Skip to content

chore(deps): bump oauth2-proxy/oauth2-proxy from v7.14.2 to v7.14.3 in /helm/modelix#330

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/docker/helm/modelix/oauth2-proxy/oauth2-proxy-v7.14.3
Open

chore(deps): bump oauth2-proxy/oauth2-proxy from v7.14.2 to v7.14.3 in /helm/modelix#330
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/docker/helm/modelix/oauth2-proxy/oauth2-proxy-v7.14.3

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 27, 2026

Bumps oauth2-proxy/oauth2-proxy from v7.14.2 to v7.14.3.

Release notes

Sourced from oauth2-proxy/oauth2-proxy's releases.

v7.14.3

Release Highlights

  • 🔵 Go1.25.7 and upgrade of dependencies to latest versions (@​tuunit)
  • 🐛 Bug fixes
    • Allow Redis URL parameters to configure username, password and max idle connection timeout if the matching configuration is empty.

Important Notes

We improved our supply chain security by added additional checks to prevent potential command injection in the publish release workflow and to ensure that it can only be triggered from branches originating in the local repository. This potential issue was reported by automated systems as well as a couple of security researchers, and we want to thank everyone for their diligence in looking out for the security of the project. Especially Aastha Aggarwal for her detailed report and follow-up. @​Aastha2602

Breaking Changes

Changes since v7.14.2

  • #3183 fix: allow URL parameters to configure username, password and max idle connection timeout if the matching configuration is empty. (@​Richard87)
Changelog

Sourced from oauth2-proxy/oauth2-proxy's changelog.

Changes since v7.14.3

V7.14.3

Release Highlights

  • 🔵 Go1.25.7 and upgrade of dependencies to latest versions
  • 🐛 Bug fixes
    • Allow Redis URL parameters to configure username, password and max idle connection timeout if the matching configuration is empty.

Important Notes

We improved our supply chain security by added additional checks to prevent potential command injection in the publish release workflow and to ensure that it can only be triggered from branches originating in the local repository. This potential issue was reported by automated systems as well as a couple of security researchers, and we want to thank everyone for their diligence in looking out for the security of the project. Especially Aastha Aggarwal for her detailed report and follow-up. @​Aastha2602

Breaking Changes

Commits
  • b5c8df7 release v7.14.3 (#3351)
  • 788f3d0 ci: ensure we always use the latest patch version of golang (#3350)
  • 06f1234 ci: ensure we always use the latest patch version of golang (#3349)
  • a279fec Merge pull request #3183 from Richard87/do-not-override-idle-timeout
  • 7822698 fix: update CHANGELOG to include new fix for URL parameters configuration
  • 7747a88 fix: add tests for configure options and URL overrides when empty
  • 1785327 fix: dont override parameters set in redis uri
  • e7724f3 ci: ensure release branches originate from the local repository and reduce re...
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [oauth2-proxy/oauth2-proxy](https://github.com/oauth2-proxy/oauth2-proxy) from v7.14.2 to v7.14.3.
- [Release notes](https://github.com/oauth2-proxy/oauth2-proxy/releases)
- [Changelog](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/CHANGELOG.md)
- [Commits](oauth2-proxy/oauth2-proxy@v7.14.2...v7.14.3)

---
updated-dependencies:
- dependency-name: oauth2-proxy/oauth2-proxy
  dependency-version: v7.14.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file docker Pull requests that update docker code labels Feb 27, 2026
@github-actions
Copy link

Test Results

27 tests  ±0   27 ✅ ±0   1m 32s ⏱️ -5s
 7 suites ±0    0 💤 ±0 
 7 files   ±0    0 ❌ ±0 

Results for commit a162665. ± Comparison against base commit 90af1eb.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file docker Pull requests that update docker code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants