v4.0.0

Features

• add syncset controller, feat: syncset readiness (open-policy-agent#3030) #3348,#3030 (alex)
• Update audit and controller manager with pod labels (open-policy-agent#3240) #3348,#3240 (James Bruce)
• add disableAudit helm option (open-policy-agent#3270) #3348,#3270 (Dor Bareket)
• vap generation (open-policy-agent#3266) #3348,#3266 (Rita Zhang)
• enable vap in helm (open-policy-agent#3329) #3348,#3329 (Rita Zhang)
• Enable toggling of deferring to VAP (open-policy-agent#3335) #3348,#3335 (Max Smythe)
• helm: matchConditions added in Validating & MutatingWebhookConfiguration (open-policy-agent#3343) #3348,#3343 (leewoobin789)
• add support for CONNECT operations (open-policy-agent#3459) #3459 (Thomas Chaplin)
• adding scopedenforcementactions (open-policy-agent#3321) #3321 (Jaydipkumar Arvindbhai Gabani)
• separate podlabels in controller-manager and audit deployment (open-policy-agent#3378) #3378 (Robert Bublik)
• add logStatsAdmission and logStatsAudit into Helm chart (open-policy-agent#3526) #3526 (Yuedong Wu)
• Implement config pod status (open-policy-agent#3544) #3544 (avinash patnala)
• Gator sync test support (open-policy-agent#3098) #3098 (Anlan Du)
• add generate operation and wait for VAPB generation (open-policy-agent#3573) #3573 (Jaydip Gabani)
• moving CEL engine to GA (open-policy-agent#3685) #3685 (Jaydip Gabani)

Bug Fixes

• helm: add nindent in objectSelector (open-policy-agent#3071) #3348,#3071 (leewoobin789)
• limit length of ExpansionTemplate names to <64 (open-policy-agent#3078) #3348,#3078 (Davis Haba)
• support DELETE configs validation (open-policy-agent#3089) #3348,#3089 (alex)
• auto signing PR for dco (open-policy-agent#3120) #3348,#3120 (Jaydipkumar Arvindbhai Gabani)
• fixes disable cache flow (open-policy-agent#3132) #3348,#3132 (Nilekh Chaudhari)
• ns exclusion audit from cache (open-policy-agent#3129) #3348,#3129 (alex)
• check name length for all gk resources (open-policy-agent#3094) #3348,#3094 (alex)
• only validate gk res (open-policy-agent#3158) #3348,#3158 (alex)
• Ident podLabels on deployments (open-policy-agent#3153) #3348,#3153 (João Silva)
• log panic in am (open-policy-agent#3174) #3348,#3174 (alex)
• disable psp as default (open-policy-agent#3179) #3348,#3179 (Rita Zhang)
• fixing panic in debug log (open-policy-agent#3244) #3348,#3244 (Jaydipkumar Arvindbhai Gabani)
• fixing panic in error log (open-policy-agent#3246) #3348,#3246 (Jaydipkumar Arvindbhai Gabani)
• Remove validation of constraint template rego (open-policy-agent#3262) #3348,#3262 (Mohammad Zuber Khan)
• update unit test for vap generation; add custom assets for envtest (open-policy-agent#3289) #3348,#3289 (Rita Zhang)
• fixing metrics views (open-policy-agent#3307) #3348,#3307 (Jaydipkumar Arvindbhai Gabani)
• store constraint status audit results in sorted order (open-policy-agent#3293) #3348,#3293 (Prachi Pendse)
• over-restrictive validation of wildcard match patterns (open-policy-agent#3310) #3348,#3310 (Ben Couture)
• fixing artifact upload error (open-policy-agent#3437) #3437 (Jaydipkumar Arvindbhai Gabani)
• adding pod subresources in mutation rules (open-policy-agent#3426) #3426 (Jaydipkumar Arvindbhai Gabani)
• include cel flags on audit deployment (open-policy-agent#3414) #3414 (Noah Reisch)
• only set matchConditions on webhook when not empty (open-policy-agent#3412) #3412 (Martijn van der Ploeg)
• open-policy-agent#3146 Support close open/fail for Ready Tracker & surface errors swallowed by grp.Wait() (open-policy-agent#3308) #3308 (David Lee)
• Remove crashOnFailureFetchingExpectations flag (open-policy-agent#3453) #3453 (David Lee)
• fixing error reporting for templates without CEL (open-policy-agent#3493) #3493 (Jaydipkumar Arvindbhai Gabani)
• vap error logging for rego only templates (open-policy-agent#3520) #3520 (Martijn van der Ploeg)
• liniting error in gatekeeper-controller-manager-poddisruptionbudget.yaml (open-policy-agent#3519) #3519 (tberreis)
• helm warning when setting NetworkPolicy ingress rule(s) (open-policy-agent#3541) #3541 (Sebastian Stephan)
• Move K8scel driver from framework (open-policy-agent#3570) #3570 (avinash patnala)

