chore: bump github.com/open-policy-agent/opa from 1.4.2 to 1.18.0 by dependabot[bot] · Pull Request #797 · officialmofabs/codeserver

dependabot · 2026-06-29T11:06:05Z

Bumps github.com/open-policy-agent/opa from 1.4.2 to 1.18.0.

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.18.0

This release contains a mix of bugfixes and small features. Notably:

A breaking fix to the outbound User-Agent header so it conforms to RFC 9110 (see below)

Container-aware resource limits: automatic GOMAXPROCS is restored and automatic GOMEMLIMIT is now supported

Several opa fmt correctness fixes

Improvements to opa test --coverage (ranges in report, inline rule head tracking, conjunction-expression coverage)

Breaking: Fix User-Agent according to RFC9110 (#8792)

OPA's outbound HTTP requests (bundle, discovery, decision log, status, http.send, AWS KMS/ECR) previously sent User-Agent: Open Policy Agent/<version> (<os>, <arch>), which is not a valid RFC 9110 User-Agent value because the product token cannot contain spaces. The header is now Open-Policy-Agent/<version> (<os>, <arch>). Server-side log filters or WAF rules that exact-match the old string will need to be updated.

Authored by @sspaink, reported by @SpecLad

Runtime, SDK, Tooling

bundle: fix per-module rego version lookup (#8797) authored by @sspaink, reported by @xubinzheng

bundle: improve determinism of file_rego_versions patterns with overlap (#8733) authored by @philipaconrad

cover: Track inline rule head in post trace walk (#6531) authored by @charlieegan3, reported by @anderseknert

cover: Update report to include ranges (#8748) reported and authored by @charlieegan3

cover: Add support for coverage of conjunction exprs (#8809) authored by @charlieegan3

download/oci: Set Accept headers (#8720) authored by @charlieegan3

fmt: preserve the multiline but single entry iterables (#8557) authored by @unichronic, reported by @anderseknert

format: Fix dropped with-clause after comment in object value (#8765) authored by @sspaink, reported by @srabraham

format: keep lone with on the closing-bracket line of multi-line expressions (#8804) authored by @anneheartrecord, reported by @burnster

oracle: Fix find-definition on expressions inside ast.Not nodes (#8731) authored by @johanfylling

runtime: Restore goautomaxprocs, add automemlimit (#8784) authored by @charlieegan3

Compiler, Topdown and Rego

ast: Apply location to inner ast.Not expressions (#8717) authored by @johanfylling, reported by @anderseknert

ast: Clean up code for value comparisons (#8737) authored by @anderseknert

ast: Fix PE regression for future.keywords.not negation inside every (#8781) authored by @johanfylling

internal/edittree: Add recursive tree node recycling (#8693) authored by @philipaconrad

internal: compile,planner: improve determinism of plan/wasm bundle builds (#8732) authored by @philipaconrad

perf: avoid allocations in object.get (#8729) authored by @anderseknert

topdown: Fix PE not namespacing vars in comprehensions nested inside every (#8816) authored by @johanfylling

topdown: remove dst.Compare(src) shortcut (#8739) authored by @srenatus

topdown: skip strconv.ParseInt in format_int base-10 fast path (#8801) authored by @srenatus

Docs, Website, Ecosystem

docs/chore: Remove broken links (#8714) authored by @charlieegan3, reported by @github-actions

docs: PoC for kapa.ai (#8125) reported and authored by @charlieegan3

docs(ecosystem): update OPA MCP entry with video, blog, and distribution links (#8712) authored by @OrygnsCode

docs/contributing: add formatting (#8740) authored by @mmzzuu

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.18.0

This release contains a mix of bugfixes and small features. Notably:

A breaking fix to the outbound User-Agent header so it conforms to RFC 9110 (see below)

Container-aware resource limits: automatic GOMAXPROCS is restored and automatic GOMEMLIMIT is now supported

Several opa fmt correctness fixes

Improvements to opa test --coverage (ranges in report, inline rule head tracking, conjunction-expression coverage)

Breaking: Fix User-Agent according to RFC9110 (#8792)

OPA's outbound HTTP requests (bundle, discovery, decision log, status, http.send, AWS KMS/ECR) previously sent User-Agent: Open Policy Agent/<version> (<os>, <arch>), which is not a valid RFC 9110 User-Agent value because the product token cannot contain spaces. The header is now Open-Policy-Agent/<version> (<os>, <arch>). Server-side log filters or WAF rules that exact-match the old string will need to be updated.

