Skip to content

chore(deps): update module github.com/open-policy-agent/opa to v1.21.2 - #3455

Open
renovate-bot wants to merge 1 commit into
GoogleCloudPlatform:mainfrom
renovate-bot:renovate/cli-github.com-open-policy-agent-opa-1.x
Open

chore(deps): update module github.com/open-policy-agent/opa to v1.21.2#3455
renovate-bot wants to merge 1 commit into
GoogleCloudPlatform:mainfrom
renovate-bot:renovate/cli-github.com-open-policy-agent-opa-1.x

Conversation

@renovate-bot

@renovate-bot renovate-bot commented Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/open-policy-agent/opa v1.12.2 → v1.21.2 age confidence

Release Notes

open-policy-agent/opa (github.com/open-policy-agent/opa)

v1.21.2

Compare Source

This release builds the OPA binary artifacts with the latest version of Go (v1.27.2), its standard library, and the golang.org/x/net dependency (v0.60.0).

See these security advisories:

Furthermore, it addresses a mismatch in how encoded slashes were handled in the input to a basic authorization policy and the Data API (#​9323, reported by @​abhishekkushwaha4u, fixed by @​sspaink).

v1.21.1

Compare Source

This release fixes a compiler regression introduced in OPA v1.21.0.

Fix some … in/every in comprehensions nested in object and set literals (#​9280)

A comprehension using some … in or every in its body, nested inside an object or set literal, was wrongly treated as ground, so the compiler skipped rewriting it. some … in then failed with rego_unsafe_var_error; every caused a compiler panic:

package example

p := {"k": [r.a | some r in input.xs]}           # rego_unsafe_var_error: var r is unsafe

q := {[1 | every x in input.xs { x > 0 }]}       # panic

Array literals weren't affected, and neither were literals that contain some other non-ground term.

authored by @​srenatus, reported by @​tun0

v1.21.0

Compare Source

This release contains a mix of new features and bug fixes. Notably:

  • Improved rule indexing
  • Improved rule recursion check
  • YAML is parsed against the 1.2 core schema (breaking change)
Rules with general refs no longer collide in the recursion check (#​6813)

Before, this was a recursion error:

package play

p[x].foo.bar if {
	x := "a"
	not p[x].foo.baz
}

p[x].foo.baz if {
	x := "a"
	false
}

Rules with a variable in their head are all stored at the ground prefix of their ref, so
p[x].foo.bar and p[x].foo.baz looked like dependencies of each other. The compiler is
now less conservative and compares the ref parts past the prefix. Genuine cycles are still
reported.

The IR and Wasm targets however still return an error: they plan one function per ground
path prefix, and cannot evaluate part of a function that is still being planned.

Authored by @​sspaink, reported by @​tsandall

Data and Query APIs can return rule labels in the response (#​9211)

# METADATA labels for evaluated rules were only available in decision log
events. The Data API (GET/POST /v1/data) and Query API (GET/POST /v1/query) now accept a rule_labels query parameter to include the same
merged labels in the response payload, under a rule_labels key.

Authored by @​srenatus

Behavior change: response gzip compression now bounds its buffer to min_length (#​9205)

The server's gzip response compression (server.encoding.gzip) buffered an entire
incoming Write call before deciding whether to compress, so a single large write could
grow the buffer well past min_length before that decision was made. The handler is now
built on klauspost/compress/gzhttp
instead of a hand-rolled buffer and gzip.Writer pool, which caps what it buffers to
min_length (floored at 512 bytes) before streaming the remainder through the chosen
path. min_length and compression_level behave the same as before; only gzip is
negotiated, not zstd.

Authored by @​srenatus

YAML is now parsed against the 1.2 core schema (#​5754, #​6598)

OPA parsed YAML with a library pinned to go-yaml v2, which implements YAML 1.1. Under
1.1, the bare words y, n, yes, no, on and off resolve to booleans, so a
GitHub Actions workflow loaded with --data came back with true where it should have
had on:

on: push
{ "true": "push" }

These words are now plain strings, as the YAML 1.2 core schema specifies. true and
false are unaffected. This applies everywhere OPA reads YAML: --data, bundles,
config files, and the yaml.unmarshal builtin.

