Release v0.8.0

Auth Module Release v0.8.0

Welcome to the latest release of the Auth module for the SIGHUP Distribution.

This release adds support for Kubernetes 1.36, updates Pomerium to the latest version
available upstream, which includes two security fixes, updates Gangplank to v1.3.0, and
removes support for Kubernetes version 1.32 and earlier.

Included packages

Package	Current Version	Previous Version
dex	v2.45.1	No update
gangplank	v1.3.0	v1.2.1
pomerium	v0.33.1	v0.32.7

Compatibility

This release adds support for Kubernetes 1.36.x while maintaining compatibility with
versions 1.33.x through 1.35.x. Support for Kubernetes 1.32.x and earlier has been dropped.

Notable changes

Pomerium moves from v0.32.7 to v0.33.1, which includes two security fixes:

• CVE-2026-47774 (High), an HTTP/2
  memory exhaustion via cookie header HPACK amplification, fixed by the Envoy 1.36.8
  update in Pomerium v0.32.9.
• GHSA-ggw3-5987-rx77
  (High), a pre-authentication memory exhaustion in the HPKE callback, fixed in Pomerium
  v0.32.8. Upstream reports that self-hosted stateful deployments, which is how this module
  deploys Pomerium, are not affected.

Pomerium's container image is now based on distroless base-nossl, and the embedded Envoy
proxy has been updated to the 1.37 line.

Breaking Changes 💔

• Clusters running Kubernetes 1.32 or older are no longer supported and should be upgraded before upgrading to this module version.

Update Guide 🦮

Process

To upgrade this module from v0.7.0 to v0.8.0, you need to download this new version, then
apply the kustomize project.

kustomize build | kubectl apply -f -