chore(deps): Update quay.io/oauth2-proxy/oauth2-proxy Docker tag to v7.15.6 #136

2026-11-07T08:18:57Z

renovate-bot commented

2026-11-07 08:18:57 +00:00

This PR contains the following updates:

Package	Update	Change
quay.io/oauth2-proxy/oauth2-proxy (source)	minor	`v7.8.1` → `v7.15.6`

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

oauth2-proxy/oauth2-proxy (quay.io/oauth2-proxy/oauth2-proxy)

`v7.15.6`

Compare Source

`v7.15.5`

Compare Source

#3587 fix: keep the query after the slash in the trailing slash redirect (@jayhemnani9910)
#3584 fix: read the Entra ID tenant from the tid claim so session validation works in national clouds such as Azure US Government (fixes #2939) (@asifsid / @dantreiman)
#3583 fix: return 403 instead of 500 when the ID token audience is invalid @marsluca
#3573 fix: return 403 instead of 500 when a user with an unverified email completes the OAuth2 callback (fixes #3234) @amichelic
#3540 fix: honor --oidc-groups-claim for tokens verified via --extra-jwt-issuers (@jaewak / @tuunit)
#3219 fix: escape OAuth state redirect URLs to preserve query parameters (@CallumWayve)

`v7.15.4`

Compare Source

#3546 fix: strip the port from the request host when matching cookie domains @kirilju
#3547 fix: refresh additional claims for OIDC and MS Entra ID providers and properly populate additional claims during login (@Apollo3zehn)
#3477 fix(bitbucket): auth failure due to Bitbucket OAuth 2.0 changes on May 4th 2026 @mfouad
#3535 fix: surface Microsoft Graph errors during Entra group overage instead of logging in with an incomplete group set @no-hup
#3527 fix(encryption): return an error instead of panicking on a short GCM ciphertext @winklemad

`v7.15.3`

Compare Source

#3493 chore(deps): update gomod @tuunit

`v7.15.2`

Compare Source

#3477 chore(dep): bump go to 1.26 and migrate of reverse proxy handling

`v7.15.1`

Compare Source

#3411 chore(deps): update gomod dependencies (@tuunit)
#3333 fix: invalidate session on fatal OAuth2 refresh errors (@frhack)
GHSA-f24x-5g9q-753f fix: clear session cookie at beginning of signinpage handler (@fnoehWM / @bella-WI / @tuunit)
GHSA-5hvv-m4w4-gf6v fix: health check user-agent authentication bypass (@tuunit)
GHSA-7x63-xv5r-3p2x fix: authentication bypass via X-Forwarded-Uri header spoofing (@tuunit)
GHSA-pxq7-h93f-9jrg fix: fragment evaluation as part of the allowed routes (@tuunit)
GHSA-c5c4-8r6x-56w3 fix: email validation bypass via malformed multi-@ email claims (@tuunit)

`v7.15.0`

Compare Source

#3382 chore(deps): update gomod and golangci/golangci-lint to v2.11.4 (@tuunit)
#3374 fix: handle Unix socket RemoteAddr in IP resolution (@H1net)
#3381 fix: do not log error for backend logout 204 (@artificiosus)
#3327 fix: improve logging when session refresh token is missing (@yosri-brh)
#2767 fix: propagate errors during route building (@sybereal)

`v7.14.3`

Compare Source

#3352 fix: backend logout URL call on sign out (#3172)(@vsejpal)
#3332 ci: distribute windows binary with .exe extension (@igitur)
#2685 feat: allow arbitrary claims from the IDToken and IdentityProvider UserInfo endpoint to be added to the session state (@vegetablest)
#3278 feat: possibility to inject id_token in redirect url during sign out (@albanf)
#2851 feat: add support for specifying allowed OIDC JWT signing algorithms (#2753) (@andoks / @tuunit)
#3369 fix: use CSRFExpire instead of Expire for CSRF cookie validation (@Br1an67)
#3365 fix: filter empty strings from allowed groups (@Br1an67)
#3338 feat: add --config-test flag for validating configuration (@MayorFaj)
#3347 feat: add same site option for csrf cookies (@jvnoije)
#3376 feat: allow setting unix socket file mode when declaring listener (@Tristan971 / @tuunit)

`v7.14.2`

Compare Source

#3183 fix: allow URL parameters to configure username, password and max idle connection timeout if the matching configuration is empty.

