Update dependency open-policy-agent/opa to v0.68.0

[renovate]

This PR contains the following updates:

Package	Update	Change
open-policy-agent/opa	minor	v0.67.1 -> v0.68.0

---

Release Notes

open-policy-agent/opa (open-policy-agent/opa)

v0.68.0

Compare Source

This release contains a mix of features and bugfixes.

Breaking Changes

entrypoint annotation implies document scope (#​6798)

The entrypoint annotation's scope requirement has changed from rule to document (https://github.com/open-policy-agent/opa/issues/6798). Furthermore, if no scope annotation is declared for a METADATA block preceding a rule, the presence of an entrypoint annotation with a true value will assign the block a document scope, where the rule scope is otherwise the default.

In practice, a rule entrypoint always point to the entire document and not a particular rule definition. The previous behavior was a bug, and one we've now addressed.

Authored by @​anderseknert

Topdown and Rego

• ast: Fixing nil-pointer dereference in compiler for partial rule edge case (#​6930) authored by @​johanfylling
• ast+parser: Add hint to future-proof imports (6968) authored by @​srenatus
• topdown: Adding unification scope to virtual-cache key. Fixing issue where false positive cache hits can occur when unification "restricts" the scope of ref-head rule evaluation (#​6926) authored by @​johanfylling reported by @​anderseknert
• topdown: Marshal JWT encode sign inputs as JSON (#​6934) authored by @​charlieegan3

Runtime, Tooling, SDK

• ast: Make type checker copy method copy all values (#​6949) authored by @​anderseknert
• ast: Include term locations in rule heads when requested (#​6860) authored by @​anderseknert
• debug: Adding experimental debugger SDK (#​6876) authored by @​johanfylling
• distributedtracing: allow OpenTelemetry resource attributes to be configured under distributed_tracing config (#​6942) authored and reported by @​brettmc
• download: Fixing issue when saving OCI bundles on disk (#​6939) authored and reported by @​Sergey-Kizimov
• logging: Always include HTTP request context in incoming req context (#​6951) authored by @​ashutosh-narkar reported by @​alvarogomez93
• plugins/bundle: Avoid race-condition during bundle reconfiguration and activation (#​6849) authored by @​ashutosh-narkar reported by @​Pushpalanka
• plugins/bundle: Escape reserved chars used in persisted bundle directory name (#​6915) authored by @​ashutosh-narkar reported by @​alvarogomez93
• plugins/rest: Support AWS_CONTAINER_CREDENTIALS_FULL_URI metadata endpoint (#​6893) authored and reported by @​mbamber
• util+server: Fix bug around chunked request handling. (#​6904) authored by @​philipaconrad reported by @​David-Wobrock
• opa exec: This command never supported "pretty" formatting (--format=pretty or -f pretty), only json. Passing pretty is now invalid. (#​6923) authored by @​srenatus
  Note that the flag is now unnecessary, but it's kept so existing calls like opa exec -fjson ... remain valid.

Security Fix: CVE-2024-8260 (#​6933)

This release includes a fix where OPA would accept UNC locations on Windows. Reading those could leak NTLM hashes.
The attack vector would include an adversary tricking the user in passing an UNC path to OPA, e.g. opa eval -d $FILE.
UNC paths are now forbidden. If this is an issue for you, please reach out on Slack or GitHub issues.

Reported by Shelly Raban
Authored by @​ashutosh-narkar

Docs, Website, Ecosystem

• docs: Suggest using opa-config.yaml as name for config file (#​6966) (#​6959) authored by @​anderseknert
• docs: Add documentation for OPA Spring Boot integration (#​6898) authored by @​charlieegan3
• docs: Update Istio tutorial (#​6896) authored by @​Pindar
• docs: Update contrib docs (#​6974) authored by @​charlieegan3
• docs: Add Lula to the OPA ecosystem (#​6902) authored by @​brandtkeller
• docs: Add github action policy testing automation (#​6954) authored by @​oycyc
• docs: Mention http.send in inter-query cache config docs (#​6953) authored by @​anderseknert
• docs+topdown: Fixing typos in built-in descriptions (#​6940) authored by @​msorens

Miscellaneous

• build: Make it possible to build only wasm testcases (#​6920) authored by @​andreaTP
• Dependency updates; notably:
  • build(deps): bump github.com/containerd/containerd from 1.7.20 to 1.7.21
  • build(deps): bump github.com/prometheus/client_golang from 1.19.1 to 1.20.2
  • build(deps): bump golang.org/x/net from 0.27.0 to 0.28.0
  • build(deps): bump golang.org/x/time from 0.5.0 to 0.6.0
  • build(deps): bump google.golang.org/grpc from 1.65.0 to 1.66.0

---

Configuration

📅 Schedule: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.