chore(deps): bump github.com/open-policy-agent/opa from 1.19.0 to 1.19.1 in the go-dependencies group

[dependabot]

Bumps the go-dependencies group with 1 update: github.com/open-policy-agent/opa.

Updates github.com/open-policy-agent/opa from 1.19.0 to 1.19.1

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.19.1

This release uses the latest version of Go (1.26.6) to build OPA, fixing stdlib vulnerabilities in code that OPA's HTTP handler and crypto builtins use:

• https://pkg.go.dev/vuln/GO-2026-6218
• https://pkg.go.dev/vuln/GO-2026-6091
• https://pkg.go.dev/vuln/GO-2026-6090
• https://pkg.go.dev/vuln/GO-2026-6089
• https://pkg.go.dev/vuln/GO-2026-6088
• https://pkg.go.dev/vuln/GO-2026-5972
• https://pkg.go.dev/vuln/GO-2026-5026

It is otherwise the same code as v1.19.0.

Note that users building their own OPA binaries and images already control the Golang version, so this is not relevant for them.

Miscellaneous

• build(go): bump to 1.26.6 (authored by @​srenatus)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.19.1

This release uses the latest version of Go (1.26.6) to build OPA, fixing stdlib vulnerabilities in code that OPA's HTTP handler and crypto builtins use:

• https://pkg.go.dev/vuln/GO-2026-6218
• https://pkg.go.dev/vuln/GO-2026-6091
• https://pkg.go.dev/vuln/GO-2026-6090
• https://pkg.go.dev/vuln/GO-2026-6089
• https://pkg.go.dev/vuln/GO-2026-6088
• https://pkg.go.dev/vuln/GO-2026-5972
• https://pkg.go.dev/vuln/GO-2026-5026

It is otherwise the same code as v1.19.0.

Note that users building their own OPA binaries and images already control the Golang version, so this is not relevant for them.

Miscellaneous

• build(go): bump to 1.26.6 (authored by @​srenatus)

Commits

• 54896f9 Release v1.19.1
• 49ee09e build(go): bump to 1.26.6
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

Claude finished @dependabot[bot]'s task in 1m 7s —— View job

---

Dependency bump review: OPA 1.19.0 → 1.19.1

• Identify changed dependencies
• Check release notes / semver for breaking changes
• Find OPA usage in this repo
• Assess risk and flag follow-ups

---

Verdict: safe to merge — no code impact

What changed: exactly one direct dependency, github.com/open-policy-agent/opa 1.19.0 → 1.19.1 (go.mod:35). No transitive changes.

A useful signal in the go.sum diff: only the zip hash changed —

-github.com/open-policy-agent/opa v1.19.0/go.mod h1:pb6Y6klyf7X7X8uXNDflruA9dQC2gMqWROXI5w/kvv0=
+github.com/open-policy-agent/opa v1.19.1/go.mod h1:pb6Y6klyf7X7X8uXNDflruA9dQC2gMqWROXI5w/kvv0=

…the /go.mod hash is byte-identical, so OPA's own dependency graph is unchanged. That matches the upstream note: "otherwise the same code as v1.19.0" — the only commit is build(go): bump to 1.26.6.

Usage in this repo

OPA is imported in three places, all via the v1 API surface:

File	Imports
internal/evaluate/rego.go:7-9	v1/ast, v1/rego, v1/storage/inmem
internal/evaluate/opa_contract_test.go:12-13	v1/ast, v1/version
cmd/kosli/evaluateInput_test.go:12-13	v1/ast, v1/version

None of these are affected by a Go-toolchain-only release. version.Version is only interpolated into test failure messages (opa_contract_test.go:478, evaluateInput_test.go:241), never asserted on, so nothing needs updating for the new version string.

One thing worth being explicit about

This bump does not deliver the CVE fixes. The seven GO-2026-* advisories in the release notes are fixed by building OPA's own distributed binaries with Go 1.26.6 — upstream says as much: "users building their own OPA binaries and images already control the Golang version, so this is not relevant for them." We consume OPA as a library, so our stdlib comes from our toolchain, not theirs.

The good news is we're already covered there independently of this PR:

• .go-version → 1.26 (setup-go resolves to latest 1.26.x)
• go.mod:3 → go 1.26.6
• Dockerfile:3 → ARG GO_VERSION="1.26"

So no security action is needed — but if anyone reads this PR as "the OPA CVEs are now patched," that inference is wrong. The stdlib patch level is what matters, and it's governed by .go-version / go.mod.

Contrast with the last OPA bump

Worth noting for reviewer confidence: the 1.18.2 → 1.19.0 bump (#1071) was risky — stricter := RHS safety checking silently invalidated a class of working customer policies. That's why internal/evaluate/opa_contract_test.go exists. This bump is the opposite case: a patch release with zero Rego-semantics surface area.

Suggested check before merge

CI should be green as-is; I wasn't able to run the build or test suite in this environment (go isn't in the allowed tool list here), so this review is static. The suite that matters is the contract pack, which is exactly the canary for this class of change:

make test_integration_single TARGET=TestOPAContract

If those pass, there is nothing else to look at in this PR.

--- · dependabot/go_modules/go-dependencies-020220aaf2