`v7.14.1`

Compare Source

#3314 revert: fix: skip provider button auth only redirect (#3309) (@StefanMarkmann / @tuunit)
#3315 docs: clarify browser vs API routes for nginx auth_request redirects (@StefanMarkmann)

`v7.14.0`

Compare Source

#3309 fix: Return 302 redirect from AuthOnly endpoint when skip-provider-button is true (@StefanMarkmann)
#3302 fix: static upstreams failing validation due to passHostHeader and proxyWebSockets defaults being set incorrectly (@sourava01 / @tuunit)
#3312 chore(deps): upgrade to go1.25.6 and latest dependencies (@tuunit)

`v7.13.0`

Compare Source

#2628 feat(structured config): revamp of yaml parsing using mapstructure decoder and custom decoders (@tuunit)
#3197 fix: NewRemoteKeySet is not using DefaultHTTPClient (@rsrdesarrollo / @tuunit)
#3292 chore(deps): upgrade gomod and bump to golang v1.25.5 (@tuunit)
#3304 fix: added conditional so default is not always set and env vars are honored fixes 3303 (@pixeldrew)
#3264 fix: more aggressively truncate logged access_token (@MartinNowak / @tuunit)
#3267 fix: Session refresh handling in OIDC provider (@gysel)
#3290 fix: WebSocket proxy to respect PassHostHeader setting (@UnsignedLong)

`v7.12.0`

Compare Source

#3228 fix: use GetSecret() in ticket.go makeCookie to respect cookie-secret-file (@stagswtf)
#3244 chore(deps): upgrade to latest go1.25.3 (@tuunit)
#3238 chore: Replace pkg/clock with narrowly targeted stub clocks (@dsymonds)
#3237 - feat: add option to use organization id for preferred username in Google Provider (@pixeldrew)
GHSA-vjrc-mh2v-45x6 fix: request header smuggling by stripping all normalized header variants (@tuunit)
#1933 fix: validation of refreshed sessions using the access_token in the OIDC provider (@gysel / @tuunit)
#2841 feat: add allowed_* constraint option to proxy endpoint query string (@jacobalberty)

`v7.11.0`

Compare Source

#2273 feat: add Cidaas provider (@Bibob7, @Teko012)
#3166 chore(dep): upgrade to latest golang 1.24.6 (@tuunit)
#3156 feat: allow disable-keep-alives configuration for upstream (@jet-go)
#3150 fix: Gitea team membership (@MagicRB, @tuunit)

`v7.10.0`

Compare Source

#2615 feat(cookies): add option to set a limit on the number of per-request CSRF cookies oauth2-proxy sets (@bh-tt)
#2605 fix: show login page on broken cookie (@Primexz)
#2743 feat: allow use more possible google admin-sdk api scopes (@BobDu)
#2359 feat: add SourceHut (sr.ht) provider(@bitfehler)
#2524 fix: regex substitution for $ signs in upstream path handling before running envsubst (@dashkan / @tuunit)
#3104 feat(cookie): add feature support for cookie-secret-file (@sandy2008)
#3055 feat: support non-default authorization request response mode also for OIDC providers (@stieler-it)
#3138 feat: make google_groups argument optional when using google provider (@sourava01)
#3093 feat: differentiate between "no available key" and error for redis sessions (@nobletrout)
GHSA-7rh7-c77v-6434 fix: skip_auth_routes bypass through query parameter inclusion

`v7.9.0`

Compare Source

#3072 feat: support for multiple github orgs #3072 (@daniel-mersch)
#3116 feat: bump to go1.24.5 and full dependency update (@wardviaene / @dolmen)
#3097 chore(deps): update alpine base image to v3.22.0
#3101 fix: return error for empty Redis URL list (@dgivens)

