v0.14.0

Compare Source

AST Support is Coming!

See details in #​241

Other Changes

• chore(deps): migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 by @​scop in #​240
• Add Go workspace support to LocalModule section by @​krostar in #​236
• feat(*): bump to 0.14 by @​daixiang0 in #​243

New Contributors

• @​scop made their first contribution in #​240
• @​krostar made their first contribution in #​236

Full Changelog: daixiang0/gci@v0.13.7...v0.14.0

v5.9.0

Compare Source

What's Changed

• Use path.Clean instead of filepath.Clean in iofs.Open by @​puerco in #​197
• Deprecate ChrootOS in favour of BoundOS by @​pjbgf in #​201
• General Improvements by @​pjbgf in #​203
• osfs: ChrootOS eval baseDir on creation by @​pjbgf in #​205
• Run go-git tests as part of integration tests by @​pjbgf in #​206

Full Changelog: go-git/go-billy@v5.8.0...v5.9.0

v2.12.2

Compare Source

Released on 2026-05-06

1. Linters bug fixes
   • gomodguard_v2: fix blocked configuration
   • gomodguard_v2: from 2.1.0 to 2.1.3
   • iface: from 1.4.1 to 1.4.2

v2.12.1

Compare Source

Released on 2026-05-01

1. Linters bug fixes
   • gomodguard_v2: fix panic with migration suggestion
2. Misc.
   • fix install.sh script (if you are still using an URL based on the branch master, please update to use https://golangci-lint.run/install.sh)

v2.12.0

Compare Source

Released on 2026-05-01

1. New linters
   • Add clickhouselint linter https://github.com/ClickHouse/clickhouse-go-linter
2. Linters new features or changes
   • dupl: from f665c8d to c99c5cf (extended detection)
   • funcorder: from 0.5.0 to 0.6.0 (new option: function)
   • goconst: add an option to ignore strings from tests
   • goconst: from 1.8.2 to 1.10.0 (extended detection)
   • gomodguard_v2: from 1.4.1 to 2.1.0 (major version with new configuration)
   • gosec: from 619ce21 to 2.26.1 (new checks: G124, G708, G709, G710)
   • govet: add inline analyzer
   • makezero: from 2.1.0 to 2.2.1 (support slice type aliases)
   • paralleltest: expose checkcleanup option
   • sloglint: from 0.11.1 to 0.12.0 (new options: allowed-keys, custom-funcs)
   • wsl_v5: from 5.6.0 to 5.8.0 (new option: cuddle-max-statements; new checks: after-decl, after-defer, after-expr, after-go, cuddle-group)
3. Linters bug fixes
   • forbidigo: from 2.3.0 to 2.3.1
   • godot: from 1.5.4 to 1.5.6
   • govet-modernize: from 0.43.0 to 0.44.0
   • ireturn: from 0.4.0 to 0.4.1
   • rowserrcheck: from 1.1.1 to c5f79b8
4. Misc.
   • Decrease cache entropy
   • Embed the JSON schema in the binary
   • Filter env vars when cloning the repository with the custom command

v1.16.2

Compare Source

This release updates the version of Go used to build the OPA binaries and images to 1.26.3;
addressing a number of vulnerabilities.

v1.16.1

Compare Source

This is a patch release addressing a regression in the plugin manager that may cause the service to hang on shutdown (#​8590).

v1.16.0

Compare Source

[!WARNING]

A regression has been found in the plugin manager, which may cause the service to hang on shutdown.
Users are advised to go directly to v1.16.1.

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

• New uri.parse and uri.is_valid built-in functions
• Data API Request/Response Metadata
• Prometheus metrics exported via OTLP
• Formatter improvements

NOTE:

In v1.15.x, OPA was dropping logs for bundle downloads, print() calls and other plugin-originated logs.
Users are advised to update, v1.16.0 fixes this bug in (#​8544).

