Pomerium

What's Changed

Breaking

• remove support for darwin x86_64 by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6141

Security

• dependency: update modelcontextprotocol/go-sdk to v1.3.1 by @wasaga in https://github.com/pomerium/pomerium/pull/6127

New

• core/config: add additional config options by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6056
• core/databroker: config service stubs by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6057
• mcp: add OAuth 2.1 conformance tests for security behaviors by @wasaga in https://github.com/pomerium/pomerium/pull/6055
• feat(health) : add metrics integration by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6058
• tidy: clustered databroker execution flow by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6060
• core/protoutil: implement sorting of arbitrary protobuf messages by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6064
• core/config: add downstream mtls settings ca key pair id by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6065
• mcp: improve domain validation UX and make allowed domains optional by @wasaga in https://github.com/pomerium/pomerium/pull/6066
• controlplane: add /version debug admin endpoint by @wasaga in https://github.com/pomerium/pomerium/pull/6070
• core/databroker: implement config service by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6089
• feat(grpc): ensure "coordination" between keepalives in http/2 protocols in internal pomerium grpc impls by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6078
• core/databroker: add service account support by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6096
• Add custom git merge driver for components.json by @wasaga in https://github.com/pomerium/pomerium/pull/6068
• mcp: add UpstreamOAuthClient type and storage for DCR caching by @wasaga in https://github.com/pomerium/pomerium/pull/6107
• databroker: add first-class record auto-expiry via Options TTL by @wasaga in https://github.com/pomerium/pomerium/pull/6121
• mcp: add PendingUpstreamAuth proto and storage methods by @wasaga in https://github.com/pomerium/pomerium/pull/6118
• mcp: pass upstream host via route context metadata and extend HostInfo by @wasaga in https://github.com/pomerium/pomerium/pull/6119
• core/databroker: support loading configuration of individual entities by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6113
• feat: schema-based blob chunking for resume uploads by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6138
• feat: session recording server by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6140
• core/config: add ssh_policy to protobuf by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6182
• core/config: add support for ssh policy ids by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6185
• core/config: add auto_apply_changesets by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6198
• core/config: add allow_upgrades by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6216
• core/debug: add raft debug handler by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6244
• core/config: include to addresses in mcp allowed as metadata domains by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6243
• core/envoy: update listeners to use additional addresses instead of the ipv4_compat flag by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6260
• core/config: allow re-issuing JWT for service accounts by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6273
• feat(blob) : middleware and reading util by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6265
• core/config: generate enums from protobuf by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6307
• core/connect: add connect method to return available log fields, move log fields to public package by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6308
• feat(ipc): generic protobuf communication via pipes by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6345
• feat(envoy): configure dynamic extensions for envoy by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6352
• feat(session_recording): health checks by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6356
• feat(session_recording): configure policy / settings by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6355
• authorize: add client cert SAN substitutions by @kenjenkins in https://github.com/pomerium/pomerium/pull/6342
• core/config: add update_mask support by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6363
• core/config: add new path/header normalization options by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6398

