build(deps): bump the all-go-mod-patch-and-minor group with 7 updates #3180

dependabot · 2024-08-05T00:32:40Z

Bumps the all-go-mod-patch-and-minor group with 7 updates:

Package	From	To
github.com/open-policy-agent/opa	`0.66.0`	`0.67.0`
github.com/open-policy-agent/opa-envoy-plugin	`0.66.0-envoy-2`	`0.67.0-envoy`
github.com/redis/go-redis/v9	`9.6.0`	`9.6.1`
github.com/tidwall/gjson	`1.17.1`	`1.17.3`
golang.org/x/oauth2	`0.21.0`	`0.22.0`
golang.org/x/sync	`0.7.0`	`0.8.0`
golang.org/x/time	`0.5.0`	`0.6.0`

Updates github.com/open-policy-agent/opa from 0.66.0 to 0.67.0

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v0.67.0

This release contains a mix of features, a new builtin function (strings.count), performance improvements, and bugfixes.

Breaking Change

Request Body Size Limits

OPA now automatically rejects very large requests (#6868) authored by @philipaconrad. Requests with a Content-Length larger than 128 MB uncompressed, and gzipped requests with payloads that decompress to larger than 256 MB will be rejected, as part of hardening OPA against denial-of-service attacks. Previously, a large enough request could cause an OPA instance to run out of memory in low-memory sidecar deployment scenarios, just from attempting to read the request body into memory.

These changes allow improvements in memory usage for the OPA HTTP server, and help OPA deployments avoid some accidental out-of-memory situations.

For most users, no changes will be needed to continue using OPA. However, to control this behavior, two new configuration keys are available: server.decoding.max_length and server.decoding.gzip.max_length. These control the max size in bytes to allow for an incoming request payload, and the maximum size in bytes to allow for a decompressed gzip request payload, respectively.

Here's an example OPA configuration using the new keys:
# Set max request size to 64 MB and max gzip size (decompressed) to be 128 MB.
server:
  decoding:
    max_length: 67108864
    gzip:
      max_length: 134217728
Topdown and Rego

topdown: New strings.count builtin which returns the number of non-overlapping instances of a substring in a string (#6827) authored by @Manish-Giri

format: Produce error when --rego-v1 formatted module has rule name conflicting with keyword (#6833) authored by @johanfylling

topdown: Add cap to caches for regex and glob built-in functions (#6828) authored by @johanfylling. This fixes possible memory leaks where caches grow uncontrollably when large amounts of regexes or globs are generated or originate from the input document.

Runtime, Tooling, SDK

repl: Add support for correctly loading bundle modules (#6872) authored by @ashutosh-narkar

plugins/discovery: Allow un-registration of discovery listener (#6851) authored by @mjungsbluth. The discovery plugin allows OPA to register a bundle download status listener but previously did not offer a method to unregister that listener

plugins/logs: Reduce amount of work performed inside global lock in decision log plugin (#6859) authored by @johanfylling

plugins/rest: Add a new client credential attribute to support Azure Workload Identity. This would allow workloads deployed on an Azure Kubernetes Services (AKS) cluster to authenticate and access Azure cloud resources (#6802) authored by @ledbutter

cmd/inspect: Add ability for opa inspect to inspect a single file outside of any bundle (#6873) authored by @tjons

cmd+bundle: Add --follow-symlinks flag to the opa build command to allow users to build directories with symlinked files, and have the contents of those symlinked files included in the built bundle (#6800) authored by @tjons

server: Add missing handling in the server for the explain=fails query value (#6886) authored by @acamatcisco

Docs, Website, Ecosystem

docs: Update bundle section with an example of a manifest with rego_version and file_rego_versions attributes (#6885) authored by @ashutosh-narkar

docs: Better link language SDKs to make them more discoverable (#6866) authored by @charlieegan3

Miscellaneous

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

0.67.0

This release contains a mix of features, a new builtin function (strings.count), performance improvements, and bugfixes.

Breaking Change

Request Body Size Limits

OPA now automatically rejects very large requests (#6868) authored by @philipaconrad. Requests with a Content-Length larger than 128 MB uncompressed, and gzipped requests with payloads that decompress to larger than 256 MB will be rejected, as part of hardening OPA against denial-of-service attacks. Previously, a large enough request could cause an OPA instance to run out of memory in low-memory sidecar deployment scenarios, just from attempting to read the request body into memory.

