlow"><code>@​lukewarlow</code></a></li>
<li>Added the <code>command</code> and <code>commandfor</code>
attributes to default allowed-list, thanks <a
href="https://github.com/lukewarlow"><code>@​lukewarlow</code></a></li>
<li>Added better template scrubbing for <code>IN_PLACE</code>
operations, thanks <a
href="https://github.com/DEMON1A"><code>@​DEMON1A</code></a></li>
<li>Added stronger checks for cross-realm windows, thanks <a
href="https://github.com/DEMON1A"><code>@​DEMON1A</code></a> &amp; <a
href="https://github.com/fg0x0"><code>@​fg0x0</code></a></li>
<li>Updated demo website and made sure it uses the latest from main</li>
<li>Updated existing workflows, fuzzer, dependabot, etc., added more
tests</li>
<li>Bumped several dependencies where possible</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/cure53/DOMPurify/commit/6ee5716f8336989753611beeca364957c0eb0c3e"><code>6ee5716</code></a>
release: 3.4.10 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1478">#1478</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/52102472d46035857c52df19e44285f8a1e102fc"><code>5210247</code></a>
release: 3.4.9 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1459">#1459</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/bcdd8285412dc9c4c149652aed2d712e790d6ccf"><code>bcdd828</code></a>
release: 3.4.8 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1439">#1439</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff"><code>ca30f07</code></a>
release: 3.4.7 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1414">#1414</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/bb7739e5bccec7e1ab3dae3f3e42d02db3acaaae"><code>bb7739e</code></a>
release: 3.4.6 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1394">#1394</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/011b0c78f2a0f57ee54f5fcccb697a46ca6e63ea"><code>011b0c7</code></a>
release: 3.4.5 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1382">#1382</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/5817ad969c15e67dfcd6cb37248d6e9c1553e7c3"><code>5817ad9</code></a>
release: 3.4.4 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1374">#1374</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/520edb0371a9638f9b51f1798051299a250c686b"><code>520edb0</code></a>
release: 3.4.3 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1352">#1352</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/6f67fd396a7b8c64294343999fe607ca1f5299c0"><code>6f67fd3</code></a>
Sync/3.4.2 (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1322">#1322</a>)</li>
<li><a
href="https://github.com/cure53/DOMPurify/commit/5b0cdbbf52331e854c0a2de875b1a3790ecec2b8"><code>5b0cdbb</code></a>
chore: merge main into 3.x for 3.4.1 release (<a
href="https://redirect.github.com/cure53/DOMPurify/issues/1301">#1301</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/cure53/DOMPurify/compare/3.4.0...3.4.10">compare
view</a></li>
</ul>
</details>
<details>
<summary>Install script changes</summary>
<p>This version adds <code>prepare</code> script that runs during
installation. Review the package contents before updating.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=dompurify&package-manager=npm_and_yarn&previous-version=3.4.0&new-version=3.4.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/open-policy-agent/opa/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 16:33:31 -05:00
dependabot[bot] ed23e2b0b2 build(deps): bump ws in /docs (#8788) 
Bumps and [ws](https://github.com/websockets/ws). These dependencies
needed to be updated together.
Updates `ws` from 7.5.10 to 7.5.11
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/websockets/ws/releases">ws's
releases</a>.</em></p>
<blockquote>
<h2>7.5.11</h2>
<h1>Bug fixes</h1>
<ul>
<li>Backported 2b2abd45 to the 7.x release line (e14c4586).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8"><code>fd36cd8</code></a>
[dist] 7.5.11</li>
<li><a
href="https://github.com/websockets/ws/commit/e14c45861deca0cef60dec0f9109b694abebdf52"><code>e14c458</code></a>
[security] Limit retained message parts</li>
<li>See full diff in <a
href="https://github.com/websockets/ws/compare/7.5.10...7.5.11">compare
view</a></li>
</ul>
</details>
<br />

Updates `ws` from 8.18.3 to 8.21.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/websockets/ws/releases">ws's
releases</a>.</em></p>
<blockquote>
<h2>7.5.11</h2>
<h1>Bug fixes</h1>
<ul>
<li>Backported 2b2abd45 to the 7.x release line (e14c4586).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8"><code>fd36cd8</code></a>
[dist] 7.5.11</li>
<li><a
href="https://github.com/websockets/ws/commit/e14c45861deca0cef60dec0f9109b694abebdf52"><code>e14c458</code></a>
[security] Limit retained message parts</li>
<li>See full diff in <a
href="https://github.com/websockets/ws/compare/7.5.10...7.5.11">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/open-policy-agent/opa/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 16:13:21 -05:00
dependabot[bot] 186d4868cf build(deps): bump launch-editor from 2.11.1 to 2.14.1 in /docs (#8790) 
Bumps [launch-editor](https://github.com/vitejs/launch-editor) from
2.11.1 to 2.14.1.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/launch-editor/commit/3f97c648307a70e7c930ba63f040e6ba8e72bc16"><code>3f97c64</code></a>
v2.14.1</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/0cc9550e05c35224a1f61914b9731723f78c06a7"><code>0cc9550</code></a>
fix: reject UNC paths (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/138">#138</a>)</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/afd1ab907769adbb0fb76b564551f3cd24822ea6"><code>afd1ab9</code></a>
ci: run tests on mac and windows (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/136">#136</a>)</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/0bfa328e4d2a70d3accd86645efde43a5a8fd931"><code>0bfa328</code></a>
test: add some tests for launch-editor package (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/135">#135</a>)</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/1b006ae00061e83628c884770df4869bac481ed3"><code>1b006ae</code></a>
chore: add README (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/134">#134</a>)</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/383ef26fceaaab75e4f122bf833a8d457e187272"><code>383ef26</code></a>
v2.14.0</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/6277209316b28bd76b057a97fcdfa42da5adc181"><code>6277209</code></a>
ci: harden publish settings</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/520b2f787af1bbe3d2333d952547fc90f2c01bb3"><code>520b2f7</code></a>
fix(deps): update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/129">#129</a>)</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/475ac662aeaa40eebe319f76acf7bd7ff2aba5d5"><code>475ac66</code></a>
chore(deps): update dependency lint-staged to v17 (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/130">#130</a>)</li>
<li><a
href="https://github.com/vitejs/launch-editor/commit/247bf1dfe2c75efb50f507d33c2c5a3cbf4e20d0"><code>247bf1d</code></a>
chore(deps): update dependency yorkie to v2 (<a
href="https://redirect.github.com/vitejs/launch-editor/issues/131">#131</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/launch-editor/compare/v2.11.1...v2.14.1">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for launch-editor since your current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=launch-editor&package-manager=npm_and_yarn&previous-version=2.11.1&new-version=2.14.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/open-policy-agent/opa/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 15:51:53 -05:00
Sebastian Spaink d1780dbe65 format: Fix dropped with-clause after comment in object value (#8785) 
resolve: https://github.com/open-policy-agent/opa/issues/8765

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
 2026-06-16 15:51:27 -05:00