chore: bump github.com/open-policy-agent/opa from 1.4.2 to 1.20.2 by dependabot[bot] · Pull Request #903 · officialmofabs/codeserver

dependabot · 2026-09-07T11:07:35Z

Bumps github.com/open-policy-agent/opa from 1.4.2 to 1.20.2.

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.20.2

This release includes a bug fix for a parser regression introduced in v1.20.0, and dependency updates.

Fix stale parse errors on statements starting with { (#9140)

When the and/or keywords added in v1.20.0 are imported, a statement that starts with { is first read as an explicit operand body, and re-read as a term (a comprehension, for example) if no and or or follows. Errors recorded during the abandoned first attempt stayed in the parser's term cache and were reported against the successful re-read, rejecting policies that parse fine:
package example
import future.keywords
xs := [1, 2, 3]
allow if {
{
y |
some y in xs # rego_parse_error: unexpected some keyword
} == {1, 2, 3}
}
The term cache is now restored along with the rest of the parser state when the operand-body guess is abandoned. Only policies importing and or or — directly or via import future.keywords — were affected; policies that don't import them parse unchanged.

Authored by @sspaink

Miscellaneous

build(go): Bump to 1.27.1 (3652eeb) authored by @srenatus

Dependency updates; notably:

build(deps): Bump github.com/dgraph-io/badger/v4 from 4.9.5 to 4.9.6

build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.1 to 3.2.0

build(deps): Bump github.com/santhosh-tekuri/jsonschema/v6 from 6.0.2 to 6.0.3

build(deps): Bump github.com/sirupsen/logrus from 1.9.4 to 1.10.2

build(deps): Bump go.opentelemetry.io/contrib/bridges/prometheus from 0.69.0 to 0.71.0

build(deps): Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.71.0

build(deps): Bump go.opentelemetry.io/otel from 1.44.0 to 1.46.0

build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.44.0 to 1.46.0

build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.44.0 to 1.46.0

build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.44.0 to 1.46.0

build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.46.0

build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.46.0

build(deps): Bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.46.0

build(deps): Bump go.opentelemetry.io/otel/sdk/metric from 1.44.0 to 1.46.0

build(deps): Bump go.opentelemetry.io/otel/trace from 1.44.0 to 1.46.0

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.20.2

This release includes a bug fix for a parser regression introduced in v1.20.0, and dependency updates.

Fix stale parse errors on statements starting with { (#9140)

When the and/or keywords added in v1.20.0 are imported, a statement that starts with { is first read as an explicit operand body, and re-read as a term (a comprehension, for example) if no and or or follows. Errors recorded during the abandoned first attempt stayed in the parser's term cache and were reported against the successful re-read, rejecting policies that parse fine:
package example
import future.keywords
xs := [1, 2, 3]
allow if {
{
y |
some y in xs # rego_parse_error: unexpected some keyword
} == {1, 2, 3}
}
The term cache is now restored along with the rest of the parser state when the operand-body guess is abandoned. Only policies importing and or or — directly or via import future.keywords — were affected; policies that don't import them parse unchanged.

Authored by @sspaink

Miscellaneous

build(go): Bump to 1.27.1 (3652eeb) authored by @srenatus

Dependency updates; notably:

build(deps): Bump github.com/dgraph-io/badger/v4 from 4.9.5 to 4.9.6

build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.1 to 3.2.0

build(deps): Bump github.com/santhosh-tekuri/jsonschema/v6 from 6.0.2 to 6.0.3

build(deps): Bump github.com/sirupsen/logrus from 1.9.4 to 1.10.2

build(deps): Bump go.opentelemetry.io/contrib/bridges/prometheus from 0.69.0 to 0.71.0

build(deps): Bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.71.0

build(deps): Bump go.opentelemetry.io/otel from 1.44.0 to 1.46.0

build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.44.0 to 1.46.0

build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.44.0 to 1.46.0

build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.44.0 to 1.46.0

build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.46.0

build(deps): Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.46.0

build(deps): Bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.46.0

... (truncated)

