Releases: dexidp/dex
Releases · dexidp/dex
v2.43.1
v2.43.1
This tag was signed with the committer’s verified signature.
What's Changed
Dependency Updates ⬆️
- Backport #4146 to 2.43.x by @sagikazarmark in #4148
Full Changelog: v2.43.0...v2.43.1
Contributors
sagikazarmark
Assets 2
v2.43.0
v2.43.0
This tag was signed with the committer’s verified signature.
What's Changed
Enhancements 🚀
- Generate access tokens for implicit & hybrid flows only when needed by @mfila in #3857
- k8s storage: Request only one object to check if API exists by @nabokihms in #4027
- refactor: simplify tests by using slog.DiscardHandler by @alexandear in #4058
Bug Fixes 🐛
- Fix Makefile to Support Spaces in Paths by @EthanDieterich in #4000
- fix: remove version controlled files from dockerignore by @sagikazarmark in #4087
- fix Incorrect Group Handling in RequestContextHandler logger.go by @alihasan070707 in #4082
Dependency Updates ⬆️
- build(deps): bump actions/cache from 4.2.0 to 4.2.1 by @dependabot in #3998
- build(deps): bump docker/build-push-action from 6.13.0 to 6.14.0 by @dependabot in #3997
- build(deps): bump github.com/dexidp/dex/api/v2 from 2.2.0 to 2.3.0 in /examples by @dependabot in #3996
- build(deps): bump github.com/prometheus/client_golang from 1.20.5 to 1.21.0 by @dependabot in #3995
- build(deps): bump google.golang.org/api from 0.221.0 to 0.222.0 by @dependabot in #3994
- build(deps): bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 in the go_modules group by @dependabot in #4008
- build(deps): bump github.com/go-jose/go-jose/v4 from 4.0.2 to 4.0.5 in /examples in the go_modules group by @dependabot in #4007
- build(deps): bump golang from 1.24.0-alpine3.20 to 1.24.1-alpine3.20 by @dependabot in #4021
- build(deps): bump sigstore/cosign-installer from 3.8.0 to 3.8.1 by @dependabot in #4001
- build(deps): bump github/codeql-action from 3.28.9 to 3.28.11 by @dependabot in #4038
- build(deps): bump golang.org/x/net from 0.35.0 to 0.36.0 in the go_modules group by @dependabot in #4043
- build(deps): bump distroless/static-debian12 from
6ec5aa9tob35229aby @dependabot in #4052 - build(deps): bump google.golang.org/api from 0.222.0 to 0.228.0 by @dependabot in #4059
- build(deps): bump distroless/static-debian12 from
b35229atoc0f429eby @dependabot in #4062 - build(deps): bump golang.org/x/net from 0.36.0 to 0.38.0 by @dependabot in #4060
- build(deps): bump actions/upload-artifact from 4.6.0 to 4.6.2 by @dependabot in #4053
- build(deps): bump docker/build-push-action from 6.14.0 to 6.15.0 by @dependabot in #4039
- build(deps): bump google.golang.org/grpc from 1.70.0 to 1.71.1 by @dependabot in #4064
- build(deps): bump docker/setup-qemu-action from 3.4.0 to 3.6.0 by @dependabot in #4031
- build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.1 by @dependabot in #4005
- build(deps): bump docker/setup-buildx-action from 3.9.0 to 3.10.0 by @dependabot in #4014
- build(deps): bump github.com/prometheus/client_golang from 1.21.0 to 1.22.0 by @dependabot in #4083
- build(deps): bump github.com/go-sql-driver/mysql from 1.9.0 to 1.9.2 by @dependabot in #4080
- build(deps): bump golang from 1.24.1-alpine3.20 to 1.24.2-alpine3.20 by @dependabot in #4079
- build(deps): bump go.etcd.io/etcd/client/v3 from 3.5.18 to 3.5.21 by @dependabot in #4074
- build(deps): bump actions/cache from 4.2.1 to 4.2.3 by @dependabot in #4072
- build(deps): bump actions/attest-build-provenance from 2.2.0 to 2.2.3 by @dependabot in #4071
- build(deps): bump docker/login-action from 3.3.0 to 3.4.0 by @dependabot in #4070
- build(deps): bump actions/setup-go from 5.3.0 to 5.4.0 by @dependabot in #4069
- build(deps): bump docker/metadata-action from 5.6.1 to 5.7.0 by @dependabot in #4068
- build(deps): bump github.com/russellhaering/goxmldsig from 1.4.0 to 1.5.0 by @dependabot in #4073
- build(deps): bump github.com/beevik/etree from 1.5.0 to 1.5.1 by @dependabot in #4096
