Update dependency open-policy-agent/opa to v1.13.2

[renovate]

This PR contains the following updates:

Package	Update	Change
open-policy-agent/opa	minor	v1.12.2 → v1.13.2

---

Release Notes

open-policy-agent/opa (open-policy-agent/opa)

v1.13.2

Compare Source

This release updates the version of Go used to build the OPA binaries and images to 1.25.7.
That version of the Go standard library contains a fix for GO-2026-4337.

Full Changelog: open-policy-agent/opa@v1.13.1...v1.13.2

v1.13.1

Compare Source

v1.13.1

This bug fix release addresses an issue found in the new array.flatten built-in function

• Fix issue in array.flatten handling of single item arrays (#​8273) (#​8272) authored by @​anderseknert

v1.13.0

Compare Source

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

• A new immediate upload trigger mode in the Decision Logger
• A new array.flatten built-in function
• Numerous performance improvements

Immediate Upload Trigger Mode in Decision Logger (#​8110)

An immediate trigger mode has been added to the Decision Logger; enabled by setting the decision_logs.reporting.trigger configuration option to immediate.
When enabled, log events are pushed to the log service as soon as the configured upload chunk size criteria is met; or, at latest, when the configured upload delay is reached.

Authored by @​sspaink

Runtime, SDK, Tooling

• cmd/fmt: Do not overwrite file on fmt without changes (#​8222) authored by @​Loic-R
• cmd/test: Enable sorting JSON test results by duration (#​7444) authored by @​sspaink
• profiler: nil *Profiler should not report Enabled() (#​8256) authored by @​anderseknert
• rego: Add Data function to simplify adding data from map (#​5961) authored by @​majiayu000 reported by @​anderseknert
• runtime: Correct naming & docs for version checking (#​8191) authored by @​charlieegan3

Compiler, Topdown and Rego

• ast: Body.String() doesn't panic on empty body (#​8244) authored by @​srenatus
• ast: Improve type error message when referencing functions (#​6840) authored by @​sspaink
• ast: Type Checker recognizes when a variable has multiple assignments but is an undefined function (#​7463) authored by @​sspaink reported by @​anderseknert
• ast/parser: Avoid duplicate loc copies (#​8142) authored by @​srenatus
• topdown: Add array.flatten built-in function (#​8226) authored by @​anderseknert
• topdown: Fix issue where numbers.range_step built-in could erroneously return undefined value (#​8194) authored by @​thevilledev
• topdown: Remove hard-coded missing key error in strings.render_template built-in (#​7931) authored by @​colinjlacy reported by @​anderseknert
• topdown: Re-introduce cancellation-awareness for regex.replace built-in (#​8179) authored by @​srenatus
  from having been reverted in v1.12.1
• topdown: Support arrays as input for json.match_schema (#​6615) authored by @​sspaink reported by @​mscudlik

Performance

• ast: Improved annotations parsing (#​8210) authored by @​anderseknert
• ast: Reinstate zero-alloc paths in Ref.String() (#​8202) authored by @​anderseknert
• ast: Replace regex implementation in IsVarCompatibleString (#​8164) authored by @​anderseknert
• ast: Optimize Set.Intersect and Set.Diff (#​8167) authored by @​thevilledev
• ast: Optimize Set.Union (#​8172) authored by @​thevilledev
• ast: Reduce allocations in Expr.MarshalJSON (#​8204) authored by @​thevilledev
• ast: Reduce allocations in Rule.MarshalJSON (#​8205) authored by @​thevilledev
• ast: Reduce allocations in Term.MarshalJSON (#​8200) authored by @​thevilledev
• ast: Reduce allocations in With.MarshalJSON (#​8206) authored by @​thevilledev
• perf: String() implementations using appenders (#​8192) authored by @​anderseknert
• topdown: Avoid redundancy in builtinTrim (#​8237) authored by @​thevilledev
• topdown: Eliminate closure allocations in Set and virtual doc enumeration (#​8242) authored by @​alex60217101990
• topdown: Fast paths for array.reverse (#​8177) authored by @​thevilledev
• topdown: Optimize json.remove and json.filter (#​8193) authored by @​thevilledev
• topdown: Optimize object built-ins (#​8175) authored by @​thevilledev
• topdown: Optimize union built-in (#​8173) authored by @​thevilledev
• topdown: Pre-alloc in various built-ins (#​8198) authored by @​thevilledev
• topdown: Reduce allocs in float sum/product (#​8235) authored by @​thevilledev
• topdown: Skip set copy in getObjectKeysParam (#​8176) authored by @​thevilledev

Docs, Website, Ecosystem

• docs: Add authz-spring-boot-starter to Spring Security API ecosystem entry (#​8234) authored by @​francois-eckert
• docs: Add header for crypto example to make (#​8259) authored by @​charlieegan3
• docs: Add notes for automated agents (#​8147, #​8203) authored by @​charlieegan3
• docs: Add opa-wasm-zig to the ecosystem (#​8163) authored by @​burdzwastaken
• docs: Add scripts to import docs from source (#​8148) authored by @​charlieegan3
• docs: Explain how to use the SDK without a initialising a server (#​8248) authored by @​andrewcameronsims
• docs: Fix a number of redirecting links (#​8165 authored by @​charlieegan3
• docs: Fix template-expression examples (#​8199) authored by @​johanfylling
• docs/ocp: Mention source prefix/path options (#​8238) authored by @​srenatus
• website: Add redirect section for immutable referrers (#​8262) authored by @​charlieegan3 reported by @​KraLeoD
• website: Display 2025 survey results on the website (#​8258) authored by @​charlieegan3
• website: Show breadcrumbs in search results (#​8207) authored by @​charlieegan3

Miscellaneous

• Decoupled the Rego job check from the Go job checks in the Github PR workflow (#​8203) authored by @​SeanLedford
• build: Format pr_check.rego with opa fmt (#​8201) authored by @​thevilledev
• build: Migrate PR check to OPA policy (#​8183) authored by @​SeanLedford
• build: Run go get against main to spot redacted (#​8146) authored by @​charlieegan3
• deps: Switch to maintained go.yaml.in/yaml/v3 yaml library (#​8182) authored by @​mrueg
• test/cases: Increase yaml test coverage for some regex and string builtins (#​8152) authored by @​srenatus
• Dependency updates; notably:
  • build: bump golang from 1.25.5 to 1.25.6 (#​8224) authored by @​srenatus
  • build(deps): bump go.opentelemetry.io deps from 1.38.0/0.63.0 to 1.39.0/0.64.0
  • build(deps): bump klauspost/compress from v1.18.1 to v1.18.2 (#​8184) authored by @​srenatus
    because of redaction warning
  • build(deps): bump github.com/go-ini/ini from v1.67.0 to gopkg.in/ini.v1 v1.67.1 (#​8208) authored by @​gabrpt

v1.12.3

Compare Source

v1.12.3

This is a bug fix release addressing two issues:

Bundle polling is being misconfigured when discovery bundle is updated (#​8215)

This is an issue where the polling interval for discovery (discovery.polling.min_delay_seconds and discovery.polling.max_delay_seconds) were misinterpreted on reconfiguration, causing extremely long update intervals.

Reported by @​loganmiller-chime, authored by @​sspaink

Decision log size buffer buffer_size_limit_bytes misconfigured during reconfiguration (#​8213)

This is a regression in the decision log, where the decision_logs.reporting.buffer_size_limit_bytes was mistakenly assigned the value of decision_logs.reporting.upload_size_limit_bytes during reconfiguration.
This issue is only present when decision_logs.reporting.buffer_type is set to size, which is the default value.

Authored by @​sspaink

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.