feat(container): update dexidp/dex ( v2.33.1 → v2.41.1 )

[jarvis-plus-bot]

This PR contains the following updates:

Package	Update	Change	OpenSSF
dexidp/dex	minor	v2.33.1 -> v2.41.1

---

Release Notes

dexidp/dex (dexidp/dex)

v2.41.1

Compare Source

What's Changed

Bug Fixes 🐛

• Fix ldap connection error: network unreachable @​nabokihms in https://github.com/dexidp/dex/pull/3677
• Fix gomplate fork/exec error for distroless images by @​nabokihms in https://github.com/dexidp/dex/pull/3684

Full Changelog: dexidp/dex@v2.41.0...v2.41.1

v2.41.0

Compare Source

What's Changed

Exciting New Features 🎉

• Enrich Dex logs with real IP and request ID by @​nabokihms in https://github.com/dexidp/dex/pull/3661
• gRPC Connectors API by @​twoojoo in https://github.com/dexidp/dex/pull/3245

[!IMPORTANT]
Connectors API is disabled by default. Set the DEX_API_CONNECTORS_CRUD=true env variable to enable the feature.

Enhancements 🚀

• Prevent double clicking of the submit button on login by @​pcorliss in https://github.com/dexidp/dex/pull/3554
• Gracefully handle no args being passed to entrypoint by @​rgmz in https://github.com/dexidp/dex/pull/3589
• New Prometheus metrics build_info by @​nlamirault in https://github.com/dexidp/dex/pull/3558
• Always retrieve github emails when preferredEmailDomain is set by @​thesuperzapper in https://github.com/dexidp/dex/pull/3584
• Propagate http.Client to JWT verifier for OIDC connector by @​jack-r-warren in https://github.com/dexidp/dex/pull/3641
• Fix the broken link to v2 page by @​tuladhar in https://github.com/dexidp/dex/pull/3648
• Add regex for oidc group matching by @​jacksonargo in https://github.com/dexidp/dex/pull/3063

Bug Fixes 🐛

• Remove additional features and add a feature flag instead by @​nabokihms in https://github.com/dexidp/dex/pull/3663