Authored by @sspaink, reported by @SpecLad

Runtime, SDK, Tooling

bundle: fix per-module rego version lookup (#8797) authored by @sspaink, reported by @xubinzheng

bundle: improve determinism of file_rego_versions patterns with overlap (#8733) authored by @philipaconrad

cover: Track inline rule head in post trace walk (#6531) authored by @charlieegan3, reported by @anderseknert

cover: Update report to include ranges (#8748) reported and authored by @charlieegan3

cover: Add support for coverage of conjunction exprs (#8809) authored by @charlieegan3

download/oci: Set Accept headers (#8720) authored by @charlieegan3

fmt: preserve the multiline but single entry iterables (#8557) authored by @unichronic, reported by @anderseknert

format: Fix dropped with-clause after comment in object value (#8765) authored by @sspaink, reported by @srabraham

format: keep lone with on the closing-bracket line of multi-line expressions (#8804) authored by @anneheartrecord, reported by @burnster

oracle: Fix find-definition on expressions inside ast.Not nodes (#8731) authored by @johanfylling

runtime: Restore goautomaxprocs, add automemlimit (#8784) authored by @charlieegan3

Compiler, Topdown and Rego

ast: Apply location to inner ast.Not expressions (#8717) authored by @johanfylling, reported by @anderseknert

ast: Clean up code for value comparisons (#8737) authored by @anderseknert

ast: Fix PE regression for future.keywords.not negation inside every (#8781) authored by @johanfylling

internal/edittree: Add recursive tree node recycling (#8693) authored by @philipaconrad

internal: compile,planner: improve determinism of plan/wasm bundle builds (#8732) authored by @philipaconrad

perf: avoid allocations in object.get (#8729) authored by @anderseknert

topdown: Fix PE not namespacing vars in comprehensions nested inside every (#8816) authored by @johanfylling

topdown: remove dst.Compare(src) shortcut (#8739) authored by @srenatus

topdown: skip strconv.ParseInt in format_int base-10 fast path (#8801) authored by @srenatus

Docs, Website, Ecosystem

docs/chore: Remove broken links (#8714) authored by @charlieegan3, reported by @github-actions

docs: PoC for kapa.ai (#8125) reported and authored by @charlieegan3

docs(ecosystem): update OPA MCP entry with video, blog, and distribution links (#8712) authored by @OrygnsCode

... (truncated)

Commits

cc2c5c6 Prepare v1.18 release (#8820)
e72a98f format: keep lone with on the closing-bracket line of multi-line expression...
03646dd topdown: Fix PE not namespacing vars in comprehensions nested inside every ...
bf2bb52 benchmarks: split off script, emit markdown table
02ce276 version: fix ill-formed User-Agent header (#8796)
1fdbb77 build(deps): bump the dependencies group across 2 directories with 6 updates
954196a cover: Add support for coverage of conjunction exprs (#8809)
dec8333 deduplicate change-detection output in pr CI checks (#8808)
09679ab benchmarks: use details+summary comments for benchlab results (#8811)
57742e8 build(deps): bump webpack-dev-server from 5.2.4 to 5.2.5 in /docs (#8807)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 1.4.2 to 1.18.0. - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](open-policy-agent/opa@v1.4.2...v1.18.0) --- updated-dependencies: - dependency-name: github.com/open-policy-agent/opa dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

cloudflare-workers-and-pages · 2026-06-29T11:06:41Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	codeserver	`a78755b`	Jun 29 2026, 11:06 AM

