sophie/homelab

Fork 0

chore(deps): update quay.io/oauth2-proxy/oauth2-proxy docker tag to v7.15.5 #44

Open

svc-renovate wants to merge 1 commit from renovate/quay.io-oauth2-proxy-oauth2-proxy-7.x into main

svc-renovate commented

2026-10-22 21:54:57 +11:00

Collaborator

This PR contains the following updates:

Package	Update	Change
quay.io/oauth2-proxy/oauth2-proxy (source)	minor	`v7.7.1` → `v7.15.5`

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

oauth2-proxy/oauth2-proxy (quay.io/oauth2-proxy/oauth2-proxy)

`v7.15.4`

Compare Source

#3546 fix: strip the port from the request host when matching cookie domains @kirilju
#3547 fix: refresh additional claims for OIDC and MS Entra ID providers and properly populate additional claims during login (@Apollo3zehn)
#3477 fix(bitbucket): auth failure due to Bitbucket OAuth 2.0 changes on May 4th 2026 @mfouad
#3535 fix: surface Microsoft Graph errors during Entra group overage instead of logging in with an incomplete group set @no-hup
#3527 fix(encryption): return an error instead of panicking on a short GCM ciphertext @winklemad

`v7.15.3`

Compare Source

#3493 chore(deps): update gomod @tuunit

`v7.15.2`

Compare Source

#3477 chore(dep): bump go to 1.26 and migrate of reverse proxy handling

`v7.15.1`

Compare Source

#3411 chore(deps): update gomod dependencies (@tuunit)
#3333 fix: invalidate session on fatal OAuth2 refresh errors (@frhack)
GHSA-f24x-5g9q-753f fix: clear session cookie at beginning of signinpage handler (@fnoehWM / @bella-WI / @tuunit)
GHSA-5hvv-m4w4-gf6v fix: health check user-agent authentication bypass (@tuunit)
GHSA-7x63-xv5r-3p2x fix: authentication bypass via X-Forwarded-Uri header spoofing (@tuunit)
GHSA-pxq7-h93f-9jrg fix: fragment evaluation as part of the allowed routes (@tuunit)
GHSA-c5c4-8r6x-56w3 fix: email validation bypass via malformed multi-@ email claims (@tuunit)

`v7.15.0`

Compare Source

#3382 chore(deps): update gomod and golangci/golangci-lint to v2.11.4 (@tuunit)
#3374 fix: handle Unix socket RemoteAddr in IP resolution (@H1net)
#3381 fix: do not log error for backend logout 204 (@artificiosus)
#3327 fix: improve logging when session refresh token is missing (@yosri-brh)
#2767 fix: propagate errors during route building (@sybereal)

`v7.14.3`

Compare Source

#3352 fix: backend logout URL call on sign out (#3172)(@vsejpal)
#3332 ci: distribute windows binary with .exe extension (@igitur)
#2685 feat: allow arbitrary claims from the IDToken and IdentityProvider UserInfo endpoint to be added to the session state (@vegetablest)
#3278 feat: possibility to inject id_token in redirect url during sign out (@albanf)
#2851 feat: add support for specifying allowed OIDC JWT signing algorithms (#2753) (@andoks / @tuunit)
#3369 fix: use CSRFExpire instead of Expire for CSRF cookie validation (@Br1an67)
#3365 fix: filter empty strings from allowed groups (@Br1an67)
#3338 feat: add --config-test flag for validating configuration (@MayorFaj)
#3347 feat: add same site option for csrf cookies (@jvnoije)
#3376 feat: allow setting unix socket file mode when declaring listener (@Tristan971 / @tuunit)

`v7.14.2`

Compare Source

#3183 fix: allow URL parameters to configure username, password and max idle connection timeout if the matching configuration is empty.