If you were relying on yes/no/on/off being read as booleans, quote the value and
use true/false instead.

Authored by @​sspaink, reported by @​scnewma and @​johnc-c

Empty composite literals are now typed as empty (#​7275)

The type checker used to give the empty object literal {} the type
object[any: any], the empty array literal [] the type array[any], and the
empty set literal set() the type set[any], i.e. the types of a collection
that may hold anything. Every other literal is typed by its contents, so
referencing a key that isn't there is caught at compile time — but only for
non-empty literals:

obj := {"foo": "bar"}
obj.bar # rego_type_error: undefined ref: obj.bar

obj := {}
obj.bar # compiles

Empty literals are now typed as what they are: an object with no properties, an
array with no items, and a set with no members. Both examples above now fail to
compile, and so does every other way of selecting from an empty literal,
including iterating one (some x in []).

Comparing an empty object or array literal against a value whose type says it
can't be empty ({"foo": "bar"} == {}) is now a match error too, the same way
{"foo": "bar"} == {"bar": "foo"} already was. Use count(x) == 0 to test a
collection for emptiness without asserting its type. Sets are unaffected here:
set[string] describes any set of strings, the empty one included, so
{"foo"} == set() still compiles.

Authored by @​sspaink, reported by @​disaverio

Rule indexing improvements

The rule indexer now excludes rules from more kinds of expression, and builds a smaller
trie to do it with. See Use indexed statements
for what is indexed.