`v7.8.2`

Compare Source

#3031 Fixes Refresh Token bug with Entra ID and Workload Identity (#3027)[#3028] by using client assertion when redeeming the token (@richard87)
#3001 Allow to set non-default authorization request response mode (@stieler-it)
#3041 chore(deps): upgrade to latest golang v1.23.x release (@TheImplementer)
#1916 fix: role extraction from access token in keycloak oidc (@Elektordi / @tuunit)
#3014 feat: ability to parse JWT encoded profile claims (@ikarius)

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- "after 3am and before 6am"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/oauth2-proxy/oauth2-proxy](https://quay.io/oauth2-proxy/oauth2-proxy) ([source](https://github.com/oauth2-proxy/oauth2-proxy)) | minor | `v7.8.1` → `v7.15.6` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/91) for more information. --- ### Release Notes <details> <summary>oauth2-proxy/oauth2-proxy (quay.io/oauth2-proxy/oauth2-proxy)</summary> ### [`v7.15.6`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7156) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.15.5...v7.15.6) ### [`v7.15.5`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7155) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.15.4...v7.15.5) - [#3587](https://github.com/oauth2-proxy/oauth2-proxy/pull/3587) fix: keep the query after the slash in the trailing slash redirect ([@jayhemnani9910](https://github.com/jayhemnani9910)) - [#3584](https://github.com/oauth2-proxy/oauth2-proxy/pull/3584) fix: read the Entra ID tenant from the `tid` claim so session validation works in national clouds such as Azure US Government (fixes [#2939](https://github.com/oauth2-proxy/oauth2-proxy/issues/2939)) ([@asifsid](https://github.com/asifsid) / [@dantreiman](https://github.com/dantreiman)) - [#3583](https://github.com/oauth2-proxy/oauth2-proxy/pull/3583) fix: return 403 instead of 500 when the ID token audience is invalid [@marsluca](https://github.com/marsluca) - [#3573](https://github.com/oauth2-proxy/oauth2-proxy/pull/3573) fix: return 403 instead of 500 when a user with an unverified email completes the OAuth2 callback (fixes [#3234](https://github.com/oauth2-proxy/oauth2-proxy/issues/3234)) [@amichelic](https://github.com/amichelic) - [#3540](https://github.com/oauth2-proxy/oauth2-proxy/pull/3540) fix: honor `--oidc-groups-claim` for tokens verified via `--extra-jwt-issuers` ([@jaewak](https://github.com/jaewak) / [@tuunit](https://github.com/tuunit)) - [#3219](https://github.com/oauth2-proxy/oauth2-proxy/pull/3219) fix: escape OAuth state redirect URLs to preserve query parameters ([@CallumWayve](https://github.com/CallumWayve)) ### [`v7.15.4`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7154) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.15.3...v7.15.4) - [#3546](https://github.com/oauth2-proxy/oauth2-proxy/pull/3546) fix: strip the port from the request host when matching cookie domains [@kirilju](https://github.com/kirilju) - [#3547](https://github.com/oauth2-proxy/oauth2-proxy/pull/3547) fix: refresh additional claims for OIDC and MS Entra ID providers and properly populate additional claims during login ([@Apollo3zehn](https://github.com/Apollo3zehn)) - [#3477](https://github.com/oauth2-proxy/oauth2-proxy/pull/3477) fix(bitbucket): auth failure due to Bitbucket OAuth 2.0 [changes on May 4th 2026](https://developer.atlassian.com/cloud/bitbucket/changelog/#CHANGE-3052) [@mfouad](https://github.com/mfouad) - [#3535](https://github.com/oauth2-proxy/oauth2-proxy/pull/3535) fix: surface Microsoft Graph errors during Entra group overage instead of logging in with an incomplete group set [@no-hup](https://github.com/no-hup) - [#3527](https://github.com/oauth2-proxy/oauth2-proxy/pull/3527) fix(encryption): return an error instead of panicking on a short GCM ciphertext [@winklemad](https://github.com/winklemad) ### [`v7.15.3`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7153) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.15.2...v7.15.3) - [#3493](https://github.com/oauth2-proxy/oauth2-proxy/pull/3493) chore(deps): update gomod [@tuunit](https://github.com/tuunit) ### [`v7.15.2`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7152) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.15.1...v7.15.2) - [#3477](https://github.com/oauth2-proxy/oauth2-proxy/pull/3477) chore(dep): bump go to 1.26 and migrate of reverse proxy handling ### [`v7.15.1`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7151) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.15.0...v7.15.1) - [#3411](https://github.com/oauth2-proxy/oauth2-proxy/pull/3411) chore(deps): update