Dependency Updates ⬆️

• build(deps): bump github.com/spf13/cobra from 1.8.0 to 1.8.1 in /examples by @​dependabot in https://github.com/dexidp/dex/pull/3582
• build(deps): bump actions/attest-build-provenance from 1.1.2 to 1.3.1 by @​dependabot in https://github.com/dexidp/dex/pull/3580
• build(deps): bump github/codeql-action from 3.25.7 to 3.25.12 by @​dependabot in https://github.com/dexidp/dex/pull/3619
• build(deps): bump actions/dependency-review-action from 4.3.2 to 4.3.4 by @​dependabot in https://github.com/dexidp/dex/pull/3618
• build(deps): bump google.golang.org/grpc from 1.64.0 to 1.65.0 by @​dependabot in https://github.com/dexidp/dex/pull/3617
• build(deps): bump aquasecurity/trivy-action from 0.21.0 to 0.24.0 by @​dependabot in https://github.com/dexidp/dex/pull/3615
• build(deps): bump google.golang.org/grpc from 1.64.0 to 1.64.1 in /examples in the go_modules group by @​dependabot in https://github.com/dexidp/dex/pull/3612
• build(deps): bump distroless/static-debian12 from e9ac71e to 8dd8d3c by @​dependabot in https://github.com/dexidp/dex/pull/3604
• build(deps): bump docker/build-push-action from 5.3.0 to 6.3.0 by @​dependabot in https://github.com/dexidp/dex/pull/3603
• build(deps): bump github.com/coreos/go-oidc/v3 from 3.10.0 to 3.11.0 in /examples by @​dependabot in https://github.com/dexidp/dex/pull/3609
• build(deps): bump golang.org/x/net from 0.25.0 to 0.27.0 by @​dependabot in https://github.com/dexidp/dex/pull/3606
• build(deps): bump golang.org/x/crypto from 0.23.0 to 0.25.0 by @​dependabot in https://github.com/dexidp/dex/pull/3605
• build(deps): bump alpine from 3.20.0 to 3.20.1 by @​dependabot in https://github.com/dexidp/dex/pull/3591
• build(deps): bump google.golang.org/grpc from 1.64.0 to 1.65.0 in /examples by @​dependabot in https://github.com/dexidp/dex/pull/3600
• build(deps): bump golang.org/x/oauth2 from 0.20.0 to 0.21.0 by @​dependabot in https://github.com/dexidp/dex/pull/3567
• build(deps): bump github.com/coreos/go-oidc/v3 from 3.10.0 to 3.11.0 by @​dependabot in https://github.com/dexidp/dex/pull/3627
• build(deps): bump actions/checkout from 4.1.6 to 4.1.7 by @​dependabot in https://github.com/dexidp/dex/pull/3621
• build(deps): bump docker/setup-qemu-action from 3.0.0 to 3.1.0 by @​dependabot in https://github.com/dexidp/dex/pull/3625
• build(deps): bump actions/attest-build-provenance from 1.3.1 to 1.3.3 by @​dependabot in https://github.com/dexidp/dex/pull/3624
• build(deps): bump google.golang.org/protobuf from 1.34.1 to 1.34.2 by @​dependabot in https://github.com/dexidp/dex/pull/3631
• build(deps): bump anchore/sbom-action from 0.16.0 to 0.17.0 by @​dependabot in https://github.com/dexidp/dex/pull/3630
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.0.2 to 4.0.3 by @​dependabot in https://github.com/dexidp/dex/pull/3626
• build(deps): bump actions/setup-go from 5.0.1 to 5.0.2 by @​dependabot in https://github.com/dexidp/dex/pull/3622
• build(deps): bump docker/build-push-action from 6.3.0 to 6.4.0 by @​dependabot in https://github.com/dexidp/dex/pull/3623
• build(deps): bump docker/setup-buildx-action from 3.3.0 to 3.4.0 by @​dependabot in https://github.com/dexidp/dex/pull/3629
• build(deps): bump github.com/AppsFlyer/go-sundheit from 0.5.0 to 0.5.1 by @​dependabot in https://github.com/dexidp/dex/pull/3635
• build(deps): bump docker/build-push-action from 6.4.0 to 6.4.1 by @​dependabot in https://github.com/dexidp/dex/pull/3633
• build(deps): bump github.com/spf13/cobra from 1.8.0 to 1.8.1 by @​dependabot in https://github.com/dexidp/dex/pull/3634
• Update dependencies before Dex v2.41 by @​nabokihms in https://github.com/dexidp/dex/pull/3637
• build(deps): bump alpine from 3.20.1 to 3.20.2 by @​dependabot in https://github.com/dexidp/dex/pull/3647
• build(deps): bump google.golang.org/api from 0.182.0 to 0.189.0 by @​dependabot in https://github.com/dexidp/dex/pull/3646
• build(deps): bump github/codeql-action from 3.25.12 to 3.25.14 by @​dependabot in https://github.com/dexidp/dex/pull/3651
• build(deps): bump actions/upload-artifact from 3.1.3 to 4.3.4 by @​dependabot in https://github.com/dexidp/dex/pull/3607
• build(deps): bump golang from 8c9183f to 0d3653d by @​dependabot in https://github.com/dexidp/dex/pull/3657
• FIx CVE before Dex v2.41 by @​nabokihms in https://github.com/dexidp/dex/pull/3653
• Bump gomplate 4.0.1 by @​MoeBensu in https://github.com/dexidp/dex/pull/3652
• build(deps): bump github.com/AppsFlyer/go-sundheit from 0.5.1 to 0.6.0 by @​dependabot in https://github.com/dexidp/dex/pull/3655
• build(deps): bump docker/setup-buildx-action from 3.4.0 to 3.6.1 by @​dependabot in https://github.com/dexidp/dex/pull/3658
• build(deps): bump go.etcd.io/etcd/client/v3 from 3.5.14 to 3.5.15 by @​dependabot in https://github.com/dexidp/dex/pull/3639
• build(deps): bump docker/setup-qemu-action from 3.1.0 to 3.2.0 by @​dependabot in https://github.com/dexidp/dex/pull/3645
• build(deps): bump ossf/scorecard-action from 2.3.3 to 2.4.0 by @​dependabot in https://github.com/dexidp/dex/pull/3656
• build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0 by @​dependabot in https://github.com/dexidp/dex/pull/3643
• build(deps): bump docker/login-action from 3.2.0 to 3.3.0 by @​dependabot in https://github.com/dexidp/dex/pull/3644
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.0.3 to 4.0.4 by @​dependabot in https://github.com/dexidp/dex/pull/3666
• build(deps): bump google.golang.org/api from 0.189.0 to 0.190.0 by @​dependabot in https://github.com/dexidp/dex/pull/3667
• build(deps): bump actions/attest-build-provenance from 1.3.3 to 1.4.0 by @​dependabot in https://github.com/dexidp/dex/pull/3665
• Bump ent v0.14.0 by @​nabokihms in https://github.com/dexidp/dex/pull/3670
• build(deps): bump github/codeql-action from 3.25.14 to 3.25.15 by @​dependabot in https://github.com/dexidp/dex/pull/3664