Documentation

• update vap demo readme (open-policy-agent#3096) #3348,#3096 (Sertaç Özercan)
• examples, fix:improve gator err msg (open-policy-agent#3079) #3348,#3079 (alex)
• clarify rc release (open-policy-agent#3139) #3348,#3139 (Sertaç Özercan)
• automate installation docs to point to tag (open-policy-agent#3178) #3348,#3178 (Sertaç Özercan)
• Update install.md (open-policy-agent#3191) #3348,#3191 (Asya-kawai)
• update repo env var (open-policy-agent#3203) #3348,#3203 (Rita Zhang)
• syncset docs (open-policy-agent#3202) #3348,#3202 (alex)
• add docs on how to contribute templates (open-policy-agent#3242) #3348,#3242 (Xander Grzywinski)
• add request input struct (open-policy-agent#3234) #3348,#3234 (Xander Grzywinski)
• document constraint match.source (open-policy-agent#3291) #3348,#3291 (Sertaç Özercan)
• fix go install gator (open-policy-agent#3325) #3348,#3325 (Sertaç Özercan)
• update opa version in readme (open-policy-agent#3330) #3348,#3330 (Rita Zhang)
• correcting metrics names (open-policy-agent#3353) #3353 (Jaydipkumar Arvindbhai Gabani)
• add vap generation doc and demo (open-policy-agent#3363) #3363 (Rita Zhang)
• updates docs with new external data provider (open-policy-agent#3356) #3356 (Nilekh Chaudhari)
• quote the subPath conditional (open-policy-agent#3385) #3385 (JenTing)
• Update mutation assign doc (open-policy-agent#3433) #3433 (Anlan Du)
• update vap doc and demo (open-policy-agent#3502) #3502 (Rita Zhang)
• add alibabacloud to the list of managed services using Gatekeeper in … (open-policy-agent#3521) #3521 (DahuK)
• refine alibaba cloud logo png (open-policy-agent#3514) (open-policy-agent#3524) #3524 (DahuK)
• update mutation docs (open-policy-agent#3553) #3553 (m1schka-bdr)
• Update milestone release cadence (open-policy-agent#3657) #3657 (Rita Zhang)

Code Refactoring

• remove finalizer removal code (open-policy-agent#3085) #3348,#3085 (alex)
• Move setting up Obj to old obj on Delete logic to target handler (open-policy-agent#3511) #3511 (avinash patnala)
• apply review comment open-policy-agent#3658 (review) (TakahiroTsuruda)

Tests

• bump dapr to 1.12 (open-policy-agent#3108) #3348,#3108 (Sertaç Özercan)

Continuous Integration

• drop arm/v7 builds for crd image (open-policy-agent#3074) #3348,#3074 (Sertaç Özercan)
• add govulncheck (open-policy-agent#3114) #3348,#3114 (Sertaç Özercan)
• set up go version for govulncheck (open-policy-agent#3159) #3348,#3159 (Sertaç Özercan)
• removing auto tagging workflow (open-policy-agent#3257) #3348,#3257 (Jaydipkumar Arvindbhai Gabani)
• running ci with gatekeeper debug logs (open-policy-agent#3260) #3348,#3260 (Jaydipkumar Arvindbhai Gabani)
• bump k8s matrix (open-policy-agent#3267) #3348,#3267 (Sertaç Özercan)
• fix license lint (open-policy-agent#3279) #3348,#3279 (Sertaç Özercan)
• pointing to correct versioned yaml on website creation (open-policy-agent#3258) #3348,#3258 (Jaydipkumar Arvindbhai Gabani)
• fix test storage url (open-policy-agent#3427) #3427 (Sertaç Özercan)
• revert kubebuilder custom env (open-policy-agent#3430) #3430 (Sertaç Özercan)
• adding k8s-1.30 (open-policy-agent#3447) #3447 (Jaydipkumar Arvindbhai Gabani)
• fix dockerfile lint (open-policy-agent#3474) #3474 (Sertaç Özercan)
• remove dockerfile buildplatform (open-policy-agent#3491) #3491 (Sertaç Özercan)
• push container images to ghcr.io as well (TakahiroTsuruda)