gomod dependencies ([@tuunit](https://github.com/tuunit)) - [#3333](https://github.com/oauth2-proxy/oauth2-proxy/pull/3333) fix: invalidate session on fatal OAuth2 refresh errors ([@frhack](https://github.com/frhack)) - [GHSA-f24x-5g9q-753f](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-f24x-5g9q-753f) fix: clear session cookie at beginning of signinpage handler ([@fnoehWM](https://github.com/fnoehWM) / [@bella-WI](https://github.com/bella-WI) / [@tuunit](https://github.com/tuunit)) - [GHSA-5hvv-m4w4-gf6v](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5hvv-m4w4-gf6v) fix: health check user-agent authentication bypass ([@tuunit](https://github.com/tuunit)) - [GHSA-7x63-xv5r-3p2x](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x) fix: authentication bypass via X-Forwarded-Uri header spoofing ([@tuunit](https://github.com/tuunit)) - [GHSA-pxq7-h93f-9jrg](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-pxq7-h93f-9jrg) fix: fragment evaluation as part of the allowed routes ([@tuunit](https://github.com/tuunit)) - [GHSA-c5c4-8r6x-56w3](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-c5c4-8r6x-56w3) fix: email validation bypass via malformed multi-@ email claims ([@tuunit](https://github.com/tuunit)) ### [`v7.15.0`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7150) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.14.3...v7.15.0) - [#3382](https://github.com/oauth2-proxy/oauth2-proxy/pull/3382) chore(deps): update gomod and golangci/golangci-lint to v2.11.4 ([@tuunit](https://github.com/tuunit)) - [#3374](https://github.com/oauth2-proxy/oauth2-proxy/pull/3374) fix: handle Unix socket RemoteAddr in IP resolution ([@H1net](https://github.com/H1net)) - [#3381](https://github.com/oauth2-proxy/oauth2-proxy/pull/3381) fix: do not log error for backend logout 204 ([@artificiosus](https://github.com/artificiosus)) - [#3327](https://github.com/oauth2-proxy/oauth2-proxy/pull/3327) fix: improve logging when session refresh token is missing ([@yosri-brh](https://github.com/yosri-brh)) - [#2767](https://github.com/oauth2-proxy/oauth2-proxy/pull/2767) fix: propagate errors during route building ([@sybereal](https://github.com/sybereal)) ### [`v7.14.3`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7143) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.14.2...v7.14.3) - [#3352](https://github.com/oauth2-proxy/oauth2-proxy/pull/3352) fix: backend logout URL call on sign out ([#3172](https://github.com/oauth2-proxy/oauth2-proxy/issues/3172))([@vsejpal](https://github.com/vsejpal)) - [#3332](https://github.com/oauth2-proxy/oauth2-proxy/pull/3332) ci: distribute windows binary with .exe extension ([@igitur](https://github.com/igitur)) - [#2685](https://github.com/oauth2-proxy/oauth2-proxy/pull/2685) feat: allow arbitrary claims from the IDToken and IdentityProvider UserInfo endpoint to be added to the session state ([@vegetablest](https://github.com/vegetablest)) - [#3278](https://github.com/oauth2-proxy/oauth2-proxy/pull/3278) feat: possibility to inject id_token in redirect url during sign out ([@albanf](https://github.com/albanf)) - [#2851](https://github.com/oauth2-proxy/oauth2-proxy/pull/2851) feat: add support for specifying allowed OIDC JWT signing algorithms ([#2753](https://github.com/oauth2-proxy/oauth2-proxy/issues/2753)) ([@andoks](https://github.com/andoks) / [@tuunit](https://github.com/tuunit)) - [#3369](https://github.com/oauth2-proxy/oauth2-proxy/pull/3369) fix: use CSRFExpire instead of Expire for CSRF cookie validation ([@Br1an67](https://github.com/Br1an67)) - [#3365](https://github.com/oauth2-proxy/oauth2-proxy/pull/3365) fix: filter empty strings from allowed groups ([@Br1an67](https://github.com/Br1an67)) - [#3338](https://github.com/oauth2-proxy/oauth2-proxy/pull/3338) feat: add --config-test flag for validating configuration ([@MayorFaj](https://github.com/MayorFaj)) - [#3347](https://github.com/oauth2-proxy/oauth2-proxy/pull/3347) feat: add same site option for csrf cookies ([@jvnoije](https://github.com/jvnoije)) - [#3376](https://github.com/oauth2-proxy/oauth2-proxy/pull/3376) feat: allow setting unix socket file mode when declaring listener ([@Tristan971](https://github.com/Tristan971) / [@tuunit](https://github.com/tuunit)) ### [`v7.14.2`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7142) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.14.1...v7.14.2) - [#3183](https://github.com/oauth2-proxy/oauth2-proxy/pull/3183) fix: allow URL parameters to configure username, password and max idle connection timeout if the matching configuration is