New Contributors

• @​pcorliss made their first contribution in https://github.com/dexidp/dex/pull/3554
• @​rgmz made their first contribution in https://github.com/dexidp/dex/pull/3589
• @​nlamirault made their first contribution in https://github.com/dexidp/dex/pull/3558
• @​thesuperzapper made their first contribution in https://github.com/dexidp/dex/pull/3584
• @​twoojoo made their first contribution in https://github.com/dexidp/dex/pull/3245
• @​jack-r-warren made their first contribution in https://github.com/dexidp/dex/pull/3641
• @​tuladhar made their first contribution in https://github.com/dexidp/dex/pull/3648
• @​MoeBensu made their first contribution in https://github.com/dexidp/dex/pull/3652
• @​jacksonargo made their first contribution in https://github.com/dexidp/dex/pull/3063

Full Changelog: dexidp/dex@v2.40.0...v2.41.0

v2.40.0

Compare Source

The official container image for this release can be pulled from

ghcr.io/dexidp/dex:v2.40.0

Know before update

[!IMPORTANT]
Dex migrated to the log/slog for logging. Both text and json log format outputs changed.

The change can affect users, that import Dex as a library in their projects.

What's Changed

Exciting New Features 🎉

• Add introspect endpoint to introspect access & refresh token by @​supercairos in https://github.com/dexidp/dex/pull/3404
• Use log/slog for structured logging by @​seankhliao in https://github.com/dexidp/dex/pull/3502

Enhancements 🚀

• Add support for configurable prompt type for Google connector by @​abhisek in https://github.com/dexidp/dex/pull/3475
• Google: Implement groups fetch by default service account from metadata (support for GKE workload identity) by @​vsychov in https://github.com/dexidp/dex/pull/2989
• OIDC connector option to override jwksURI by @​sohgaura in https://github.com/dexidp/dex/pull/3543
• Allow domain names or IDs in keystone connector by @​cardoe in https://github.com/dexidp/dex/pull/3506

Bug Fixes 🐛

• Fix function names in comment by @​mountcount in https://github.com/dexidp/dex/pull/3464
• Fix slight grammar errors. by @​adeinega in https://github.com/dexidp/dex/pull/3538

