Pull requests

• fix: return 403 instead of 500 for unverified email on OAuth2 callback

  kind/bug
  #3573·amichelic opened Oct 16, 2026·5 tasks done·

  ·
  2

• fix(logger): stop quoting RequestURI and UserAgent in log variables

  needs-kind
  #3572·carterpewpew opened Oct 16, 2026·5 tasks done·

  ·
  1

  2

• fix: consider query param overrides in proxied auth (with tests)

  needs-kind
  #3571·amanning9 opened Oct 14, 2026·5 tasks done·

  ·
  2

• fix(redirect): reject ASCII control characters in redirect URLs

  kind/bug
  #3570·choksi2212 opened Oct 13, 2026·5 tasks done·

  ·
  1

  6

• feat: add a SQLite session store for single-host deployments

  kind/enhancement
  #3569·savv opened Oct 13, 2026·5 tasks done·

  ·
  5

• feat: add --session-cookie-strip-id-token to keep cookie sessions within a single cookie

  needs-kind
  #3567·Bappi369 opened Oct 12, 2026·5 tasks done·

  ·
  2

• chore(deps): update actions/setup-node action to v7.1.0

  needs-kind
  #3566·renovate[bot] opened Oct 11, 2026Bot·1 task·

  ·
  2

• chore(deps): update actions/upload-artifact action to v7.0.2

  needs-kind
  #3565·renovate[bot] opened Oct 11, 2026Bot·1 task·

  ·
  2

• docs: Clarify identity header propagation in NGINX Ingress

  needs-kind
  #3564·Sahvendra7 opened Oct 7, 2026·

  ·
  3

  

• perf: check Google group membership concurrently

  kind/enhancement
  #3563·KKamJi98 opened Oct 7, 2026·5 tasks done·

  ·
  3

  

• fix(encryption): fallback to standard base64 decoding for cookie secrets

  needs-kind
  #3562·sudeepchalla opened Oct 4, 2026·5 tasks done·

  ·
  1

  3

• feat: Support host-based redirects

  kind/enhancement
  #3561·codello opened Oct 4, 2026·5 tasks done·

  ·
  1

  2

• fix(oidc): check nonces in refresh responses

  kind/bug
  #3560·yousefissa opened Oct 4, 2026·5 tasks done·

  ·
  4

• chore(deps): update gitea/gitea docker tag to v28

  needs-kind
  #3559·renovate[bot] opened Oct 4, 2026Bot·1 task·

  ·
  2

• chore(deps): update helm release dex to v0.26.0

  needs-kind
  #3558·renovate[bot] opened Oct 4, 2026Bot·1 task·

  ·
  2

• chore(deps): update gomod

  needs-kind
  #3557·renovate[bot] opened Oct 4, 2026Bot·1 task·

  ·
  3

• feat(bitbucket): support self-hosted Bitbucket Data Center via --bitbucket-datacenter-url

  needs-kind
  #3555·NickTheDevOpsGuy opened Oct 2, 2026·5 tasks done·

  ·
  2

• feat(oidc): lazy OIDC discovery so startup survives an unreachable issuer

  kind/enhancement
  #3551·orkhan-huseyn opened Sep 30, 2026·5 tasks done·

  ·
  1

  2

• feat: add oidc-preferred-username-claim option

  area/configurationkind/enhancement
  #3548·sourava01 opened Sep 25, 2026Contributor·5 tasks done·

  ·
  5

• chore(deps): update alpine docker tag to v3.24.2

  #3541·renovate[bot] opened Sep 20, 2026Bot·1 task·

  ·
  1

• fix: honor --oidc-groups-claim for tokens from extra JWT issuers

  area/authorizationkind/bug
  #3540·jaewak opened Sep 17, 2026·5 tasks done·

  ·
  12

• perf: resolve the request path once per skip-auth check

  #3538·no-hup opened Sep 15, 2026Contributor·5 tasks done·

  ·
  3

• chore(deps): update docker/setup-qemu-action action to v4.4.0

  #3533·renovate[bot] opened Sep 6, 2026Bot·1 task·

  ·
  1

• chore(deps): update actions/deploy-pages action to v5.0.1

  #3532·renovate[bot] opened Sep 6, 2026Bot·1 task·

  ·
  1

• feat(cookies): support partitioned cookies

  docsgotests
  #3531·maxih4 opened Sep 2, 2026·

  ·
  1

  1