empty. ### [`v7.14.1`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7141) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.14.0...v7.14.1) - [#3314](https://github.com/oauth2-proxy/oauth2-proxy/pull/3314) revert: fix: skip provider button auth only redirect ([#3309](https://github.com/oauth2-proxy/oauth2-proxy/issues/3309)) ([@StefanMarkmann](https://github.com/StefanMarkmann) / [@tuunit](https://github.com/tuunit)) - [#3315](https://github.com/oauth2-proxy/oauth2-proxy/pull/3315) docs: clarify browser vs API routes for nginx auth_request redirects ([@StefanMarkmann](https://github.com/StefanMarkmann)) ### [`v7.14.0`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7140) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.13.0...v7.14.0) - [#3309](https://github.com/oauth2-proxy/oauth2-proxy/pull/3309) fix: Return 302 redirect from AuthOnly endpoint when skip-provider-button is true ([@StefanMarkmann](https://github.com/StefanMarkmann)) - [#3302](https://github.com/oauth2-proxy/oauth2-proxy/pull/3302) fix: static upstreams failing validation due to `passHostHeader` and `proxyWebSockets` defaults being set incorrectly ([@sourava01](https://github.com/sourava01) / [@tuunit](https://github.com/tuunit)) - [#3312](https://github.com/oauth2-proxy/oauth2-proxy/pull/3312) chore(deps): upgrade to go1.25.6 and latest dependencies ([@tuunit](https://github.com/tuunit)) ### [`v7.13.0`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7130) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.12.0...v7.13.0) - [#2628](https://github.com/oauth2-proxy/oauth2-proxy/pull/2628) feat(structured config): revamp of yaml parsing using mapstructure decoder and custom decoders ([@tuunit](https://github.com/tuunit)) - [#3197](https://github.com/oauth2-proxy/oauth2-proxy/pull/3197) fix: NewRemoteKeySet is not using DefaultHTTPClient ([@rsrdesarrollo](https://github.com/rsrdesarrollo) / [@tuunit](https://github.com/tuunit)) - [#3292](https://github.com/oauth2-proxy/oauth2-proxy/pull/3292) chore(deps): upgrade gomod and bump to golang v1.25.5 ([@tuunit](https://github.com/tuunit)) - [#3304](https://github.com/oauth2-proxy/oauth2-proxy/pull/3304) fix: added conditional so default is not always set and env vars are honored fixes 3303 ([@pixeldrew](https://github.com/pixeldrew)) - [#3264](https://github.com/oauth2-proxy/oauth2-proxy/pull/3264) fix: more aggressively truncate logged access_token ([@MartinNowak](https://github.com/MartinNowak) / [@tuunit](https://github.com/tuunit)) - [#3267](https://github.com/oauth2-proxy/oauth2-proxy/pull/3267) fix: Session refresh handling in OIDC provider ([@gysel](https://github.com/gysel)) - [#3290](https://github.com/oauth2-proxy/oauth2-proxy/pull/3290) fix: WebSocket proxy to respect PassHostHeader setting ([@UnsignedLong](https://github.com/UnsignedLong)) ### [`v7.12.0`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7120) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.11.0...v7.12.0) - [#3228](https://github.com/oauth2-proxy/oauth2-proxy/pull/3228) fix: use GetSecret() in ticket.go makeCookie to respect cookie-secret-file ([@stagswtf](https://github.com/stagswtf)) - [#3244](https://github.com/oauth2-proxy/oauth2-proxy/pull/3244) chore(deps): upgrade to latest go1.25.3 ([@tuunit](https://github.com/tuunit)) - [#3238](https://github.com/oauth2-proxy/oauth2-proxy/pull/3238) chore: Replace pkg/clock with narrowly targeted stub clocks ([@dsymonds](https://github.com/dsymonds)) - [#3237](https://github.com/oauth2-proxy/oauth2-proxy/pull/3237) - feat: add option to use organization id for preferred username in Google Provider ([@pixeldrew](https://github.com/pixeldrew)) - [GHSA-vjrc-mh2v-45x6](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6) fix: request header smuggling by stripping all normalized header variants ([@tuunit](https://github.com/tuunit)) - [#1933](https://github.com/oauth2-proxy/oauth2-proxy/pull/1933) fix: validation of refreshed sessions using the access_token in the OIDC provider ([@gysel](https://github.com/gysel) / [@tuunit](https://github.com/tuunit)) - [#2841](https://github.com/oauth2-proxy/oauth2-proxy/pull/2841) feat: add allowed\_\* constraint option to proxy endpoint query string ([@jacobalberty](https://github.com/jacobalberty)) ### [`v7.11.0`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7110) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.10.0...v7.11.0) - [#2273](https://github.com/oauth2-proxy/oauth2-proxy/pull/2273) feat: add Cidaas provider ([@Bibob7](https://github.com/Bibob7), [@Teko012](https://github.com/Teko012)) - [#3166](https://github.com/oauth2-proxy/oauth2-proxy/pull/3166) chore(dep): upgrade