Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Sync with upstream master #6

Open
wants to merge 863 commits into
base: master
Choose a base branch
from
Open

Sync with upstream master #6

wants to merge 863 commits into from

Conversation

cruizen
Copy link
Collaborator

@cruizen cruizen commented Oct 17, 2022 •
edited
Loading

Overview

Sync the pf9 fork with dexidp/dex master to bring in all the changes from https://github.com/dexidp/dex/releases/tag/v2.35.3 + this PR dexidp#2708 from master

What this PR does / why we need it

Bring in the upstream fixes to improve security (there is a known CVE), bring in fixes / optimisations
ArgoCD has now released patches for v2.2 and v2.4 that fix this in ArgoCD's dex server pod (by upgrading to v2.25.3 of upstream dex).
We are missing this (just upgrading ArgoCD will not help) since we use our own forked dex

Special notes for your reviewer

Does this PR introduce a user-facing change?

@cruizen cruizen changed the title Merge master Sync with upstream master Oct 17, 2022
@cruizen cruizen marked this pull request as ready for review October 17, 2022 21:26
@cruizen
Copy link
Collaborator Author

cruizen commented Oct 17, 2022 •
edited
Loading

Hi @erwinvaneyk , @pshanbhag I don't have write access to the repo and therefore cannot ask for review and / or resolve merge conflicts, it seems.

This PR is in draft state since I see a message that "This branch has conflicts that must be resolved".

@cruizen
Copy link
Collaborator Author

cruizen commented Oct 4, 2023

This branch has conflicts that must be resolved :-/

@cruizen cruizen marked this pull request as draft October 4, 2023 21:17
mithilarun
mithilarun previously approved these changes Oct 4, 2023
View reviewed changes
@cruizen cruizen marked this pull request as ready for review March 12, 2024 12:47
@cruizen cruizen requested review from mithilarun, gauravgavhane05 and a team March 13, 2024 09:23
mithilarun
mithilarun previously approved these changes Mar 13, 2024
View reviewed changes
sagikazarmark and others added 15 commits April 8, 2024 21:56
@sagikazarmark
Merge pull request #3452 from dexidp/dependabot/go_modules/examples/g…
b12883c 
…olang.org/x/oauth2-0.19.0

build(deps): bump golang.org/x/oauth2 from 0.18.0 to 0.19.0 in /examples
@sagikazarmark
Merge pull request #3451 from dexidp/dependabot/go_modules/golang.org…
0261110 
…/x/net-0.24.0

build(deps): bump golang.org/x/net from 0.22.0 to 0.24.0
@sagikazarmark
Merge pull request #3446 from dexidp/dependabot/docker/golang-1.22.2-…
e5123f1 
…alpine3.18

build(deps): bump golang from 1.22.1-alpine3.18 to 1.22.2-alpine3.18
@sagikazarmark
Merge pull request #3443 from dexidp/dependabot/go_modules/go.etcd.io…
3b1b174 
…/etcd/client/pkg/v3-3.5.13

build(deps): bump go.etcd.io/etcd/client/pkg/v3 from 3.5.12 to 3.5.13
@sagikazarmark
Merge pull request #3440 from dexidp/dependabot/docker/distroless/sta…
f1772cb 
…tic-debian12-42c8865

build(deps): bump distroless/static-debian12 from `67686c9` to `42c8865`
@sagikazarmark
Merge pull request #3435 from dexidp/dependabot/github_actions/action…
b2e0f96 
…s/dependency-review-action-4.2.5

build(deps): bump actions/dependency-review-action from 4.1.3 to 4.2.5
@dependabot
build(deps): bump go.etcd.io/etcd/client/v3 from 3.5.12 to 3.5.13
090d3b0 
Bumps [go.etcd.io/etcd/client/v3](https://github.com/etcd-io/etcd) from 3.5.12 to 3.5.13.
- [Release notes](https://github.com/etcd-io/etcd/releases)
- [Commits](etcd-io/etcd@v3.5.12...v3.5.13)

---
updated-dependencies:
- dependency-name: go.etcd.io/etcd/client/v3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@sagikazarmark
Merge pull request #3434 from dexidp/dependabot/go_modules/github.com…
e53e962 
…/go-sql-driver/mysql-1.8.1

build(deps): bump github.com/go-sql-driver/mysql from 1.8.0 to 1.8.1
@dependabot
build(deps): bump google.golang.org/api from 0.171.0 to 0.172.0
68d8ad0 
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.171.0 to 0.172.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.171.0...v0.172.0)