Chores

• bump golang from 02f350d to 4369695 in /build/tooling (open-policy-agent#2997) #3348,#2997 (dependabot[bot])
• bump golang from 02f350d to 4369695 in /test/image (open-policy-agent#2996) #3348,#2996 (dependabot[bot])
• bump the all group with 3 updates (open-policy-agent#3051) #3348,#3051 (dependabot[bot])
• bump postcss from 8.4.14 to 8.4.31 in /website (open-policy-agent#3041) #3348,#3041 (dependabot[bot])
• bump to go 1.21 and k8s 1.28 (open-policy-agent#2979) #3348,#2979 (Sertaç Özercan)
• bump golang.org/x/net from 0.11.0 to 0.17.0 (open-policy-agent#3060) #3348,#3060 (dependabot[bot])
• bump kubectl from 1.28.1 to v1.28.2 (open-policy-agent#3068) #3348,#3068 (dependabot[bot])
• bump golang from 23ad9fe to 26c7537 in /build/tooling (open-policy-agent#3070) #3348,#3070 (dependabot[bot])
• bump golang from 23ad9fe to 26c7537 in /test/image (open-policy-agent#3069) #3348,#3069 (dependabot[bot])
• bump frameworks for 3.14 (open-policy-agent#3083) #3348,#3083 (Sertaç Özercan)
• bump @babel/traverse from 7.18.8 to 7.23.2 in /website (open-policy-agent#3075) #3348,#3075 (dependabot[bot])
• bump the all group with 3 updates (open-policy-agent#3088) #3348,#3088 (dependabot[bot])
• bump github.com/onsi/gomega from 1.27.7 to 1.27.10 (open-policy-agent#2900) #3348,#2900 (dependabot[bot])
• bump cloud.google.com/go/trace from 1.10.1 to 1.10.2 (open-policy-agent#3095) #3348,#3095 (dependabot[bot])
• bump the all group with 1 update (open-policy-agent#3104) #3348,#3104 (dependabot[bot])
• bump @docusaurus/core from 2.4.0 to 2.4.3 in /website (open-policy-agent#3021) #3348,#3021 (dependabot[bot])
• bump google.golang.org/grpc from 1.58.2 to 1.58.3 (open-policy-agent#3087) #3348,#3087 (dependabot[bot])
• bump @docusaurus/preset-classic from 2.4.0 to 2.4.3 in /website (open-policy-agent#3022) #3348,#3022 (dependabot[bot])
• add codeowners (open-policy-agent#3110) #3348,#3110 (Sertaç Özercan)
• bump kubectl from 1.28.2 to v1.28.3 (open-policy-agent#3101) #3348,#3101 (dependabot[bot])
• adding default helm values for pubsub audit connection and channel (open-policy-agent#3097) #3348,#3097 (Jaydipkumar Arvindbhai Gabani)
• Prepare v3.15.0-beta.0 release (open-policy-agent#3142) #3348,#3142 (github-actions[bot])
• auto tagging after release pr is merged (open-policy-agent#3135) #3348,#3135 (Jaydipkumar Arvindbhai Gabani)
• bump the all group with 5 updates (open-policy-agent#3182) #3348,#3182 (dependabot[bot])
• bump golang from 26c7537 to fe69f48 in /build/tooling (open-policy-agent#3148) #3348,#3148 (dependabot[bot])
• bump golang from 26c7537 to fe69f48 in /test/image (open-policy-agent#3150) #3348,#3150 (dependabot[bot])
• fix golanglint, checkout prior to setup-go (open-policy-agent#3206) #3348,#3206 (Andrew Peabody)
• bump the all group with 5 updates (open-policy-agent#3207) #3348,#3207 (dependabot[bot])
• bump golang.org/x/crypto from 0.14.0 to 0.17.0 (open-policy-agent#3197) #3348,#3197 (dependabot[bot])
• bump golang from fe69f48 to ca78a56 in /test/image (open-policy-agent#3196) #3348,#3196 (dependabot[bot])
• bump golang from fe69f48 to ca78a56 in /build/tooling (open-policy-agent#3194) #3348,#3194 (dependabot[bot])
• bump github.com/containerd/containerd from 1.7.6 to 1.7.11 (open-policy-agent#3198) #3348,#3198 (dependabot[bot])
• bump kubectl from v1.28.3 to v1.29.0 (open-policy-agent#3193) #3348,#3193 (dependabot[bot])