`v7.14.1`

Compare Source

#3314 revert: fix: skip provider button auth only redirect (#3309) (@StefanMarkmann / @tuunit)
#3315 docs: clarify browser vs API routes for nginx auth_request redirects (@StefanMarkmann)

`v7.14.0`

Compare Source

#3309 fix: Return 302 redirect from AuthOnly endpoint when skip-provider-button is true (@StefanMarkmann)
#3302 fix: static upstreams failing validation due to passHostHeader and proxyWebSockets defaults being set incorrectly (@sourava01 / @tuunit)
#3312 chore(deps): upgrade to go1.25.6 and latest dependencies (@tuunit)

`v7.13.0`

Compare Source

#2628 feat(structured config): revamp of yaml parsing using mapstructure decoder and custom decoders (@tuunit)
#3197 fix: NewRemoteKeySet is not using DefaultHTTPClient (@rsrdesarrollo / @tuunit)
#3292 chore(deps): upgrade gomod and bump to golang v1.25.5 (@tuunit)
#3304 fix: added conditional so default is not always set and env vars are honored fixes 3303 (@pixeldrew)
#3264 fix: more aggressively truncate logged access_token (@MartinNowak / @tuunit)
#3267 fix: Session refresh handling in OIDC provider (@gysel)
#3290 fix: WebSocket proxy to respect PassHostHeader setting (@UnsignedLong)

`v7.12.0`

Compare Source

#3228 fix: use GetSecret() in ticket.go makeCookie to respect cookie-secret-file (@stagswtf)
#3244 chore(deps): upgrade to latest go1.25.3 (@tuunit)
#3238 chore: Replace pkg/clock with narrowly targeted stub clocks (@dsymonds)
#3237 - feat: add option to use organization id for preferred username in Google Provider (@pixeldrew)
GHSA-vjrc-mh2v-45x6 fix: request header smuggling by stripping all normalized header variants (@tuunit)
#1933 fix: validation of refreshed sessions using the access_token in the OIDC provider (@gysel / @tuunit)
#2841 feat: add allowed_* constraint option to proxy endpoint query string (@jacobalberty)

`v7.11.0`

Compare Source

#2273 feat: add Cidaas provider (@Bibob7, @Teko012)
#3166 chore(dep): upgrade to latest golang 1.24.6 (@tuunit)
#3156 feat: allow disable-keep-alives configuration for upstream (@jet-go)
#3150 fix: Gitea team membership (@MagicRB, @tuunit)

`v7.10.0`

Compare Source

#2615 feat(cookies): add option to set a limit on the number of per-request CSRF cookies oauth2-proxy sets (@bh-tt)
#2605 fix: show login page on broken cookie (@Primexz)
#2743 feat: allow use more possible google admin-sdk api scopes (@BobDu)
#2359 feat: add SourceHut (sr.ht) provider(@bitfehler)
#2524 fix: regex substitution for $ signs in upstream path handling before running envsubst (@dashkan / @tuunit)
#3104 feat(cookie): add feature support for cookie-secret-file (@sandy2008)
#3055 feat: support non-default authorization request response mode also for OIDC providers (@stieler-it)
#3138 feat: make google_groups argument optional when using google provider (@sourava01)
#3093 feat: differentiate between "no available key" and error for redis sessions (@nobletrout)
GHSA-7rh7-c77v-6434 fix: skip_auth_routes bypass through query parameter inclusion

`v7.9.0`

Compare Source

#3072 feat: support for multiple github orgs #3072 (@daniel-mersch)
#3116 feat: bump to go1.24.5 and full dependency update (@wardviaene / @dolmen)
#3097 chore(deps): update alpine base image to v3.22.0
#3101 fix: return error for empty Redis URL list (@dgivens)

`v7.8.2`

Compare Source

#3031 Fixes Refresh Token bug with Entra ID and Workload Identity (#3027)[#3028] by using client assertion when redeeming the token (@richard87)
#3001 Allow to set non-default authorization request response mode (@stieler-it)
#3041 chore(deps): upgrade to latest golang v1.23.x release (@TheImplementer)
#1916 fix: role extraction from access token in keycloak oidc (@Elektordi / @tuunit)
#3014 feat: ability to parse JWT encoded profile claims (@ikarius)

`v7.8.1`

Compare Source

#2918 feat: add --bearer-token-login-fallback (@carillonator)
#2927 chore(deps/build): bump golang to 1.23 and use go.mod as single point of truth for all build files (@tuunit)
#2697 Use Max-Age instead of Expires for cookie expiration (@matpen-wi)
#2969 Update golang.org/x/oauth2 to v0.27.0 to address CVE-2025-22868 (@dsymonds)
#2977 Update golang.org/x/net to v0.36.0 to address CVE-2025-22870 (@dsymonds)
#2982 chore(deps): remove go:generate tool from go.mod (@dolmen)
#3011 chore(deps): update golang dependencies and pin to latest golang v1.23.x release (@tuunit)
#2967 Update HashNonce to use crypto/sha256 (@egibs)

