build(deps): bump github.com/open-policy-agent/opa from 1.20.1 to 1.21.2

[dependabot]

Bumps github.com/open-policy-agent/opa from 1.20.1 to 1.21.2.

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.21.2

This release builds the OPA binary artifacts with the latest version of Go (v1.27.2), its standard library, and the golang.org/x/net dependency (v0.60.0).

See these security advisories:

• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
• https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs

Furthermore, it addresses a mismatch in how encoded slashes were handled in the input to a basic authorization policy and the Data API (#9323, reported by @​abhishekkushwaha4u, fixed by @​sspaink).

v1.21.1

This release fixes a compiler regression introduced in OPA v1.21.0.

Fix some … in/every in comprehensions nested in object and set literals (#9280)

A comprehension using some … in or every in its body, nested inside an object or set literal, was wrongly treated as ground, so the compiler skipped rewriting it. some … in then failed with rego_unsafe_var_error; every caused a compiler panic:

package example
p := {"k": [r.a | some r in input.xs]}           # rego_unsafe_var_error: var r is unsafe
q := {[1 | every x in input.xs { x > 0 }]}       # panic

Array literals weren't affected, and neither were literals that contain some other non-ground term.

authored by @​srenatus, reported by @​tun0

v1.21.0

This release contains a mix of new features and bug fixes. Notably:

• Improved rule indexing
• Improved rule recursion check
• YAML is parsed against the 1.2 core schema (breaking change)

Rules with general refs no longer collide in the recursion check (#6813)

Before, this was a recursion error:

package play
p[x].foo.bar if {
x := "a"
not p[x].foo.baz
}
</tr></table>

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.21.2

This release builds the OPA binary artifacts with the latest version of Go (v1.27.2), its standard library, and the golang.org/x/net dependency (v0.60.0).

See these security advisories:

• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
• https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs

Furthermore, it addresses a mismatch in how encoded slashes were handled in the input to a basic authorization policy and the Data API (#9323, reported by @​abhishekkushwaha4u, fixed by @​sspaink).

1.21.1

This release fixes a compiler regression introduced in OPA v1.21.0.

Fix some … in/every in comprehensions nested in object and set literals (#9280)

A comprehension using some … in or every in its body, nested inside an object or set literal, was wrongly treated as ground, so the compiler skipped rewriting it. some … in then failed with rego_unsafe_var_error; every caused a compiler panic:

package example
p := {"k": [r.a | some r in input.xs]}           # rego_unsafe_var_error: var r is unsafe
q := {[1 | every x in input.xs { x > 0 }]}       # panic

Array literals weren't affected, and neither were literals that contain some other non-ground term.

authored by @​srenatus, reported by @​tun0

1.21.0

This release contains a mix of new features and bug fixes. Notably:

• Improved rule indexing
• Improved rule recursion check
• YAML is parsed against the 1.2 core schema (breaking change)

Rules with general refs no longer collide in the recursion check (#6813)

Before, this was a recursion error:

package play
p[x].foo.bar if {
</tr></table>

... (truncated)

Commits

• 3f7474e Release 1.21.2
• a48c42a server: resolve encoded request paths consistently in authorizer and handlers...
• 60edfb2 build: bump go (1.27.1 -> 1.27.2) (#9340)
• 2a109e5 Prepare v1.21.1 release
• 9057ccb ast: treat SomeDecl/Every exprs as non-ground in Expr.IsGround
• dc6269f Release v1.21.0 (#9258)
• f6aa85f ast: count a ref once when an index entry replaces its var entry
• b7a4a42 build(deps): bump the dependencies group across 2 directories with 11 updates
• 3f11d3a docs: update Agent Evidence Admission repo links (#9255)
• 2dcd8ab topdown: fix flaky TestRegexBuiltinCache (#9254)
• Additional commits viewable in compare view

[Justin (jterry75)]

Tingmao Wang (@micromaomao) - Can you take a look at the failure here please. Looks like the policy doesn't compile on the .revision

[dependabot]

A newer version of github.com/open-policy-agent/opa exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

[Justin (jterry75)]

Dependabot (@dependabot) recreate

[Justin (jterry75)]

Takuro Sato (@takuro-sato) / Tingmao Wang (@micromaomao) - Can one of you take a look. They must have done a breaking chance because the policies don't seem to compile anymore.