build(deps): bump the all-go-mod-patch-and-minor group with 3 updates

[dependabot]

Bumps the all-go-mod-patch-and-minor group with 3 updates: github.com/open-policy-agent/opa, github.com/open-policy-agent/opa-envoy-plugin and github.com/redis/go-redis/v9.

Updates github.com/open-policy-agent/opa from 0.66.0 to 0.67.0

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v0.67.0

This release contains a mix of features, a new builtin function (strings.count), performance improvements, and bugfixes.

Breaking Change

Request Body Size Limits

OPA now automatically rejects very large requests (#6868) authored by @​philipaconrad. Requests with a Content-Length larger than 128 MB uncompressed, and gzipped requests with payloads that decompress to larger than 256 MB will be rejected, as part of hardening OPA against denial-of-service attacks. Previously, a large enough request could cause an OPA instance to run out of memory in low-memory sidecar deployment scenarios, just from attempting to read the request body into memory.

These changes allow improvements in memory usage for the OPA HTTP server, and help OPA deployments avoid some accidental out-of-memory situations.

For most users, no changes will be needed to continue using OPA. However, to control this behavior, two new configuration keys are available: server.decoding.max_length and server.decoding.gzip.max_length. These control the max size in bytes to allow for an incoming request payload, and the maximum size in bytes to allow for a decompressed gzip request payload, respectively.

Here's an example OPA configuration using the new keys:

# Set max request size to 64 MB and max gzip size (decompressed) to be 128 MB.
server:
  decoding:
    max_length: 67108864
    gzip:
      max_length: 134217728

Topdown and Rego

• topdown: New strings.count builtin which returns the number of non-overlapping instances of a substring in a string (#6827) authored by @​Manish-Giri
• format: Produce error when --rego-v1 formatted module has rule name conflicting with keyword (#6833) authored by @​johanfylling
• topdown: Add cap to caches for regex and glob built-in functions (#6828) authored by @​johanfylling. This fixes possible memory leaks where caches grow uncontrollably when large amounts of regexes or globs are generated or originate from the input document.

Runtime, Tooling, SDK

• repl: Add support for correctly loading bundle modules (#6872) authored by @​ashutosh-narkar
• plugins/discovery: Allow un-registration of discovery listener (#6851) authored by @​mjungsbluth. The discovery plugin allows OPA to register a bundle download status listener but previously did not offer a method to unregister that listener
• plugins/logs: Reduce amount of work performed inside global lock in decision log plugin (#6859) authored by @​johanfylling
• plugins/rest: Add a new client credential attribute to support Azure Workload Identity. This would allow workloads deployed on an Azure Kubernetes Services (AKS) cluster to authenticate and access Azure cloud resources (#6802) authored by @​ledbutter
• cmd/inspect: Add ability for opa inspect to inspect a single file outside of any bundle (#6873) authored by @​tjons
• cmd+bundle: Add --follow-symlinks flag to the opa build command to allow users to build directories with symlinked files, and have the contents of those symlinked files included in the built bundle (#6800) authored by @​tjons
• server: Add missing handling in the server for the explain=fails query value (#6886) authored by @​acamatcisco

Docs, Website, Ecosystem

• docs: Update bundle section with an example of a manifest with rego_version and file_rego_versions attributes (#6885) authored by @​ashutosh-narkar
• docs: Better link language SDKs to make them more discoverable (#6866) authored by @​charlieegan3

Miscellaneous

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

0.67.0

This release contains a mix of features, a new builtin function (strings.count), performance improvements, and bugfixes.

Breaking Change

Request Body Size Limits

OPA now automatically rejects very large requests (#6868) authored by @​philipaconrad. Requests with a Content-Length larger than 128 MB uncompressed, and gzipped requests with payloads that decompress to larger than 256 MB will be rejected, as part of hardening OPA against denial-of-service attacks. Previously, a large enough request could cause an OPA instance to run out of memory in low-memory sidecar deployment scenarios, just from attempting to read the request body into memory.

These changes allow improvements in memory usage for the OPA HTTP server, and help OPA deployments avoid some accidental out-of-memory situations.

For most users, no changes will be needed to continue using OPA. However, to control this behavior, two new configuration keys are available: server.decoding.max_length and server.decoding.gzip.max_length. These control the max size in bytes to allow for an incoming request payload, and the maximum size in bytes to allow for a decompressed gzip request payload, respectively.

Here's an example OPA configuration using the new keys:

# Set max request size to 64 MB and max gzip size (decompressed) to be 128 MB.
server:
  decoding:
    max_length: 67108864
    gzip:
      max_length: 134217728

Topdown and Rego

• topdown: New strings.count builtin which returns the number of non-overlapping instances of a substring in a string (#6827) authored by @​Manish-Giri
• format: Produce error when --rego-v1 formatted module has rule name conflicting with keyword (#6833) authored by @​johanfylling
• topdown: Add cap to caches for regex and glob built-in functions (#6828) authored by @​johanfylling. This fixes possible memory leaks where caches grow uncontrollably when large amounts of regexes or globs are generated or originate from the input document.

