build(deps): bump github.com/open-policy-agent/opa from 1.19.1 to 1.21.0

[dependabot]

Bumps github.com/open-policy-agent/opa from 1.19.1 to 1.21.0.

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.21.0

This release contains a mix of new features and bug fixes. Notably:

• Improved rule indexing
• Improved rule recursion check
• YAML is parsed against the 1.2 core schema (breaking change)

Rules with general refs no longer collide in the recursion check (#6813)

Before, this was a recursion error:

package play
p[x].foo.bar if {
x := "a"
not p[x].foo.baz
}
p[x].foo.baz if {
x := "a"
false
}

Rules with a variable in their head are all stored at the ground prefix of their ref, so p[x].foo.bar and p[x].foo.baz looked like dependencies of each other. The compiler is now less conservative and compares the ref parts past the prefix. Genuine cycles are still reported.

The IR and Wasm targets however still return an error: they plan one function per ground path prefix, and cannot evaluate part of a function that is still being planned.

Authored by @​sspaink, reported by @​tsandall

Data and Query APIs can return rule labels in the response (#9211)

# METADATA labels for evaluated rules were only available in decision log events. The Data API (GET/POST /v1/data) and Query API (GET/POST /v1/query) now accept a rule_labels query parameter to include the same merged labels in the response payload, under a rule_labels key.

Authored by @​srenatus

Behavior change: response gzip compression now bounds its buffer to min_length (#9205)

The server's gzip response compression (server.encoding.gzip) buffered an entire incoming Write call before deciding whether to compress, so a single large write could grow the buffer well past min_length before that decision was made. The handler is now built on klauspost/compress/gzhttp

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.21.0

This release contains a mix of new features and bug fixes. Notably:

• Improved rule indexing
• Improved rule recursion check
• YAML is parsed against the 1.2 core schema (breaking change)

Rules with general refs no longer collide in the recursion check (#6813)

Before, this was a recursion error:

package play
p[x].foo.bar if {
x := "a"
not p[x].foo.baz
}
p[x].foo.baz if {
x := "a"
false
}

Rules with a variable in their head are all stored at the ground prefix of their ref, so p[x].foo.bar and p[x].foo.baz looked like dependencies of each other. The compiler is now less conservative and compares the ref parts past the prefix. Genuine cycles are still reported.

The IR and Wasm targets however still return an error: they plan one function per ground path prefix, and cannot evaluate part of a function that is still being planned.

Authored by @​sspaink, reported by @​tsandall

Data and Query APIs can return rule labels in the response (#9211)

# METADATA labels for evaluated rules were only available in decision log events. The Data API (GET/POST /v1/data) and Query API (GET/POST /v1/query) now accept a rule_labels query parameter to include the same merged labels in the response payload, under a rule_labels key.

Authored by @​srenatus

Behavior change: response gzip compression now bounds its buffer to min_length (#9205)

The server's gzip response compression (server.encoding.gzip) buffered an entire incoming Write call before deciding whether to compress, so a single large write could grow the buffer well past min_length before that decision was made. The handler is now

... (truncated)

Commits

• dc6269f Release v1.21.0 (#9258)
• f6aa85f ast: count a ref once when an index entry replaces its var entry
• b7a4a42 build(deps): bump the dependencies group across 2 directories with 11 updates
• 3f11d3a docs: update Agent Evidence Admission repo links (#9255)
• 2dcd8ab topdown: fix flaky TestRegexBuiltinCache (#9254)
• c327a14 docs: ecosystem entry for Agent Evidence Admission (#9213)
• a83674f docs: Address incorrect package name in example (#9250)
• 620b7a5 website: Implement local search based on Pagefind (#9249)
• 959890c topdown: add stack traces to evaluation errors (#9242)
• 455aebd ast: don't box a slice header on the way out of Transform
• Additional commits viewable in compare view

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

🟢 Coverage ∅ diff coverage · -0.01% coverage variation

Metric	Results
Coverage variation	✅ -0.01% coverage variation (-1.00%)
Diff coverage	✅ ∅ diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (a325542)	89111	21640	24.28%
Head commit (04e0d0c)	89111 (+0)	21630 (-10)	24.27% (-0.01%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#3599)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}