Commits

b2c2670 Prepare v1.20.2 release
0ea9844 ast: clear the term cache when a brace operand guess is abandoned (#9140)
04d715b build(go): bump to 1.27.1
17accbe build(deps): bump dependencies
72f30d6 Prepare v1.20.1 release
ceb4bf2 ast: fix panic comparing a decimal zero with a non-integral number (#9099)
328ca09 Prepare v1.20.0 release (#9095)
ce7ab30 Add Scanara to the OPA ecosystem page. (#9094)
cbc0993 ast: Index rules with and/or expressions (#9063)
54bf329 fix loading absolute paths on Windows (#9055)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 1.4.2 to 1.20.2. - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](open-policy-agent/opa@v1.4.2...v1.20.2) --- updated-dependencies: - dependency-name: github.com/open-policy-agent/opa dependency-version: 1.20.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-09-07T11:07:58Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability
golang/golang.org/x/oauth2@v0.29.0 ⏵ v0.36.0	⁺¹
golang/github.com/prometheus/client_golang@v1.22.0 ⏵ v1.24.1	⁺¹
golang/golang.org/x/crypto@v0.39.0 ⏵ v0.55.0	⁺¹	⁺⁷⁵
golang/golang.org/x/net@v0.41.0 ⏵ v0.58.0		⁺³
golang/golang.org/x/tools@v0.33.0 ⏵ v0.48.0
golang/github.com/open-policy-agent/opa@v1.4.2 ⏵ v1.20.2	^-1
golang/google.golang.org/grpc@v1.73.0 ⏵ v1.83.2	⁺¹	⁺⁷⁵
golang/google.golang.org/protobuf@v1.36.6 ⏵ v1.36.12	⁺¹
golang/go.opentelemetry.io/otel@v1.37.0 ⏵ v1.46.0	⁺²	⁺¹⁶
golang/golang.org/x/text@v0.26.0 ⏵ v0.41.0
golang/google.golang.org/api@v0.231.0 ⏵ v0.264.0	⁺¹
golang/github.com/prometheus/client_model@v0.6.1 ⏵ v0.6.2
golang/github.com/prometheus/common@v0.63.0 ⏵ v0.70.1	^-1
golang/golang.org/x/sys@v0.33.0 ⏵ v0.47.0
golang/github.com/stretchr/testify@v1.10.0 ⏵ v1.12.1	^-6
golang/github.com/klauspost/compress@v1.18.0 ⏵ v1.19.1
golang/golang.org/x/mod@v0.25.0 ⏵ v0.38.0	⁺¹
golang/github.com/creack/pty@v1.1.21 ⏵ v1.1.24	⁺¹
golang/github.com/spf13/pflag@v1.0.6 ⏵ v1.0.10
golang/github.com/go-jose/go-jose/v4@v4.1.0 ⏵ v4.1.4		⁺¹⁶
golang/go.opentelemetry.io/otel/sdk@v1.37.0 ⏵ v1.46.0		⁺²²
golang/cloud.google.com/go/compute/metadata@v0.7.0 ⏵ v0.9.0	⁺¹
golang/github.com/fsnotify/fsnotify@v1.9.0 ⏵ v1.10.1	⁺¹
golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.35.0 ⏵ v1.46.0
golang/golang.org/x/sync@v0.15.0 ⏵ v0.22.0
golang/github.com/go-logr/logr@v1.4.3 ⏵ v1.4.4	⁺¹
golang/go.opentelemetry.io/otel/trace@v1.37.0 ⏵ v1.46.0	⁺¹
golang/golang.org/x/term@v0.32.0 ⏵ v0.45.0	⁺¹
golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.35.0 ⏵ v1.46.0

View full report

socket-security · 2026-09-07T11:07:59Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: golang `github.com/envoyproxy/go-control-plane/envoy` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go.mod → `golang/google.golang.org/grpc@v1.83.2` → `golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: golang `github.com/envoyproxy/go-control-plane/envoy` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go.mod → `golang/google.golang.org/grpc@v1.83.2` → `golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: golang `github.com/envoyproxy/go-control-plane/envoy` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go.mod → `golang/google.golang.org/grpc@v1.83.2` → `golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: golang `github.com/envoyproxy/go-control-plane/envoy` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go.mod → `golang/google.golang.org/grpc@v1.83.2` → `golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: golang `github.com/envoyproxy/go-control-plane/envoy` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go.mod → `golang/google.golang.org/grpc@v1.83.2` → `golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: golang `github.com/envoyproxy/go-control-plane/envoy` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go.mod → `golang/google.golang.org/grpc@v1.83.2` → `golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/github.com/envoyproxy/go-control-plane/envoy@v1.37.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: golang `github.com/googleapis/enterprise-certificate-proxy` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go.mod → `golang/google.golang.org/api@v0.264.0` → `golang/google.golang.org/grpc@v1.83.2` → `golang/github.com/golang-migrate/migrate/v4@v4.18.1` → `golang/github.com/aquasecurity/trivy-iac@v0.8.0` → `golang/cdr.dev/slog@v1.6.2-0.20250703074222-9df5e0a6c145` → `golang/github.com/coder/aisdk-go@v0.0.9` → `golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 7, 2026

dependabot Bot mentioned this pull request Sep 7, 2026

chore: bump github.com/open-policy-agent/opa from 1.4.2 to 1.20.1 #893

Closed

Navigation Menu

chore: bump github.com/open-policy-agent/opa from 1.4.2 to 1.20.2 - #903

chore: bump github.com/open-policy-agent/opa from 1.4.2 to 1.20.2#903
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/github.com/open-policy-agent/opa-1.20.2

dependabot Bot commented on behalf of github Sep 7, 2026

Uh oh!

socket-security Bot commented Sep 7, 2026

Uh oh!

socket-security Bot commented Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 7, 2026

v1.20.2

Fix stale parse errors on statements starting with { (#9140)

Miscellaneous

1.20.2

Fix stale parse errors on statements starting with { (#9140)

Miscellaneous

Uh oh!

socket-security Bot commented Sep 7, 2026

Uh oh!

socket-security Bot commented Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Fix stale parse errors on statements starting with `{` (#9140)

Fix stale parse errors on statements starting with `{` (#9140)