Dependency Updates ⬆️

• build(deps): bump google.golang.org/api from 0.172.0 to 0.179.0 by @​dependabot in https://github.com/dexidp/dex/pull/3516
• build(deps): bump golang from 1.22.2-alpine3.18 to 1.22.3-alpine3.18 by @​dependabot in https://github.com/dexidp/dex/pull/3514
• build(deps): bump aquasecurity/trivy-action from 0.18.0 to 0.20.0 by @​dependabot in https://github.com/dexidp/dex/pull/3512
• build(deps): bump golang.org/x/oauth2 from 0.19.0 to 0.20.0 in /examples by @​dependabot in https://github.com/dexidp/dex/pull/3508
• build(deps): bump anchore/sbom-action from 0.15.9 to 0.15.11 by @​dependabot in https://github.com/dexidp/dex/pull/3497
• build(deps): bump golang.org/x/net from 0.20.0 to 0.23.0 in /api/v2 in the go_modules group by @​dependabot in https://github.com/dexidp/dex/pull/3483
• build(deps): bump sigstore/cosign-installer from 3.4.0 to 3.5.0 by @​dependabot in https://github.com/dexidp/dex/pull/3472
• build(deps): bump distroless/static-debian12 from 42c8865 to e9ac71e by @​dependabot in https://github.com/dexidp/dex/pull/3469
• build(deps): bump docker/setup-buildx-action from 3.2.0 to 3.3.0 by @​dependabot in https://github.com/dexidp/dex/pull/3462
• build(deps): bump google.golang.org/protobuf from 1.33.0 to 1.34.1 in /api/v2 by @​dependabot in https://github.com/dexidp/dex/pull/3510
• build(deps): bump github.com/prometheus/client_golang from 1.19.0 to 1.19.1 by @​dependabot in https://github.com/dexidp/dex/pull/3526
• build(deps): bump google.golang.org/api from 0.179.0 to 0.180.0 by @​dependabot in https://github.com/dexidp/dex/pull/3525
• build(deps): bump actions/dependency-review-action from 4.2.5 to 4.3.2 by @​dependabot in https://github.com/dexidp/dex/pull/3524
• build(deps): bump helm/kind-action from 1.9.0 to 1.10.0 by @​dependabot in https://github.com/dexidp/dex/pull/3523
• build(deps): bump github/codeql-action from 3.24.10 to 3.25.4 by @​dependabot in https://github.com/dexidp/dex/pull/3522
• build(deps): bump mheap/github-action-required-labels from 5.4.0 to 5.4.1 by @​dependabot in https://github.com/dexidp/dex/pull/3521
• build(deps): bump actions/setup-go from 5.0.0 to 5.0.1 by @​dependabot in https://github.com/dexidp/dex/pull/3520
• build(deps): bump google.golang.org/grpc from 1.62.1 to 1.63.2 in /api/v2 by @​dependabot in https://github.com/dexidp/dex/pull/3465
• build(deps): bump google.golang.org/grpc from 1.62.1 to 1.63.2 in /examples by @​dependabot in https://github.com/dexidp/dex/pull/3460
• build(deps): bump alpine from 3.19.1 to 3.20.0 by @​dependabot in https://github.com/dexidp/dex/pull/3547
• build(deps): bump anchore/sbom-action from 0.15.11 to 0.16.0 by @​dependabot in https://github.com/dexidp/dex/pull/3545
• build(deps): bump github/codeql-action from 3.25.4 to 3.25.6 by @​dependabot in https://github.com/dexidp/dex/pull/3544
• build(deps): bump actions/checkout from 4.1.2 to 4.1.6 by @​dependabot in https://github.com/dexidp/dex/pull/3542
• build(deps): bump google.golang.org/api from 0.180.0 to 0.181.0 by @​dependabot in https://github.com/dexidp/dex/pull/3541
• build(deps): bump golang from 4531927 to ff6ab2b by @​dependabot in https://github.com/dexidp/dex/pull/3536
• build(deps): bump ossf/scorecard-action from 2.3.1 to 2.3.3 by @​dependabot in https://github.com/dexidp/dex/pull/3534
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.0.1 to 4.0.2 by @​dependabot in https://github.com/dexidp/dex/pull/3531
• build(deps): bump github.com/beevik/etree from 1.3.0 to 1.4.0 by @​dependabot in https://github.com/dexidp/dex/pull/3530
• build(deps): bump google.golang.org/grpc from 1.63.2 to 1.64.0 in /examples by @​dependabot in https://github.com/dexidp/dex/pull/3535
• build(deps): bump docker/login-action from 3.1.0 to 3.2.0 by @​dependabot in https://github.com/dexidp/dex/pull/3551
• build(deps): bump golang from ff6ab2b to d1a601b by @​dependabot in https://github.com/dexidp/dex/pull/3550
• build(deps): bump aquasecurity/trivy-action from 0.20.0 to 0.21.0 by @​dependabot in https://github.com/dexidp/dex/pull/3552
• Bump google.golang.org/grpc to v1.64.0 by @​nabokihms in https://github.com/dexidp/dex/pull/3553
• build(deps): bump go.etcd.io/etcd/client/pkg/v3 from 3.5.13 to 3.5.14 by @​dependabot in https://github.com/dexidp/dex/pull/3555
• build(deps): bump go.etcd.io/etcd/client/v3 from 3.5.13 to 3.5.14 by @​dependabot in https://github.com/dexidp/dex/pull/3556
• build(deps): bump github/codeql-action from 3.25.6 to 3.25.7 by @​dependabot in https://github.com/dexidp/dex/pull/3561
• Bump gomplate 3.11.8 by @​nabokihms in https://github.com/dexidp/dex/pull/3565

New Contributors

• @​elehcim made their first contribution in https://github.com/dexidp/dex/pull/3474
• @​abhisek made their first contribution in https://github.com/dexidp/dex/pull/3475
• @​mountcount made their first contribution in https://github.com/dexidp/dex/pull/3464
• @​adeinega made their first contribution in https://github.com/dexidp/dex/pull/3538
• @​sohgaura made their first contribution in https://github.com/dexidp/dex/pull/3543
• @​cardoe made their first contribution in https://github.com/dexidp/dex/pull/3506

Full Changelog: dexidp/dex@v2.39.1...v2.40.0

v2.39.1

Compare Source

The official container image for this release can be pulled from

ghcr.io/dexidp/dex:v2.39.1

Bug Fixes 🐛

• Update max length of Kubernetes object to fit Kubernetes policy by @​RomanenkoDenys in https://github.com/dexidp/dex/pull/3439 (fix regression for Kubernetes storage)

• Do not escape password for LDAP connectors by @​nabokihms in https://github.com/dexidp/dex/pull/3470 (changes introduced in v2.39.0 were reverted)

v2.39.0

Compare Source

The official container image for this release can be pulled from

ghcr.io/dexidp/dex:v2.39.0

Know before update

[!WARNING]
The validation of username and password in the LDAP connector is much more strict now.
As of today, Dex uses the EscapeFilter function to check for special characters in credentials and prevent injections by denying such requests.

the special characters in the set ()*\ and those out of the range 0 < c < 0x80, as defined in RFC4515