• bump follow-redirects from 1.14.9 to 1.15.4 in /website (open-policy-agent#3208) #3348,#3208 (dependabot[bot])
• bump cloud.google.com/go/trace from 1.10.2 to 1.10.4 (open-policy-agent#3149) #3348,#3149 (dependabot[bot])
• bump github.com/docker/docker from 24.0.6+incompatible to 24.0.7+incompatible (open-policy-agent#3127) #3348,#3127 (dependabot[bot])
• bump clsx from 1.2.1 to 2.1.0 in /website (open-policy-agent#3204) #3348,#3204 (dependabot[bot])
• bump the k8s group with 3 updates (open-policy-agent#3209) #3348,#3209 (dependabot[bot])
• bump framework to 18fa1fc7dc06 (open-policy-agent#3211) #3348,#3211 (Rita Zhang)
• moving to otel from opencensus (open-policy-agent#3011) #3348,#3011 (Jaydipkumar Arvindbhai Gabani)
• bump golang from 1e3c713 to 6ac4c35 in /build/tooling (open-policy-agent#3221) #3348,#3221 (dependabot[bot])
• bump golang from 1e3c713 to 6ac4c35 in /test/image (open-policy-agent#3220) #3348,#3220 (dependabot[bot])
• bump the k8s group with 2 updates (open-policy-agent#3226) #3348,#3226 (dependabot[bot])
• bump kubectl from v1.29.0 to v1.29.1 (open-policy-agent#3232) #3348,#3232 (dependabot[bot])
• bump golang from 6ac4c35 to adf7ccb in /build/tooling (open-policy-agent#3233) #3348,#3233 (dependabot[bot])
• bump golang from 6ac4c35 to adf7ccb in /test/image (open-policy-agent#3231) #3348,#3231 (dependabot[bot])
• bump golang from adf7ccb to 47fa179 in /build/tooling (open-policy-agent#3238) #3348,#3238 (dependabot[bot])
• bump golang from adf7ccb to 47fa179 in /test/image (open-policy-agent#3236) #3348,#3236 (dependabot[bot])
• Setting pubsub annotations using --set in makefile (open-policy-agent#3160) #3348,#3160 (Jaydipkumar Arvindbhai Gabani)
• Prepare v3.16.0-beta.0 release (open-policy-agent#3256) #3348,#3256 (github-actions[bot])
• bump kubectl from v1.29.1 to v1.29.2 (open-policy-agent#3273) #3348,#3273 (dependabot[bot])
• Upgrade controller-runtime to 0.17.2, remove fork (open-policy-agent#3278) #3348,#3278 (Max Smythe)
• bump the k8s group with 4 updates (open-policy-agent#3280) #3348,#3280 (dependabot[bot])
• bump oras.land/oras-go from 1.2.4 to 1.2.5 (open-policy-agent#3239) #3348,#3239 (dependabot[bot])
• bump the all group with 10 updates (open-policy-agent#3281) #3348,#3281 (dependabot[bot])
• bump cloud.google.com/go/trace from 1.10.4 to 1.10.5 (open-policy-agent#3254) #3348,#3254 (dependabot[bot])
• bump the all group with 4 updates (open-policy-agent#3292) #3348,#3292 (dependabot[bot])
• bump github.com/golang/protobuf from 1.5.3 to 1.5.4 (open-policy-agent#3301) #3348,#3301 (dependabot[bot])
• bump kubectl from v1.29.2 to v1.29.3 (open-policy-agent#3317) #3348,#3317 (dependabot[bot])
• bump the k8s group with 4 updates (open-policy-agent#3318) #3348,#3318 (dependabot[bot])
• bump the all group with 4 updates (open-policy-agent#3313) #3348,#3313 (dependabot[bot])
• bump follow-redirects from 1.15.4 to 1.15.6 in /website (open-policy-agent#3316) #3348,#3316 (dependabot[bot])
• bump google.golang.org/grpc from 1.61.0 to 1.61.1 (open-policy-agent#3285) #3348,#3285 (dependabot[bot])
• Prepare v3.16.0-beta.1 release (open-policy-agent#3306) #3348,#3306 (github-actions[bot])
• bump github.com/docker/docker from 25.0.1+incompatible to 25.0.2+incompatible (open-policy-agent#3324) #3348,#3324 (dependabot[bot])