---
updated-dependencies:
- dependency-name: google.golang.org/api
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@sagikazarmark
Merge pull request #3430 from dexidp/dependabot/github_actions/mheap/…
231481f 
…github-action-required-labels-5.4.0

build(deps): bump mheap/github-action-required-labels from 5.3.0 to 5.4.0
@sagikazarmark
Merge pull request #3428 from dexidp/dependabot/github_actions/docker…
4078a17 
…/setup-buildx-action-3.2.0

build(deps): bump docker/setup-buildx-action from 3.1.0 to 3.2.0
@sagikazarmark
Merge pull request #3442 from dexidp/dependabot/go_modules/go.etcd.io…
ca27d3c 
…/etcd/client/v3-3.5.13

build(deps): bump go.etcd.io/etcd/client/v3 from 3.5.12 to 3.5.13
@sagikazarmark
Merge pull request #3438 from dexidp/dependabot/go_modules/google.gol…
98980ca 
…ang.org/api-0.172.0

build(deps): bump google.golang.org/api from 0.171.0 to 0.172.0
@dependabot
build(deps): bump docker/setup-buildx-action from 3.2.0 to 3.3.0
b13f5ac 
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.2.0 to 3.3.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@2b51285...d70bba7)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
build(deps): bump distroless/static-debian12 from 42c8865 to e9ac71e
cd693d3 
Bumps distroless/static-debian12 from `42c8865` to `e9ac71e`.

---
updated-dependencies:
- dependency-name: distroless/static-debian12
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
dependabot bot and others added 30 commits October 22, 2024 07:57
@dependabot
build(deps): bump actions/dependency-review-action from 4.3.4 to 4.3.5 (
577c2d7 
#3804)

Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 4.3.4 to 4.3.5.
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@5a2ce3f...a6993e2)

---
updated-dependencies:
- dependency-name: actions/dependency-review-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump anchore/sbom-action from 0.17.4 to 0.17.5 (#3803)
14bf497 
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.17.4 to 0.17.5.
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@8d0a650...1ca97d9)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump sigstore/cosign-installer from 3.6.0 to 3.7.0 (#3800)
80be9bc 
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@4959ce0...dc72c7d)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump github.com/mattn/go-sqlite3 from 1.14.23 to 1.14.24 (…
5245138 
…#3805)

Bumps [github.com/mattn/go-sqlite3](https://github.com/mattn/go-sqlite3) from 1.14.23 to 1.14.24.
- [Release notes](https://github.com/mattn/go-sqlite3/releases)
- [Commits](mattn/go-sqlite3@v1.14.23...v1.14.24)

---
updated-dependencies:
- dependency-name: github.com/mattn/go-sqlite3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump github/codeql-action from 3.26.13 to 3.27.0 (#3806)
a37b6e9 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.26.13 to 3.27.0.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@f779452...6624720)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump actions/checkout from 4.1.7 to 4.2.1 (#3785)
3b00bbe 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.7 to 4.2.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@692973e...eef6144)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump google.golang.org/api from 0.196.0 to 0.203.0 (#3807)
2ab83e5 
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.196.0 to 0.203.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.196.0...v0.203.0)

---
updated-dependencies:
- dependency-name: google.golang.org/api
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@zvlb @nabokihms
GitLab connector: add GitLab additional group with role (#2941)
3e00d33 
Signed-off-by: zvlb <vl.zemtsov@gmail.com>
Signed-off-by: Maksim Nabokikh <maksim.nabokikh@flant.com>
Signed-off-by: Maksim Nabokikh <max.nabokih@gmail.com>
Co-authored-by: Maksim Nabokikh <maksim.nabokikh@flant.com>
Co-authored-by: Maksim Nabokikh <max.nabokih@gmail.com>
@dependabot
build(deps): bump actions/checkout from 4.2.1 to 4.2.2 (#3808)
b14e628 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.1 to 4.2.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@eef6144...11bd719)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump actions/dependency-review-action from 4.3.5 to 4.4.0 (
eefa6c1 
#3814)

Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 4.3.5 to 4.4.0.
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@a6993e2...4081bf9)

---
updated-dependencies:
- dependency-name: actions/dependency-review-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump distroless/static-debian12 from 26f9b99 to `3a03f…
6c8a9fe 
…c0` (#3812)

Bumps distroless/static-debian12 from `26f9b99` to `3a03fc0`.

