What's Changed Breaking remove support for darwin x86_64 by @alexandreLamarre in #6141 Security dependency: update modelcontextprotocol/go-sdk to v1.3.1 by @wasaga in #6127 New core/config: add additional config options by @calebdoxsey in #6056 core/databroker: config service stubs by @calebdoxsey in #6057 mcp: add OAuth 2.1 conformance tests for security behaviors by @wasaga in #6055 feat(health)…
Backport 1aadf5a from #6521 Co-authored-by: Alexandre Lamarre alamarre@pomerium.com
Backport 1aadf5a from #6521 Co-authored-by: Alexandre Lamarre alamarre@pomerium.com
Security This release includes an update to Envoy v1.36.8, to address CVE-2026-47774. What's Changed Changed envoyconfig: increase header size limits by @kenjenkins in #6452 Dependency Updates envoy: update envoy-custom to v1.36.8-p1 by @kenjenkins in #6450 dependency updates for security patches by @kenjenkins in #6454 Full Changelog: v0.32.8...v0.32.9
What's Changed Changed fix for GHSA-ggw3-5987-rx77 backport 6405 to 0.32 by @calebdoxsey in #6422 Full Changelog: v0.32.7...v0.32.8
What's Changed Changed update github.com/jackc/pgx/v5 from 5.8.0 to 5.9.2 by @kenjenkins in #6326 bump Go version to 1.25.10 by @kenjenkins in #6329 Full Changelog: v0.32.6...v0.32.7
What's Changed Changed core/session: remove exp and nbf by @backport-actions-token[bot] in #6306 Full Changelog: v0.32.5...v0.32.6
What's Changed Changed fix: ssh authorization code flow issues empty codes by @backport-actions-token[bot] in #6226 bump Go to 1.25.9 by @kenjenkins in #6248 Dependency Updates dependency updates for v0.32 branch by @kenjenkins in #6230 Full Changelog: v0.32.4...v0.32.5
Test pre-release for Apple certificate rotation verification (OPE-244) This release tests the new Developer ID Installer cert (4CCCBFF1...) for goreleaser macOS signing under bdd@pomerium.com. Do not use in production. This will be deleted after verification.
What's Changed Changed core/autocert: detect use_proxy_protocol changes in http redirect server by @backport-actions-token[bot] in #6192 Full Changelog: v0.32.3...v0.32.4
Security This release includes an update to Envoy v1.36.5, to address the following CVEs: CVE-2026-26330 CVE-2026-26308 CVE-2026-26310 CVE-2026-26311 CVE-2026-26309 What's Changed Changed databroker: add VersionedConfig proto and syncer (#6032) by @kenjenkins in #6128 envoy: update envoy-custom to v1.36.5-p1 by @kenjenkins in #6189 Full Changelog: v0.32.2...v0.32.3
This release is a replacement for v0.32.1 which had a CI failure. Changes Limit sync cache batch size to 128MB to avoid hitting Pebble's 4GB batch limit by @calebdoxsey in #6073 Show a user-friendly error page when MCP client domains are not authorized, and make allowed domains optional by @wasaga in #6066 Update MCP Go SDK to v1.3.1 to fix a message smuggling vulnerability via case-insensitive JS…
Backport e2b8cb8 from #6127 Co-authored-by: Denis Mishin dmishin@pomerium.com