Andrei Aaron 9425ca8b7d fix(auth): prevent open redirect via callback_ui (#3844) ...

Validate callback_ui and default invalid values to /.
Allow absolute callback_ui only when its origin is allowlisted via http.auth.openid.callbackAllowOrigins (and externalUrl).
Add/adjust unit + controller tests and update examples/docs for relative vs allowlisted absolute redirect

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

2026-03-08 08:13:16 +02:00

..

api

fix(auth): prevent open redirect via callback_ui (#3844)

2026-03-08 08:13:16 +02:00

cel

Introduce support for OIDC workload identity federation (#3711)

2026-01-24 21:03:53 -08:00

cli

GCS storage support (#3798)

2026-02-18 23:41:21 -08:00

cluster

chore: update golangci-lint and fix all issues (#3575)

2025-11-22 23:36:48 +02:00

common

fix(meta): fixes for LastUpdated and TaggedTimestamp (#3754)

2026-02-03 21:10:35 +02:00

compat

chore: update golangci-lint and fix all issues (#3575)

2025-11-22 23:36:48 +02:00

compliance

chore: update golangci-lint and fix all issues (#3575)

2025-11-22 23:36:48 +02:00

debug

fix: graphql playground documentation was hardcoded to an unrelated example (#3721)

2026-01-21 09:28:49 +02:00

exporter

chore: Enable Go jsonv2 experiment and update the trivy dependency (v0.67.2) (#3572)

2025-11-27 09:58:37 +02:00

extensions

feat(sync): add SyncLegacyCosignTags config to skip syncing legacy cosign/SBOM tags when disabled (#3842)

2026-03-06 19:12:31 +02:00

log

fix: make sure the function and caller information are added to log messages emitted by 3rd party libraries using slog directly. (#3659)

2025-12-19 07:32:13 +02:00

meta

fix(meta): fixes for LastUpdated and TaggedTimestamp (#3754)

2026-02-03 21:10:35 +02:00

regexp

chore: update golangci-lint and fix all issues (#3575)

2025-11-22 23:36:48 +02:00

requestcontext

chore: update golangci-lint and fix all issues (#3575)

2025-11-22 23:36:48 +02:00

retention

fix: prevent nil pointer dereference in RemoveImageFromRepoMeta (#3658)

2025-12-17 11:44:51 +02:00

scheduler

refactor(test): new apis for creating temporary files (#3605)

2025-12-05 09:54:38 +02:00

storage

GCS storage support (#3798)

2026-02-18 23:41:21 -08:00

test

GCS storage support (#3798)

2026-02-18 23:41:21 -08:00