Conftest v0.71.1 Release Notes: Dependency Updates for OPA and Buildkit

Introduction

Conftest, the tool for testing Terraform plans (and other structured configuration) against OPA/Rego policies, has released v0.71.1. This is the first version tracked on this site, so there is no prior baseline to diff against. The release notes for v0.71.1 are thin — they contain only two dependency bump entries, with no new Conftest features, flags, or CLI changes mentioned.

What Is New

According to the published changelog at the release page, this release contains exclusively dependency maintenance:

• OPA bumped from 1.21.0 to 1.21.1 — commit 00e9bc6, PR #1439 (dependabot). This updates the embedded github.com/open-policy-agent/opa library used to evaluate Rego policies inside Conftest.
• BuildKit bumped from 0.33.0 to 0.33.1 — commit 8f7ac01, PR #1440 (dependabot). BuildKit is a build-time dependency and does not affect Conftest's runtime policy-testing behavior for Terraform plans.

There are no documented new Conftest commands, output formats, parser changes, or breaking changes in this release. If you rely on a specific OPA 1.21.0 behavior, review the OPA 1.21.1 changelog directly, since Conftest's release notes do not enumerate the OPA-side changes.

Upgrade Steps

For teams running Conftest via a pinned binary version in CI, update the version reference:

# Linux/macOS via the official install script or direct download
CONFTEST_VERSION=0.71.1
curl -L -o conftest.tar.gz \
  "https://github.com/open-policy-agent/conftest/releases/download/v${CONFTEST_VERSION}/conftest_${CONFTEST_VERSION}_Linux_x86_64.tar.gz"
tar xzf conftest.tar.gz
sudo mv conftest /usr/local/bin

If Conftest is installed via go install:

go install github.com/open-policy-agent/conftest@v0.71.1

If Conftest is pulled as a container image in a terraform plan | conftest test - pipeline step, pin the tag explicitly:

docker pull openpolicyagent/conftest:v0.71.1

There are no Rego policy syntax changes or CLI flag changes in this release, so existing conftest test invocations against Terraform plan JSON remain unchanged, for example:

terraform show -json terraform.tfplan > plan.json
conftest test --policy policy/ plan.json

Verify

Confirm the installed version matches the release:

conftest --version

Expected output should report v0.71.1. Then re-run the existing policy suite against a known Terraform plan to confirm no regressions were introduced by the OPA 1.21.1 bump:

terraform plan -out=tfplan.binary
terraform show -json tfplan.binary > tfplan.json
conftest test --policy policy/ tfplan.json

If the test suite passes with the same results as before the upgrade, the dependency bumps had no observable effect on policy evaluation.

Conclusion

Conftest v0.71.1 is a maintenance release with only two dependabot-driven dependency bumps (OPA 1.21.1, BuildKit 0.33.1) and no feature or breaking changes documented in the release notes. Teams can upgrade with low risk, but should still re-run their policy test suites as a sanity check given the OPA engine version change. For any additional detail beyond what dependabot's commit messages state, consult the release page directly.