These changes allow improvements in memory usage for the OPA HTTP server, and help OPA deployments avoid some accidental out-of-memory situations.

For most users, no changes will be needed to continue using OPA. However, to control this behavior, two new configuration keys are available: server.decoding.max_length and server.decoding.gzip.max_length. These control the max size in bytes to allow for an incoming request payload, and the maximum size in bytes to allow for a decompressed gzip request payload, respectively.

Here's an example OPA configuration using the new keys:
# Set max request size to 64 MB and max gzip size (decompressed) to be 128 MB.
server:
  decoding:
    max_length: 67108864
    gzip:
      max_length: 134217728
Topdown and Rego

topdown: New strings.count builtin which returns the number of non-overlapping instances of a substring in a string (#6827) authored by @Manish-Giri

format: Produce error when --rego-v1 formatted module has rule name conflicting with keyword (#6833) authored by @johanfylling

topdown: Add cap to caches for regex and glob built-in functions (#6828) authored by @johanfylling. This fixes possible memory leaks where caches grow uncontrollably when large amounts of regexes or globs are generated or originate from the input document.

Runtime, Tooling, SDK

repl: Add support for correctly loading bundle modules (#6872) authored by @ashutosh-narkar

plugins/discovery: Allow un-registration of discovery listener (#6851) authored by @mjungsbluth. The discovery plugin allows OPA to register a bundle download status listener but previously did not offer a method to unregister that listener

plugins/logs: Reduce amount of work performed inside global lock in decision log plugin (#6859) authored by @johanfylling

plugins/rest: Add a new client credential attribute to support Azure Workload Identity. This would allow workloads deployed on an Azure Kubernetes Services (AKS) cluster to authenticate and access Azure cloud resources (#6802) authored by @ledbutter

cmd/inspect: Add ability for opa inspect to inspect a single file outside of any bundle (#6873) authored by @tjons

cmd+bundle: Add --follow-symlinks flag to the opa build command to allow users to build directories with symlinked files, and have the contents of those symlinked files included in the built bundle (#6800) authored by @tjons

server: Add missing handling in the server for the explain=fails query value (#6886) authored by @acamatcisco

Docs, Website, Ecosystem

docs: Update bundle section with an example of a manifest with rego_version and file_rego_versions attributes (#6885) authored by @ashutosh-narkar

docs: Better link language SDKs to make them more discoverable (#6866) authored by @charlieegan3

... (truncated)

Commits

b62ae6b Prepare v0.67.0 release
bec8e1a build(deps): bump github/codeql-action from 3.25.13 to 3.25.14 (#6888)
d48fdd9 server: Add missing handling for explain=fails to the REST API.
959f9e5 docs: Add an example of a manifest with attribute
a793f27 repl: Add support for correctly loading bundle modules
c5706ee server+util: Limit max request sizes, prealloc request buffers (#6868)
0ca35e2 build(deps): bump docker/setup-buildx-action from 3.4.0 to 3.5.0 (#6880)
f9ccb66 build(deps): bump github/codeql-action from 3.25.12 to 3.25.13 (#6881)
0db1f8f build(deps): bump docker/setup-qemu-action from 3.1.0 to 3.2.0 (#6882)
ac3ddf9 docs: Update generated CLI docs
Additional commits viewable in compare view

Updates github.com/open-policy-agent/opa-envoy-plugin from 0.66.0-envoy-2 to 0.67.0-envoy

Release notes

Sourced from github.com/open-policy-agent/opa-envoy-plugin's releases.

v0.67.0-envoy

What's Changed

build(deps): bump github.com/open-policy-agent/opa from 0.66.0 to 0.67.0 by @ashutosh-narkar in open-policy-agent/opa-envoy-plugin#569. See the OPA v0.67.0 release notes.

build(go): bump 1.22.4 -> 1.22.5 by @srenatus in open-policy-agent/opa-envoy-plugin#565

build(deps): bump google.golang.org/grpc from 1.64.0 to 1.65.0

build(deps): bump golang.org/x/tools from 0.22.0 to 0.23.0

Commits

a596d30 build(deps): bump github.com/open-policy-agent/opa from 0.66.0 to 0.67.0
c111c33 build(deps): bump golang.org/x/tools from 0.22.0 to 0.23.0
5b63a68 build(deps): bump google.golang.org/grpc from 1.64.0 to 1.65.0
10d8375 build(go): bump 1.22.4 -> 1.22.5
See full diff in compare view

Updates github.com/redis/go-redis/v9 from 9.6.0 to 9.6.1

Release notes

Sourced from github.com/redis/go-redis/v9's releases.