- build(deps): bump golang.org/x/oauth2 from 0.28.0 to 0.29.0 by @dependabot in #4095
- build(deps): bump github.com/go-ldap/ldap/v3 from 3.4.10 to 3.4.11 by @dependabot in #4093
- build(deps): bump actions/dependency-review-action from 4.5.0 to 4.6.0 by @dependabot in #4092
- build(deps): bump github/codeql-action from 3.28.11 to 3.28.15 by @dependabot in #4091
- build(deps): bump aquasecurity/trivy-action from 0.29.0 to 0.30.0 by @dependabot in #4090
- build(deps): bump golang.org/x/net from 0.38.0 to 0.39.0 by @dependabot in #4094
- build(deps): bump github/codeql-action from 3.28.15 to 3.28.17 by @dependabot in #4116
- build(deps): bump google.golang.org/api from 0.228.0 to 0.231.0 by @dependabot in #4114
- build(deps): bump actions/attest-build-provenance from 2.2.3 to 2.3.0 by @dependabot in #4111
- build(deps): bump anchore/sbom-action from 0.18.0 to 0.19.0 by @dependabot in #4109
- build(deps): bump docker/build-push-action from 6.15.0 to 6.16.0 by @dependabot in #4108
- build(deps): bump github.com/fsnotify/fsnotify from 1.8.0 to 1.9.0 by @dependabot in #4101
- build(deps): bump sigstore/cosign-installer from 3.8.1 to 3.8.2 by @dependabot in #4105
- build(deps): bump github.com/coreos/go-oidc/v3 from 3.12.0 to 3.14.1 by @dependabot in #4099
- build(deps): bump github.com/go-jose/go-jose/v4 from 4.0.5 to 4.1.0 by @dependabot in #4100
- build(deps): bump google.golang.org/protobuf from 1.36.5 to 1.36.6 in /api/v2 by @dependabot in #4057
- build(deps): bump golang from 1.24.2-alpine3.20 to 1.24.3-alpine3.20 by @dependabot in #4124
- build(deps): bump golang.org/x/oauth2 from 0.29.0 to 0.30.0 by @dependabot in #4122
- build(deps): bump oras-project/setup-oras from 1.2.2 to 1.2.3 by @dependabot in #4119
- build(deps): bump google.golang.org/api from 0.231.0 to 0.232.0 by @dependabot in #4120
- build(deps): bump github.com/mattn/go-sqlite3 from 1.14.24 to 1.14.28 by @dependabot in #4123
- build(deps): bump golang.org/x/net from 0.39.0 to 0.40.0 by @dependabot in #4121
- build(deps): bump actions/dependency-review-action from 4.6.0 to 4.7.0 by @dependabot in #4127
- build(deps): bump actions/setup-go from 5.4.0 to 5.5.0 by @dependabot in #4126
- build(deps): bump anchore/sbom-action from 0.19.0 to 0.20.0 by @dependabot in #4132
- build(deps): bump google.golang.org/grpc from 1.72.0 to 1.72.1 by @dependabot in #4131
- build(deps): bump cloud.google.com/go/compute/metadata from 0.6.0 to 0.7.0 by @dependabot in #4130
- build(deps): bump actions/dependency-review-action from 4.7.0 to 4.7.1 by @dependabot in #4128
- build(deps): bump google.golang.org/api from 0.232.0 to 0.233.0 by @dependabot in #4129
- build(deps): bump distroless/static-debian12 from
c0f429eto188ddfbby @dependabot in #4140 - build(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by @dependabot in #4139
- build(deps): bump docker/build-push-action from 6.16.0 to 6.17.0 by @dependabot in #4135
- build(deps): bump go.etcd.io/etcd/client/v3 from 3.5.21 to 3.6.0 by @dependabot in #4136
- chore: update dependencies by @sagikazarmark in #4141
New Contributors
- @mfila made their first contribution in #3857
- @EthanDieterich made their first contribution in #4000
- @alexandear made their first contribution in #4058
- @shurup made their first contribution in #4097
- @alihasan070707 made their first contribution in #4082
Full Changelog: v2.42.0...v2.43.0
Contributors
mfila, sagikazarmark, and 6 other contributors
Assets 2
v2.42.1
v2.42.1
This tag was signed with the committer’s verified signature.
What's Changed
Bug Fixes 🐛
- fix: remove version controlled files from dockerignore by @sagikazarmark in #4089
Full Changelog: v2.42.0...v2.42.1
Contributors
sagikazarmark
Assets 2
v2.42.0
v2.42.0
This tag was signed with the committer’s verified signature.
7d1a747
This commit was signed with the committer’s verified signature.
