Update ghcr.io/dexidp/dex Docker tag to v2.45.1#2799
Update ghcr.io/dexidp/dex Docker tag to v2.45.1#2799gardener-ci-robot wants to merge 1 commit intomasterfrom
Conversation
gardener-ci-robot
requested review from
grolu,
holgerkoser and
klocke-io
as code owners
gardener-ci-robot
added
renovate
kind/enhancement
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
gardener-prow
bot
added
cla: yes
📝 WalkthroughWalkthroughUpdated the Dex identity chart's image tag in the Helm values file from v2.44.0-distroless to v2.45.1-distroless. No other configuration, logic, or public API changes were made. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
/hold track next Dex release notes for gomplate/CVE resolution |
gardener-prow
bot
added
the
do-not-merge/hold
gardener-ci-robot
force-pushed
the
renovate/ghcr.io-dexidp-dex-2.x
branch
from
8f2e59d to
0f8d440
Compare
gardener-ci-robot
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@charts/identity/values.yaml`:
- Line 8: The image tag under the YAML key `tag` currently uses the non-existent
value `v2.45.1-distroless`; change that to an existing release (e.g., `v2.45.0`
or `v2.45.0-distroless`) in the values.yaml `tag` entry and, if your deployment
uses gomplate preprocessing, disable or avoid gomplate-based preprocessing until
upstream fixes are released (or explicitly document the CVE risk) so you don't
rely on the vulnerable gomplate in the Dex image.
| image: | ||
| repository: ghcr.io/dexidp/dex | ||
| tag: v2.44.0-distroless | ||
| tag: v2.45.1-distroless |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check Dex versions available and CVE information
echo "=== Checking GitHub releases for v2.45.x ==="
# Using GitHub API to fetch releases containing v2.45
curl -s https://api.github.com/repos/dexidp/dex/releases | jq -r '.[].tag_name' 2>/dev/null | grep -E "v2\.45" | sort -V
echo ""
echo "=== Checking git tags for v2.45.x ==="
curl -s https://api.github.com/repos/dexidp/dex/git/refs/tags | jq -r '.[].ref' 2>/dev/null | grep -E "v2\.45" | sort -VRepository: gardener/dashboard
Length of output: 197
🌐 Web query:
Dex v2.45.1 release information CVE gomplate
💡 Result:
As of March 3, 2026, the dexidp/dex project does not have a v2.45.1 release tag; the latest in that series is v2.45.0 (Feb 23, 2026). [1]
For the gomplate/CVE part, the v2.45.0 release notes say: [2]
gomplatein the Dex container image was bumped to v5.0.0 (breaking changes).- The release explicitly calls out two known CVEs in the bundled
gomplatebinary: CVE-2025-68121 and CVE-2026-25934. gomplateis described as optional and used only for preprocessing configuration files; Dex maintainers plan to update it once upstream fixes are available.
Sources:
[1] Dex tags list (shows latest tag v2.45.0; no v2.45.1) (github.com)
[2] Dex v2.45.0 GitHub release notes (Know Before Upgrade section) (github.com)
Citations:
🌐 Web query:
CVE-2025-68121 CVE-2026-25934 gomplate dex
💡 Result:
-
How this relates to Dex/gomplate: Dex’s v2.45.0 release notes state that the container image includes a
gomplatebinary with two known CVEs: CVE-2025-68121 and CVE-2026-25934. Dex also notesgomplateis optional and used only to preprocess configuration files, and the image will be updated oncegomplateis fixed upstream. [1] -
CVE-2025-68121 (Go stdlib crypto/tls): A Go standard library issue where, during TLS session resumption, mutating
tls.Configtrust fields (ClientCAs/RootCAs) between the original and resumed handshake can allow the resumed handshake to succeed when it should fail. Fixed in specific Go patch releases (see Go’s advisory for the exact version ranges). [2][3] -
CVE-2026-25934 (go-git): A vulnerability in github.com/go-git/go-git where integrity check values for Git
.packand.idxfiles were not properly verified, potentially causing consumption of corrupted data and errors (e.g., “object not found”). Fixed in go-git v5.16.5; NVD lists CVSS 4.3 (Medium) from GitHub. [4][5]
Practical impact / what to do (Dex context):
- If you don’t use gomplate features in Dex, avoid enabling gomplate-based preprocessing (Dex calls it optional) to eliminate that exposure path. [1]
- If you do need gomplate, track for an updated
gomplate(or Dex image) that incorporates Go’s fix for CVE-2025-68121 and updates go-git to v5.16.5+ (fix for CVE-2026-25934). [1][2][5]
Sources
- Dex v2.45.0 release notes (Know Before Upgrade) — gomplate CVEs called out: CVE-2025-68121, CVE-2026-25934. [1]
- Go vulnerability report GO-2026-4337 for CVE-2025-68121 (crypto/tls) and fixed Go version ranges. [2]
- NVD entry for CVE-2025-68121. [3]
- NVD entry for CVE-2026-25934 (description, fix in 5.16.5, CVSS from GitHub). [4]
- GitHub Security Advisory GHSA-37cx-329c-33x3 (CVE-2026-25934) — affected <=5.16.4, patched 5.16.5. [5]
Do not merge: image tag v2.45.1-distroless does not exist.