New uri.parse and uri.is_valid built-in functions (#​8263)

Two new built-in functions have been added: uri.parse for parsing a given URI, and uri.is_valid for verifying the structure of a given URI.

uri.parse

Parses a URI and returns an object containing its components according to RFC 3986. Empty components are omitted.

package example

test_uri if {
	uri.parse("https://example.com:8080/api?q=1#top") == {
		"scheme": "https",
		"hostname": "example.com",
		"port": "8080",
		"path": "/api",
		"raw_path": "/api",
		"raw_query": "q=1",
		"fragment": "top",
	}
}

uri.is_valid

Returns true if the input can be parsed as a URI, false otherwise.

package example

deny contains "invalid URI" if {
    not uri.is_valid("http://[invalid")
}

Authored by @​charlieegan3 reported by @​anivar

Data API Request/Response Metadata (#​8570)

Wrapping projects can now attach custom metadata to Data API requests and have evaluation produce response metadata.

Two distinct metadata paths are introduced:

• Request metadata: parsed from extra top-level keys in the request body, made available to builtins via BuiltinContext.RequestMetadata. Logged in the decision log under Custom["request_metadata"].

• Response metadata: a separate map (BuiltinContext.ResponseMetadata) that builtins can populate during evaluation. Only included in the API response and decision log if non-empty.

In vanilla OPA, no builtins write response metadata, so responses are unchanged. The request metadata map is only allocated when the request carries extra fields; the response map is one empty map per request.

To avoid conflicts with future OPA top-level keys, callers should use a namespaced key: {"input": {...}, "com.example.opa/md": {...}}.

Request with metadata:

curl -H 'Content-Type: application/json' \
  -d '{"input": {"user": "alice"}, "com.example.opa/metadata": {"corp-id": "acme-42"}}' \
  http://localhost:8181/v1/data/example/allow

Response (response metadata included if, for example, set by a custom builtin):

{
  "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135",
  "result": true,
  "com.example.opa/response": {
    "snapshot_version": "v3"
  }
}

Decision log entry:

{
  "custom": {
    "request_metadata": {
      "com.example.opa/metadata": {
        "corp-id": "acme-42"
      }
    },
    "response_metadata": {
      "com.example.opa/response": {
        "snapshot_version": "v3"
      }
    }
  },
  "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135",
  "input": { "user": "alice" },
  "msg": "Decision Log",
  "path": "example/allow",
  "result": true
}

Authored by @​srenatus

Runtime, SDK, Tooling

• distributedtracing: Export Prometheus metrics via OTLP (#​7591) reported and authored by @​Munken
• cmd,tester: Update opa test to stream test case results (#​3676) authored by @​sspaink reported by @​tsandall
• cmd,tester: Show full errors when test fails and using --coverage (#​8438) authored by @​grosser
• format: Add new line between METADATA blocks (#​8483) authored by @​sspaink
• format: Allow indenting all withs in expression (#​8508) authored by @​anderseknert
• format: Fix dropping comments after handling unexpectedCommentError (#​8553) authored by @​sspaink
• format: Preserve location of trailing comments inside every body (#​8558) authored by @​johanfylling
• format: Prevent opa fmt from formatting single attribute objects with comments (#​7565) authored by @​sspaink reported by @​anderseknert
• logging: Keep forwarding from BufferedLogger after Flush() (#​8544) authored by @​srenatus reported by @​annieyhuang
• plugins/logs: Fix logBuffer eviction loop only dropping one element (#​8543) authored by @​sspaink
• plugins/logs: Fix out-of-order plugin status notifications (#​8009) authored by @​sspaink reported by @​Pushpalanka
• plugins/rest: Carry over all of *tls.Config (#​8473) authored by @​srenatus reported by @​ashu2496
• server: Drop HTML index page query form (#​8477) authored by @​johanfylling reported by @​srenatus and @​r0binak
• server: Skip chmod for abstract Unix domain sockets (#​8536) authored by @​bakayolo
• storage/inmem: Avoid allocations from Read() in MakeDir() (#​8561) authored by @​srenatus
• tester: Add method to match tests by ref prefixes (#​6696) authored by @​anderseknert
  Note: Experimental.