What's Changed
Exciting New Features 🎉
Enhancements 🚀
- Added Discovery to grpc by @koendelaat in #3598
- feat(metrics): add response_size, request_duration histograms by @IvoGoman in #3748
- Handle root path better (than nothing) by @nabokihms in #3747
- Support base64 encoded and PEM encoded certs by @nabokihms in #3751
- GitLab connector: add GitLab additional group with role by @zvlb in #2941
- OIDC Connector: Support for IssuerAlias and group claims with maps instead of strings by @meldsza in #3676
- Add CSS for example app to make it prettier by @nabokihms in #3886
- feat: set resource revision for connectors by @nrwiersma in #3868
- Add authproxy preferred_username header by @kotx in #3950
- Passing context storage by @bobmaertz in #3941
Bug Fixes 🐛
- Fix scheme for DialURL ldap connection by @nabokihms in #3677
- Change workdir for gomplate by @nabokihms in #3684
- fix unmarshaling of expanded environment variables with special characters by @tuminoid in #3770
- saml connector: fix nil pointer PANIC on validate saml by @siarhei-haurylau in #3793
- fix: update enhancement proposal link by @emmanuel-ferdman in #3755
- Create offline sessions if approval is skipped by @nabokihms in #3828
Dependency Updates ⬆️
- build(deps): bump golang from 1.22.5-alpine3.20 to 1.23.1-alpine3.20 by @dependabot in #3728
- build(deps): bump alpine from 3.20.2 to 3.20.3 by @dependabot in #3729
- build(deps): bump golang.org/x/net from 0.27.0 to 0.29.0 by @dependabot in #3726
- build(deps): bump golang.org/x/oauth2 from 0.21.0 to 0.23.0 in /examples by @dependabot in #3722
- build(deps): bump actions/attest-build-provenance from 1.4.0 to 1.4.3 by @dependabot in #3727
- build(deps): bump google.golang.org/grpc from 1.65.0 to 1.66.1 in /examples by @dependabot in #3731
- build(deps): bump distroless/static-debian12 from
8dd8d3cto42d15c6by @dependabot in #3724 - build(deps): bump tonistiigi/xx from 1.4.0 to 1.5.0 by @dependabot in #3705
- build(deps): bump google.golang.org/api from 0.190.0 to 0.196.0 by @dependabot in #3721
- build(deps): bump docker/build-push-action from 6.5.0 to 6.7.0 by @dependabot in #3696
- build(deps): bump golang.org/x/oauth2 from 0.21.0 to 0.23.0 by @dependabot in #3723
- build(deps): bump sigstore/cosign-installer from 3.5.0 to 3.6.0 by @dependabot in #3685
- build(deps): bump actions/upload-artifact from 4.3.4 to 4.4.0 by @dependabot in #3720
- build(deps): bump github.com/dexidp/dex/api/v2 from 2.1.0 to 2.2.0 in /examples by @dependabot in #3734
- build(deps): bump mheap/github-action-required-labels from 5.4.1 to 5.4.2 by @dependabot i 8000 n #3735
- build(deps): bump github.com/mattn/go-sqlite3 from 1.14.22 to 1.14.23 by @dependabot in #3738
- build(deps): bump google.golang.org/grpc from 1.66.0 to 1.66.2 by @dependabot in #3742
- build(deps): bump distroless/static-debian12 from
42d15c6todcd3f1fby @dependabot in #3754 - build(deps): bump anchore/sbom-action from 0.17.0 to 0.17.2 by @dependabot in #3746
- build(deps): bump github.com/Masterminds/sprig/v3 from 3.2.3 to 3.3.0 by @dependabot in #3753
- build(deps): bump aquasecurity/trivy-action from 0.24.0 to 0.28.0 by @dependabot in #3797
- build(deps): bump github/codeql-action from 3.25.15 to 3.26.13 by @dependabot in #3795
- build(deps): bump golang from 1.23.1-alpine3.20 to 1.23.2-alpine3.20 by @dependabot in #3775
- build(deps): bump distroless/static-debian12 from
dcd3f1fto26f9b99by @dependabot in #3766 - build(deps): bump cloud.google.com/go/compute/metadata from 0.5.0 to 0.5.2 by @dependabot in #3764
- build(deps): bump docker/setup-buildx-action from 3.6.1 to 3.7.1 by @dependabot in #3781
- build(deps): bump google.golang.org/grpc from 1.66.1 to 1.67.1 in /examples by @dependabot in #3774
- build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0 by @dependabot in #3772