Fixes

• core/synccache: limit batch size by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6073
• fix(authorize): sync_querier can have an inconsistent state by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6071
• authenticate: avoid double signout confirmation by @kenjenkins in https://github.com/pomerium/pomerium/pull/6093
• core/autocert: detect use_proxy_protocol changes in http redirect server by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6191
• recording: rework handleBlobChange() by @kenjenkins in https://github.com/pomerium/pomerium/pull/6193
• fix: allow loopback redirect URIs with any port per OAuth 2.1 by @wasaga in https://github.com/pomerium/pomerium/pull/6251
• fix: render HTML error pages for MCP authorize endpoint by @wasaga in https://github.com/pomerium/pomerium/pull/6252
• fix(mcp): recover MCP upstream auth after late config delivery by @wasaga in https://github.com/pomerium/pomerium/pull/6281
• core/session: remove exp and nbf by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6305
• mcp: strip default ports when comparing PRM resource to upstream URL by @wasaga in https://github.com/pomerium/pomerium/pull/6309
• ssh: fix sign-in prompt link URL by @kenjenkins in https://github.com/pomerium/pomerium/pull/6346
• core/config: switch gRPC port when 5443 is not available by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6405
• config: additional jwt_claims_headers validation by @kenjenkins in https://github.com/pomerium/pomerium/pull/6419
• ssh: use TypedStruct for enabled channel filter configs by @kralicky in https://github.com/pomerium/pomerium/pull/6445
• ssh: fix connection buffer limits by @kralicky in https://github.com/pomerium/pomerium/pull/6448
• ssh: use xds route configuration by @kralicky in https://github.com/pomerium/pomerium/pull/6436
• build xds discovery resources synchronously by @kralicky in https://github.com/pomerium/pomerium/pull/6468
• fix(controlplane): fix the debug databroker browser by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6495
• ssh tui: fix log viewer text styles by @kralicky in https://github.com/pomerium/pomerium/pull/6069
• fix: add remaining keepalives for databroker follower clients & admin endpoint by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6097
• fix(grpc): deadlock in CachedOutboundGRPClientConn.Get() on config change by @wasaga in https://github.com/pomerium/pomerium/pull/6101
• ssh: fix and re-enable routes portal tests by @kralicky in https://github.com/pomerium/pomerium/pull/6167
• fix: remove cd /tmp from deps-release to fix asdf compatibility by @wasaga in https://github.com/pomerium/pomerium/pull/6176
• fix(mcp): CORS header consistency and e2e tests by @wasaga in https://github.com/pomerium/pomerium/pull/6109
• fix(mcp): include request path in WWW-Authenticate resource_metadata URI by @nickytonline in https://github.com/pomerium/pomerium/pull/6200
• fix(mcp): include request path in upstream_auth PRM URL and normalize trailing slash by @wasaga in https://github.com/pomerium/pomerium/pull/6202
• ssh: fix diagnostic logs not being displayed by @kralicky in https://github.com/pomerium/pomerium/pull/6150
• core/pebble: fix batch not always being closed by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6222
• fix: ssh authorization code flow issues empty codes by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6225
• fix(session_recording): recording content type should be protobuf by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6375
• fix(session_recording): validate that the bucket is accessible before propagating it to the recording server by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6399
• fix(blob): s3 audit middleware modifies the request before signing by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6402
• fix: expected health checks must be recomputed when config changes by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6474
• fix: use X-Serverless-Authorization for Cloud Run serverless auth by @wasaga in https://github.com/pomerium/pomerium/pull/6268
• fix(config): use proxy protocol for internal communication by @backport-actions-token[bot] in https://github.com/pomerium/pomerium/pull/6518
• fix: root spans when mcp runtime flag is on by @backport-actions-token[bot] in https://github.com/pomerium/pomerium/pull/6532
• tracing: fix otel resource initialization by @backport-actions-token[bot] in https://github.com/pomerium/pomerium/pull/6500
• authenticate: fix Handle.WithNewIssuer to preserve TTL for Exp and clear Nbf by @desimone in https://github.com/pomerium/pomerium/pull/6212
• fix: client bindings not accessible from proxy /.pomerium handler by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6427
• fix: validate GCS metadata identity response before using as token by @desimone in https://github.com/pomerium/pomerium/pull/6266
• fix(identity): exclude AccessTokenAllowedAudiences from provider hash by @desimone in https://github.com/pomerium/pomerium/pull/6263
• fix: anypb type resolution when writing session recording metadata by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6239
• fix(mcp): rejoin configured upstream base path for reactive PRM discovery by @wasaga in https://github.com/pomerium/pomerium/pull/6409
• ssh tui: fix data races related to model updates by @kralicky in https://github.com/pomerium/pomerium/pull/6077
• core/config: fix generated bool setter by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6344
• fix(azblob): strict signing on blob operations ordering with BeforeRead middleware by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6420