Compiler, Topdown and Rego

• ast: Allow Back-to-back metadata blocks (#​8482) authored by @​sspaink reported by @​johanfylling
• ast: Catch functions in dynamic extent of ref head rule (#​8461) authored by @​srenatus reported by @​johanfylling
• ast: Fix parenthesis in String() of {obj,arr,set} comprehensions (#​8511) authored by @​srenatus
• ast: Fix parsing of unary - in front of a ref (#​5014) authored by @​mmzzuu reported by @​philipaconrad
• ast: Fix type checker match error for objects with set keys (#​6260) authored by @​sspaink reported by @​tsandall
• ast: Fix type checker to recognize numeric index in generated map (#​6736) authored by @​sspaink reported by @​anderseknert
• ast: Handle underdetermined function args (#​5234) authored by @​sspaink reported by @​obataku
• ast: Identify compatible type from reference in type checker (#​7273) authored by @​sspaink reported by @​anderseknert
• ast: Support recursive JSON Schemas (#​6099) authored by @​sspaink reported by @​anderseknert
• builtins: Add support for days, weeks and years in time.parse_duration_ns built-in function (#​2719) authored by @​sspaink reported by @​freeseacher
• builtins: Fix graph.reachable_paths to return all reachable paths (#​5871) authored by @​davidmarne-wf reported by @​ericjkao
• builtins: Limit exponent size in units.parse_bytes built-in function to prevent timeout bypass (#​8326) authored by @​isaiahvita reported by @​anderseknert
• perf: Add CopyNonGround() methods for Array, Set, and Object (#​8323) authored by @​alex60217101990
• resolver/wasm: Add NewWithContext to allow passing context (#​8499) authored by @​dominikschulz

Docs, Website, Ecosystem

• docs: Add aggregates examples for count and sum built-in functions (#​8566) authored by @​alliasgher reported by @​srenatus
• docs: Add generated output.jsons for docs examples (#​8535) authored by @​charlieegan3
• docs: Add spec for OCP bundle status tracking API (#​8502) authored by @​ashutosh-narkar
• docs: Add the latest videos to the README presentations section (#​8523) authored by @​sspaink
• docs: Add Windows development notes to dev reference guide (#​8422) authored by @​raajheshkannaa
• docs: Fix input value type in not undefined example (#​8580) authored by @​menma1234
• docs: Update Regal docs to v0.40.0 (#​8538) authored by @​charlieegan3
• docs: Updated roadmap link (#​8501) authored by @​johanfylling
• docs: Various typo fixes (#​8529) authored by @​sspaink
• ecosystem: Add vulnetix ecosystem entry (#​8532) authored by @​0x73746F66
• ecosystem: Add KubeStellar Console (#​8560) authored by @​clubanderson
• website: Add banner to show when event has passed (#​8493) authored by @​charlieegan3
• website: Add copy-as-markdown button to doc pages (#​8540) authored by @​charlieegan3
• website: Copy button improvements (#​8577) authored by @​charlieegan3
• website: Remove old redirects, add new management redirect (#​8424) authored by @​charlieegan3 reported by @​narainar
• website: Update intro video on homepage (#​8547) authored by @​charlieegan3

Miscellaneous

• build: Exclude domains that cause false positives (#​8533) (#​8495) authored by @​charlieegan3
• e2e/cli: Add test for debug print() logging (#​8567) authored by @​srenatus
• e2e/cli: Start CLI E2E tests (#​8545) authored by @​srenatus
• github: declare formatted rego as rego (#​8564) authored by @​srenatus
• Security policy update (#​8479) authored by @​anderseknert
• Dependency updates; notably:
  • build: bump go 1.26.2 (#​8497) authored by @​sspaink
  • build(deps): bump wasmtime-go from v39.0.1 to v43.0.2
  • build(deps): bump go.opentelemetry.io deps from 1.40.0/0.65.0 to 1.43.0/0.68.0
  • build(deps): bump github.com/containerd/containerd/v2 from 2.2.1 to 2.2.3
  • build(deps): bump ithub.com/huandu/go-sqlbuilder from 1.39.1 to 1.40.2
  • build(deps): bump golang.org/x/net from 0.51.0 to 0.53.0
  • build(deps): bump golang.org/x/text from 0.34.0 to 0.36.0

v0.11.0

Compare Source

v0.45.0

Compare Source

v0.45.0 Release 🎉

This release adds the describe subcommand for customrun, migrates tracing from OpenCensus to OpenTelemetry, removes the deprecated chains command, adds support for Pipelines v1.12.0, and includes dependency updates to address multiple critical CVEs.