- build(deps): bump anchore/sbom-action from 0.17.2 to 0.17.4 by @dependabot in #3801
- build(deps): bump github.com/prometheus/client_golang from 1.19.1 to 1.20.5 by @dependabot in #3799
- build(deps): bump golang.org/x/net from 0.29.0 to 0.30.0 by @dependabot in #3802
- build(deps): bump actions/dependency-review-action from 4.3.4 to 4.3.5 by @dependabot in #3804
- build(deps): bump anchore/sbom-action from 0.17.4 to 0.17.5 by @dependabot in #3803
- build(deps): bump sigstore/cosign-installer from 3.6.0 to 3.7.0 by @dependabot in #3800
- build(deps): bump github.com/mattn/go-sqlite3 from 1.14.23 to 1.14.24 by @dependabot in #3805
- build(deps): bump github/codeql-action from 3.26.13 to 3.27.0 by @dependabot in #3806
- build(deps): bump actions/checkout from 4.1.7 to 4.2.1 by @dependabot in #3785
- build(deps): bump google.golang.org/api from 0.196.0 to 0.203.0 by @dependabot in #3807
- build(deps): bump actions/checkout from 4.2.1 to 4.2.2 by @dependabot in #3808
- build(deps): bump actions/dependency-review-action from 4.3.5 to 4.4.0 by @dependabot in #3814
- build(deps): bump distroless/static-debian12 from
26f9b99to3a03fc0by @dependabot in #3812 - build(deps): bump actions/setup-go from 5.0.2 to 5.1.0 by @dependabot in #3809
- build(deps): bump anchore/sbom-action from 0.17.5 to 0.17.6 by @dependabot in #3817
- build(deps): bump github.com/fsnotify/fsnotify from 1.7.0 to 1.8.0 by @dependabot in #3822
- build(deps): bump alpine from
beefdbdto1e42bbeby @dependabot in #3840 - build(deps): bump golang.org/x/oauth2 from 0.23.0 to 0.24.0 in /examples by @dependabot in #3832
- build(deps): bump golang from 1.23.2-alpine3.20 to 1.23.3-alpine3.20 by @dependabot in #3834
- build(deps): bump anchore/sbom-action from 0.17.6 to 0.17.8 by @dependabot in #3858
- build(deps): bump distroless/static-debian12 from
3a03fc0tod71f4b2by @dependabot in #3839 - build(deps): bump golang from
0974259toc694a4dby @dependabot in #3863 - build(deps): bump tonistiigi/xx from 1.5.0 to 1.6.1 by @dependabot in #3879
- build(deps): bump golang.org/x/crypto from 0.28.0 to 0.31.0 in the go_modules group by @dependabot in #3893
- build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0 in /examples in the go_modules group by @dependabot in #3892
- build(deps): bump github/codeql-action from 3.27.0 to 3.28.0 by @dependabot in #3898
- build(deps): bump actions/upload-artifact from 4.4.0 to 4.5.0 by @dependabot in #3890
- build(deps): bump actions/attest-build-provenance from 1.4.3 to 2.1.0 by @dependabot in #3878
- build(deps): bump golang from 1.23.3-alpine3.20 to 1.23.4-alpine3.20 by @dependabot in #3866
- build(deps): bump distroless/static-debian12 from
d71f4b2to6cd937eby @dependabot in #3864 - build(deps): bump actions/dependency-review-action from 4.4.0 to 4.5.0 by @dependabot in #3862
- build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1 by @dependabot in #3861
- build(deps): bump aquasecurity/trivy-action from 0.28.0 to 0.29.0 by @dependabot in #3851
- build(deps): bump gomplate from 4.0.1 to 4.3.0 by @MoeBensu in #3856
- build: update Go version by @sagikazarmark in #3913
- build(deps): bump githu...
Contributors
nrwiersma, tuminoid, and 15 other contributors
Assets 2
v2.2.0 Dex API release
v2.41.1
What's Changed
Bug Fixes 🐛
- Fix ldap connection error: network unreachable @nabokihms in #3677
- Fix gomplate fork/exec error for distroless images by @nabokihms in #3684
Full Changelog: v2.41.0...v2.41.1
Contributors
nabokihms
Assets 2
v2.41.0
What's Changed
Exciting New Features 🎉
- Enrich Dex logs with real IP and request ID by @nabokihms in #3661
- gRPC Connectors API by @twoojoo in #3245
Important
Connectors API is disabled by default. Set the DEX_API_CONNECTORS_CRUD=true env variable to enable the feature.
