BREAKING: Licensing change for official Pomerium builds Starting with v0.34, official Pomerium Core binaries and container images use the Pomerium Community Edition License. Source code remains licensed under Apache 2.0. Review the licensing announcement for eligibility and commercial licensing requirements before upgrading. What's Changed Breaking feat(github): use node_ids for user ids by @caleb…
Summary The most recent versions of OPA upgrade the github.com/gobwas/glob package, which breaks otel, because it hasn't been upgraded to be compatible yet. Related issues User Explanation AI disclosure Checklist reference any related issues updated unit tests add appropriate label (enhancement, bug, breaking, dependencies, ci) disclosed AI usage (or wrote "none") per AI_POLICY.md ready for review
Summary The most recent versions of OPA upgrade the github.com/gobwas/glob package, which breaks otel, because it hasn't been upgraded to be compatible yet. Related issues User Explanation AI disclosure Checklist reference any related issues updated unit tests add appropriate label (enhancement, bug, breaking, dependencies, ci) disclosed AI usage (or wrote "none") per AI_POLICY.md ready for review
What's Changed Changed fix: update distroless CA bundles (0.33) by @desimone in #6912 Full Changelog: v0.33.5...v0.33.6
Update distroless images so Envoy rejects the compromised eMudhra chains. Use Debian's corrected bundle and package metadata, following Envoy #48729. Tested both architectures with live TLS rejection and public CA controls. AI: Codex implementation and testing.
Update distroless images so Envoy rejects the compromised eMudhra chains. Use Debian's corrected bundle and package metadata, following Envoy #48729. Tested both architectures with live TLS rejection and public CA controls. AI: Codex implementation and testing.
Full Changelog: v0.33.4...v0.33.5
Backport d383a3d from #6909 Adapted for 0-33-0: go-sdk v1.5.0 decodes a message with a null method as a response; reject a body that has a method member but did not decode as a request. hegel v0.6.27 has no T.Event; drop the coverage labels. ext_proc_outbound_reload_test sends a well-formed MCP request.
Backport d383a3d from #6909 Adapted for 0-33-0: go-sdk v1.5.0 decodes a message with a null method as a response; reject a body that has a method member but did not decode as a request. hegel v0.6.27 has no T.Event; drop the coverage labels. ext_proc_outbound_reload_test sends a well-formed MCP request.
Security This release includes an update to Envoy v1.38.5 (from v1.38.2). Please see the following Envoy release notes for a full list of security fixes: https://www.envoyproxy.io/docs/envoy/v1.38.5/version_history/v1.38/v1.38.3 https://www.envoyproxy.io/docs/envoy/v1.38.5/version_history/v1.38/v1.38.4 https://www.envoyproxy.io/docs/envoy/v1.38.5/version_history/v1.38/v1.38.5 Fixes a bug that coul…
Backport e88b32a from #6838 Co-authored-by: Joe Kralicky joekralicky@gmail.com
Backport e88b32a from #6838 Co-authored-by: Joe Kralicky joekralicky@gmail.com
What's Changed Fixes grpc: identify owner and changed options when the outbound connection reloads (#6738) by @wasaga in #6742 mcp: keep ext_proc databroker access working across outbound connection reloads (#6740) by @wasaga in #6744 mcp: negotiate supported token auth endpoint methods based on Oauth2 server metadata by @backport-actions-token[bot] in #6735 Full Changelog: v0.33.1...v0.33.3 Note…