to latest golang 1.24.6 ([@tuunit](https://github.com/tuunit)) - [#3156](https://github.com/oauth2-proxy/oauth2-proxy/pull/3156) feat: allow disable-keep-alives configuration for upstream ([@jet-go](https://github.com/jet-go)) - [#3150](https://github.com/oauth2-proxy/oauth2-proxy/pull/3150) fix: Gitea team membership ([@MagicRB](https://github.com/MagicRB), [@tuunit](https://github.com/tuunit)) ### [`v7.10.0`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7100) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.9.0...v7.10.0) - [#2615](https://github.com/oauth2-proxy/oauth2-proxy/pull/2615) feat(cookies): add option to set a limit on the number of per-request CSRF cookies oauth2-proxy sets ([@bh-tt](https://github.com/bh-tt)) - [#2605](https://github.com/oauth2-proxy/oauth2-proxy/pull/2605) fix: show login page on broken cookie ([@Primexz](https://github.com/Primexz)) - [#2743](https://github.com/oauth2-proxy/oauth2-proxy/pull/2743) feat: allow use more possible google admin-sdk api scopes ([@BobDu](https://github.com/BobDu)) - [#2359](https://github.com/oauth2-proxy/oauth2-proxy/pull/2359) feat: add SourceHut (sr.ht) provider([@bitfehler](https://github.com/bitfehler)) - [#2524](https://github.com/oauth2-proxy/oauth2-proxy/pull/2524) fix: regex substitution for $ signs in upstream path handling before running envsubst ([@dashkan](https://github.com/dashkan) / [@tuunit](https://github.com/tuunit)) - [#3104](https://github.com/oauth2-proxy/oauth2-proxy/pull/3104) feat(cookie): add feature support for cookie-secret-file ([@sandy2008](https://github.com/sandy2008)) - [#3055](https://github.com/oauth2-proxy/oauth2-proxy/pull/3055) feat: support non-default authorization request response mode also for OIDC providers ([@stieler-it](https://github.com/stieler-it)) - [#3138](https://github.com/oauth2-proxy/oauth2-proxy/pull/3138) feat: make google_groups argument optional when using google provider ([@sourava01](https://github.com/sourava01)) - [#3093](https://github.com/oauth2-proxy/oauth2-proxy/pull/3093) feat: differentiate between "no available key" and error for redis sessions ([@nobletrout](https://github.com/nobletrout)) - [GHSA-7rh7-c77v-6434](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7rh7-c77v-6434) fix: skip_auth_routes bypass through query parameter inclusion ### [`v7.9.0`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v790) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.8.2...v7.9.0) - [#3072](https://github.com/oauth2-proxy/oauth2-proxy/pull/3072) feat: support for multiple github orgs [#3072](https://github.com/oauth2-proxy/oauth2-proxy/issues/3072) ([@daniel-mersch](https://github.com/daniel-mersch)) - [#3116](https://github.com/oauth2-proxy/oauth2-proxy/pull/3116) feat: bump to go1.24.5 and full dependency update ([@wardviaene](https://github.com/wardviaene) / [@dolmen](https://github.com/dolmen)) - [#3097](https://github.com/oauth2-proxy/oauth2-proxy/pull/3097) chore(deps): update alpine base image to v3.22.0 - [#3101](https://github.com/oauth2-proxy/oauth2-proxy/pull/3101) fix: return error for empty Redis URL list ([@dgivens](https://github.com/dgivens)) ### [`v7.8.2`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v782) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.8.1...v7.8.2) - [#3031](https://github.com/oauth2-proxy/oauth2-proxy/pull/3031) Fixes Refresh Token bug with Entra ID and Workload Identity ([#3027](https://github.com/oauth2-proxy/oauth2-proxy/issues/3027))\[[#3028](https://github.com/oauth2-proxy/oauth2-proxy/issues/3028)] by using client assertion when redeeming the token ([@richard87](https://github.com/richard87)) - [#3001](https://github.com/oauth2-proxy/oauth2-proxy/pull/3001) Allow to set non-default authorization request response mode ([@stieler-it](https://github.com/stieler-it)) - [#3041](https://github.com/oauth2-proxy/oauth2-proxy/pull/3041) chore(deps): upgrade to latest golang v1.23.x release ([@TheImplementer](https://github.com/TheImplementer)) - [#1916](https://github.com/oauth2-proxy/oauth2-proxy/pull/1916) fix: role extraction from access token in keycloak oidc ([@Elektordi](https://github.com/Elektordi) / [@tuunit](https://github.com/tuunit)) - [#3014](https://github.com/oauth2-proxy/oauth2-proxy/pull/3014) feat: ability to parse JWT encoded profile claims ([@ikarius](https://github.com/ikarius)) </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - "after 3am and before 6am" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added the needs-review dependencies automated-update labels 2026-11-07 08:18:57 +00:00

