Update quay.io/oauth2-proxy/oauth2-proxy Docker tag to v7.15.2

[renovate]

This PR contains the following updates:

Package	Update	Change
quay.io/oauth2-proxy/oauth2-proxy (source)	minor	v7.5.1 → v7.15.2

---

Release Notes

oauth2-proxy/oauth2-proxy (quay.io/oauth2-proxy/oauth2-proxy)

v7.15.2

Compare Source

v7.15.1

Compare Source

• #​3411 chore(deps): update gomod dependencies (@​tuunit)
• #​3333 fix: invalidate session on fatal OAuth2 refresh errors (@​frhack)
• GHSA-f24x-5g9q-753f fix: clear session cookie at beginning of signinpage handler (@​fnoehWM / @​bella-WI / @​tuunit)
• GHSA-5hvv-m4w4-gf6v fix: health check user-agent authentication bypass (@​tuunit)
• GHSA-7x63-xv5r-3p2x fix: authentication bypass via X-Forwarded-Uri header spoofing (@​tuunit)
• GHSA-pxq7-h93f-9jrg fix: fragment evaluation as part of the allowed routes (@​tuunit)
• GHSA-c5c4-8r6x-56w3 fix: email validation bypass via malformed multi-@​ email claims (@​tuunit)

v7.15.0

Compare Source

• #​3382 chore(deps): update gomod and golangci/golangci-lint to v2.11.4 (@​tuunit)
• #​3374 fix: handle Unix socket RemoteAddr in IP resolution (@​H1net)
• #​3381 fix: do not log error for backend logout 204 (@​artificiosus)
• #​3327 fix: improve logging when session refresh token is missing (@​yosri-brh)
• #​2767 fix: propagate errors during route building (@​sybereal)

v7.14.3

Compare Source

• #​3352 fix: backend logout URL call on sign out (#​3172)(@​vsejpal)
• #​3332 ci: distribute windows binary with .exe extension (@​igitur)
• #​2685 feat: allow arbitrary claims from the IDToken and IdentityProvider UserInfo endpoint to be added to the session state (@​vegetablest)
• #​3278 feat: possibility to inject id_token in redirect url during sign out (@​albanf)
• #​2851 feat: add support for specifying allowed OIDC JWT signing algorithms (#​2753) (@​andoks / @​tuunit)
• #​3369 fix: use CSRFExpire instead of Expire for CSRF cookie validation (@​Br1an67)
• #​3365 fix: filter empty strings from allowed groups (@​Br1an67)
• #​3338 feat: add --config-test flag for validating configuration (@​MayorFaj)
• #​3347 feat: add same site option for csrf cookies (@​jvnoije)
• #​3376 feat: allow setting unix socket file mode when declaring listener (@​Tristan971 / @​tuunit)

v7.14.2

Compare Source

• #​3183 fix: allow URL parameters to configure username, password and max idle connection timeout if the matching configuration is empty.

v7.14.1

Compare Source

• #​3314 revert: fix: skip provider button auth only redirect (#​3309) (@​StefanMarkmann / @​tuunit)
• #​3315 docs: clarify browser vs API routes for nginx auth_request redirects (@​StefanMarkmann)

v7.14.0

Compare Source

• #​3309 fix: Return 302 redirect from AuthOnly endpoint when skip-provider-button is true (@​StefanMarkmann)
• #​3302 fix: static upstreams failing validation due to passHostHeader and proxyWebSockets defaults being set incorrectly (@​sourava01 / @​tuunit)
• #​3312 chore(deps): upgrade to go1.25.6 and latest dependencies (@​tuunit)

v7.13.0

Compare Source

• #​2628 feat(structured config): revamp of yaml parsing using mapstructure decoder and custom decoders (@​tuunit)
• #​3197 fix: NewRemoteKeySet is not using DefaultHTTPClient (@​rsrdesarrollo / @​tuunit)
• #​3292 chore(deps): upgrade gomod and bump to golang v1.25.5 (@​tuunit)
• #​3304 fix: added conditional so default is not always set and env vars are honored fixes 3303 (@​pixeldrew)
• #​3264 fix: more aggressively truncate logged access_token (@​MartinNowak / @​tuunit)
• #​3267 fix: Session refresh handling in OIDC provider (@​gysel)
• #​3290 fix: WebSocket proxy to respect PassHostHeader setting (@​UnsignedLong)

v7.12.0

Compare Source

• #​3228 fix: use GetSecret() in ticket.go makeCookie to respect cookie-secret-file (@​stagswtf)
• #​3244 chore(deps): upgrade to latest go1.25.3 (@​tuunit)
• #​3238 chore: Replace pkg/clock with narrowly targeted stub clocks (@​dsymonds)
• #​3237 - feat: add option to use organization id for preferred username in Google Provider (@​pixeldrew)
• GHSA-vjrc-mh2v-45x6 fix: request header smuggling by stripping all normalized header variants (@​tuunit)
• #​1933 fix: validation of refreshed sessions using the access_token in the OIDC provider (@​gysel / @​tuunit)
• #​2841 feat: add allowed_* constraint option to proxy endpoint query string (@​jacobalberty)

v7.11.0

Compare Source

• #​2273 feat: add Cidaas provider (@​Bibob7, @​Teko012)
• #​3166 chore(dep): upgrade to latest golang 1.24.6 (@​tuunit)
• #​3156 feat: allow disable-keep-alives configuration for upstream (@​jet-go)
• #​3150 fix: Gitea team membership (@​MagicRB, @​tuunit)