The official Dex repository (dexidp/dex) does not have a v2.45.1 release; the latest available version is v2.45.0 (Feb 23, 2026). The image tag v2.45.1-distroless referenced in this PR does not exist.
The v2.45.0 release includes two known CVEs in the bundled gomplate binary (CVE-2025-68121 and CVE-2026-25934). Since gomplate is optional and used only for preprocessing configuration files, the exposure can be mitigated by not using gomplate-based preprocessing. Dex maintainers plan to update the image once upstream fixes are available.
Additionally, gomplate has been bumped to v5.0.0, which includes breaking changes. If gomplate preprocessing is used, review the breaking changes carefully.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@charts/identity/values.yaml` at line 8, The image tag under the YAML key
`tag` currently uses the non-existent value `v2.45.1-distroless`; change that to
an existing release (e.g., `v2.45.0` or `v2.45.0-distroless`) in the values.yaml
`tag` entry and, if your deployment uses gomplate preprocessing, disable or
avoid gomplate-based preprocessing until upstream fixes are released (or
explicitly document the CVE risk) so you don't rely on the vulnerable gomplate
in the Dex image.
2 participants
This PR contains the following updates:
v2.44.0-distroless→v2.45.1-distrolessRelease Notes
dexidp/dex (ghcr.io/dexidp/dex)
v2.45.1Compare Source
Bug Fixes 🐛
groupsreserved word in query replacer to fix MySQL 8.0+ storage migration (#4580)authproxyandoauthto match CallbackConnector interface (#4589)Full Changelog: dexidp/dex@v2.45.0...v2.45.1
v2.45.0Compare Source
Know Before Upgrade
gomplatehas been bumped to v5.0.0, which includes breaking changes. Here is the full list.gomplatebinary -CVE-2025-68121andCVE-2026-25934.gomplateis only used for preprocessing configuration files and is optional. Once the CVEs are fixed upstream, the version of gomplate in the dex image will be updated accordingly.ContinueOnConnectorFailurefeature flag is now enabled by default. To disable it, use the following environment variable:DEX_CONTINUE_ON_CONNECTOR_FAILURE=false.v2.minor+1.0-yyyymmdd-commithash.What's Changed
Exciting New Features 🎉
Enhancements 🚀
ContinueOnConnectorFailurefeature flag by @manojVivek in #4495Bug Fixes 🐛
Dependency Updates ⬆️
a9f88e0toe8a4044by @dependabot[bot] in #431320ee0b6toaee43c3by @dependabot[bot] in #4371e8a4044to2b7c93fby @dependabot[bot] in #4427b5b9fd0tof9f84bdby @dependabot[bot] in #4468d9c983dtoad295fcby @dependabot[bot] in #4493f9f84bdto01e550fby @dependabot[bot] in #4546Other Changes
New Contributors
Full Changelog: dexidp/dex@v2.44.0...v2.45.0
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.