feat(container): update image quay.io/oauth2-proxy/oauth2-proxy ( v7.6.0 → v7.12.0 )

[renovate]

This PR contains the following updates:

Package	Update	Change
quay.io/oauth2-proxy/oauth2-proxy (source)	minor	v7.6.0 -> v7.12.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

oauth2-proxy/oauth2-proxy (quay.io/oauth2-proxy/oauth2-proxy)

v7.12.0

Compare Source

v7.11.0

Compare Source

• #​2273 feat: add Cidaas provider (@​Bibob7, @​Teko012)
• #​3166 chore(dep): upgrade to latest golang 1.24.6 (@​tuunit)
• #​3156 feat: allow disable-keep-alives configuration for upstream (@​jet-go)
• #​3150 fix: Gitea team membership (@​MagicRB, @​tuunit)

v7.10.0

Compare Source

• #​2615 feat(cookies): add option to set a limit on the number of per-request CSRF cookies oauth2-proxy sets (@​bh-tt)
• #​2605 fix: show login page on broken cookie (@​Primexz)
• #​2743 feat: allow use more possible google admin-sdk api scopes (@​BobDu)
• #​2359 feat: add SourceHut (sr.ht) provider(@​bitfehler)
• #​2524 fix: regex substitution for $ signs in upstream path handling before running envsubst (@​dashkan / @​tuunit)
• #​3104 feat(cookie): add feature support for cookie-secret-file (@​sandy2008)
• #​3055 feat: support non-default authorization request response mode also for OIDC providers (@​stieler-it)
• #​3138 feat: make google_groups argument optional when using google provider (@​sourava01)
• #​3093 feat: differentiate between "no available key" and error for redis sessions (@​nobletrout)
• GHSA-7rh7-c77v-6434 fix: skip_auth_routes bypass through query parameter inclusion

v7.9.0

Compare Source

• #​3072 feat: support for multiple github orgs #​3072 (@​daniel-mersch)
• #​3116 feat: bump to go1.24.5 and full dependency update (@​wardviaene / @​dolmen)
• #​3097 chore(deps): update alpine base image to v3.22.0
• #​3101 fix: return error for empty Redis URL list (@​dgivens)

v7.8.2

Compare Source

• #​3031 Fixes Refresh Token bug with Entra ID and Workload Identity (#​3027)[#​3028] by using client assertion when redeeming the token (@​richard87)
• #​3001 Allow to set non-default authorization request response mode (@​stieler-it)
• #​3041 chore(deps): upgrade to latest golang v1.23.x release (@​TheImplementer)
• #​1916 fix: role extraction from access token in keycloak oidc (@​Elektordi / @​tuunit)
• #​3014 feat: ability to parse JWT encoded profile claims (@​ikarius)

v7.8.1

Compare Source

• #​2918 feat: add --bearer-token-login-fallback (@​carillonator)
• #​2927 chore(deps/build): bump golang to 1.23 and use go.mod as single point of truth for all build files (@​tuunit)
• #​2697 Use Max-Age instead of Expires for cookie expiration (@​matpen-wi)
• #​2969 Update golang.org/x/oauth2 to v0.27.0 to address CVE-2025-22868 (@​dsymonds)
• #​2977 Update golang.org/x/net to v0.36.0 to address CVE-2025-22870 (@​dsymonds)
• #​2982 chore(deps): remove go:generate tool from go.mod (@​dolmen)
• #​3011 chore(deps): update golang dependencies and pin to latest golang v1.23.x release (@​tuunit)
• #​2967 Update HashNonce to use crypto/sha256 (@​egibs)

v7.8.0

Compare Source

• #​2887 fix: jwt regex validation error during skip-jwt-bearer-tokens flow
• #​2920 fix: missing oauth2-proxy version for docker builds

v7.7.1

Compare Source

• #​2390 feat: add Microsoft Entra ID provider (@​jjlakis / @​tuunit)
• #​2902 feat(entra): add Workload Identity support for Entra ID (@​jjlakis)
• #​2800 doc: add some opencontainer labels to docker image (@​halkeye)
• #​2755 feat: add X-Envoy-External-Address as supported header (@​bjencks)
• #​1985 feat: add support for systemd socket (@​isodude)
• #​2916 fix: systemd socket support build handling for windows (@​tuunit)
• #​2300 fix: add fix for websocket path rewrite (@​rekup)
• #​2821 feat: add CF-Connecting-IP as supported real ip header (@​ondrejsika)
• #​2620 fix: update code_verifier to use recommended method (@​vishvananda)
• #​2376 feat: static public keys file support for oidc provider (@​axel7083 / @​jjlakis)
• #​2392 chore: extend test cases for oidc provider and documentation regarding implicit setting of the groups scope when no scope was specified in the config (@​jjlakis / @​tuunit)

v7.7.0

Compare Source

• #​2803 fix: self signed certificate handling in v7.7.0 (@​tuunit)
• #​2619 fix: unable to use hyphen in JSON path for oidc-groups-claim option (@​rd-danny-fleer)
• #​2311 fix: runtime error: index out of range (0) with length 0 (@​miguelborges99 / @​tuunit)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[carpenike-bot]

--- kubernetes/cluster-0/apps/security/oauth2-proxy/app Kustomization: flux-system/oauth2-proxy HelmRelease: security/oauth2-proxy

+++ kubernetes/cluster-0/apps/security/oauth2-proxy/app Kustomization: flux-system/oauth2-proxy HelmRelease: security/oauth2-proxy

@@ -81,13 +81,13 @@

               OAUTH2_PROXY_SESSION_STORE_TYPE: redis
               OAUTH2_PROXY_SET_AUTHORIZATION-HEADER: true
               OAUTH2_PROXY_SET_XAUTHREQUEST: true
               OAUTH2_PROXY_WHITELIST_DOMAINS: .ryho.lt
             image:
               repository: quay.io/oauth2-proxy/oauth2-proxy
-              tag: v7.6.0
+              tag: v7.8.2
             probes:
               liveness:
                 custom: true
                 enabled: true
                 spec:
                   failureThreshold: 3

[carpenike-bot]

--- HelmRelease: security/oauth2-proxy Deployment: security/oauth2-proxy

+++ HelmRelease: security/oauth2-proxy Deployment: security/oauth2-proxy

@@ -99,13 +99,13 @@

         - name: OAUTH2_PROXY_SET_AUTHORIZATION-HEADER
           value: 'true'
         - name: OAUTH2_PROXY_SET_XAUTHREQUEST
           value: 'true'
         - name: OAUTH2_PROXY_WHITELIST_DOMAINS
           value: .ryho.lt
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.8.2
         livenessProbe:
           failureThreshold: 3
           httpGet:
             path: /ping
             port: 4180
           initialDelaySeconds: 10

[carpenike-bot]

🦙 MegaLinter status: ❌ ERROR

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
❌ COPYPASTE	jscpd	yes		2	no	1.33s
✅ REPOSITORY	git_diff	yes		no	no	0.04s
✅ REPOSITORY	secretlint	yes		no	no	3.8s
⚠️ YAML	prettier	1		1	2	0.44s
❌ YAML	yamllint	1		4	0	0.64s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff