chore: upgrade Dex to 2.35.0

[crenshaw-dev]

Supersedes #10617

Closes #10615

[jannfis]

LGTM

[codecov]

Codecov Report

Base: 45.65% // Head: 45.67% // Increases project coverage by +0.01% 🎉

Coverage data is based on head (c9abe8a) compared to base (202efb2).
Patch coverage: 66.66% of modified lines in pull request are covered.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #10775      +/-   ##
==========================================
+ Coverage   45.65%   45.67%   +0.01%     
==========================================
  Files         236      236              
  Lines       28702    28699       -3     
==========================================
+ Hits        13104    13108       +4     
+ Misses      13804    13799       -5     
+ Partials     1794     1792       -2     

Impacted Files	Coverage Δ
util/git/client.go	48.64% <66.66%> (-0.53%)	⬇️
cmd/argocd/commands/app.go	18.50% <0.00%> (-0.20%)	⬇️
util/settings/settings.go	51.36% <0.00%> (ø)
server/application/application.go	28.98% <0.00%> (+1.05%)	⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

[34fathombelow]

LGTM Thanks for your prompt response

[crenshaw-dev]

Just for a paper trail: this addresses GHSA-vh7g-p26c-j2cw for us. Argo CD configures the bundled Dex instance with a public client to be used by the argocd CLI. So our users should upgrade Dex to protect themselves from that vulnerability.

[crenshaw-dev]

Cherry-picked onto release-2.2 for 2.2.13, release-2.3 for 2.3.8, and release-2.4 for 2.4.13.

[mayurwaghmode]

Here when we can expect argocd dex server image will get updated to 2.35.0 from 2.32.0? - https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml#:~:text=image%3A%20ghcr.io/dexidp/dex%3Av2.32.0.
So that ppc64le users don't have to modify any manifest file :)
cc @crenshaw-dev @jannfis @34fathombelow

[crenshaw-dev]

@mayurwaghmode I failed to update the stable tag to point to v2.4.14 after the release (I'll create an issue about automating this).

The manifest looks correct now: https://github.com/argoproj/argo-cd/blob/stable/manifests/install.yaml#L9767

I think the raw response must be cached, because it still hasn't updated. Hopefully that'll change in a few minutes.

[mayurwaghmode]

Thanks @crenshaw-dev :)