Enhancements 🚀
- Prevent double clicking of the submit button on login by @pcorliss in #3554
- Gracefully handle no args being passed to entrypoint by @rgmz in #3589
- New Prometheus metrics build_info by @nlamirault in #3558
- Always retrieve github emails when
preferredEmailDomainis set by @thesuperzapper in #3584 - Propagate http.Client to JWT verifier for OIDC connector by @jack-r-warren in #3641
- Fix the broken link to v2 page by @tuladhar in #3648
- Add regex for oidc group matching by @jacksonargo in #3063
Bug Fixes 🐛
- Remove additional features and add a feature flag instead by @nabokihms in #3663
Dependency Updates ⬆️
- build(deps): bump github.com/spf13/cobra from 1.8.0 to 1.8.1 in /examples by @dependabot in #3582
- build(deps): bump actions/attest-build-provenance from 1.1.2 to 1.3.1 by @dependabot< 6D40 /a> in #3580
- build(deps): bump github/codeql-action from 3.25.7 to 3.25.12 by @dependabot in #3619
- build(deps): bump actions/dependency-review-action from 4.3.2 to 4.3.4 by @dependabot in #3618
- build(deps): bump google.golang.org/grpc from 1.64.0 to 1.65.0 by @dependabot in #3617
- build(deps): bump aquasecurity/trivy-action from 0.21.0 to 0.24.0 by @dependabot in #3615
- build(deps): bump google.golang.org/grpc from 1.64.0 to 1.64.1 in /examples in the go_modules group by @dependabot in #3612
- build(deps): bump distroless/static-debian12 from
e9ac71eto8dd8d3cby @dependabot in #3604 - build(deps): bump docker/build-push-action from 5.3.0 to 6.3.0 by @dependabot in #3603
- build(deps): bump github.com/coreos/go-oidc/v3 from 3.10.0 to 3.11.0 in /examples by @dependabot in #3609
- build(deps): bump golang.org/x/net from 0.25.0 to 0.27.0 by @dependabot in #3606
- build(deps): bump golang.org/x/crypto from 0.23.0 to 0.25.0 by @dependabot in #3605
- build(deps): bump alpine from 3.20.0 to 3.20.1 by @dependabot in #3591
- build(deps): bump google.golang.org/grpc from 1.64.0 to 1.65.0 in /examples by @dependabot in #3600
- build(deps): bump golang.org/x/oauth2 from 0.20.0 to 0.21.0 by @dependabot in #3567
- build(deps): bump github.com/coreos/go-oidc/v3 from 3.10.0 to 3.11.0 by @dependabot in #3627
- build(deps): bump actions/checkout from 4.1.6 to 4.1.7 by @dependabot in #3621
- build(deps): bump docker/setup-qemu-action from 3.0.0 to 3.1.0 by @dependabot in #3625
- build(deps): bump actions/attest-build-provenance from 1.3.1 to 1.3.3 by @dependabot in #3624
- build(deps): bump google.golang.org/protobuf from 1.34.1 to 1.34.2 by @dependabot in #3631
- build(deps): bump anchore/sbom-action from 0.16.0 to 0.17.0 by @dependabot in #3630
- build(deps): bump github.com/go-jose/go-jose/v4 from 4.0.2 to 4.0.3 by @dependabot in #3626
- build(deps): bump actions/setup-go from 5.0.1 to 5.0.2 by @dependabot in #3622
- build(deps): bump docker/build-push-action from 6.3.0 to 6.4.0 by @dependabot in #3623
- build(deps): bump docker/setup-buildx-action from 3.3.0 to 3.4.0 by @dependabot in #3629
- build(deps): bump github.com/AppsFlyer/go-sundheit from 0.5.0 to 0.5.1 by @dependabot in #3635
- build(deps): bump docker/build-push-action from 6.4.0 to 6.4.1 by @dependabot in #3633
- build(deps): bump github.com/spf13/cobra from 1.8.0 to 1.8.1 by @dependabot in #3634
- Update dependencies before Dex v2.41 by @nabokihms in #3637
- build(deps): bump alpine from 3.20.1 to 3.20.2 by @dependabot in #3647
- build(deps): bump google.golang.org/api from 0.182.0 to 0.189.0 by @dependabot in #3646
- build(deps): bump github/codeql-action from 3.25.12 to 3.25.14 by @dependabot in #3651
- build(deps): bump actions/upload-artifact from 3.1.3 to 4.3.4 by @dependabot in #3607
- build(deps): bump golang from
8c9183fto0d3653dby @dependabot in #3657 - FIx CVE before Dex v2.41 by @nabokihms in #3653
- Bump gomplate 4.0.1 by @MoeBensu in #3652
- build(deps): bump github.com/AppsFlyer/go-sundheit from 0.5.1 to 0.6.0 by @dependabot in #3655
- build(deps): bump docker/setup-buildx-action from 3.4.0 to 3.6.1 by @dependabot in #3658
- build(deps): bump go.etcd.io/etcd/client/v3 from 3.5.14 to 3.5.15 by @dependabot in #3639
- build(deps): bump docker/setup-qemu-action from 3.1.0 to 3.2.0 by @dependabot in #3645
- build(deps): bump ossf/scorecard-action from 2.3.3 to 2.4.0 by @dependabot in #3656
- build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0 by @dependabot in #3643
- build(deps): bump docker/login-action from 3.2.0 to 3.3.0 by @dependabot in #3644
- build(deps): bump github.com/go-jose/go-jose/v4 from 4.0.3 to 4.0.4 by @dependabot in #3666
- build(deps): bump google.golang.org/api from 0.189.0 to 0.190.0 by @dependabot in #3667
- build(deps): bump actions/attest-build-provenance from 1.3.3 to 1.4.0 by @dependabot in #3665
- Bump ent v0.14.0 by @nabokihms in #3670
- build(deps): bump github/codeql-action from 3.25.14 to 3.25.15 by @dependabot in #3664
New Contributors
- @pcorliss made their first contribution in #3554
- @rgmz made their first contribution in #3589
- @nlamirault made their first contribution in #3558
- @thesuperzapper made their first contribution in #3584
- @twoojoo made their first contribution in #3245
- @jack-r-warren made their first contribution in #3641
- @tuladhar made their first contribution in #3648
- @MoeBensu made their first contribution in #3652
- @jacksonargo made their first contribution in #3063
Full Changelog: v2.40.0...v2.41.0
Contributors
nlamirault, pcorliss, and 9 other contributors
Assets 2
v2.40.0
The official container image for this release can be pulled from
ghcr.io/dexidp/dex:v2.40.0
Know before update
Important
Dex migrated to the log/slog for logging. Both text and json log format outputs changed.
