All pull requests

Pull requests

• docs(security): direct vulnerability reports to GitHub private reporting

  release-note/ignore
  #5152·sagikazarmark opened Nov 11, 2026Member·

  ·

• fix(server): use invalid_request for an unsupported subject_token_type and reject any typ other than JWT

  #5150·kanywst opened Nov 11, 2026Contributor·

  ·
  1

• fix(server/grants): check requested_token_type before calling the connector in token exchange

  #5149·kanywst opened Nov 11, 2026Contributor·

  ·

• feat(connector/microsoft): add groupsFilter support

  area/policy
  #5134·henningfleege opened Nov 5, 2026·

  ·
  1

• feat(server): RFC 8693 delegation in token exchange

  #5130·QuentinBisson opened Nov 3, 2026·

  ·

• docs: DEP 5101, RFC 8693 delegation in token exchange

  #5119·QuentinBisson opened Oct 27, 2026·

  ·

• feat(oidc): send id_token_hint on upstream logout

  #5112·preiter93 opened Oct 26, 2026·

  ·

• feat(oidc): add userInfoRequestMethod to choose GET or POST for userinfo

  kind/enhancement
  #5102·cvas22 opened Oct 23, 2026·

  ·
  1

  4

• fix(connector/github): return UserNotInRequiredGroupsError when user lacks org or team access

  #5100·Jojoussef opened Oct 22, 2026·

  ·
  1

• fix(connector/google): pass domain to groups.list when not impersonating an admin

  #5098·keramblock opened Oct 22, 2026·

  ·

• fix(storage): store an unset auth_time on MySQL

  #5089·basitalisandhu opened Oct 19, 2026·

  ·
  1

• fix(storage/ent): permit empty optional fields for AuthCode and Client

  #5084·AdamMagued opened Oct 18, 2026Contributor·

  ·
  1

• feat: add jwt connector for upstream JWT bearer tokens

  #5083·FireDrunk opened Oct 16, 2026·

  ·

• feat(server): allow starting without connectors when the connectors API is enabled

  #5061·ABGEO opened Oct 8, 2026·

  ·

• feat: add OIDC picture claim for user avatars

  #5056·sylr opened Oct 4, 2026Contributor·

  ·

• fix: reload server TLS after Kubernetes Secret updates

  #5053·CBEPX opened Oct 1, 2026·

  ·

• fix: reload server certificates for clients without SNI

  #5052·CBEPX opened Oct 1, 2026·

  ·

• fix: keep the last valid TLS configuration on reload errors

  #5051·CBEPX opened Oct 1, 2026·

  ·

• fix(oidc): bound the fetch of the issuer's signing keys

  kind/bug
  #5050·The127 opened Sep 30, 2026Contributor·

  ·

• build(deps): let Dependabot track the docker-compose images

  #5048·JanWelker opened Sep 29, 2026Contributor·

  ·

• feat: added the amr claim to JWTs

  #5043·ston1th opened Sep 26, 2026·

  ·
  1

• fix(httpclient): reload file-backed root CAs before requests

  #5033·CBEPX opened Sep 22, 2026·

  ·

• server: prefill the password login form from the OIDC login_hint

  #5019·okigan opened Sep 14, 2026·

  ·

• feat(storage/kubernetes): add crdHandling skip mode to disable CRD creation

  #5018·Retr0-XD opened Sep 13, 2026·

  ·
  1

  1

• fix(apiserver): refuse an identity purge that cannot finish

  #5000·rasty94 opened Sep 3, 2026·

  ·