Open Policy Agent

OPA now parses YAML against the 1.2 core schema, fixes recursion-check false positives for rules with general refs, improves rule indexing to exclude more non-indexable expressions, exposes rule_labels in Data and Query API responses, and bounds gzip response buffering to min_length. Because YAML 1.2 parsing no longer treats bare words like yes, no, on, and off as booleans, any policies, bundles, or config files relying on that YAML 1.1 behavior must quote those values and use true/false explicitly, and code depending on empty object, array, or set literals having an any-typed schema must be updated since empty composite literals are now typed as strictly empty.

Matters for: Teams loading GitHub Actions workflow files or other YAML configs into OPA via --data, bundles, or the yaml.unmarshal builtin, and teams running large rulesets with variable-headed or general-ref rules that rely on accurate rule indexing and recursion checking.

Rego now supports and and or keywords, letting you combine conditions directly within a single rule body instead of splitting logic into separate helper rules that produce boolean results. This release also extends allow_net enforcement to cover remote JSON Schema $ref fetches performed by json.match_schema and json.verify_schema at evaluation time, and adds coverage reports that tag uncovered ranges as excluded by rule indexing or early exit.

Matters for: Engineers writing complex authorization rules in Rego for API gateways and service meshes, and teams relying on schema validation with untrusted input-supplied JSON Schemas.

This release quotes dynamic field identifiers in Compile API SQL output to close a SQL injection vector, switches the WebAssembly runtime from wasmtime-go to wazero for cgo-free builds with faster cold starts and warm evaluation, adds a strings.split_n built-in, warns on unknown configuration options, and improves REPL line editing with automatic history file migration. The assignment operator (:=) now enforces stricter safety checking so its right-hand side must be made safe independently rather than through the left-hand side, meaning policies like x := y; x = 7 that previously compiled will now fail with a rego_unsafe_var_error and must be rewritten to properly assign or bind variables.

Matters for: Teams enforcing authorization policies that translate to SQL filters via the Compile API, and teams embedding OPA's wasm evaluation target in cgo-free build pipelines.

OPA now sends an RFC 9110-compliant User-Agent header on outbound HTTP requests (bundle, discovery, decision log, status, http.send, AWS KMS/ECR), and automatically restores GOMAXPROCS while adding automatic GOMEMLIMIT support for container-aware resource limits; opa fmt and opa test --coverage also gained correctness and reporting improvements. This is breaking: any server-side log filters or WAF rules that exact-match the old 'Open Policy Agent/' string must be updated to match the new 'Open-Policy-Agent/' format.

Matters for: Teams running OPA in containerized environments (e.g. Kubernetes) with CPU/memory limits, and teams operating WAFs or log pipelines that filter on OPA's outbound User-Agent string.