The change can affect users, that import Dex as a library in their projects.
What's Changed
Exciting New Features 🎉
- Add introspect endpoint to introspect access & refresh token by @supercairos in #3404
- Use log/slog for structured logging by @seankhliao in #3502
Enhancements 🚀
- Add support for configurable prompt type for Google connector by @abhisek in #3475
- Google: Implement groups fetch by default service account from metadata (support for GKE workload identity) by @vsychov in #2989
- OIDC connector option to override jwksURI by @sohgaura in #3543
- Allow domain names or IDs in keystone connector by @cardoe in #3506
Bug Fixes 🐛
- Fix function names in comment by @mountcount in #3464
- Fix slight grammar errors. by @adeinega in #3538
Dependency Updates ⬆️
- build(deps): bump google.golang.org/api from 0.172.0 to 0.179.0 by @dependabot in #3516
- build(deps): bump golang from 1.22.2-alpine3.18 to 1.22.3-alpine3.18 by @dependabot in #3514
- build(deps): bump aquasecurity/trivy-action from 0.18.0 to 0.20.0 by @dependabot in #3512
- build(deps): bump golang.org/x/oauth2 from 0.19.0 to 0.20.0 in /examples by @dependabot in #3508
- build(deps): bump ancho F438 re/sbom-action from 0.15.9 to 0.15.11 by @dependabot in #3497
- build(deps): bump golang.org/x/net from 0.20.0 to 0.23.0 in /api/v2 in the go_modules group by @dependabot in #3483
- build(deps): bump sigstore/cosign-installer from 3.4.0 to 3.5.0 by @dependabot in #3472
- build(deps): bump distroless/static-debian12 from
42c8865toe9ac71eby @dependabot in #3469 - build(deps): bump docker/setup-buildx-action from 3.2.0 to 3.3.0 by @dependabot in #3462
- build(deps): bump google.golang.org/protobuf from 1.33.0 to 1.34.1 in /api/v2 by @dependabot in #3510
- build(deps): bump github.com/prometheus/client_golang from 1.19.0 to 1.19.1 by @dependabot in #3526
- build(deps): bump google.golang.org/api from 0.179.0 to 0.180.0 by @dependabot in #3525
- build(deps): bump actions/dependency-review-action from 4.2.5 to 4.3.2 by @dependabot in #3524
- build(deps): bump helm/kind-action from 1.9.0 to 1.10.0 by @dependabot in #3523
- build(deps): bump github/codeql-action from 3.24.10 to 3.25.4 by @dependabot in #3522
- build(deps): bump mheap/github-action-required-labels from 5.4.0 to 5.4.1 by @dependabot in #3521
- build(deps): bump actions/setup-go from 5.0.0 to 5.0.1 by @dependabot in #3520
- build(deps): bump google.golang.org/grpc from 1.62.1 to 1.63.2 in /api/v2 by @dependabot in #3465
- build(deps): bump google.golang.org/grpc from 1.62.1 to 1.63.2 in /examples by @dependabot in #3460
- build(deps): bump alpine from 3.19.1 to 3.20.0 by @dependabot in #3547
- build(deps): bump anchore/sbom-action from 0.15.11 to 0.16.0 by @dependabot in #3545
- build(deps): bump github/codeql-action from 3.25.4 to 3.25.6 by @dependabot in #3544
- build(deps): bump actions/checkout from 4.1.2 to 4.1.6 by @dependabot in #3542
- build(deps): bump google.golang.org/api from 0.180.0 to 0.181.0 by @dependabot in #3541
- build(deps): bump golang from
4531927toff6ab2bby @dependabot in #3536 - build(deps): bump ossf/scorecard-action from 2.3.1 to 2.3.3 by @dependabot in #3534
- build(deps): bump github.com/go-jose/go-jose/v4 from 4.0.1 to 4.0.2 by @dependabot in #3531
- build(deps): bump github.com/beevik/etree from 1.3.0 to 1.4.0 by @dependabot in #3530
- build(deps): bump google.golang.org/grpc from 1.63.2 to 1.64.0 in /examples by @dependabot in #3535
- build(deps): bump docker/login-action from 3.1.0 to 3.2.0 by @dependabot in #3551
- build(deps): bump golang from
ff6ab2btod1a601bby @dependabot in #3550 - build(deps): bump aquasecurity/trivy-action from 0.20.0 to 0.21.0 by @dependabot in #3552
- Bump google.golang.org/grpc to v1.64.0 by @nabokihms in #3553
- build(deps): bump go.etcd.io/etcd/client/pkg/v3 from 3.5.13 to 3.5.14 by @dependabot in #3555
- build(deps): bump go.etcd.io/etcd/client/v3 from 3.5.13 to 3.5.14 by @dependabot in #3556
- build(deps): bump github/codeql-action from 3.25.6 to 3.25.7 by @dependabot in #3561