  • startswith, endswith, strings.any_prefix_match and strings.any_suffix_match
    are indexed when the base strings are known at compile time.
  • A reference that reads a key out of the object at its ground prefix in base data
    (data.groups.admins.members[input.subject]) is indexed by asking that object for the
    key, where such a ruleset used to leave every rule a candidate.
  • References rooted at a local variable (x := input; x.foo == "a") are indexed the
    same as input.foo == "a", and a chain of assignments no longer drops the constraint
    at the end of it.
  • A rule's path through the trie stops at the last level it constrains, and a reference
    reached by several values no longer leaves the rest of the rule unindexed.
  • Candidates come back in declaration order, which the indexer documented but did not
    do. A complete rules must not produce multiple outputs error now points at the first
    of the conflicting definitions rather than the second, and partial evaluation names
    and orders the generated locals of its support rules differently. What a policy
    evaluates to is unaffected.
Changes
Runtime, SDK, Tooling
Compiler, Topdown and Rego
Docs, Website, Ecosystem
Miscellaneous
  • ast: Add util.MapKeys helper (#​9158) authored by @​anderseknert
  • ast: Enable more gocritic linters (#​9154) authored by @​anderseknert
  • ast: Enable unparam linter (#​9223) authored by @​anderseknert
  • ast: More niceties, less allocs, less code (#​9228) authored by @​anderseknert
  • ast: Pin BenchmarkObjectConstruction shuffle seed (#​9222) authored by @​srenatus
  • ast: Update remaining errors.As call sites to use errors.AsType (#​9106) authored by @​anderseknert
  • ast: Use modern Go in place of custom compare code (#​9151) authored by @​anderseknert
  • ast: Where have all the allocs gone? (#​9137) authored by @​anderseknert
  • build: Add bench-nightly, a three-arm benchlab experiment runner (#​9118) authored by @​srenatus
  • build: Pin pigeon in build/tools instead of go run pkg@​version (#​9160) authored by @​sspaink
  • bundle: Avoid allocation in getdepth (#​9199) authored by @​srenatus
  • bundle: Remove unused writeModules helper (#​9199) authored by @​srenatus
  • bundle: Reuse encoder buffer while hashing (#​9199) authored by @​srenatus
  • bundle: deep-copy bundle data natively instead of via JSON round-trip (#​9199) authored by @​srenatus
  • check: Avoid allocating in checkExprEq (#​9150) authored by @​anderseknert
  • ci: Publish benchmark trend on a schedule instead of per-push (#​9119) authored by @​srenatus
  • ci: Run the nightly benchlab experiment (#​9118) authored by @​srenatus
  • cmd: Stop binding a fixed port in the run tests (#​9240) authored by @​srenatus
  • github: Drop python from the CodeQL language matrix (#​9097) authored by @​sspaink
  • nightly: Fix go get smoke test (#​9245) authored by @​srenatus
  • perf: Cheaper custom function calls (#​9167) authored by @​anderseknert
  • perf: Fix linear runtime for Array.set due to rehashing (#​9161) authored by @​tsandall
  • perf: General performance improvements in compiler (#​9170) authored by @​anderseknert
  • style: Some more functional niceties (#​9152) authored by @​anderseknert
  • test/e2e: Wait for diagnostic listeners before running tests (#​9134) authored by @​sspaink
  • tests: Expanded testing for and/or keywords (#​9115) authored by @​johanfylling
  • topdown: Fix BulkStartsWith benchmark input generation (#​9222) authored by @​srenatus
  • topdown: Enable more revive linters (#​9181) authored by @​anderseknert
  • topdown: Fix flaky TestRegexBuiltinCache (#​9254) authored by @​sspaink
  • topdown: Fix linter issues (#​9231) authored by @​srenatus
  • util: Add RoundTripFast (#​9199) authored by @​srenatus
  • util: Decode RoundTrip's fallback into a fresh value (#​9206) authored by @​srenatus
  • workflows: Check the nightly go-get job for retractions via the proxy (#​9240) authored by @​srenatus
  • workflows: Remove benchmarks from nightly (#​9182) authored by @​srenatus
  • workflows: Run Regal's do.rq in the nightly compatibility check (#​9209) authored by @​sspaink
  • workflows: Use OCP@​main in nightly (#​9171) authored by @​srenatus
  • Collapse v0 shim packages into a single file each (#​8976) authored by @​sspaink, reported by @​anderseknert
  • Makefile: Add a benchlab target (#​9222) authored by @​srenatus
  • Remove retired go report (#​9112) authored by @​sspaink
  • Dependency updates:
    • build(go): Bump to 1.27.1 (#​9136) authored by @​srenatus
    • build(deps): Bump github.com/dgraph-io/badger/v4 from 4.9.5 to 4.9.6
    • build(deps): Bump github.com/gobwas/glob to v1.0.0 (#​9114) authored by @​sspaink, reported by @​ghmer
    • build(deps): Bump github.com/huandu/go-sqlbuilder from 1.42.1 to 1.43.0
    • build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.1 to 3.3.0
    • build(deps): Bump github.com/olekukonko/tablewriter from 1.1.4 to 1.1.5
    • build(deps): Bump github.com/prometheus/client_model from 0.6.2 to 0.6.3
    • build(deps): Bump github.com/santhosh-tekuri/jsonschema/v6 from 6.0.2 to 6.0.3
    • build(deps): Bump github.com/sirupsen/logrus from 1.9.4 to 1.10.2
    • build(deps): Bump github.com/vektah/gqlparser/v2 from 2.5.36 to 2.5.37
    • build(deps): Bump go.opentelemetry.io/contrib/bridges/prometheus from 0.69.0 to 0.71.0
    • build(deps): Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.71.0
    • build(deps): Bump go.opentelemetry.io/otel from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/sdk/metric from 1.44.0 to 1.46.0
    • build(deps): Bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5
    • build(deps): Bump golang.org/x/sync from 0.22.0 to 0.23.0
    • build(deps): Bump golang.org/x/term from 0.45.0 to 0.46.0
    • build(deps): Bump golang.org/x/text from 0.40.0 to 0.42.0
    • build(deps): Bump golang.org/x/time from 0.15.0 to 0.16.0
    • build(deps): Bump google.golang.org/grpc from 1.82.1 to 1.83.2
    • build(deps): Bump google.golang.org/protobuf from 1.36.11 to 1.36.12
    • build(deps): Drop sigs.k8s.io/yaml (was 1.6.0)

v1.20.2

Compare Source

This release includes a bug fix for a parser regression introduced in v1.20.0, and dependency updates.

