v0.32.5

What's Changed

Changed

• update core to v0.32.4 by @calebdoxsey in #1348

Full Changelog: v0.32.4...v0.32.5

v0.32.4

Security

This release includes an update to Envoy v1.36.5, to address the following CVEs:

• CVE-2026-26330
• CVE-2026-26308
• CVE-2026-26310
• CVE-2026-26311
• CVE-2026-26309

What's Changed

Changed

• set core to v0.32.3, bump patch version by @kenjenkins in #1347

Full Changelog: v0.32.3...v0.32.4

v0.32.3

• Upgrades Pomerium core to v0.32.1

Full Changelog: v0.32.2...v0.32.3

v0.32.2

What's Changed

Changed

• maybe fix v0.32 by @calebdoxsey in #1325

Full Changelog: v0.32.1...v0.32.2

v0.32.1

What's Changed

Changed

• ingress-controller/gateway: fix missing source ppl by @backport-actions-token[bot] in #1324

Full Changelog: v0.32.0...v0.32.1

v0.32.0

What's Changed

Breaking

• ingress-controller/config: remove envoy options by @calebdoxsey in #1293

New

• add support for route idp_client_id and idp_client_secret by @calebdoxsey in #1283

Fixes

• config: sort certs to prevent churn by @wasaga in #1246

Changed

• chore: upgrade go 1.25 by @alexandreLamarre in #1284
• update docs for 'Secrets' field by @kenjenkins in #1298
• docs: fix broken documentation links in reference.md by @desimone in #1300
• chore: bump pomerium to f2e7e605bc3724a293a3b58d14b2f085682afae7 by @alexandreLamarre in #1301
• feat: add mcpAllowedClientIdDomains to Pomerium CRD by @wasaga in #1304

Dependency Updates

• build(deps): bump distroless/base-debian12 from 61e3d3d to e51574a in the docker group by @dependabot[bot] in #1263
• build(deps): bump the go group with 5 updates by @dependabot[bot] in #1264
• build(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 by @dependabot[bot] in #1268
• build(deps): bump the k8s group with 2 updates by @dependabot[bot] in #1265
• build(deps): bump the go group across 1 directory with 5 updates by @dependabot[bot] in #1276
• build(deps): bump the k8s group across 1 directory with 6 updates by @dependabot[bot] in #1277
• build(deps): bump the github-actions group with 6 updates by @dependabot[bot] in #1272
• build(deps): bump distroless/base-debian12 from e51574a to d26c2ee in the docker group by @dependabot[bot] in #1294
• build(deps): bump the go group with 3 updates by @dependabot[bot] in #1295
• build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #1297
• build(deps): bump the k8s group with 5 updates by @dependabot[bot] in #1296

New Contributors

• @desimone made their first contribution in #1300

Full Changelog: v0.31.3...v0.32.0

v0.31.3

Security

This release includes an update to Envoy v1.35.8, to address the following CVEs:

• CVE-2025-67514 / CVE-2025-62408
• CVE-2025-66220

What's Changed

• prepare for v0.31.3 release by @kenjenkins in #1286

Full Changelog: v0.31.2...v0.31.3

v0.30.8

Security

This release includes an update to Envoy v1.34.12, to address the following CVEs:

• CVE-2025-67514 / CVE-2025-62408
• CVE-2025-66220

What's Changed

• prepare for v0.30.8 release by @kenjenkins in #1285

Full Changelog: v0.30.7...v0.30.8

v0.31.2

What's Changed

Changed

• upgrade core to v0.31.2 by @calebdoxsey in #1279

Full Changelog: v0.31.1...v0.31.2

v0.30.7

Security

This release includes an update to Envoy v1.34.10, to address the following CVEs in Envoy and its dependencies:

• CVE-2025-62504
• CVE-2025-62409
• CVE-2025-27818
• CVE-2025-27817
• CVE-2025-0725
• CVE-2024-25178
• CVE-2024-25177
• CVE-2024-25176
• CVE-2024-11407

What's Changed

• prepare for v0.30.7 release by @kenjenkins in #1259

Full Changelog: v0.30.6...v0.30.7