Summary The v0.33.2 release job fails in the goreleaser before hook: go: github.com/goreleaser/goreleaser/v2@v2.18.1: requires go >= 1.27.1 (running go 1.26.8; GOTOOLCHAIN=local) make: *** [Makefile:69: deps-release] Error 1 goreleaser raised its own Go floor to 1.27 in 2.18.0 and 1.27.1 in 2.18.1. This branch pins golang 1.26.8 in .tool-versions, and the release job runs with GOTOOLCHAIN=local, s…
Summary The v0.33.2 release job fails in the goreleaser before hook: go: github.com/goreleaser/goreleaser/v2@v2.18.1: requires go >= 1.27.1 (running go 1.26.8; GOTOOLCHAIN=local) make: *** [Makefile:69: deps-release] Error 1 goreleaser raised its own Go floor to 1.27 in 2.18.0 and 1.27.1 in 2.18.1. This branch pins golang 1.26.8 in .tool-versions, and the release job runs with GOTOOLCHAIN=local, s…
This PR updates dependencies not managed by dependabot. Co-authored-by: GitHub Actions apparitor@users.noreply.github.com
What's Changed Dependency Updates docker: use distroless base-nossl images by @wasaga in #6614 ci: refresh v0.33 security dependencies by @desimone in #6616 Full Changelog: v0.33.0...v0.33.1
This PR updates dependencies not managed by dependabot. Co-authored-by: GitHub Actions apparitor@users.noreply.github.com
This PR updates dependencies not managed by dependabot. Co-authored-by: GitHub Actions apparitor@users.noreply.github.com
What's Changed Breaking remove support for darwin x86_64 by @alexandreLamarre in #6141 Security dependency: update modelcontextprotocol/go-sdk to v1.3.1 by @wasaga in #6127 New core/config: add additional config options by @calebdoxsey in #6056 core/databroker: config service stubs by @calebdoxsey in #6057 mcp: add OAuth 2.1 conformance tests for security behaviors by @wasaga in #6055 feat(health)…
Backport 1aadf5a from #6521 Co-authored-by: Alexandre Lamarre alamarre@pomerium.com
Backport 1aadf5a from #6521 Co-authored-by: Alexandre Lamarre alamarre@pomerium.com
Security This release includes an update to Envoy v1.36.8, to address CVE-2026-47774. What's Changed Changed envoyconfig: increase header size limits by @kenjenkins in #6452 Dependency Updates envoy: update envoy-custom to v1.36.8-p1 by @kenjenkins in #6450 dependency updates for security patches by @kenjenkins in #6454 Full Changelog: v0.32.8...v0.32.9
What's Changed Changed fix for GHSA-ggw3-5987-rx77 backport 6405 to 0.32 by @calebdoxsey in #6422 Full Changelog: v0.32.7...v0.32.8
What's Changed Changed update github.com/jackc/pgx/v5 from 5.8.0 to 5.9.2 by @kenjenkins in #6326 bump Go version to 1.25.10 by @kenjenkins in #6329 Full Changelog: v0.32.6...v0.32.7
What's Changed Changed core/session: remove exp and nbf by @backport-actions-token[bot] in #6306 Full Changelog: v0.32.5...v0.32.6
What's Changed Changed fix: ssh authorization code flow issues empty codes by @backport-actions-token[bot] in #6226 bump Go to 1.25.9 by @kenjenkins in #6248 Dependency Updates dependency updates for v0.32 branch by @kenjenkins in #6230 Full Changelog: v0.32.4...v0.32.5
Test pre-release for Apple certificate rotation verification (OPE-244) This release tests the new Developer ID Installer cert (4CCCBFF1...) for goreleaser macOS signing under bdd@pomerium.com. Do not use in production. This will be deleted after verification.
What's Changed Changed core/autocert: detect use_proxy_protocol changes in http redirect server by @backport-actions-token[bot] in #6192 Full Changelog: v0.32.3...v0.32.4
Security This release includes an update to Envoy v1.36.5, to address the following CVEs: CVE-2026-26330 CVE-2026-26308 CVE-2026-26310 CVE-2026-26311 CVE-2026-26309 What's Changed Changed databroker: add VersionedConfig proto and syncer (#6032) by @kenjenkins in #6128 envoy: update envoy-custom to v1.36.5-p1 by @kenjenkins in #6189 Full Changelog: v0.32.2...v0.32.3