Fix stale parse errors on statements starting with { (#​9140)

When the and/or keywords added in v1.20.0 are imported, a statement that starts with { is
first read as an explicit operand body, and re-read as a term (a comprehension, for example) if no
and or or follows. Errors recorded during the abandoned first attempt stayed in the parser's
term cache and were reported against the successful re-read, rejecting policies that parse fine:

package example

import future.keywords

xs := [1, 2, 3]

allow if {
	{
	y |
		some y in xs # rego_parse_error: unexpected some keyword
	} == {1, 2, 3}
}

The term cache is now restored along with the rest of the parser state when the operand-body guess
is abandoned. Only policies importing and or or — directly or via import future.keywords —
were affected; policies that don't import them parse unchanged.

Authored by @​sspaink

Miscellaneous
  • build(go): Bump to 1.27.1 (3652eeb) authored by @​srenatus
  • Dependency updates; notably:
    • build(deps): Bump github.com/dgraph-io/badger/v4 from 4.9.5 to 4.9.6
    • build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.1 to 3.2.0
    • build(deps): Bump github.com/santhosh-tekuri/jsonschema/v6 from 6.0.2 to 6.0.3
    • build(deps): Bump github.com/sirupsen/logrus from 1.9.4 to 1.10.2
    • build(deps): Bump go.opentelemetry.io/contrib/bridges/prometheus from 0.69.0 to 0.71.0
    • build(deps): Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.71.0
    • build(deps): Bump go.opentelemetry.io/otel from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/sdk/metric from 1.44.0 to 1.46.0
    • build(deps): Bump go.opentelemetry.io/otel/trace from 1.44.0 to 1.46.0
    • build(deps): Bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5
    • build(deps): Bump golang.org/x/text from 0.40.0 to 0.41.0
    • build(deps): Bump google.golang.org/grpc from 1.82.1 to 1.83.2
    • build(deps): Bump google.golang.org/protobuf from 1.36.11 to 1.36.12

v1.20.1

Compare Source

This release includes a bug fix for a regression introduced in v1.20.0 in
comparing a number to some float values.
Thanks @​kmadan for reporting the issue and submitting a fix!

v1.20.0

Compare Source

This release contains a mix of new features and bug fixes. Notably:

  • New Rego keywords: and and or, for combining conditions inside a single rule body
  • allow_net now restricts remote JSON Schema $ref fetching from json.match_schema and json.verify_schema
  • Coverage reports can now explain why a range is not covered
  • Much faster partial evaluation for dynamically composed policies
New Rego keywords: and and or (#​7602)

Rego gains two keywords for combining conditions inside a single rule body — a long-standing
request, and one of the larger additions to the language in some time. and and or let control
flow that previously had to be split across helper rules stay where it is read.

Before, a rule body that needed to succeed on one of several conditions meant extracting a rule:

package example

allow if {
	input.method == "GET"
	admin_or_public_owner
}

admin_or_public_owner if input.user.admin

admin_or_public_owner if {
	input.user.owner
	input.resource.public
}

Now:

package example

import future.keywords.and
import future.keywords.or

# the and groups first, so this reads as:

# an admin, or an owner of a public resource
allow if {
	input.method == "GET"
	input.user.admin or input.user.owner and input.resource.public
}

Both keywords are opt-in future keywords:
import future.keywords.and, import future.keywords.or, or import future.keywords for both.

An and/or expression either succeeds or fails; it never produces a value. So you can't assign
one to a variable, pass one to a function, or use one as the head of a comprehension.

Operands can read variables from the rule body around them, but can't create new ones for the rest
of the rule to use — wrap an operand in braces to give it a body of its own, and any variables it
creates stay inside those braces. Only as much is evaluated as needed: if the left side settles the
outcome, the right side is skipped. And when both sides of an or succeed, you still get a single
result; evaluation doesn't split in two.

Further reading:

Try the new keywords in the Rego Playground, or in your
editor with the VS Code extension
or the IntelliJ IDEA plugin — see
Editor and IDE Support for others.

