Open Policy Agent v1.19.0

This release focuses on hardening security and boosting performance. Key highlights include a fix for a SQL injection vector in the Compile API, a major overhaul of the WebAssembly runtime that removes C dependencies while slashing execution times, and stricter Rego language checks to prevent ambiguous policy logic. Additionally, OPA now provides better feedback on configuration errors and improves the local development experience via an upgraded REPL.

Fix SQL Injection vector in Compile API via identifier quoting — Prevents attackers from manipulating SQL queries generated by OPA's Compile API when using dynamic keys. This closes a critical vulnerability where malicious input could bypass policy enforcement by injecting SQL control characters into database filters.

Faster, cgo-free WebAssembly runtime with wazero — Significantly improves performance for users deploying OPA with WebAssembly. By switching to a pure-Go runtime, you get faster cold starts (73%), faster evaluations (29%), and a simpler build process that no longer requires a C toolchain (cgo-free).

Stricter safety checks for Rego assignment operator (:=) — OPA now enforces stricter logic for the assignment operator (:=). If your policies relied on 'backwards' unification to make a variable safe, they will now fail with a compilation error. This ensures policies are more explicit and prevents performance pitfalls like accidental full-collection iterations.

Startup warnings for unknown configuration options — Easier debugging and management of OPA instances. You will now receive explicit warnings at startup if your configuration file contains typos or unsupported keys, rather than having them silently ignored.