socket-security · 2026-06-29T11:07:26Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability
golang/golang.org/x/oauth2@v0.29.0 ⏵ v0.36.0	⁺¹
golang/github.com/prometheus/client_golang@v1.22.0 ⏵ v1.23.2	⁺¹
golang/golang.org/x/crypto@v0.39.0 ⏵ v0.52.0	⁺¹	⁺⁷⁵
golang/golang.org/x/net@v0.41.0 ⏵ v0.55.0		⁺²
golang/golang.org/x/tools@v0.33.0 ⏵ v0.45.0
golang/google.golang.org/grpc@v1.73.0 ⏵ v1.81.1	⁺¹	⁺⁷⁵
golang/google.golang.org/protobuf@v1.36.6 ⏵ v1.36.11	⁺¹
golang/go.opentelemetry.io/otel@v1.37.0 ⏵ v1.44.0	⁺¹	⁺¹⁶
golang/github.com/open-policy-agent/opa@v1.4.2 ⏵ v1.18.0	⁺¹
golang/golang.org/x/text@v0.26.0 ⏵ v0.38.0
golang/github.com/prometheus/client_model@v0.6.1 ⏵ v0.6.2
golang/github.com/prometheus/common@v0.63.0 ⏵ v0.67.5
golang/golang.org/x/sys@v0.33.0 ⏵ v0.45.0
golang/github.com/klauspost/compress@v1.18.0 ⏵ v1.18.5	⁺¹
golang/github.com/stretchr/testify@v1.10.0 ⏵ v1.11.1	⁺¹
golang/golang.org/x/mod@v0.25.0 ⏵ v0.36.0	⁺¹
golang/github.com/spf13/pflag@v1.0.6 ⏵ v1.0.10
golang/github.com/go-jose/go-jose/v4@v4.1.0 ⏵ v4.1.4		⁺¹⁶
golang/cloud.google.com/go/compute/metadata@v0.7.0 ⏵ v0.9.0	⁺¹
golang/go.opentelemetry.io/otel/sdk@v1.37.0 ⏵ v1.44.0	⁺¹	⁺²²
golang/github.com/fsnotify/fsnotify@v1.9.0 ⏵ v1.10.1	⁺¹
golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.35.0 ⏵ v1.44.0
golang/golang.org/x/sync@v0.15.0 ⏵ v0.21.0
golang/go.opentelemetry.io/otel/trace@v1.37.0 ⏵ v1.44.0	⁺¹
golang/golang.org/x/term@v0.32.0 ⏵ v0.43.0	⁺¹
golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.35.0 ⏵ v1.44.0

View full report

socket-security · 2026-06-29T11:07:28Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: golang `github.com/envoyproxy/go-control-plane/envoy` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `golang/google.golang.org/grpc@v1.81.1` → `golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: golang `github.com/envoyproxy/go-control-plane/envoy` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `golang/google.golang.org/grpc@v1.81.1` → `golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: golang `github.com/envoyproxy/go-control-plane/envoy` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `golang/google.golang.org/grpc@v1.81.1` → `golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: golang `github.com/envoyproxy/go-control-plane/envoy` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `golang/google.golang.org/grpc@v1.81.1` → `golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: golang `github.com/envoyproxy/go-control-plane/envoy` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `golang/google.golang.org/grpc@v1.81.1` → `golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: golang `github.com/envoyproxy/go-control-plane/envoy` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `golang/google.golang.org/grpc@v1.81.1` → `golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: golang `golang.org/x/tools` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go.mod → `golang/golang.org/x/tools@v0.45.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/golang.org/x/tools@v0.45.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jun 29, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: bump github.com/open-policy-agent/opa from 1.4.2 to 1.18.0#797

chore: bump github.com/open-policy-agent/opa from 1.4.2 to 1.18.0#797
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/github.com/open-policy-agent/opa-1.18.0

dependabot Bot commented on behalf of github Jun 29, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 29, 2026

Uh oh!

socket-security Bot commented Jun 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 29, 2026

v1.18.0

Breaking: Fix User-Agent according to RFC9110 (#8792)

Runtime, SDK, Tooling

Compiler, Topdown and Rego

Docs, Website, Ecosystem

1.18.0

Breaking: Fix User-Agent according to RFC9110 (#8792)

Runtime, SDK, Tooling

Compiler, Topdown and Rego

Docs, Website, Ecosystem

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

socket-security Bot commented Jun 29, 2026

Uh oh!

socket-security Bot commented Jun 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

cloudflare-workers-and-pages Bot commented Jun 29, 2026 •

edited

Loading