[dependabot]

Bumps the go group with 1 update in the /packages/policy directory: github.com/open-policy-agent/opa.

Updates github.com/open-policy-agent/opa from 1.22.0 to 1.22.2

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.22.2

This is a bugfix release for a type checker regression in v1.21.0.

Iterating an empty collection is rejected by the type checker

Policies that iterate a collection known to be empty, such as some x in [] or m[_] where m := {}, were rejected with rego_type_error: undefined ref. Iteration with a non-constant key is valid again, and simply yields nothing. Comparing or unifying the elements of such a collection with a value is accepted as well. Constant keys, like [][0], are still reported as undefined.

Reported by @​kholia.

v1.22.1

This is a bugfix release for a rule indexer regression in v1.21.0.

x in {"a", input.y} never matches for a ref x

allow if {
	input.x in {"a", input.y}
}

For an input of {"x": "b", "y": "b"}, this should evaluate to true. Due to a bug in the rule indexer, the rule body hadn't been returned, and allow thus evaluated to undefined.

Reported by @​kholia.

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.22.2

This is a bugfix release for a type checker regression in v1.21.0.

Iterating an empty collection is rejected by the type checker

Policies that iterate a collection known to be empty, such as some x in [] or m[_] where m := {}, were rejected with rego_type_error: undefined ref. Iteration with a non-constant key is valid again, and simply yields nothing. Comparing or unifying the elements of such a collection with a value is accepted as well. Constant keys, like [][0], are still reported as undefined.

Reported by @​kholia.

1.22.1

This is a bugfix release for a rule indexer regression in v1.21.0.

x in {"a", input.y} never matches for a ref x

allow if {
	input.x in {"a", input.y}
}

For an input of {"x": "b", "y": "b"}, this should evaluate to true. Due to a bug in the rule indexer, the rule body hadn't been returned, and allow thus evaluated to undefined.

Reported by @​kholia.

Commits

• 482d9e3 Release 1.22.2 prep (#9521)
• 7fb317c Release 1.22.1
• c918277 ast: keep a rule indexed as "anything" for in with a var member
• See full diff in compare view