Authored by @​johanfylling

Behavior change: allow_net applies to remote JSON Schema $refs (#​8979)

The allow_net
capability restricts which hosts remote JSON Schema $refs may be fetched from, but it was only
wired up on the compile-time type-checking path. Policies using neither -s schemas nor
# METADATA schemas:
annotations never reached it, and an unset allowlist permitted every host — so
json.match_schema
and json.verify_schema,
which compile schemas at evaluation time, fetched $refs from anywhere. Their schema argument can
come from input, so the host was not necessarily under the policy author's control.

The allowlist now travels with the schema loader and is checked per caller at any nesting depth.
Every redirect hop is checked too, matching http.send, and the inter-query cache key includes the
allowlist so a permissive caller cannot populate the cache for a restrictive one.

Authored by @​sspaink, reported by @​charlesdaniels

Coverage reports explain why a range is not covered (#​8937)

Coverage reports showed that a
range was uncovered, but not why: ranges skipped by rule indexing
or early exit looked identical to dead code.

Not-covered ranges are now tagged with a Kind — index_excluded or early_exit — determined
by re-evaluating with each optimization disabled and diffing the extra coverage data. Both
supplementary passes run by default when --coverage is set; the new --coverage-runs flag on
opa eval and opa test selects which of them to run, and an empty list disables them.

Authored by @​charlieegan3

Runtime, SDK, Tooling
Compiler, Topdown and Rego

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@forking-renovate forking-renovate Bot added the dependencies Pull requests that update a dependency file label Jul 30, 2026
@renovate-bot
renovate-bot requested review from a team and q2w as code owners July 30, 2026 22:46
@forking-renovate

forking-renovate Bot commented Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown

ℹ️ Artifact update notice

File name: cli/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 65 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=7 days

Details:

Package Change
go 1.24.6 -> 1.26.0
github.com/stretchr/testify v1.11.1 -> v1.12.1
golang.org/x/oauth2 v0.35.0 -> v0.36.0
golang.org/x/text v0.34.0 -> v0.42.0
google.golang.org/protobuf v1.36.11 -> v1.36.12
cel.dev/expr v0.24.0 -> v0.25.2
cloud.google.com/go/auth v0.18.1 -> v0.18.2
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 -> v1.33.0
github.com/cncf/xds/go v0.0.0-20251022180443-0feb69152e9f -> v0.0.0-20260202195803-dba9d589def2
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 -> v4.4.1
github.com/envoyproxy/go-control-plane/envoy v1.35.0 -> v1.37.0
github.com/envoyproxy/protoc-gen-validate v1.2.1 -> v1.3.3
github.com/felixge/httpsnoop v1.0.4 -> v1.1.0
github.com/fsnotify/fsnotify v1.9.0 -> v1.10.1
github.com/go-jose/go-jose/v4 v4.1.3 -> v4.1.4
github.com/go-logr/logr v1.4.3 -> v1.4.4
github.com/go-openapi/analysis v0.21.2 -> v0.25.5
github.com/go-openapi/errors v0.20.2 -> v0.22.8
github.com/go-openapi/jsonpointer v0.20.0 -> v1.0.0
github.com/go-openapi/jsonreference v0.20.2 -> v1.0.0
github.com/go-openapi/loads v0.21.1 -> v0.25.0
github.com/go-openapi/spec v0.20.4 -> v0.22.9
github.com/go-openapi/strfmt v0.21.2 -> v0.27.0
github.com/go-openapi/swag v0.22.4 -> v0.28.0
github.com/go-viper/mapstructure/v2 v2.4.0 -> v2.5.0
github.com/gobwas/glob v0.2.3 -> v1.0.0
github.com/goccy/go-json v0.10.5 -> v0.10.6
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 -> v2.30.0
github.com/klauspost/compress v1.18.1 -> v1.20.0
github.com/lestrrat-go/dsig v1.0.0 -> v1.4.0
github.com/lestrrat-go/httprc/v3 v3.0.1 -> v3.0.6
github.com/lestrrat-go/jwx/v3 v3.0.12 -> v3.3.0
github.com/mattn/go-colorable v0.1.13 -> v0.1.14
github.com/mattn/go-runewidth v0.0.16 -> v0.0.19
github.com/prometheus/client_golang v1.23.2 -> v1.24.1
github.com/prometheus/client_model v0.6.2 -> v0.6.3
github.com/prometheus/common v0.66.1 -> v0.70.1
github.com/prometheus/procfs v0.17.0 -> v0.21.1
github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af -> v1.10.2
github.com/spiffe/go-spiffe/v2 v2.6.0 -> v2.7.0
github.com/valyala/fastjson v1.6.4 -> v1.6.10
github.com/vektah/gqlparser/v2 v2.5.31 -> v2.5.37
go.opentelemetry.io/contrib/detectors/gcp v1.38.0 -> v1.44.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 -> v0.70.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 -> v0.71.0
go.opentelemetry.io/otel v1.39.0 -> v1.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 -> v1.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 -> v1.46.0
go.opentelemetry.io/otel/metric v1.39.0 -> v1.46.0
go.opentelemetry.io/otel/sdk v1.39.0 -> v1.46.0
go.opentelemetry.io/otel/sdk/metric v1.39.0 -> v1.46.0
go.opentelemetry.io/otel/trace v1.39.0 -> v1.46.0
go.opentelemetry.io/proto/otlp v1.7.1 -> v1.11.0
go.yaml.in/yaml/v2 v2.4.2 -> v2.4.4
go.yaml.in/yaml/v3 v3.0.4 -> v3.0.5
golang.org/x/crypto v0.47.0 -> v0.57.0
golang.org/x/mod v0.32.0 -> v0.41.0
golang.org/x/net v0.49.0 -> v0.60.0
golang.org/x/sync v0.19.0 -> v0.23.0
golang.org/x/sys v0.40.0 -> v0.48.0
golang.org/x/term v0.39.0 -> v0.46.0
golang.org/x/time v0.14.0 -> v0.16.0
golang.org/x/tools v0.41.0 -> v0.49.0
google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 -> v0.0.0-20260819154853-08b0e4226688
google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20 -> v0.0.0-20260819154853-08b0e4226688
google.golang.org/grpc v1.78.0 -> v1.83.2