---
updated-dependencies:
- dependency-name: distroless/static-debian12
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump actions/setup-go from 5.0.2 to 5.1.0 (#3809)
d02035f 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.0.2 to 5.1.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@0a12ed9...41dfa10)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@meldsza
Support for IssuerAlias and groups as maps (#3676)
8b93966 
Signed-off-by: Melroy Dsouza <meldsza@gmail.com>
@nabokihms
Fix trivydb TOOMANYREQUESTS error (#3819)
113751e 
Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>
@nabokihms
Update trivydb cache on the begging of each day (#3821)
9243dce 
Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>
@dependabot
build(deps): bump anchore/sbom-action from 0.17.5 to 0.17.6 (#3817)
02e5088 
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.17.5 to 0.17.6.
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@1ca97d9...251a468)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump github.com/fsnotify/fsnotify from 1.7.0 to 1.8.0 (#…
fa3bfc1 
…3822)

Bumps [github.com/fsnotify/fsnotify](https://github.com/fsnotify/fsnotify) from 1.7.0 to 1.8.0.
- [Release notes](https://github.com/fsnotify/fsnotify/releases)
- [Changelog](https://github.com/fsnotify/fsnotify/blob/main/CHANGELOG.md)
- [Commits](fsnotify/fsnotify@v1.7.0...v1.8.0)

---
updated-dependencies:
- dependency-name: github.com/fsnotify/fsnotify
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@diafour
chore: fix url for crowd connector in README.md (#3823)
6b4632c 
Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>
@nabokihms
Skip trivy db updates (#3829)
b211f55 
Signed-off-by: Maksim Nabokikh <maksim.nabokikh@flant.com>
@dependabot
build(deps): bump alpine from beefdbd to 1e42bbe (#3840)
fa0240d 
Bumps alpine from `beefdbd` to `1e42bbe`.

---
updated-dependencies:
- dependency-name: alpine
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump golang.org/x/oauth2 from 0.23.0 to 0.24.0 in /examp…
ca43b59 
…les (#3832)

Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.23.0 to 0.24.0.
- [Commits](golang/oauth2@v0.23.0...v0.24.0)

---
updated-dependencies:
- dependency-name: golang.org/x/oauth2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump golang from 1.23.2-alpine3.20 to 1.23.3-alpine3.20 (#…
f1b711b 
…3834)

Bumps golang from 1.23.2-alpine3.20 to 1.23.3-alpine3.20.

---
updated-dependencies:
- dependency-name: golang
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@nabokihms
Create offline sessions if approval is skipped (#3828)
bb985ca 
Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>
@dependabot
build(deps): bump anchore/sbom-action from 0.17.6 to 0.17.8 (#3858)
1f5d07b 
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.17.6 to 0.17.8.
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@251a468...55dc4ee)

---
updated-dependencies:
- dependency-name: anchore/sbom-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump distroless/static-debian12 from 3a03fc0 to `d71f4…
53bea80 
…b2` (#3839)

Bumps distroless/static-debian12 from `3a03fc0` to `d71f4b2`.

---
updated-dependencies:
- dependency-name: distroless/static-debian12
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump golang from 0974259 to c694a4d (#3863)
2476f0e 
Bumps golang from `0974259` to `c694a4d`.

---
updated-dependencies:
- dependency-name: golang
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@nabokihms
Add CSS for example app to make it prettier (#3886)
00c0e28 
Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>
@dependabot
build(deps): bump tonistiigi/xx from 1.5.0 to 1.6.1 (#3879)
6110149 
Bumps tonistiigi/xx from 1.5.0 to 1.6.1.

---
updated-dependencies:
- dependency-name: tonistiigi/xx
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@nrwiersma
feat: set resource revision for connectors (#3868)
d521051 
Signed-off-by: Nicholas Wiersma <nick@wiersma.co.za>
@dependabot
build(deps): bump golang.org/x/crypto in the go_modules group (#3893)
38309ed 
Bumps the go_modules group with 1 update: [golang.org/x/crypto](https://github.com/golang/crypto).


Updates `golang.org/x/crypto` from 0.28.0 to 0.31.0
- [Commits](golang/crypto@v0.28.0...v0.31.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mithilarun mithilarun mithilarun left review comments

@jayanth-tjvrr jayanth-tjvrr Awaiting requested review from jayanth-tjvrr

@gauravgavhane05 gauravgavhane05 Awaiting requested review from gauravgavhane05

At least 2 approving reviews are required to merge this pull request.

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.