Changelog 📋

• ce6edf3 New version v0.45.0

What's Changed

• Bump chainguard-dev/actions from 1.6.1 to 1.6.3 by @​dependabot[bot] in #​2742
• Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 by @​dependabot[bot] in #​2753
• chore: referencing the setup-kind script from the plumbing repo instead of copying it by @​infernus01 in #​2590
• Nominate divyansh42 as cli approver by @​vdemeester in #​2761
• Move piyush-garg to alumni by @​vdemeester in #​2760
• docs: Update CLI docs for v0.44.0 release by @​pratap0007 in #​2748
• Bump github/codeql-action from 4.32.3 to 4.32.5 by @​dependabot[bot] in #​2755
• Bump step-security/harden-runner from 2.14.2 to 2.15.0 by @​dependabot[bot] in #​2757
• Bump actions/setup-go from 6.2.0 to 6.3.0 by @​dependabot[bot] in #​2754
• Bump github.com/google/go-containerregistry from 0.21.0 to 0.21.2 by @​dependabot[bot] in #​2759
• Bump github.com/docker/cli from 29.2.1+incompatible to 29.3.0+incompatible in the go-docker-dependencies group by @​dependabot[bot] in #​2763
• Bump golang.org/x/term from 0.40.0 to 0.41.0 by @​dependabot[bot] in #​2766
• Bump github.com/golangci/golangci-lint/v2 from 2.10.1 to 2.11.3 in /tools by @​dependabot[bot] in #​2765
• Add CI summary fan-in job to presubmit CI by @​vdemeester in #​2741
• feat: add cherry-pick command workflow by @​vdemeester in #​2682
• Bump chainguard-dev/actions from 1.6.3 to 1.6.5 by @​dependabot[bot] in #​2756
• Bump actions/upload-artifact from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​2758
• Bump the go-k8s-dependencies group with 3 updates by @​dependabot[bot] in #​2752
• Change all occurences of GCS buckets with OCI buckets by @​adityavshinde in #​2768
• Add long flag --display-name to display the log of pipelinerun by @​icloudnote in #​2450
• feat: add describe subcommand in customrun command by @​pratap0007 in #​2712
• Cleanup/remove deprecate chains cmd by @​adityavshinde in #​2769
• Bump google.golang.org/grpc from 1.78.0 to 1.79.3 by @​dependabot[bot] in #​2775
• Bump github.com/tektoncd/pipeline from 1.9.1 to 1.9.2 by @​dependabot[bot] in #​2781
• Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @​dependabot[bot] in #​2789
• Bump knative and components version by @​khrm in #​2788
• Migrate tracing from OpenCensus to OpenTelemetry by @​khrm in #​2799
• Bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 by @​dependabot[bot] in #​2800
• Bump github.com/docker/cli from 29.3.0+incompatible to 29.3.1+incompatible in the go-docker-dependencies group across 1 directory by @​dependabot[bot] in #​2783
• Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.42.0 to 1.43.0 by @​dependabot[bot] in #​2801
• Bump github.com/letsencrypt/boulder from 0.20251110.0 to 0.20260406.0 by @​dependabot[bot] in #​2796
• (deps) Bump go version to 1.25.8 to fix CVE-2026-25679 by @​divyansh42 in #​2803
• Bump github.com/google/go-containerregistry from 0.21.3 to 0.21.4 by @​dependabot[bot] in #​2797
• Bump github.com/sigstore/cosign/v2 from 2.6.2 to 2.6.3 by @​dependabot[bot] in #​2798
• Bump step-security/harden-runner from 2.15.0 to 2.17.0 by @​dependabot[bot] in #​2808
• Bump github.com/fatih/color from 1.18.0 to 1.19.0 by @​dependabot[bot] in #​2777