@renovate-bot renovate-bot added the dependencies Pull requests that update a dependency file label Jul 30, 2026
@dpebot

dpebot commented Jul 30, 2026

Copy link
Copy Markdown
Collaborator

/gcbrun

gemini-code-assist[bot]
gemini-code-assist Bot reviewed Jul 30, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates several Go dependencies in the cli module, including upgrading github.com/open-policy-agent/opa to v1.13.2, updating various OpenTelemetry libraries, and replacing github.com/go-ini/ini with gopkg.in/ini.v1. I have no feedback to provide as there are no review comments and the dependency updates appear standard.

@renovate-bot
renovate-bot force-pushed the renovate/cli-github.com-open-policy-agent-opa-1.x branch from 67c4e82 to 9dcc7a1 Compare July 30, 2026 22:50
@dpebot

dpebot commented Jul 30, 2026

Copy link
Copy Markdown
Collaborator

/gcbrun

@renovate-bot
renovate-bot force-pushed the renovate/cli-github.com-open-policy-agent-opa-1.x branch from 9dcc7a1 to d79a580 Compare July 30, 2026 23:09
@dpebot

dpebot commented Jul 30, 2026

Copy link
Copy Markdown
Collaborator

/gcbrun

@renovate-bot
renovate-bot force-pushed the renovate/cli-github.com-open-policy-agent-opa-1.x branch from d79a580 to 327220b Compare July 30, 2026 23:36
@dpebot

dpebot commented Jul 30, 2026

Copy link
Copy Markdown
Collaborator

/gcbrun

@renovate-bot
renovate-bot force-pushed the renovate/cli-github.com-open-policy-agent-opa-1.x branch from 327220b to f07295e Compare July 30, 2026 23:47
@dpebot

dpebot commented Jul 30, 2026

Copy link
Copy Markdown
Collaborator

/gcbrun

@renovate-bot
renovate-bot force-pushed the renovate/cli-github.com-open-policy-agent-opa-1.x branch from f07295e to ef0ca74 Compare July 31, 2026 01:29
@dpebot

dpebot commented Jul 31, 2026

Copy link
Copy Markdown
Collaborator

/gcbrun

@renovate-bot
renovate-bot force-pushed the renovate/cli-github.com-open-policy-agent-opa-1.x branch from ef0ca74 to c7046f1 Compare July 31, 2026 17:51
@dpebot

dpebot commented Jul 31, 2026

Copy link
Copy Markdown
Collaborator

/gcbrun

@renovate-bot
renovate-bot force-pushed the renovate/cli-github.com-open-policy-agent-opa-1.x branch from c7046f1 to e0f3a4b Compare July 31, 2026 19:24
@dpebot

dpebot commented Jul 31, 2026

Copy link
Copy Markdown
Collaborator

/gcbrun

@renovate-bot
renovate-bot force-pushed the renovate/cli-github.com-open-policy-agent-opa-1.x branch from e0f3a4b to 849308f Compare July 31, 2026 19:38
@dpebot

dpebot commented Jul 31, 2026

Copy link
Copy Markdown
Collaborator

/gcbrun

@renovate-bot
renovate-bot force-pushed the renovate/cli-github.com-open-policy-agent-opa-1.x branch from 849308f to 40fc4b8 Compare July 31, 2026 21:16
@dpebot

dpebot commented Jul 31, 2026

Copy link
Copy Markdown
Collaborator

/gcbrun

@renovate-bot
renovate-bot force-pushed the renovate/cli-github.com-open-policy-agent-opa-1.x branch from 40fc4b8 to 7ede40b Compare September 2, 2026 19:18
@dpebot

dpebot commented Sep 2, 2026

Copy link
Copy Markdown
Collaborator

/gcbrun

@renovate-bot
renovate-bot force-pushed the renovate/cli-github.com-open-policy-agent-opa-1.x branch from 7ede40b to 5e09bc4 Compare October 6, 2026 17:45
@dpebot

dpebot commented Oct 6, 2026

Copy link
Copy Markdown
Collaborator

/gcbrun

@renovate-bot
renovate-bot force-pushed the renovate/cli-github.com-open-policy-agent-opa-1.x branch from 5e09bc4 to 173df77 Compare October 6, 2026 22:45
@dpebot

dpebot commented Oct 6, 2026

Copy link
Copy Markdown
Collaborator

/gcbrun

@renovate-bot
renovate-bot force-pushed the renovate/cli-github.com-open-policy-agent-opa-1.x branch from 173df77 to d4241fc Compare October 8, 2026 10:11
@dpebot

dpebot commented Oct 8, 2026

Copy link
Copy Markdown
Collaborator

/gcbrun

@renovate-bot
renovate-bot force-pushed the renovate/cli-github.com-open-policy-agent-opa-1.x branch from d4241fc to cfb53c0 Compare October 12, 2026 18:24
@renovate-bot renovate-bot changed the title chore(deps): update module github.com/open-policy-agent/opa to v1.13.2 chore(deps): update module github.com/open-policy-agent/opa to v1.21.1 Oct 12, 2026
@dpebot

dpebot commented Oct 12, 2026

Copy link
Copy Markdown
Collaborator

/gcbrun

@renovate-bot renovate-bot changed the title chore(deps): update module github.com/open-policy-agent/opa to v1.21.1 chore(deps): update module github.com/open-policy-agent/opa to v1.21.2 Oct 19, 2026
@renovate-bot
renovate-bot force-pushed the renovate/cli-github.com-open-policy-agent-opa-1.x branch from cfb53c0 to dbaa744 Compare October 19, 2026 22:30
@dpebot

dpebot commented Oct 19, 2026

Copy link
Copy Markdown
Collaborator

/gcbrun

@renovate-bot
renovate-bot force-pushed the renovate/cli-github.com-open-policy-agent-opa-1.x branch from dbaa744 to 0c53b7a Compare October 25, 2026 02:50
@dpebot

dpebot commented Oct 25, 2026

Copy link
Copy Markdown
Collaborator

/gcbrun

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@q2w q2w Awaiting requested review from q2w q2w is a code owner
1 more reviewer
@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@renovate-bot @dpebot