What's Changed

Enhancements 🚀

• Also set the username in authproxy connector by @​ppacher in https://github.com/dexidp/dex/pull/3307
• Log failed login attempt by @​i-amelia in https://github.com/dexidp/dex/pull/2454
• Update ent by @​sagikazarmark in https://github.com/dexidp/dex/pull/3379
• Add sanitizer to LDAP account and password by @​hsinhoyeh in https://github.com/dexidp/dex/pull/3372
• Add headers control to Dex web server by @​nabokihms in https://github.com/dexidp/dex/pull/3339
• OIDC connector: Allow specifying empty prompt type by @​nabokihms in https://github.com/dexidp/dex/pull/3373
• Set read-only permissions to the check job by @​nabokihms in https://github.com/dexidp/dex/pull/3415

Bug Fixes 🐛

• Use the correct token type for userInfo requests while Token Exchange by @​MrDeerly in https://github.com/dexidp/dex/pull/3336
• Do not evaluate skipApproval on the approval page by @​MM53 in https://github.com/dexidp/dex/pull/3086

Dependency Updates ⬆️

• build(deps): bump anchore/sbom-action from 0.15.5 to 0.15.6 by @​dependabot in https://github.com/dexidp/dex/pull/3314
• build(deps): bump github.com/mattn/go-sqlite3 from 1.14.19 to 1.14.22 by @​dependabot in https://github.com/dexidp/dex/pull/3328
• build(deps): bump github/codeql-action from 3.23.1 to 3.24.0 by @​dependabot in https://github.com/dexidp/dex/pull/3327
• build(deps): bump anchore/sbom-action from 0.15.6 to 0.15.8 by @​dependabot in https://github.com/dexidp/dex/pull/3325
• build(deps): bump go.etcd.io/etcd/client/pkg/v3 from 3.5.11 to 3.5.12 by @​dependabot in https://github.com/dexidp/dex/pull/3323
• build(deps): bump google.golang.org/api from 0.157.0 to 0.161.0 by @​dependabot in https://github.com/dexidp/dex/pull/3317
• build(deps): bump alpine from 3.19.0 to 3.19.1 by @​dependabot in https://github.com/dexidp/dex/pull/3311
• build(deps): bump golang from 3bd4475 to 3354c3a by @​dependabot in https://github.com/dexidp/dex/pull/3310
• build(deps): bump mheap/github-action-required-labels from 5.1.0 to 5.2.0 by @​dependabot in https://github.com/dexidp/dex/pull/3308
• build(deps): bump sigstore/cosign-installer from 3.2.0 to 3.4.0 by @​dependabot in https://github.com/dexidp/dex/pull/3324
• build(deps): bump go.etcd.io/etcd/client/v3 from 3.5.11 to 3.5.12 by @​dependabot in https://github.com/dexidp/dex/pull/3321
• build(deps): bump golang.org/x/oauth2 from 0.16.0 to 0.17.0 in /examples by @​dependabot in https://github.com/dexidp/dex/pull/3340
• build(deps): bump tonistiigi/xx from 1.3.0 to 1.4.0 by @​dependabot in https://github.com/dexidp/dex/pull/3333
• build(deps): bump golang.org/x/oauth2 from 0.16.0 to 0.17.0 by @​dependabot in https://github.com/dexidp/dex/pull/3341
• build(deps): bump google.golang.org/grpc from 1.61.0 to 1.61.1 in /examples by @​dependabot in https://github.com/dexidp/dex/pull/3352
• build(deps): bump distroless/static from 9be3fcc to a43abc8 by @​dependabot in https://github.com/dexidp/dex/pull/3350
• build(deps): bump aquasecurity/trivy-action from 0.16.1 to 0.17.0 by @​dependabot in https://github.com/dexidp/dex/pull/3332
• build(deps): bump docker/metadata-action from 5.5.0 to 5.5.1 by @​dependabot in https://github.com/dexidp/dex/pull/3330
• build(deps): bump mheap/github-action-required-labels from 5.2.0 to 5.3.0 by @​dependabot in https://github.com/dexidp/dex/pull/3347
• build(deps): bump helm/kind-action from 1.8.0 to 1.9.0 by @​dependabot in https://github.com/dexidp/dex/pull/3345
• build(deps): bump github/codeql-action from 3.24.0 to 3.24.3 by @​dependabot in https://github.com/dexidp/dex/pull/3360
• build(deps): bump google.golang.org/api from 0.161.0 to 0.165.0 by @​dependabot in https://github.com/dexidp/dex/pull/3355
• build(deps): bump actions/dependency-review-action from 4.0.0 to 4.1.0 by @​dependabot in https://github.com/dexidp/dex/pull/3359
• build(deps): bump golang.org/x/crypto from 0.19.0 to 0.20.0 by @​dependabot in https://github.com/dexidp/dex/pull/3377
• build(deps): bump google.golang.org/api from 0.165.0 to 0.167.0 by @​dependabot in https://github.com/dexidp/dex/pull/3376
• build(deps): bump github/codeql-action from 3.24.3 to 3.24.5 by @​dependabot in https://github.com/dexidp/dex/pull/3375
• build(deps): bump distroless/static from a43abc8 to 072d78b by @​dependabot in https://github.com/dexidp/dex/pull/3374
• build(deps): bump google.golang.org/grpc from 1.61.1 to 1.62.0 in /examples by @​dependabot in https://github.com/dexidp/dex/pull/3368
