[dependabot]

Bumps the go-dependencies group with 1 update: github.com/open-policy-agent/opa.

Updates github.com/open-policy-agent/opa from 1.21.3 to 1.21.4

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.21.4

This release builds the OPA binary artifacts with the latest version of Go (v1.27.3).

See: https://groups.google.com/g/golang-announce/c/66pojueaQek

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.21.4

This release builds the OPA binary artifacts with the latest version of Go (v1.27.3).

See: https://groups.google.com/g/golang-announce/c/66pojueaQek

Commits

• 05c8451 Release 1.21.4
• bbfea76 build: bump go (1.27.2 -> 1.27.3) (#9421)
• ba9214e changelog: link the bundle signature verification advisory (#9405)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

Claude finished @dependabot[bot]'s task in 36s —— View job

---

Dependency review: github.com/open-policy-agent/opa 1.21.3 → 1.21.4

Verdict: low risk, fine to merge once CI is green.

What changed

• Only github.com/open-policy-agent/opa moved, a patch bump. go.mod changed by one line and go.sum by two hashes. No transitive dependencies moved and the go directive is the same.
• Upstream, 1.21.4 only rebuilds OPA's binary artifacts with Go 1.27.3 for a Go security release. The other commit in the range is a changelog link. Neither touches the Go library API this repo imports. The go.mod hash is the same across both versions, which confirms the module's dependency set is unchanged.

How this repo uses OPA

• internal/evaluate/rego.go uses opa/v1/ast, opa/v1/rego and opa/v1/storage/inmem.
• Tests: internal/evaluate/opa_contract_test.go and cmd/kosli/evaluateInput_test.go use ast and version. They only use version.Version in failure messages. Nothing asserts on the version string, so the bump won't break them.

Risks and follow-ups

• No API, default or behaviour changes are expected for kosli evaluate. The OPA contract tests (opa_contract_test.go) will catch any Rego parse or compile drift.
• Bumping this library does not carry the Go toolchain security fix into the kosli binary. Kosli builds with its own toolchain (go 1.26.10, .go-version, golang:1.26.10-alpine in the Dockerfile). If the linked Go advisory affects the 1.26 line, that needs a separate Go patch bump. I haven't checked whether 1.26.10 already includes the fix.