Changed

• handlers: refactor JWKSHandler by @kenjenkins in https://github.com/pomerium/pomerium/pull/6052
• config: derive signing key from shared secret by @kenjenkins in https://github.com/pomerium/pomerium/pull/6037
• ssh: reverse tunnel status tui improvements by @kralicky in https://github.com/pomerium/pomerium/pull/6004
• databroker: add VersionedConfig record type by @kenjenkins in https://github.com/pomerium/pomerium/pull/6032
• test(acceptance): add E2E acceptance test harness by @desimone in https://github.com/pomerium/pomerium/pull/6062
• authorize: add missing MCP explanation trace by @kenjenkins in https://github.com/pomerium/pomerium/pull/6081
• controlplane: add /versioned_config debug page by @kenjenkins in https://github.com/pomerium/pomerium/pull/6079
• ssh tui: style adjustments/fixes by @kralicky in https://github.com/pomerium/pomerium/pull/6092
• feat(metrics): databroker syncer handler metrics by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6102
• mcp: add upstream OAuth discovery core functions (RFC 9728/8414) by @wasaga in https://github.com/pomerium/pomerium/pull/6099
• core/config: more flexible get settings request by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6111
• mcp: add ext_proc integration for response interception by @wasaga in https://github.com/pomerium/pomerium/pull/6091
• version: add a component version for 'hosted' idp by @kenjenkins in https://github.com/pomerium/pomerium/pull/6110
• mcp: host Client ID Metadata Documents for auto-discovery mode by @wasaga in https://github.com/pomerium/pomerium/pull/6088
• databroker: add CompositeRecordID utility for building record IDs by @wasaga in https://github.com/pomerium/pomerium/pull/6114
• mcp: add upstream MCP token storage by @wasaga in https://github.com/pomerium/pomerium/pull/6100
• simplify acceptance test users setup by @kenjenkins in https://github.com/pomerium/pomerium/pull/6115
• Update README to clarify Pomerium's functionality by @desimone in https://github.com/pomerium/pomerium/pull/6134
• mcp: add ext_proc handler interface for upstream token injection by @wasaga in https://github.com/pomerium/pomerium/pull/6130
• feat: add SSRF-safe HTTP client for MCP metadata fetching by @wasaga in https://github.com/pomerium/pomerium/pull/6144
• ssh: configure interrupt options for tunnel status command by @kralicky in https://github.com/pomerium/pomerium/pull/6104
• mcp: add upstream OAuth setup utilities and token exchange by @wasaga in https://github.com/pomerium/pomerium/pull/6133
• feat: add DCR (Dynamic Client Registration) for upstream OAuth by @wasaga in https://github.com/pomerium/pomerium/pull/6145
• feat: serve session recording server by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6149
• mcp: add config and proto fields for upstream auth by @wasaga in https://github.com/pomerium/pomerium/pull/6152
• mcp: add PRM path-prefix validation and DCR fallback option by @wasaga in https://github.com/pomerium/pomerium/pull/6153
• add internal/cmd/mock-idp standalone command by @kralicky in https://github.com/pomerium/pomerium/pull/6146
• mcp: add UpstreamAuthHandler for upstream token injection and 401/403 interception by @wasaga in https://github.com/pomerium/pomerium/pull/6165
• ssh: refactor StreamHandler state management by @kralicky in https://github.com/pomerium/pomerium/pull/6166
• reverse tunnel: populate route info in endpoint metadata by @kralicky in https://github.com/pomerium/pomerium/pull/6155
• mcp: add controlplane wiring and upstream OAuth callback handler by @wasaga in https://github.com/pomerium/pomerium/pull/6172
• mcp: add e2e tests for service account MCP routes by @wasaga in https://github.com/pomerium/pomerium/pull/6171