• bump cloud.google.com/go/trace from 1.10.5 to 1.10.6 (open-policy-agent#3319) #3348,#3319 (dependabot[bot])
• bump frameworks to 359cf1b (open-policy-agent#3326) #3348,#3326 (Sertaç Özercan)
• bump github.com/docker/docker from 25.0.2+incompatible to 25.0.5+incompatible (open-policy-agent#3327) #3348,#3327 (dependabot[bot])
• bump webpack-dev-middleware from 5.3.1 to 5.3.4 in /website (open-policy-agent#3332) #3348,#3332 (dependabot[bot])
• bump express from 4.18.1 to 4.19.2 in /website (open-policy-agent#3334) #3348,#3334 (dependabot[bot])
• bump to go 1.22 bookworm (open-policy-agent#3323) #3348,#3323 (Sertaç Özercan)
• update lint (open-policy-agent#3338) #3348,#3338 (Sertaç Özercan)
• Prepare v3.16.0-beta.2 release (open-policy-agent#3344) #3348,#3344 (github-actions[bot])
• fix GO-2024-2687 (open-policy-agent#3350) #3350 (Sertaç Özercan)
• bump frameworks to c2efb0 (open-policy-agent#3366) #3366 (Sertaç Özercan)
• bump clsx from 2.1.0 to 2.1.1 in /website (open-policy-agent#3371) #3371 (dependabot[bot])
• bump the k8s group across 1 directory with 4 updates (open-policy-agent#3368) #3368 (dependabot[bot])
• bump kubectl from v1.29.3 to v1.30.0 (open-policy-agent#3359) #3359 (dependabot[bot])
• adding design docs for scoped EA, VAP as EP, pubsub CRD (open-policy-agent#3367) #3367 (Jaydipkumar Arvindbhai Gabani)
• Prepare v3.17.0-beta.0 release (open-policy-agent#3379) #3379 (github-actions[bot])
• bump BASEIMAGE from static to static-debian12 (open-policy-agent#3386) #3386 (Sahil Verma)
• bump google.golang.org/grpc from 1.62.1 to 1.62.2 (open-policy-agent#3346) #3346 (dependabot[bot])
• bump sigs.k8s.io/controller-runtime from 0.17.3 to 0.17.5 in the k8s group across 1 directory (open-policy-agent#3382) #3382 (dependabot[bot])
• bump the k8s group across 1 directory with 5 updates (open-policy-agent#3387) #3387 (dependabot[bot])
• bump github.com/prometheus/client_golang from 1.19.0 to 1.19.1 (open-policy-agent#3381) #3381 (dependabot[bot])
• bump cloud.google.com/go/trace from 1.10.6 to 1.10.7 (open-policy-agent#3373) #3373 (dependabot[bot])
• bump kubectl from v1.30.0 to v1.30.1 (open-policy-agent#3390) #3390 (dependabot[bot])
• bumping to frameworks 2ece026 (open-policy-agent#3392) #3392 (Jaydipkumar Arvindbhai Gabani)
• bump golang from d996c64 to 48b942a in /build/tooling (open-policy-agent#3347) #3347 (dependabot[bot])
• Patch docs for 3.16.1 release (open-policy-agent#3395) #3395 (github-actions[bot])
• bumping frameworks/constraints to 5368a3b697f2 (open-policy-agent#3399) #3399 (Jaydipkumar Arvindbhai Gabani)
• Patch docs for 3.16.3 release (open-policy-agent#3407) #3407 (Jaydipkumar Arvindbhai Gabani)
• bump the all group across 1 directory with 12 updates (open-policy-agent#3431) #3431 (dependabot[bot])
• bump braces from 3.0.2 to 3.0.3 in /website (open-policy-agent#3424) #3424 (dependabot[bot])
• bump github.com/go-logr/logr from 1.4.1 to 1.4.2 (open-policy-agent#3403) #3403 (dependabot[bot])
• bump the all group across 1 directory with 2 updates (open-policy-agent#3444) #3444 (dependabot[bot])
• bump golang from 5c56bd4 to aec4784 in /build/tooling (open-policy-agent#3417) #3417 (dependabot[bot])
• bump ws from 7.5.7 to 7.5.10 in /website (open-policy-agent#3425) #3425 (dependabot[bot])
• bump kubectl from v1.30.1 to v1.30.2 (open-policy-agent#3420) #3420 (dependabot[bot])
