chore: bump github.com/open-policy-agent/opa from 1.18.2 to 1.19.1 in /authbridge/authlib

[dependabot]

Bumps github.com/open-policy-agent/opa from 1.18.2 to 1.19.1.

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.19.1

This release uses the latest version of Go (1.26.6) to build OPA, fixing stdlib vulnerabilities in code that OPA's HTTP handler and crypto builtins use:

• https://pkg.go.dev/vuln/GO-2026-6218
• https://pkg.go.dev/vuln/GO-2026-6091
• https://pkg.go.dev/vuln/GO-2026-6090
• https://pkg.go.dev/vuln/GO-2026-6089
• https://pkg.go.dev/vuln/GO-2026-6088
• https://pkg.go.dev/vuln/GO-2026-5972
• https://pkg.go.dev/vuln/GO-2026-5026

It is otherwise the same code as v1.19.0.

Note that users building their own OPA binaries and images already control the Golang version, so this is not relevant for them.

Miscellaneous

• build(go): bump to 1.26.6 (authored by @​srenatus)

v1.19.0

This release contains a mix of new features and bug fixes. Notably:

• A fixed SQL injection vector in the Compile API
• Stricter safety checking for Rego assignments (:=)
• A cgo-free, faster WebAssembly runtime (wazero replaces wasmtime-go)
• Startup warnings for unknown configuration options
• A new strings.split_n built-in function
• A REPL line reader that handles pasted input correctly, migrating existing history files

Fix SQL injection vector in Compile API: Quote SQL filter field identifiers (#8945)

The field names in the SQL emitted by the Compile API come from partially evaluated refs, so a policy that selects a dynamic key — such as input.fruits[input.column] — puts caller-controlled text in an identifier position. That text was emitted verbatim, which turns

WHERE fruit.name = 'allowed'

into

WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed'

and an application appending the filter to its query returns rows the policy denies.

Field segments that are not bare identifiers are now quoted at the UCAST-to-SQL boundary, with any embedded quote character escaped. Ordinary column names stay unquoted, so existing filters keep

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.19.1

This release uses the latest version of Go (1.26.6) to build OPA, fixing stdlib vulnerabilities in code that OPA's HTTP handler and crypto builtins use:

• https://pkg.go.dev/vuln/GO-2026-6218
• https://pkg.go.dev/vuln/GO-2026-6091
• https://pkg.go.dev/vuln/GO-2026-6090
• https://pkg.go.dev/vuln/GO-2026-6089
• https://pkg.go.dev/vuln/GO-2026-6088
• https://pkg.go.dev/vuln/GO-2026-5972
• https://pkg.go.dev/vuln/GO-2026-5026

It is otherwise the same code as v1.19.0.

Note that users building their own OPA binaries and images already control the Golang version, so this is not relevant for them.

Miscellaneous

• build(go): bump to 1.26.6 (authored by @​srenatus)

1.19.0

This release contains a mix of new features and bug fixes. Notably:

• A fixed SQL injection vector in the Compile API
• Stricter safety checking for Rego assignments (:=)
• A cgo-free, faster WebAssembly runtime (wazero replaces wasmtime-go)
• Startup warnings for unknown configuration options
• A new strings.split_n built-in function
• A REPL line reader that handles pasted input correctly, migrating existing history files

Fix SQL injection vector in Compile API: Quote SQL filter field identifiers (#8945)

The field names in the SQL emitted by the Compile API come from partially evaluated refs, so a policy that selects a dynamic key — such as input.fruits[input.column] — puts caller-controlled text in an identifier position. That text was emitted verbatim, which turns

WHERE fruit.name = 'allowed'

into

WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed'

and an application appending the filter to its query returns rows the policy denies.

... (truncated)

Commits

• 54896f9 Release v1.19.1
• 49ee09e build(go): bump to 1.26.6
• 1e32c79 Prepare v1.19.0 release (#8955)
• db035b0 Add support for Go 1.27 & jsonv2 (#8947)
• 27fe5ce ast: Fix leaky future.keywords.not import in Rego v0 (#8953)
• ab21870 format: Keep rule body inline when the head spans multiple lines (#8904)
• 95090fa Add strings.split_n built-in function (#8915)
• 12a86ed build(deps): bump find-my-way and prisma in /e2e/api/compile/prisma
• 18815e2 build(deps): bump the dependencies group across 2 directories with 5 updates
• f1e2ac0 build(deps): bump postcss from 8.5.15 to 8.5.23 in /docs
• Additional commits viewable in compare view

[clawgenti]

Dependency Update Analysis

Package: github.com/open-policy-agent/opa (1.18.2 -> 1.19.0)
Ecosystem: pip | Age: 16 days (SLA: 14 days)
CI Status: unknown

Changelog Summary

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.19.0

This release contains a mix of new features and bug fixes. Notably:

• A fixed SQL injection vector in the Compile API
• Stricter safety checking for Rego assignments (:=)
• A cgo-free, faster WebAssembly runtime (wazero replaces wasmtime-go)
• Startup warnings for unknown configuration options
• A new strings.split_n built-in function
• A REPL line reader that handles pasted input correctly, migrating existing history files

Fix SQL injection vector in Compile API: Quote SQL filter field identifiers (#8945)

The field names in the SQL emitted by the Compile API come from partially evaluated refs, so a policy that selects a dynamic key — such as input.fruits[input.column] — puts caller-controlled text in an identifier position. That text was emitted verbatim, which turns

WHERE fruit.name = 'allowed'

into

WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed'

and an application appending the filter to its query returns rows the policy denies.

Field segments that are not bare identifiers are now quoted at the UCA...

Risk Assessment

• Breaking changes: None detected
• Recommendation: Safe to merge (minor/patch, CI unknown, no breaking changes detected)

---

Automated analysis by Rossoctl Dep Bump Fixer (scan 2026-08-20-002)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[huang195]

Routine minor bump, opa 1.18.2 → 1.19.1 across authlib, abctl, envoy, proxy. CI green.

Shares go.sum with #704, #734, and #771, so expect a Dependabot rebase depending on merge order.

Assisted-By: Claude Code