• core/consolidated-api: validate routes, policies, settings by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6181
• mcp: improve route listing for auto-discovery upstream auth by @wasaga in https://github.com/pomerium/pomerium/pull/6178
• mcp: add auto-discovery support to connect, disconnect, and authorize endpoints by @wasaga in https://github.com/pomerium/pomerium/pull/6179
• mcp: add MCP server indicators and connect/disconnect to routes portal by @wasaga in https://github.com/pomerium/pomerium/pull/6184
• mcp: proto/config foundation for upstream OAuth unification by @wasaga in https://github.com/pomerium/pomerium/pull/6194
• mcp: set Accept: application/json on upstream token exchange requests by @wasaga in https://github.com/pomerium/pomerium/pull/6195
• mcp: unified option constructors for pre-registered and static endpoint OAuth by @wasaga in https://github.com/pomerium/pomerium/pull/6196
• mcp: unify upstream OAuth flows, remove static-config parallel path by @wasaga in https://github.com/pomerium/pomerium/pull/6197
• Revert "authenticate: fix Handle.WithNewIssuer to preserve TTL for Exp and clear Nbf" by @desimone in https://github.com/pomerium/pomerium/pull/6220
• update get-envoy tool to fetch binaries from oci images by @kralicky in https://github.com/pomerium/pomerium/pull/6183
• core/pebble: use pebbleutil.Iterate for iterators, add reversed by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6224
• feat(blob): chunk readers should only read from finalized recordings by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6229
• authenticate: add server-side PKCE support for authorization code flow by @desimone in https://github.com/pomerium/pomerium/pull/6061
• core/config: add json docs by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6211
• ci: skip Cloudsmith publish for release candidates by @desimone in https://github.com/pomerium/pomerium/pull/6238
• chore: add go-fix pre-commit hook and apply modernizations by @wasaga in https://github.com/pomerium/pomerium/pull/6247
• routes: append X-Forwarded-Host when host rewrite is active by @desimone in https://github.com/pomerium/pomerium/pull/6264
• feat: add unix socket support for target resources by @IngmarStein in https://github.com/pomerium/pomerium/pull/6259
• core/config: remove the empty string from allow_upgrades by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6267
• config/envoyconfig: add http3 downstream integration test by @wasaga in https://github.com/pomerium/pomerium/pull/6284
• mcp: refresh expired upstream token before forcing reauth by @wasaga in https://github.com/pomerium/pomerium/pull/6282
• config/envoyconfig: disable route timeouts on MCP server routes by @wasaga in https://github.com/pomerium/pomerium/pull/6288
• feat : minor recording storage schema improvements by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6287
• pomerium/authorize: disable redirect when session passed in header or query string by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6289
• core/envoyconfig: change the error code for ext_authz errors from 500 to 503 by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6293
• core/config: improve code generation by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6299
• chore: rm dead mcp check in authz by @wasaga in https://github.com/pomerium/pomerium/pull/6311
• Add AI usage policy by @desimone in https://github.com/pomerium/pomerium/pull/6333
• config/envoyconfig: integration test for WebSockets via middle Envoy by @desimone in https://github.com/pomerium/pomerium/pull/6332
• core/envoy: use abstract namespace for unix sockets on linux by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6340