• bump google.golang.org/protobuf from 1.34.0 to 1.34.2 (open-policy-agent#3423) #3423 (dependabot[bot])
• bump github.com/spf13/cobra from 1.8.0 to 1.8.1 (open-policy-agent#3422) #3422 (dependabot[bot])
• bump the k8s group with 4 updates (open-policy-agent#3421) #3421 (dependabot[bot])
• bump google.golang.org/grpc from 1.63.2 to 1.63.3 (open-policy-agent#3448) #3448 (dependabot[bot])
• fixing deprecating function in dapr fake test client (open-policy-agent#3451) #3451 (Jaydipkumar Arvindbhai Gabani)
• bump the all group with 4 updates (open-policy-agent#3449) #3449 (dependabot[bot])
• adding generateVAP field, removing annotations for vap (open-policy-agent#3398) #3398 (Jaydipkumar Arvindbhai Gabani)
• bump kubectl from v1.30.2 to v1.30.3 (open-policy-agent#3455) #3455 (dependabot[bot])
• bump the k8s group with 4 updates (open-policy-agent#3456) #3456 (dependabot[bot])
• bump the all group with 2 updates (open-policy-agent#3454) #3454 (dependabot[bot])
• bump cloud.google.com/go/trace from 1.10.7 to 1.10.11 (open-policy-agent#3461) #3461 (dependabot[bot])
• bump the all group with 2 updates (open-policy-agent#3466) #3466 (dependabot[bot])
• Make service account configurable and add option to opt out of creation (open-policy-agent#3404) #3404 (Stef Graces)
• bump golang from 6c27802 to af9b40f in /build/tooling (open-policy-agent#3465) #3465 (dependabot[bot])
• bump github.com/docker/docker from 25.0.5+incompatible to 26.1.4+incompatible (open-policy-agent#3467) #3467 (dependabot[bot])
• Add optional rollingUpdate strategy parameters to helm chart (open-policy-agent#3406) #3406 (Stefan Peer)
• add document separator to the generated manifests (open-policy-agent#3462) #3462 (Ankur Kothiwal)
• bumping-otel to 1.28 (open-policy-agent#3469) #3469 (Jaydipkumar Arvindbhai Gabani)
• bump actions/upload-artifact from 4.3.4 to 4.3.5 in the all group (open-policy-agent#3473) #3473 (dependabot[bot])
• upgrading to 0.30 api, creating v1 or v1beta1 VAP/VAPB (open-policy-agent#3472) #3472 (Jaydipkumar Arvindbhai Gabani)
• bump cert-controller to 0.11.0 (open-policy-agent#3480) #3480 (Sertaç Özercan)
• moving k8s-native-validation feature to beta (open-policy-agent#3476) #3476 (Jaydipkumar Arvindbhai Gabani)
• check for CT generateVap intent before generating vapbinding (open-policy-agent#3479) #3479 (Jaydipkumar Arvindbhai Gabani)
• bump github.com/docker/docker from 26.1.4+incompatible to 26.1.5+incompatible (open-policy-agent#3482) #3482 (dependabot[bot])
• Removing setting alpha flags for vap/vapb generation unless explicitly set through helm (open-policy-agent#3481) #3481 (Jaydipkumar Arvindbhai Gabani)
• bump golang from af9b40f to 39b7e6e in /build/tooling (open-policy-agent#3488) #3488 (dependabot[bot])
• Prepare v3.18.0-beta.0 release (open-policy-agent#3510) #3510 (github-actions[bot])
• bump the k8s group with 5 updates (open-policy-agent#3503) #3503 (dependabot[bot])
• bump micromatch from 4.0.5 to 4.0.8 in /website (open-policy-agent#3517) #3517 (dependabot[bot])
• bump the all group across 1 directory with 3 updates (open-policy-agent#3512) #3512 (dependabot[bot])
• bump golang from 1.22-bullseye to 1.23-bullseye in /test/image (open-policy-agent#3505) #3505 (dependabot[bot])
• bump golang from 1.22-bookworm to 1.23-bookworm in /build/tooling (open-policy-agent#3506) #3506 (dependabot[bot])