v7.10.0

Compare Source

• #​2615 feat(cookies): add option to set a limit on the number of per-request CSRF cookies oauth2-proxy sets (@​bh-tt)
• #​2605 fix: show login page on broken cookie (@​Primexz)
• #​2743 feat: allow use more possible google admin-sdk api scopes (@​BobDu)
• #​2359 feat: add SourceHut (sr.ht) provider(@​bitfehler)
• #​2524 fix: regex substitution for $ signs in upstream path handling before running envsubst (@​dashkan / @​tuunit)
• #​3104 feat(cookie): add feature support for cookie-secret-file (@​sandy2008)
• #​3055 feat: support non-default authorization request response mode also for OIDC providers (@​stieler-it)
• #​3138 feat: make google_groups argument optional when using google provider (@​sourava01)
• #​3093 feat: differentiate between "no available key" and error for redis sessions (@​nobletrout)
• GHSA-7rh7-c77v-6434 fix: skip_auth_routes bypass through query parameter inclusion

v7.9.0

Compare Source

• #​3072 feat: support for multiple github orgs #​3072 (@​daniel-mersch)
• #​3116 feat: bump to go1.24.5 and full dependency update (@​wardviaene / @​dolmen)
• #​3097 chore(deps): update alpine base image to v3.22.0
• #​3101 fix: return error for empty Redis URL list (@​dgivens)

v7.8.2

Compare Source

• #​3031 Fixes Refresh Token bug with Entra ID and Workload Identity (#​3027)[#​3028] by using client assertion when redeeming the token (@​richard87)
• #​3001 Allow to set non-default authorization request response mode (@​stieler-it)
• #​3041 chore(deps): upgrade to latest golang v1.23.x release (@​TheImplementer)
• #​1916 fix: role extraction from access token in keycloak oidc (@​Elektordi / @​tuunit)
• #​3014 feat: ability to parse JWT encoded profile claims (@​ikarius)

v7.8.1

Compare Source

• #​2918 feat: add --bearer-token-login-fallback (@​carillonator)
• #​2927 chore(deps/build): bump golang to 1.23 and use go.mod as single point of truth for all build files (@​tuunit)
• #​2697 Use Max-Age instead of Expires for cookie expiration (@​matpen-wi)
• #​2969 Update golang.org/x/oauth2 to v0.27.0 to address CVE-2025-22868 (@​dsymonds)
• #​2977 Update golang.org/x/net to v0.36.0 to address CVE-2025-22870 (@​dsymonds)
• #​2982 chore(deps): remove go:generate tool from go.mod (@​dolmen)
• #​3011 chore(deps): update golang dependencies and pin to latest golang v1.23.x release (@​tuunit)
• #​2967 Update HashNonce to use crypto/sha256 (@​egibs)

v7.8.0

Compare Source

• #​2887 fix: jwt regex validation error during skip-jwt-bearer-tokens flow
• #​2920 fix: missing oauth2-proxy version for docker builds

v7.7.1

Compare Source

• #​2390 feat: add Microsoft Entra ID provider (@​jjlakis / @​tuunit)
• #​2902 feat(entra): add Workload Identity support for Entra ID (@​jjlakis)
• #​2800 doc: add some opencontainer labels to docker image (@​halkeye)
• #​2755 feat: add X-Envoy-External-Address as supported header (@​bjencks)
• #​1985 feat: add support for systemd socket (@​isodude)
• #​2916 fix: systemd socket support build handling for windows (@​tuunit)
• #​2300 fix: add fix for websocket path rewrite (@​rekup)
• #​2821 feat: add CF-Connecting-IP as supported real ip header (@​ondrejsika)
• #​2620 fix: update code_verifier to use recommended method (@​vishvananda)
• #​2376 feat: static public keys file support for oidc provider (@​axel7083 / @​jjlakis)
• #​2392 chore: extend test cases for oidc provider and documentation regarding implicit setting of the groups scope when no scope was specified in the config (@​jjlakis / @​tuunit)

v7.7.0

Compare Source

• #​2803 fix: self signed certificate handling in v7.7.0 (@​tuunit)
• #​2619 fix: unable to use hyphen in JSON path for oidc-groups-claim option (@​rd-danny-fleer)
• #​2311 fix: runtime error: index out of range (0) with length 0 (@​miguelborges99 / @​tuunit)

v7.6.0

Compare Source

• #​2539 pkg/http: Fix leaky test (@​isodude)
• #​4917 Upgraded all modules to the latest version (@​pierluigilenoci)
• #​2570 Set default user agent to oauth2-proxy/$version (from default Golang one)
• #​2674 docs: additional notes about available claims for HeaderValue (@​vegetablest)
• #​2459 chore(deps): Updated to ginkgo v2 (@​kvanzuijlen, @​tuunit)
• #​2112 docs: update list of providers which support refresh tokens (@​mikefab-msf)
• #​2734 Added s390x architecture option support (@​priby05)
• #​2589 Added support for regex path matching and rewriting when using a static file: upstream (@​ianroberts)
• #​2790 chore(deps): update all golang dependencies (@​tuunit)
• #​2607 fix(csrf): fix possible infinite loop (@​Primexz)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.