• Bump github.com/golangci/golangci-lint/v2 from 2.11.3 to 2.11.4 in /tools by @​dependabot[bot] in #​2778
• Bump github/codeql-action from 4.32.5 to 4.35.1 by @​dependabot[bot] in #​2784
• Bump actions/setup-go from 6.3.0 to 6.4.0 by @​dependabot[bot] in #​2786
• Bump github.com/sigstore/sigstore from 1.10.4 to 1.10.5 by @​dependabot[bot] in #​2805
• Bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 by @​dependabot[bot] in #​2809
• Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.42.0 to 1.43.0 by @​dependabot[bot] in #​2802
• Bump actions/upload-artifact from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​2816
• Bump step-security/harden-runner from 2.17.0 to 2.19.0 by @​dependabot[bot] in #​2815
• Bump the go-k8s-dependencies group with 3 updates by @​dependabot[bot] in #​2811
• Bump github.com/letsencrypt/boulder from 0.20260406.0 to 0.20260413.0 by @​dependabot[bot] in #​2812
• Bump github.com/google/go-containerregistry from 0.21.4 to 0.21.5 by @​dependabot[bot] in #​2813
• Bump chainguard-dev/actions from 1.6.5 to 1.6.15 by @​dependabot[bot] in #​2814
• Bump github/codeql-action from 4.35.1 to 4.35.2 by @​dependabot[bot] in #​2817
• Bump github.com/docker/cli from 29.4.0+incompatible to 29.4.1+incompatible in the go-docker-dependencies group by @​dependabot[bot] in #​2820
• Bump github.com/tektoncd/pipeline from 1.11.0 to 1.11.1 by @​dependabot[bot] in #​2823
• Bump github.com/tektoncd/chains from 0.26.2 to 0.26.3 by @​dependabot[bot] in #​2827
• Bump chainguard-dev/actions from 1.6.15 to 1.6.16 by @​dependabot[bot] in #​2829
• Bump go.uber.org/zap from 1.27.1 to 1.28.0 by @​dependabot[bot] in #​2830
• Bump github.com/letsencrypt/boulder from 0.20260413.0 to 0.20260420.0 by @​dependabot[bot] in #​2821
• Bump github.com/tektoncd/pipeline from 1.11.1 to 1.12.0 by @​dependabot[bot] in #​2836
• Bump google.golang.org/grpc from 1.80.0 to 1.81.0 by @​dependabot[bot] in #​2837
• Bump chainguard-dev/actions from 1.6.16 to 1.6.19 by @​dependabot[bot] in #​2839
• Bump github.com/golangci/golangci-lint/v2 from 2.11.4 to 2.12.1 in /tools by @​dependabot[bot] in #​2834
• Bump step-security/harden-runner from 2.19.0 to 2.19.1 by @​dependabot[bot] in #​2840
• Strip Go symbol table from release binaries by @​alliasgher in #​2843
• Bump github/codeql-action from 4.35.2 to 4.35.3 by @​dependabot[bot] in #​2838
• Bump github.com/golangci/golangci-lint/v2 from 2.12.1 to 2.12.2 in /tools by @​dependabot[bot] in #​2842
• Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 by @​dependabot[bot] in #​2844
• Bump github.com/docker/cli from 29.4.1+incompatible to 29.4.3+incompatible in the go-docker-dependencies group across 1 directory by @​dependabot[bot] in #​2833
• Update tekton hub to 1.24.0 by @​divyansh42 in #​2845
• Bump golang.org/x/crypto from 0.50.0 to 0.51.0 by @​dependabot[bot] in #​2847

New Contributors

• @​adityavshinde made their first contribution in #​2768
• @​alliasgher made their first contribution in #​2843

Full Changelog: tektoncd/cli@v0.44.0...v0.45.0

v0.42.0

Compare Source

What's Changed

⚠️ Breaking Changes

• chore!: migrate to moby modules (#​3591) @​thaJeztah

🔒 Security

• chore(deps): bump moby/client v0.4

✂ Note

PR body was truncated to here.