`v7.8.0`

Compare Source

#2887 fix: jwt regex validation error during skip-jwt-bearer-tokens flow
#2920 fix: missing oauth2-proxy version for docker builds

Configuration

📅 Schedule: (UTC)

Branch creation
- "on the first day of the month"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [quay.io/oauth2-proxy/oauth2-proxy](https://quay.io/oauth2-proxy/oauth2-proxy) ([source](https://github.com/oauth2-proxy/oauth2-proxy)) | minor | `v7.7.1` → `v7.15.5` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/3) for more information. --- ### Release Notes <details> <summary>oauth2-proxy/oauth2-proxy (quay.io/oauth2-proxy/oauth2-proxy)</summary> ### [`v7.15.5`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7155) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.15.4...v7.15.5) ### [`v7.15.4`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7154) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.15.3...v7.15.4) - [#3546](https://github.com/oauth2-proxy/oauth2-proxy/pull/3546) fix: strip the port from the request host when matching cookie domains [@kirilju](https://github.com/kirilju) - [#3547](https://github.com/oauth2-proxy/oauth2-proxy/pull/3547) fix: refresh additional claims for OIDC and MS Entra ID providers and properly populate additional claims during login ([@Apollo3zehn](https://github.com/Apollo3zehn)) - [#3477](https://github.com/oauth2-proxy/oauth2-proxy/pull/3477) fix(bitbucket): auth failure due to Bitbucket OAuth 2.0 [changes on May 4th 2026](https://developer.atlassian.com/cloud/bitbucket/changelog/#CHANGE-3052) [@mfouad](https://github.com/mfouad) - [#3535](https://github.com/oauth2-proxy/oauth2-proxy/pull/3535) fix: surface Microsoft Graph errors during Entra group overage instead of logging in with an incomplete group set [@no-hup](https://github.com/no-hup) - [#3527](https://github.com/oauth2-proxy/oauth2-proxy/pull/3527) fix(encryption): return an error instead of panicking on a short GCM ciphertext [@winklemad](https://github.com/winklemad) ### [`v7.15.3`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7153) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.15.2...v7.15.3) - [#3493](https://github.com/oauth2-proxy/oauth2-proxy/pull/3493) chore(deps): update gomod [@tuunit](https://github.com/tuunit) ### [`v7.15.2`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7152) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.15.1...v7.15.2) - [#3477](https://github.com/oauth2-proxy/oauth2-proxy/pull/3477) chore(dep): bump go to 1.26 and migrate of reverse proxy handling ### [`v7.15.1`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7151) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.15.0...v7.15.1) - [#3411](https://github.com/oauth2-proxy/oauth2-proxy/pull/3411) chore(deps): update gomod dependencies ([@tuunit](https://github.com/tuunit)) - [#3333](https://github.com/oauth2-proxy/oauth2-proxy/pull/3333) fix: invalidate session on fatal OAuth2 refresh errors ([@frhack](https://github.com/frhack)) - [GHSA-f24x-5g9q-753f](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-f24x-5g9q-753f) fix: clear session cookie at beginning of signinpage handler ([@fnoehWM](https://github.com/fnoehWM) / [@bella-WI](https://github.com/bella-WI) / [@tuunit](https://github.com/tuunit)) - [GHSA-5hvv-m4w4-gf6v](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5hvv-m4w4-gf6v) fix: health check user-agent authentication bypass ([@tuunit](https://github.com/tuunit)) - [GHSA-7x63-xv5r-3p2x](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x) fix: authentication bypass via X-Forwarded-Uri header spoofing ([@tuunit](https://github.com/tuunit)) - [GHSA-pxq7-h93f-9jrg](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-pxq7-h93f-9jrg) fix: fragment evaluation as part of the allowed routes ([@tuunit](https://github.com/tuunit)) - [GHSA-c5c4-8r6x-56w3](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-c5c4-8r6x-56w3) fix: email validation bypass via malformed multi-@ email claims ([@tuunit](https://github.com/tuunit)) ### [`v7.15.0`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7150) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.14.3...v7.15.0) - [#3382](https://github.com/oauth2-proxy/oauth2-proxy/pull/3382) chore(deps): update gomod and golangci/golangci-lint to v2.11.4 ([@tuunit](https://github.com/tuunit)) - [#3374](https://github.com/oauth2-proxy/oauth2-proxy/pull/3374) fix: handle Unix socket RemoteAddr in IP resolution ([@H1net](https://github.com/H1net)) - [#3381](https://github.com/oauth2-proxy/oauth2-proxy/pull/3381) fix: do not log error for backend logout 204 ([@artificiosus](https://github.com/artificiosus)) - [#3327](https://github.com/oauth2-proxy/oauth2-proxy/pull/3327) fix: improve logging when session refresh token is missing ([@yosri-brh](https://github.com/yosri-brh)) - [#2767](https://github.com/oauth2-proxy/oauth2-proxy/pull/2767) fix: propagate errors during route building ([@sybereal](https://github.com/sybereal)) ### [`v7.14.3`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7143) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.14.2...v7.14.3) - [#3352](https://github.com/oauth2-proxy/oauth2-proxy/pull/3352) fix: backend logout URL call on sign out ([#3172](https://github.com/oauth2-proxy/oauth2-proxy/issues/3172))([@vsejpal](https://github.com/vsejpal)) - [#3332](https://github.com/oauth2-proxy/oauth2-proxy/pull/3332) ci: distribute windows binary with .exe extension ([@igitur](https://github.com/igitur)) - [#2685](https://github.com/oauth2-proxy/oauth2-proxy/pull/2685) feat: allow arbitrary claims from the IDToken and IdentityProvider UserInfo endpoint to be added to the session state ([@vegetablest](https://github.com/vegetablest)) - [#3278](https://github.com/oauth2-proxy/oauth2-proxy/pull/3278) feat: possibility to inject id\_token in redirect url during sign out ([@albanf](https://github.com/albanf)) - [#2851](https://github.com/oauth2-proxy/oauth2-proxy/pull/2851) feat: add support for specifying allowed OIDC JWT signing algorithms ([#2753](https://github.com/oauth2-proxy/oauth2-proxy/issues/2753)) ([@andoks](https://github.com/andoks) / [@tuunit](https://github.com/tuunit)) - [#3369](https://github.com/oauth2-proxy/oauth2-proxy/pull/3369) fix: use CSRFExpire instead of Expire for CSRF cookie validation ([@Br1an67](https://github.com/Br1an67)) - [#3365](https://github.com/oauth2-proxy/oauth2-proxy/pull/3365) fix: filter empty strings from allowed groups ([@Br1an67](https://github.com/Br1an67)) - [#3338](https://github.com/oauth2-proxy/oauth2-proxy/pull/3338) feat: add --config-test flag for validating configuration ([@MayorFaj](https://github.com/MayorFaj)) - [#3347](https://github.com/oauth2-proxy/oauth2-proxy/pull/3347) feat: add same site option for csrf cookies ([@jvnoije](https://github.com/jvnoije)) - [#3376](https://github.com/oauth2-proxy/oauth2-proxy/pull/3376) feat: allow setting unix socket file mode when declaring listener ([@Tristan971](https://github.com/Tristan971) / [@tuunit](https://github.com/tuunit)) ### [`v7.14.2`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7142) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.14.1...v7.14.2) - [#3183](https://github.com/oauth2-proxy/oauth2-proxy/pull/3183) fix: allow URL parameters to configure username, password and max idle connection timeout if the matching configuration is empty. ### [`v7.14.1`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7141) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.14.0...v7.14.1) - [#3314](https://github.com/oauth2-proxy/oauth2-proxy/pull/3314) revert: fix: skip provider button auth only redirect ([#3309](https://github.com/oauth2-proxy/oauth2-proxy/issues/3309)) ([@StefanMarkmann](https://github.com/StefanMarkmann) / [@tuunit](https://github.com/tuunit)) - [#3315](https://github.com/oauth2-proxy/oauth2-proxy/pull/3315) docs: clarify browser vs API routes for nginx auth\_request redirects ([@StefanMarkmann](https://github.com/StefanMarkmann)) ### [`v7.14.0`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7140) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.13.0...v7.14.0) - [#3309](https://github.com/oauth2-proxy/oauth2-proxy/pull/3309) fix: Return 302 redirect from AuthOnly endpoint when skip-provider-button is true ([@StefanMarkmann](https://github.com/StefanMarkmann)) - [#3302](https://github.com/oauth2-proxy/oauth2-proxy/pull/3302) fix: static upstreams failing validation due to `passHostHeader` and `proxyWebSockets` defaults being set incorrectly ([@sourava01](https://github.com/sourava01) / [@tuunit](https://github.com/tuunit)) - [#3312](https://github.com/oauth2-proxy/oauth2-proxy/pull/3312) chore(deps): upgrade to go1.25.6 and latest dependencies ([@tuunit](https://github.com/tuunit)) ### [`v7.13.0`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7130) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.12.0...v7.13.0) - [#2628](https://github.com/oauth2-proxy/oauth2-proxy/pull/2628) feat(structured config): revamp of yaml parsing using mapstructure decoder and custom decoders ([@tuunit](https://github.com/tuunit)) - [#3197](https://github.com/oauth2-proxy/oauth2-proxy/pull/3197) fix: NewRemoteKeySet is not using DefaultHTTPClient ([@rsrdesarrollo](https://github.com/rsrdesarrollo) / [@tuunit](https://github.com/tuunit)) - [#3292](https://github.com/oauth2-proxy/oauth2-proxy/pull/3292) chore(deps): upgrade gomod and bump to golang v1.25.5 ([@tuunit](https://github.com/tuunit)) - [#3304](https://github.com/oauth2-proxy/oauth2-proxy/pull/3304) fix: added conditional so default is not always set and env vars are honored fixes 3303 ([@pixeldrew](https://github.com/pixeldrew)) - [#3264](https://github.com/oauth2-proxy/oauth2-proxy/pull/3264) fix: more aggressively truncate logged access\_token ([@MartinNowak](https://github.com/MartinNowak) / [@tuunit](https://github.com/tuunit)) - [#3267](https://github.com/oauth2-proxy/oauth2-proxy/pull/3267) fix: Session refresh handling in OIDC provider ([@gysel](https://github.com/gysel)) - [#3290](https://github.com/oauth2-proxy/oauth2-proxy/pull/3290) fix: WebSocket proxy to respect PassHostHeader setting ([@UnsignedLong](https://github.com/UnsignedLong)) ### [`v7.12.0`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7120) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.11.0...v7.12.0) - [#3228](https://github.com/oauth2-proxy/oauth2-proxy/pull/3228) fix: use GetSecret() in ticket.go makeCookie to respect cookie-secret-file ([@stagswtf](https://github.com/stagswtf)) - [#3244](https://github.com/oauth2-proxy/oauth2-proxy/pull/3244) chore(deps): upgrade to latest go1.25.3 ([@tuunit](https://github.com/tuunit)) - [#3238](https://github.com/oauth2-proxy/oauth2-proxy/pull/3238) chore: Replace pkg/clock with narrowly targeted stub clocks ([@dsymonds](https://github.com/dsymonds)) - [#3237](https://github.com/oauth2-proxy/oauth2-proxy/pull/3237) - feat: add option to use organization id for preferred username in Google Provider ([@pixeldrew](https://github.com/pixeldrew)) - [GHSA-vjrc-mh2v-45x6](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6) fix: request header smuggling by stripping all normalized header variants ([@tuunit](https://github.com/tuunit)) - [#1933](https://github.com/oauth2-proxy/oauth2-proxy/pull/1933) fix: validation of refreshed sessions using the access\_token in the OIDC provider ([@gysel](https://github.com/gysel) / [@tuunit](https://github.com/tuunit)) - [#2841](https://github.com/oauth2-proxy/oauth2-proxy/pull/2841) feat: add allowed\_\* constraint option to proxy endpoint query string ([@jacobalberty](https://github.com/jacobalberty)) ### [`v7.11.0`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7110) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.10.0...v7.11.0) - [#2273](https://github.com/oauth2-proxy/oauth2-proxy/pull/2273) feat: add Cidaas provider ([@Bibob7](https://github.com/Bibob7), [@Teko012](https://github.com/Teko012)) - [#3166](https://github.com/oauth2-proxy/oauth2-proxy/pull/3166) chore(dep): upgrade to latest golang 1.24.6 ([@tuunit](https://github.com/tuunit)) - [#3156](https://github.com/oauth2-proxy/oauth2-proxy/pull/3156) feat: allow disable-keep-alives configuration for upstream ([@jet-go](https://github.com/jet-go)) - [#3150](https://github.com/oauth2-proxy/oauth2-proxy/pull/3150) fix: Gitea team membership ([@MagicRB](https://github.com/MagicRB), [@tuunit](https://github.com/tuunit)) ### [`v7.10.0`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v7100) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.9.0...v7.10.0) - [#2615](https://github.com/oauth2-proxy/oauth2-proxy/pull/2615) feat(cookies): add option to set a limit on the number of per-request CSRF cookies oauth2-proxy sets ([@bh-tt](https://github.com/bh-tt)) - [#2605](https://github.com/oauth2-proxy/oauth2-proxy/pull/2605) fix: show login page on broken cookie ([@Primexz](https://github.com/Primexz)) - [#2743](https://github.com/oauth2-proxy/oauth2-proxy/pull/2743) feat: allow use more possible google admin-sdk api scopes ([@BobDu](https://github.com/BobDu)) - [#2359](https://github.com/oauth2-proxy/oauth2-proxy/pull/2359) feat: add SourceHut (sr.ht) provider([@bitfehler](https://github.com/bitfehler)) - [#2524](https://github.com/oauth2-proxy/oauth2-proxy/pull/2524) fix: regex substitution for $ signs in upstream path handling before running envsubst ([@dashkan](https://github.com/dashkan) / [@tuunit](https://github.com/tuunit)) - [#3104](https://github.com/oauth2-proxy/oauth2-proxy/pull/3104) feat(cookie): add feature support for cookie-secret-file ([@sandy2008](https://github.com/sandy2008)) - [#3055](https://github.com/oauth2-proxy/oauth2-proxy/pull/3055) feat: support non-default authorization request response mode also for OIDC providers ([@stieler-it](https://github.com/stieler-it)) - [#3138](https://github.com/oauth2-proxy/oauth2-proxy/pull/3138) feat: make google\_groups argument optional when using google provider ([@sourava01](https://github.com/sourava01)) - [#3093](https://github.com/oauth2-proxy/oauth2-proxy/pull/3093) feat: differentiate between "no available key" and error for redis sessions ([@nobletrout](https://github.com/nobletrout)) - [GHSA-7rh7-c77v-6434](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7rh7-c77v-6434) fix: skip\_auth\_routes bypass through query parameter inclusion ### [`v7.9.0`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v790) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.8.2...v7.9.0) - [#3072](https://github.com/oauth2-proxy/oauth2-proxy/pull/3072) feat: support for multiple github orgs [#3072](https://github.com/oauth2-proxy/oauth2-proxy/issues/3072) ([@daniel-mersch](https://github.com/daniel-mersch)) - [#3116](https://github.com/oauth2-proxy/oauth2-proxy/pull/3116) feat: bump to go1.24.5 and full dependency update ([@wardviaene](https://github.com/wardviaene) / [@dolmen](https://github.com/dolmen)) - [#3097](https://github.com/oauth2-proxy/oauth2-proxy/pull/3097) chore(deps): update alpine base image to v3.22.0 - [#3101](https://github.com/oauth2-proxy/oauth2-proxy/pull/3101) fix: return error for empty Redis URL list ([@dgivens](https://github.com/dgivens)) ### [`v7.8.2`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v782) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.8.1...v7.8.2) - [#3031](https://github.com/oauth2-proxy/oauth2-proxy/pull/3031) Fixes Refresh Token bug with Entra ID and Workload Identity ([#3027](https://github.com/oauth2-proxy/oauth2-proxy/issues/3027))\[[#3028](https://github.com/oauth2-proxy/oauth2-proxy/issues/3028)] by using client assertion when redeeming the token ([@richard87](https://github.com/richard87)) - [#3001](https://github.com/oauth2-proxy/oauth2-proxy/pull/3001) Allow to set non-default authorization request response mode ([@stieler-it](https://github.com/stieler-it)) - [#3041](https://github.com/oauth2-proxy/oauth2-proxy/pull/3041) chore(deps): upgrade to latest golang v1.23.x release ([@TheImplementer](https://github.com/TheImplementer)) - [#1916](https://github.com/oauth2-proxy/oauth2-proxy/pull/1916) fix: role extraction from access token in keycloak oidc ([@Elektordi](https://github.com/Elektordi) / [@tuunit](https://github.com/tuunit)) - [#3014](https://github.com/oauth2-proxy/oauth2-proxy/pull/3014) feat: ability to parse JWT encoded profile claims ([@ikarius](https://github.com/ikarius)) ### [`v7.8.1`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v781) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.8.0...v7.8.1) - [#2918](https://github.com/oauth2-proxy/oauth2-proxy/issues/2918) feat: add --bearer-token-login-fallback ([@carillonator](https://github.com/carillonator)) - [#2927](https://github.com/oauth2-proxy/oauth2-proxy/pull/2927) chore(deps/build): bump golang to 1.23 and use go.mod as single point of truth for all build files ([@tuunit](https://github.com/tuunit)) - [#2697](https://github.com/oauth2-proxy/oauth2-proxy/pull/2697) Use `Max-Age` instead of `Expires` for cookie expiration ([@matpen-wi](https://github.com/matpen-wi)) - [#2969](https://github.com/oauth2-proxy/oauth2-proxy/pull/2969) Update golang.org/x/oauth2 to v0.27.0 to address CVE-2025-22868 ([@dsymonds](https://github.com/dsymonds)) - [#2977](https://github.com/oauth2-proxy/oauth2-proxy/pull/2977) Update golang.org/x/net to v0.36.0 to address CVE-2025-22870 ([@dsymonds](https://github.com/dsymonds)) - [#2982](https://github.com/oauth2-proxy/oauth2-proxy/pull/2982) chore(deps): remove go:generate tool from go.mod ([@dolmen](https://github.com/dolmen)) - [#3011](https://github.com/oauth2-proxy/oauth2-proxy/pull/3011) chore(deps): update golang dependencies and pin to latest golang v1.23.x release ([@tuunit](https://github.com/tuunit)) - [#2967](https://github.com/oauth2-proxy/oauth2-proxy/pull/2967) Update HashNonce to use crypto/sha256 ([@egibs](https://github.com/egibs)) ### [`v7.8.0`](https://github.com/oauth2-proxy/oauth2-proxy/blob/HEAD/CHANGELOG.md#Changes-since-v780) [Compare Source](https://github.com/oauth2-proxy/oauth2-proxy/compare/v7.7.1...v7.8.0) - [#2887](https://github.com/oauth2-proxy/oauth2-proxy/issues/2887) fix: jwt regex validation error during skip-jwt-bearer-tokens flow - [#2920](https://github.com/oauth2-proxy/oauth2-proxy/pull/2920) fix: missing oauth2-proxy version for docker builds </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "on the first day of the month" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