• build(deps): bump actions/dependency-review-action from 4.1.0 to 4.1.3 by @​dependabot in https://github.com/dexidp/dex/pull/3363
• build(deps): bump haya14busa/action-cond from 1.1.1 to 1.2.1 by @​dependabot in https://github.com/dexidp/dex/pull/3346
• build(deps): bump golang from 1.21.6-alpine3.18 to 1.22.0-alpine3.18 by @​dependabot in https://github.com/dexidp/dex/pull/3334
• build(deps): bump google.golang.org/grpc from 1.61.0 to 1.62.0 by @​dependabot in https://github.com/dexidp/dex/pull/3367
• build(deps): bump google.golang.org/grpc from 1.61.0 to 1.62.0 in /api/v2 by @​dependabot in https://github.com/dexidp/dex/pull/3365
• build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.1 to 3.0.3 by @​dependabot in https://github.com/dexidp/dex/pull/3405
• build(deps): bump github.com/prometheus/client_golang from 1.18.0 to 1.19.0 by @​dependabot in https://github.com/dexidp/dex/pull/3380
• build(deps): bump golang from 1.22.0-alpine3.18 to 1.22.1-alpine3.18 by @​dependabot in https://github.com/dexidp/dex/pull/3398
• build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.1 to 3.0.3 in /examples by @​dependabot in https://github.com/dexidp/dex/pull/3406
• build(deps): bump google.golang.org/api from 0.167.0 to 0.169.0 by @​dependabot in https://github.com/dexidp/dex/pull/3407
• Update jose by @​nabokihms in https://github.com/dexidp/dex/pull/3409
• build(deps): bump distroless/static from 072d78b to 9235ad9 by @​dependabot in https://github.com/dexidp/dex/pull/3381
• build(deps): bump docker/setup-buildx-action from 3.0.0 to 3.1.0 by @​dependabot in https://github.com/dexidp/dex/pull/3382
• build(deps): bump aquasecurity/trivy-action from 0.17.0 to 0.18.0 by @​dependabot in https://github.com/dexidp/dex/pull/3384
• build(deps): bump github/codeql-action from 3.24.5 to 3.24.6 by @​dependabot in https://github.com/dexidp/dex/pull/3386
• build(deps): bump anchore/sbom-action from 0.15.8 to 0.15.9 by @​dependabot in https://github.com/dexidp/dex/pull/3397
• build(deps): bump golang.org/x/oauth2 from 0.17.0 to 0.18.0 by @​dependabot in https://github.com/dexidp/dex/pull/3393
• build(deps): bump golang.org/x/oauth2 from 0.17.0 to 0.18.0 in /examples by @​dependabot in https://github.com/dexidp/dex/pull/3394
• build(deps): bump google.golang.org/grpc from 1.62.0 to 1.62.1 in /examples by @​dependabot in https://github.com/dexidp/dex/pull/3401
• build(deps): bump github.com/go-sql-driver/mysql from 1.7.1 to 1.8.0 by @​dependabot in https://github.com/dexidp/dex/pull/3414
• build(deps): bump google.golang.org/protobuf from 1.32.0 to 1.33.0 by @​dependabot in https://github.com/dexidp/dex/pull/3413
• build(deps): bump distroless/static from 9235ad9 to 7e5c6a2 by @​dependabot in https://github.com/dexidp/dex/pull/3410
• build(deps): bump docker/build-push-action from 5.1.0 to 5.2.0 by @​dependabot in https://github.com/dexidp/dex/pull/3411
• build(deps): bump google.golang.org/grpc from 1.62.0 to 1.62.1 by @​dependabot in https://github.com/dexidp/dex/pull/3412
• build(deps): bump github.com/stretchr/testify from 1.8.4 to 1.9.0 by @​dependabot in https://github.com/dexidp/dex/pull/3389
• build(deps): bump actions/checkout from 4.1.1 to 4.1.2 by @​dependabot in https://github.com/dexidp/dex/pull/3417
• build(deps): bump github/codeql-action from 3.24.6 to 3.24.8 by @​dependabot in https://github.com/dexidp/dex/pull/3422
• build(deps): bump google.golang.org/api from 0.169.0 to 0.171.0 by @​dependabot in https://github.com/dexidp/dex/pull/3426
• build(deps): bump docker/login-action from 3.0.0 to 3.1.0 by @​dependabot in https://github.com/dexidp/dex/pull/3418
• build(deps): bump github.com/coreos/go-oidc/v3 from 3.9.0 to 3.10.0 in /examples by @​dependabot in https://github.com/dexidp/dex/pull/3424
• build(deps): bump github.com/coreos/go-oidc/v3 from 3.9.0 to 3.10.0 by @​dependabot in https://github.com/dexidp/dex/pull/3425
• build(deps): bump docker/build-push-action from 5.2.0 to 5.3.0 by @​dependabot in https://github.com/dexidp/dex/pull/3420
• build(deps): bump golang from 010f3b3 to ede158f by @​dependabot in https://github.com/dexidp/dex/pull/3421
• build(deps): bump google.golang.org/grpc from 1.62.0 to 1.62.1 in /api/v2 by @​dependabot in https://github.com/dexidp/dex/pull/3399
• build(deps): bump google.golang.org/protobuf from 1.32.0 to 1.33.0 in /api/v2 by @​dependabot in https://github.com/dexidp/dex/pull/3400