9.6.1

Changes

9.6

This release contains all new features from version 9.6.

🚀 New Features

Support Hash-field expiration commands (#2991)

Support Hash-field expiration commands in Pipeline & Fix HExpire HExpireWithArgs expiration (#3038)

Support NOVALUES parameter for HSCAN (#2925)

Added test case for CLIENT KILL with MAXAGE option (#2971)

Add support for XREAD last entry (#3005)

Reduce the type assertion of CheckConn (#3066)

9.6.1

In addition minor changes were performed to retract version 9.5.3 and 9.5.4 that were released accidentally.

🧰 Maintenance

Change CI to 7.4.0-RC2 (#3070)

🎁 Package Distribution

Retract versions 9.5.3 and 9.5.4 (#3069)

Contributors

We'd like to thank all the contributors who worked on this release!

@LINKIWI, @b1ron, @gerzse, @haines, @immersedin, @naiqianz, @ofekshenawa, @srikar-jilugu, @tzongw, @vladvildanov, @vmihailenco and @monkey92t

Commits

c3610cd cp retracts and bump version to 9.6.1 (#3069)
b0b94e7 Change CI to 7.4.0-RC2 (#3070)
See full diff in compare view

Updates github.com/tidwall/gjson from 1.17.1 to 1.17.3

Commits

5ab551f Add flag for disabling HTML escaping
28d458b Disable html escaping
c2bc5a4 dark mode logo
2ba56cc Merge pull request #354 from rustfix/master
5d0d40c chore: fix some typos in comments
See full diff in compare view

Updates golang.org/x/oauth2 from 0.21.0 to 0.22.0

Commits

6d8340f LICENSE: update per Google Legal
See full diff in compare view

Updates golang.org/x/sync from 0.7.0 to 0.8.0

Commits

411f99e LICENSE: update per Google Legal
See full diff in compare view

Updates golang.org/x/time from 0.5.0 to 0.6.0

Commits

5d9ef58 LICENSE: update per Google Legal
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the all-go-mod-patch-and-minor group with 7 updates: | Package | From | To | | --- | --- | --- | | [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `0.66.0` | `0.67.0` | | [github.com/open-policy-agent/opa-envoy-plugin](https://github.com/open-policy-agent/opa-envoy-plugin) | `0.66.0-envoy-2` | `0.67.0-envoy` | | [github.com/redis/go-redis/v9](https://github.com/redis/go-redis) | `9.6.0` | `9.6.1` | | [github.com/tidwall/gjson](https://github.com/tidwall/gjson) | `1.17.1` | `1.17.3` | | [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.21.0` | `0.22.0` | | [golang.org/x/sync](https://github.com/golang/sync) | `0.7.0` | `0.8.0` | | [golang.org/x/time](https://github.com/golang/time) | `0.5.0` | `0.6.0` | Updates `github.com/open-policy-agent/opa` from 0.66.0 to 0.67.0 - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](open-policy-agent/opa@v0.66.0...v0.67.0) Updates `github.com/open-policy-agent/opa-envoy-plugin` from 0.66.0-envoy-2 to 0.67.0-envoy - [Release notes](https://github.com/open-policy-agent/opa-envoy-plugin/releases) - [Changelog](https://github.com/open-policy-agent/opa-envoy-plugin/blob/main/CHANGELOG.md) - [Commits](open-policy-agent/opa-envoy-plugin@v0.66.0-envoy-2...v0.67.0-envoy) Updates `github.com/redis/go-redis/v9` from 9.6.0 to 9.6.1 - [Release notes](https://github.com/redis/go-redis/releases) - [Changelog](https://github.com/redis/go-redis/blob/master/CHANGELOG.md) - [Commits](redis/go-redis@v9.6.0...v9.6.1) Updates `github.com/tidwall/gjson` from 1.17.1 to 1.17.3 - [Commits](tidwall/gjson@v1.17.1...v1.17.3) Updates `golang.org/x/oauth2` from 0.21.0 to 0.22.0 - [Commits](golang/oauth2@v0.21.0...v0.22.0) Updates `golang.org/x/sync` from 0.7.0 to 0.8.0 - [Commits](golang/sync@v0.7.0...v0.8.0) Updates `golang.org/x/time` from 0.5.0 to 0.6.0 - [Commits](golang/time@v0.5.0...v0.6.0) --- updated-dependencies: - dependency-name: github.com/open-policy-agent/opa dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-mod-patch-and-minor - dependency-name: github.com/open-policy-agent/opa-envoy-plugin dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-mod-patch-and-minor - dependency-name: github.com/redis/go-redis/v9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-go-mod-patch-and-minor - dependency-name: github.com/tidwall/gjson dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-go-mod-patch-and-minor - dependency-name: golang.org/x/oauth2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-mod-patch-and-minor - dependency-name: golang.org/x/sync dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-mod-patch-and-minor - dependency-name: golang.org/x/time dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-mod-patch-and-minor ... Signed-off-by: dependabot[bot] <[email protected]>

