Security This release includes an update to Envoy v1.38.5 (from v1.38.2). Please see the following Envoy release notes for a full list of security fixes: https://www.envoyproxy.io/docs/envoy/v1.38.5/version_history/v1.38/v1.38.3 https://www.envoyproxy.io/docs/envoy/v1.38.5/version_history/v1.38/v1.38.4 https://www.envoyproxy.io/docs/envoy/v1.38.5/version_history/v1.38/v1.38.5 Fixes a bug that coul…
Backport e88b32a from #6838 Co-authored-by: Joe Kralicky joekralicky@gmail.com
Backport e88b32a from #6838 Co-authored-by: Joe Kralicky joekralicky@gmail.com
What's Changed Fixes grpc: identify owner and changed options when the outbound connection reloads (#6738) by @wasaga in #6742 mcp: keep ext_proc databroker access working across outbound connection reloads (#6740) by @wasaga in #6744 mcp: negotiate supported token auth endpoint methods based on Oauth2 server metadata by @backport-actions-token[bot] in #6735 Full Changelog: v0.33.1...v0.33.3 Note…
Summary The v0.33.2 release job fails in the goreleaser before hook: go: github.com/goreleaser/goreleaser/v2@v2.18.1: requires go >= 1.27.1 (running go 1.26.8; GOTOOLCHAIN=local) make: *** [Makefile:69: deps-release] Error 1 goreleaser raised its own Go floor to 1.27 in 2.18.0 and 1.27.1 in 2.18.1. This branch pins golang 1.26.8 in .tool-versions, and the release job runs with GOTOOLCHAIN=local, s…
Summary The v0.33.2 release job fails in the goreleaser before hook: go: github.com/goreleaser/goreleaser/v2@v2.18.1: requires go >= 1.27.1 (running go 1.26.8; GOTOOLCHAIN=local) make: *** [Makefile:69: deps-release] Error 1 goreleaser raised its own Go floor to 1.27 in 2.18.0 and 1.27.1 in 2.18.1. This branch pins golang 1.26.8 in .tool-versions, and the release job runs with GOTOOLCHAIN=local, s…
This PR updates dependencies not managed by dependabot. Co-authored-by: GitHub Actions apparitor@users.noreply.github.com
What's Changed Dependency Updates docker: use distroless base-nossl images by @wasaga in #6614 ci: refresh v0.33 security dependencies by @desimone in #6616 Full Changelog: v0.33.0...v0.33.1
This PR updates dependencies not managed by dependabot. Co-authored-by: GitHub Actions apparitor@users.noreply.github.com
This PR updates dependencies not managed by dependabot. Co-authored-by: GitHub Actions apparitor@users.noreply.github.com
What's Changed Breaking remove support for darwin x86_64 by @alexandreLamarre in #6141 Security dependency: update modelcontextprotocol/go-sdk to v1.3.1 by @wasaga in #6127 New core/config: add additional config options by @calebdoxsey in #6056 core/databroker: config service stubs by @calebdoxsey in #6057 mcp: add OAuth 2.1 conformance tests for security behaviors by @wasaga in #6055 feat(health)…
Backport 1aadf5a from #6521 Co-authored-by: Alexandre Lamarre alamarre@pomerium.com
Backport 1aadf5a from #6521 Co-authored-by: Alexandre Lamarre alamarre@pomerium.com
Security This release includes an update to Envoy v1.36.8, to address CVE-2026-47774. What's Changed Changed envoyconfig: increase header size limits by @kenjenkins in #6452 Dependency Updates envoy: update envoy-custom to v1.36.8-p1 by @kenjenkins in #6450 dependency updates for security patches by @kenjenkins in #6454 Full Changelog: v0.32.8...v0.32.9
What's Changed Changed fix for GHSA-ggw3-5987-rx77 backport 6405 to 0.32 by @calebdoxsey in #6422 Full Changelog: v0.32.7...v0.32.8
What's Changed Changed update github.com/jackc/pgx/v5 from 5.8.0 to 5.9.2 by @kenjenkins in #6326 bump Go version to 1.25.10 by @kenjenkins in #6329 Full Changelog: v0.32.6...v0.32.7
What's Changed Changed core/session: remove exp and nbf by @backport-actions-token[bot] in #6306 Full Changelog: v0.32.5...v0.32.6
What's Changed Changed fix: ssh authorization code flow issues empty codes by @backport-actions-token[bot] in #6226 bump Go to 1.25.9 by @kenjenkins in #6248 Dependency Updates dependency updates for v0.32 branch by @kenjenkins in #6230 Full Changelog: v0.32.4...v0.32.5
Test pre-release for Apple certificate rotation verification (OPE-244) This release tests the new Developer ID Installer cert (4CCCBFF1...) for goreleaser macOS signing under bdd@pomerium.com. Do not use in production. This will be deleted after verification.
What's Changed Changed core/autocert: detect use_proxy_protocol changes in http redirect server by @backport-actions-token[bot] in #6192 Full Changelog: v0.32.3...v0.32.4
Security This release includes an update to Envoy v1.36.5, to address the following CVEs: CVE-2026-26330 CVE-2026-26308 CVE-2026-26310 CVE-2026-26311 CVE-2026-26309 What's Changed Changed databroker: add VersionedConfig proto and syncer (#6032) by @kenjenkins in #6128 envoy: update envoy-custom to v1.36.5-p1 by @kenjenkins in #6189 Full Changelog: v0.32.2...v0.32.3
This release is a replacement for v0.32.1 which had a CI failure. Changes Limit sync cache batch size to 128MB to avoid hitting Pebble's 4GB batch limit by @calebdoxsey in #6073 Show a user-friendly error page when MCP client domains are not authorized, and make allowed domains optional by @wasaga in #6066 Update MCP Go SDK to v1.3.1 to fix a message smuggling vulnerability via case-insensitive JS…
Backport e2b8cb8 from #6127 Co-authored-by: Denis Mishin dmishin@pomerium.com