New Contributors

• @​ppacher made their first contribution in https://github.com/dexidp/dex/pull/3307
• @​MrDeerly made their first contribution in https://github.com/dexidp/dex/pull/3336
• @​i-amelia made their first contribution in https://github.com/dexidp/dex/pull/2454
• @​hsinhoyeh made their first contribution in https://github.com/dexidp/dex/pull/3372

Full Changelog: dexidp/dex@v2.38.0...v2.39.0

v2.38.0

Compare Source

The official container image for this release can be pulled from

ghcr.io/dexidp/dex:v2.38.0

What's Changed

Exciting New Features 🎉

• RFC 8693 OAuth 2.0 Token Exchange by @​seankhliao in https://github.com/dexidp/dex/pull/2806

Enhancements 🚀

• include granttypes in example config by @​seankhliao in https://github.com/dexidp/dex/pull/3027
• Add GetClient grpc service by @​marcofranssen in https://github.com/dexidp/dex/pull/2972
• feat: Update response_types_supported to allow multiple-valued response type combinations by @​Cedric-Magnan in https://github.com/dexidp/dex/pull/2521
• verify access tokens by checking getuserinfo during a token exchange by @​seankhliao in https://github.com/dexidp/dex/pull/3031
• Store offline sessions only if they were requested by the user by @​MM53 in https://github.com/dexidp/dex/pull/3125
• Minimalistic support for group filtering in oidc connector by @​mdpradeep in https://github.com/dexidp/dex/pull/3074
• feat(connector/microsoft): support custom api and graph URLs by @​sagikazarmark in https://github.com/dexidp/dex/pull/3084
• Composite claims in OIDC connector by @​Oded-B in https://github.com/dexidp/dex/pull/3056
• Add support for extra claims to authproxy connector by @​mkjpryor in https://github.com/dexidp/dex/pull/2851
• Add support for linux/s390x by @​lysliu in https://github.com/dexidp/dex/pull/3189
• Override OIDC provider discovered claims by @​nabokihms in https://github.com/dexidp/dex/pull/3267
• Bump gomplate to v3.11.7 by @​nabokihms in https://github.com/dexidp/dex/pull/3293
• Introduce a dedicated pkg for featureflags by @​nabokihms in https://github.com/dexidp/dex/pull/3278
• Sign container images by @​nabokihms in https://github.com/dexidp/dex/pull/3269
• Add context to storage's Create endpoints by @​PumpkinSeed in https://github.com/dexidp/dex/pull/2935
• feat: add TLS versions configuration by @​tuminoid in https://github.com/dexidp/dex/pull/3303

Bug Fixes 🐛

• Fix etcd device requests by @​MM53 in https://github.com/dexidp/dex/pull/3119
• Fix lint errors after merging AllowedHeaders feature by @​nabokihms in https://github.com/dexidp/dex/pull/3247
• Propagate Dex version from build args by @​nabokihms in https://github.com/dexidp/dex/pull/3276

