[EliMoshkovich]

Summary

• OPA: 1.9.0-static → 1.21.4-static (2026-10-23, built with Go 1.27.3), the latest security release:

  • 1.21.2 and 1.21.4 are Go security rebuilds;
  • 1.21.3 fixes GHSA-g2pf-6v5v-qcc8 (a bundle stripped of its signature was accepted).

  The old binary was built with Go 1.25.1, which carries CVE-2025-68121 and later Go stdlib CVEs.

  • Pinned by digest. opa_digest defaults to the 1.21.4-static index (linux/amd64 and linux/arm64). The build checks that the tag resolves to it, then copies by digest.
  • The documented opa_image / opa_tag build args ([enh] Add opa_image Dockerfile build argument #322) keep working. An override needs the matching opa_digest, or an empty one; otherwise the build stops and says so.
  • skopeo copy now passes --override-arch "${TARGETARCH}", so the arch is explicit rather than an accident of the stage running emulated.

• EOPA: v1.44.0 → v1.45.1. The download is now checked against the release's checksums.txt for each arch; before, wget output went into the image unchecked.

• CI:

  • The real-binary argv tests run against OPA 1.21.4, the same version the image ships (they were on 1.20.2), and the download retries.
  • A new binary-stages job builds opa-extractor and eopa-extractor for linux/amd64 and linux/arm64, so a wrong digest or checksum fails a PR rather than a release.

• Docs:

  • opa-version-migration.mdx gets a section, "OPA bundled in the client image", covering the changes below and the opa check commands.
  • The quickstart's eOPA section warns that upstream eOPA is archived.

• Merged master as of 2026-10-27 (5f0e875).

⚠️ May break some user policies (worth a release note)

OPA 1.19–1.21 tightened the compiler, and OPAL loads user policies through PUT /v1/policies. A policy that compiled on 1.9 can therefore be rejected at load time on the new client image, with or without --v0-compatible:

• 1.19.0: stricter safety for :=. Policies that unified backwards through := now fail with rego_unsafe_var_error.
• 1.21.0: empty composite literals ({}, [], set()) are typed as empty, so selecting from or iterating them fails to compile. in is type-checked (#5658).
• 1.21.0: YAML is parsed as YAML 1.2 core, so yes/no/on/off are strings, including in --config-file.
• 1.20.0: adds the and/or keywords, which import future.keywords now pulls in.

Users should run opa check (plus --v0-compatible if they use it) with 1.21.4 against their policy repo before upgrading. The user docs now say so.

OPAL's opa run flags and the REST endpoints it uses (/v1/policies, /v1/data, /health) are unchanged. The real-binary argv tests pass on 1.21.4 (15 passed). OPAL's own policies and fixtures checked identically on 1.9.0 and 1.21.1.

Resolved

Measured with Trivy (CRITICAL/HIGH, amd64):

• The OPA binary in the published permitio/opal-client:latest (0.9.9) is OPA 1.9.0 and carries 54 findings, including CVE-2025-68121 (CRITICAL, Go stdlib 1.25.1) and CVE-2026-33186 (CRITICAL, grpc 1.75.1).
• master (5f0e875) and 0.10.0-rc.1 still pin 1.9.0.

The image scan of this branch is in the verification below.

CVE	Image	Dependency	Fix
CVE-2025-68121 (and later Go stdlib CVEs)	permitio/opal-client	golang/stdlib@1.25.1	OPA 1.21.4, built with Go 1.27.3

Not resolvable upstream (EOPA image)

open-policy-agent/eopa is archived, so v1.45.1 is its last release. That binary is built with go1.25.4 on OPA v1.10.1 and bundles pgx v5.7.6. In permitio/opal-client-eopa these stay unfixed for good:

• every pgx advisory fixed after 5.7.6 (5.9.x and later);
• the Go stdlib fixes after 1.25.4;
• every OPA server fix after 1.10.1.

The Dockerfile and the quickstart docs say so, and recommend retiring the EOPA variant.

Verified locally

• The opa-extractor and eopa-extractor stages build for linux/amd64 and linux/arm64, each with the correct-arch static binary.
• The digest pin, four cases:
  • the default builds;
  • a wrong opa_digest stops with the expected digest and the fix;
  • opa_tag=1.21.3-static without a digest stops with the same message;
  • the same override with an empty opa_digest builds.
• Negative test: a wrong EOPA_SHA256_x86_64 fails the build at sha256sum -c.

Not changed here (already on master)

alpine:latest in the two extractor stages, the tag-only permitio/cedar-agent:0.2.1, and the unchecked libgit2 tarball download are floating or unverified inputs. They're worth their own follow-up.

Description updated during review to match 66a8c1e: OPA 1.21.4, digest pin, docs, arm64 stages in CI.

🤖 Generated with Claude Code

[linear]

PER-14697 Docker Scout Vulnerability

[netlify]

✅ Deploy Preview for opal-docs ready!

Name	Link
🔨 Latest commit	032e1b4
🔍 Latest deploy log	https://app.netlify.com/projects/opal-docs/deploys/6ae0f79a3814896e44aa8f6b
😎 Deploy Preview	https://deploy-preview-906--opal-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

Copilot review overview

🟢 Approval recommended

The version updates and architecture-specific checksum verification are internally consistent and correctly implemented.

Review effort: Balanced
Findings: None

What changed in this PR

Updates embedded OPA/EOPA binaries to address known vulnerabilities and adds integrity verification for EOPA downloads.

Changes:

• Bumps OPA to 1.21.1-static.
• Bumps EOPA to v1.45.1.
• Verifies architecture-specific EOPA downloads using pinned SHA-256 checksums.

File	Description
docker/​Dockerfile	Updates binary versions, documents residual CVEs, and adds checksum validation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟢 Approval recommended

The version updates, multi-architecture handling, checksum verification, and CI alignment are consistent and complete.

Review effort: Balanced
Findings: None

[zeevmoney]

Changes requested — 1 HIGH, 1 MEDIUM, 4 LOW.

Blocking:

• HIGH docker/Dockerfile:99 — OPA 1.21.1 has been superseded by security releases 1.21.2 and 1.21.3; bump here and in tests.yml:72

Non-blocking:

• MEDIUM docker/Dockerfile:97 — the policy-compatibility break isn't in the user docs, and "see the release notes" points nowhere
• LOW docker/Dockerfile:101 — the OPA image is still resolved by a mutable tag
• LOW docker/Dockerfile:142 — the list of unfixed pgx CVEs is incomplete
• LOW docker/Dockerfile:144 — the user docs still offer opal-client-eopa without a caveat
• LOW docker/Dockerfile:157 — PR CI never builds eopa-extractor or any arm64 target, so this checksum is first checked at release

Merge readiness (not a code finding):

• The branch is one commit behind master (#968), which added the required CI aggregate job to tests.yml. That check can't report on this PR until master is merged in. The PR's CI results date from 2026-10-01.

Details are in the inline comments on each line.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[zeevmoney]

Approved — no CRITICAL or HIGH issues found.

Non-blocking:

• MEDIUM documentation/docs/tutorials/opa-version-migration.mdx:162 — opa check can't catch the YAML change, but the section presents it as a load-time rejection
• LOW docker/Dockerfile:132 — the digest check's error message is wrong in two cases
• LOW .github/workflows/tests.yml:299 — the new job pins the docker actions by tag

Details are in the inline comments on each line.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.