• adding design doc for exporting violation interface (open-policy-agent#3515) #3515 (Jaydipkumar Arvindbhai Gabani)
• adding helm lint ci test (open-policy-agent#3536) #3536 (Jaydipkumar Arvindbhai Gabani)
• Patch docs for 3.17.1 release (open-policy-agent#3540) #3540 (github-actions[bot])
• bump kubectl from v1.30.3 to v1.31.1 (open-policy-agent#3543) #3543 (dependabot[bot])
• bump golang from 31dc846 to 1a5326b in /build/tooling (open-policy-agent#3533) #3533 (dependabot[bot])
• bump golang from ecef830 to 45b4337 in /test/image (open-policy-agent#3531) #3531 (dependabot[bot])
• Updating GK -> opa versions (open-policy-agent#3537) #3537 (Jaydip Gabani)
• adding common function for error reporting for constraint (open-policy-agent#3486) #3486 (Jaydip Gabani)
• bumping opa to 0.68.0 (open-policy-agent#3561) #3561 (Jaydip Gabani)
• bump webpack from 5.76.3 to 5.95.0 in /website (open-policy-agent#3562) #3562 (dependabot[bot])
• bump golang from 45b4337 to 1a26d5a in /test/image (open-policy-agent#3566) #3566 (dependabot[bot])
• bump golang from 1a5326b to dba79eb in /build/tooling (open-policy-agent#3565) #3565 (dependabot[bot])
• bump express from 4.19.2 to 4.21.0 in /website (open-policy-agent#3542) #3542 (dependabot[bot])
• bump github.com/prometheus/client_golang from 1.20.2 to 1.20.4 (open-policy-agent#3575) #3575 (dependabot[bot])
• bump the k8s group with 4 updates (open-policy-agent#3547) #3547 (dependabot[bot])
• bump google.golang.org/grpc from 1.66.0 to 1.66.3 (open-policy-agent#3644) #3644 (dependabot[bot])
• bump the all group across 1 directory with 9 updates (open-policy-agent#3649) #3649 (dependabot[bot])
• bump distroless/static-debian12 from 8dd8d3c to 69830f2 in /test/externaldata/dummy-provider (open-policy-agent#3567) #3567 (dependabot[bot])
• bump distroless/static-debian12 from 8dd8d3c to 69830f2 (open-policy-agent#3564) #3564 (dependabot[bot])
• remove setting alpha flags out of box (open-policy-agent#3578) #3578 (Jaydip Gabani)
• bump golang from 1.22-bookworm to 1.23-bookworm (open-policy-agent#3551) #3551 (dependabot[bot])
• bump golang from 1.22-bookworm to 1.23-bookworm in /test/externaldata/dummy-provider (open-policy-agent#3549) #3549 (dependabot[bot])
• bump golang from 18d2f94 to 2341ddf in /build/tooling (open-policy-agent#3655) #3655 (dependabot[bot])
• bump golang from ebaf58d to ecb3fe7 in /test/image (open-policy-agent#3654) #3654 (dependabot[bot])
• bump the all group with 6 updates (open-policy-agent#3672) #3672 (dependabot[bot])
• bump golang from 37189aa to 2341ddf (open-policy-agent#3670) #3670 (dependabot[bot])
• Update constraint framework to version without k8scel (open-policy-agent#3680) #3680 (Max Smythe)

Commits

• d916017: fix:enh: protect agg against empty gvks (open-policy-agent#3040) (alex) #3348,#3040
• fed8e15: fix open-policy-agent#3261 Sort constraint status audit results (open-policy-agent#3277) (Prachi Pendse) #3348,#3277
• 2a25627: [StepSecurity] ci: Harden GitHub Actions (open-policy-agent#3351) (StepSecurity Bot) #3351
• 42b7466: Merge branch 'master' into feature/release-to-ghcr (Takahiro Tsuruda)
• 261de27: Merge branch 'master' into feature/release-to-ghcr (Takahiro Tsuruda)
• a7c5d95: Merge branch 'master' into feature/release-to-ghcr (Takahiro Tsuruda)
• 686d741: test (Sertac Ozercan)
• 84dee23: test (Sertac Ozercan)