elastic / cloudbeat / 30987088177
49%
main: 76%

LAST BUILD BRANCH: renovate/8.19-trivy
DEFAULT BRANCH: main
Ran
Jobs 1
Files 312
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 49.308% (-0.003%) from 49.311%
30987088177

push

github

web-flow 
fix(deps): update module github.com/open-policy-agent/opa to v1.19.0 (8.19) (#7654)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[github.com/open-policy-agent/opa](https://redirect.github.com/open-policy-agent/opa)
| `v1.18.2` → `v1.19.0` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fopen-policy-agent%2fopa/v1.19.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fopen-policy-agent%2fopa/v1.18.2/v1.19.0?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

---

### Release Notes

<details>
<summary>open-policy-agent/opa
(github.com/open-policy-agent/opa)</summary>

###
[`v1.19.0`](https://redirect.github.com/open-policy-agent/opa/releases/tag/v1.19.0)

[Compare
Source](https://redirect.github.com/open-policy-agent/opa/compare/v1.18.2...v1.19.0)

This release contains a mix of new features and bug fixes. Notably:

- A fixed SQL injection vector in the Compile API
- Stricter safety checking for Rego assignments (`:=`)
- A cgo-free, faster WebAssembly runtime (wazero replaces wasmtime-go)
- Startup warnings for unknown configuration options
- A new `strings.split_n` built-in function
- A REPL line reader that handles pasted input correctly, migrating
existing history files

##### Fix SQL injection vector in Compile API: Quote SQL filter field
identifiers
([#&#8203;8945](https://redirect.github.com/open-policy-agent/opa/pull/8945))

The field names in the SQL emitted by the Compile API come from
partially evaluated refs, so a
policy that selects a dynamic key — such as `input.fruits[input.column]`
— puts caller-controlled
text in an identifier position. That text was emitted verbatim, which
turns

```sql
WHERE fruit.name = 'allowed'
```

into

```sql
WHERE frui... (continued)

13746 of 27878 relevant lines covered (49.31%)

9.44 hits per line

Coverage Regressions

Lines Coverage ∆ File
2
95.79
 -2.11% internal/vulnerability/snapshot.go
Jobs
ID Job ID Ran Files Coverage
1 30987088177.1 312
49.31
 GitHub Action Run
Source Files on build 30987088177