renovate-bot added 1 commit 2026-11-07 08:18:57 +00:00

chore(deps): Update quay.io/oauth2-proxy/oauth2-proxy Docker tag to v7.15.6

gate / gate (pull_request) Failing after 2m57s

Details

gate / conformance (pull_request) Has been skipped

Details

893c9dee4f

gitea-admin referenced this issue from a commit

2026-11-08 06:02:26 +00:00

fix(conformance): regenerate L1 render goldens for oauth2-proxy v7.15.6

gitea-admin added 1 commit 2026-11-08 06:02:26 +00:00

fix(conformance): regenerate L1 render goldens for oauth2-proxy v7.15.6

gate / gate (pull_request) Successful in 3m0s

Details

gate / conformance (pull_request) Skipped

Details

3d7ecbcfe9

PR #136 bumps the renderer's OAUTH2_PROXY_IMAGE; the container-workload
and egress-class (vpn + internet) goldens still pinned v7.8.1. Regenerated
with the check scripts' own invocation; each diff is the image tag only.
Also updates the crafty README's current-pin row.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

gitea-admin commented

2026-11-08 06:02:40 +00:00

Rework: L1 render goldens regenerated for oauth2-proxy v7.15.6

Operator action required: this push touches conformance/**, which is a sensitive path (infra/gitea/approval-policy.json). The approval-policy stage will block this PR until an administrator posts
/approve-override <reason>
as a PR review of type "Comment" (not in the plain comment box; CI's token cannot read issue comments — CLAUDE.md §1). The agent that pushed this deliberately did not post it.