- Bump gomplate 3.11.8 by @nabokihms in #3565
New Contributors
- @elehcim made their first contribution in #3474
- @abhisek made their first contribution in #3475
- @mountcount made their first contribution in #3464
- @adeinega made their first contribution in #3538
- @sohgaura made their first contribution in #3543
- @cardoe made their first contribution in #3506
Full Changelog: v2.39.1...v2.40.0
Contributors
cardoe, abhisek, and 9 other contributors
Assets 2
v2.39.1
The official container image for this release can be pulled from
ghcr.io/dexidp/dex:v2.39.1
Bug Fixes 🐛
-
Update max length of Kubernetes object to fit Kubernetes policy by @RomanenkoDenys in #3439 (fix regression for Kubernetes storage)
-
Do not escape password for LDAP connectors by @nabokihms in #3470 (changes introduced in v2.39.0 were reverted)
Contributors
nabokihms and RomanenkoDenys
Assets 2
v2.39.0
The official container image for this release can be pulled from
ghcr.io/dexidp/dex:v2.39.0
Know before update
Warning
The validation of username and password in the LDAP connector is much more strict now.
As of today, Dex uses the EscapeFilter function to check for special characters in credentials and prevent injections by denying such requests.
the special characters in the set
()*\and those out of the range 0 < c < 0x80, as defined in RFC4515
What's Changed
Enhancements 🚀
- Also set the username in authproxy connector by @ppacher in #3307
- Log failed login attempt by @i-amelia in #2454
- Update ent by @sagikazarmark in #3379
- Add sanitizer to LDAP account and password by @hsinhoyeh in #3372
- Add headers control to Dex web server by @nabokihms in #3339
- OIDC connector: Allow specifying empty prompt type by @nabokihms in #3373
- Set read-only permissions to the check job by @nabokihms in #3415
Bug Fixes 🐛
- Use the correct token type for userInfo requests while Token Exchange by @MrDeerly in #3336
- Do not evaluate skipApproval on the approval page by @MM53 in #3086
Dependency Updates ⬆️
- build(deps): bump anchore/sbom-action from 0.15.5 to 0.15.6 by @dependabot in #3314
- build(deps): bump github.com/mattn/go-sqlite3 from 1.14.19 to 1.14.22 by @dependabot in #3328
- build(deps): bump github/codeql-action from 3.23.1 to 3.24.0 by @dependabot in #3327
- build(deps): bump anchore/sbom-action from 0.15.6 to 0.15.8 by @dependabot in #3325
- build(deps): bump go.etcd.io/etcd/client/pkg/v3 from 3.5.11 to 3.5.12 by @dependabot in #3323
- build(deps): bump google.golang.org/api from 0.157.0 to 0.161.0 by @dependabot in #3317
- build(deps): bump alpine from 3.19.0 to 3.19.1 by @dependabot in #3311
- build(deps): bump golang from
3bd4475to3354c3aby @dependabot in #3310 - build(deps): bump mheap/github-action-required-labels from 5.1.0 to 5.2.0 by @dependabot in #3308
- build(deps): bump sigstore/cosign-installer from 3.2.0 to 3.4.0 by @dependabot in #3324
- build(deps): bump go.etcd.io/etcd/client/v3 from 3.5.11 to 3.5.12 by @dependabot in #3321
- build(deps): bump golang.org/x/oauth2 from 0.16.0 to 0.17.0 in /examples by @dependabot in #3340
- build(deps): bump tonistiigi/xx from 1.3.0 to 1.4.0 by @dependabot in #3333
- build(deps): bump golang.org/x/oauth2 from 0.16.0 to 0.17.0 by @dependabot in #3341
- build(deps): bump google.golang.org/grpc from 1.61.0 to 1.61.1 in /examples by @dependabot in #3352
- build(deps): bump distroless/static from
9be3fcctoa43abc8by @dependabot in #3350 - build(deps): bump aquasecurity/trivy-action from 0.16.1 to 0.17.0 by @dependabot in #3332
- build(deps): bump docker/metadata-action from 5.5.0 to 5.5.1 by @dependabot in #3330
- build(deps): bump mheap/github-action-required-labels from 5.2.0 to 5.3.0 by @dependabot in #3347
- build(deps): bump helm/kind-action from 1.8.0 to 1.9.0 by @dependabot in #3345
- build(deps): bump github/codeql-action from 3.24.0 to 3.24.3 by @dependabot in #3360
- build(deps): bump google.golang.org/api from 0.161.0 to 0.165.0 by @dependabot in #3355