• feat(mcp/configapi): shared library exposing ConfigService as MCP tools by @wasaga in https://github.com/pomerium/pomerium/pull/6286
• core/envoy: abstract socket improvements by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6347
• core/config: add New function for config.Config by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6349
• feat: update session recording protocol & disable session recording by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6335
• proxy: guard support for pomerium_redirect_uri by @kenjenkins in https://github.com/pomerium/pomerium/pull/6358
• chore: rename plugins_envoy to envoy_dynamic_extensions for consistency with logs by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6362
• feat(recording) : include upstream host by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6364
• add protoreflect byteskind to storage indexing by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6376
• core/databroker: add a cache invalidator and invalidate cache when the storage backend changes by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6357
• core/zero: default envoy admin internal address in bootstrap config by @wasaga in https://github.com/pomerium/pomerium/pull/6382
• configapi: surface proto field comments as MCP tool descriptions by @wasaga in https://github.com/pomerium/pomerium/pull/6378
• mcp: carry session record version in access token by @wasaga in https://github.com/pomerium/pomerium/pull/6381
• feat(blob): file provider will always set no_tmp_dir to prevent issues in containerized environments by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6383
• session_recording: better recording protocol error responses by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6400
• core: refactor config, databroker proto packages, add go.mods by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6387
• fix(build): repair make generate by @wasaga in https://github.com/pomerium/pomerium/pull/6412
• mcp: allow CIMD query params by @wasaga in https://github.com/pomerium/pomerium/pull/6411
• ci: harden JS dependency supply chain by @desimone in https://github.com/pomerium/pomerium/pull/6227
• databrokerutil: add Reconciler unit tests by @kenjenkins in https://github.com/pomerium/pomerium/pull/6433
• Add websocket denial test by @desimone in https://github.com/pomerium/pomerium/pull/5622
• authorize: surface underlying error for unresolved MCP access token by @wasaga in https://github.com/pomerium/pomerium/pull/6442
• chore: better errors for reading recordings by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6441
• databrokerutil: add ReconcilerRunner unit tests by @kenjenkins in https://github.com/pomerium/pomerium/pull/6444
• databrokerutil: let Reconciler accept a ClientGetter by @kenjenkins in https://github.com/pomerium/pomerium/pull/6429
• envoyconfig: increase header size limits by @kenjenkins in https://github.com/pomerium/pomerium/pull/6449
• core/config: generate openapi spec from protobuf by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6421
• feat: health checks for envoy dynamic extensions by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6475
• test: e2e coverage for IdP claim propagation to JWT claim headers by @wasaga in https://github.com/pomerium/pomerium/pull/6476
• chore(logs): add iterate method for log reader by @calebdoxsey in https://github.com/pomerium/pomerium/pull/6482
• api: add option to force delete policy by @kenjenkins in https://github.com/pomerium/pomerium/pull/6489
• feat(mcp): add mcp_dynamic_client_registration runtime flag by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6483
• feat: enable mcp runtime flag by default by @backport-actions-token[bot] in https://github.com/pomerium/pomerium/pull/6533