svc-renovate added 1 commit

2026-10-22 21:54:57 +11:00

chore(deps): update quay.io/oauth2-proxy/oauth2-proxy docker tag to v7.15.5 786c0f0581

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/quay.io-oauth2-proxy-oauth2-proxy-7.x:renovate/quay.io-oauth2-proxy-oauth2-proxy-7.x

git switch renovate/quay.io-oauth2-proxy-oauth2-proxy-7.x

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff renovate/quay.io-oauth2-proxy-oauth2-proxy-7.x

git switch renovate/quay.io-oauth2-proxy-oauth2-proxy-7.x

git rebase main

git switch main

git merge --ff-only renovate/quay.io-oauth2-proxy-oauth2-proxy-7.x

git switch renovate/quay.io-oauth2-proxy-oauth2-proxy-7.x

git rebase main

git switch main

git merge --no-ff renovate/quay.io-oauth2-proxy-oauth2-proxy-7.x

git switch main

git merge --squash renovate/quay.io-oauth2-proxy-oauth2-proxy-7.x

git switch main

git merge --ff-only renovate/quay.io-oauth2-proxy-oauth2-proxy-7.x

git switch main

git merge renovate/quay.io-oauth2-proxy-oauth2-proxy-7.x

git push origin main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sophie/homelab!44

No description provided.

Rows
Columns