Download Latest Version v1.9.0 source code.tar.gz (106.5 MB)
Email in envelope

Get an email when there's a new version of Open Policy Agent

Home / v1.9.0
Name Modified Size InfoDownloads / Week
Parent folder
opa_linux_arm64_static.sha256 2025-09-26 89 Bytes
0
opa_windows_amd64.exe 2025-09-26 93.7 MB
10 10 weekly downloads
opa_windows_amd64.exe.sha256 2025-09-26 88 Bytes
0
opa_linux_amd64_static.sha256 2025-09-26 89 Bytes
0
opa_linux_arm64_static 2025-09-26 47.5 MB
0
opa_darwin_amd64 2025-09-26 74.7 MB
0
opa_darwin_amd64.sha256 2025-09-26 83 Bytes
0
opa_darwin_arm64_static 2025-09-26 49.3 MB
0
opa_darwin_arm64_static.sha256 2025-09-26 90 Bytes
0
opa_linux_amd64 2025-09-26 73.7 MB
0
opa_linux_amd64.sha256 2025-09-26 82 Bytes
0
opa_linux_amd64_static 2025-09-26 50.5 MB
0
README.md 2025-09-26 9.3 kB
0
v1.9.0 source code.tar.gz 2025-09-26 106.5 MB
0
v1.9.0 source code.zip 2025-09-26 112.6 MB
0
Totals: 15 Items   608.5 MB 10

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • Compile API extensions ported from EOPA
  • Improved rule indexing

Compile Rego Queries Into SQL Filters (#7887)

Compile API extensions with support for SQL filter generation previously exclusive to EOPA has been ported into OPA.

Example

With OPA running with this policy, we'll compile the query data.filters.include into SQL filters:

:::rego
package filters

# METADATA
# scope: document
# compile:
#   unknowns: [input.fruits]
include if input.fruits.name == input.favorite
Example Request
POST /v1/compile/filters/include HTTP/1.1
Content-Type: application/json
Accept: application/vnd.opa.sql.postgresql+json

:::json
{
  "input": {
    "favorite": "pineapple"
  }
}
Example Response
HTTP/1.1 200 OK
Content-Type: application/vnd.opa.sql.postgresql+json

:::json
{
  "result": {
    "query": "WHERE fruits.name = E'pineapple'"
  }
}

See the documentation for more details.

Authored by @srenatus and @philipaconrad

Improved Rule Indexing For "Naked" Refs (#7897)

OPA's rule indexer is a means by which OPA can optimize evaluation performance. Briefly, the indexer can in some cases determine that a rule won't successfully evaluate before it's evaluated based on the query input. The indexer previously only considered terms in certain compound expressions, ignoring single terms; e.g. an expression containing a sole "naked" ref. This has now changed!

Example

Given a policy with an allow rule containing two "naked" refs: input.foo and input.bar:

:::rego
package example

allow if {
    input.foo
    input.bar
}

and the input document:

:::json
{
    "foo": 1
}

before this improvement, when evaluating the query data.example.allow, we get the trace log:

query:1           Enter data.example.allow = _
query:1           | Eval data.example.allow = _
query:1           | Index data.example.allow (matched 1 rule, early exit)
policy.rego:3     | Enter data.example.allow
policy.rego:5     | | Eval input.foo
policy.rego:6     | | Eval input.bar
policy.rego:6     | | Fail input.bar
policy.rego:5     | | Redo input.foo
query:1           | Fail data.example.allow = _

Here, we can see that the allow rule is evaluated, but fails on the input.bar expression, as it's referencing an undefined value.

With the improvement to the indexer, we instead get:

query:1     Enter data.example.allow = _
query:1     | Eval data.example.allow = _
query:1     | Index data.example.allow (matched 0 rules, early exit)
query:1     | Fail data.example.allow = _

Where we can see that the allow rule was never evaluated, since the input doesn't meet the conditions established by the indexer; i.e. both input.foo and input.bar must have defined values.

Authored by @srenatus

Runtime, Tooling

  • cmd: Print eval errors to stderr (#6749) authored by @sspaink reported by @janorn
  • plugin/decision: Encoder immediately returns when event same size as limit (#7928) authored by @sspaink
  • plugin/decision: Refactor size buffer into its own type (#7884) authored by @sspaink
  • plugins/bundle: Return callback error for manually triggered bundle downloads through the SDK (#7869) authored by @sspaink reported by @victoraugustolls
  • runtime: Fix possible panic in opa run when loading bundles in watch-mode (--watch) (#7870) authored by @sspaink reported by @johanfylling

Compiler, Topdown and Rego

  • perf: Don't invoke future parser for Rego v1 (#7909) authored by @anderseknert
  • topdown: Add counter metric for http.send network requests (#7851) authored by @anivar
  • topdown: Update numbers.range_step built-in error message (#7882) authored by @charlieegan3

Docs, Website

  • docs: Add every and not examples (#7901) authored by @charlieegan3
  • docs: Add examples for io.jwt and time built-ins (#7892) authored by @charlieegan3
  • docs: Add examples for regex and string built-ins (#7890) authored by @charlieegan3
  • docs: Add guide for common Rego errors (#7896) authored by @charlieegan3
  • docs: Add missing anchors and example data (#6205) authored by @mmzzuu reported by @johanfylling
  • docs: Add Rego keyword examples (#7889) authored by @charlieegan3
  • docs: Add Rego language comparison pages (#7893) authored by @charlieegan3
  • docs: Add Style Guide to policy authoring docs (#7932) authored by @charlieegan3
  • docs: Generative AI policy example fix (#7885) authored by @msorens
  • docs: Remove integration from build-security (#7899) authored by @ieugen
  • docs: Update Envoy tutorial for new versions and images (#7911) authored by @CharlieTLe
  • docs: Update references to cheat sheet and awesome-opa (#7930) authored by @charlieegan3
  • docs: Add OCP docs (#7875) authored by @charlieegan3
  • docs/ocp: Update docs on Azure object storage (#7921) authored by @minajevs
  • docs/ocp: Fix inline-transform example (#7913) authored by @srenatus
  • docs/ocp: Fix wrong example on concepts page (#7907) authored by @srenatus
  • docs/ocp: Update API reference (#7906) authored by @srenatus
  • docs/ocp: Update OCP api-key (#7904) authored by @charlieegan3
  • docs/ocp: Update OCP install instructions (#7910) authored by @ashutosh-narkar
  • docs: Add Regal docs to OPA site (#7874) authored by @charlieegan3
  • docs/regal: Update docs following 0.36.0 (#7891) authored by @charlieegan3
  • docs/deploy: Add OPA deployment docs (#7898) authored by @charlieegan3
  • docs/website: Update references to Styra (#7877) authored by @charlieegan3

Miscellaneous

Source: README.md, updated 2025-09-26