Dependency Updates

• chore(deps): bump lodash from 4.17.21 to 4.17.23 in /ui by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6059
• chore(deps): bump github.com/exaring/otelpgx from 0.9.4 to 0.10.0 in the otel group by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6086
• chore(deps): bump the go group with 18 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6085
• chore(deps): bump github.com/charmbracelet/x/ansi from 0.11.3 to 0.11.4 in the tui group by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6087
• chore(deps): bump the github-actions group with 8 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6084
• chore(deps): bump the docker group in /.github with 3 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6082
• chore(deps): bump distroless/base-debian12 from f1a1796 to e8075f7 in the docker group by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6083
• chore(deps): bump the github-actions group with 6 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6160
• chore(deps): bump distroless/base-debian12 from e8075f7 to 1f87597 in the docker group by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6158
• chore(deps): bump minimatch in /ui by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6156
• chore(deps): bump the docker group in /.github with 3 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6157
• chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6163
• chore(deps): bump the go group across 1 directory with 21 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6169
• chore(deps): bump the otel group with 14 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6161
• chore(deps): bump github.com/docker/cli from 29.1.3+incompatible to 29.2.0+incompatible in /internal/tools by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6173
• chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 in /internal/tools by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6205
• chore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6206
• chore(deps): bump github.com/modelcontextprotocol/go-sdk from 1.4.0 to 1.4.1 by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6207
• chore(deps-dev): bump flatted from 3.3.3 to 3.4.2 in /ui by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6208
• chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2 in /ui by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6215
• chore(deps): bump yaml from 1.10.2 to 1.10.3 in /ui by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6214
• chore(deps): bump golang.org/x/image from 0.36.0 to 0.38.0 by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6221
• chore(deps): bump the go group with 21 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6234
• chore(deps): bump the github-actions group with 10 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6233
• chore(deps): bump the docker group in /.github with 2 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6231
• chore(deps): bump the otel group across 1 directory with 15 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6235
• chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6241
• chore(deps): bump lodash from 4.17.23 to 4.18.1 in /ui by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6240
• chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.42.0 to 1.43.0 by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6249
• chore(deps): bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6291
• migrate deprecated docker module by @kenjenkins in https://github.com/pomerium/pomerium/pull/6294
• update bufbuild tool by @kenjenkins in https://github.com/pomerium/pomerium/pull/6297
• chore(deps): bump the github-actions group with 8 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6319
• chore(deps): bump the docker group in /.github with 3 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6315
• chore(deps): bump distroless/base-debian12 from 1f87597 to fd8e2df in the docker group across 1 directory by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6314
• chore(deps): bump the otel group with 7 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6317
• chore(deps): bump ws from 8.19.0 to 8.20.1 in /internal/acceptance/ws-server by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6359
• chore(deps): bump the github-actions group with 7 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6396
• chore(deps-dev): bump the npm group in /internal/acceptance/browser with 2 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6390
• chore(deps): bump ws from 8.20.1 to 8.21.0 in /internal/acceptance/ws-server in the npm group by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6389
• chore(deps): bump distroless/base-debian12 from fd8e2df to ba85161 in the docker group by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6391
• chore(deps): bump github.com/getkin/kin-openapi from 0.124.0 to 0.131.0 by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6406
• chore(deps): bump the npm group across 1 directory with 18 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6395
• chore(deps): bump the github-actions group with 4 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6438
• chore(deps-dev): bump @types/node from 25.9.1 to 25.9.3 in /internal/acceptance/browser in the npm group across 1 directory by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6437
• chore(deps-dev): bump esbuild from 0.28.0 to 0.28.1 in /ui by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6451
• chore(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2 by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6455
• chore(deps): bump distroless/base-debian12 from ba85161 to b2a854c in the docker group by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6463
• chore(deps-dev): bump @playwright/test from 1.60.0 to 1.61.0 in /internal/acceptance/browser in the npm group by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6462
• update tui dependencies by @kralicky in https://github.com/pomerium/pomerium/pull/6469
• chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 in /pkg/grpc/databroker in the go-grpc-databroker group by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6488
• chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 in /pkg/grpc/config in the go-grpc-config group by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6487
• chore(deps): bump the github-actions group with 7 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6486
• chore(deps-dev): bump the npm group in /internal/acceptance/browser with 2 updates by @dependabot[bot] in https://github.com/pomerium/pomerium/pull/6478
• ci: upgrade to Go 1.26.0 by @wasaga in https://github.com/pomerium/pomerium/pull/6123
• ci: update update-dependencies script to Go 1.26 by @wasaga in https://github.com/pomerium/pomerium/pull/6125
• chore(ui): upgrade to React 19 by @nickytonline in https://github.com/pomerium/pomerium/pull/6417
• bump Go version to 1.26.3 by @kenjenkins in https://github.com/pomerium/pomerium/pull/6328
• bump envoy-custom to v1.37.0-rc3 by @kralicky in https://github.com/pomerium/pomerium/pull/6170
• ci: bump Node to 24.14.1 by @desimone in https://github.com/pomerium/pomerium/pull/6255
• chore: bump envoy custom to 16ede7a56f2f2c4de7011337193495e32d57ce3b by @alexandreLamarre in https://github.com/pomerium/pomerium/pull/6470
• run 'go mod tidy' by @kenjenkins in https://github.com/pomerium/pomerium/pull/6490

New Contributors

• @IngmarStein made their first contribution in https://github.com/pomerium/pomerium/pull/6259

Full Changelog: https://github.com/pomerium/pomerium/compare/v0.32.0...v0.33.0