MustafaSaber · 2024-08-05T13:00:10Z

Concerns from #3169 are still valid, maybe I will create a PR to update other dependencies and we leave OPA for now

Pushpalanka · 2024-08-08T09:17:27Z

Concerns from #3169 are still valid, maybe I will create a PR to update other dependencies and we leave OPA for now

OPA now has a bug fix release, https://github.com/open-policy-agent/opa/releases/tag/v0.67.1 and https://github.com/open-policy-agent/opa-envoy-plugin/releases/tag/v0.67.1-envoy

MustafaSaber · 2024-08-08T10:49:43Z

OPA now has a bug fix release, https://github.com/open-policy-agent/opa/releases/tag/v0.67.1 and https://github.com/open-policy-agent/opa-envoy-plugin/releases/tag/v0.67.1-envoy

Great! We can merge next week dependencies updates, thanks for the follow up!

dependabot · 2024-08-12T00:45:21Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

MustafaSaber · 2024-08-12T07:53:23Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

the other way #3186

dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Aug 5, 2024

dependabot bot closed this Aug 12, 2024

dependabot bot deleted the dependabot/go_modules/all-go-mod-patch-and-minor-b4d191045a branch August 12, 2024 00:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the all-go-mod-patch-and-minor group with 7 updates #3180

build(deps): bump the all-go-mod-patch-and-minor group with 7 updates #3180

dependabot bot commented on behalf of github Aug 5, 2024 •

edited

Loading

MustafaSaber commented Aug 5, 2024

Pushpalanka commented Aug 8, 2024

MustafaSaber commented Aug 8, 2024 •

edited

Loading

dependabot bot commented on behalf of github Aug 12, 2024

MustafaSaber commented Aug 12, 2024

build(deps): bump the all-go-mod-patch-and-minor group with 7 updates #3180

build(deps): bump the all-go-mod-patch-and-minor group with 7 updates #3180

Conversation

dependabot bot commented on behalf of github Aug 5, 2024 • edited Loading

v0.67.0

Breaking Change

Request Body Size Limits

Topdown and Rego

Runtime, Tooling, SDK

Docs, Website, Ecosystem

Miscellaneous

0.67.0

Breaking Change

Request Body Size Limits

Topdown and Rego

Runtime, Tooling, SDK

Docs, Website, Ecosystem

v0.67.0-envoy

What's Changed

9.6.1

Changes

9.6

🚀 New Features

9.6.1

🧰 Maintenance

🎁 Package Distribution

Contributors

MustafaSaber commented Aug 5, 2024

Pushpalanka commented Aug 8, 2024

MustafaSaber commented Aug 8, 2024 • edited Loading

dependabot bot commented on behalf of github Aug 12, 2024

MustafaSaber commented Aug 12, 2024

dependabot bot commented on behalf of github Aug 5, 2024 •

edited

Loading

MustafaSaber commented Aug 8, 2024 •

edited

Loading