build(deps): Bump github.com/open-policy-agent/opa from 1.4.2 to 1.18.2 in /authbridge/authlib

[dependabot]

Bumps github.com/open-policy-agent/opa from 1.4.2 to 1.18.2.

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.18.2

This release includes a bug fix for a opa fmt regression introduced in v1.18.0.

The original fix for #8557 had the formatter enforce newlines in single-item collections (arrays, objects, sets) rather than merely honoring existing ones. As a result, running opa fmt on already-formatted policies could introduce a large number of unwanted changes. This patch release restores the intended behavior: only newlines already present in the source determine whether a single-item collection is formatted on one line or across multiple lines.

Fixes

• Fix regression in fix of #8557 (#8845) (authored by @​anderseknert)

v1.18.1

This release fixes a memory leak introduced in OPA v1.17.0. It is advised to update if you notice excess memory usage when running OPA server.

Fixes

• ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle (#8817) authored by @​srenatus reported by @​keydon and @​gorsr01

v1.18.0

This release contains a mix of bugfixes and small features. Notably:

• A breaking fix to the outbound User-Agent header so it conforms to RFC 9110 (see below)
• Container-aware resource limits: automatic GOMAXPROCS is restored and automatic GOMEMLIMIT is now supported
• Several opa fmt correctness fixes
• Improvements to opa test --coverage (ranges in report, inline rule head tracking, conjunction-expression coverage)

Breaking: Fix User-Agent according to RFC9110 (#8792)

OPA's outbound HTTP requests (bundle, discovery, decision log, status, http.send, AWS KMS/ECR) previously sent User-Agent: Open Policy Agent/<version> (<os>, <arch>), which is not a valid RFC 9110 User-Agent value because the product token cannot contain spaces. The header is now Open-Policy-Agent/<version> (<os>, <arch>). Server-side log filters or WAF rules that exact-match the old string will need to be updated.

Authored by @​sspaink, reported by @​SpecLad

Runtime, SDK, Tooling

• bundle: fix per-module rego version lookup (#8797) authored by @​sspaink, reported by @​xubinzheng
• bundle: improve determinism of file_rego_versions patterns with overlap (#8733) authored by @​philipaconrad
• cover: Track inline rule head in post trace walk (#6531) authored by @​charlieegan3, reported by @​anderseknert
• cover: Update report to include ranges (#8748) reported and authored by @​charlieegan3
• cover: Add support for coverage of conjunction exprs (#8809) authored by @​charlieegan3
• download/oci: Set Accept headers (#8720) authored by @​charlieegan3
• fmt: preserve the multiline but single entry iterables (#8557) authored by @​unichronic, reported by @​anderseknert
• format: Fix dropped with-clause after comment in object value (#8765) authored by @​sspaink, reported by @​srabraham
• format: keep lone with on the closing-bracket line of multi-line expressions (#8804) authored by @​anneheartrecord, reported by @​burnster
• oracle: Fix find-definition on expressions inside ast.Not nodes (#8731) authored by @​johanfylling
• runtime: Restore goautomaxprocs, add automemlimit (#8784) authored by @​charlieegan3

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.18.2

This release includes a bug fix for a opa fmt regression introduced in v1.18.0.

The original fix for #8557 had the formatter enforce newlines in single-item collections (arrays, objects, sets) rather than merely honoring existing ones. As a result, running opa fmt on already-formatted policies could introduce a large number of unwanted changes. This patch release restores the intended behavior: only newlines already present in the source determine whether a single-item collection is formatted on one line or across multiple lines.

Fixes

• Fix regression in fix of #8557 (#8845) (authored by @​anderseknert)

1.18.1

This release fixes a memory leak introduced in OPA v1.17.0. It is advised to update if you notice excess memory usage when running OPA server.

Fixes

• ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle (#8817) authored by @​srenatus reported by @​keydon and @​gorsr01

1.18.0

This release contains a mix of bugfixes and small features. Notably:

• A breaking fix to the outbound User-Agent header so it conforms to RFC 9110 (see below)
• Container-aware resource limits: automatic GOMAXPROCS is restored and automatic GOMEMLIMIT is now supported
• Several opa fmt correctness fixes
• Improvements to opa test --coverage (ranges in report, inline rule head tracking, conjunction-expression coverage)

Breaking: Fix User-Agent according to RFC9110 (#8792)

OPA's outbound HTTP requests (bundle, discovery, decision log, status, http.send, AWS KMS/ECR) previously sent User-Agent: Open Policy Agent/<version> (<os>, <arch>), which is not a valid RFC 9110 User-Agent value because the product token cannot contain spaces. The header is now Open-Policy-Agent/<version> (<os>, <arch>). Server-side log filters or WAF rules that exact-match the old string will need to be updated.

Authored by @​sspaink, reported by @​SpecLad

Runtime, SDK, Tooling

• bundle: fix per-module rego version lookup (#8797) authored by @​sspaink, reported by @​xubinzheng
• bundle: improve determinism of file_rego_versions patterns with overlap (#8733) authored by @​philipaconrad
• cover: Track inline rule head in post trace walk (#6531) authored by @​charlieegan3, reported by @​anderseknert
• cover: Update report to include ranges (#8748) reported and authored by @​charlieegan3
• cover: Add support for coverage of conjunction exprs (#8809) authored by @​charlieegan3

... (truncated)

Commits

• e695c9e Patch release v1.18.2
• d473969 Fix regression in fix of #8557 (#8845)
• acc8bf9 Release v1.18.1
• 713dc6a ast: fix AnnotationSet memory leak via runtime.AddCleanup cycle
• cc2c5c6 Prepare v1.18 release (#8820)
• e72a98f format: keep lone with on the closing-bracket line of multi-line expression...
• 03646dd topdown: Fix PE not namespacing vars in comprehensions nested inside every ...
• bf2bb52 benchmarks: split off script, emit markdown table
• 02ce276 version: fix ill-formed User-Agent header (#8796)
• 1fdbb77 build(deps): bump the dependencies group across 2 directories with 6 updates
• Additional commits viewable in compare view

[pdettori]

Holding this one — triaged as high-risk.

Bumping opa 1.4.2 → 1.18.2 transitively pulls in oras.land/oras-go/v2@2.6.1, which carries a high-severity advisory:

• GHSA-fxhp-mv3v-67qp — oras-go tar extraction: hardlink entry with relative Linkname escapes the extract dir via process CWD resolution.

This is why the Dependency Review check fails (fail-on-severity: moderate), on top of the shared dependent-module go mod tidy issue that affected the other authlib bumps (now resolved in #673).

Recommended options before merging:

1. Wait for an opa release whose transitive oras-go is >= 2.6.2 (the patched version), then let Dependabot re-open, or
2. Manually bundle this bump with an explicit oras.land/oras-go/v2 bump to the patched version + go mod tidy in authlib/envoy/proxy (same pattern as build(deps): Bump authlib deps and tidy dependent modules #673).

Leaving open for now rather than merging.

[pdettori]

Superseded by #674, which applies option 2 above: the opa 1.4.2 → 1.18.2 bump bundled with an explicit oras.land/oras-go/v2 v2.6.2 pin (patches GHSA-fxhp-mv3v-67qp) plus go mod tidy across authlib/envoy/proxy/abctl. #674 will close this PR on merge.