chore: bump github.com/open-policy-agent/opa from 1.20.2 to 1.21.0 in /constraint

[dependabot]

Bumps github.com/open-policy-agent/opa from 1.20.2 to 1.21.0.

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.21.0

This release contains a mix of new features and bug fixes. Notably:

• Improved rule indexing
• Improved rule recursion check
• YAML is parsed against the 1.2 core schema (breaking change)

Rules with general refs no longer collide in the recursion check (#6813)

Before, this was a recursion error:

package play
p[x].foo.bar if {
x := "a"
not p[x].foo.baz
}
p[x].foo.baz if {
x := "a"
false
}

Rules with a variable in their head are all stored at the ground prefix of their ref, so p[x].foo.bar and p[x].foo.baz looked like dependencies of each other. The compiler is now less conservative and compares the ref parts past the prefix. Genuine cycles are still reported.

The IR and Wasm targets however still return an error: they plan one function per ground path prefix, and cannot evaluate part of a function that is still being planned.

Authored by @​sspaink, reported by @​tsandall

Data and Query APIs can return rule labels in the response (#9211)

# METADATA labels for evaluated rules were only available in decision log events. The Data API (GET/POST /v1/data) and Query API (GET/POST /v1/query) now accept a rule_labels query parameter to include the same merged labels in the response payload, under a rule_labels key.

Authored by @​srenatus

Behavior change: response gzip compression now bounds its buffer to min_length (#9205)

The server's gzip response compression (server.encoding.gzip) buffered an entire incoming Write call before deciding whether to compress, so a single large write could grow the buffer well past min_length before that decision was made. The handler is now built on klauspost/compress/gzhttp

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.21.0

This release contains a mix of new features and bug fixes. Notably:

• Improved rule indexing
• Improved rule recursion check
• YAML is parsed against the 1.2 core schema (breaking change)

Rules with general refs no longer collide in the recursion check (#6813)

Before, this was a recursion error:

package play
p[x].foo.bar if {
x := "a"
not p[x].foo.baz
}
p[x].foo.baz if {
x := "a"
false
}

Rules with a variable in their head are all stored at the ground prefix of their ref, so p[x].foo.bar and p[x].foo.baz looked like dependencies of each other. The compiler is now less conservative and compares the ref parts past the prefix. Genuine cycles are still reported.

The IR and Wasm targets however still return an error: they plan one function per ground path prefix, and cannot evaluate part of a function that is still being planned.

Authored by @​sspaink, reported by @​tsandall

Data and Query APIs can return rule labels in the response (#9211)

# METADATA labels for evaluated rules were only available in decision log events. The Data API (GET/POST /v1/data) and Query API (GET/POST /v1/query) now accept a rule_labels query parameter to include the same merged labels in the response payload, under a rule_labels key.

Authored by @​srenatus

Behavior change: response gzip compression now bounds its buffer to min_length (#9205)

The server's gzip response compression (server.encoding.gzip) buffered an entire incoming Write call before deciding whether to compress, so a single large write could grow the buffer well past min_length before that decision was made. The handler is now

... (truncated)

Commits

• dc6269f Release v1.21.0 (#9258)
• f6aa85f ast: count a ref once when an index entry replaces its var entry
• b7a4a42 build(deps): bump the dependencies group across 2 directories with 11 updates
• 3f11d3a docs: update Agent Evidence Admission repo links (#9255)
• 2dcd8ab topdown: fix flaky TestRegexBuiltinCache (#9254)
• c327a14 docs: ecosystem entry for Agent Evidence Admission (#9213)
• a83674f docs: Address incorrect package name in example (#9250)
• 620b7a5 website: Implement local search based on Pagefind (#9249)
• 959890c topdown: add stack traces to evaluation errors (#9242)
• 455aebd ast: don't box a slice header on the way out of Transform
• Additional commits viewable in compare view

[JaydipGabani]

@dependabot rebase