Runtime, Tooling, SDK

• repl: Add support for correctly loading bundle modules (#6872) authored by @​ashutosh-narkar
• plugins/discovery: Allow un-registration of discovery listener (#6851) authored by @​mjungsbluth. The discovery plugin allows OPA to register a bundle download status listener but previously did not offer a method to unregister that listener
• plugins/logs: Reduce amount of work performed inside global lock in decision log plugin (#6859) authored by @​johanfylling
• plugins/rest: Add a new client credential attribute to support Azure Workload Identity. This would allow workloads deployed on an Azure Kubernetes Services (AKS) cluster to authenticate and access Azure cloud resources (#6802) authored by @​ledbutter
• cmd/inspect: Add ability for opa inspect to inspect a single file outside of any bundle (#6873) authored by @​tjons
• cmd+bundle: Add --follow-symlinks flag to the opa build command to allow users to build directories with symlinked files, and have the contents of those symlinked files included in the built bundle (#6800) authored by @​tjons
• server: Add missing handling in the server for the explain=fails query value (#6886) authored by @​acamatcisco

Docs, Website, Ecosystem

• docs: Update bundle section with an example of a manifest with rego_version and file_rego_versions attributes (#6885) authored by @​ashutosh-narkar
• docs: Better link language SDKs to make them more discoverable (#6866) authored by @​charlieegan3

... (truncated)

Commits

• b62ae6b Prepare v0.67.0 release
• bec8e1a build(deps): bump github/codeql-action from 3.25.13 to 3.25.14 (#6888)
• d48fdd9 server: Add missing handling for explain=fails to the REST API.
• 959f9e5 docs: Add an example of a manifest with attribute
• a793f27 repl: Add support for correctly loading bundle modules
• c5706ee server+util: Limit max request sizes, prealloc request buffers (#6868)
• 0ca35e2 build(deps): bump docker/setup-buildx-action from 3.4.0 to 3.5.0 (#6880)
• f9ccb66 build(deps): bump github/codeql-action from 3.25.12 to 3.25.13 (#6881)
• 0db1f8f build(deps): bump docker/setup-qemu-action from 3.1.0 to 3.2.0 (#6882)
• ac3ddf9 docs: Update generated CLI docs
• Additional commits viewable in compare view

Updates github.com/open-policy-agent/opa-envoy-plugin from 0.66.0-envoy-2 to 0.67.0-envoy

Release notes

Sourced from github.com/open-policy-agent/opa-envoy-plugin's releases.

v0.67.0-envoy

What's Changed

• build(deps): bump github.com/open-policy-agent/opa from 0.66.0 to 0.67.0 by @​ashutosh-narkar in open-policy-agent/opa-envoy-plugin#569. See the OPA v0.67.0 release notes.
• build(go): bump 1.22.4 -> 1.22.5 by @​srenatus in open-policy-agent/opa-envoy-plugin#565
• build(deps): bump google.golang.org/grpc from 1.64.0 to 1.65.0
• build(deps): bump golang.org/x/tools from 0.22.0 to 0.23.0

Commits

• a596d30 build(deps): bump github.com/open-policy-agent/opa from 0.66.0 to 0.67.0
• c111c33 build(deps): bump golang.org/x/tools from 0.22.0 to 0.23.0
• 5b63a68 build(deps): bump google.golang.org/grpc from 1.64.0 to 1.65.0
• 10d8375 build(go): bump 1.22.4 -> 1.22.5
• See full diff in compare view

Updates github.com/redis/go-redis/v9 from 9.6.0 to 9.6.1

Release notes

Sourced from github.com/redis/go-redis/v9's releases.

9.6.1

Changes

9.6

This release contains all new features from version 9.6.

🚀 New Features

• Support Hash-field expiration commands (#2991)
• Support Hash-field expiration commands in Pipeline & Fix HExpire HExpireWithArgs expiration (#3038)
• Support NOVALUES parameter for HSCAN (#2925)
• Added test case for CLIENT KILL with MAXAGE option (#2971)
• Add support for XREAD last entry (#3005)
• Reduce the type assertion of CheckConn (#3066)

9.6.1

In addition minor changes were performed to retract version 9.5.3 and 9.5.4 that were released accidentally.

🧰 Maintenance

• Change CI to 7.4.0-RC2 (#3070)

🎁 Package Distribution

• Retract versions 9.5.3 and 9.5.4 (#3069)

Contributors

We'd like to thank all the contributors who worked on this release!

@​LINKIWI, @​b1ron, @​gerzse, @​haines, @​immersedin, @​naiqianz, @​ofekshenawa, @​srikar-jilugu, @​tzongw, @​vladvildanov, @​vmihailenco and @​monkey92t

Commits

• c3610cd cp retracts and bump version to 9.6.1 (#3069)
• b0b94e7 Change CI to 7.4.0-RC2 (#3070)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[MustafaSaber]

we need to check the breaking changes first

[Pushpalanka]

On breaking change in OPA

The breaking change is Requests with a Content-Length larger than 128 MB uncompressed, and gzipped requests with payloads that decompress to larger than 256 MB will be rejected automatically.
Out current default setting for this is 1MB and AFAIK no deployment is parsing a body size above this at the moment.

I would suggest we release the change with a same note, that if anyone is using OPA filter with request bodies above 128MB it will break, given the slight possibility based on opensource community.

For the use case to parse body sizes above 128 MB, down the line it will create a confusion as even though Skipper configs allow it, OPA will fail it. Created issue(#3177) to pass on the configurations in the Skipper integration with OPA, now that OPA supports this.

[Pushpalanka]

Also there is this regression issue reported against OPA 0.67.0 version. Issue is specific and seems to happen only when Transfer-Encoding: chunked header is present, still I would suggest it's safer to to upgrade with the bug fixed version.

[MustafaSaber]

Also there is this regression issue reported against OPA 0.67.0 version. Issue is specific and seems to happen only when Transfer-Encoding: chunked header is present, still I would suggest it's safer to to upgrade with the bug fixed version.

then let's wait for the next version, thanks @Pushpalanka !

[MustafaSaber]

@dependabot close

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

[MustafaSaber]

let's keep an eye also on how dependabot will create the new PR and deal with the unmerged version but has no new versions