- build(deps): bump actions/dependency-review-action from 4.0.0 to 4.1.0 by @dependabot in #3359
- build(deps): bump golang.org/x/crypto from 0.19.0 to 0.20.0 by @dependabot in #3377
- build(deps): bump google.golang.org/api from 0.165.0 to 0.167.0 by @dependabot in #3376
- build(deps): bump github/codeql-action from 3.24.3 to 3.24.5 by @dependabot in #3375
- build(deps): bump distroless/static from
a43abc8to072d78bby @dependabot in #3374 - build(deps): bump google.golang.org/grpc from 1.61.1 to 1.62.0 in /examples by @dependabot in #3368
- build(deps): bump actions/dependency-review-action from 4.1.0 to 4.1.3 by @dependabot in #3363
- build(deps): bump haya14busa/action-cond from 1.1.1 to 1.2.1 by @dependabot in #3346
- build(deps): bump golang from 1.21.6-alpine3.18 to 1.22.0-alpine3.18 by @dependabot in #3334
- build(deps): bump google.golang.org/grpc from 1.61.0 to 1.62.0 by @dependabot in #3367
- build(deps): bump google.golang.org/grpc from 1.61.0 to 1.62.0 in /api/v2 by @dependabot in #3365
- build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.1 to 3.0.3 by @dependabot in #3405
- build(deps): bump github.com/prometheus/client_golang from 1.18.0 to 1.19.0 by @dependabot in #3380
- build(deps): bump golang from 1.22.0-alpine3.18 to 1.22.1-alpine3.18 by @dependabot in #3398
- build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.1 to 3.0.3 in /examples by @dependabot in #3406
- build(deps): bump google.golang.org/api from 0.167.0 to 0.169.0 by @dependabot in #3407
- Update jose by @nabokihms in #3409
- build(deps): bump distroless/static from
072d78bto9235ad9by @dependabot in #3381 - build(deps): bump docker/setup-buildx-action from 3.0.0 to 3.1.0 by @dependabot in #3382
- build(deps): bump aquasecurity/trivy-action from 0.17.0 to 0.18.0 by @dependabot in #3384
- build(deps): bump github/codeql-action from 3.24.5 to 3.24.6 by @dependabot in #3386
- build(deps): bump anchore/sbom-action from 0.15.8 to 0.15.9 by @dependabot in #3397
- build(deps): bump golang.org/x/oauth2 from 0.17.0 to 0.18.0 by @dependabot in #3393
- build(deps): bump golang.org/x/oauth2 from 0.17.0 to 0.18.0 in /examples by @dependabot in #3394
- build(deps): bump google.golang.org/grpc from 1.62.0 to 1.62.1 in /examples by @dependabot in #3401
- build(deps): bump github.com/go-sql-driver/mysql from 1.7.1 to 1.8.0 by @dependabot in #3414
- build(deps): bump google.golang.org/protobuf from 1.32.0 to 1.33.0 by @dependabot in #3413
- build(deps): bump distroless/static from
9235ad9to7e5c6a2by @dependabot in #3410 - build(deps): bump docker/build-push-action from 5.1.0 to 5.2.0 by @dependabot in #3411
- build(deps): bump google.golang.org/grpc from 1.62.0 to 1.62.1 by @dependabot in #3412
- build(deps): bump github.com/stretchr/testify from 1.8.4 to 1.9.0 by @dependabot in #3389
- build(deps): bump actions/checkout from 4.1.1 to 4.1.2 by @dependabot in #3417
- build(deps): bump github/codeql-action from 3.24.6 to 3.24.8 by @dependabot in #3422
- build(deps): bump google.golang.org/api from 0.169.0 to 0.171.0 by @dependabot in #3426
- build(deps): bump docker/login-action from 3.0.0 to 3.1.0 by @dependabot in #3418
- build(deps): bump github.com/coreos/go-oidc/v3 from 3.9.0 to 3.10.0 in /examples by @dependabot in #3424
- build(deps): bump github.com/coreos/go-oidc/v3 from 3.9.0 to 3.10.0 by @dependabot in #3425
- build(deps): bump docker/build-push-action from 5.2.0 to 5.3.0 by @dependabot in #3420
- build(deps): bump golang from
010f3b3toede158fby @dependabot in #3421 - build(deps): bump google.golang.org/grpc from 1.62.0 to 1.62.1 in /api/v2 by @dependabot in #3399
- build(deps): bump google.golang.org/protobuf from 1.32.0 to 1.33.0 in /api/v2 by @dependabot in #3400
New Contributors
- @ppacher made their first contribution in #3307
- @MrDeerly made their first contribution in #3336
- @i-amelia made their first contribution in #2454
- @hsinhoyeh made their first contribution in #3372
Full Changelog: v2.38.0...v2.39.0
Contributors
ppacher, sagikazarmark, and 6 other contributors