What changed (commit 3d7ecbc, on top of Renovate's 893c9de):

Regenerated three L1 goldens in the pinned toolbox with the check scripts' own invocation (python3 catalog/render.py <fixture> > <golden>):
- conformance/tests/l1-rendering/container-workload-render/golden/expected.yaml
- conformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yaml
- conformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml (also drifted; CI only showed vpn because the check stops at the first diff)
Each diff is exactly one line: oauth2-proxy:v7.8.1 -> oauth2-proxy:v7.15.6. Nothing else moved.
platform/crafty/README.md: current-pin row updated to v7.15.6.
Handoff: decisions/2026-11-08-rework-136.md.
Left alone on purpose: render.py comments/messages recording what was verified against the v7.8.1 binary (rewriting them would claim an unperformed v7.15.6 --help check), and v7.8.1 inside synthetic promtool test series.

Local toolbox gate: rc 3 (UNDETERMINED, not green). Passed: lint, l0, render-golden, l1 (all 3 L1 render checks), spec-immutability, decisions-log (73 entries), approval-policy (N/A offline — no PR event). Not run: gitea-settings (no token locally), conformance L2/L3 (no cluster).

Renovate note: this branch now carries a non-Renovate commit, so Renovate will likely stop rebasing/updating it (it treats the branch as edited). If a newer 7.x lands, expect a fresh Renovate PR or a manual rebase.

🤖 Generated with Claude Code

## Rework: L1 render goldens regenerated for oauth2-proxy v7.15.6 > **Operator action required:** this push touches `conformance/**`, which is a **sensitive path** (`infra/gitea/approval-policy.json`). The `approval-policy` stage will **block** this PR until an administrator posts > > /approve-override <reason> > > as a **PR review of type "Comment"** (not in the plain comment box; CI's token cannot read issue comments — CLAUDE.md §1). The agent that pushed this deliberately did **not** post it. **What changed** (commit `3d7ecbc`, on top of Renovate's `893c9de`): - Regenerated three L1 goldens in the pinned toolbox with the check scripts' own invocation (`python3 catalog/render.py <fixture> > <golden>`): - `conformance/tests/l1-rendering/container-workload-render/golden/expected.yaml` - `conformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yaml` - `conformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml` (also drifted; CI only showed vpn because the check stops at the first diff) - Each diff is exactly one line: `oauth2-proxy:v7.8.1` -> `oauth2-proxy:v7.15.6`. Nothing else moved. - `platform/crafty/README.md`: current-pin row updated to v7.15.6. - Handoff: `decisions/2026-11-08-rework-136.md`. - Left alone on purpose: render.py comments/messages recording what was verified against the v7.8.1 binary (rewriting them would claim an unperformed v7.15.6 `--help` check), and v7.8.1 inside synthetic promtool test series. **Local toolbox gate:** rc **3** (UNDETERMINED, not green). Passed: lint, l0, render-golden, l1 (all 3 L1 render checks), spec-immutability, decisions-log (73 entries), approval-policy (N/A offline — no PR event). Not run: `gitea-settings` (no token locally), `conformance` L2/L3 (no cluster). **Renovate note:** this branch now carries a non-Renovate commit, so Renovate will likely stop rebasing/updating it (it treats the branch as edited). If a newer 7.x lands, expect a fresh Renovate PR or a manual rebase. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jakman85 approved these changes

2026-11-08 06:44:48 +00:00

jakman85 merged commit 7be693bf37 into main

2026-11-08 06:45:31 +00:00

Sign in to join this conversation.

3 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Home-Network/home-network-k3s-impl#136