Dependency Updates ⬆️

• build(deps): bump golang.org/x/net from 0.11.0 to 0.12.0 by @​dependabot in https://github.com/dexidp/dex/pull/3036
• build(deps): bump google.golang.org/api from 0.129.0 to 0.130.0 by @​dependabot in https://github.com/dexidp/dex/pull/3034
• build(deps): bump golang.org/x/crypto from 0.10.0 to 0.11.0 by @​dependabot in https://github.com/dexidp/dex/pull/3035
• build(deps): bump helm/kind-action from 1.7.0 to 1.8.0 by @​dependabot in https://github.com/dexidp/dex/pull/3041
• build(deps): bump google.golang.org/api from 0.130.0 to 0.134.0 by @​dependabot in https://github.com/dexidp/dex/pull/3054
• build(deps): bump docker/setup-buildx-action from 2.8.0 to 2.9.1 by @​dependabot in https://github.com/dexidp/dex/pull/3043
• build(deps): bump github/codeql-action from 2.20.1 to 2.21.2 by @​dependabot in https://github.com/dexidp/dex/pull/3057
• build(deps): bump google.golang.org/grpc from 1.56.1 to 1.57.0 by @​dependabot in https://github.com/dexidp/dex/pull/3055
• build(deps): bump google.golang.org/protobuf from 1.30.0 to 1.31.0 in /api/v2 by @​dependabot in https://github.com/dexidp/dex/pull/3021
• build(deps): bump google.golang.org/grpc from 1.55.0 to 1.57.0 in /api/v2 by @​dependabot in https://github.com/dexidp/dex/pull/3053
• build(deps): bump golang.org/x/net from 0.12.0 to 0.13.0 by @​dependabot in https://github.com/dexidp/dex/pull/3060
• build(deps): bump google.golang.org/api from 0.134.0 to 0.138.0 by @​dependabot in https://github.com/dexidp/dex/pull/3079
• build(deps): bump actions/dependency-review-action from 3.0.6 to 3.0.8 by @​dependabot in https://github.com/dexidp/dex/pull/3078
• build(deps): bump github/codeql-action from 2.21.2 to 2.21.4 by @​dependabot in https://github.com/dexidp/dex/pull/3076
• build(deps): bump actions/setup-go from 4.0.1 to 4.1.0 by @​dependabot in https://github.com/dexidp/dex/pull/3071
• build(deps): bump alpine from 3.18.2 to 3.18.3 by @​dependabot in https://github.com/dexidp/dex/pull/3069
• build(deps): bump aquasecurity/trivy-action from 0.11.2 to 0.12.0 by @​dependabot in https://github.com/dexidp/dex/pull/3090
• build(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 by @​dependabot in https://github.com/dexidp/dex/pull/3099
• build(deps): bump docker/setup-buildx-action from 2.9.1 to 3.0.0 by @​dependabot in https://github.com/dexidp/dex/pull/3104
• build(deps): bump actions/checkout from 3.5.3 to 4.1.0 by @​dependabot in https://github.com/dexidp/dex/pull/3117
• build(deps): bump alpine from 3.18.3 to 3.18.4 by @​dependabot in https://github.com/dexidp/dex/pull/3130
• build(deps): bump github/codeql-action from 2.21.4 to 2.21.9 by @​dependabot in https://github.com/dexidp/dex/pull/3127
• build(deps): bump google.golang.org/api from 0.138.0 to 0.143.0 by @​dependabot in https://github.com/dexidp/dex/pull/3121
• build(deps): bump google.golang.org/grpc from 1.57.0 to 1.58.2 by @​dependabot in https://github.com/dexidp/dex/pull/3116
• build(deps): bump google.golang.org/grpc from 1.57.0 to 1.58.2 in /api/v2 by @​dependabot in https://github.com/dexidp/dex/pull/3115
• build(deps): bump github.com/prometheus/client_golang from 1.16.0 to 1.17.0 by @​dependabot in https://github.com/dexidp/dex/pull/3132
• build(deps): bump github.com/go-ldap/ldap/v3 from 3.4.5 to 3.4.6 by @​dependabot in https://github.com/dexidp/dex/pull/3133
• build(deps): bump docker/login-action from 2.2.0 to 3.0.0 by @​dependabot in https://github.com/dexidp/dex/pull/3134
• build(deps): bump docker/build-push-action from 4.1.1 to 5.0.0 by @​dependabot in https://github.com/dexidp/dex/pull/3135
• build(deps): bump docker/metadata-action from 4.6.0 to 5.0.0 by @​dependabot in https://github.com/dexidp/dex/pull/3136
• build(deps): bump actions/dependency-review-action from 3.0.8 to 3.1.0 by @​dependabot in https://github.com/dexidp/dex/pull/3137
• build(deps): bump docker/setup-qemu-action from 2.2.0 to 3.0.0 by @​dependabot in https://github.com/dexidp/dex/pull/3138
• build(deps): bump google.golang.org/api from 0.143.0 to 0.147.0 by @​dependabot in https://github.com/dexidp/dex/pull/3152
• build(deps): bump google.golang.org/grpc from 1.58.2 to 1.58.3 by @​dependabot in [https://github.com/build(deps): bump google.golang.org/grpc from 1.58.2 to 1.58.3 dexidp/dex#3155](https://redirect.gith

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[github-actions]

no HelmRelease objects found in cluster